Skype Virus - ' Dies ist ein sehr schönes Foto von dir '

Batlo · 22.05.2013, 19:45

Hallo

,
Ich denke , dass ich auf ein Skype Virus reingefallen bin...
Ein Bekannter aus meiner Freundesliste hat mir eine Nachricht mit : 'Dies ist ein sehr schönes Foto von dir' und einem Link gesendet, vor lauter erstaunen über ein Bild von mir habe ich blind auf den Link geklickt und diese Datei heruntergeladen.
Wenige Sekunden später ging die selbe Nachricht an all meine Freunde.
Ich hab die heruntergeladene Datei gelöscht aber mein Skype schließt sich immer noch automatisch und es werden weiter Nachrichten an meine Freunde geschickt ( ich hab sie alle aufgefordert die Nachrichten zu ignorieren ).
Ich hab Avira Free Antivirus schon durchlaufen lassen aber die Nachrichten werden weiter gesendet.

Ich glaube das es hier um da selbe Problem geht jedoch hat der Betroffene schneller gehandelt als ich und sein Skype wurde 'verschont' http://www.trojaner-board.de/135277-skype-virus.html

Jetzt frag ich mich was ich machen soll bzw. machen kann um den Virus endgültig runter zu
hauen.

mfg Batlo

markusg · 22.05.2013, 19:50

Hi, informiere auch mal den Absender, der hat den Link nich absichtlich versendet, und sollte sich melden.

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die
Textbox.

Code:

ATTFilter

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
C:\Windows\system32\*.tsp
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Batlo · 22.05.2013, 21:31

OTL.txt:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 22.05.2013 21:31:57 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Kehrer\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 6,12 Gb Available Physical Memory | 76,67% Memory free
15,97 Gb Paging File | 14,29 Gb Available in Paging File | 89,49% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931,41 Gb Total Space | 551,20 Gb Free Space | 59,18% Space Free | Partition Type: NTFS
Drive D: | 7,59 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: EXTR3M | User Name: Kehrer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.05.22 21:29:20 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Kehrer\Desktop\OTL.exe
PRC - [2013.05.22 01:01:16 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2013.05.22 01:00:59 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2013.05.22 01:00:58 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.04.27 14:29:40 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2013.02.26 00:32:22 | 001,260,320 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2013.01.26 08:08:30 | 004,480,768 | ---- | M] (Akamai Technologies, Inc.) -- C:\Users\Kehrer\AppData\Local\Akamai\netsession_win.exe
PRC - [2013.01.18 08:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.01.24 03:08:52 | 000,770,728 | ---- | M] () -- C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe
PRC - [2010.11.17 03:53:16 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
PRC - [2010.11.05 23:54:22 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.11.05 23:54:20 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2006.11.03 11:01:16 | 000,319,488 | ---- | M] (PixArt Imaging Incorporation) -- C:\Windows\PixArt\Pac207\Monitor.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.05.16 03:27:22 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\30e3a21202000677d0a9270572251477\System.Windows.Forms.ni.dll
MOD - [2013.05.16 03:27:11 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\716959df79685a1eae0fc14275a32b0f\WindowsBase.ni.dll
MOD - [2013.05.16 03:27:08 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll
MOD - [2013.02.14 08:34:26 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\5ecf01964c70e453d71e5d7653912ff9\System.Web.ni.dll
MOD - [2013.01.10 17:08:33 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\4d6518ef6ae8d6f005c49ab1c86de7fe\IAStorCommon.ni.dll
MOD - [2013.01.10 17:08:32 | 000,475,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\ab54c04b3df40416205883b4049fe273\IAStorUtil.ni.dll
MOD - [2013.01.10 15:14:23 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll
MOD - [2013.01.10 15:13:36 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll
MOD - [2013.01.10 15:12:53 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll
MOD - [2013.01.10 15:12:48 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013.01.10 15:12:43 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll
MOD - [2012.08.27 22:33:32 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012.08.27 22:33:08 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.01.24 03:08:52 | 000,770,728 | ---- | M] () -- C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe
MOD - [2010.11.13 02:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.04.01 19:24:28 | 001,159,168 | ---- | M] () -- C:\Program Files (x86)\Lexmark S300-S400 Series\lxeaDRS.dll
MOD - [2010.04.01 19:23:27 | 000,389,120 | ---- | M] () -- C:\Program Files (x86)\Lexmark S300-S400 Series\lxeascw.dll
MOD - [2009.06.10 23:41:46 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2009.05.27 14:16:50 | 000,192,512 | ---- | M] () -- C:\Program Files (x86)\Lexmark S300-S400 Series\lxeadatr.dll
MOD - [2009.03.10 07:43:49 | 000,155,648 | ---- | M] () -- C:\Program Files (x86)\Lexmark S300-S400 Series\lxeacaps.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2010.04.14 22:45:36 | 001,052,328 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxeacoms.exe -- (lxea_device)
SRV:64bit: - [2010.04.06 16:30:38 | 000,031,272 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysNative\AppleChargerSrv.exe -- (AppleChargerSrv)
SRV - [2013.05.22 01:01:16 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.05.22 01:00:59 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2013.05.15 06:54:14 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.05.04 01:35:30 | 000,543,656 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2013.04.27 14:29:40 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2013.04.23 14:48:24 | 000,009,216 | ---- | M] (Hi-Rez Studios) [Auto | Stopped] -- C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe -- (HiPatchService)
SRV - [2013.04.19 15:14:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013.04.05 16:48:14 | 000,049,152 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\BattlEye\BEService.exe -- (BEService)
SRV - [2013.03.21 18:12:46 | 004,561,152 | ---- | M] () [Auto | Running] -- c:\program files (x86)\common files\akamai/netsession_win_ca0e279.dll -- (Akamai)
SRV - [2013.02.26 00:32:22 | 001,260,320 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2013.01.19 01:21:29 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.01.18 08:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.12.10 18:29:46 | 002,465,712 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2012.07.09 00:40:10 | 000,104,912 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.05.15 21:25:00 | 004,264,632 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
SRV - [2010.11.05 23:54:22 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.04.14 22:45:21 | 000,598,696 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysWOW64\lxeacoms.exe -- (lxea_device)
SRV - [2009.08.18 13:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013.05.22 01:01:25 | 000,130,016 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2013.05.22 01:01:25 | 000,100,712 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2013.05.22 01:01:25 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.09.28 11:32:56 | 000,053,760 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.08.21 14:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.09.21 11:25:54 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\cpuz135_x64.sys -- (cpuz135)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.01.10 18:16:08 | 000,021,104 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\drivers\AppleCharger.sys -- (AppleCharger)
DRV:64bit: - [2010.12.24 09:32:54 | 000,412,264 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.19 04:34:26 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010.11.19 04:34:26 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010.11.05 23:45:48 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.09.21 09:59:38 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.07.01 14:21:50 | 000,038,992 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys -- (ScreamBAudioSvc)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.03.18 16:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2008.08.14 06:48:34 | 000,024,064 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\skfiltv.sys -- (skfiltv)
DRV:64bit: - [2006.12.05 11:34:26 | 000,572,416 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PFC027.SYS -- (PAC207)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2005.01.04 02:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\npptNT2.sys -- (NPPTNT2)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,Backup.Old.DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-3281158987-627306578-157583830-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKU\S-1-5-21-3281158987-627306578-157583830-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
IE - HKU\S-1-5-21-3281158987-627306578-157583830-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-3281158987-627306578-157583830-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7E 6B 95 9F 22 AA CC 01  [binary data]
IE - HKU\S-1-5-21-3281158987-627306578-157583830-1000\..\SearchScopes,Backup.Old.DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-3281158987-627306578-157583830-1000\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-21-3281158987-627306578-157583830-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3281158987-627306578-157583830-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>;*.local
 
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://grooveshark.com/"
FF - prefs.js..extensions.enabledAddons: groovesharkProxy%40DannieDarko:1.2.2
FF - prefs.js..extensions.enabledAddons: groovesharkUnlocker%40overlord1337:1.3
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1
FF - prefs.js..network.proxy.no_proxies_on: "127.0.0.1:9421"
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=2.1.3: C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Kehrer\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Kehrer\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\IB UPDATER\FIREFOX
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.01.19 01:21:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012.03.01 22:46:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kehrer\AppData\Roaming\mozilla\Extensions
[2012.12.31 22:38:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kehrer\AppData\Roaming\mozilla\Firefox\Profiles\uta1vmja.default\extensions
[2012.10.28 13:58:28 | 000,000,000 | ---D | M] (Grooveshark Proxy) -- C:\Users\Kehrer\AppData\Roaming\mozilla\Firefox\Profiles\uta1vmja.default\extensions\groovesharkProxy@DannieDarko
[2012.12.31 22:38:23 | 000,029,022 | ---- | M] () (No name found) -- C:\Users\Kehrer\AppData\Roaming\mozilla\firefox\profiles\uta1vmja.default\extensions\groovesharkUnlocker@overlord1337.xpi
[2013.01.19 01:21:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.01.19 01:21:29 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.11.20 08:17:14 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.11.20 08:17:14 | 000,002,058 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Kehrer\AppData\Local\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Kehrer\AppData\Local\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Kehrer\AppData\Local\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Users\Kehrer\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Java(TM) Platform SE 7 U5 (Enabled) = C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Kehrer\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll
CHR - plugin: Java Deployment Toolkit 7.0.50.255 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - Extension: Deadmau5 Blue Edition = C:\Users\Kehrer\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiklhkepfpikmjoachlckldbcdapckbm\1.1_1\
CHR - Extension: Battlefield Heroes = C:\Users\Kehrer\AppData\Local\Google\Chrome\User Data\Default\Extensions\cehdakiococlfmjcbebbkjkfjhbieknh\5.0.203.0_0\
CHR - Extension: Grooveshark Germany unlocker = C:\Users\Kehrer\AppData\Local\Google\Chrome\User Data\Default\Extensions\docdgimmdejoiemdafcgeodchlbllgac\2.3.4_0\
CHR - Extension: Grooveshark Germany unlocker = C:\Users\Kehrer\AppData\Local\Google\Chrome\User Data\Default\Extensions\docdgimmdejoiemdafcgeodchlbllgac\2.3.4_0\.orig
CHR - Extension: AdBlock = C:\Users\Kehrer\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.63_0\
CHR - Extension: Skype Click to Call = C:\Users\Kehrer\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\
CHR - Extension: AdBlock = C:\Users\Kehrer\AppData\Local\Google\Chrome\User Data\Default\Extensions\onomnaapllbibeeggnncehgfnkfafpfb\0.2_0\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files (x86)\Lexmark Toolbar\toolband.dll ()
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Lexmark ) - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Programme\Lexmark Printable Web\bho.dll ()
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files (x86)\Lexmark Toolbar\toolband.dll ()
O3 - HKU\S-1-5-21-3281158987-627306578-157583830-1000\..\Toolbar\WebBrowser: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files (x86)\Lexmark Toolbar\toolband.dll ()
O4:64bit: - HKLM..\Run: [lxeamon.exe] C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe ()
O4:64bit: - HKLM..\Run: [Monitor] C:\Windows\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3281158987-627306578-157583830-1000..\Run: [Akamai NetSession Interface] C:\Users\Kehrer\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.)
O4 - HKU\S-1-5-21-3281158987-627306578-157583830-1000..\Run: [Clownfish]  File not found
O4 - HKU\S-1-5-21-3281158987-627306578-157583830-1000..\Run: [RGSC] C:\Program Files (x86)\Steam\SteamApps\common\Grand Theft Auto IV\GTAIV\RGSCLauncher.exe /silent File not found
O4 - HKU\S-1-5-21-3281158987-627306578-157583830-1001..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-3281158987-627306578-157583830-1001..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~3\OFFICE11\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~3\OFFICE11\EXCEL.EXE/3000 File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-3281158987-627306578-157583830-1000\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-3281158987-627306578-157583830-1000\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-3281158987-627306578-157583830-1000\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-3281158987-627306578-157583830-1000\..Trusted Domains: sony.com ([]* in Trusted sites)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3887C743-7838-4C1D-A646-D191AC07EE0F}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ipp - No CLSID value found
O18:64bit: - Protocol\Handler\ipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.12.01 13:15:56 | 000,206,657 | R--- | M] () - D:\Autorun.ico -- [ CDFS ]
O32 - AutoRun File - [2012.05.14 15:03:14 | 000,000,106 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{32debecd-2488-11e1-9df1-1c6f65f9ec8b}\Shell - "" = AutoRun
O33 - MountPoints2\{32debecd-2488-11e1-9df1-1c6f65f9ec8b}\Shell\AutoRun\command - "" = E:\KODAK_Software_Downloader.exe
O33 - MountPoints2\{444fbab0-c31b-11e0-9732-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{444fbab0-c31b-11e0-9732-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Run.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.05.22 21:29:18 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Kehrer\Desktop\OTL.exe
[2013.05.22 12:36:35 | 000,000,000 | ---D | C] -- C:\Users\Kehrer\AppData\Roaming\Avira
[2013.05.22 12:36:19 | 000,083,160 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avnetflt.sys
[2013.05.22 12:35:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2013.05.22 12:35:28 | 000,130,016 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.05.22 12:35:28 | 000,100,712 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.05.22 12:35:28 | 000,028,600 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.05.22 12:35:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2013.05.21 20:15:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.05.21 20:15:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2013.05.19 19:47:09 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013.05.16 03:01:37 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.05.16 03:01:37 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.05.16 03:01:37 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013.05.16 03:01:36 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.05.16 03:01:36 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013.05.16 03:01:36 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013.05.16 03:01:36 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013.05.16 03:01:36 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013.05.16 03:01:36 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013.05.16 03:01:36 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013.05.16 03:01:36 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013.05.16 03:01:36 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013.05.16 03:01:35 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.05.16 03:01:35 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.05.16 03:01:35 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.05.15 07:19:20 | 000,265,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\dxgmms1.sys
[2013.05.15 07:19:20 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll
[2013.05.15 07:19:17 | 001,930,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\authui.dll
[2013.05.15 07:19:17 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\authui.dll
[2013.05.15 07:19:17 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\shdocvw.dll
[2013.05.15 07:19:17 | 000,111,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\consent.exe
[2013.05.15 07:19:15 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wwanprotdim.dll
[2013.04.28 23:13:01 | 000,000,000 | ---D | C] -- C:\Lexmark ToolBar
[2013.04.28 10:45:43 | 000,000,000 | ---D | C] -- C:\Users\Kehrer\Desktop\FIP's
[2013.04.27 14:23:09 | 000,000,000 | ---D | C] -- C:\Users\Kehrer\Documents\Battlefield 3
[2013.04.27 14:20:56 | 000,000,000 | ---D | C] -- C:\Users\Kehrer\AppData\Local\ESN
[2013.04.27 14:18:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Battlelog Web Plugins
[2013.04.27 14:17:06 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Logs
[2013.04.27 14:17:06 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core
[2013.04.27 11:44:44 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Common Files\EAInstaller
[2013.04.27 10:34:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin Games
[2013.04.27 10:34:26 | 000,000,000 | ---D | C] -- C:\Users\Kehrer\AppData\Local\Origin
[2013.04.27 10:32:00 | 000,000,000 | ---D | C] -- C:\Users\Kehrer\AppData\Roaming\Origin
[2013.04.27 10:32:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Origin
[2013.04.27 10:32:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts
[2013.04.27 10:31:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.05.22 21:29:20 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Kehrer\Desktop\OTL.exe
[2013.05.22 21:22:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3281158987-627306578-157583830-1000UA.job
[2013.05.22 21:17:09 | 000,000,434 | ---- | M] () -- C:\Users\Kehrer\Documents\aionmemo_9d9d aa1.dat
[2013.05.22 20:54:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.05.22 20:44:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3281158987-627306578-157583830-1004UA.job
[2013.05.22 20:22:15 | 000,002,367 | ---- | M] () -- C:\Users\Kehrer\Desktop\Google Chrome.lnk
[2013.05.22 15:44:00 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3281158987-627306578-157583830-1004Core.job
[2013.05.22 15:22:19 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3281158987-627306578-157583830-1000Core.job
[2013.05.22 12:47:01 | 000,018,784 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.22 12:47:01 | 000,018,784 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.22 12:38:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.22 12:38:38 | 2134,446,079 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.22 12:36:08 | 000,083,160 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avnetflt.sys
[2013.05.22 12:35:35 | 000,001,994 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.05.22 01:01:25 | 000,130,016 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.05.22 01:01:25 | 000,100,712 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.05.22 01:01:25 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.05.21 20:15:17 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2013.05.21 03:02:48 | 001,590,038 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.05.21 03:02:48 | 000,698,060 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.05.21 03:02:48 | 000,653,138 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.05.21 03:02:48 | 000,148,756 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.05.21 03:02:48 | 000,121,540 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.05.21 03:02:42 | 001,590,038 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.05.19 17:34:48 | 000,282,296 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2013.05.19 17:34:48 | 000,282,296 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2013.05.19 17:25:45 | 000,282,296 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2013.05.16 03:26:15 | 000,445,072 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.05.15 06:54:14 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.05.15 06:54:14 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.05.08 12:44:07 | 000,001,232 | ---- | M] () -- C:\Users\Kehrer\Desktop\Neverwinter.lnk
[2013.05.04 23:14:51 | 001,170,617 | ---- | M] () -- C:\Users\Kehrer\Desktop\blackout.JPG
[2013.05.01 22:07:49 | 000,000,771 | ---- | M] () -- C:\Users\Kehrer\Desktop\Rockstar Games Social Club.lnk
[2013.04.27 14:29:40 | 000,076,888 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2013.04.27 11:44:48 | 000,001,170 | ---- | M] () -- C:\Users\Public\Desktop\Battlefield 3.lnk
[2013.04.27 10:32:00 | 000,000,979 | ---- | M] () -- C:\Users\Public\Desktop\Origin.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.05.22 12:35:35 | 000,001,994 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.05.21 22:22:22 | 000,071,680 | ---- | C] () -- C:\ProgramData\DFF3.exe
[2013.05.21 22:22:13 | 000,071,680 | ---- | C] () -- C:\ProgramData\BE30.exe
[2013.05.21 22:07:22 | 000,071,680 | ---- | C] () -- C:\ProgramData\2377.exe
[2013.05.21 22:07:13 | 000,071,680 | ---- | C] () -- C:\ProgramData\1B5.exe
[2013.05.21 21:52:21 | 000,071,680 | ---- | C] () -- C:\ProgramData\63C1.exe
[2013.05.21 21:52:13 | 000,071,680 | ---- | C] () -- C:\ProgramData\44CC.exe
[2013.05.21 21:37:20 | 000,071,680 | ---- | C] () -- C:\ProgramData\A5FE.exe
[2013.05.21 21:37:12 | 000,071,680 | ---- | C] () -- C:\ProgramData\86AC.exe
[2013.05.21 21:22:20 | 000,071,680 | ---- | C] () -- C:\ProgramData\E9D1.exe
[2013.05.21 21:22:12 | 000,071,680 | ---- | C] () -- C:\ProgramData\CA4F.exe
[2013.05.21 21:07:19 | 000,071,680 | ---- | C] () -- C:\ProgramData\2C3D.exe
[2013.05.21 21:07:12 | 000,071,680 | ---- | C] () -- C:\ProgramData\DC5.exe
[2013.05.21 20:52:19 | 000,071,680 | ---- | C] () -- C:\ProgramData\701F.exe
[2013.05.21 20:52:11 | 000,071,680 | ---- | C] () -- C:\ProgramData\50CC.exe
[2013.05.21 20:37:19 | 000,071,680 | ---- | C] () -- C:\ProgramData\B346.exe
[2013.05.21 20:37:11 | 000,071,680 | ---- | C] () -- C:\ProgramData\9422.exe
[2013.05.21 20:22:19 | 000,071,680 | ---- | C] () -- C:\ProgramData\F6F9.exe
[2013.05.21 20:22:11 | 000,071,680 | ---- | C] () -- C:\ProgramData\D7C6.exe
[2013.05.21 20:07:18 | 000,071,680 | ---- | C] () -- C:\ProgramData\38B9.exe
[2013.05.21 20:07:11 | 000,071,680 | ---- | C] () -- C:\ProgramData\1ACE.exe
[2013.05.21 19:52:18 | 000,071,680 | ---- | C] () -- C:\ProgramData\7C9C.exe
[2013.05.21 19:52:10 | 000,071,680 | ---- | C] () -- C:\ProgramData\5C21.exe
[2013.05.21 19:37:20 | 000,071,680 | ---- | C] () -- C:\ProgramData\BA85.exe
[2013.05.21 19:37:09 | 000,071,680 | ---- | C] () -- C:\ProgramData\9F96.exe
[2013.05.21 19:22:16 | 000,071,680 | ---- | C] () -- C:\ProgramData\FE67.exe
[2013.05.21 19:22:09 | 000,071,680 | ---- | C] () -- C:\ProgramData\E2CD.exe
[2013.05.08 12:44:07 | 000,001,232 | ---- | C] () -- C:\Users\Kehrer\Desktop\Neverwinter.lnk
[2013.05.04 23:12:17 | 001,170,617 | ---- | C] () -- C:\Users\Kehrer\Desktop\blackout.JPG
[2013.05.01 22:07:49 | 000,000,771 | ---- | C] () -- C:\Users\Kehrer\Desktop\Rockstar Games Social Club.lnk
[2013.04.27 11:44:48 | 000,001,170 | ---- | C] () -- C:\Users\Public\Desktop\Battlefield 3.lnk
[2013.04.27 10:32:00 | 000,000,979 | ---- | C] () -- C:\Users\Public\Desktop\Origin.lnk
[2013.02.15 00:58:17 | 000,703,117 | ---- | C] () -- C:\Users\Kehrer\AppData\Roaming\technic-launcher.jar
[2013.02.06 23:30:41 | 000,000,850 | ---- | C] () -- C:\Users\Kehrer\AppData\Local\recently-used.xbel
[2013.01.14 19:51:39 | 000,151,656 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2012.11.26 16:41:42 | 000,331,776 | ---- | C] () -- C:\Windows\SysWow64\LXEAinst.dll
[2012.11.26 16:41:41 | 000,364,544 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeainpa.dll
[2012.11.26 16:41:41 | 000,344,064 | ---- | C] () -- C:\Windows\SysWow64\lxeacomx.dll
[2012.11.26 16:41:41 | 000,344,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeaiesc.dll
[2012.11.26 16:41:41 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\lxeajswr.dll
[2012.11.26 16:41:40 | 000,847,872 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeausb1.dll
[2012.11.26 16:41:40 | 000,643,072 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeapmui.dll
[2012.11.26 16:41:40 | 000,323,584 | ---- | C] () -- C:\Windows\SysWow64\lxeains.dll
[2012.11.26 16:41:40 | 000,262,144 | ---- | C] () -- C:\Windows\SysWow64\lxeainsb.dll
[2012.11.26 16:41:40 | 000,253,952 | ---- | C] () -- C:\Windows\SysWow64\lxeacu.dll
[2012.11.26 16:41:40 | 000,114,688 | ---- | C] () -- C:\Windows\SysWow64\lxeainsr.dll
[2012.11.26 16:41:40 | 000,090,112 | ---- | C] () -- C:\Windows\SysWow64\lxeacub.dll
[2012.11.26 16:41:40 | 000,036,864 | ---- | C] () -- C:\Windows\SysWow64\lxeacur.dll
[2012.11.26 16:41:39 | 001,048,576 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeaserv.dll
[2012.11.26 16:41:39 | 000,688,128 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeahbn3.dll
[2012.11.26 16:41:39 | 000,598,696 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeacoms.exe
[2012.11.26 16:41:39 | 000,577,536 | ---- | C] ( ) -- C:\Windows\SysWow64\lxealmpm.dll
[2012.11.26 16:41:39 | 000,372,736 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeacomm.dll
[2012.11.26 16:41:39 | 000,324,264 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeaih.exe
[2012.11.26 16:41:38 | 000,802,816 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeacomc.dll
[2012.11.26 16:41:38 | 000,373,416 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeacfg.exe
[2012.11.26 16:34:34 | 000,299,008 | ---- | C] () -- C:\Windows\SysWow64\LXEAsm.dll
[2012.11.26 16:34:34 | 000,024,064 | ---- | C] () -- C:\Windows\SysWow64\LXEAsmr.dll
[2012.11.14 23:54:47 | 000,385,078 | ---- | C] () -- C:\Users\Kehrer\phase-6-backpack-basti-2012-11-14.p6b
[2012.08.13 22:46:17 | 000,384,835 | ---- | C] () -- C:\Users\Kehrer\AppData\Local\speeddial.crx
[2012.07.12 13:03:47 | 000,007,606 | ---- | C] () -- C:\Users\Kehrer\AppData\Local\Resmon.ResmonCfg
[2012.03.16 07:33:18 | 000,041,009 | ---- | C] () -- C:\Users\Kehrer\phase-6-backpack-all-2012-03-16.p6a
[2012.03.09 19:25:38 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe
[2012.01.24 22:30:51 | 000,000,032 | R--- | C] () -- C:\ProgramData\hash.dat
[2012.01.13 16:58:55 | 001,590,038 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.12.17 13:28:26 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.09.07 22:05:33 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\lame_enc.dll
[2011.09.07 22:05:33 | 000,110,080 | ---- | C] () -- C:\Windows\SysWow64\advd.dll
[2011.09.07 22:05:33 | 000,023,040 | ---- | C] () -- C:\Windows\SysWow64\auth.dll
[2011.08.21 11:18:57 | 000,282,296 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.08.20 14:22:58 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe
[2011.08.20 14:22:58 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.08.10 08:49:35 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll
[2011.08.10 08:46:08 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[2013.05.22 12:34:30 | 000,005,120 | -HS- | M] () -- C:\Windows\assembly\GAC_32\Desktop.ini
[2013.05.22 12:34:30 | 000,006,144 | -HS- | M] () -- C:\Windows\assembly\GAC_64\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
"ThreadingModel" = Both
"" = C:\$Recycle.Bin\S-1-5-21-3281158987-627306578-157583830-1000\$0b16cf4bb62f9d48614715127dd507c2\n.
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\$Recycle.Bin\S-1-5-18\$0b16cf4bb62f9d48614715127dd507c2\n.
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >

--- --- ---

Extra.txt:OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 22.05.2013 21:31:57 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Kehrer\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 6,12 Gb Available Physical Memory | 76,67% Memory free
15,97 Gb Paging File | 14,29 Gb Available in Paging File | 89,49% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931,41 Gb Total Space | 551,20 Gb Free Space | 59,18% Space Free | Partition Type: NTFS
Drive D: | 7,59 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: EXTR3M | User Name: Kehrer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E5D76AD-A3FB-48D5-8400-8903B10317D3}" = iTunes
"{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}" = Microsoft .NET Framework 4.5
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{26A24AE4-039D-4CA4-87B4-2F86417003FF}" = Java(TM) 7 Update 3 (64-bit)
"{2C5927BD-3F65-4207-8FB5-8EDF638A3511}_is1" = SmartPCFixer 4.2
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031" = Microsoft .NET Framework 4.5 DEU Language Pack
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{A2585A63-ADD2-3F54-9819-125E680CC7E1}" = Microsoft .NET Framework 4.5 DEU Language Pack
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 311.06
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 311.06
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 311.06
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.11.3
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{D70884EA-E2CE-4539-91DB-4766CC1E5F5F}" = Apple Mobile Device Support
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.59
"GIMP-2_is1" = GIMP 2.8.2
"Lexmark S300-S400 Series" = Lexmark S300-S400 Series
"WinRAR archiver" = WinRAR 4.11 (64-Bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{1017A80C-6F09-4548-A84D-EDD6AC9525F0}" = Lexmark Symbolleiste
"{106B4413-ACBB-4CDE-8707-587DB9BD77EC}" = LogMeIn Hamachi
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{15D44296-62E0-4979-BFF5-1E09ABFE49E0}" = DayZ Commander
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java(TM) 7 Update 5
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2C9EE786-1DDB-4C98-8FA4-B1B9B5A66B77}" = Microsoft Games for Windows - LIVE
"{2D8CED57-CCDB-4D86-9087-3BBCAE8F8F22}" = Six Updater
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{3B11D799-48E0-48ED-BFD7-EA655676D8BB}" = Star Wars: The Old Republic
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}" = Smite
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}" = Hi-Rez Studios Authenticate and Update Service
"{3DECD372-76A1-4483-BF10-B547790A3261}" = ON_OFF Charge B11.0110.1
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{56364334-9530-11D2-BFFC-00C04FA329AA}" = Microsoft Works 2000
"{5DC02603-6642-11D3-80AC-00C04F348408}" = Word in Works Suite-Add-In
"{64467D47-FFE4-4FBC-ABBA-A0DB829A17EB}" = NVIDIA PhysX
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{6A9EF6CF-7630-4E33-AE22-7D70F3AF4B05}" = AION Free-To-Play
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{CCE825DB-347A-4004-A186-5F4A6FDD8547}" = Apple Application Support
"{D2C5E510-BE6D-42CC-9F61-E4F939078474}" = Lexmark 
"{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1" = War Thunder Launcher 1.0.1.162
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Akamai" = Akamai NetSession Interface
"Avira AntiVir Desktop" = Avira Free Antivirus
"Battlelog Web Plugins" = Battlelog Web Plugins
"BattlEye for A2" = BattlEye Uninstall
"BattlEye for OA" = BattlEye for OA Uninstall
"Diablo III" = Diablo III
"ESN Sonar-0.70.4" = ESN Sonar
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"LogMeIn Hamachi" = LogMeIn Hamachi
"Mozilla Firefox 18.0.1 (x86 en-US)" = Mozilla Firefox 18.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NCLauncher_GameForge" = NC Launcher (GameForge)
"Neverwinter" = Neverwinter
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Origin" = Origin
"Paintball2" = Paintball2 Alpha build 35
"phase-6" = phase-6 2.3.1d
"PunkBusterSvc" = PunkBuster Services
"StarCraft II" = StarCraft II
"Steam App 105450" = Age of Empires® III: Complete Collection
"Steam App 105600" = Terraria
"Steam App 107410" = Arma 3 Alpha
"Steam App 113200" = The Binding of Isaac
"Steam App 12210" = Grand Theft Auto IV
"Steam App 202990" = Call of Duty: Black Ops II - Multiplayer
"Steam App 205790" = Dota 2 Test
"Steam App 212680" = FTL: Faster Than Light
"Steam App 218230" = PlanetSide 2
"Steam App 223390" = Forge
"Steam App 33910" = ARMA 2
"Steam App 33930" = ARMA 2: Operation Arrowhead
"Steam App 34830" = Sniper: Ghost Warrior
"Steam App 42680" = Call of Duty: Modern Warfare 3
"Steam App 42690" = Call of Duty: Modern Warfare 3 - Multiplayer
"Steam App 42750" = Call of Duty: Modern Warfare 3 - Dedicated Server
"Steam App 42910" = Magicka
"Steam App 570" = Dota 2
"Steam App 620" = Portal 2
"Steam App 65800" = Dungeon Defenders
"Steam App 730" = Counter-Strike: Global Offensive
"Steam App 745" = Counter-Strike: Global Offensive - SDK
"Steam App 7940" = Call of Duty 4: Modern Warfare
"Steam App 8980" = Borderlands
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"YTdetect" = Yahoo! Detect
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3281158987-627306578-157583830-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4}" = Battlefield Heroes
"Akamai" = Akamai NetSession Interface
"Google Chrome" = Google Chrome
"mIRC" = mIRC
"VisualBee for Microsoft PowerPoint" = VisualBee for Microsoft PowerPoint
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 21.05.2013 01:46:21 | Computer Name = Extr3m | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 4025
 
Error - 21.05.2013 01:46:21 | Computer Name = Extr3m | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4025
 
Error - 21.05.2013 01:46:22 | Computer Name = Extr3m | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 21.05.2013 01:46:22 | Computer Name = Extr3m | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 5039
 
Error - 21.05.2013 01:46:22 | Computer Name = Extr3m | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 5039
 
Error - 21.05.2013 01:46:23 | Computer Name = Extr3m | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 21.05.2013 01:46:23 | Computer Name = Extr3m | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 6037
 
Error - 21.05.2013 01:46:23 | Computer Name = Extr3m | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6037
 
Error - 21.05.2013 14:19:21 | Computer Name = Extr3m | Source = MsiInstaller | ID = 11609
Description = 
 
Error - 22.05.2013 06:34:47 | Computer Name = Extr3m | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: setuppending.exe, Version: 13.6.0.778,
 Zeitstempel: 0x511e4145  Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325,
 Zeitstempel: 0x4df2be1e  Ausnahmecode: 0x40000015  Fehleroffset: 0x0008d6fd  ID des fehlerhaften
 Prozesses: 0xc7c  Startzeit der fehlerhaften Anwendung: 0x01ce56d7de5025e9  Pfad der
 fehlerhaften Anwendung: C:\Windows\Temp\AVSETUP_519bfcd4\setuppending.exe  Pfad des
 fehlerhaften Moduls: C:\Windows\system32\MSVCR100.dll  Berichtskennung: 39337459-c2cb-11e2-b6f9-1c6f65f9ec8b
 
[ System Events ]
Error - 22.05.2013 15:31:00 | Computer Name = Extr3m | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:   %%1060
 
Error - 22.05.2013 15:32:00 | Computer Name = Extr3m | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:   %%1060
 
Error - 22.05.2013 15:33:00 | Computer Name = Extr3m | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:   %%1060
 
Error - 22.05.2013 15:34:00 | Computer Name = Extr3m | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:   %%1060
 
Error - 22.05.2013 15:35:00 | Computer Name = Extr3m | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:   %%1060
 
Error - 22.05.2013 15:36:00 | Computer Name = Extr3m | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:   %%1060
 
Error - 22.05.2013 15:37:00 | Computer Name = Extr3m | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:   %%1060
 
Error - 22.05.2013 15:37:00 | Computer Name = Extr3m | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:   %%1060
 
Error - 22.05.2013 15:38:06 | Computer Name = Extr3m | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:   %%1060
 
Error - 22.05.2013 15:39:00 | Computer Name = Extr3m | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:   %%1060
 
 
< End of report >

--- --- ---

markusg · 22.05.2013, 23:45

Hi Frage die ich per privater Nachicht gestellt habe, beantworten.

markusg · 23.05.2013, 20:21

Hi,
Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Batlo · 24.05.2013, 11:31

12:29:17.0146 4360 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
12:29:17.0234 4360 ============================================================
12:29:17.0234 4360 Current date / time: 2013/05/24 12:29:17.0234
12:29:17.0234 4360 SystemInfo:
12:29:17.0234 4360
12:29:17.0234 4360 OS Version: 6.1.7601 ServicePack: 1.0
12:29:17.0234 4360 Product type: Workstation
12:29:17.0234 4360 ComputerName: EXTR3M
12:29:17.0234 4360 UserName: Kehrer
12:29:17.0234 4360 Windows directory: C:\Windows
12:29:17.0234 4360 System windows directory: C:\Windows
12:29:17.0234 4360 Running under WOW64
12:29:17.0234 4360 Processor architecture: Intel x64
12:29:17.0234 4360 Number of processors: 4
12:29:17.0234 4360 Page size: 0x1000
12:29:17.0234 4360 Boot type: Normal boot
12:29:17.0234 4360 ============================================================
12:29:17.0636 4360 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x700FC, SectorsPerTrack: 0x13, TracksPerCylinder: 0xE0, Type 'K0', Flags 0x00000040
12:29:17.0639 4360 ============================================================
12:29:17.0639 4360 \Device\Harddisk0\DR0:
12:29:17.0639 4360 MBR partitions:
12:29:17.0639 4360 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
12:29:17.0639 4360 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x746D3800
12:29:17.0639 4360 ============================================================
12:29:17.0664 4360 C: <-> \Device\Harddisk0\DR0\Partition2
12:29:17.0664 4360 ============================================================
12:29:17.0664 4360 Initialize success
12:29:17.0664 4360 ============================================================
12:29:43.0086 6464 ============================================================
12:29:43.0086 6464 Scan started
12:29:43.0086 6464 Mode: Manual; SigCheck; TDLFS;
12:29:43.0086 6464 ============================================================
12:29:43.0931 6464 ================ Scan system memory ========================
12:29:43.0931 6464 System memory - ok
12:29:43.0932 6464 ================ Scan services =============================
12:29:44.0096 6464 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
12:29:44.0255 6464 1394ohci - ok
12:29:44.0312 6464 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys
12:29:44.0332 6464 ACPI - ok
12:29:44.0363 6464 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
12:29:44.0489 6464 AcpiPmi - ok
12:29:44.0579 6464 [ 11A52CF7B265631DEEB24C6149309EFF ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
12:29:44.0592 6464 AdobeARMservice - ok
12:29:44.0718 6464 [ F040037B149FD0F5A5044AE563390FA7 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
12:29:44.0732 6464 AdobeFlashPlayerUpdateSvc - ok
12:29:44.0783 6464 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
12:29:44.0809 6464 adp94xx - ok
12:29:44.0827 6464 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
12:29:44.0838 6464 adpahci - ok
12:29:44.0853 6464 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
12:29:44.0862 6464 adpu320 - ok
12:29:44.0911 6464 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
12:29:45.0403 6464 AeLookupSvc - ok
12:29:45.0452 6464 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys
12:29:45.0540 6464 AFD - ok
12:29:45.0589 6464 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys
12:29:45.0601 6464 agp440 - ok
12:29:45.0765 6464 [ C7074BD8D4B8F564859ED373433030AE ] Akamai c:\program files (x86)\common files\akamai/netsession_win_ca0e279.dll
12:29:45.0765 6464 Suspicious file (Hidden): c:\program files (x86)\common files\akamai/netsession_win_ca0e279.dll. md5: C7074BD8D4B8F564859ED373433030AE
12:29:45.0769 6464 Akamai ( HiddenFile.Multi.Generic ) - warning
12:29:45.0769 6464 Akamai - detected HiddenFile.Multi.Generic (1)
12:29:45.0787 6464 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe
12:29:45.0849 6464 ALG - ok
12:29:45.0911 6464 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys
12:29:45.0923 6464 aliide - ok
12:29:45.0953 6464 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys
12:29:45.0962 6464 amdide - ok
12:29:45.0993 6464 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
12:29:46.0076 6464 AmdK8 - ok
12:29:46.0087 6464 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
12:29:46.0126 6464 AmdPPM - ok
12:29:46.0179 6464 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys
12:29:46.0190 6464 amdsata - ok
12:29:46.0233 6464 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
12:29:46.0244 6464 amdsbs - ok
12:29:46.0260 6464 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys
12:29:46.0268 6464 amdxata - ok
12:29:46.0380 6464 [ D9A92E6DD41C5ADC045AE485026AA40C ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
12:29:46.0389 6464 AntiVirSchedulerService - ok
12:29:46.0424 6464 [ 66A7A38F7C439153B758548375EB9E5E ] AntiVirService C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
12:29:46.0435 6464 AntiVirService - ok
12:29:46.0498 6464 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys
12:29:46.0663 6464 AppID - ok
12:29:46.0683 6464 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll
12:29:46.0785 6464 AppIDSvc - ok
12:29:46.0834 6464 [ 9D2A2369AB4B08A4905FE72DB104498F ] Appinfo C:\Windows\System32\appinfo.dll
12:29:46.0921 6464 Appinfo - ok
12:29:46.0979 6464 [ A5299D04ED225D64CF07A568A3E1BF8C ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
12:29:46.0992 6464 Apple Mobile Device - ok
12:29:47.0034 6464 [ 6BE11AD81D4527D299F0CB5F3731AABC ] AppleCharger C:\Windows\system32\DRIVERS\AppleCharger.sys
12:29:47.0050 6464 AppleCharger - ok
12:29:47.0071 6464 [ 95EF7247C50C7241FDAE39A9B3AFF4AE ] AppleChargerSrv C:\Windows\system32\AppleChargerSrv.exe
12:29:47.0080 6464 AppleChargerSrv - ok
12:29:47.0099 6464 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\DRIVERS\arc.sys
12:29:47.0110 6464 arc - ok
12:29:47.0123 6464 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
12:29:47.0135 6464 arcsas - ok
12:29:47.0226 6464 [ 108FB6DDB69E537A2EA53F425363FAE5 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
12:29:47.0288 6464 aspnet_state - ok
12:29:47.0329 6464 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
12:29:47.0395 6464 AsyncMac - ok
12:29:47.0450 6464 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys
12:29:47.0463 6464 atapi - ok
12:29:47.0524 6464 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
12:29:47.0603 6464 AudioEndpointBuilder - ok
12:29:47.0610 6464 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll
12:29:47.0634 6464 AudioSrv - ok
12:29:47.0669 6464 [ 09E6069EF94B345061B4BD3CEBD974C8 ] avgntflt C:\Windows\system32\DRIVERS\avgntflt.sys
12:29:47.0676 6464 avgntflt - ok
12:29:47.0723 6464 [ 488486DAD09A5B6C6DBB8B990A8B2307 ] avipbb C:\Windows\system32\DRIVERS\avipbb.sys
12:29:47.0737 6464 avipbb - ok
12:29:47.0783 6464 [ 490FA25161BF3E51993EB724ECF0ACEB ] avkmgr C:\Windows\system32\DRIVERS\avkmgr.sys
12:29:47.0795 6464 avkmgr - ok
12:29:47.0834 6464 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll
12:29:47.0960 6464 AxInstSV - ok
12:29:48.0004 6464 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys
12:29:48.0066 6464 b06bdrv - ok
12:29:48.0114 6464 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
12:29:48.0198 6464 b57nd60a - ok
12:29:48.0224 6464 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll
12:29:48.0275 6464 BDESVC - ok
12:29:48.0302 6464 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys
12:29:48.0372 6464 Beep - ok
12:29:48.0447 6464 [ 06C1E887BF34C0E31EB8E2C999E4842F ] BEService C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
12:29:48.0519 6464 BEService ( UnsignedFile.Multi.Generic ) - warning
12:29:48.0519 6464 BEService - detected UnsignedFile.Multi.Generic (1)
12:29:48.0566 6464 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
12:29:48.0613 6464 blbdrive - ok
12:29:48.0718 6464 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
12:29:48.0739 6464 Bonjour Service - ok
12:29:48.0781 6464 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
12:29:48.0844 6464 bowser - ok
12:29:48.0892 6464 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
12:29:48.0975 6464 BrFiltLo - ok
12:29:49.0006 6464 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
12:29:49.0025 6464 BrFiltUp - ok
12:29:49.0091 6464 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll
12:29:49.0176 6464 Browser - ok
12:29:49.0213 6464 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys
12:29:49.0338 6464 Brserid - ok
12:29:49.0366 6464 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
12:29:49.0417 6464 BrSerWdm - ok
12:29:49.0445 6464 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
12:29:49.0494 6464 BrUsbMdm - ok
12:29:49.0528 6464 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
12:29:49.0545 6464 BrUsbSer - ok
12:29:49.0562 6464 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
12:29:49.0609 6464 BTHMODEM - ok
12:29:49.0683 6464 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll
12:29:49.0751 6464 bthserv - ok
12:29:49.0763 6464 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
12:29:49.0785 6464 cdfs - ok
12:29:49.0866 6464 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
12:29:49.0882 6464 cdrom - ok
12:29:49.0944 6464 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll
12:29:50.0019 6464 CertPropSvc - ok
12:29:50.0055 6464 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\DRIVERS\circlass.sys
12:29:50.0087 6464 circlass - ok
12:29:50.0131 6464 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys
12:29:50.0152 6464 CLFS - ok
12:29:50.0204 6464 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
12:29:50.0216 6464 clr_optimization_v2.0.50727_32 - ok
12:29:50.0273 6464 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
12:29:50.0283 6464 clr_optimization_v2.0.50727_64 - ok
12:29:50.0380 6464 [ 6D7C8A951AF6AD6835C029B3CB88D333 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
12:29:50.0436 6464 clr_optimization_v4.0.30319_32 - ok
12:29:50.0452 6464 [ 86329C35FF23CFEF0FB6C0023BA06BCE ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
12:29:50.0475 6464 clr_optimization_v4.0.30319_64 - ok
12:29:50.0508 6464 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
12:29:50.0542 6464 CmBatt - ok
12:29:50.0593 6464 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys
12:29:50.0603 6464 cmdide - ok
12:29:50.0645 6464 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\Windows\system32\Drivers\cng.sys
12:29:50.0692 6464 CNG - ok
12:29:50.0731 6464 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
12:29:50.0740 6464 Compbatt - ok
12:29:50.0780 6464 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
12:29:50.0816 6464 CompositeBus - ok
12:29:50.0818 6464 COMSysApp - ok
12:29:50.0870 6464 [ C08063F052308B6F5882482615387F30 ] cpuz135 C:\Windows\system32\drivers\cpuz135_x64.sys
12:29:50.0882 6464 cpuz135 - ok
12:29:50.0925 6464 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
12:29:50.0938 6464 crcdisk - ok
12:29:50.0974 6464 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\Windows\system32\cryptsvc.dll
12:29:51.0015 6464 CryptSvc - ok
12:29:51.0066 6464 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll
12:29:51.0230 6464 DcomLaunch - ok
12:29:51.0308 6464 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll
12:29:51.0417 6464 defragsvc - ok
12:29:51.0480 6464 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
12:29:51.0573 6464 DfsC - ok
12:29:51.0604 6464 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll
12:29:51.0682 6464 Dhcp - ok
12:29:51.0714 6464 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys
12:29:51.0760 6464 discache - ok
12:29:51.0792 6464 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\DRIVERS\disk.sys
12:29:51.0807 6464 Disk - ok
12:29:51.0854 6464 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll
12:29:51.0901 6464 Dnscache - ok
12:29:51.0948 6464 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll
12:29:52.0010 6464 dot3svc - ok
12:29:52.0041 6464 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll
12:29:52.0104 6464 DPS - ok
12:29:52.0182 6464 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
12:29:52.0228 6464 drmkaud - ok
12:29:52.0384 6464 dump_wmimmc - ok
12:29:52.0462 6464 [ AF2E16242AA723F68F461B6EAE2EAD3D ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
12:29:52.0494 6464 DXGKrnl - ok
12:29:52.0525 6464 EagleX64 - ok
12:29:52.0540 6464 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll
12:29:52.0572 6464 EapHost - ok
12:29:52.0665 6464 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys
12:29:52.0728 6464 ebdrv - ok
12:29:52.0774 6464 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe
12:29:52.0852 6464 EFS - ok
12:29:52.0946 6464 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
12:29:53.0024 6464 ehRecvr - ok
12:29:53.0086 6464 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe
12:29:53.0133 6464 ehSched - ok
12:29:53.0164 6464 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
12:29:53.0196 6464 elxstor - ok
12:29:53.0242 6464 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys
12:29:53.0289 6464 ErrDev - ok
12:29:53.0336 6464 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll
12:29:53.0367 6464 EventSystem - ok
12:29:53.0414 6464 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys
12:29:53.0430 6464 exfat - ok
12:29:53.0461 6464 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys
12:29:53.0539 6464 fastfat - ok
12:29:53.0586 6464 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe
12:29:53.0617 6464 Fax - ok
12:29:53.0679 6464 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\DRIVERS\fdc.sys
12:29:53.0726 6464 fdc - ok
12:29:53.0773 6464 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll
12:29:53.0851 6464 fdPHost - ok
12:29:53.0866 6464 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll
12:29:53.0898 6464 FDResPub - ok
12:29:53.0929 6464 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
12:29:53.0929 6464 FileInfo - ok
12:29:53.0960 6464 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
12:29:54.0022 6464 Filetrace - ok
12:29:54.0038 6464 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
12:29:54.0054 6464 flpydisk - ok
12:29:54.0085 6464 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
12:29:54.0100 6464 FltMgr - ok
12:29:54.0178 6464 [ C4C183E6551084039EC862DA1C945E3D ] FontCache C:\Windows\system32\FntCache.dll
12:29:54.0241 6464 FontCache - ok
12:29:54.0350 6464 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
12:29:54.0366 6464 FontCache3.0.0.0 - ok
12:29:54.0381 6464 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
12:29:54.0381 6464 FsDepends - ok
12:29:54.0444 6464 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
12:29:54.0444 6464 Fs_Rec - ok
12:29:54.0490 6464 [ 8F6322049018354F45F05A2FD2D4E5E0 ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
12:29:54.0506 6464 fvevol - ok
12:29:54.0522 6464 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
12:29:54.0537 6464 gagp30kx - ok
12:29:54.0553 6464 gdrv - ok
12:29:54.0584 6464 [ 8E98D21EE06192492A5671A6144D092F ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
12:29:54.0600 6464 GEARAspiWDM - ok
12:29:54.0631 6464 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll
12:29:54.0693 6464 gpsvc - ok
12:29:54.0724 6464 [ 1E6438D4EA6E1174A3B3B1EDC4DE660B ] hamachi C:\Windows\system32\DRIVERS\hamachi.sys
12:29:54.0740 6464 hamachi - ok
12:29:54.0896 6464 [ 785FD63B74B30986A9F2C7D965CA509F ] Hamachi2Svc C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
12:29:54.0943 6464 Hamachi2Svc - ok
12:29:54.0958 6464 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
12:29:54.0990 6464 hcw85cir - ok
12:29:55.0052 6464 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
12:29:55.0068 6464 HdAudAddService - ok
12:29:55.0099 6464 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
12:29:55.0130 6464 HDAudBus - ok
12:29:55.0130 6464 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
12:29:55.0146 6464 HidBatt - ok
12:29:55.0161 6464 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
12:29:55.0177 6464 HidBth - ok
12:29:55.0177 6464 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
12:29:55.0208 6464 HidIr - ok
12:29:55.0224 6464 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\system32\hidserv.dll
12:29:55.0255 6464 hidserv - ok
12:29:55.0270 6464 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
12:29:55.0286 6464 HidUsb - ok
12:29:55.0380 6464 [ 9D2C35E06CE117355ABADCEEE1558D21 ] HiPatchService C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
12:29:55.0380 6464 HiPatchService ( UnsignedFile.Multi.Generic ) - warning
12:29:55.0380 6464 HiPatchService - detected UnsignedFile.Multi.Generic (1)
12:29:55.0426 6464 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll
12:29:55.0458 6464 hkmsvc - ok
12:29:55.0504 6464 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
12:29:55.0536 6464 HomeGroupListener - ok
12:29:55.0551 6464 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
12:29:55.0567 6464 HomeGroupProvider - ok
12:29:55.0614 6464 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
12:29:55.0629 6464 HpSAMD - ok
12:29:55.0660 6464 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys
12:29:55.0738 6464 HTTP - ok
12:29:55.0770 6464 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
12:29:55.0785 6464 hwpolicy - ok
12:29:55.0848 6464 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys
12:29:55.0863 6464 i8042prt - ok
12:29:55.0879 6464 [ D7921D5A870B11CC1ADAB198A519D50A ] iaStor C:\Windows\system32\DRIVERS\iaStor.sys
12:29:55.0894 6464 iaStor - ok
12:29:55.0988 6464 [ 8FFF9083252C16FE3960173722605E9E ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
12:29:56.0004 6464 IAStorDataMgrSvc - ok
12:29:56.0019 6464 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
12:29:56.0035 6464 iaStorV - ok
12:29:56.0097 6464 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
12:29:56.0113 6464 idsvc - ok
12:29:56.0128 6464 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
12:29:56.0144 6464 iirsp - ok
12:29:56.0160 6464 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll
12:29:56.0206 6464 IKEEXT - ok
12:29:56.0316 6464 [ 03076F51AF9F78A272CCCDE03E9340CE ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
12:29:56.0362 6464 IntcAzAudAddService - ok
12:29:56.0378 6464 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys
12:29:56.0378 6464 intelide - ok
12:29:56.0409 6464 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
12:29:56.0425 6464 intelppm - ok
12:29:56.0456 6464 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll
12:29:56.0503 6464 IPBusEnum - ok
12:29:56.0534 6464 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
12:29:56.0581 6464 IpFilterDriver - ok
12:29:56.0596 6464 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
12:29:56.0612 6464 IPMIDRV - ok
12:29:56.0628 6464 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys
12:29:56.0659 6464 IPNAT - ok
12:29:56.0706 6464 [ 0F261EC4F514926177C70C1832374231 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
12:29:56.0752 6464 iPod Service - ok
12:29:56.0768 6464 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
12:29:56.0893 6464 IRENUM - ok
12:29:56.0908 6464 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys
12:29:56.0924 6464 isapnp - ok
12:29:56.0971 6464 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
12:29:56.0986 6464 iScsiPrt - ok
12:29:57.0002 6464 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
12:29:57.0018 6464 kbdclass - ok
12:29:57.0064 6464 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
12:29:57.0080 6464 kbdhid - ok
12:29:57.0096 6464 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe
12:29:57.0111 6464 KeyIso - ok
12:29:57.0142 6464 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
12:29:57.0158 6464 KSecDD - ok
12:29:57.0189 6464 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
12:29:57.0205 6464 KSecPkg - ok
12:29:57.0236 6464 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
12:29:57.0314 6464 ksthunk - ok
12:29:57.0345 6464 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll
12:29:57.0408 6464 KtmRm - ok
12:29:57.0454 6464 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\system32\srvsvc.dll
12:29:57.0501 6464 LanmanServer - ok
12:29:57.0548 6464 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
12:29:57.0579 6464 LanmanWorkstation - ok
12:29:57.0610 6464 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
12:29:57.0657 6464 lltdio - ok
12:29:57.0688 6464 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll
12:29:57.0704 6464 lltdsvc - ok
12:29:57.0720 6464 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll
12:29:57.0735 6464 lmhosts - ok
12:29:57.0829 6464 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
12:29:57.0844 6464 LSI_FC - ok
12:29:57.0844 6464 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
12:29:57.0860 6464 LSI_SAS - ok
12:29:57.0860 6464 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
12:29:57.0876 6464 LSI_SAS2 - ok
12:29:57.0891 6464 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
12:29:57.0891 6464 LSI_SCSI - ok
12:29:57.0907 6464 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys
12:29:57.0985 6464 luafv - ok
12:29:58.0000 6464 lxea_device - ok
12:29:58.0032 6464 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
12:29:58.0032 6464 Mcx2Svc - ok
12:29:58.0094 6464 [ 11F714F85530A2BD134074DC30E99FCA ] MDM C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
12:29:58.0125 6464 MDM - ok
12:29:58.0125 6464 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
12:29:58.0141 6464 megasas - ok
12:29:58.0156 6464 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
12:29:58.0156 6464 MegaSR - ok
12:29:58.0188 6464 [ 1C6E73FC46B509EFF9D0086AA37132DF ] MEIx64 C:\Windows\system32\DRIVERS\HECIx64.sys
12:29:58.0203 6464 MEIx64 - ok
12:29:58.0234 6464 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll
12:29:58.0297 6464 MMCSS - ok
12:29:58.0312 6464 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys
12:29:58.0344 6464 Modem - ok
12:29:58.0359 6464 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys
12:29:58.0422 6464 monitor - ok
12:29:58.0453 6464 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
12:29:58.0468 6464 mouclass - ok
12:29:58.0484 6464 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
12:29:58.0500 6464 mouhid - ok
12:29:58.0546 6464 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
12:29:58.0562 6464 mountmgr - ok
12:29:58.0609 6464 [ 9C3758018DED02F4AE53CCA1C5F084A2 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
12:29:58.0624 6464 MozillaMaintenance - ok
12:29:58.0624 6464 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys
12:29:58.0640 6464 mpio - ok
12:29:58.0656 6464 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
12:29:58.0687 6464 mpsdrv - ok
12:29:58.0718 6464 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
12:29:58.0734 6464 MRxDAV - ok
12:29:58.0780 6464 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
12:29:58.0796 6464 mrxsmb - ok
12:29:58.0812 6464 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
12:29:58.0843 6464 mrxsmb10 - ok
12:29:58.0874 6464 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
12:29:58.0890 6464 mrxsmb20 - ok
12:29:58.0890 6464 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys
12:29:58.0890 6464 msahci - ok
12:29:58.0936 6464 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys
12:29:58.0936 6464 msdsm - ok
12:29:58.0983 6464 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe
12:29:58.0999 6464 MSDTC - ok
12:29:59.0030 6464 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys
12:29:59.0061 6464 Msfs - ok
12:29:59.0077 6464 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
12:29:59.0155 6464 mshidkmdf - ok
12:29:59.0155 6464 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
12:29:59.0170 6464 msisadrv - ok
12:29:59.0186 6464 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
12:29:59.0248 6464 MSiSCSI - ok
12:29:59.0248 6464 msiserver - ok
12:29:59.0264 6464 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
12:29:59.0280 6464 MSKSSRV - ok
12:29:59.0295 6464 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
12:29:59.0326 6464 MSPCLOCK - ok
12:29:59.0342 6464 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
12:29:59.0420 6464 MSPQM - ok
12:29:59.0451 6464 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
12:29:59.0467 6464 MsRPC - ok
12:29:59.0482 6464 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
12:29:59.0482 6464 mssmbios - ok
12:29:59.0482 6464 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
12:29:59.0529 6464 MSTEE - ok
12:29:59.0529 6464 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
12:29:59.0560 6464 MTConfig - ok
12:29:59.0576 6464 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys
12:29:59.0592 6464 Mup - ok
12:29:59.0623 6464 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll
12:29:59.0670 6464 napagent - ok
12:29:59.0701 6464 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
12:29:59.0748 6464 NativeWifiP - ok
12:29:59.0810 6464 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys
12:29:59.0841 6464 NDIS - ok
12:29:59.0857 6464 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
12:29:59.0872 6464 NdisCap - ok
12:29:59.0888 6464 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
12:29:59.0904 6464 NdisTapi - ok
12:29:59.0966 6464 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
12:29:59.0997 6464 Ndisuio - ok
12:30:00.0028 6464 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
12:30:00.0060 6464 NdisWan - ok
12:30:00.0091 6464 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
12:30:00.0138 6464 NDProxy - ok
12:30:00.0153 6464 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
12:30:00.0231 6464 NetBIOS - ok
12:30:00.0262 6464 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
12:30:00.0294 6464 NetBT - ok
12:30:00.0325 6464 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe
12:30:00.0325 6464 Netlogon - ok
12:30:00.0356 6464 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll
12:30:00.0387 6464 Netman - ok
12:30:00.0434 6464 [ 5243CFC2E7161C91C2B355240035B9E4 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
12:30:00.0450 6464 NetMsmqActivator - ok
12:30:00.0450 6464 [ 5243CFC2E7161C91C2B355240035B9E4 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
12:30:00.0450 6464 NetPipeActivator - ok
12:30:00.0481 6464 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll
12:30:00.0512 6464 netprofm - ok
12:30:00.0528 6464 [ 5243CFC2E7161C91C2B355240035B9E4 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
12:30:00.0543 6464 NetTcpActivator - ok
12:30:00.0543 6464 [ 5243CFC2E7161C91C2B355240035B9E4 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
12:30:00.0543 6464 NetTcpPortSharing - ok
12:30:00.0574 6464 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
12:30:00.0574 6464 nfrd960 - ok
12:30:00.0652 6464 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\Windows\System32\nlasvc.dll
12:30:00.0730 6464 NlaSvc - ok
12:30:00.0746 6464 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys
12:30:00.0777 6464 Npfs - ok
12:30:00.0793 6464 npggsvc - ok
12:30:00.0793 6464 NPPTNT2 - ok
12:30:00.0824 6464 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll
12:30:00.0902 6464 nsi - ok
12:30:00.0902 6464 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
12:30:00.0933 6464 nsiproxy - ok
12:30:01.0011 6464 [ B98F8C6E31CD07B2E6F71F7F648E38C0 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
12:30:01.0042 6464 Ntfs - ok
12:30:01.0074 6464 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys
12:30:01.0105 6464 Null - ok
12:30:01.0152 6464 [ A7127E86F9FFE2A53E271B56B2C4CEDF ] nusb3hub C:\Windows\system32\DRIVERS\nusb3hub.sys
12:30:01.0167 6464 nusb3hub - ok
12:30:01.0198 6464 [ 49BBEC6F48D5F9284B03ABF3A959B19B ] nusb3xhc C:\Windows\system32\DRIVERS\nusb3xhc.sys
12:30:01.0230 6464 nusb3xhc - ok
12:30:01.0386 6464 [ FCBA1C22727939E7CFF9EB08FE9692AB ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
12:30:01.0542 6464 nvlddmkm - ok
12:30:01.0557 6464 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys
12:30:01.0573 6464 nvraid - ok
12:30:01.0620 6464 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys
12:30:01.0635 6464 nvstor - ok
12:30:01.0682 6464 [ 10C232F6CFFD51D2332898AE7AE0FF23 ] nvsvc C:\Windows\system32\nvvsvc.exe
12:30:01.0713 6464 nvsvc - ok
12:30:01.0776 6464 [ 4789E020D2617046862D1790FC235FF6 ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
12:30:01.0807 6464 nvUpdatusService - ok
12:30:01.0854 6464 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
12:30:01.0869 6464 nv_agp - ok
12:30:01.0885 6464 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
12:30:01.0900 6464 ohci1394 - ok
12:30:01.0932 6464 [ 7A56CF3E3F12E8AF599963B16F50FB6A ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
12:30:01.0947 6464 ose - ok
12:30:01.0963 6464 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
12:30:01.0994 6464 p2pimsvc - ok
12:30:02.0010 6464 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll
12:30:02.0025 6464 p2psvc - ok
12:30:02.0103 6464 [ 3A6DCEB1848470320E4A3C12D7A35B1C ] PAC207 C:\Windows\system32\DRIVERS\PFC027.SYS
12:30:02.0150 6464 PAC207 - ok
12:30:02.0166 6464 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\DRIVERS\parport.sys
12:30:02.0181 6464 Parport - ok
12:30:02.0228 6464 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys
12:30:02.0228 6464 partmgr - ok
12:30:02.0244 6464 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll
12:30:02.0275 6464 PcaSvc - ok
12:30:02.0290 6464 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys
12:30:02.0306 6464 pci - ok
12:30:02.0322 6464 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys
12:30:02.0322 6464 pciide - ok
12:30:02.0337 6464 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
12:30:02.0353 6464 pcmcia - ok
12:30:02.0368 6464 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys
12:30:02.0368 6464 pcw - ok
12:30:02.0384 6464 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys
12:30:02.0446 6464 PEAUTH - ok
12:30:02.0509 6464 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe
12:30:02.0540 6464 PerfHost - ok
12:30:02.0602 6464 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll
12:30:02.0649 6464 pla - ok
12:30:02.0774 6464 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
12:30:02.0821 6464 PlugPlay - ok
12:30:02.0899 6464 PnkBstrA - ok
12:30:02.0899 6464 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
12:30:02.0930 6464 PNRPAutoReg - ok
12:30:02.0930 6464 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
12:30:02.0946 6464 PNRPsvc - ok
12:30:02.0977 6464 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
12:30:03.0024 6464 PolicyAgent - ok
12:30:03.0070 6464 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll
12:30:03.0102 6464 Power - ok
12:30:03.0148 6464 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
12:30:03.0180 6464 PptpMiniport - ok
12:30:03.0195 6464 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\DRIVERS\processr.sys
12:30:03.0211 6464 Processor - ok
12:30:03.0258 6464 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll
12:30:03.0273 6464 ProfSvc - ok
12:30:03.0320 6464 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
12:30:03.0320 6464 ProtectedStorage - ok
12:30:03.0367 6464 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys
12:30:03.0398 6464 Psched - ok
12:30:03.0429 6464 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
12:30:03.0460 6464 ql2300 - ok
12:30:03.0476 6464 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
12:30:03.0492 6464 ql40xx - ok
12:30:03.0507 6464 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll
12:30:03.0523 6464 QWAVE - ok
12:30:03.0538 6464 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
12:30:03.0554 6464 QWAVEdrv - ok
12:30:03.0570 6464 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
12:30:03.0585 6464 RasAcd - ok
12:30:03.0601 6464 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
12:30:03.0632 6464 RasAgileVpn - ok
12:30:03.0632 6464 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll
12:30:03.0663 6464 RasAuto - ok
12:30:03.0663 6464 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
12:30:03.0694 6464 Rasl2tp - ok
12:30:03.0726 6464 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll
12:30:03.0757 6464 RasMan - ok
12:30:03.0772 6464 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
12:30:03.0804 6464 RasPppoe - ok
12:30:03.0835 6464 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
12:30:03.0866 6464 RasSstp - ok
12:30:03.0882 6464 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
12:30:03.0944 6464 rdbss - ok
12:30:03.0960 6464 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
12:30:04.0006 6464 rdpbus - ok
12:30:04.0022 6464 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
12:30:04.0069 6464 RDPCDD - ok
12:30:04.0069 6464 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
12:30:04.0100 6464 RDPENCDD - ok
12:30:04.0131 6464 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
12:30:04.0162 6464 RDPREFMP - ok
12:30:04.0194 6464 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
12:30:04.0256 6464 RDPWD - ok
12:30:04.0303 6464 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
12:30:04.0303 6464 rdyboost - ok
12:30:04.0318 6464 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll
12:30:04.0365 6464 RemoteAccess - ok
12:30:04.0381 6464 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll
12:30:04.0428 6464 RemoteRegistry - ok
12:30:04.0443 6464 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
12:30:04.0521 6464 RpcEptMapper - ok
12:30:04.0521 6464 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe
12:30:04.0537 6464 RpcLocator - ok
12:30:04.0568 6464 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll
12:30:04.0599 6464 RpcSs - ok
12:30:04.0615 6464 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
12:30:04.0630 6464 rspndr - ok
12:30:04.0662 6464 [ 712944C0A377E9B8743F95BD83E882D4 ] RTL8167 C:\Windows\system32\DRIVERS\Rt64win7.sys
12:30:04.0677 6464 RTL8167 - ok
12:30:04.0693 6464 RTL8192cu - ok
12:30:04.0693 6464 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe
12:30:04.0708 6464 SamSs - ok
12:30:04.0740 6464 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
12:30:04.0755 6464 sbp2port - ok
12:30:04.0771 6464 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll
12:30:04.0818 6464 SCardSvr - ok
12:30:04.0849 6464 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
12:30:04.0880 6464 scfilter - ok
12:30:04.0927 6464 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll
12:30:04.0958 6464 Schedule - ok
12:30:05.0005 6464 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll
12:30:05.0036 6464 SCPolicySvc - ok
12:30:05.0067 6464 [ 8B56BDCE6A303DDE63D63440D1CF9AD1 ] ScreamBAudioSvc C:\Windows\system32\drivers\ScreamingBAudio64.sys
12:30:05.0083 6464 ScreamBAudioSvc - ok
12:30:05.0130 6464 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll
12:30:05.0176 6464 SDRSVC - ok
12:30:05.0192 6464 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys
12:30:05.0223 6464 secdrv - ok
12:30:05.0254 6464 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll
12:30:05.0270 6464 seclogon - ok
12:30:05.0301 6464 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\System32\sens.dll
12:30:05.0332 6464 SENS - ok
12:30:05.0379 6464 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll
12:30:05.0410 6464 SensrSvc - ok
12:30:05.0442 6464 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
12:30:05.0535 6464 Serenum - ok
12:30:05.0598 6464 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\DRIVERS\serial.sys
12:30:05.0613 6464 Serial - ok
12:30:05.0644 6464 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
12:30:05.0691 6464 sermouse - ok
12:30:05.0769 6464 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll
12:30:05.0847 6464 SessionEnv - ok
12:30:05.0878 6464 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
12:30:05.0941 6464 sffdisk - ok
12:30:05.0956 6464 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
12:30:06.0019 6464 sffp_mmc - ok
12:30:06.0034 6464 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
12:30:06.0066 6464 sffp_sd - ok
12:30:06.0097 6464 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
12:30:06.0159 6464 sfloppy - ok
12:30:06.0175 6464 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
12:30:06.0222 6464 ShellHWDetection - ok
12:30:06.0237 6464 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
12:30:06.0253 6464 SiSRaid2 - ok
12:30:06.0253 6464 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
12:30:06.0268 6464 SiSRaid4 - ok
12:30:06.0315 6464 [ 01ACB9228C303DE1FFF82B807D28B2B0 ] skfiltv C:\Windows\system32\drivers\skfiltv.sys
12:30:06.0362 6464 skfiltv - ok
12:30:06.0424 6464 [ CA355B308AA537C6B9D67CD3A5485AF9 ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe
12:30:06.0424 6464 SkypeUpdate - ok
12:30:06.0440 6464 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys
12:30:06.0471 6464 Smb - ok
12:30:06.0502 6464 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe
12:30:06.0534 6464 SNMPTRAP - ok
12:30:06.0549 6464 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys
12:30:06.0565 6464 spldr - ok
12:30:06.0596 6464 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe
12:30:06.0643 6464 Spooler - ok
12:30:06.0736 6464 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe
12:30:06.0799 6464 sppsvc - ok
12:30:06.0799 6464 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll
12:30:06.0861 6464 sppuinotify - ok
12:30:06.0924 6464 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys
12:30:06.0986 6464 srv - ok
12:30:07.0033 6464 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
12:30:07.0080 6464 srv2 - ok
12:30:07.0095 6464 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
12:30:07.0126 6464 srvnet - ok
12:30:07.0189 6464 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
12:30:07.0220 6464 SSDPSRV - ok
12:30:07.0236 6464 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll
12:30:07.0251 6464 SstpSvc - ok
12:30:07.0314 6464 Steam Client Service - ok
12:30:07.0392 6464 [ 5A19667A580B1CE886EAF968B9743F45 ] Stereo Service C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
12:30:07.0407 6464 Stereo Service - ok
12:30:07.0423 6464 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
12:30:07.0438 6464 stexstor - ok
12:30:07.0470 6464 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll
12:30:07.0501 6464 stisvc - ok
12:30:07.0532 6464 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\drivers\swenum.sys
12:30:07.0532 6464 swenum - ok
12:30:07.0563 6464 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll
12:30:07.0610 6464 swprv - ok
12:30:07.0657 6464 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll
12:30:07.0704 6464 SysMain - ok
12:30:07.0735 6464 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
12:30:07.0766 6464 TabletInputService - ok
12:30:07.0782 6464 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll
12:30:07.0828 6464 TapiSrv - ok
12:30:07.0860 6464 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll
12:30:07.0875 6464 TBS - ok
12:30:07.0938 6464 [ B62A953F2BF3922C8764A29C34A22899 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
12:30:07.0984 6464 Tcpip - ok
12:30:08.0000 6464 [ B62A953F2BF3922C8764A29C34A22899 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
12:30:08.0031 6464 TCPIP6 - ok
12:30:08.0062 6464 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
12:30:08.0109 6464 tcpipreg - ok
12:30:08.0125 6464 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
12:30:08.0156 6464 TDPIPE - ok
12:30:08.0187 6464 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
12:30:08.0234 6464 TDTCP - ok
12:30:08.0281 6464 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
12:30:08.0312 6464 tdx - ok
12:30:08.0328 6464 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\drivers\termdd.sys
12:30:08.0343 6464 TermDD - ok
12:30:08.0374 6464 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll
12:30:08.0437 6464 TermService - ok
12:30:08.0437 6464 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll
12:30:08.0452 6464 Themes - ok
12:30:08.0484 6464 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll
12:30:08.0499 6464 THREADORDER - ok
12:30:08.0515 6464 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll
12:30:08.0577 6464 TrkWks - ok
12:30:08.0608 6464 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
12:30:08.0640 6464 TrustedInstaller - ok
12:30:08.0671 6464 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
12:30:08.0702 6464 tssecsrv - ok
12:30:08.0733 6464 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
12:30:08.0780 6464 TsUsbFlt - ok
12:30:08.0889 6464 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
12:30:08.0920 6464 tunnel - ok
12:30:08.0936 6464 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
12:30:08.0952 6464 uagp35 - ok
12:30:08.0983 6464 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
12:30:09.0045 6464 udfs - ok
12:30:09.0061 6464 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe
12:30:09.0076 6464 UI0Detect - ok
12:30:09.0092 6464 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
12:30:09.0108 6464 uliagpkx - ok
12:30:09.0139 6464 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
12:30:09.0170 6464 umbus - ok
12:30:09.0186 6464 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
12:30:09.0217 6464 UmPass - ok
12:30:09.0232 6464 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll
12:30:09.0264 6464 upnphost - ok
12:30:09.0310 6464 [ 43228F8EDD1B0BCDD3145AD246E63D39 ] USBAAPL64 C:\Windows\system32\Drivers\usbaapl64.sys
12:30:09.0357 6464 USBAAPL64 - ok
12:30:09.0388 6464 [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio C:\Windows\system32\drivers\usbaudio.sys
12:30:09.0420 6464 usbaudio - ok
12:30:09.0466 6464 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
12:30:09.0498 6464 usbccgp - ok
12:30:09.0513 6464 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys
12:30:09.0529 6464 usbcir - ok
12:30:09.0544 6464 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\drivers\usbehci.sys
12:30:09.0576 6464 usbehci - ok
12:30:09.0607 6464 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
12:30:09.0638 6464 usbhub - ok
12:30:09.0654 6464 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\drivers\usbohci.sys
12:30:09.0685 6464 usbohci - ok
12:30:09.0685 6464 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
12:30:09.0716 6464 usbprint - ok
12:30:09.0763 6464 [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
12:30:09.0794 6464 usbscan - ok
12:30:09.0794 6464 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
12:30:09.0841 6464 USBSTOR - ok
12:30:09.0856 6464 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
12:30:09.0888 6464 usbuhci - ok
12:30:09.0903 6464 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll
12:30:09.0934 6464 UxSms - ok
12:30:09.0950 6464 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe
12:30:09.0950 6464 VaultSvc - ok
12:30:09.0981 6464 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
12:30:09.0981 6464 vdrvroot - ok
12:30:09.0997 6464 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe
12:30:10.0028 6464 vds - ok
12:30:10.0028 6464 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
12:30:10.0044 6464 vga - ok
12:30:10.0044 6464 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys
12:30:10.0075 6464 VgaSave - ok
12:30:10.0075 6464 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
12:30:10.0090 6464 vhdmp - ok
12:30:10.0122 6464 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys
12:30:10.0137 6464 viaide - ok
12:30:10.0153 6464 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys
12:30:10.0168 6464 volmgr - ok
12:30:10.0231 6464 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
12:30:10.0246 6464 volmgrx - ok
12:30:10.0262 6464 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys
12:30:10.0278 6464 volsnap - ok
12:30:10.0293 6464 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
12:30:10.0293 6464 vsmraid - ok
12:30:10.0387 6464 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe
12:30:10.0434 6464 VSS - ok
12:30:10.0434 6464 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
12:30:10.0449 6464 vwifibus - ok
12:30:10.0465 6464 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
12:30:10.0496 6464 vwififlt - ok
12:30:10.0543 6464 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll
12:30:10.0605 6464 W32Time - ok
12:30:10.0621 6464 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
12:30:10.0652 6464 WacomPen - ok
12:30:10.0668 6464 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
12:30:10.0714 6464 WANARP - ok
12:30:10.0714 6464 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
12:30:10.0730 6464 Wanarpv6 - ok
12:30:10.0808 6464 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe
12:30:10.0886 6464 wbengine - ok
12:30:10.0886 6464 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
12:30:10.0917 6464 WbioSrvc - ok
12:30:10.0948 6464 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll
12:30:10.0980 6464 wcncsvc - ok
12:30:10.0995 6464 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
12:30:11.0011 6464 WcsPlugInService - ok
12:30:11.0042 6464 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\DRIVERS\wd.sys
12:30:11.0042 6464 Wd - ok
12:30:11.0120 6464 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
12:30:11.0136 6464 Wdf01000 - ok
12:30:11.0151 6464 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll
12:30:11.0229 6464 WdiServiceHost - ok
12:30:11.0229 6464 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll
12:30:11.0245 6464 WdiSystemHost - ok
12:30:11.0276 6464 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll
12:30:11.0307 6464 WebClient - ok
12:30:11.0323 6464 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll
12:30:11.0370 6464 Wecsvc - ok
12:30:11.0385 6464 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll
12:30:11.0432 6464 wercplsupport - ok
12:30:11.0448 6464 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll
12:30:11.0463 6464 WerSvc - ok
12:30:11.0479 6464 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
12:30:11.0510 6464 WfpLwf - ok
12:30:11.0510 6464 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys
12:30:11.0526 6464 WIMMount - ok
12:30:11.0526 6464 WinHttpAutoProxySvc - ok
12:30:11.0557 6464 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
12:30:11.0604 6464 Winmgmt - ok
12:30:11.0650 6464 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll
12:30:11.0713 6464 WinRM - ok
12:30:11.0760 6464 [ FE88B288356E7B47B74B13372ADD906D ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
12:30:11.0791 6464 WinUsb - ok
12:30:11.0806 6464 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll
12:30:11.0853 6464 Wlansvc - ok
12:30:11.0978 6464 [ 98F138897EF4246381D197CB81846D62 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
12:30:12.0025 6464 wlidsvc - ok
12:30:12.0056 6464 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
12:30:12.0072 6464 WmiAcpi - ok
12:30:12.0087 6464 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
12:30:12.0118 6464 wmiApSrv - ok
12:30:12.0150 6464 WMPNetworkSvc - ok
12:30:12.0165 6464 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll
12:30:12.0196 6464 WPCSvc - ok
12:30:12.0228 6464 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
12:30:12.0243 6464 WPDBusEnum - ok
12:30:12.0259 6464 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
12:30:12.0290 6464 ws2ifsl - ok
12:30:12.0290 6464 WSearch - ok
12:30:12.0306 6464 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
12:30:12.0337 6464 WudfPf - ok
12:30:12.0384 6464 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
12:30:12.0384 6464 WUDFRd - ok
12:30:12.0399 6464 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
12:30:12.0430 6464 wudfsvc - ok
12:30:12.0462 6464 [ FE90B750AB808FB9DD8FBB428B5FF83B ] WwanSvc C:\Windows\System32\wwansvc.dll
12:30:12.0524 6464 WwanSvc - ok
12:30:12.0618 6464 X6va005 - ok
12:30:12.0633 6464 ================ Scan global ===============================
12:30:12.0664 6464 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
12:30:12.0696 6464 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
12:30:12.0711 6464 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
12:30:12.0727 6464 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
12:30:12.0758 6464 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
12:30:12.0758 6464 [Global] - ok
12:30:12.0758 6464 ================ Scan MBR ==================================
12:30:12.0774 6464 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
12:30:12.0992 6464 \Device\Harddisk0\DR0 - ok
12:30:12.0992 6464 ================ Scan VBR ==================================
12:30:12.0992 6464 [ 8FB636E50AE62A7F9994F23AA7C7E69B ] \Device\Harddisk0\DR0\Partition1
12:30:12.0992 6464 \Device\Harddisk0\DR0\Partition1 - ok
12:30:13.0023 6464 [ 470BB330CABF399EAF7A6B0CDB56020F ] \Device\Harddisk0\DR0\Partition2
12:30:13.0023 6464 \Device\Harddisk0\DR0\Partition2 - ok
12:30:13.0023 6464 ============================================================
12:30:13.0023 6464 Scan finished
12:30:13.0023 6464 ============================================================
12:30:13.0023 3908 Detected object count: 3
12:30:13.0023 3908 Actual detected object count: 3
12:30:45.0340 3908 Akamai ( HiddenFile.Multi.Generic ) - skipped by user
12:30:45.0340 3908 Akamai ( HiddenFile.Multi.Generic ) - User select action: Skip
12:30:45.0341 3908 BEService ( UnsignedFile.Multi.Generic ) - skipped by user
12:30:45.0341 3908 BEService ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:30:45.0342 3908 HiPatchService ( UnsignedFile.Multi.Generic ) - skipped by user
12:30:45.0342 3908 HiPatchService ( UnsignedFile.Multi.Generic ) - User select action: Skip

markusg · 24.05.2013, 11:40

Hi,
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Batlo · 24.05.2013, 22:55

Combofix Logfile:

Code:

ATTFilter

ComboFix 13-05-24.01 - Kehrer 24.05.2013  23:37:12.2.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8175.6657 [GMT 2:00]
ausgeführt von:: c:\users\Kehrer\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Vorheriger Suchlauf -------
.
c:\users\Kehrer\AppData\Roaming\mIRC\logs\status.log
c:\users\Kehrer\AppData\Roaming\technic-launcher.jar
c:\windows\assembly\GAC_32\Desktop.ini
c:\windows\assembly\GAC_64\Desktop.ini
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-04-24 bis 2013-05-24  ))))))))))))))))))))))))))))))
.
.
2013-05-24 21:45 . 2013-05-24 21:45	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2013-05-24 21:45 . 2013-05-24 21:45	--------	d-----w-	c:\users\hedev\AppData\Local\temp
2013-05-24 21:45 . 2013-05-24 21:45	--------	d-----w-	c:\users\extem2\AppData\Local\temp
2013-05-24 21:45 . 2013-05-24 21:45	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-05-24 21:04 . 2013-05-24 21:04	--------	d-----w-	c:\program files (x86)\LogMeIn Hamachi
2013-05-22 10:36 . 2013-05-22 10:36	--------	d-----w-	c:\users\Kehrer\AppData\Roaming\Avira
2013-05-22 10:36 . 2013-05-22 10:36	83160	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2013-05-22 10:35 . 2013-05-21 23:01	28600	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2013-05-22 10:35 . 2013-05-21 23:01	130016	----a-w-	c:\windows\system32\drivers\avipbb.sys
2013-05-22 10:35 . 2013-05-21 23:01	100712	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2013-05-22 10:35 . 2013-05-22 10:35	--------	d-----w-	c:\program files (x86)\Avira
2013-05-21 23:28 . 2013-05-13 23:48	9460464	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{BBE05A73-2D04-4E89-9705-85B09CBBEDD4}\mpengine.dll
2013-05-21 18:15 . 2013-05-21 18:15	--------	d-----w-	c:\program files (x86)\Common Files\Skype
2013-05-15 05:19 . 2013-04-10 06:01	265064	----a-w-	c:\windows\system32\drivers\dxgmms1.sys
2013-05-08 10:41 . 2013-05-08 10:41	--------	d-----w-	c:\users\Public\Games
2013-04-28 21:13 . 2013-04-28 21:13	--------	d-----w-	C:\Lexmark ToolBar
2013-04-27 12:20 . 2013-04-27 12:20	--------	d-----w-	c:\users\Kehrer\AppData\Local\ESN
2013-04-27 12:18 . 2013-05-19 10:48	--------	d-----w-	c:\program files (x86)\Battlelog Web Plugins
2013-04-27 12:17 . 2013-04-27 12:32	--------	d-----w-	c:\programdata\EA Logs
2013-04-27 12:17 . 2013-04-27 12:17	--------	d-----w-	c:\programdata\EA Core
2013-04-27 09:44 . 2013-04-27 09:44	--------	d--h--w-	c:\program files (x86)\Common Files\EAInstaller
2013-04-27 08:34 . 2013-04-27 08:50	--------	d-----w-	c:\program files (x86)\Origin Games
2013-04-27 08:34 . 2013-04-27 12:14	--------	d-----w-	c:\users\Kehrer\AppData\Local\Origin
2013-04-27 08:32 . 2013-04-27 21:52	--------	d-----w-	c:\programdata\Origin
2013-04-27 08:32 . 2013-04-27 12:17	--------	d-----w-	c:\programdata\Electronic Arts
2013-04-27 08:32 . 2013-04-27 08:38	--------	d-----w-	c:\users\Kehrer\AppData\Roaming\Origin
2013-04-27 08:31 . 2013-04-27 08:34	--------	d-----w-	c:\program files (x86)\Origin
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-19 15:34 . 2011-08-21 09:18	282296	----a-w-	c:\windows\SysWow64\PnkBstrB.exe
2013-05-19 15:34 . 2011-08-20 13:42	282296	----a-w-	c:\windows\SysWow64\PnkBstrB.xtr
2013-05-19 15:25 . 2011-08-20 12:22	282296	----a-w-	c:\windows\SysWow64\PnkBstrB.ex0
2013-05-16 01:05 . 2011-08-10 12:13	75016696	----a-w-	c:\windows\system32\MRT.exe
2013-05-15 04:54 . 2012-07-05 14:24	692104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-05-15 04:54 . 2011-08-10 14:21	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-05-02 00:06 . 2011-08-10 07:00	278800	------w-	c:\windows\system32\MpSigStub.exe
2013-04-28 21:14 . 2009-08-18 11:49	564632	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\wlidui.dll
2013-04-28 21:13 . 2009-08-18 10:24	20808	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-04-27 12:29 . 2011-08-20 12:22	76888	----a-w-	c:\windows\SysWow64\PnkBstrA.exe
2013-04-13 05:49 . 2013-05-15 05:19	135168	----a-w-	c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-15 05:19	350208	----a-w-	c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-15 05:19	308736	----a-w-	c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-15 05:19	111104	----a-w-	c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-15 05:19	474624	----a-w-	c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-15 05:19	2176512	----a-w-	c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 11:10	1656680	----a-w-	c:\windows\system32\drivers\ntfs.sys
2013-04-02 01:03 . 2013-04-02 01:03	73728	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2013-04-02 01:03 . 2013-04-02 01:03	719360	----a-w-	c:\windows\SysWow64\mshtmlmedia.dll
2013-04-02 01:03 . 2013-04-02 01:03	523264	----a-w-	c:\windows\SysWow64\vbscript.dll
2013-04-02 01:03 . 2013-04-02 01:03	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2013-04-02 01:03 . 2013-04-02 01:03	38400	----a-w-	c:\windows\SysWow64\imgutil.dll
2013-04-02 01:03 . 2013-04-02 01:03	226304	----a-w-	c:\windows\system32\elshyph.dll
2013-04-02 01:03 . 2013-04-02 01:03	185344	----a-w-	c:\windows\SysWow64\elshyph.dll
2013-04-02 01:03 . 2013-04-02 01:03	158720	----a-w-	c:\windows\SysWow64\msls31.dll
2013-04-02 01:03 . 2013-04-02 01:03	150528	----a-w-	c:\windows\SysWow64\iexpress.exe
2013-04-02 01:03 . 2013-04-02 01:03	138752	----a-w-	c:\windows\SysWow64\wextract.exe
2013-04-02 01:03 . 2013-04-02 01:03	137216	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2013-04-02 01:03 . 2013-04-02 01:03	12800	----a-w-	c:\windows\SysWow64\mshta.exe
2013-04-02 01:03 . 2013-04-02 01:03	110592	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2013-04-02 01:03 . 2013-04-02 01:03	1054720	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2013-04-02 01:03 . 2013-04-02 01:03	97280	----a-w-	c:\windows\system32\mshtmled.dll
2013-04-02 01:03 . 2013-04-02 01:03	92160	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2013-04-02 01:03 . 2013-04-02 01:03	905728	----a-w-	c:\windows\system32\mshtmlmedia.dll
2013-04-02 01:03 . 2013-04-02 01:03	81408	----a-w-	c:\windows\system32\icardie.dll
2013-04-02 01:03 . 2013-04-02 01:03	77312	----a-w-	c:\windows\system32\tdc.ocx
2013-04-02 01:03 . 2013-04-02 01:03	762368	----a-w-	c:\windows\system32\ieapfltr.dll
2013-04-02 01:03 . 2013-04-02 01:03	62976	----a-w-	c:\windows\system32\pngfilt.dll
2013-04-02 01:03 . 2013-04-02 01:03	61952	----a-w-	c:\windows\SysWow64\tdc.ocx
2013-04-02 01:03 . 2013-04-02 01:03	599552	----a-w-	c:\windows\system32\vbscript.dll
2013-04-02 01:03 . 2013-04-02 01:03	52224	----a-w-	c:\windows\system32\msfeedsbs.dll
2013-04-02 01:03 . 2013-04-02 01:03	51200	----a-w-	c:\windows\system32\imgutil.dll
2013-04-02 01:03 . 2013-04-02 01:03	48640	----a-w-	c:\windows\system32\mshtmler.dll
2013-04-02 01:03 . 2013-04-02 01:03	452096	----a-w-	c:\windows\system32\dxtmsft.dll
2013-04-02 01:03 . 2013-04-02 01:03	441856	----a-w-	c:\windows\system32\html.iec
2013-04-02 01:03 . 2013-04-02 01:03	361984	----a-w-	c:\windows\SysWow64\html.iec
2013-04-02 01:03 . 2013-04-02 01:03	281600	----a-w-	c:\windows\system32\dxtrans.dll
2013-04-02 01:03 . 2013-04-02 01:03	27648	----a-w-	c:\windows\system32\licmgr10.dll
2013-04-02 01:03 . 2013-04-02 01:03	270848	----a-w-	c:\windows\system32\iedkcs32.dll
2013-04-02 01:03 . 2013-04-02 01:03	247296	----a-w-	c:\windows\system32\webcheck.dll
2013-04-02 01:03 . 2013-04-02 01:03	235008	----a-w-	c:\windows\system32\url.dll
2013-04-02 01:03 . 2013-04-02 01:03	23040	----a-w-	c:\windows\SysWow64\licmgr10.dll
2013-04-02 01:03 . 2013-04-02 01:03	216064	----a-w-	c:\windows\system32\msls31.dll
2013-04-02 01:03 . 2013-04-02 01:03	197120	----a-w-	c:\windows\system32\msrating.dll
2013-04-02 01:03 . 2013-04-02 01:03	173568	----a-w-	c:\windows\system32\ieUnatt.exe
2013-04-02 01:03 . 2013-04-02 01:03	167424	----a-w-	c:\windows\system32\iexpress.exe
2013-04-02 01:03 . 2013-04-02 01:03	1509376	----a-w-	c:\windows\system32\inetcpl.cpl
2013-04-02 01:03 . 2013-04-02 01:03	149504	----a-w-	c:\windows\system32\occache.dll
2013-04-02 01:03 . 2013-04-02 01:03	144896	----a-w-	c:\windows\system32\wextract.exe
2013-04-02 01:03 . 2013-04-02 01:03	1441280	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2013-04-02 01:03 . 2013-04-02 01:03	1400416	----a-w-	c:\windows\system32\ieapfltr.dat
2013-04-02 01:03 . 2013-04-02 01:03	13824	----a-w-	c:\windows\system32\mshta.exe
2013-04-02 01:03 . 2013-04-02 01:03	136192	----a-w-	c:\windows\system32\iepeers.dll
2013-04-02 01:03 . 2013-04-02 01:03	135680	----a-w-	c:\windows\system32\IEAdvpack.dll
2013-04-02 01:03 . 2013-04-02 01:03	12800	----a-w-	c:\windows\system32\msfeedssync.exe
2013-04-02 01:03 . 2013-04-02 01:03	102912	----a-w-	c:\windows\system32\inseng.dll
2013-04-02 01:02 . 2013-04-02 01:02	9728	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-04-02 01:02 . 2013-04-02 01:02	9728	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-04-02 01:02 . 2013-04-02 01:02	648192	----a-w-	c:\windows\system32\d3d10level9.dll
2013-04-02 01:02 . 2013-04-02 01:02	604160	----a-w-	c:\windows\SysWow64\d3d10level9.dll
2013-04-02 01:02 . 2013-04-02 01:02	5632	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-04-02 01:02 . 2013-04-02 01:02	5632	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-04-02 01:02 . 2013-04-02 01:02	5632	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-04-02 01:02 . 2013-04-02 01:02	5632	---ha-w-	c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-04-02 01:02 . 2013-04-02 01:02	522752	----a-w-	c:\windows\system32\XpsGdiConverter.dll
2013-04-02 01:02 . 2013-04-02 01:02	465920	----a-w-	c:\windows\system32\WMPhoto.dll
2013-04-02 01:02 . 2013-04-02 01:02	417792	----a-w-	c:\windows\SysWow64\WMPhoto.dll
2013-04-02 01:02 . 2013-04-02 01:02	4096	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-04-02 01:02 . 2013-04-02 01:02	4096	---ha-w-	c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-04-02 01:02 . 2013-04-02 01:02	3928064	----a-w-	c:\windows\system32\d2d1.dll
2013-04-02 01:02 . 2013-04-02 01:02	364544	----a-w-	c:\windows\SysWow64\XpsGdiConverter.dll
2013-04-02 01:02 . 2013-04-02 01:02	363008	----a-w-	c:\windows\system32\dxgi.dll
2013-04-02 01:02 . 2013-04-02 01:02	3584	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-04-02 01:02 . 2013-04-02 01:02	3584	---ha-w-	c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-04-02 01:02 . 2013-04-02 01:02	3419136	----a-w-	c:\windows\SysWow64\d2d1.dll
2013-04-02 01:02 . 2013-04-02 01:02	333312	----a-w-	c:\windows\system32\d3d10_1core.dll
2013-04-02 01:02 . 2013-04-02 01:02	3072	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2013-04-02 01:02 . 2013-04-02 01:02	3072	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-04-02 01:02 . 2013-04-02 01:02	3072	---ha-w-	c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-04-02 01:02 . 2013-04-02 01:02	3072	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-04-02 01:02 . 2013-04-02 01:02	296960	----a-w-	c:\windows\system32\d3d10core.dll
2013-04-02 01:02 . 2013-04-02 01:02	293376	----a-w-	c:\windows\SysWow64\dxgi.dll
2013-04-02 01:02 . 2013-04-02 01:02	2776576	----a-w-	c:\windows\system32\msmpeg2vdec.dll
2013-04-02 01:02 . 2013-04-02 01:02	2565120	----a-w-	c:\windows\system32\d3d10warp.dll
2013-04-02 01:02 . 2013-04-02 01:02	2560	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-04-02 01:02 . 2013-04-02 01:02	2560	---ha-w-	c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-04-02 01:02 . 2013-04-02 01:02	249856	----a-w-	c:\windows\SysWow64\d3d10_1core.dll
2013-04-02 01:02 . 2013-04-02 01:02	245248	----a-w-	c:\windows\system32\WindowsCodecsExt.dll
2013-04-02 01:02 . 2013-04-02 01:02	2284544	----a-w-	c:\windows\SysWow64\msmpeg2vdec.dll
2013-04-02 01:02 . 2013-04-02 01:02	221184	----a-w-	c:\windows\system32\UIAnimation.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Akamai NetSession Interface"="c:\users\Kehrer\AppData\Local\Akamai\netsession_win.exe" [2013-01-26 4480768]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-04-19 18678376]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-11-05 283160]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 152544]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-05-21 345312]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2013-05-15 2255184]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Erinnerungen für Microsoft Works-Kalender.lnk - c:\program files (x86)\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [1999-8-6 53317]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2012-07-08 123856]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-04-19 161384]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [2010-04-06 31272]
R3 BEService;BattlEye Service;c:\program files (x86)\Common Files\BattlEye\BEService.exe [2013-04-05 49152]
R3 dump_wmimmc;dump_wmimmc;c:\program files (x86)\Games-Masters.com\CABAL Online (Europe)\GameGuard\dump_wmimmc.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]
R3 PAC207;SoC PC-Camera;c:\windows\system32\DRIVERS\PFC027.SYS [2006-12-05 572416]
R3 RTL8192cu;Realtek RTL8192CU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192cu.sys [x]
R3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys [2010-07-01 38992]
R3 skfiltv;skfiltv;c:\windows\system32\drivers\skfiltv.sys [2008-08-14 24064]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-09-28 53760]
R3 X6va005;X6va005;c:\users\Kehrer\AppData\Local\Temp\005E16A.tmp [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [2011-01-10 21104]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-05-21 28600]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2013-05-21 86752]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [2011-09-21 21992]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2013-05-15 2467664]
S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [2013-04-23 9216]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-05 13336]
S2 lxea_device;lxea_device;c:\windows\system32\lxeacoms.exe [2010-04-14 1052328]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-01-18 383264]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-11-19 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-11-19 181248]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-12-24 412264]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai	REG_MULTI_SZ   	Akamai
.
Inhalt des "geplante Tasks" Ordners
.
2013-05-24 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-05 04:54]
.
2013-05-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3281158987-627306578-157583830-1000Core.job
- c:\users\Kehrer\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-20 09:12]
.
2013-05-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3281158987-627306578-157583830-1000UA.job
- c:\users\Kehrer\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-20 09:12]
.
2013-05-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3281158987-627306578-157583830-1004Core.job
- c:\users\extem2\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-07 14:39]
.
2013-05-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3281158987-627306578-157583830-1004UA.job
- c:\users\extem2\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-07 14:39]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-01-04 11772520]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"lxeamon.exe"="c:\program files (x86)\Lexmark S300-S400 Series\lxeamon.exe" [2011-01-24 770728]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - LocalService
FontCache
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = 127.0.0.1:9421;<local>;*.local
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~3\OFFICE11\EXCEL.EXE/3000
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
FF - ProfilePath - c:\users\Kehrer\AppData\Roaming\Mozilla\Firefox\Profiles\uta1vmja.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-Clownfish - (no file)
Wow6432Node-HKCU-Run-RGSC - c:\program files (x86)\Steam\SteamApps\common\Grand Theft Auto IV\GTAIV\RGSCLauncher.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-BattlEye for A2 - c:\program files (x86)\steam\steamapps\common\arma 2BattlEye\UnInstallBE.exe
AddRemove-mIRC - c:\users\Kehrer\Desktop\mIRC\uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_ca0e279.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va005]
"ImagePath"="\??\c:\users\Kehrer\AppData\Local\Temp\005E16A.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
   1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{336D0C35-8A85-403a-B9D2-65C292C39087}"=hex:51,66,7a,6c,4c,1d,3b,1b,08,1f,66,
   1a,82,e9,65,3d,9d,e9,17,af,a2,b0,e5,ab
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:64,a9,0a,c0,41,96,cc,01
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,39,72,38,72,8c,05,73,4d,b8,2c,7a,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,39,72,38,72,8c,05,73,4d,b8,2c,7a,\
.
[HKEY_USERS\S-1-5-21-3281158987-627306578-157583830-1000\Software\SecuROM\License information*]
"datasecu"=hex:11,13,b0,58,2d,0e,c8,da,ad,5f,1c,6e,6c,ca,4c,36,3f,0a,4b,6f,61,
   f9,ac,d6,27,de,20,f4,bf,79,4a,9d,da,12,cf,3f,64,d6,3e,9b,5e,40,8d,b3,3b,e5,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-05-24  23:47:37
ComboFix-quarantined-files.txt  2013-05-24 21:47
.
Vor Suchlauf: 16 Verzeichnis(se), 602.314.747.904 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 602.120.237.056 Bytes frei
.
- - End Of File - - C871621EE4926C143E7E9F5F9A408B2E

--- --- ---

markusg · 24.05.2013, 23:07

Hi,
malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Batlo · 27.05.2013, 12:10

Malwarebytes Anti-Malware 1.75.0.1300
Malwarebytes : Free Anti-Malware download

Datenbank Version: v2013.05.26.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16576
Kehrer :: EXTR3M [Administrator]

27.05.2013 11:19:17
mbam-log-2013-05-27 (11-19-17).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 587212
Laufzeit: 1 Stunde(n), 20 Minute(n), 43 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Kann ich Skype wieder verwenden , oder ist der Virus noch auf meinem PC ?

mfg Batlo

markusg · 28.05.2013, 09:08

Teste es mal.

lade den CCleaner standard:
CCleaner - Download - Filepony
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Skype Virus - ' Dies ist ein sehr schönes Foto von dir '

Plagegeister aller Art und deren Bekämpfung: Skype Virus - ' Dies ist ein sehr schönes Foto von dir '