Exp/cve-2012-1723.a1

chatt · 05.07.2013, 14:40

Hallo miteinander,

ich habe gestern meinen PC komplett scannen lassen. Avira meldete dann, dass sich in der minecraft-1.8.jar Datei Erkennungsmuster des Exploits "EXP/CVE-2012-1723.A1" befinden.
Avira hat die Datei in Quarantäne verschoben. Ich habe erneut 2 Scans durchgeführt, die keine Funde angezeigt haben. Kann ich mein System nun wieder nutzen oder muss ich noch weitere Schritte zur Säuberung des PC befolgen? Worauf ist dieses Exploit angesetzt, denn ich kenne mich in solchen Sachen echt nicht so gut aus und kann ich Daten von meinem "betroffenem" PC auf eine DVD brennen ohne zu riskieren, dass da das Exploit etc. mit raufkommt?

Ich wäre über eure Hilfe sehr dankbar!

MFG

Chatt

markusg · 05.07.2013, 14:44

Hi,

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die
Textbox.

Code:

ATTFilter

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
C:\Windows\system32\*.tsp
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

chatt · 05.07.2013, 15:20

Hier sind die Files.

OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 05.07.2013 15:52:18 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\****\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 6,03 Gb Available Physical Memory | 75,54% Memory free
15,96 Gb Paging File | 14,03 Gb Available in Paging File | 87,96% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931,41 Gb Total Space | 733,19 Gb Free Space | 78,72% Space Free | Partition Type: NTFS
 
Computer Name: ****-PC | User Name: **** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1"
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1"
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04282734-FD8E-4470-ACFA-8F137D076DBE}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{0ADA85C9-163F-47F8-9D8E-D76A5D64DB7E}" = rport=137 | protocol=17 | dir=out | app=system | 
"{0D24D21A-41C3-4F65-9C44-64C5C7C4D19F}" = rport=139 | protocol=6 | dir=out | app=system | 
"{0E727E6B-CEDB-46C4-A6B2-C60626500ECA}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{172C1AA8-ABD9-46EF-9E6F-861CA41E29AB}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{34869755-5239-4F3F-9091-A3BFCBC0E1D7}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{42D99FCD-5DD7-4BDA-896B-86E3CEA24390}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{50EA25E4-A86D-4726-B985-3615876F73DA}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{5504A2F1-A1A0-49A8-8575-DD4D2ED93138}" = rport=138 | protocol=17 | dir=out | app=system | 
"{59A761B5-4CA1-442C-B944-3979887400F7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{6373C04D-9B2C-4DD8-BDDC-A60AF9AC7F43}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{6464EACB-33A5-495A-9B8B-461B7DC8DF2F}" = lport=445 | protocol=6 | dir=in | app=system | 
"{688F8B5C-B57F-41AC-A5B9-F3698D093D99}" = rport=445 | protocol=6 | dir=out | app=system | 
"{8B691FE1-20E0-47E7-BC26-5BDC568979F1}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{94C921D7-3C91-4B4C-BA0A-7600B65A49F2}" = lport=137 | protocol=17 | dir=in | app=system | 
"{9589F531-0CB2-4B34-96D1-7A6DF093C485}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{A655F01C-1F57-4147-931F-D4981533F4D3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{ABE35F22-B404-4F08-B725-85E88ECB9999}" = lport=139 | protocol=6 | dir=in | app=system | 
"{ACFE5EE6-1488-465D-A7FC-4DA329964F82}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{C2BA10F7-2897-4060-A10A-B0C85E6A9F8B}" = lport=138 | protocol=17 | dir=in | app=system | 
"{C45EF52E-91C7-4C00-8896-C15C1BE65938}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{CC24E1C8-C0A6-4B0F-B032-F4CAFB3CF343}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{FB24E323-5344-4A02-9B62-0ABAC4A544BE}" = lport=2869 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01A6C708-6AA3-4D1D-8B25-A00F68791321}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp_server.exe | 
"{0573F87D-CC65-4FB6-B1FA-9693AC96C7F3}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops ii\t6zm.exe | 
"{0A404541-B0E5-43E8-8948-EF2D650D3C59}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{101799D7-FED1-43F6-B1EA-930001FA6FB0}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{10378960-37F0-40DD-B2C0-50F8AB405279}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{1294A7D9-2C05-4F06-89B9-22C4D7E2A678}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | 
"{200ACEB8-6454-4791-BFD4-221C338E219C}" = dir=in | app=c:\program files\hp\hp officejet 6600\bin\devicesetup.exe | 
"{28481FEF-D8F7-4636-B6DB-3F5F04B77BC3}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe | 
"{3310F900-3D7E-47FD-A50B-39BAA05363AF}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dota 2 beta\dota.exe | 
"{344CDA1C-9CDF-4EC1-90D9-4A3C75C2B229}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\natural selection 2\ns2.exe | 
"{3629A212-9ABF-4222-9017-F906B04B1BC8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{36922A1C-E98C-40CE-A335-1A405A3D4B53}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{373DF08D-5193-4737-B1F2-CE0C81577A6A}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp_server.exe | 
"{3B0A916C-76CD-4A78-B9C7-867988FBC0CC}" = protocol=6 | dir=in | app=c:\users\****\appdata\roaming\spotify\spotify.exe | 
"{3B303FC8-27AA-44ED-9F4E-20FC2298CC2A}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops ii\t6zm.exe | 
"{3CC6206C-4FBF-490A-B70E-9AFB62394027}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{3E122913-EED6-435A-B857-A62CF47AEA37}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 
"{3EB1AB51-51BF-4BA1-913C-85838D529761}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe | 
"{42E19F53-B36C-4F63-98E9-4F485171A0C0}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{46311070-2E11-445D-909F-F8AE211EA085}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops ii\t6mp.exe | 
"{46DB4D87-F3FA-417F-BB8E-FB51E76904D8}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{490F8E4A-220A-4838-8A2C-F2BE198C386E}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 
"{4A11166A-F1DB-4BB8-A1AE-709C34139F0E}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe | 
"{4A9D6E16-B735-4EC6-9BC0-691518759D7A}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp_server.exe | 
"{4CE044B1-B0FB-4567-93B3-71312A5CC387}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{56FF4BF3-C006-4E04-BD32-3AF6CAA2921C}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe | 
"{575940DF-2B0A-4605-8F68-D362E4ED0CED}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 
"{5C749BF4-6A4E-4D17-894A-10047D09B39B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\sdklauncher.exe | 
"{5E11CBD2-3B85-487B-ACD7-06BA21936BA1}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe | 
"{614989CE-6F26-4861-8E79-146D4739E3A5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{6303E898-CC3B-4852-B958-E0FE9E51C4B8}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{668709C3-AB10-4302-A81D-C02704434C6B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe | 
"{670B5AA7-5FC5-46A5-B362-6645DAA80AB7}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{6EBCC3E0-F6D1-44D6-8BC4-BD72799949BF}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 
"{6FB0EDA2-9D1A-4E67-BBBE-2A6F82CBF7B9}" = protocol=6 | dir=in | app=c:\users\****\appdata\roaming\dropbox\bin\dropbox.exe | 
"{736F4AA7-F38A-4386-943F-65088395DDA3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{747BECCB-CA73-43F1-9359-6134CDA57A3F}" = protocol=6 | dir=in | app=c:\users\****\appdata\roaming\dropbox\bin\dropbox.exe | 
"{7A098263-975A-4282-92C3-06F622C2294E}" = dir=in | app=c:\program files\hp\hp officejet 6600\bin\hpnetworkcommunicator.exe | 
"{7A9EC2F6-9652-4F2B-B361-6ABC240A4D40}" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"{7D50EA06-F4DF-4AE5-9DB3-8E5437463B6C}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{816E18A7-12ED-410C-A1D8-12CE6421829B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops ii\t6sp.exe | 
"{820C0BED-6101-4B0E-9CFF-2CBA93C20C4A}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{82D47D9B-7530-4C26-9BD1-63EF61A1EA15}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{84F17F5E-28DD-4CCB-BAFF-D502442839C7}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dota 2 beta\dota.exe | 
"{8DECFD62-E63E-4523-9EEE-E7CCC1238825}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{97CE2DED-C1E6-4ADC-8008-01F8C28FC598}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{993CF89F-893B-45AB-A030-DD38C1F11A93}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | 
"{994E026E-B1B3-4E16-B17A-3EBFA9301FB8}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{9D521FA3-4500-439C-A840-E9FF5AB4D75F}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\natural selection 2\ns2.exe | 
"{9D7A2A7B-A568-4DC3-9366-2A21AE816C83}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{9E254F9E-00C1-4964-BB71-AAD0D1EC72BE}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe | 
"{A5DF7AB3-CE08-4200-BEB8-6615EFF49E41}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{A7BF6939-FBF8-408F-879F-20BF5686AE0F}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{AA985E61-0183-4B06-9AA7-9151D92D8739}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{AB34D1A9-9E90-4CC7-A048-A9C72D927A57}" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"{AF8A2C98-4B17-45AD-9821-9C0A58ED91D9}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{B57329D3-FA25-4C3C-96E2-F0105C0B24BC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{B6034F94-BD86-483C-B2AC-6D24D3C596A2}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{B60B6CBF-0464-417F-9E5E-3EB7B9D39157}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 
"{B9527D0E-4768-445C-A1CB-3619DD45F5E3}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe | 
"{C06205B3-B62F-4072-A67B-5F824853DCFB}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 
"{C2303363-2C77-477D-8AE5-F5234C6649FE}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe | 
"{C4752675-8C6C-4BFF-A14D-4F3554340731}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{C83EE605-711F-43E1-9448-852C280A448A}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{CA99BD27-BD13-4033-96FA-99CC906942AF}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 
"{CAB807C7-F52D-42B9-8B60-483513A806FF}" = protocol=17 | dir=in | app=c:\users\****\appdata\roaming\dropbox\bin\dropbox.exe | 
"{CDDB3F93-89E1-4270-A959-E03F1BF8689A}" = protocol=17 | dir=in | app=c:\users\****\appdata\roaming\spotify\spotify.exe | 
"{D07C4CFA-479C-47B6-BEAD-552842E11486}" = protocol=17 | dir=in | app=c:\users\****\appdata\roaming\dropbox\bin\dropbox.exe | 
"{D0B0BF56-0CE1-4B7F-AA29-D6B927CAA7C8}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dota 2 beta\dota.exe | 
"{D0ED58E9-F9C2-4116-8C0F-0EB945378B2F}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops ii\t6sp.exe | 
"{D12E5FB6-6585-47B3-A5E3-68F1A2511EAB}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\sdklauncher.exe | 
"{D2EDB22F-CD08-4517-976C-3A181CBD5E84}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{D49329F1-DBAC-4697-A08E-26792928D634}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{D4D4E775-8E16-4695-9AA0-B6ABF7B038EF}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops ii\t6mp.exe | 
"{D73087D6-9206-4E15-814A-B5D05E13DF5B}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dota 2 beta\dota.exe | 
"{D743985F-CAAC-4C4E-B367-DB8CCA8933DA}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{D87BC945-E77E-4661-8418-9161BE668EF4}" = protocol=6 | dir=out | app=system | 
"{D8DADD8D-A1A9-48FD-85CC-15A5343601C2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{E074F8E9-BE3F-441B-B0F7-893D8FD1A2AC}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{E725289B-4382-4443-BCD3-DC607C219C8C}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp_server.exe | 
"{F115CCE2-4E2B-4F95-8379-54A1A736FF7E}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{F59308BA-DB6A-4842-9DDD-098A86C47712}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe | 
"{F7E6A89B-4FFF-4410-9938-824CA0A6D675}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{FA18388A-5197-45CF-9ECE-DE3A6EA09C36}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{FA6BDF2C-D6A1-420E-9970-8DD6C4A7CAE5}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 
"TCP Query User{00BB73DA-E400-4E81-BFAC-0783D3E4D2A6}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"TCP Query User{1884B1C5-1476-495A-8BBE-1FFA3103009C}C:\program files (x86)\guild wars 2\gw2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\guild wars 2\gw2.exe | 
"TCP Query User{94DFA609-91CD-4AD0-842A-F8AA230D5FA0}C:\users\****\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\****\appdata\roaming\spotify\spotify.exe | 
"TCP Query User{CCB677AC-25C4-4003-B755-959017C90E2B}C:\program files (x86)\steam\steamapps\hattori95\counter-strike source\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\hattori95\counter-strike source\hl2.exe | 
"UDP Query User{156B1161-DA9E-4D7D-B46F-947E02A20BB2}C:\users\****\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\****\appdata\roaming\spotify\spotify.exe | 
"UDP Query User{25C4BA7D-57F0-4B71-A869-895138408A2D}C:\program files (x86)\steam\steamapps\hattori95\counter-strike source\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\hattori95\counter-strike source\hl2.exe | 
"UDP Query User{88505D80-E308-4AEA-A4E0-6BFE15E56689}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"UDP Query User{D7C4A4BD-8C85-4C5A-B407-0A5E1786AFEF}C:\program files (x86)\guild wars 2\gw2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\guild wars 2\gw2.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{26A24AE4-039D-4CA4-87B4-2F86416021FF}" = Java(TM) 6 Update 21 (64-bit)
"{26A24AE4-039D-4CA4-87B4-2F86417000FF}" = Java(TM) 7 (64-bit)
"{2F72F540-1F60-4266-9506-952B21D6640D}" = Apple Mobile Device Support
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7FCDABCC-1A1E-4D61-909D-BA9495172774}" = iTunes
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{A1E85B9A-AFAD-4D38-AF01-6B020DD5213A}" = Logitech GamePanel Software 3.06.109
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 314.22
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 314.22
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 314.22
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 314.22
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.1031
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.12.12
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.23.1
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{C768E610-4DFB-4A60-A59B-71549EB7BF75}" = HP Officejet 6600 - Grundlegende Software für das Gerät
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"RolandRDID0104" = ME-25-Treiber
"VLC media player" = VLC media player 2.0.5
"WinRAR archiver" = WinRAR 4.01 (64-Bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 25
"{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF010}" = Tribes Ascend
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}" = Hi-Rez Studios Authenticate and Update Service
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}" = OpenOffice.org 3.4
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.5
"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{5DF7AA5E-A1CB-11E0-A7D6-0013D3D69929}" = MSVCRT Redists
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{85DF2EED-08BC-46FB-90DA-28B0D0A8E8A8}" = HP Update
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}" = NVIDIA PhysX
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{95140000-00AF-0407-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{9580813D-94B1-4C28-9426-A441E2BB29A5}" = Counter-Strike: Source
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C4D79B6-238E-49D8-AEBC-26384EBDE6B3}" = Windows Phone app for desktop
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.7) - Deutsch
"{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{C05905B9-775A-4894-A4DF-B57C15250958}" = Razer Imperator
"{C5DA59CF-2BB8-48D5-8E5B-17F2E0F0FEE4}" = System Requirements Lab for Intel
"{C818BA3A-226F-4ED0-9CEF-96A0DF300211}" = HP Officejet 6600 Hilfe
"{CA6BCA2F-EDEB-408F-850B-31404BE16A61}" = I.R.I.S. OCR
"{D793423B-FF18-4A54-B9C9-75B3396BAAC4}" = Browser Configuration Utility
"{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}" = Asmedia ASM104x USB 3.0 Host Controller Driver
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"AVMWLANCLI" = AVM FRITZ!WLAN
"Battlelog Web Plugins" = Battlelog Web Plugins
"ESN Sonar-0.70.4" = ESN Sonar
"Guild Wars" = GUILD WARS
"Guild Wars 2" = Guild Wars 2
"KLiteCodecPack_is1" = K-Lite Codec Pack 6.0.4 (Basic)
"MPE" = MyPhoneExplorer
"mv61xxDriver" = marvell 61xx
"NCLauncher_GameForge" = NC Launcher (GameForge)
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"SONAR85LE_is1" = SONAR LE
"Steam App 10180" = Call of Duty: Modern Warfare 2
"Steam App 10190" = Call of Duty: Modern Warfare 2 - Multiplayer
"Steam App 200170" = Worms Revolution
"Steam App 202970" = Call of Duty: Black Ops II
"Steam App 202990" = Call of Duty: Black Ops II - Multiplayer
"Steam App 212910" = Call of Duty: Black Ops II - Zombies
"Steam App 240" = Counter-Strike: Source
"Steam App 42680" = Call of Duty: Modern Warfare 3
"Steam App 42690" = Call of Duty: Modern Warfare 3 - Multiplayer
"Steam App 42750" = Call of Duty: Modern Warfare 3 - Dedicated Server
"Steam App 4920" = Natural Selection 2
"Steam App 570" = Dota 2
"Steam App 730" = Counter-Strike: Global Offensive
"Steam App 745" = Counter-Strike: Global Offensive - SDK
"SystemRequirementsLab" = System Requirements Lab
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
"Spotify" = Spotify
"TeamSpeak 3 Client" = TeamSpeak 3 Client
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 10.12.2012 13:01:43 | Computer Name = ****-PC | Source = Google Update | ID = 20
Description = 
 
Error - 12.12.2012 09:51:38 | Computer Name = ****-PC | Source = MsiInstaller | ID = 11609
Description = 
 
Error - 14.12.2012 03:39:56 | Computer Name = ****-PC | Source = Google Update | ID = 20
Description = 
 
Error - 14.12.2012 07:51:03 | Computer Name = ****-PC | Source = Application Hang | ID = 1002
Description = Programm iw5mp.exe, Version 0.0.0.0 kann nicht mehr unter Windows 
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 1728    Startzeit:
 01cdd9f130b427fb    Endzeit: 23    Anwendungspfad: c:\program files (x86)\steam\steamapps\common\call
 of duty modern warfare 3\iw5mp.exe    Berichts-ID: 8619a5c1-45e4-11e2-a2ef-bc054304263a

 
Error - 15.12.2012 11:40:05 | Computer Name = ****-PC | Source = Application Hang | ID = 1002
Description = Programm iw5mp.exe, Version 0.0.0.0 kann nicht mehr unter Windows 
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 1ca8    Startzeit:
 01cddad8d0e358e2    Endzeit: 72    Anwendungspfad: c:\program files (x86)\steam\steamapps\common\call
 of duty modern warfare 3\iw5mp.exe    Berichts-ID: b0c63241-46cd-11e2-aa09-bc054304263a

 
Error - 15.12.2012 12:14:33 | Computer Name = ****-PC | Source = Application Hang | ID = 1002
Description = Programm LolClient.exe, Version 2.0.2.12610 kann nicht mehr unter 
Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in
 der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem 
zu suchen.    Prozess-ID: 10cc    Startzeit: 01cddab526dcccac    Endzeit: 2    Anwendungspfad: C:\Riot
 Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.0.228\deploy\LolClient.exe

Berichts-ID:
 813b452d-46d2-11e2-aa09-bc054304263a  
 
Error - 15.12.2012 12:39:05 | Computer Name = ****-PC | Source = Google Update | ID = 20
Description = 
 
Error - 19.12.2012 12:39:32 | Computer Name = ****-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: League of Legends.exe, Version: 1.0.0.152,
 Zeitstempel: 0x50c7e311  Name des fehlerhaften Moduls: League of Legends.exe, Version:
 1.0.0.152, Zeitstempel: 0x50c7e311  Ausnahmecode: 0xc0000005  Fehleroffset: 0x004a540a
ID
 des fehlerhaften Prozesses: 0x1e80  Startzeit der fehlerhaften Anwendung: 0x01cdde070f4e8ce8
Pfad
 der fehlerhaften Anwendung: C:\Riot Games\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.0.203\deploy\League
 of Legends.exe  Pfad des fehlerhaften Moduls: C:\Riot Games\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.0.203\deploy\League
 of Legends.exe  Berichtskennung: a9c28338-49fa-11e2-9f9b-bc054304263a
 
Error - 19.12.2012 12:42:52 | Computer Name = ****-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: League of Legends.exe, Version: 1.0.0.152,
 Zeitstempel: 0x50c7e311  Name des fehlerhaften Moduls: League of Legends.exe, Version:
 1.0.0.152, Zeitstempel: 0x50c7e311  Ausnahmecode: 0xc0000005  Fehleroffset: 0x004a540a
ID
 des fehlerhaften Prozesses: 0x1964  Startzeit der fehlerhaften Anwendung: 0x01cdde078beab890
Pfad
 der fehlerhaften Anwendung: C:\Riot Games\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.0.203\deploy\League
 of Legends.exe  Pfad des fehlerhaften Moduls: C:\Riot Games\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.0.203\deploy\League
 of Legends.exe  Berichtskennung: 20df6fe5-49fb-11e2-9f9b-bc054304263a
 
Error - 20.12.2012 06:24:41 | Computer Name = ****-PC | Source = MsiInstaller | ID = 11609
Description = 
 
[ System Events ]
Error - 04.07.2013 15:29:58 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7038
Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"
 mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:   %%1330    Vergewissern
 Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
 Management Console (MMC).
 
Error - 04.07.2013 15:29:58 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%1069
 
Error - 05.07.2013 04:24:35 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVR0FLASHDev" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 05.07.2013 04:26:42 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7038
Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"
 mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:   %%1330    Vergewissern
 Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
 Management Console (MMC).
 
Error - 05.07.2013 04:26:42 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%1069
 
Error - 05.07.2013 04:26:45 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7024
Description = Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem
 Fehler beendet: %%-1073473535.
 
Error - 05.07.2013 04:26:45 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits
 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt:
 Neustart des Diensts.
 
Error - 05.07.2013 07:16:39 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVR0FLASHDev" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 05.07.2013 07:19:08 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7038
Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"
 mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:   %%1330    Vergewissern
 Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
 Management Console (MMC).
 
Error - 05.07.2013 07:19:08 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%1069
 
 
< End of report >

--- --- ---
OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 05.07.2013 15:52:18 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\****\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 6,03 Gb Available Physical Memory | 75,54% Memory free
15,96 Gb Paging File | 14,03 Gb Available in Paging File | 87,96% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931,41 Gb Total Space | 733,19 Gb Free Space | 78,72% Space Free | Partition Type: NTFS
 
Computer Name: ****-PC | User Name: **** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.07.05 15:49:41 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\****\Desktop\OTL.exe
PRC - [2013.06.26 12:52:55 | 000,084,024 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2013.06.26 12:50:43 | 000,108,088 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2013.06.26 12:50:42 | 000,345,144 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.03.14 22:07:46 | 000,383,264 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012.10.02 13:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012.07.15 15:55:12 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2011.07.25 16:58:41 | 003,077,528 | ---- | M] () -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
PRC - [2011.02.01 13:20:48 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2011.02.01 13:20:46 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010.12.02 04:15:14 | 000,915,584 | R--- | M] () -- C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe
PRC - [2010.11.05 23:54:22 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.11.05 23:54:20 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.11.03 11:30:14 | 000,918,144 | R--- | M] () -- C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
PRC - [2010.10.22 03:00:00 | 002,105,344 | R--- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
PRC - [2010.10.22 03:00:00 | 000,376,832 | R--- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
PRC - [2010.10.21 11:52:26 | 000,586,880 | R--- | M] () -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe
PRC - [2009.10.26 13:16:00 | 000,223,464 | ---- | M] (DeviceVM, Inc.) -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
PRC - [2009.10.26 13:15:56 | 000,375,000 | ---- | M] (DeviceVM, Inc.) -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.05.16 22:21:36 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\30e3a21202000677d0a9270572251477\System.Windows.Forms.ni.dll
MOD - [2013.05.16 22:21:26 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\716959df79685a1eae0fc14275a32b0f\WindowsBase.ni.dll
MOD - [2013.05.16 22:21:24 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll
MOD - [2013.01.11 14:51:04 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\4d6518ef6ae8d6f005c49ab1c86de7fe\IAStorCommon.ni.dll
MOD - [2013.01.11 14:51:03 | 000,475,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\ab54c04b3df40416205883b4049fe273\IAStorUtil.ni.dll
MOD - [2013.01.10 18:56:23 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll
MOD - [2013.01.10 18:56:05 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll
MOD - [2013.01.10 18:55:54 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll
MOD - [2013.01.10 18:55:51 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013.01.10 18:55:47 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll
MOD - [2011.07.25 16:58:41 | 003,077,528 | ---- | M] () -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
MOD - [2011.04.12 09:43:06 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2010.11.13 01:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.06.27 10:11:12 | 000,503,202 | ---- | M] () -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\sqlite3.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2013.06.26 12:52:55 | 000,084,024 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.06.26 12:50:43 | 000,108,088 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2013.06.12 20:23:23 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.06.07 00:06:24 | 000,543,656 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2013.06.03 16:21:54 | 000,162,408 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.03.15 07:53:06 | 001,266,464 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2013.03.14 22:07:46 | 000,383,264 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.12.04 13:13:36 | 000,008,704 | ---- | M] (Hi-Rez Studios) [Auto | Running] -- C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe -- (HiPatchService)
SRV - [2012.10.02 13:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.07.15 15:55:12 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011.02.01 13:20:48 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2011.02.01 13:20:46 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010.12.02 04:15:14 | 000,915,584 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe -- (asHmComSvc)
SRV - [2010.11.05 23:54:22 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.11.03 11:30:14 | 000,918,144 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe -- (asComSvc)
SRV - [2010.10.22 03:00:00 | 000,376,832 | R--- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe -- (AVM WLAN Connection Service)
SRV - [2010.10.21 11:52:26 | 000,586,880 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe -- (AsSysCtrlService)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.10.26 13:16:00 | 000,223,464 | ---- | M] (DeviceVM, Inc.) [Auto | Running] -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe -- (BCUService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013.04.26 14:28:58 | 000,130,016 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2013.04.26 14:28:58 | 000,100,712 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2013.04.26 14:28:58 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.12.19 07:41:52 | 000,194,488 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012.10.22 14:33:36 | 000,027,760 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggsemc.sys -- (ggsemc)
DRV:64bit: - [2012.10.22 14:33:36 | 000,014,448 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggflt.sys -- (ggflt)
DRV:64bit: - [2012.09.28 11:32:56 | 000,053,760 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.08.23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012.08.23 16:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012.08.23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012.08.21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.08.03 10:58:40 | 000,025,528 | ---- | M] (Turtle Entertainment GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ESLvnic.sys -- (ESLvnic1)
DRV:64bit: - [2011.06.10 06:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.04.30 13:59:22 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2011.04.30 13:59:22 | 000,060,184 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.12.08 18:17:40 | 000,369,640 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci)
DRV:64bit: - [2010.12.08 18:17:38 | 000,122,856 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.05 23:45:48 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.10.22 03:00:00 | 001,293,824 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\fwlanusb4.sys -- (fwlanusb4)
DRV:64bit: - [2010.10.22 03:00:00 | 000,014,120 | R--- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avmeject.sys -- (avmeject)
DRV:64bit: - [2010.10.19 16:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.10.06 07:55:10 | 000,179,752 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mv61xx.sys -- (mv61xx)
DRV:64bit: - [2010.10.01 00:16:34 | 000,013,312 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VKbms.sys -- (VKbms)
DRV:64bit: - [2010.09.29 12:34:50 | 000,377,176 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ladfSBVMamd64.sys -- (LADF_SBVM)
DRV:64bit: - [2010.09.29 12:34:48 | 000,062,168 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ladfDHP2amd64.sys -- (LADF_DHP2)
DRV:64bit: - [2009.11.23 18:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid)
DRV:64bit: - [2009.11.23 18:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2009.10.01 01:00:00 | 000,197,888 | ---- | M] (Roland Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rdwm1104.sys -- (RDID1104)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.03.18 18:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2008.11.04 13:12:08 | 000,023,096 | ---- | M] (Samsung Electronics, Inc. ) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\MTiCtwl.sys -- (Magic Tune)
DRV:64bit: - [2008.07.26 16:26:34 | 000,050,072 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LVUSBS64.sys -- (LVUSBS64)
DRV:64bit: - [2008.07.26 16:25:48 | 000,790,424 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64)
DRV:64bit: - [2008.07.26 16:22:34 | 002,624,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LV302V64.SYS -- (PID_PEPI)
DRV:64bit: - [2008.07.26 16:22:22 | 000,015,768 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lv302a64.sys -- (lvpepf64)
DRV:64bit: - [2008.01.17 16:51:44 | 000,018,816 | ---- | M] (Razer USA Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Lycosa.sys -- (Lycosa)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.msn.com/?ocid=ie9hp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.avg.com/?cid={3F57C2FA-A20A-40F4-8363-573D5F06A82D}&mid=5073a776909747d0a7806d4c05e0cfc9-b82c7c8ebf85e38e21aecf1e279c904159f23c5c&lang=de&ds=tt015&pr=sa&d=2012-05-15 14:54:34&v=8.0.0.34&sap=hp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 67 1B D4 10 26 4D CC 01  [binary data]
IE - HKCU\..\URLSearchHook: {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll (DeviceVM, Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {2B340395-C512-461c-956A-5FDBEA7B876A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKCU\..\SearchScopes\{0B57F2EF-C1E8-4829-8B0B-CFC373F202F1}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
IE - HKCU\..\SearchScopes\{2B340395-C512-461c-956A-5FDBEA7B876A}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=EGMB
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={3F57C2FA-A20A-40F4-8363-573D5F06A82D}&mid=5073a776909747d0a7806d4c05e0cfc9-b82c7c8ebf85e38e21aecf1e279c904159f23c5c&lang=de&ds=tt015&pr=sa&d=2012-05-15 14:54:34&v=8.0.0.34&sap=dsp&q={searchTerms}
IE - HKCU\..\SearchScopes\{9C033EFD-DC9B-46D0-989A-E12A39585B69}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=FF&o=14594&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=FV&apn_dtid=YYYYYYYYDE&apn_uid=a06bbb18-ed4a-4933-a4d7-f89eeab59237&apn_sauid=0E4E82E2-7AE5-4199-AF8F-D7699BD2D048
IE - HKCU\..\SearchScopes\{C8299E6A-588C-4b34-98B1-93300412880E}: "URL" = hxxp://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5369970905&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=de&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..extensions.enabledAddons: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:2.0.3
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.110.0: C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.118.0: C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.132.0: C:\Program Files (x86)\Battlelog Web Plugins\1.132.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.140.0: C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=2.1.3: C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=2.1.7: C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\****\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\****\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
 
[2012.04.26 19:58:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\****\AppData\Roaming\mozilla\Extensions
[2012.05.15 15:27:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\****\AppData\Roaming\mozilla\Firefox\Profiles\2omav72d.default\extensions
[2012.05.07 17:42:04 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\****\AppData\Roaming\mozilla\Firefox\Profiles\2omav72d.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.04.26 20:26:51 | 000,634,964 | ---- | M] () (No name found) -- C:\Users\****\AppData\Roaming\mozilla\firefox\profiles\2omav72d.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.09.24 20:20:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.10.30 11:16:51 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: hxxp://www.google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\****\AppData\Local\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\****\AppData\Local\Google\Chrome\Application\27.0.1453.116\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\****\AppData\Local\Google\Chrome\Application\27.0.1453.116\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: ESN Launch Mozilla Plugin (Enabled) = C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll
CHR - plugin: ESN Sonar API (Enabled) = C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Java(TM) Platform SE 7 U3 (Enabled) = C:\Program Files (x86)\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 7.0.30.255 (Enabled) = C:\Windows\system32\npDeployJava1.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\****\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - Extension: YouTube = C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google-Suche = C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Grooveshark Germany unlocker = C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\docdgimmdejoiemdafcgeodchlbllgac\2.3.4_0\
CHR - Extension: Grooveshark Germany unlocker = C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\docdgimmdejoiemdafcgeodchlbllgac\2.3.4_0\.orig
CHR - Extension: AdBlock = C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.2_0\
CHR - Extension: Google Mail = C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Launch LgDeviceAgent] C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin)
O4 - HKLM..\Run: [BCU] C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\****\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm File not found
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\****\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\****\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\****\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 10.0.0)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 1.7.0)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} hxxp://support.asus.de/common/asusTek_sys_ctrl.cab (asusTek_sysctrl Class)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B5D33E03-A1B8-4E4C-A528-F9D2BD19C006}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{0df4fc0b-b6bd-11e0-a161-f46d04735911}\Shell - "" = AutoRun
O33 - MountPoints2\{0df4fc0b-b6bd-11e0-a161-f46d04735911}\Shell\AutoRun\command - "" = E:\pushinst.exe
O33 - MountPoints2\{6de13f0f-b6b6-11e0-a6a6-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{6de13f0f-b6b6-11e0-a6a6-806e6f6e6963}\Shell\AutoRun\command - "" = D:\.\Bin\ASSETUP.exe
O33 - MountPoints2\{84f5ace1-19c8-11e1-a466-bc054304263a}\Shell - "" = AutoRun
O33 - MountPoints2\{84f5ace1-19c8-11e1-a466-bc054304263a}\Shell\AutoRun\command - "" = E:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.07.05 15:49:39 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\****\Desktop\OTL.exe
[2013.07.04 21:34:33 | 000,000,000 | ---D | C] -- C:\Users\****\Documents\Add-in Express
[2013.07.04 21:34:25 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013.06.26 20:41:47 | 000,000,000 | ---D | C] -- C:\Users\****\Desktop\****** Sachen
[2013.06.20 19:08:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Phone
[2013.06.20 19:08:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Phone
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.07.05 15:49:41 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\****\Desktop\OTL.exe
[2013.07.05 15:23:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.07.05 15:15:10 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4264279110-3506634303-1943128777-1000UA.job
[2013.07.05 13:24:11 | 000,021,840 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.07.05 13:24:11 | 000,021,840 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.07.05 13:16:28 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.07.05 13:16:23 | 2130,104,319 | -HS- | M] () -- C:\hiberfil.sys
[2013.07.04 12:15:00 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4264279110-3506634303-1943128777-1000Core.job
[2013.06.26 20:43:33 | 001,613,340 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.06.26 20:43:33 | 000,696,832 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.06.26 20:43:33 | 000,652,150 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.06.26 20:43:33 | 000,148,128 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.06.26 20:43:33 | 000,121,082 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.06.26 12:53:39 | 000,083,672 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avnetflt.sys
[2013.06.24 19:52:16 | 000,194,972 | ---- | M] () -- C:\Users\****\Documents\hinter.odt
[2013.06.24 18:32:01 | 000,055,410 | ---- | M] () -- C:\Users\****\Documents\found.JPG
[2013.06.24 18:28:27 | 000,074,046 | ---- | M] () -- C:\Users\****\Documents\Here.JPG
[2013.06.24 17:07:28 | 000,847,461 | ---- | M] () -- C:\Users\****\Documents\****.odg
[2013.06.24 16:43:41 | 000,032,299 | ---- | M] () -- C:\Users\****\Documents\****.jpg
[2013.06.19 21:39:28 | 000,291,088 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2013.06.19 21:39:28 | 000,291,088 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2013.06.19 21:39:19 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2013.06.11 16:27:21 | 000,010,479 | ---- | M] () -- C:\Users\****\Documents\Unbenannt 1z.odt
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.06.24 19:52:15 | 000,194,972 | ---- | C] () -- C:\Users\****\Documents\hinter.odt
[2013.06.24 18:32:00 | 000,055,410 | ---- | C] () -- C:\Users\****\Documents\found.JPG
[2013.06.24 18:28:27 | 000,074,046 | ---- | C] () -- C:\Users\****\Documents\Here.JPG
[2013.06.24 16:55:11 | 000,847,461 | ---- | C] () -- C:\Users\****\Documents\****.odg
[2013.06.24 16:43:40 | 000,032,299 | ---- | C] () -- C:\Users\****\Documents\****.jpg
[2013.06.09 13:15:51 | 000,010,479 | ---- | C] () -- C:\Users\****\Documents\Unbenannt 1z.odt
[2013.04.08 13:26:42 | 000,007,597 | ---- | C] () -- C:\Users\****\AppData\Local\Resmon.ResmonCfg
[2012.07.15 15:41:03 | 003,130,440 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_blr.exe
[2012.05.10 19:43:35 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
[2012.01.27 17:06:53 | 000,005,675 | ---- | C] () -- C:\Users\****\AppData\Local\Temp5.html
[2012.01.27 17:06:51 | 000,001,955 | ---- | C] () -- C:\Users\****\AppData\Local\Temp1.html
[2011.12.12 17:43:33 | 002,726,645 | ---- | C] () -- C:\Users\****\am.wma
[2011.11.21 20:43:14 | 000,168,864 | ---- | C] () -- C:\Program Files\Common Files\WireHelpSvc.exe
[2011.11.16 15:15:37 | 000,003,584 | ---- | C] () -- C:\Users\****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.10.17 17:13:44 | 001,590,298 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.10.03 12:59:01 | 000,291,088 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.10.03 12:59:00 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.09.28 20:12:30 | 000,001,854 | ---- | C] () -- C:\Users\****\AppData\Roaming\ImperatorProfile0.dat
[2011.09.11 15:57:34 | 001,085,424 | ---- | C] () -- C:\Windows\PE_Rom.dll
[2011.09.11 15:19:54 | 000,013,440 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys
[2011.09.11 15:19:49 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2011.07.25 14:29:04 | 000,037,846 | ---- | C] () -- C:\Windows\Ascd_log.ini
[2011.07.25 14:27:17 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2011.07.25 14:27:14 | 000,024,738 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2011.11.09 22:45:45 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Cakewalk
[2013.06.28 12:31:45 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Dropbox
[2011.09.30 19:00:55 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\FreeScreenToVideo
[2011.09.27 17:59:34 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Leadertech
[2011.07.25 17:41:27 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\LolClient
[2012.05.24 10:35:36 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\LolClient2
[2013.02.14 20:27:24 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\MyPhoneExplorer
[2013.03.25 19:43:15 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Natural Selection 2
[2012.06.11 15:02:21 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\OpenOffice.org
[2013.06.18 15:27:21 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Origin
[2012.06.28 13:50:35 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Razer
[2013.07.04 16:13:27 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Spotify
[2013.07.05 00:52:45 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\TS3Client
[2011.07.25 16:20:26 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\ts3overlay
[2011.09.25 17:32:05 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\TuxGuitar
 
========== Purity Check ==========
 
 

< End of report >

--- --- ---

markusg · 05.07.2013, 15:43

Hi,

bDownloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

chatt · 05.07.2013, 16:04

Hier das File.

16:55:51.0123 5104 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
16:55:51.0573 5104 ============================================================
16:55:51.0573 5104 Current date / time: 2013/07/05 16:55:51.0573
16:55:51.0573 5104 SystemInfo:
16:55:51.0573 5104
16:55:51.0573 5104 OS Version: 6.1.7601 ServicePack: 1.0
16:55:51.0573 5104 Product type: Workstation
16:55:51.0573 5104 ComputerName: ****-PC
16:55:51.0574 5104 UserName: ****
16:55:51.0574 5104 Windows directory: C:\Windows
16:55:51.0574 5104 System windows directory: C:\Windows
16:55:51.0574 5104 Running under WOW64
16:55:51.0574 5104 Processor architecture: Intel x64
16:55:51.0574 5104 Number of processors: 8
16:55:51.0574 5104 Page size: 0x1000
16:55:51.0574 5104 Boot type: Normal boot
16:55:51.0574 5104 ============================================================
16:55:51.0973 5104 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
16:55:51.0977 5104 ============================================================
16:55:51.0977 5104 \Device\Harddisk0\DR0:
16:55:51.0977 5104 MBR partitions:
16:55:51.0977 5104 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
16:55:51.0977 5104 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x746D3800
16:55:51.0977 5104 ============================================================
16:55:52.0031 5104 C: <-> \Device\Harddisk0\DR0\Partition2
16:55:52.0031 5104 ============================================================
16:55:52.0031 5104 Initialize success
16:55:52.0031 5104 ============================================================
16:57:28.0699 5592 ============================================================
16:57:28.0699 5592 Scan started
16:57:28.0699 5592 Mode: Manual; SigCheck; TDLFS;
16:57:28.0699 5592 ============================================================
16:57:28.0980 5592 ================ Scan system memory ========================
16:57:28.0980 5592 System memory - ok
16:57:28.0980 5592 ================ Scan services =============================
16:57:29.0120 5592 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\DRIVERS\1394ohci.sys
16:57:29.0214 5592 1394ohci - ok
16:57:29.0260 5592 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys
16:57:29.0260 5592 ACPI - ok
16:57:29.0276 5592 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
16:57:29.0354 5592 AcpiPmi - ok
16:57:29.0479 5592 [ ADDA5E1951B90D3D23C56D3CF0622ADC ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
16:57:29.0479 5592 AdobeARMservice - ok
16:57:29.0604 5592 [ 9915504F602D277EE47FD843A677FD15 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
16:57:29.0604 5592 AdobeFlashPlayerUpdateSvc - ok
16:57:29.0635 5592 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
16:57:29.0650 5592 adp94xx - ok
16:57:29.0666 5592 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\drivers\adpahci.sys
16:57:29.0682 5592 adpahci - ok
16:57:29.0697 5592 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\drivers\adpu320.sys
16:57:29.0697 5592 adpu320 - ok
16:57:29.0728 5592 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
16:57:29.0853 5592 AeLookupSvc - ok
16:57:29.0884 5592 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys
16:57:29.0916 5592 AFD - ok
16:57:29.0947 5592 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys
16:57:29.0947 5592 agp440 - ok
16:57:29.0962 5592 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe
16:57:29.0994 5592 ALG - ok
16:57:30.0025 5592 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys
16:57:30.0025 5592 aliide - ok
16:57:30.0103 5592 ALSysIO - ok
16:57:30.0118 5592 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys
16:57:30.0118 5592 amdide - ok
16:57:30.0150 5592 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
16:57:30.0196 5592 AmdK8 - ok
16:57:30.0228 5592 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\drivers\amdppm.sys
16:57:30.0243 5592 AmdPPM - ok
16:57:30.0274 5592 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys
16:57:30.0274 5592 amdsata - ok
16:57:30.0290 5592 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\drivers\amdsbs.sys
16:57:30.0290 5592 amdsbs - ok
16:57:30.0321 5592 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys
16:57:30.0321 5592 amdxata - ok
16:57:30.0462 5592 [ FE9932692FC61C2203EC9884D414F700 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
16:57:30.0462 5592 AntiVirSchedulerService - ok
16:57:30.0508 5592 [ B1F8B58F27971B7E316DD316687886EC ] AntiVirService C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
16:57:30.0508 5592 AntiVirService - ok
16:57:30.0524 5592 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys
16:57:30.0680 5592 AppID - ok
16:57:30.0742 5592 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll
16:57:30.0758 5592 AppIDSvc - ok
16:57:30.0820 5592 [ 9D2A2369AB4B08A4905FE72DB104498F ] Appinfo C:\Windows\System32\appinfo.dll
16:57:30.0867 5592 Appinfo - ok
16:57:30.0930 5592 [ 4FE5C6D40664AE07BE5105874357D2ED ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
16:57:30.0930 5592 Apple Mobile Device - ok
16:57:30.0961 5592 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\drivers\arc.sys
16:57:30.0961 5592 arc - ok
16:57:31.0008 5592 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\drivers\arcsas.sys
16:57:31.0023 5592 arcsas - ok
16:57:31.0101 5592 [ FB03A917C1294D3E6D671F24722E1BA3 ] asComSvc C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
16:57:31.0117 5592 asComSvc - ok
16:57:31.0148 5592 [ A63173897EA1A73A75D0E65036DE5B15 ] asHmComSvc C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe
16:57:31.0164 5592 asHmComSvc - ok
16:57:31.0195 5592 [ FEF9DD9EA587F8886ADE43C1BEFBDAFE ] AsIO C:\Windows\syswow64\drivers\AsIO.sys
16:57:31.0210 5592 AsIO - ok
16:57:31.0242 5592 [ E1E75921E9EB025009696D4837F531FB ] asmthub3 C:\Windows\system32\DRIVERS\asmthub3.sys
16:57:31.0273 5592 asmthub3 - ok
16:57:31.0304 5592 [ B0CF9AB16006B61634D4F955345CA5D2 ] asmtxhci C:\Windows\system32\DRIVERS\asmtxhci.sys
16:57:31.0351 5592 asmtxhci - ok
16:57:31.0476 5592 [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
16:57:31.0476 5592 aspnet_state - ok
16:57:31.0538 5592 [ 5C31DFB196CB3A488A041881634D86D2 ] AsSysCtrlService C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe
16:57:31.0554 5592 AsSysCtrlService - ok
16:57:31.0632 5592 [ 1392B92179B07B672720763D9B1028A5 ] AsUpIO C:\Windows\syswow64\drivers\AsUpIO.sys
16:57:31.0647 5592 AsUpIO - ok
16:57:31.0678 5592 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
16:57:31.0710 5592 AsyncMac - ok
16:57:31.0756 5592 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys
16:57:31.0756 5592 atapi - ok
16:57:31.0803 5592 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
16:57:31.0834 5592 AudioEndpointBuilder - ok
16:57:31.0850 5592 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll
16:57:31.0866 5592 AudioSrv - ok
16:57:31.0912 5592 [ 09E6069EF94B345061B4BD3CEBD974C8 ] avgntflt C:\Windows\system32\DRIVERS\avgntflt.sys
16:57:31.0928 5592 avgntflt - ok
16:57:31.0975 5592 [ 488486DAD09A5B6C6DBB8B990A8B2307 ] avipbb C:\Windows\system32\DRIVERS\avipbb.sys
16:57:31.0975 5592 avipbb - ok
16:57:32.0022 5592 [ 490FA25161BF3E51993EB724ECF0ACEB ] avkmgr C:\Windows\system32\DRIVERS\avkmgr.sys
16:57:32.0022 5592 avkmgr - ok
16:57:32.0100 5592 [ C6F4C466B654C1BE98AF31418BB5AC30 ] AVM WLAN Connection Service C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
16:57:32.0115 5592 AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - warning
16:57:32.0115 5592 AVM WLAN Connection Service - detected UnsignedFile.Multi.Generic (1)
16:57:32.0131 5592 [ 1DC2F715792CF33428AD7993ACBD224D ] avmeject C:\Windows\system32\drivers\avmeject.sys
16:57:32.0131 5592 avmeject - ok
16:57:32.0146 5592 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll
16:57:32.0256 5592 AxInstSV - ok
16:57:32.0271 5592 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\drivers\bxvbda.sys
16:57:32.0349 5592 b06bdrv - ok
16:57:32.0380 5592 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
16:57:32.0396 5592 b57nd60a - ok
16:57:32.0474 5592 [ 7ED4E1D2E124AD4E6A287CF49DBC9BBA ] BCUService C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
16:57:32.0474 5592 BCUService - ok
16:57:32.0505 5592 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll
16:57:32.0536 5592 BDESVC - ok
16:57:32.0552 5592 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys
16:57:32.0583 5592 Beep - ok
16:57:32.0630 5592 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll
16:57:32.0661 5592 BFE - ok
16:57:32.0724 5592 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\System32\qmgr.dll
16:57:32.0786 5592 BITS - ok
16:57:32.0833 5592 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
16:57:32.0848 5592 blbdrive - ok
16:57:32.0973 5592 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
16:57:32.0973 5592 Bonjour Service - ok
16:57:33.0020 5592 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
16:57:33.0067 5592 bowser - ok
16:57:33.0114 5592 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\drivers\BrFiltLo.sys
16:57:33.0129 5592 BrFiltLo - ok
16:57:33.0145 5592 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\drivers\BrFiltUp.sys
16:57:33.0145 5592 BrFiltUp - ok
16:57:33.0176 5592 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll
16:57:33.0207 5592 Browser - ok
16:57:33.0223 5592 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys
16:57:33.0270 5592 Brserid - ok
16:57:33.0285 5592 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
16:57:33.0332 5592 BrSerWdm - ok
16:57:33.0348 5592 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
16:57:33.0394 5592 BrUsbMdm - ok
16:57:33.0410 5592 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
16:57:33.0426 5592 BrUsbSer - ok
16:57:33.0457 5592 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
16:57:33.0472 5592 BTHMODEM - ok
16:57:33.0504 5592 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll
16:57:33.0519 5592 bthserv - ok
16:57:33.0550 5592 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
16:57:33.0628 5592 cdfs - ok
16:57:33.0644 5592 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
16:57:33.0660 5592 cdrom - ok
16:57:33.0691 5592 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll
16:57:33.0722 5592 CertPropSvc - ok
16:57:33.0738 5592 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\drivers\circlass.sys
16:57:33.0738 5592 circlass - ok
16:57:33.0769 5592 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys
16:57:33.0769 5592 CLFS - ok
16:57:33.0894 5592 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:57:33.0894 5592 clr_optimization_v2.0.50727_32 - ok
16:57:33.0940 5592 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
16:57:33.0940 5592 clr_optimization_v2.0.50727_64 - ok
16:57:34.0018 5592 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:57:34.0034 5592 clr_optimization_v4.0.30319_32 - ok
16:57:34.0050 5592 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
16:57:34.0050 5592 clr_optimization_v4.0.30319_64 - ok
16:57:34.0065 5592 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\drivers\CmBatt.sys
16:57:34.0081 5592 CmBatt - ok
16:57:34.0112 5592 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys
16:57:34.0112 5592 cmdide - ok
16:57:34.0143 5592 [ AAFCB52FE0037207FB6FBEA070D25EFE ] CNG C:\Windows\system32\Drivers\cng.sys
16:57:34.0159 5592 CNG - ok
16:57:34.0174 5592 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\drivers\compbatt.sys
16:57:34.0190 5592 Compbatt - ok
16:57:34.0221 5592 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\DRIVERS\CompositeBus.sys
16:57:34.0221 5592 CompositeBus - ok
16:57:34.0237 5592 COMSysApp - ok
16:57:34.0252 5592 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
16:57:34.0252 5592 crcdisk - ok
16:57:34.0284 5592 [ D8129C49798CBBFB2E4351D4B7B8EF9C ] CryptSvc C:\Windows\system32\cryptsvc.dll
16:57:34.0299 5592 CryptSvc - ok
16:57:34.0346 5592 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll
16:57:34.0393 5592 DcomLaunch - ok
16:57:34.0408 5592 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll
16:57:34.0440 5592 defragsvc - ok
16:57:34.0455 5592 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
16:57:34.0486 5592 DfsC - ok
16:57:34.0518 5592 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll
16:57:34.0580 5592 Dhcp - ok
16:57:34.0596 5592 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys
16:57:34.0627 5592 discache - ok
16:57:34.0642 5592 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\drivers\disk.sys
16:57:34.0642 5592 Disk - ok
16:57:34.0674 5592 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll
16:57:34.0705 5592 Dnscache - ok
16:57:34.0736 5592 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll
16:57:34.0767 5592 dot3svc - ok
16:57:34.0798 5592 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll
16:57:34.0876 5592 DPS - ok
16:57:34.0892 5592 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
16:57:34.0923 5592 drmkaud - ok
16:57:35.0001 5592 [ AF2E16242AA723F68F461B6EAE2EAD3D ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
16:57:35.0017 5592 DXGKrnl - ok
16:57:35.0048 5592 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll
16:57:35.0079 5592 EapHost - ok
16:57:35.0126 5592 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\drivers\evbda.sys
16:57:35.0173 5592 ebdrv - ok
16:57:35.0188 5592 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe
16:57:35.0220 5592 EFS - ok
16:57:35.0266 5592 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
16:57:35.0282 5592 ehRecvr - ok
16:57:35.0313 5592 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe
16:57:35.0329 5592 ehSched - ok
16:57:35.0344 5592 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\drivers\elxstor.sys
16:57:35.0360 5592 elxstor - ok
16:57:35.0360 5592 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys
16:57:35.0391 5592 ErrDev - ok
16:57:35.0422 5592 [ C33ACB897AF927D1C1BD84F211FAE75B ] ESLvnic1 C:\Windows\system32\DRIVERS\ESLvnic.sys
16:57:35.0422 5592 ESLvnic1 - ok
16:57:35.0438 5592 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll
16:57:35.0469 5592 EventSystem - ok
16:57:35.0500 5592 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys
16:57:35.0516 5592 exfat - ok
16:57:35.0532 5592 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys
16:57:35.0547 5592 fastfat - ok
16:57:35.0594 5592 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe
16:57:35.0625 5592 Fax - ok
16:57:35.0641 5592 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\drivers\fdc.sys
16:57:35.0656 5592 fdc - ok
16:57:35.0672 5592 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll
16:57:35.0719 5592 fdPHost - ok
16:57:35.0734 5592 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll
16:57:35.0766 5592 FDResPub - ok
16:57:35.0781 5592 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
16:57:35.0797 5592 FileInfo - ok
16:57:35.0812 5592 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
16:57:35.0859 5592 Filetrace - ok
16:57:35.0859 5592 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\drivers\flpydisk.sys
16:57:35.0875 5592 flpydisk - ok
16:57:35.0875 5592 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
16:57:35.0890 5592 FltMgr - ok
16:57:35.0937 5592 [ C4C183E6551084039EC862DA1C945E3D ] FontCache C:\Windows\system32\FntCache.dll
16:57:35.0953 5592 FontCache - ok
16:57:35.0984 5592 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
16:57:36.0000 5592 FontCache3.0.0.0 - ok
16:57:36.0000 5592 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
16:57:36.0015 5592 FsDepends - ok
16:57:36.0015 5592 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
16:57:36.0031 5592 Fs_Rec - ok
16:57:36.0062 5592 [ 8F6322049018354F45F05A2FD2D4E5E0 ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
16:57:36.0078 5592 fvevol - ok
16:57:36.0109 5592 [ 4632BB93B668004965246D7911E2DD05 ] fwlanusb4 C:\Windows\system32\DRIVERS\fwlanusb4.sys
16:57:36.0140 5592 fwlanusb4 - ok
16:57:36.0171 5592 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
16:57:36.0187 5592 gagp30kx - ok
16:57:36.0218 5592 [ 8E98D21EE06192492A5671A6144D092F ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
16:57:36.0218 5592 GEARAspiWDM - ok
16:57:36.0249 5592 [ 16C2A6BCDDA8952C2035DEC861492A19 ] ggflt C:\Windows\system32\DRIVERS\ggflt.sys
16:57:36.0265 5592 ggflt - ok
16:57:36.0280 5592 [ 6B503DF845EABF3457E49FBBDA26C10E ] ggsemc C:\Windows\system32\DRIVERS\ggsemc.sys
16:57:36.0280 5592 ggsemc - ok
16:57:36.0296 5592 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll
16:57:36.0327 5592 gpsvc - ok
16:57:36.0343 5592 [ 1E6438D4EA6E1174A3B3B1EDC4DE660B ] hamachi C:\Windows\system32\DRIVERS\hamachi.sys
16:57:36.0343 5592 hamachi - ok
16:57:36.0358 5592 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
16:57:36.0390 5592 hcw85cir - ok
16:57:36.0421 5592 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
16:57:36.0436 5592 HdAudAddService - ok
16:57:36.0468 5592 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
16:57:36.0483 5592 HDAudBus - ok
16:57:36.0499 5592 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\drivers\HidBatt.sys
16:57:36.0499 5592 HidBatt - ok
16:57:36.0514 5592 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\drivers\hidbth.sys
16:57:36.0530 5592 HidBth - ok
16:57:36.0546 5592 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\drivers\hidir.sys
16:57:36.0561 5592 HidIr - ok
16:57:36.0577 5592 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\system32\hidserv.dll
16:57:36.0608 5592 hidserv - ok
16:57:36.0608 5592 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
16:57:36.0624 5592 HidUsb - ok
16:57:36.0686 5592 [ 34E95DE386032FD7F14C228DD8E1CDBF ] HiPatchService C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
16:57:36.0702 5592 HiPatchService ( UnsignedFile.Multi.Generic ) - warning
16:57:36.0702 5592 HiPatchService - detected UnsignedFile.Multi.Generic (1)
16:57:36.0748 5592 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll
16:57:36.0780 5592 hkmsvc - ok
16:57:36.0795 5592 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
16:57:36.0811 5592 HomeGroupListener - ok
16:57:36.0858 5592 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
16:57:36.0889 5592 HomeGroupProvider - ok
16:57:36.0889 5592 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
16:57:36.0889 5592 HpSAMD - ok
16:57:36.0920 5592 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys
16:57:36.0951 5592 HTTP - ok
16:57:36.0951 5592 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
16:57:36.0967 5592 hwpolicy - ok
16:57:36.0982 5592 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys
16:57:36.0982 5592 i8042prt - ok
16:57:37.0029 5592 [ D7921D5A870B11CC1ADAB198A519D50A ] iaStor C:\Windows\system32\DRIVERS\iaStor.sys
16:57:37.0029 5592 iaStor - ok
16:57:37.0107 5592 [ 8FFF9083252C16FE3960173722605E9E ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
16:57:37.0123 5592 IAStorDataMgrSvc - ok
16:57:37.0138 5592 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
16:57:37.0154 5592 iaStorV - ok
16:57:37.0248 5592 [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
16:57:37.0279 5592 IDriverT ( UnsignedFile.Multi.Generic ) - warning
16:57:37.0279 5592 IDriverT - detected UnsignedFile.Multi.Generic (1)
16:57:37.0310 5592 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
16:57:37.0326 5592 idsvc - ok
16:57:37.0341 5592 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\drivers\iirsp.sys
16:57:37.0357 5592 iirsp - ok
16:57:37.0372 5592 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll
16:57:37.0404 5592 IKEEXT - ok
16:57:37.0482 5592 [ 589B94A9B73A0E819FF873743A480834 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
16:57:37.0528 5592 IntcAzAudAddService - ok
16:57:37.0528 5592 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys
16:57:37.0544 5592 intelide - ok
16:57:37.0591 5592 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
16:57:37.0606 5592 intelppm - ok
16:57:37.0606 5592 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll
16:57:37.0638 5592 IPBusEnum - ok
16:57:37.0653 5592 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
16:57:37.0669 5592 IpFilterDriver - ok
16:57:37.0700 5592 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
16:57:37.0716 5592 iphlpsvc - ok
16:57:37.0716 5592 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
16:57:37.0747 5592 IPMIDRV - ok
16:57:37.0747 5592 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys
16:57:37.0778 5592 IPNAT - ok
16:57:37.0825 5592 [ 2872B90D57C8310194A78A9787406467 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
16:57:37.0825 5592 iPod Service - ok
16:57:37.0856 5592 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
16:57:37.0872 5592 IRENUM - ok
16:57:37.0872 5592 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys
16:57:37.0887 5592 isapnp - ok
16:57:37.0903 5592 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
16:57:37.0903 5592 iScsiPrt - ok
16:57:37.0934 5592 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
16:57:37.0934 5592 kbdclass - ok
16:57:37.0965 5592 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
16:57:37.0981 5592 kbdhid - ok
16:57:38.0012 5592 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe
16:57:38.0012 5592 KeyIso - ok
16:57:38.0028 5592 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
16:57:38.0043 5592 KSecDD - ok
16:57:38.0074 5592 [ 7EFB9333E4ECCE6AE4AE9D777D9E553E ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
16:57:38.0074 5592 KSecPkg - ok
16:57:38.0090 5592 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
16:57:38.0106 5592 ksthunk - ok
16:57:38.0137 5592 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll
16:57:38.0168 5592 KtmRm - ok
16:57:38.0199 5592 [ 86DCBF8A41C78561A1DA07AB5E7B1CCC ] LADF_DHP2 C:\Windows\system32\DRIVERS\ladfDHP2amd64.sys
16:57:38.0199 5592 LADF_DHP2 - ok
16:57:38.0246 5592 [ 175C04C7813CE64616B5CB046E5E1383 ] LADF_SBVM C:\Windows\system32\DRIVERS\ladfSBVMamd64.sys
16:57:38.0246 5592 LADF_SBVM - ok
16:57:38.0293 5592 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\system32\srvsvc.dll
16:57:38.0324 5592 LanmanServer - ok
16:57:38.0340 5592 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
16:57:38.0355 5592 LanmanWorkstation - ok
16:57:38.0402 5592 [ FA529FB35694C24BF98A9EF67C1CD9D0 ] LGBusEnum C:\Windows\system32\drivers\LGBusEnum.sys
16:57:38.0402 5592 LGBusEnum - ok
16:57:38.0433 5592 [ 94B29CE153765E768F004FB3440BE2B0 ] LGVirHid C:\Windows\system32\drivers\LGVirHid.sys
16:57:38.0433 5592 LGVirHid - ok
16:57:38.0511 5592 [ 1074C77A47835E03C15BF92452F9A750 ] LHidFilt C:\Windows\system32\DRIVERS\LHidFilt.Sys
16:57:38.0527 5592 LHidFilt - ok
16:57:38.0558 5592 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
16:57:38.0589 5592 lltdio - ok
16:57:38.0605 5592 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll
16:57:38.0636 5592 lltdsvc - ok
16:57:38.0652 5592 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll
16:57:38.0683 5592 lmhosts - ok
16:57:38.0698 5592 [ 96999C364C649E2866A268F7420A304A ] LMouFilt C:\Windows\system32\DRIVERS\LMouFilt.Sys
16:57:38.0698 5592 LMouFilt - ok
16:57:38.0730 5592 [ 98B16E756243BEA9410E32025B19C06F ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
16:57:38.0730 5592 LMS - ok
16:57:38.0761 5592 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
16:57:38.0776 5592 LSI_FC - ok
16:57:38.0792 5592 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
16:57:38.0792 5592 LSI_SAS - ok
16:57:38.0808 5592 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\drivers\lsi_sas2.sys
16:57:38.0808 5592 LSI_SAS2 - ok
16:57:38.0808 5592 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
16:57:38.0823 5592 LSI_SCSI - ok
16:57:38.0839 5592 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys
16:57:38.0870 5592 luafv - ok
16:57:38.0886 5592 [ 07389F6925E490D2DB7882110E99921C ] lvpepf64 C:\Windows\system32\DRIVERS\lv302a64.sys
16:57:38.0901 5592 lvpepf64 - ok
16:57:38.0932 5592 [ 7F0BA3A6E8996F15693C6B7D81DA049E ] LVRS64 C:\Windows\system32\DRIVERS\lvrs64.sys
16:57:38.0948 5592 LVRS64 - ok
16:57:38.0964 5592 [ 5C3FF68267A5D242EE79EE01B993D6CE ] LVUSBS64 C:\Windows\system32\drivers\LVUSBS64.sys
16:57:38.0964 5592 LVUSBS64 - ok
16:57:38.0979 5592 [ E5ECF40E5FD459141E5F6685FFD51804 ] Lycosa C:\Windows\system32\drivers\Lycosa.sys
16:57:39.0010 5592 Lycosa - ok
16:57:39.0057 5592 [ B3B7C5F26F3F8C7992350B7EDE64F5C9 ] Magic Tune C:\Windows\system32\Drivers\MtiCtwl.sys
16:57:39.0073 5592 Magic Tune - ok
16:57:39.0088 5592 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
16:57:39.0104 5592 Mcx2Svc - ok
16:57:39.0104 5592 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\drivers\megasas.sys
16:57:39.0120 5592 megasas - ok
16:57:39.0135 5592 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\drivers\MegaSR.sys
16:57:39.0135 5592 MegaSR - ok
16:57:39.0151 5592 [ A6518DCC42F7A6E999BB3BEA8FD87567 ] MEIx64 C:\Windows\system32\DRIVERS\HECIx64.sys
16:57:39.0151 5592 MEIx64 - ok
16:57:39.0166 5592 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll
16:57:39.0198 5592 MMCSS - ok
16:57:39.0213 5592 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys
16:57:39.0244 5592 Modem - ok
16:57:39.0244 5592 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys
16:57:39.0276 5592 monitor - ok
16:57:39.0291 5592 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
16:57:39.0291 5592 mouclass - ok
16:57:39.0322 5592 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
16:57:39.0354 5592 mouhid - ok
16:57:39.0354 5592 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
16:57:39.0369 5592 mountmgr - ok
16:57:39.0385 5592 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys
16:57:39.0400 5592 mpio - ok
16:57:39.0463 5592 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
16:57:39.0494 5592 mpsdrv - ok
16:57:39.0525 5592 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll
16:57:39.0541 5592 MpsSvc - ok
16:57:39.0556 5592 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
16:57:39.0572 5592 MRxDAV - ok
16:57:39.0572 5592 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
16:57:39.0603 5592 mrxsmb - ok
16:57:39.0619 5592 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
16:57:39.0634 5592 mrxsmb10 - ok
16:57:39.0634 5592 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
16:57:39.0650 5592 mrxsmb20 - ok
16:57:39.0650 5592 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys
16:57:39.0650 5592 msahci - ok
16:57:39.0666 5592 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys
16:57:39.0666 5592 msdsm - ok
16:57:39.0681 5592 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe
16:57:39.0681 5592 MSDTC - ok
16:57:39.0697 5592 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys
16:57:39.0728 5592 Msfs - ok
16:57:39.0728 5592 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
16:57:39.0759 5592 mshidkmdf - ok
16:57:39.0759 5592 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
16:57:39.0775 5592 msisadrv - ok
16:57:39.0790 5592 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
16:57:39.0806 5592 MSiSCSI - ok
16:57:39.0806 5592 msiserver - ok
16:57:39.0822 5592 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
16:57:39.0837 5592 MSKSSRV - ok
16:57:39.0868 5592 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
16:57:39.0900 5592 MSPCLOCK - ok
16:57:39.0900 5592 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
16:57:39.0931 5592 MSPQM - ok
16:57:39.0946 5592 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
16:57:39.0962 5592 MsRPC - ok
16:57:39.0962 5592 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
16:57:39.0962 5592 mssmbios - ok
16:57:39.0978 5592 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
16:57:39.0993 5592 MSTEE - ok
16:57:40.0009 5592 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\drivers\MTConfig.sys
16:57:40.0009 5592 MTConfig - ok
16:57:40.0024 5592 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys
16:57:40.0024 5592 Mup - ok
16:57:40.0040 5592 [ 3BF808A71E26D88FF2BEF841BEEB2960 ] mv61xx C:\Windows\system32\DRIVERS\mv61xx.sys
16:57:40.0040 5592 mv61xx - ok
16:57:40.0071 5592 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll
16:57:40.0087 5592 napagent - ok
16:57:40.0118 5592 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
16:57:40.0149 5592 NativeWifiP - ok
16:57:40.0165 5592 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys
16:57:40.0180 5592 NDIS - ok
16:57:40.0196 5592 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
16:57:40.0212 5592 NdisCap - ok
16:57:40.0227 5592 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
16:57:40.0258 5592 NdisTapi - ok
16:57:40.0258 5592 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
16:57:40.0290 5592 Ndisuio - ok
16:57:40.0305 5592 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
16:57:40.0336 5592 NdisWan - ok
16:57:40.0352 5592 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
16:57:40.0383 5592 NDProxy - ok
16:57:40.0399 5592 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
16:57:40.0414 5592 NetBIOS - ok
16:57:40.0414 5592 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
16:57:40.0446 5592 NetBT - ok
16:57:40.0461 5592 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe
16:57:40.0461 5592 Netlogon - ok
16:57:40.0492 5592 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll
16:57:40.0524 5592 Netman - ok
16:57:40.0539 5592 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:57:40.0555 5592 NetMsmqActivator - ok
16:57:40.0570 5592 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:57:40.0570 5592 NetPipeActivator - ok
16:57:40.0586 5592 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll
16:57:40.0617 5592 netprofm - ok
16:57:40.0633 5592 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:57:40.0633 5592 NetTcpActivator - ok
16:57:40.0633 5592 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:57:40.0648 5592 NetTcpPortSharing - ok
16:57:40.0664 5592 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
16:57:40.0664 5592 nfrd960 - ok
16:57:40.0680 5592 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\Windows\System32\nlasvc.dll
16:57:40.0695 5592 NlaSvc - ok
16:57:40.0711 5592 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys
16:57:40.0742 5592 Npfs - ok
16:57:40.0742 5592 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll
16:57:40.0773 5592 nsi - ok
16:57:40.0773 5592 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
16:57:40.0804 5592 nsiproxy - ok
16:57:40.0867 5592 [ B98F8C6E31CD07B2E6F71F7F648E38C0 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
16:57:40.0882 5592 Ntfs - ok
16:57:40.0898 5592 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys
16:57:40.0914 5592 Null - ok
16:57:40.0929 5592 [ B4F53BCA4C688FF47F04FA90098F896E ] NVHDA C:\Windows\system32\drivers\nvhda64v.sys
16:57:40.0945 5592 NVHDA - ok
16:57:41.0101 5592 [ 4EE399576F76D38C04745DB739BBC8C7 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
16:57:41.0257 5592 nvlddmkm - ok
16:57:41.0257 5592 NVR0FLASHDev - ok
16:57:41.0272 5592 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys
16:57:41.0272 5592 nvraid - ok
16:57:41.0304 5592 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys
16:57:41.0304 5592 nvstor - ok
16:57:41.0335 5592 [ 7335C3D78A7746D76D37F6722CC4A466 ] nvsvc C:\Windows\system32\nvvsvc.exe
16:57:41.0350 5592 nvsvc - ok
16:57:41.0428 5592 [ B7C53DA1C73FF39F4A6248643EFD979A ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
16:57:41.0444 5592 nvUpdatusService - ok
16:57:41.0475 5592 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
16:57:41.0491 5592 nv_agp - ok
16:57:41.0491 5592 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
16:57:41.0506 5592 ohci1394 - ok
16:57:41.0522 5592 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
16:57:41.0553 5592 p2pimsvc - ok
16:57:41.0584 5592 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll
16:57:41.0584 5592 p2psvc - ok
16:57:41.0600 5592 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\drivers\parport.sys
16:57:41.0631 5592 Parport - ok
16:57:41.0647 5592 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys
16:57:41.0647 5592 partmgr - ok
16:57:41.0662 5592 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll
16:57:41.0678 5592 PcaSvc - ok
16:57:41.0694 5592 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys
16:57:41.0694 5592 pci - ok
16:57:41.0725 5592 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys
16:57:41.0725 5592 pciide - ok
16:57:41.0740 5592 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
16:57:41.0740 5592 pcmcia - ok
16:57:41.0756 5592 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys
16:57:41.0772 5592 pcw - ok
16:57:41.0787 5592 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys
16:57:41.0818 5592 PEAUTH - ok
16:57:41.0881 5592 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe
16:57:41.0896 5592 PerfHost - ok
16:57:41.0943 5592 [ 087A343DFC337F37723DD7912DE6B6CD ] PID_PEPI C:\Windows\system32\DRIVERS\LV302V64.SYS
16:57:41.0990 5592 PID_PEPI - ok
16:57:42.0021 5592 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll
16:57:42.0052 5592 pla - ok
16:57:42.0084 5592 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
16:57:42.0115 5592 PlugPlay - ok
16:57:42.0130 5592 PnkBstrA - ok
16:57:42.0146 5592 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
16:57:42.0162 5592 PNRPAutoReg - ok
16:57:42.0162 5592 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
16:57:42.0162 5592 PNRPsvc - ok
16:57:42.0193 5592 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
16:57:42.0224 5592 PolicyAgent - ok
16:57:42.0240 5592 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll
16:57:42.0271 5592 Power - ok
16:57:42.0302 5592 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
16:57:42.0333 5592 PptpMiniport - ok
16:57:42.0333 5592 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\drivers\processr.sys
16:57:42.0349 5592 Processor - ok
16:57:42.0364 5592 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll
16:57:42.0380 5592 ProfSvc - ok
16:57:42.0396 5592 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
16:57:42.0411 5592 ProtectedStorage - ok
16:57:42.0427 5592 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys
16:57:42.0458 5592 Psched - ok
16:57:42.0489 5592 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\drivers\ql2300.sys
16:57:42.0520 5592 ql2300 - ok
16:57:42.0520 5592 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
16:57:42.0536 5592 ql40xx - ok
16:57:42.0552 5592 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll
16:57:42.0552 5592 QWAVE - ok
16:57:42.0567 5592 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
16:57:42.0583 5592 QWAVEdrv - ok
16:57:42.0598 5592 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
16:57:42.0614 5592 RasAcd - ok
16:57:42.0645 5592 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
16:57:42.0661 5592 RasAgileVpn - ok
16:57:42.0661 5592 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll
16:57:42.0692 5592 RasAuto - ok
16:57:42.0692 5592 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
16:57:42.0723 5592 Rasl2tp - ok
16:57:42.0754 5592 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll
16:57:42.0770 5592 RasMan - ok
16:57:42.0786 5592 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
16:57:42.0817 5592 RasPppoe - ok
16:57:42.0817 5592 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
16:57:42.0848 5592 RasSstp - ok
16:57:42.0848 5592 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
16:57:42.0879 5592 rdbss - ok
16:57:42.0910 5592 [ 4FEE29816833F0E44AAC4D0AD521823C ] RDID1104 C:\Windows\system32\Drivers\rdwm1104.sys
16:57:42.0942 5592 RDID1104 - ok
16:57:42.0957 5592 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\drivers\rdpbus.sys
16:57:42.0973 5592 rdpbus - ok
16:57:43.0004 5592 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
16:57:43.0020 5592 RDPCDD - ok
16:57:43.0035 5592 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
16:57:43.0066 5592 RDPENCDD - ok
16:57:43.0066 5592 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
16:57:43.0082 5592 RDPREFMP - ok
16:57:43.0113 5592 [ 313F68E1A3E6345A4F47A36B07062F34 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
16:57:43.0129 5592 RdpVideoMiniport - ok
16:57:43.0160 5592 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
16:57:43.0176 5592 RDPWD - ok
16:57:43.0191 5592 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
16:57:43.0207 5592 rdyboost - ok
16:57:43.0238 5592 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll
16:57:43.0254 5592 RemoteAccess - ok
16:57:43.0269 5592 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll
16:57:43.0300 5592 RemoteRegistry - ok
16:57:43.0316 5592 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
16:57:43.0347 5592 RpcEptMapper - ok
16:57:43.0347 5592 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe
16:57:43.0363 5592 RpcLocator - ok
16:57:43.0394 5592 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll
16:57:43.0410 5592 RpcSs - ok
16:57:43.0425 5592 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
16:57:43.0456 5592 rspndr - ok
16:57:43.0488 5592 [ EE082E06A82FF630351D1E0EBBD3D8D0 ] RTL8167 C:\Windows\system32\DRIVERS\Rt64win7.sys
16:57:43.0488 5592 RTL8167 - ok
16:57:43.0503 5592 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe
16:57:43.0503 5592 SamSs - ok
16:57:43.0519 5592 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
16:57:43.0519 5592 sbp2port - ok
16:57:43.0534 5592 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll
16:57:43.0550 5592 SCardSvr - ok
16:57:43.0566 5592 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
16:57:43.0581 5592 scfilter - ok
16:57:43.0612 5592 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll
16:57:43.0644 5592 Schedule - ok
16:57:43.0675 5592 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll
16:57:43.0690 5592 SCPolicySvc - ok
16:57:43.0722 5592 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll
16:57:43.0753 5592 SDRSVC - ok
16:57:43.0768 5592 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys
16:57:43.0784 5592 secdrv - ok
16:57:43.0800 5592 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll
16:57:43.0815 5592 seclogon - ok
16:57:43.0831 5592 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\System32\sens.dll
16:57:43.0846 5592 SENS - ok
16:57:43.0862 5592 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll
16:57:43.0893 5592 SensrSvc - ok
16:57:43.0924 5592 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
16:57:43.0940 5592 Serenum - ok
16:57:43.0956 5592 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\DRIVERS\serial.sys
16:57:43.0971 5592 Serial - ok
16:57:44.0002 5592 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\drivers\sermouse.sys
16:57:44.0002 5592 sermouse - ok
16:57:44.0018 5592 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll
16:57:44.0034 5592 SessionEnv - ok
16:57:44.0049 5592 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
16:57:44.0065 5592 sffdisk - ok
16:57:44.0065 5592 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
16:57:44.0096 5592 sffp_mmc - ok
16:57:44.0096 5592 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
16:57:44.0112 5592 sffp_sd - ok
16:57:44.0127 5592 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
16:57:44.0127 5592 sfloppy - ok
16:57:44.0158 5592 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll
16:57:44.0190 5592 SharedAccess - ok
16:57:44.0221 5592 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
16:57:44.0236 5592 ShellHWDetection - ok
16:57:44.0252 5592 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\drivers\SiSRaid2.sys
16:57:44.0268 5592 SiSRaid2 - ok
16:57:44.0268 5592 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
16:57:44.0283 5592 SiSRaid4 - ok
16:57:44.0408 5592 [ 388AE59FE75F1B959DFA0900923C61BB ] Skype C2C Service C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
16:57:44.0455 5592 Skype C2C Service - ok
16:57:44.0502 5592 [ 4E8A4BB5B11D828FF986F6228B1CD3DF ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe
16:57:44.0502 5592 SkypeUpdate - ok
16:57:44.0517 5592 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys
16:57:44.0548 5592 Smb - ok
16:57:44.0564 5592 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe
16:57:44.0564 5592 SNMPTRAP - ok
16:57:44.0564 5592 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys
16:57:44.0580 5592 spldr - ok
16:57:44.0611 5592 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe
16:57:44.0626 5592 Spooler - ok
16:57:44.0673 5592 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe
16:57:44.0736 5592 sppsvc - ok
16:57:44.0767 5592 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll
16:57:44.0782 5592 sppuinotify - ok
16:57:44.0814 5592 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys
16:57:44.0829 5592 srv - ok
16:57:44.0845 5592 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
16:57:44.0860 5592 srv2 - ok
16:57:44.0860 5592 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
16:57:44.0860 5592 srvnet - ok
16:57:44.0907 5592 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
16:57:44.0923 5592 SSDPSRV - ok
16:57:44.0938 5592 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll
16:57:44.0954 5592 SstpSvc - ok
16:57:44.0985 5592 Steam Client Service - ok
16:57:45.0048 5592 [ 81F177C1954453AF407604160BD149CB ] Stereo Service C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
16:57:45.0048 5592 Stereo Service - ok
16:57:45.0063 5592 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\drivers\stexstor.sys
16:57:45.0063 5592 stexstor - ok
16:57:45.0110 5592 [ DECACB6921DED1A38642642685D77DAC ] StillCam C:\Windows\system32\DRIVERS\serscan.sys
16:57:45.0126 5592 StillCam - ok
16:57:45.0157 5592 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll
16:57:45.0188 5592 stisvc - ok
16:57:45.0204 5592 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
16:57:45.0219 5592 swenum - ok
16:57:45.0235 5592 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll
16:57:45.0266 5592 swprv - ok
16:57:45.0297 5592 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll
16:57:45.0328 5592 SysMain - ok
16:57:45.0344 5592 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
16:57:45.0360 5592 TabletInputService - ok
16:57:45.0375 5592 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll
16:57:45.0406 5592 TapiSrv - ok
16:57:45.0406 5592 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll
16:57:45.0438 5592 TBS - ok
16:57:45.0484 5592 [ 9849EA3843A2ADBDD1497E97A85D8CAE ] Tcpip C:\Windows\system32\drivers\tcpip.sys
16:57:45.0516 5592 Tcpip - ok
16:57:45.0531 5592 [ 9849EA3843A2ADBDD1497E97A85D8CAE ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
16:57:45.0562 5592 TCPIP6 - ok
16:57:45.0562 5592 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
16:57:45.0578 5592 tcpipreg - ok
16:57:45.0578 5592 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
16:57:45.0609 5592 TDPIPE - ok
16:57:45.0625 5592 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
16:57:45.0640 5592 TDTCP - ok
16:57:45.0640 5592 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
16:57:45.0672 5592 tdx - ok
16:57:45.0687 5592 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
16:57:45.0703 5592 TermDD - ok
16:57:45.0734 5592 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll
16:57:45.0750 5592 TermService - ok
16:57:45.0765 5592 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll
16:57:45.0781 5592 Themes - ok
16:57:45.0812 5592 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll
16:57:45.0828 5592 THREADORDER - ok
16:57:45.0843 5592 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll
16:57:45.0874 5592 TrkWks - ok
16:57:45.0921 5592 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
16:57:45.0937 5592 TrustedInstaller - ok
16:57:45.0952 5592 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
16:57:45.0968 5592 tssecsrv - ok
16:57:45.0999 5592 [ 17C6B51CBCCDED95B3CC14E22791F85E ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
16:57:46.0015 5592 TsUsbFlt - ok
16:57:46.0046 5592 [ AD64450A4ABE076F5CB34CC08EEACB07 ] TsUsbGD C:\Windows\system32\drivers\TsUsbGD.sys
16:57:46.0046 5592 TsUsbGD - ok
16:57:46.0077 5592 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
16:57:46.0093 5592 tunnel - ok
16:57:46.0108 5592 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\drivers\uagp35.sys
16:57:46.0108 5592 uagp35 - ok
16:57:46.0124 5592 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
16:57:46.0155 5592 udfs - ok
16:57:46.0155 5592 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe
16:57:46.0186 5592 UI0Detect - ok
16:57:46.0202 5592 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
16:57:46.0202 5592 uliagpkx - ok
16:57:46.0218 5592 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
16:57:46.0249 5592 umbus - ok
16:57:46.0264 5592 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\drivers\umpass.sys
16:57:46.0280 5592 UmPass - ok
16:57:46.0358 5592 [ 7A78ED1088890114DFDE2C4AB038D6B6 ] UNS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
16:57:46.0389 5592 UNS - ok
16:57:46.0420 5592 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll
16:57:46.0452 5592 upnphost - ok
16:57:46.0483 5592 [ 43228F8EDD1B0BCDD3145AD246E63D39 ] USBAAPL64 C:\Windows\system32\Drivers\usbaapl64.sys
16:57:46.0483 5592 USBAAPL64 ( UnsignedFile.Multi.Generic ) - warning
16:57:46.0483 5592 USBAAPL64 - detected UnsignedFile.Multi.Generic (1)
16:57:46.0514 5592 [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio C:\Windows\system32\drivers\usbaudio.sys
16:57:46.0530 5592 usbaudio - ok
16:57:46.0576 5592 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
16:57:46.0592 5592 usbccgp - ok
16:57:46.0608 5592 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys
16:57:46.0639 5592 usbcir - ok
16:57:46.0639 5592 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\drivers\usbehci.sys
16:57:46.0654 5592 usbehci - ok
16:57:46.0670 5592 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
16:57:46.0686 5592 usbhub - ok
16:57:46.0701 5592 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\drivers\usbohci.sys
16:57:46.0717 5592 usbohci - ok
16:57:46.0717 5592 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
16:57:46.0732 5592 usbprint - ok
16:57:46.0748 5592 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
16:57:46.0779 5592 USBSTOR - ok
16:57:46.0779 5592 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
16:57:46.0795 5592 usbuhci - ok
16:57:46.0826 5592 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll
16:57:46.0842 5592 UxSms - ok
16:57:46.0857 5592 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe
16:57:46.0857 5592 VaultSvc - ok
16:57:46.0873 5592 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
16:57:46.0873 5592 vdrvroot - ok
16:57:46.0888 5592 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe
16:57:46.0920 5592 vds - ok
16:57:46.0935 5592 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
16:57:46.0951 5592 vga - ok
16:57:46.0951 5592 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys
16:57:46.0966 5592 VgaSave - ok
16:57:46.0998 5592 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
16:57:46.0998 5592 vhdmp - ok
16:57:47.0013 5592 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys
16:57:47.0013 5592 viaide - ok
16:57:47.0044 5592 [ 3B59BB6D10CF969DBE4DB93D9EAD7FB4 ] VKbms C:\Windows\system32\DRIVERS\VKbms.sys
16:57:47.0060 5592 VKbms ( UnsignedFile.Multi.Generic ) - warning
16:57:47.0060 5592 VKbms - detected UnsignedFile.Multi.Generic (1)
16:57:47.0076 5592 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys
16:57:47.0076 5592 volmgr - ok
16:57:47.0091 5592 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
16:57:47.0107 5592 volmgrx - ok
16:57:47.0107 5592 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys
16:57:47.0122 5592 volsnap - ok
16:57:47.0122 5592 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
16:57:47.0138 5592 vsmraid - ok
16:57:47.0169 5592 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe
16:57:47.0200 5592 VSS - ok
16:57:47.0216 5592 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys
16:57:47.0247 5592 vwifibus - ok
16:57:47.0278 5592 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll
16:57:47.0294 5592 W32Time - ok
16:57:47.0310 5592 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\drivers\wacompen.sys
16:57:47.0325 5592 WacomPen - ok
16:57:47.0341 5592 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
16:57:47.0372 5592 WANARP - ok
16:57:47.0372 5592 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
16:57:47.0388 5592 Wanarpv6 - ok
16:57:47.0434 5592 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe
16:57:47.0481 5592 wbengine - ok
16:57:47.0497 5592 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
16:57:47.0512 5592 WbioSrvc - ok
16:57:47.0528 5592 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll
16:57:47.0559 5592 wcncsvc - ok
16:57:47.0559 5592 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
16:57:47.0575 5592 WcsPlugInService - ok
16:57:47.0590 5592 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\drivers\wd.sys
16:57:47.0590 5592 Wd - ok
16:57:47.0622 5592 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
16:57:47.0637 5592 Wdf01000 - ok
16:57:47.0653 5592 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll
16:57:47.0700 5592 WdiServiceHost - ok
16:57:47.0700 5592 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll
16:57:47.0715 5592 WdiSystemHost - ok
16:57:47.0731 5592 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll
16:57:47.0746 5592 WebClient - ok
16:57:47.0762 5592 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll
16:57:47.0778 5592 Wecsvc - ok
16:57:47.0793 5592 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll
16:57:47.0809 5592 wercplsupport - ok
16:57:47.0824 5592 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll
16:57:47.0840 5592 WerSvc - ok
16:57:47.0856 5592 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
16:57:47.0871 5592 WfpLwf - ok
16:57:47.0887 5592 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys
16:57:47.0887 5592 WIMMount - ok
16:57:47.0887 5592 WinDefend - ok
16:57:47.0902 5592 WinHttpAutoProxySvc - ok
16:57:47.0949 5592 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
16:57:47.0980 5592 Winmgmt - ok
16:57:48.0027 5592 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll
16:57:48.0074 5592 WinRM - ok
16:57:48.0090 5592 [ FE88B288356E7B47B74B13372ADD906D ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
16:57:48.0105 5592 WinUsb - ok
16:57:48.0136 5592 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll
16:57:48.0168 5592 Wlansvc - ok
16:57:48.0183 5592 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\DRIVERS\wmiacpi.sys
16:57:48.0199 5592 WmiAcpi - ok
16:57:48.0214 5592 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
16:57:48.0230 5592 wmiApSrv - ok
16:57:48.0246 5592 WMPNetworkSvc - ok
16:57:48.0277 5592 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll
16:57:48.0292 5592 WPCSvc - ok
16:57:48.0292 5592 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
16:57:48.0292 5592 WPDBusEnum - ok
16:57:48.0308 5592 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
16:57:48.0339 5592 ws2ifsl - ok
16:57:48.0355 5592 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\System32\wscsvc.dll
16:57:48.0370 5592 wscsvc - ok
16:57:48.0370 5592 WSearch - ok
16:57:48.0417 5592 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll
16:57:48.0448 5592 wuauserv - ok
16:57:48.0464 5592 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
16:57:48.0495 5592 WudfPf - ok
16:57:48.0511 5592 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
16:57:48.0526 5592 WUDFRd - ok
16:57:48.0558 5592 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
16:57:48.0573 5592 wudfsvc - ok
16:57:48.0589 5592 [ FE90B750AB808FB9DD8FBB428B5FF83B ] WwanSvc C:\Windows\System32\wwansvc.dll
16:57:48.0620 5592 WwanSvc - ok
16:57:48.0620 5592 ================ Scan global ===============================
16:57:48.0651 5592 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
16:57:48.0667 5592 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
16:57:48.0667 5592 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
16:57:48.0698 5592 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
16:57:48.0729 5592 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
16:57:48.0729 5592 [Global] - ok
16:57:48.0729 5592 ================ Scan MBR ==================================
16:57:48.0729 5592 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
16:57:48.0932 5592 \Device\Harddisk0\DR0 - ok
16:57:48.0932 5592 ================ Scan VBR ==================================
16:57:48.0932 5592 [ 9F5AF316FEEEEF2B696D4098922F8D73 ] \Device\Harddisk0\DR0\Partition1
16:57:48.0932 5592 \Device\Harddisk0\DR0\Partition1 - ok
16:57:48.0932 5592 [ 90FA13E1A2F08C6BA69A93B1FF93BA34 ] \Device\Harddisk0\DR0\Partition2
16:57:48.0932 5592 \Device\Harddisk0\DR0\Partition2 - ok
16:57:48.0932 5592 ============================================================
16:57:48.0932 5592 Scan finished
16:57:48.0932 5592 ============================================================
16:57:48.0932 4196 Detected object count: 5
16:57:48.0932 4196 Actual detected object count: 5
16:58:47.0732 4196 AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - skipped by user
16:58:47.0732 4196 AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:58:47.0732 4196 HiPatchService ( UnsignedFile.Multi.Generic ) - skipped by user
16:58:47.0732 4196 HiPatchService ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:58:47.0733 4196 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
16:58:47.0733 4196 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:58:47.0734 4196 USBAAPL64 ( UnsignedFile.Multi.Generic ) - skipped by user
16:58:47.0734 4196 USBAAPL64 ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:58:47.0734 4196 VKbms ( UnsignedFile.Multi.Generic ) - skipped by user
16:58:47.0734 4196 VKbms ( UnsignedFile.Multi.Generic ) - User select action: Skip

markusg · 05.07.2013, 16:17

Hi,
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

chatt · 05.07.2013, 16:40

Hier:
Combofix Logfile:

Code:

ATTFilter

ComboFix 13-07-04.01 - **** 05.07.2013  17:32:28.1.8 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8170.6046 [GMT 2:00]
ausgeführt von:: c:\users\****\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-06-05 bis 2013-07-05  ))))))))))))))))))))))))))))))
.
.
2074-05-07 16:38 . 2006-11-21 18:48	203576	------w-	c:\program files (x86)\Microsoft Games\Age of Empires III\autopatcher2.exe
2013-07-05 15:35 . 2013-07-05 15:35	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2013-07-05 15:35 . 2013-07-05 15:35	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-06-26 12:29 . 2013-06-26 12:29	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-20 17:08 . 2013-06-20 17:08	--------	d-----w-	c:\program files (x86)\Windows Phone
2013-06-12 13:03 . 2013-05-17 01:25	257536	----a-w-	c:\program files (x86)\Internet Explorer\ieproxy.dll
2013-06-12 07:50 . 2013-05-08 06:39	1910632	----a-w-	c:\windows\system32\drivers\tcpip.sys
2013-06-12 07:50 . 2013-04-26 05:51	751104	----a-w-	c:\windows\system32\win32spl.dll
2013-06-12 07:50 . 2013-04-26 04:55	492544	----a-w-	c:\windows\SysWow64\win32spl.dll
2013-06-12 07:50 . 2013-05-10 05:49	30720	----a-w-	c:\windows\system32\cryptdlg.dll
2013-06-12 07:50 . 2013-05-10 03:20	24576	----a-w-	c:\windows\SysWow64\cryptdlg.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-26 12:29 . 2012-01-24 20:30	867240	----a-w-	c:\windows\SysWow64\npdeployJava1.dll
2013-06-26 12:29 . 2012-01-24 20:30	789416	----a-w-	c:\windows\SysWow64\deployJava1.dll
2013-06-26 10:53 . 2013-05-02 08:45	83672	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2013-06-19 19:39 . 2011-10-03 11:45	291088	----a-w-	c:\windows\SysWow64\PnkBstrB.xtr
2013-06-19 19:39 . 2011-10-03 10:59	291088	----a-w-	c:\windows\SysWow64\PnkBstrB.exe
2013-06-19 19:39 . 2011-10-03 10:59	280904	----a-w-	c:\windows\SysWow64\PnkBstrB.ex0
2013-06-12 18:23 . 2012-04-01 08:46	692104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-12 18:23 . 2011-07-25 14:09	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-12 13:03 . 2011-08-14 18:16	75825640	----a-w-	c:\windows\system32\MRT.exe
2013-05-18 14:01 . 2013-05-18 14:01	73728	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2013-05-18 14:01 . 2013-05-18 14:01	719360	----a-w-	c:\windows\SysWow64\mshtmlmedia.dll
2013-05-18 14:01 . 2013-05-18 14:01	61952	----a-w-	c:\windows\SysWow64\tdc.ocx
2013-05-18 14:01 . 2013-05-18 14:01	523264	----a-w-	c:\windows\SysWow64\vbscript.dll
2013-05-18 14:01 . 2013-05-18 14:01	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2013-05-18 14:01 . 2013-05-18 14:01	38400	----a-w-	c:\windows\SysWow64\imgutil.dll
2013-05-18 14:01 . 2013-05-18 14:01	361984	----a-w-	c:\windows\SysWow64\html.iec
2013-05-18 14:01 . 2013-05-18 14:01	226304	----a-w-	c:\windows\system32\elshyph.dll
2013-05-18 14:01 . 2013-05-18 14:01	185344	----a-w-	c:\windows\SysWow64\elshyph.dll
2013-05-18 14:01 . 2013-05-18 14:01	158720	----a-w-	c:\windows\SysWow64\msls31.dll
2013-05-18 14:01 . 2013-05-18 14:01	150528	----a-w-	c:\windows\SysWow64\iexpress.exe
2013-05-18 14:01 . 2013-05-18 14:01	1441280	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2013-05-18 14:01 . 2013-05-18 14:01	138752	----a-w-	c:\windows\SysWow64\wextract.exe
2013-05-18 14:01 . 2013-05-18 14:01	137216	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2013-05-18 14:01 . 2013-05-18 14:01	12800	----a-w-	c:\windows\SysWow64\mshta.exe
2013-05-18 14:01 . 2013-05-18 14:01	110592	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2013-05-18 14:01 . 2013-05-18 14:01	1054720	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2013-05-18 14:01 . 2013-05-18 14:01	97280	----a-w-	c:\windows\system32\mshtmled.dll
2013-05-18 14:01 . 2013-05-18 14:01	92160	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2013-05-18 14:01 . 2013-05-18 14:01	905728	----a-w-	c:\windows\system32\mshtmlmedia.dll
2013-05-18 14:01 . 2013-05-18 14:01	81408	----a-w-	c:\windows\system32\icardie.dll
2013-05-18 14:01 . 2013-05-18 14:01	77312	----a-w-	c:\windows\system32\tdc.ocx
2013-05-18 14:01 . 2013-05-18 14:01	762368	----a-w-	c:\windows\system32\ieapfltr.dll
2013-05-18 14:01 . 2013-05-18 14:01	62976	----a-w-	c:\windows\system32\pngfilt.dll
2013-05-18 14:01 . 2013-05-18 14:01	599552	----a-w-	c:\windows\system32\vbscript.dll
2013-05-18 14:01 . 2013-05-18 14:01	52224	----a-w-	c:\windows\system32\msfeedsbs.dll
2013-05-18 14:01 . 2013-05-18 14:01	51200	----a-w-	c:\windows\system32\imgutil.dll
2013-05-18 14:01 . 2013-05-18 14:01	48640	----a-w-	c:\windows\system32\mshtmler.dll
2013-05-18 14:01 . 2013-05-18 14:01	452096	----a-w-	c:\windows\system32\dxtmsft.dll
2013-05-18 14:01 . 2013-05-18 14:01	441856	----a-w-	c:\windows\system32\html.iec
2013-05-18 14:01 . 2013-05-18 14:01	281600	----a-w-	c:\windows\system32\dxtrans.dll
2013-05-18 14:01 . 2013-05-18 14:01	27648	----a-w-	c:\windows\system32\licmgr10.dll
2013-05-18 14:01 . 2013-05-18 14:01	270848	----a-w-	c:\windows\system32\iedkcs32.dll
2013-05-18 14:01 . 2013-05-18 14:01	247296	----a-w-	c:\windows\system32\webcheck.dll
2013-05-18 14:01 . 2013-05-18 14:01	235008	----a-w-	c:\windows\system32\url.dll
2013-05-18 14:01 . 2013-05-18 14:01	23040	----a-w-	c:\windows\SysWow64\licmgr10.dll
2013-05-18 14:01 . 2013-05-18 14:01	216064	----a-w-	c:\windows\system32\msls31.dll
2013-05-18 14:01 . 2013-05-18 14:01	197120	----a-w-	c:\windows\system32\msrating.dll
2013-05-18 14:01 . 2013-05-18 14:01	173568	----a-w-	c:\windows\system32\ieUnatt.exe
2013-05-18 14:01 . 2013-05-18 14:01	167424	----a-w-	c:\windows\system32\iexpress.exe
2013-05-18 14:01 . 2013-05-18 14:01	1509376	----a-w-	c:\windows\system32\inetcpl.cpl
2013-05-18 14:01 . 2013-05-18 14:01	149504	----a-w-	c:\windows\system32\occache.dll
2013-05-18 14:01 . 2013-05-18 14:01	144896	----a-w-	c:\windows\system32\wextract.exe
2013-05-18 14:01 . 2013-05-18 14:01	1400416	----a-w-	c:\windows\system32\ieapfltr.dat
2013-05-18 14:01 . 2013-05-18 14:01	13824	----a-w-	c:\windows\system32\mshta.exe
2013-05-18 14:01 . 2013-05-18 14:01	136192	----a-w-	c:\windows\system32\iepeers.dll
2013-05-18 14:01 . 2013-05-18 14:01	135680	----a-w-	c:\windows\system32\IEAdvpack.dll
2013-05-18 14:01 . 2013-05-18 14:01	12800	----a-w-	c:\windows\system32\msfeedssync.exe
2013-05-18 14:01 . 2013-05-18 14:01	102912	----a-w-	c:\windows\system32\inseng.dll
2013-05-01 01:59 . 2013-05-01 01:59	94208	----a-w-	c:\windows\SysWow64\QuickTimeVR.qtx
2013-05-01 01:59 . 2013-05-01 01:59	69632	----a-w-	c:\windows\SysWow64\QuickTime.qts
2013-04-26 12:28 . 2013-04-26 12:29	28600	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2013-04-26 12:28 . 2013-04-26 12:29	130016	----a-w-	c:\windows\system32\drivers\avipbb.sys
2013-04-26 12:28 . 2013-04-26 12:29	100712	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2013-04-13 05:49 . 2013-05-16 15:19	135168	----a-w-	c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-16 15:19	350208	----a-w-	c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-16 15:19	308736	----a-w-	c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-16 15:19	111104	----a-w-	c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-16 15:19	474624	----a-w-	c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-16 15:19	2176512	----a-w-	c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 14:39	1656680	----a-w-	c:\windows\system32\drivers\ntfs.sys
2013-04-10 06:01 . 2013-05-16 15:19	265064	----a-w-	c:\windows\system32\drivers\dxgmms1.sys
2013-04-10 06:01 . 2013-05-16 15:19	983400	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2013-04-10 03:30 . 2013-05-16 15:17	3153920	----a-w-	c:\windows\system32\win32k.sys
2011-11-28 12:21 . 2011-11-21 18:43	168864	----a-w-	c:\program files\Common Files\WireHelpSvc.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	130736	----a-w-	c:\users\****\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	130736	----a-w-	c:\users\****\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	130736	----a-w-	c:\users\****\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2011-07-25 3077528]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-26 375000]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-11-05 283160]
"AVMWlanClient"="c:\program files (x86)\avmwlanstick\wlangui.exe" [2010-10-22 2105344]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-06-26 345144]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"HP Software Update"=c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 ALSysIO;ALSysIO;c:\users\****\AppData\Local\Temp\ALSysIO64.sys;c:\users\****\AppData\Local\Temp\ALSysIO64.sys [x]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys;c:\windows\SYSNATIVE\drivers\avmeject.sys [x]
R3 ESLvnic1;ESLvnic Virtual Network 64 Bit;c:\windows\system32\DRIVERS\ESLvnic.sys;c:\windows\SYSNATIVE\DRIVERS\ESLvnic.sys [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
R3 LADF_DHP2;G35 DHP2 Filter Driver;c:\windows\system32\DRIVERS\ladfDHP2amd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfDHP2amd64.sys [x]
R3 LADF_SBVM;G35 SBVM Filter Driver;c:\windows\system32\DRIVERS\ladfSBVMamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfSBVMamd64.sys [x]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys;c:\windows\SYSNATIVE\drivers\LGVirHid.sys [x]
R3 lvpepf64;Volume Adapter;c:\windows\system32\DRIVERS\lv302a64.sys;c:\windows\SYSNATIVE\DRIVERS\lv302a64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
R3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\drivers\LVUSBS64.sys;c:\windows\SYSNATIVE\drivers\LVUSBS64.sys [x]
R3 Lycosa;Lycosa Keyboard;c:\windows\system32\drivers\Lycosa.sys;c:\windows\SYSNATIVE\drivers\Lycosa.sys [x]
R3 RDID1104;ME-25;c:\windows\system32\Drivers\rdwm1104.sys;c:\windows\SYSNATIVE\Drivers\rdwm1104.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 VKbms;Virtual HID Minidriver;c:\windows\system32\DRIVERS\VKbms.sys;c:\windows\SYSNATIVE\DRIVERS\VKbms.sys [x]
S0 mv61xx;mv61xx;c:\windows\system32\DRIVERS\mv61xx.sys;c:\windows\SYSNATIVE\DRIVERS\mv61xx.sys [x]
S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys;SysWow64\drivers\AsUpIO.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 Magic Tune;MagicTune;c:\windows\system32\Drivers\MtiCtwl.sys;c:\windows\SYSNATIVE\Drivers\MtiCtwl.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 asComSvc;ASUS Com Service;c:\program files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe;c:\program files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [x]
S2 asHmComSvc;ASUS HM Com Service;c:\program files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe;c:\program files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe [x]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [x]
S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [x]
S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 fwlanusb4;FRITZ!WLAN N/G;c:\windows\system32\DRIVERS\fwlanusb4.sys;c:\windows\SYSNATIVE\DRIVERS\fwlanusb4.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys;c:\windows\SYSNATIVE\drivers\LGBusEnum.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 84528118
*Deregistered* - 84528118
.
Inhalt des "geplante Tasks" Ordners
.
2013-07-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 18:23]
.
2013-07-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4264279110-3506634303-1943128777-1000Core.job
- c:\users\****\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-26 19:48]
.
2013-07-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4264279110-3506634303-1943128777-1000UA.job
- c:\users\****\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-26 19:48]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]
"Launch LgDeviceAgent"="c:\program files\Logitech\GamePanel Software\LgDevAgt.exe" [2010-08-03 415816]
"Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2010-08-03 4725320]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://isearch.avg.com/?cid={3F57C2FA-A20A-40F4-8363-573D5F06A82D}&mid=5073a776909747d0a7806d4c05e0cfc9-b82c7c8ebf85e38e21aecf1e279c904159f23c5c&lang=de&ds=tt015&pr=sa&d=2012-05-15 14:54&v=8.0.0.34&sap=hp
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube Download - c:\users\****\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\****\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.0.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_blr.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-4264279110-3506634303-1943128777-1000\Software\SecuROM\License information*]
"datasecu"=hex:05,28,84,e8,0f,e5,64,e9,5d,c2,e3,ab,3a,7c,09,01,3c,14,42,43,0e,
   d3,21,81,9e,4e,ce,22,d4,9a,fe,4c,3e,d5,6a,d7,51,d3,8c,4a,17,36,8b,91,09,02,\
"rkeysecu"=hex:c2,60,94,81,08,bc,3b,a0,b9,c1,1d,5e,8e,5a,4e,17
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-07-05  17:36:12
ComboFix-quarantined-files.txt  2013-07-05 15:36
.
Vor Suchlauf: 14 Verzeichnis(se), 787.131.695.104 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 786.594.623.488 Bytes frei
.
- - End Of File - - 83F11B84C441067B0BFDE5D9FB12B537

--- --- ---
D41D8CD98F00B204E9800998ECF8427E

markusg · 05.07.2013, 16:43

Hi,
malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

chatt · 05.07.2013, 17:41

Keine Funde!

Malwarebytes Anti-Malware 1.75.0.1300
Malwarebytes : Free Anti-Malware download

Datenbank Version: v2013.07.05.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16618
**** :: ****-PC [Administrator]

05.07.2013 17:51:17
mbam-log-2013-07-05 (17-51-17).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 430384
Laufzeit: 40 Minute(n), 47 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

markusg · 05.07.2013, 17:50

Hi,

lade den CCleaner standard:
CCleaner - Download - Filepony
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

chatt · 05.07.2013, 18:03

Hier:

Adobe Flash Player 11 ActiveX Adobe Systems Incorporated 11.06.2013 6,00MB 11.7.700.224 -notwendig
Adobe Flash Player 11 Plugin Adobe Systems Incorporated 11.06.2013 6,00MB 11.7.700.224 -notwendig
Adobe Reader X (10.1.7) - Deutsch Adobe Systems Incorporated 14.05.2013 122,8MB 10.1.7 -unnötig
Apple Application Support Apple Inc. 30.05.2013 64,7MB 2.3.4 -unnötig
Apple Mobile Device Support Apple Inc. 30.05.2013 25,3MB 6.1.0.13 -unnötig
Apple Software Update Apple Inc. 23.08.2011 2,38MB 2.1.3.127 -unnötig
Asmedia ASM104x USB 3.0 Host Controller Driver Asmedia Technology 24.07.2011 2,12MB 1.4.5.0 -notwendig
Avira Free Antivirus Avira 30.06.2013 128,5MB 13.0.0.3737 -notwendig
AVM FRITZ!WLAN AVM Berlin 28.03.2012 -notwendig
Battlefield 3™ Electronic Arts 24.09.2012 1.4.0.0 -notwendig
Battlelog Web Plugins EA Digital Illusions CE AB 17.06.2013 2.1.7-notwendig
Bonjour Apple Inc. 28.09.2012 2,08MB 3.0.0.10 -notwendig
Browser Configuration Utility DeviceVM Inc. 24.07.2011 3,14MB 1.0.10.0 -unbekannt
Call of Duty: Black Ops II 23.12.2012 -notwendig
Call of Duty: Black Ops II - Multiplayer 23.12.2012 -notwendig
Call of Duty: Black Ops II - Zombies 23.12.2012 -notwendig
Call of Duty: Modern Warfare 2 Infinity Ward 07.05.2013 -notwendig
Call of Duty: Modern Warfare 2 - Multiplayer Infinity Ward 07.05.2013 -notwendig
Call of Duty: Modern Warfare 3 Infinity Ward - Sledgehammer Games 06.11.2011 -notwendig
Call of Duty: Modern Warfare 3 - Dedicated Server Infinity Ward - Sledgehammer Games 17.11.2011 -notwendig
Call of Duty: Modern Warfare 3 - Multiplayer Infinity Ward - Sledgehammer Games 06.11.2011 -notwendig
CCleaner Piriform 16.02.2012 3.15 -notwendig
Counter-Strike: Global Offensive 27.11.2012 -notwendig
Counter-Strike: Global Offensive - SDK 27.11.2012 -notwendig
Counter-Strike: Source Valve 13.12.2011 -notwendig
Counter-Strike: Source Valve 06.11.2011 3.844MB 1.0.0.0 -notwendig
Dota 2 19.06.2012 -notwendig
Dropbox Dropbox, Inc. 27.06.2013 2.0.22 -notwendig
ESN Sonar ESN Social Software AB 06.04.2013 0.70.4 -notwendig
Google Chrome Google Inc. 26.04.2012 27.0.1453.116 -notwendig
GUILD WARS 02.08.2011 -notwendig
Guild Wars 2 NCsoft Corporation, Ltd. 16.08.2012 -notwendig
Hi-Rez Studios Authenticate and Update Service Hi-Rez Studios 12.01.2013 3.0.0.0 -unnötig
HP Officejet 6600 - Grundlegende Software für das Gerät Hewlett-Packard Co. 09.05.2012 180,8MB 25.0.619.0 -notwendig
HP Officejet 6600 Hilfe Hewlett Packard 09.05.2012 17,6MB 140.0.2.2 -notwendig
HP Update Hewlett-Packard 09.05.2012 3,98MB 5.003.000.004 -notwendig
I.R.I.S. OCR HP 09.05.2012 69,0MB 12.3.4.0 -notwendig
Intel(R) Management Engine Components Intel Corporation 25.07.2011 7.0.0.1144 -notwendig
Intel(R) Rapid Storage Technology Intel Corporation 25.07.2011 10.1.0.1008 -notwendig
iTunes Apple Inc. 30.05.2013 187,6MB 11.0.3.42 -notwendig
Java 7 Update 25 Oracle 25.06.2013 129,3MB 7.0.250 -notwendig
Java(TM) 6 Update 21 (64-bit) Oracle 20.04.2012 90,5MB 6.0.210 -notwendig
Java(TM) 7 (64-bit) Oracle 06.09.2011 93,3MB 7.0.0 -notwendig
JavaFX 2.1.1 Oracle Corporation 09.07.2012 20,9MB 2.1.1 -notwendig
K-Lite Codec Pack 6.0.4 (Basic) 08.03.2012 14,2MB 6.0.4 -notwendig
League of Legends Riot Games 13.04.2012 1.3 -notwendig
Logitech GamePanel Software 3.06.109 Logitech Inc. 07.11.2012 20,6MB 3.06.109 -notwendig
Malwarebytes Anti-Malware Version 1.75.0.1300 Malwarebytes Corporation 04.07.2013 19,3MB 1.75.0.1300
marvell 61xx Marvell 24.07.2011 1.2.0.7600 -notwendig
ME-25-Treiber Roland Corporation 08.11.2011 -notwendig
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 25.07.2011 38,8MB 4.0.30319 -notwendig
Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Corporation 25.07.2011 2,94MB 4.0.30319 -notwendig
Microsoft .NET Framework 4 Extended Microsoft Corporation 16.10.2011 52,0MB 4.0.30319 -notwendig
Microsoft .NET Framework 4 Extended DEU Language Pack Microsoft Corporation 16.10.2011 10,7MB 4.0.30319 -notwendig
Microsoft PowerPoint Viewer Microsoft Corporation 05.09.2011 147,6MB 14.0.4763.1000 -notwendig
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 09.09.2011 0,42MB 8.0.56336 -notwendig
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 Microsoft Corporation 14.07.2012 1,43MB 9.0.21022 -notwendig
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Corporation 24.07.2011 0,25MB 9.0.30729 -notwendig
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Corporation 24.07.2011 0,77MB 9.0.30729.4148 -notwendig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 Microsoft Corporation 10.06.2012 1,46MB 9.0.30411 -notwendig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 Microsoft Corporation 08.11.2011 0,22MB 9.0.30729 -notwendig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 02.10.2011 0,23MB 9.0.30729 -notwendig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 24.07.2011 0,58MB 9.0.30729.4148 -notwendig
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 Microsoft Corporation 02.10.2011 13,8MB 10.0.40219 -notwendig
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 02.10.2011 11,1MB 10.0.40219 -notwendig
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 17.07.2012 1,28MB 4.20.9870.0 -notwendig
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 19.07.2012 1,33MB 4.20.9876.0 -notwendig
MyPhoneExplorer F.J. Wechselberger 02.01.2012 1.8.2 -notwendig
Natural Selection 2 Unknown Worlds Entertainment 24.03.2013 -unnötig
NC Launcher (GameForge) NCsoft 01.03.2012 -unnötig
NVIDIA 3D Vision Controller-Treiber 314.22 NVIDIA Corporation 11.05.2013 314.22 -notwendig
NVIDIA 3D Vision Treiber 314.22 NVIDIA Corporation 11.05.2013 314.22 -notwendig
NVIDIA Grafiktreiber 314.22 NVIDIA Corporation 11.05.2013 314.22 -notwendig
NVIDIA HD-Audiotreiber 1.3.23.1 NVIDIA Corporation 11.05.2013 1.3.23.1 -notwendig
NVIDIA PhysX-Systemsoftware 9.12.1031 NVIDIA Corporation 26.11.2012 9.12.1031 -notwendig
NVIDIA Update 1.12.12 NVIDIA Corporation 11.05.2013 1.12.12 -notwendig
OpenOffice.org 3.4 OpenOffice.org 10.06.2012 328MB 3.4.9590 -notwendig
Origin Electronic Arts, Inc. 29.02.2012 8.5.0.4550 -notwendig
Pando Media Booster Pando Networks Inc. 24.07.2011 5,47MB 2.3.6.0 -notwendig
PunkBuster Services Even Balance, Inc. 14.07.2012 0.992 -notwendig
QuickTime Apple Inc. 30.05.2013 74,6MB 7.74.80.86 -notwendig
Razer Imperator Razer USA Ltd. 29.10.2012 14,7MB 2.02.00 -notwendig
Realtek Ethernet Controller Driver Realtek 24.07.2011 7.31.1025.2010
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 24.07.2011 6.0.1.6251 -notwendig
Skype Click to Call Skype Technologies S.A. 29.10.2012 40,7MB 6.3.11079 -notwendig
Skype™ 6.5 Skype Technologies S.A. 11.06.2013 22,0MB 6.5.158 -notwendig
SONAR LE Cakewalk Music Software 08.11.2011 18.0 -notwendig
Spotify Spotify AB 19.06.2013 0.9.1.53.g876fa9df -notwendig
Steam Valve Corporation 18.09.2011 35,5MB 1.0.0.0 -notwendig
System Requirements Lab 28.11.2011 -notwendig
System Requirements Lab for Intel Husdawg, LLC 20.04.2012 0,75MB 4.5.5.0 -notwendig
TeamSpeak 3 Client TeamSpeak Systems GmbH 07.04.2013 3.0.10.1 -notwendig
Tribes Ascend Hi-Rez Studios 12.01.2013 1.0.1185.4 -unnötig
VLC media player 2.0.5 VideoLAN 25.12.2012 2.0.5 -notwendig
Windows Phone app for desktop Microsoft Corporation 19.06.2013 8,79MB 1.0.1720.1 -notwendig
WinRAR 4.01 (64-Bit) win.rar GmbH 05.10.2011 4.01.0 -notwendig
Worms Revolution 03.05.2013 -unnötig

markusg · 05.07.2013, 18:15

deinstaliere:
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden, instalieren.
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen
bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
Sicherheit (erweitert)
Erweiterte Sicherheit anhaken
und alle Dateien auswählen.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
Browser Configuration
Hi-Rez
Java(TM) : alle
Natural
NC
Tribes
Worms
Öffne CCleaner, analysieren, starten, PC neustarten.
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

chatt · 05.07.2013, 18:57

Flashplayer habe ich deinstalliert, jedoch sagt mir die Seite, dass Chrome den Flashplayer selbstständig aktualisiert etc.

Hier die Log-Datei von adwcleaner:AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v2.304 - Datei am 05/07/2013 um 19:51:03 erstellt
# Aktualisiert am 03/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : **** - ****-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\****\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\Program Files (x86)\Ilivid
Ordner Gelöscht : C:\Users\****\AppData\Local\Ilivid Player
Ordner Gelöscht : C:\Users\****\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\2omav72d.default\extensions\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\ilivid
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Schlüssel Gelöscht : HKLM\Software\Freeze.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16611

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://isearch.avg.com/?cid={3F57C2FA-A20A-40F4-8363-573D5F06A82D}&mid=5073a776909747d0a7806d4c05e0cfc9-b82c7c8ebf85e38e21aecf1e279c904159f23c5c&lang=de&ds=tt015&pr=sa&d=2012-05-15 14:54:34&v=8.0.0.34&sap=hp --> hxxp://www.google.com
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://isearch.avg.com/tab?cid={3F57C2FA-A20A-40F4-8363-573D5F06A82D}&mid=5073a776909747d0a7806d4c05e0cfc9-b82c7c8ebf85e38e21aecf1e279c904159f23c5c&lang=de&ds=tt015&pr=sa&d=2012-05-15 14:54:34&v=8.0.0.34&sap=nt --> hxxp://www.google.com

-\\ Mozilla Firefox v [Version kann nicht ermittelt werden]

Datei : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\2omav72d.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Google Chrome v27.0.1453.116

Datei : C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [3002 octets] - [05/07/2013 19:51:03]

########## EOF - C:\AdwCleaner[S1].txt - [3062 octets] ##########

--- --- ---

markusg · 05.07.2013, 19:00

joa, aber für andere Browser, zb ie, falls verwendet, müsste er dann instaliert werden (über jeweiligen Browser)
neustarten bitte.
HitmanPro - Download - Filepony
Hitmanpro laden, doppelklicken, Scan klicken.
Nichts löschen.
Weiter klicken, Log speichern und posten, bzw als XML exportieren, packen und anhängen

chatt · 05.07.2013, 19:18

Okay gut

Hier die Logdatei:

Code:

ATTFilter

HitmanPro 3.7.6.201
www.hitmanpro.com

   Computer name . . . . : ****-PC
   Windows . . . . . . . : 6.1.1.7601.X64/8
   User name . . . . . . : ****-PC\****
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2013-07-05 20:09:42
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 3m 3s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 90

   Objects scanned . . . : 1.428.359
   Files scanned . . . . : 34.507
   Remnants scanned  . . : 434.641 files / 959.211 keys

Suspicious files ____________________________________________________________

   C:\Users\****\AppData\Local\PunkBuster\BF3\pb\dll\wc002287.dll
      Size . . . . . . . : 948.113 bytes
      Age  . . . . . . . : 527.9 days (2012-01-24 22:44:44)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 1BE27031845D80D6803C15BCE2EBE1276C0CA17F3BD47FDA8EAD97DBF5A517AF
      Fuzzy  . . . . . . : 29.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.

   C:\Users\****\AppData\Local\PunkBuster\BF3\pb\dll\wc002288.dll
      Size . . . . . . . : 948.118 bytes
      Age  . . . . . . . : 525.3 days (2012-01-27 13:29:01)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 3192353354FE593051B33886088D4C312ACB9A653D874281B2EBF131B80415CB
      Fuzzy  . . . . . . : 29.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.

   C:\Users\****\AppData\Local\PunkBuster\BF3\pb\dll\wc002292.dll
      Size . . . . . . . : 956.681 bytes
      Age  . . . . . . . : 448.2 days (2012-04-13 14:09:07)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 7218A15A9890CE82EB25F7AB5AC7AA60B4E3055C5574B70A6CABA4274D6DE493
      Fuzzy  . . . . . . : 29.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.

   C:\Users\****\AppData\Local\PunkBuster\BF3\pb\dll\wc002317.dll
      Size . . . . . . . : 949.613 bytes
      Age  . . . . . . . : 279.4 days (2012-09-29 10:24:28)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 15059F09B1D62DEA6B5D22EF9E0D062411C167378D870AE339AAB50B0BDC7FC0
      Fuzzy  . . . . . . : 29.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.

   C:\Users\****\AppData\Local\PunkBuster\BF3\pb\dll\wc002325.dll
      Size . . . . . . . : 959.376 bytes
      Age  . . . . . . . : 88.9 days (2013-04-07 21:55:53)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : A85592ACDCFDA7C0293504A5F5279C2654ACC0E6D2398ED8958F6E03F05DCEB5
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : 22.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.
         Program is code signed with a valid Authenticode certificate.

   C:\Users\****\AppData\Local\PunkBuster\BF3\pb\pbcl.dll
      Size . . . . . . . : 959.376 bytes
      Age  . . . . . . . : 15.9 days (2013-06-19 21:39:25)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : A85592ACDCFDA7C0293504A5F5279C2654ACC0E6D2398ED8958F6E03F05DCEB5
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : 23.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
         Program contains PE structure anomalies. This is not typical for most programs.
         Program is code signed with a valid Authenticode certificate.

   C:\Users\****\AppData\Local\PunkBuster\BF3\pb\pbclold.dll
      Size . . . . . . . : 959.376 bytes
      Age  . . . . . . . : 641.3 days (2011-10-03 13:45:02)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : A85592ACDCFDA7C0293504A5F5279C2654ACC0E6D2398ED8958F6E03F05DCEB5
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : 22.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.
         Program is code signed with a valid Authenticode certificate.

   C:\Users\****\AppData\Local\PunkBuster\BF3\pb\PnkBstrK.sys
      Size . . . . . . . : 137.992 bytes
      Age  . . . . . . . : 641.3 days (2011-10-03 13:45:31)
      Entropy  . . . . . : 7.8
      SHA-256  . . . . . : 21A3D2E3A063EA2F986EF1BAFD1A71F7FC9EDB3F69E0265E51A18DBC111084F1
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : 22.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.
         The file is a device driver. Device drivers run as trusted (highly privileged) code.
         Program is code signed with a valid Authenticode certificate.

   C:\Users\****\AppData\Local\PunkBuster\BLR\pb\dll\wc002293.dll
      Size . . . . . . . : 949.190 bytes
      Age  . . . . . . . : 328.2 days (2012-08-11 14:56:56)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : DAF43E93528BEEECC015FA98D6EE6D6FD6D19A049321E47A65665144E4511F41
      Fuzzy  . . . . . . : 29.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.

   C:\Users\****\AppData\Local\PunkBuster\BLR\pb\pbcl.dll
      Size . . . . . . . : 949.190 bytes
      Age  . . . . . . . : 328.2 days (2012-08-11 14:56:56)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : DAF43E93528BEEECC015FA98D6EE6D6FD6D19A049321E47A65665144E4511F41
      Fuzzy  . . . . . . : 29.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.

   C:\Users\****\AppData\Local\PunkBuster\BLR\pb\pbclold.dll
      Size . . . . . . . : 963.613 bytes
      Age  . . . . . . . : 355.2 days (2012-07-15 15:55:02)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : E7EB0F070DDDBDC1793677B6EF811338CDCEC5AE744A032C223DD1763D97A56B
      Fuzzy  . . . . . . : 29.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.

   C:\Users\****\AppData\Local\PunkBuster\BLR\pb\PnkBstrK.sys
      Size . . . . . . . : 140.360 bytes
      Age  . . . . . . . : 355.2 days (2012-07-15 15:55:12)
      Entropy  . . . . . : 7.8
      SHA-256  . . . . . : 0F41B3843E2D2D1BB1ACF8B7CAA293309CC1CF8CF478B1AC86DD6BB214928DC4
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : 22.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.
         The file is a device driver. Device drivers run as trusted (highly privileged) code.
         Program is code signed with a valid Authenticode certificate.

   C:\Windows\PEV.exe
      Size . . . . . . . : 256.000 bytes
      Age  . . . . . . . : 0.1 days (2013-07-05 17:31:45)
      Entropy  . . . . . : 8.0
      SHA-256  . . . . . : AE0F5CC54E4B133DF66A54572A7CE52FAFF11F8FD0CAEAB088AAD3699D6EC924
      Fuzzy  . . . . . . : 22.0
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         The .rsrc (resources) section in this program is set to executable. This is an indication of malware infection.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
         The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities.
         Program contains PE structure anomalies. This is not typical for most programs.
      Forensic Cluster
         -2.7s C:\Qoobox\Quarantine\Registry_backups\
         -2.7s C:\Qoobox\
         -2.7s C:\Qoobox\Quarantine\
         -1.2s C:\Qoobox\BackEnv\
         -1.1s C:\Qoobox\Quarantine\catchme.log
         -0.0s C:\Windows\SWXCACLS.exe
         -0.0s C:\Windows\SWSC.exe
         -0.0s C:\Windows\sed.exe
         -0.0s C:\Windows\grep.exe
         -0.0s C:\Windows\zip.exe
         -0.0s C:\Windows\SWREG.exe
          0.0s C:\Windows\PEV.exe
          0.0s C:\Windows\NIRCMD.exe
          0.0s C:\Windows\MBR.exe
          6.6s C:\Qoobox\BackEnv\AppData.folder.dat
          6.6s C:\Qoobox\BackEnv\Cache.folder.dat
          6.6s C:\Qoobox\BackEnv\Cookies.folder.dat
          6.6s C:\Qoobox\BackEnv\Desktop.folder.dat
          6.6s C:\Qoobox\BackEnv\Favorites.folder.dat
          6.6s C:\Qoobox\BackEnv\History.folder.dat
          6.6s C:\Qoobox\BackEnv\LocalAppData.folder.dat
          6.6s C:\Qoobox\BackEnv\LocalSettings.folder.dat
          6.6s C:\Qoobox\BackEnv\Music.folder.dat
          6.6s C:\Qoobox\BackEnv\NetHood.folder.dat
          6.6s C:\Qoobox\BackEnv\Personal.folder.dat
          6.6s C:\Qoobox\BackEnv\Pictures.folder.dat
          6.6s C:\Qoobox\BackEnv\PrintHood.folder.dat
          6.6s C:\Qoobox\BackEnv\Profiles.Folder.dat
          6.6s C:\Qoobox\BackEnv\Profiles.Folder.folder.dat
          6.6s C:\Qoobox\BackEnv\Programs.folder.dat
          6.6s C:\Qoobox\BackEnv\Recent.folder.dat
          6.6s C:\Qoobox\BackEnv\SendTo.folder.dat
          6.6s C:\Qoobox\BackEnv\StartMenu.folder.dat
          6.6s C:\Qoobox\BackEnv\StartUp.folder.dat
          6.6s C:\Qoobox\BackEnv\Templates.folder.dat
          6.8s C:\Qoobox\BackEnv\SysPath.dat
          6.8s C:\Qoobox\BackEnv\SetPath.bat
          6.8s C:\Qoobox\BackEnv\SetPath.bat
          6.8s C:\Qoobox\BackEnv\VikPev00
          7.0s C:\Qoobox\Quarantine\C\