| |
| |||||||
Log-Analyse und Auswertung: Windows XP: Neue Tabs öffnen sichWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
10.12.2014, 22:20
| #16 |
| Ruhe in Frieden † 2019     |  Windows XP: Neue Tabs öffnen sich Hallo, danke für die Nachfrage. Wir probieren das noch einmal anders. Mache bitte nochmal einen neuen Scan mit FRST. Schritt 1 Starte noch einmal FRST.
|
|
12.12.2014, 16:21
| #17 |
 | Windows XP: Neue Tabs öffnen sich Hallo,
__________________alles klar, hier nochmal das Ergebnis: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-12-2014 01
Ran by User (administrator) on KATIE on 12-12-2014 16:15:27
Running from C:\Dokumente und Einstellungen\User\Desktop
Loaded Profile: User (Available profiles: User)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
() C:\WINDOWS\system32\ibmpmsvc.exe
(Intel(R) Corporation) C:\Programme\Intel\WiFi\bin\S24EvMon.exe
(Juniper Networks) C:\Programme\Juniper Networks\Common Files\dsNcService.exe
(Intel(R) Corporation) C:\Programme\Intel\WiFi\bin\EvtEng.exe
() C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MobileBrServ\mbbService.exe
(Microsoft Corporation) C:\WINDOWS\system32\wbem\unsecapp.exe
(HP) C:\WINDOWS\system32\HPZipm12.exe
(Intel(R) Corporation) C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe
(Skype Technologies S.A.) C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Broadcom Corporation.) C:\Programme\ThinkPad\Bluetooth Software\bin\btwdins.exe
(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
(Analog Devices, Inc.) C:\Programme\Analog Devices\Core\smax4pnp.exe
(Intel Corporation) C:\WINDOWS\system32\igfxtray.exe
(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
(Synaptics, Inc.) C:\Programme\Synaptics\SynTP\SynTPLpr.exe
(Synaptics, Inc.) C:\Programme\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
() C:\Programme\FileZilla FTP Client\locales\sl_SI\eat_drink\reason_code.exe
(Skype Technologies S.A.) C:\Programme\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Piriform Ltd) C:\Programme\CCleaner\CCleaner.exe
(Microsoft Corporation) C:\WINDOWS\system32\taskkill.exe
(Microsoft Corporation) C:\WINDOWS\system32\wbem\unsecapp.exe
(Microsoft Corporation) C:\WINDOWS\system32\cmdl32.exe
(Microsoft Corporation) C:\WINDOWS\system32\charmap.exe
(Broadcom Corporation.) C:\Programme\ThinkPad\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\WINDOWS\system32\dllhost.exe
(Microsoft Corporation) C:\WINDOWS\system32\logagent.exe
(Microsoft Corporation) C:\WINDOWS\system32\convert.exe
(Microsoft Corporation) C:\WINDOWS\system32\PresentationHost.exe
(Mozilla Corporation) C:\Programme\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Programme\Mozilla Firefox\plugin-container.exe
(Microsoft Corporation) C:\WINDOWS\system32\sol.exe
(Microsoft Corporation) C:\WINDOWS\system32\print.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SoundMAXPnP] => C:\Programme\Analog Devices\Core\smax4pnp.exe [925696 2005-05-20] (Analog Devices, Inc.)
HKLM\...\Run: [SynTPLpr] => C:\Programme\Synaptics\SynTP\SynTPLpr.exe [126976 2003-06-24] (Synaptics, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Programme\Synaptics\SynTP\SynTPEnh.exe [561152 2003-06-24] (Synaptics, Inc.)
HKLM\...\Run: [photo_gallery] => C:\Programme\FileZilla FTP Client\locales\sl_SI\eat_drink\reason_code.exe [392192 2012-08-05] ()
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Run: [Skype] => C:\Programme\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Run: [CCleaner Monitoring] => C:\Programme\CCleaner\CCleaner.exe [4811032 2014-09-26] (Piriform Ltd)
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Run: [account-code] => C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Temp\Account_delay\account_check.exe [69632 2014-12-10] () <===== ATTENTION
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Run: [kid-anger] => C:\Dokumente und Einstellungen\User\Anwendungsdaten\Kid-read\kid_refuse.exe [179712 2014-12-12] ()
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Run: [channel-shock] => C:\Dokumente und Einstellungen\User\Anwendungsdaten\Channel-come\channeloccasion.exe [69632 2014-12-09] ()
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Run: [signal-contain] => C:\Dokumente und Einstellungen\User\Anwendungsdaten\Signal_guy\signal-fold.exe [69632 2014-12-10] ()
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Run: [markpersuade] => C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Temp\Mark-model\mark-contest.exe [195584 2014-12-09] () <===== ATTENTION
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Run: [access-contain] => C:\Dokumente und Einstellungen\User\Anwendungsdaten\Access-bottom\access-contain.exe [177664 2014-12-10] ()
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Run: [zxzwkeos] => C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Temp\Fcvlyajb\mpjkwkeos.exe [160768 2014-12-12] () <===== ATTENTION
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Run: [bicycle-kiss] => C:\Dokumente und Einstellungen\User\Anwendungsdaten\Bicycle_tool\bicycle-project.exe [73728 2014-12-12] ()
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\RunOnce: [kid-anger] => C:\Dokumente und Einstellungen\User\Anwendungsdaten\Kid-read\kid_refuse.exe [179712 2014-12-12] ()
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\RunOnce: [markpersuade] => C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Temp\Mark-model\mark-contest.exe [195584 2014-12-09] () <===== ATTENTION
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\RunOnce: [access-contain] => C:\Dokumente und Einstellungen\User\Anwendungsdaten\Access-bottom\access-contain.exe [177664 2014-12-10] ()
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\RunOnce: [bicycle-kiss] => C:\Dokumente und Einstellungen\User\Anwendungsdaten\Bicycle_tool\bicycle-project.exe [73728 2014-12-12] ()
Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk
ShortcutTarget: BTTray.lnk -> C:\Programme\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:4880;https=127.0.0.1:4880;
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9E2BD873EEF2CF01
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Programme\Java\jre6\bin\jp2ssv.dll No File
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\d90tq7ym.default-1413761053703
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_15_0_0_246.dll ()
FF Plugin: @java.com/DTPlugin,version=10.10.2 -> C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Programme\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF user.js: detected! => C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\d90tq7ym.default-1413761053703\user.js
FF Plugin ProgramFiles/Appdata: C:\Programme\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF SearchPlugin: C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\d90tq7ym.default-1413761053703\searchplugins\google-images.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\d90tq7ym.default-1413761053703\searchplugins\google-maps.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\d90tq7ym.default-1413761053703\searchplugins\search.xml
FF Extension: Cliqz Beta - C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\d90tq7ym.default-1413761053703\Extensions\cliqz@cliqz.com.xpi [2014-10-22]
FF Extension: Newtab - C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\d90tq7ym.default-1413761053703\Extensions\{a535a12b-d6c2-4f95-aef8-29c60aef0888}.xpi [2014-11-27]
FF Extension: Skype Click to Call - C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-12-09]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-09-26]
FF HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\d90tq7ym.default-1413761053703\extensions\cliqz@cliqz.com
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default
CHR Extension: (DivX HiQ) - C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae [2011-10-09]
CHR Extension: (DivX Plus Web Player HTML5 <video>) - C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2011-10-09]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Programme\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2012-07-05]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 btwdins; C:\Programme\ThinkPad\Bluetooth Software\bin\btwdins.exe [349528 2010-09-22] (Broadcom Corporation.)
R2 dsNcService; C:\Programme\Juniper Networks\Common Files\dsNcService.exe [670792 2011-09-08] (Juniper Networks)
R2 EvtEng; C:\Programme\Intel\WiFi\bin\EvtEng.exe [866576 2010-10-19] (Intel(R) Corporation)
R2 IBMPMSVC; C:\WINDOWS\system32\ibmpmsvc.exe [57344 2003-07-03] ()
R2 Mobile Broadband HL Service; C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MobileBrServ\mbbservice.exe [239184 2013-01-28] ()
S3 MozillaMaintenance; C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe [114800 2014-12-09] (Mozilla Foundation)
S3 odserv; C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE [440696 2011-07-20] (Microsoft Corporation)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [145184 2006-10-26] (Microsoft Corporation)
S2 playback_order; C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\windows_to_go\video.exe [174080 2014-08-14] (Company 'gora-sah') [File not signed]
R2 RegSrvc; C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe [477456 2010-10-19] (Intel(R) Corporation)
R2 S24EventMonitor; C:\Programme\Intel\WiFi\bin\S24EvMon.exe [966656 2010-10-19] (Intel(R) Corporation) [File not signed]
S2 shut_down; C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\windows_to_go\voice_note.exe [174080 2014-08-03] (Company 'gora-sah') [File not signed]
R2 Skype C2C Service; C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3048136 2012-07-05] (Skype Technologies S.A.)
S2 SkypeUpdate; C:\Programme\Skype\Updater\Updater.exe [172192 2013-10-23] (Skype Technologies)
S2 trusted_root_ca; C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\windows_to_go\pin_to_start.exe [175104 2014-07-04] (Company 'gora-sah') [File not signed]
S2 windows_call; C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\windows_to_go\vision.exe [206848 2013-12-09] (Company 'gora-sah') [File not signed]
S3 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 AEAudioService; C:\WINDOWS\System32\drivers\AEAudio.sys [93952 2006-08-07] (Andrea Electronics Corporation)
R3 BTKRNL; C:\WINDOWS\System32\DRIVERS\btkrnl.sys [993576 2010-09-23] (Broadcom Corporation.)
R3 dsNcAdpt; C:\WINDOWS\System32\DRIVERS\dsNcAdpt.sys [26624 2011-09-08] (Juniper Networks)
S3 HPZid412; C:\WINDOWS\System32\DRIVERS\HPZid412.sys [49664 2005-10-28] (HP)
S3 HPZipr12; C:\WINDOWS\System32\DRIVERS\HPZipr12.sys [16496 2005-10-28] (HP)
S3 HPZius12; C:\WINDOWS\System32\DRIVERS\HPZius12.sys [21568 2005-10-28] (HP)
R3 HSFHWAZL; C:\WINDOWS\System32\DRIVERS\HSFHWAZL.sys [217016 2010-06-02] (Conexant Systems, Inc.)
R3 HSF_DPV; C:\WINDOWS\System32\DRIVERS\HSF_DPV.sys [993464 2010-06-02] (Conexant Systems, Inc.)
R3 IBMPMDRV; C:\WINDOWS\System32\DRIVERS\ibmpmdrv.sys [11344 2003-07-03] (IBM Corp.)
R3 NETwLx32; C:\WINDOWS\System32\DRIVERS\NETwLx32.sys [6609920 2010-10-07] (Intel Corporation)
R3 Rasirda; C:\WINDOWS\System32\DRIVERS\rasirda.sys [19584 2001-08-17] (Microsoft Corporation)
R2 s24trans; C:\WINDOWS\System32\DRIVERS\s24trans.sys [13952 2010-05-19] (Intel Corporation) [File not signed]
S4 sptd; C:\WINDOWS\System32\Drivers\sptd.sys [717296 2011-03-17] (Duplex Secure Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S4 IntelIde; No ImagePath
S3 StarOpen; No ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-12 16:15 - 2014-12-12 16:16 - 00017219 _____ () C:\Dokumente und Einstellungen\User\Desktop\FRST.txt
2014-12-12 15:19 - 2014-12-12 15:19 - 00000000 ___HD () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Bicycle_tool
2014-12-12 00:23 - 2014-12-12 00:23 - 00000000 ___HD () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Kid-read
2014-12-10 19:04 - 2014-12-10 19:09 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft Help
2014-12-10 06:08 - 2014-12-12 00:32 - 00000000 ___HD () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Doyemgl
2014-12-10 06:07 - 2014-12-11 22:07 - 00000010 _____ () C:\WINDOWS\)†
2014-12-10 03:38 - 2014-12-10 03:38 - 00000000 ___HD () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Access-bottom
2014-12-10 02:19 - 2014-12-10 02:19 - 00000000 ___HD () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Signal_guy
2014-12-09 18:03 - 2014-12-09 18:03 - 00000000 ___HD () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Channel-come
2014-12-09 14:12 - 2014-12-09 14:12 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Anwendungsdaten\OpenOffice
2014-12-09 09:33 - 2014-12-09 09:33 - 04184008 _____ (Kaspersky Lab ZAO) C:\Dokumente und Einstellungen\User\Desktop\tdsskiller.exe
2014-12-09 08:15 - 2014-12-09 08:20 - 00000000 ____D () C:\Programme\Mozilla Firefox
2014-12-09 06:50 - 2014-12-10 06:08 - 00000000 ___HD () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Jndbambsq
2014-12-05 11:06 - 2014-12-05 11:17 - 00000000 ___SD () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\OpenOffice 4.1.1
2014-12-05 11:06 - 2014-12-05 11:06 - 00000853 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\OpenOffice 4.1.1.lnk
2014-12-05 10:56 - 2014-12-05 10:59 - 00000000 ____D () C:\Programme\OpenOffice 4
2014-12-05 10:48 - 2014-12-05 10:50 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Desktop\OpenOffice 4.1.1 (de) Installation Files
2014-12-05 10:28 - 2014-12-05 10:28 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Cliqz
2014-12-05 10:12 - 2014-12-05 10:12 - 01174352 _____ () C:\Dokumente und Einstellungen\User\Desktop\OpenOffice - CHIP-Installer.exe
2014-12-04 07:40 - 2014-12-04 07:40 - 00000213 _____ () C:\WINDOWS\afl.rul
2014-12-04 07:36 - 2014-12-12 16:13 - 00000458 _____ () C:\WINDOWS\onsxe.jix
2014-12-04 07:36 - 2014-12-04 07:36 - 00475713 _____ () C:\WINDOWS\xtkq.eof
2014-12-04 07:36 - 2014-12-04 07:36 - 00233224 _____ () C:\WINDOWS\ejyt.gwq
2014-12-04 07:35 - 2014-12-12 16:13 - 00001146 _____ () C:\WINDOWS\klwbxnc.zpa
2014-12-03 07:17 - 2014-12-07 04:39 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Desktop\FRST-OlderVersion
2014-12-02 04:02 - 2014-12-02 04:02 - 00025591 _____ () C:\ComboFix.txt
2014-12-02 04:02 - 2014-12-02 04:02 - 00000000 ____D () C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\temp
2014-12-02 04:02 - 2014-12-02 04:02 - 00000000 ____D () C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\temp
2014-12-02 03:47 - 2014-12-02 03:47 - 00000000 ____H () C:\WINDOWS\system32\config\system.tmp.LOG
2014-12-02 03:47 - 2014-12-02 03:47 - 00000000 ____H () C:\WINDOWS\system32\config\software.tmp.LOG
2014-12-02 03:47 - 2014-12-02 03:47 - 00000000 ____H () C:\WINDOWS\system32\config\SAM.tmp.LOG
2014-12-02 03:47 - 2014-12-02 03:47 - 00000000 ____H () C:\WINDOWS\system32\config\default.tmp.LOG
2014-12-02 03:46 - 2014-12-02 03:46 - 00008192 ____H () C:\WINDOWS\system32\config\SECURITY.tmp.LOG
2014-12-02 03:27 - 2014-12-02 03:27 - 00000000 _RSHD () C:\cmdcons
2014-12-02 03:27 - 2011-03-17 10:31 - 00000211 _____ () C:\Boot.bak
2014-12-02 03:27 - 2004-08-03 23:00 - 00262448 __RSH () C:\cmldr
2014-12-02 03:18 - 2011-06-26 07:45 - 00256000 _____ () C:\WINDOWS\PEV.exe
2014-12-02 03:18 - 2010-11-07 18:20 - 00208896 _____ () C:\WINDOWS\MBR.exe
2014-12-02 03:18 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2014-12-02 03:18 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2014-12-02 03:18 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2014-12-02 03:18 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2014-12-02 03:18 - 2000-08-31 01:00 - 00098816 _____ () C:\WINDOWS\sed.exe
2014-12-02 03:18 - 2000-08-31 01:00 - 00080412 _____ () C:\WINDOWS\grep.exe
2014-12-02 03:18 - 2000-08-31 01:00 - 00068096 _____ () C:\WINDOWS\zip.exe
2014-12-02 03:16 - 2014-12-02 04:02 - 00000000 ____D () C:\Qoobox
2014-12-02 03:14 - 2014-12-02 03:14 - 00000000 ___RD () C:\Dokumente und Einstellungen\User\Startmenü\Programme\Verwaltung
2014-12-02 03:12 - 2014-12-02 04:00 - 00000000 ____D () C:\WINDOWS\erdnt
2014-12-02 02:50 - 2014-12-02 02:52 - 05600374 ____R (Swearware) C:\Dokumente und Einstellungen\User\Desktop\ComboFix.exe
2014-12-02 01:02 - 2014-12-02 01:02 - 00000000 ___HD () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mrues
2014-12-01 10:35 - 2014-12-01 10:35 - 00114904 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\6F062457.sys
2014-12-01 09:29 - 2014-12-01 09:29 - 00380416 _____ () C:\Dokumente und Einstellungen\User\Desktop\Gmer-19357.exe
2014-12-01 09:14 - 2014-12-12 16:15 - 00000000 ____D () C:\FRST
2014-12-01 08:58 - 2014-12-07 04:39 - 01111040 _____ (Farbar) C:\Dokumente und Einstellungen\User\Desktop\FRST.exe
2014-11-28 05:09 - 2014-11-30 20:17 - 00000012 _____ () C:\WINDOWS\䌯尺䐀尺
2014-11-28 05:04 - 2014-11-28 05:04 - 00000020 _____ () C:\Dokumente und Einstellungen\User\defogger_reenable
2014-11-28 05:02 - 2014-11-28 05:02 - 00050477 _____ () C:\Dokumente und Einstellungen\User\Desktop\Defogger.exe
2014-11-28 01:35 - 2014-11-28 02:01 - 00000018 _____ () C:\WINDOWS\䌯尺䐀尺䘀尺
2014-11-18 14:56 - 2014-11-18 14:56 - 01202848 _____ (Microsoft Corporation) C:\WINDOWS\system32\FM20.DLL
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-12 16:16 - 2013-12-06 13:20 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-12-12 16:16 - 2011-03-17 09:27 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Temp
2014-12-12 14:01 - 2011-03-17 09:14 - 01159828 _____ () C:\WINDOWS\WindowsUpdate.log
2014-12-12 13:52 - 2014-03-27 17:31 - 00000220 _____ () C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP – Benachrichtigung – Anmeldung.job
2014-12-12 13:52 - 2008-04-14 13:00 - 00013646 _____ () C:\WINDOWS\system32\wpa.dbl
2014-12-12 13:48 - 2011-03-17 09:08 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2014-12-12 13:48 - 2011-03-17 09:08 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2014-12-12 13:46 - 2011-03-17 09:19 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-12-12 11:17 - 2011-03-17 09:19 - 00032396 _____ () C:\WINDOWS\SchedLgU.Txt
2014-12-10 23:17 - 2012-08-30 18:52 - 00000000 ____D () C:\Programme\Mozilla Maintenance Service
2014-12-10 19:03 - 2011-03-17 09:05 - 00000000 __SHD () C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen\Verlauf
2014-12-10 09:17 - 2013-12-06 13:20 - 00701104 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2014-12-10 09:17 - 2012-01-18 09:01 - 00071344 ____C (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2014-12-09 19:07 - 2013-11-02 13:29 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Desktop\Bewerbung_NEU
2014-12-09 18:50 - 2011-10-08 11:24 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Skype
2014-12-09 12:19 - 2011-03-17 09:05 - 00000000 ____D () C:\Programme
2014-12-09 06:48 - 2011-03-17 09:56 - 00000000 ____D () C:\WINDOWS\Help
2014-12-08 21:30 - 2012-09-22 18:16 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Desktop\Hartz
2014-12-08 15:00 - 2014-03-27 17:31 - 00000214 _____ () C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP – Monatliche Benachrichtigung.job
2014-12-08 12:44 - 2012-07-04 12:30 - 00015360 ___HC () C:\Dokumente und Einstellungen\User\Desktop\photothumb.db
2014-12-08 12:44 - 2011-09-25 22:22 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Anwendungsdaten\PhotoScape
2014-12-08 12:43 - 2011-03-17 10:09 - 00075216 ____C () C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2014-12-08 12:43 - 2011-03-17 09:27 - 00000000 ___RD () C:\Dokumente und Einstellungen\User\Eigene Dateien\Eigene Bilder
2014-12-08 12:40 - 2011-03-17 09:27 - 00000000 ___HD () C:\Dokumente und Einstellungen\User\Netzwerkumgebung
2014-12-07 04:08 - 2008-04-14 13:00 - 00001588 _____ () C:\WINDOWS\win.ini
2014-12-06 06:27 - 2011-03-17 09:04 - 00296456 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-12-05 11:06 - 2011-03-17 09:05 - 00000000 ___RD () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme
2014-12-03 20:13 - 2011-03-17 09:19 - 00000000 __SHD () C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Verlauf
2014-12-03 07:46 - 2011-03-17 09:27 - 00000000 __SHD () C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Verlauf
2014-12-03 07:45 - 2011-03-17 09:19 - 00000000 __SHD () C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Verlauf
2014-12-03 07:41 - 2014-09-12 20:00 - 00000000 ____D () C:\Programme\Security Guard
2014-12-02 03:54 - 2008-04-14 13:00 - 00000227 _____ () C:\WINDOWS\system.ini
2014-12-02 03:49 - 2011-03-17 10:03 - 29097984 _____ () C:\WINDOWS\system32\config\software.bak
2014-12-02 03:49 - 2011-03-17 10:03 - 04980736 _____ () C:\WINDOWS\system32\config\system.bak
2014-12-02 03:49 - 2011-03-17 10:03 - 00524288 _____ () C:\WINDOWS\system32\config\default.bak
2014-12-02 03:49 - 2011-03-17 10:02 - 00000000 ____D () C:\WINDOWS\Microsoft.NET
2014-12-02 03:49 - 2011-03-17 09:04 - 00262144 _____ () C:\WINDOWS\system32\config\SECURITY.bak
2014-12-02 03:49 - 2011-03-17 09:04 - 00262144 _____ () C:\WINDOWS\system32\config\SAM.bak
2014-12-02 03:27 - 2011-03-17 10:03 - 00000327 __RSH () C:\boot.ini
2014-12-02 03:14 - 2011-03-17 09:27 - 00000000 ___RD () C:\Dokumente und Einstellungen\User\Startmenü\Programme
2014-12-01 10:35 - 2014-10-20 00:37 - 00114904 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-11-28 01:55 - 2012-12-13 00:29 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2770660$
2014-11-28 01:46 - 2011-10-09 21:32 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DivX
2014-11-28 01:45 - 2014-11-05 19:30 - 00001351 _____ () C:\WINDOWS\setupapi.log
2014-11-28 01:45 - 2011-10-09 21:35 - 00000000 ____D () C:\Programme\DivX
2014-11-26 03:45 - 2012-11-21 11:21 - 00000000 ____D () C:\Programme\OpenOffice.org 3
2014-11-26 03:43 - 2011-03-17 09:27 - 00000000 ___RD () C:\Dokumente und Einstellungen\User\Startmenü\Programme\Autostart
2014-11-26 03:11 - 2012-03-09 03:00 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2641690$
2014-11-26 03:11 - 2011-03-17 09:56 - 00000000 ____D () C:\WINDOWS\Connection Wizard
2014-11-26 01:50 - 2012-12-13 00:29 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2779562$
2014-11-25 14:36 - 2014-11-04 20:36 - 00000000 ____D () C:\Programme\Optimizer Pro
2014-11-25 14:24 - 2014-11-05 20:12 - 00000157 _____ () C:\Dokumente und Einstellungen\User\Anwendungsdaten\WB.CFG
2014-11-21 18:12 - 2014-11-07 22:20 - 00000001 _____ () C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\DSI.DAT
Files to move or delete:
====================
C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Temp\Account_delay\account_check.exe
C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Temp\Mark-model\mark-contest.exe
C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Temp\Fcvlyajb\mpjkwkeos.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
==================== End Of Log ============================
[/CODE] Viele Grüß, Katie |
|
13.12.2014, 19:50
| #18 |
| /// the machine /// TB-Ausbilder   | Windows XP: Neue Tabs öffnen sich Hi,
__________________ich übernehme ab hier. Combofix bitte löschen und neu laden. Nochmal laufen lassen und das Log posten.
__________________ |
|
15.12.2014, 16:06
| #19 |
| | Windows XP: Neue Tabs öffnen sich Hallo, vielen Dank dafür! Hier das Combolog: Code:
ATTFilter Combofix Logfile: |
|
15.12.2014, 21:11
| #20 |
| /// the machine /// TB-Ausbilder | Windows XP: Neue Tabs öffnen sich Hinweis für Mitleser: Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen! Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm vom folgenden Download-Spiegel neu herunter: BleepingComputer.comund speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)! Drücke die Windows + R Taste --> Notepad (hinein schreiben) --> OK Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument. Code:
ATTFilter KillAll::
Folder::
c:\dokumente und einstellungen\User\Anwendungsdaten\Epgazl
c:\dokumente und einstellungen\User\Anwendungsdaten\Signal-ball
c:\dokumente und einstellungen\User\Anwendungsdaten\Ifqsuhjm
c:\dokumente und einstellungen\User\Anwendungsdaten\Bicycle_tool
c:\dokumente und einstellungen\User\Anwendungsdaten\Kid-read
c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft Help
c:\dokumente und einstellungen\User\Anwendungsdaten\Doyemgl
c:\dokumente und einstellungen\User\Anwendungsdaten\Access-bottom
c:\dokumente und einstellungen\User\Anwendungsdaten\Channel-come
c:\dokumente und einstellungen\User\Anwendungsdaten\OpenOffice
c:\dokumente und einstellungen\User\Anwendungsdaten\Jndbambsq
c:\dokumente und einstellungen\User\Anwendungsdaten\Cliqz
c:\dokumente und einstellungen\User\Anwendungsdaten\Mrues
c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"kid-anger"=-
"channel-shock"=-
"access-contain"=-
"zxzwkeos"=-
"bicycle-kiss"=-
"markpersuade"=-
Driver::
anonymizer
live_export
playback_order
shut_down
trusted_root_ca
Firefox::
FF - ProfilePath - c:\dokumente und einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\d90tq7ym.default-1413761053703\
FF - user.js: extensions.srchlsrn.hmpg - true
FF - user.js: extensions.srchlsrn.hmpgUrl - hxxp://Lasaoren.com/?f=1&a=lrn_frg01_14_45_ff&cd=2XzuyEtN2Y1L1QzutDtD0F0FtDzz0EtDtBtDzzyCzzyB0FzytN0D0Tzu0StCtDtAzytN1L2XzutAtFyCtFtDtFyEtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StBzzyBzytCyCyDtCtG0Fzz0D0EtGtAtAyD0CtGtDtAtBtAtGtByCtDtByE0AyB0FzztD0E0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0A0DtB0DzztB0E0EtG0DzztByEtGyEzyzyyDtGzyzyyB0AtGyDtAtCtD0F0CtD0CtD0A0B0D2Q&cr=644361098&ir=
FF - user.js: extensions.srchlsrn.dfltSrch - true
FF - user.js: extensions.srchlsrn.srchPrvdr - Lasaoren
FF - user.js: extensions.srchlsrn.dnsErr - true
FF - user.js: extensions.srchlsrn_i.newTab - true
FF - user.js: extensions.srchlsrn.newTabUrl - hxxp://Lasaoren.com/?f=2&a=lrn_frg01_14_45_ff&cd=2XzuyEtN2Y1L1QzutDtD0F0FtDzz0EtDtBtDzzyCzzyB0FzytN0D0Tzu0StCtDtAzytN1L2XzutAtFyCtFtDtFyEtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StBzzyBzytCyCyDtCtG0Fzz0D0EtGtAtAyD0CtGtDtAtBtAtGtByCtDtByE0AyB0FzztD0E0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0A0DtB0DzztB0E0EtG0DzztByEtGyEzyzyyDtGzyzyyB0AtGyDtAtCtD0F0CtD0CtD0A0B0D2Q&cr=644361098&ir=
FF - user.js: extensions.srchlsrn.tlbrSrchUrl - hxxp://Lasaoren.com/?f=3&a=lrn_frg01_14_45_ff&cd=2XzuyEtN2Y1L1QzutDtD0F0FtDzz0EtDtBtDzzyCzzyB0FzytN0D0Tzu0StCtDtAzytN1L2XzutAtFyCtFtDtFyEtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StBzzyBzytCyCyDtCtG0Fzz0D0EtGtAtAyD0CtGtDtAtBtAtGtByCtDtByE0AyB0FzztD0E0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0A0DtB0DzztB0E0EtG0DzztByEtGyEzyzyyDtGzyzyyB0AtGyDtAtCtD0F0CtD0CtD0A0B0D2Q&cr=644361098&ir=&q=
FF - user.js: extensions.srchlsrn.id - 00FF08E0208687F9
FF - user.js: extensions.srchlsrn.instlDay - 16378
FF - user.js: extensions.srchlsrn.vrsn -
FF - user.js: extensions.srchlsrn.vrsni -
FF - user.js: extensions.srchlsrn_i.vrsnTs - 21:45
FF - user.js: extensions.srchlsrn.prtnrId - WSE_Lasaoren
FF - user.js: extensions.srchlsrn.prdct - srchlsrn
FF - user.js: extensions.srchlsrn.aflt - lrn_frg01_14_45_ff
FF - user.js: extensions.srchlsrn_i.smplGrp - none
FF - user.js: extensions.srchlsrn.tlbrId -
FF - user.js: extensions.srchlsrn.instlRef - 142905_b
FF - user.js: extensions.srchlsrn.dfltLng -
FF - user.js: extensions.srchlsrn.appId - {9CE28B1F-CD59-4F6C-B4E8-5B1DA889B0F5}
FF - user.js: extensions.srchlsrn.excTlbr - false
FF - user.js: extensions.srchlsrn.cr - 644361098
FF - user.js: extensions.srchlsrn.cd - 2XzuyEtN2Y1L1QzutDtD0F0FtDzz0EtDtBtDzzyCzzyB0FzytN0D0Tzu0StCtDtAzytN1L2XzutAtFyCtFtDtFyEtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StBzzyBzytCyCyDtCtG0Fzz0D0EtGtAtAyD0CtGtDtAtBtAtGtByCtDtByE0AyB0FzztD0E0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0A0DtB0DzztB0E0EtG0DzztByEtGyEzyzyyDtGzyzyyB0AtGyDtAtCtD0F0CtD0CtD0A0B0D2Q
FF - user.js: extensions.srchlsrn.AL - 4
Wichtig:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
16.12.2014, 12:48
| #21 |
| | Windows XP: Neue Tabs öffnen sich Hier die Logdatei: Code:
ATTFilter Combofix Logfile: |
|
16.12.2014, 21:38
| #22 |
| /// the machine /// TB-Ausbilder | Windows XP: Neue Tabs öffnen sich Das is doch zum Mäuse melken  Hinweis für Mitleser: Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen! Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm vom folgenden Download-Spiegel neu herunter: BleepingComputer.comund speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)! Drücke die Windows + R Taste --> Notepad (hinein schreiben) --> OK Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument. Code:
ATTFilter DeQuarantine::
c:\dokumente und einstellungen\User\Anwendungsdaten\OpenOffice
Quit::
Wichtig:
Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
17.12.2014, 18:03
| #23 |
| | Windows XP: Neue Tabs öffnen sich Hallo, die Datei ist zu groß... deswegen erstaml der erste Teil: Code:
ATTFilter Combofix Logfile: Code:
ATTFilter 13:05:58.0000 0x1ee4 TDSS rootkit removing tool 3.0.0.41 Oct 28 2014 17:58:34
13:06:08.0250 0x1ee4 ============================================================
13:06:08.0250 0x1ee4 Current date / time: 2014/12/17 13:06:08.0250
13:06:08.0250 0x1ee4 SystemInfo:
13:06:08.0250 0x1ee4
13:06:08.0250 0x1ee4 OS Version: 5.1.2600 ServicePack: 3.0
13:06:08.0250 0x1ee4 Product type: Workstation
13:06:08.0250 0x1ee4 ComputerName: KATIE
13:06:08.0250 0x1ee4 UserName: User
13:06:08.0250 0x1ee4 Windows directory: C:\WINDOWS
13:06:08.0250 0x1ee4 System windows directory: C:\WINDOWS
13:06:08.0250 0x1ee4 Processor architecture: Intel x86
13:06:08.0250 0x1ee4 Number of processors: 2
13:06:08.0250 0x1ee4 Page size: 0x1000
13:06:08.0250 0x1ee4 Boot type: Normal boot
13:06:08.0250 0x1ee4 ============================================================
13:06:11.0328 0x1ee4 KLMD registered as C:\WINDOWS\system32\drivers\09342858.sys
13:06:12.0812 0x1ee4 System UUID: {6E843E34-D651-8883-E417-B0B14EF818E0}
13:06:15.0921 0x1ee4 Drive \Device\Harddisk0\DR0 - Size: 0x12A1F16000 ( 74.53 Gb ), SectorSize: 0x200, Cylinders: 0x2861, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000054
13:06:15.0921 0x1ee4 ============================================================
13:06:15.0921 0x1ee4 \Device\Harddisk0\DR0:
13:06:15.0921 0x1ee4 MBR partitions:
13:06:15.0921 0x1ee4 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x8D3D4F1
13:06:15.0921 0x1ee4 ============================================================
13:06:15.0968 0x1ee4 C: <-> \Device\Harddisk0\DR0\Partition1
13:06:15.0968 0x1ee4 ============================================================
13:06:15.0968 0x1ee4 Initialize success
13:06:15.0968 0x1ee4 ============================================================
13:06:25.0984 0x28c8 ============================================================
13:06:25.0984 0x28c8 Scan started
13:06:25.0984 0x28c8 Mode: Manual;
13:06:25.0984 0x28c8 ============================================================
13:06:25.0984 0x28c8 KSN ping started
13:06:26.0218 0x28c8 KSN ping finished: true
13:06:27.0359 0x28c8 ================ Scan system memory ========================
13:06:27.0375 0x28c8 System memory - ok
13:06:27.0375 0x28c8 ================ Scan services =============================
13:06:27.0875 0x28c8 Abiosdsk - ok
13:06:27.0875 0x28c8 abp480n5 - ok
13:06:28.0000 0x28c8 [ AC407F1A62C3A300B4F2B5A9F1D55B2C, 31F5FC61B37E22100B3A52A590295A7E827FFC581FA9960C64B9032452AAECED ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
13:06:28.0093 0x28c8 ACPI - ok
13:06:28.0296 0x28c8 [ 9E1CA3160DAFB159CA14F83B1E317F75, 13B3E897B0E819BF734449416D9EC6EBCAC89538EC69BF48C068593B82D57004 ] ACPIEC C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
13:06:28.0296 0x28c8 ACPIEC - ok
13:06:28.0437 0x28c8 [ BEEE84A79710F705864685B05F1BB172, B3E75F860179EB6C72A902EF9425F57992F73890DAB2C6F9562E8D77ADF4EC5B ] ADIHdAudAddService C:\WINDOWS\system32\drivers\ADIHdAud.sys
13:06:28.0531 0x28c8 ADIHdAudAddService - ok
13:06:28.0765 0x28c8 [ 749F94C424524285DCDA84D695ABC12F, E5AD194AF5B8B4FDB3976D3E3F9EF942DECFEC4EBAA9881A8EF7707BB781E4AD ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
13:06:28.0906 0x28c8 AdobeFlashPlayerUpdateSvc - ok
13:06:28.0921 0x28c8 adpu160m - ok
13:06:28.0984 0x28c8 [ 358063AB6C1C4173B735525CDFA65F94, E2C7E27F8E0B4C6A662313FEEE61AF02D9166F4DC40E709DBB6C73EB489A5CC5 ] AEAudioService C:\WINDOWS\system32\drivers\AEAudio.sys
13:06:29.0031 0x28c8 AEAudioService - ok
13:06:29.0125 0x28c8 [ 8BED39E3C35D6A489438B8141717A557, 1B5796E56B0927360CE0759641B1151828BC0A9E45620D2B2D880491F5CE33D0 ] aec C:\WINDOWS\system32\drivers\aec.sys
13:06:29.0203 0x28c8 aec - ok
13:06:29.0328 0x28c8 [ 1E44BC1E83D8FD2305F8D452DB109CF9, CF5EC07E0B589FA2A4701C6CFD69E893FC3ABF274AD57AE3C13FFE49063B02C8 ] AFD C:\WINDOWS\System32\drivers\afd.sys
13:06:29.0390 0x28c8 AFD - ok
13:06:29.0406 0x28c8 Aha154x - ok
13:06:29.0406 0x28c8 aic78u2 - ok
13:06:29.0406 0x28c8 aic78xx - ok
13:06:29.0453 0x28c8 [ 738D80CC01D7BC7584BE917B7F544394, DCC17AAEF5CDDF52FAAC3CC6904EF421CD595F66318A2370BEE261D5C3A8E340 ] Alerter C:\WINDOWS\system32\alrsvc.dll
13:06:29.0468 0x28c8 Alerter - ok
13:06:29.0515 0x28c8 [ 190CD73D4984F94D823F9444980513E5, 93A32C2495CCA094F768BA707C74DA5C00B8A88A9236DD1A297439A7C2E6C6FA ] ALG C:\WINDOWS\System32\alg.exe
13:06:29.0546 0x28c8 ALG - ok
13:06:29.0546 0x28c8 AliIde - ok
13:06:29.0546 0x28c8 amsint - ok
13:06:29.0640 0x28c8 [ D45960BE52C3C610D361977057F98C54, 9186589B502F46B47672CFB8EBD558D51B0F3CBFE4E0DDBA625A4265236518CE ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
13:06:29.0703 0x28c8 AppMgmt - ok
13:06:29.0718 0x28c8 asc - ok
13:06:29.0718 0x28c8 asc3350p - ok
13:06:29.0734 0x28c8 asc3550 - ok
13:06:29.0921 0x28c8 [ 776ACEFA0CA9DF0FAA51A5FB2F435705, 72DF7ED6B085BC468994F5B3189506FD726A9A17A9C42ACA1E420D787691361D ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
13:06:29.0937 0x28c8 aspnet_state - ok
13:06:29.0953 0x28c8 [ B153AFFAC761E7F5FCFA822B9C4E97BC, 7E60F572A6B3C6219E3C86225AA37243AFFD74337DB7F108B04778042E5CC959 ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
13:06:29.0968 0x28c8 AsyncMac - ok
13:06:30.0031 0x28c8 [ 9F3A2F5AA6875C72BF062C712CFA2674, B4DF1D2C56A593C6B54DE57395E3B51D288F547842893B32B0F59228A0CF70B9 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
13:06:30.0031 0x28c8 atapi - ok
13:06:30.0031 0x28c8 Atdisk - ok
13:06:30.0109 0x28c8 [ 9916C1225104BA14794209CFA8012159, 5D6F05F715C52A16D05CAE15C3DFE77A139A7F27F7AE710EC9A10F9EE05115A1 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
13:06:30.0140 0x28c8 Atmarpc - ok
13:06:30.0218 0x28c8 [ 58ED0D5452DF7BE732193E7999C6B9A4, 254E2ECF592DDA2E3E6CA9F6F3E77926E2265586A7937BA95199ED47BCDE69A3 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
13:06:30.0250 0x28c8 AudioSrv - ok
13:06:30.0265 0x28c8 [ D9F724AA26C010A217C97606B160ED68, 329B5118F2409731D06FDAE85B6ADD64A048292801BCB3546651CEB303111695 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
13:06:30.0265 0x28c8 audstub - ok
13:06:30.0296 0x28c8 [ DA1F27D85E0D1525F6621372E7B685E9, 5A81A46A3BDD19DAFC6C87D277267A5D44F3A1B5302F2CC1111D84B7BAD5610D ] Beep C:\WINDOWS\system32\drivers\Beep.sys
13:06:30.0312 0x28c8 Beep - ok
13:06:30.0578 0x28c8 [ D6F603772A789BB3228F310D650B8BD1, A539025C70FD998A9B8703DE05CAE5E99BC721D8852EA561EBC2DD20CB371D2E ] BITS C:\WINDOWS\system32\qmgr.dll
13:06:30.0796 0x28c8 BITS - ok
13:06:30.0890 0x28c8 [ B71549F23736ADF83A571061C47777FD, A1D0320736EE777030A543DCA086367EB5A5B6F95088B9C22D8E09326C3A39A9 ] Browser C:\WINDOWS\System32\browser.dll
13:06:30.0937 0x28c8 Browser - ok
13:06:31.0515 0x28c8 [ D26B5B9A40A2B2191B35C76D5CBF5D2A, 1557739113DA7AA67FB71E898D9E30224DE8022EFF3C333110900CAC8B9FFC54 ] BTKRNL C:\WINDOWS\system32\DRIVERS\btkrnl.sys
13:06:32.0046 0x28c8 BTKRNL - ok
13:06:32.0359 0x28c8 [ C261E704B5558BA04DD643A0D998327D, 7BD5EFF71BA6D7120A3CCA63187842E85BCB6FCA77190A90362E3E6F9047E58C ] btwdins C:\Programme\ThinkPad\Bluetooth Software\bin\btwdins.exe
13:06:32.0546 0x28c8 btwdins - ok
13:06:32.0562 0x28c8 catchme - ok
13:06:32.0609 0x28c8 [ 90A673FC8E12A79AFBED2576F6A7AAF9, BDE7858A3457DB979FEDD8577FA6321BF72848E4A7BF9F173C78A6A10CBB3EBE ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
13:06:32.0609 0x28c8 cbidf2k - ok
13:06:32.0609 0x28c8 cd20xrnt - ok
13:06:32.0656 0x28c8 [ C1B486A7658353D33A10CC15211A873B, AA4DD9E7AAE5AAB1146B360B17001F975D2F29A1281CF7B13E7136480410F347 ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
13:06:32.0671 0x28c8 Cdaudio - ok
13:06:32.0750 0x28c8 [ C885B02847F5D2FD45A24E219ED93B32, B26B2F8E3A831E2B65EB0C5195B0645CD50E22615CE79C9B0B391CD563B121DB ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
13:06:32.0781 0x28c8 Cdfs - ok
13:06:32.0828 0x28c8 [ 1F4260CC5B42272D71F79E570A27A4FE, B51C2A3ED3C309953D0EA45869C8E464C10F2533DADE9E0286AF674979098D1D ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
13:06:32.0875 0x28c8 Cdrom - ok
13:06:32.0875 0x28c8 Changer - ok
13:06:32.0890 0x28c8 [ 28E3040D1F1CA2008CD6B29DFEBC9A5E, ACB458E8A11AA2143734A5A0281973D95158E6402A6453F98F9832D1E19B01F9 ] CiSvc C:\WINDOWS\system32\cisvc.exe
13:06:32.0906 0x28c8 CiSvc - ok
13:06:32.0937 0x28c8 [ 778A30ED3C134EB7E406AFC407E9997D, 3E6AD115AB2596EB001BC21AEADDBC75F27C42DB90C986B7AD17743CE631234E ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
13:06:32.0953 0x28c8 ClipSrv - ok
13:06:33.0078 0x28c8 [ D87ACAED61E417BBA546CED5E7E36D9C, 14AC6034A5BC0FB2A1AFDAD42BEF4DE641556E54AD30D0C46765660A4BE55462 ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
13:06:33.0109 0x28c8 clr_optimization_v2.0.50727_32 - ok
13:06:33.0218 0x28c8 [ C5A75EB48E2344ABDC162BDA79E16841, 6070A8AAFD38FBC6A68A2B10C20117612354DF21B4492D90CA522BFB6870D726 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
13:06:33.0296 0x28c8 clr_optimization_v4.0.30319_32 - ok
13:06:33.0343 0x28c8 [ 0F6C187D38D98F8DF904589A5F94D411, DB987093446216CEE913AC27503BF7E23E5A62DF169B355730285DAB64F6ED28 ] CmBatt C:\WINDOWS\system32\DRIVERS\CmBatt.sys
13:06:33.0343 0x28c8 CmBatt - ok
13:06:33.0359 0x28c8 CmdIde - ok
13:06:33.0375 0x28c8 [ 6E4C9F21F0FAE8940661144F41B13203, 731202A0DD021FCF9287FEA631212603AAAC23F9E7F76B2882F913B18A971F1C ] Compbatt C:\WINDOWS\system32\DRIVERS\compbatt.sys
13:06:33.0375 0x28c8 Compbatt - ok
13:06:33.0375 0x28c8 COMSysApp - ok
13:06:33.0390 0x28c8 Cpqarray - ok
13:06:33.0453 0x28c8 [ 611F824E5C703A5A899F84C5F1699E4D, 9EFA5612FE58E9974E4CC13D39D91D7B5DEA3ED66BEFBED3AAE6D2800FD8162A ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
13:06:33.0484 0x28c8 CryptSvc - ok
13:06:33.0484 0x28c8 dac2w2k - ok
13:06:33.0500 0x28c8 dac960nt - ok
13:06:33.0750 0x28c8 [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B, ECFBACE3CBF2384948EA1C445BDA3955EB4F44A9874286E6537C67DC1283E5B0 ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
13:06:33.0968 0x28c8 DcomLaunch - ok
13:06:34.0046 0x28c8 [ C29A1C9B75BA38FA37F8C44405DEC360, 7476D8BC4380CDE56764B2034AF3741DA4ED00F315E41C9A02B5EAD04374F241 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
13:06:34.0125 0x28c8 Dhcp - ok
13:06:34.0171 0x28c8 [ 044452051F3E02E7963599FC8F4F3E25, 584BDDB074618BE76454CF90E74829CFF588B5B5FAEB793E2F7AAD26352DD689 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
13:06:34.0187 0x28c8 Disk - ok
13:06:34.0187 0x28c8 dmadmin - ok
13:06:34.0359 0x28c8 [ 0DCFC8395A99FECBB1EF771CEC7FE4EA, 89B0AEE5BE01B9FE4FF2989FF16DB6121721ACDFCE6D9655C0ACD321D8C308BE ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
13:06:34.0484 0x28c8 dmboot - ok
13:06:34.0562 0x28c8 [ 53720AB12B48719D00E327DA470A619A, 800264866A6267C9000A85D00095D57908D059D737E5F28C9C4049B884C46228 ] dmio C:\WINDOWS\system32\drivers\dmio.sys
13:06:34.0625 0x28c8 dmio - ok
13:06:34.0656 0x28c8 [ E9317282A63CA4D188C0DF5E09C6AC5F, D41E002F555FE9015EF620975255F58BB79198CA1FF0E09EC950CB450FF77CF7 ] dmload C:\WINDOWS\system32\drivers\dmload.sys
13:06:34.0656 0x28c8 dmload - ok
13:06:34.0703 0x28c8 [ 25C83FFBBA13B554EB6D59A9B2E2EE78, 9FBD655ED3E9163AE11EC207F283E387EFBA5A23108EC790BAE4846B35E66F16 ] dmserver C:\WINDOWS\System32\dmserver.dll
13:06:34.0718 0x28c8 dmserver - ok
13:06:34.0781 0x28c8 [ 8A208DFCF89792A484E76C40E5F50B45, 4E40E2EB38C6254E7CAA488200E89EE7DEBBBA773890BC6A84313CC68178D54F ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
13:06:34.0812 0x28c8 DMusic - ok
13:06:34.0875 0x28c8 [ 407F3227AC618FD1CA54B335B083DE07, 96B8E734648FE9A4EBA59C096C8779BD1A11A93A6303AFD438A406C8122D36C6 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
13:06:34.0906 0x28c8 Dnscache - ok
13:06:35.0015 0x28c8 [ 676E36C4FF5BCEA1900F44182B9723E6, 740CF18BD40E00FEA26CF0E6340C5D18F7D0B4390055FAEEC258B3AA790C4AE9 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
13:06:35.0093 0x28c8 Dot3svc - ok
13:06:35.0093 0x28c8 dpti2o - ok
13:06:35.0109 0x28c8 [ 8F5FCFF8E8848AFAC920905FBD9D33C8, C8C6FB97AB0871C8C88A2201525A5CF10D5131CB6980D32692ED7A8F58399AD5 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
13:06:35.0109 0x28c8 drmkaud - ok
13:06:35.0156 0x28c8 [ B2C3F71B86E25C3DF78339DDB40A7562, E8B821B0F9DE213C9C5115FDCE3C59F98CB6C4015B3E4A1F96387C81E3EBA56A ] dsNcAdpt C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys
13:06:35.0171 0x28c8 dsNcAdpt - ok
13:06:35.0625 0x28c8 [ DBB553EFC611BFC7FC2E658FFDD3AF33, 44C5ABA4412923DDD7EDA633EF75AF8E6719E991F595FF26AEF0C6A5F002529E ] dsNcService C:\Programme\Juniper Networks\Common Files\dsNcService.exe
13:06:36.0046 0x28c8 dsNcService - ok
13:06:36.0234 0x28c8 [ 06D94F4543671B497A5F4A0AEDD5E36A, E896A3816405FB381C8490AD1F9799C6D7CE6777D3029B1C19785A5552E284C3 ] e1express C:\WINDOWS\system32\DRIVERS\e1e5132.sys
13:06:36.0359 0x28c8 e1express - ok
13:06:36.0406 0x28c8 [ 4E4F2FDDAB0A0736D7671134DCCE91FB, 8E2C57D1A006856C47CBDD5765A9DD317DB205B26DA8BFC70555A506257A1CD9 ] EapHost C:\WINDOWS\System32\eapsvc.dll
13:06:36.0437 0x28c8 EapHost - ok
13:06:36.0468 0x28c8 [ 877C18558D70587AA7823A1A308AC96B, 6B336A62112988D855513F45153F73F8470C41A448E9B7438B4A8EC1813AABF1 ] ERSvc C:\WINDOWS\System32\ersvc.dll
13:06:36.0468 0x28c8 ERSvc - ok
13:06:36.0578 0x28c8 [ A3EDBE9053889FB24AB22492472B39DC, 6F2ED6E04BDE2FCA2A8BF9BD2D1D6923DE6EAECB46F582B6C0BD1CF364D65C9E ] Eventlog C:\WINDOWS\system32\services.exe
13:06:36.0640 0x28c8 Eventlog - ok
13:06:36.0812 0x28c8 [ AF4F6B5739D18CA7972AB53E091CBC74, A399E2CC026730D3A429727AAB48093B9F1E5DD8EB6336519C7F16182FDB3905 ] EventSystem C:\WINDOWS\system32\es.dll
13:06:36.0968 0x28c8 EventSystem - ok
13:06:37.0515 0x28c8 [ 33ABDDB21DE2F4BB1B05A5A3A671BD64, 9A27823BE9C035F99729001AD765EF086DFAD7DB2DD546E7E1D0B9F347513A09 ] EvtEng C:\Programme\Intel\WiFi\bin\EvtEng.exe
13:06:38.0015 0x28c8 EvtEng - ok
13:06:38.0031 0x28c8 ewusbnet - ok
13:06:38.0171 0x28c8 [ 38D332A6D56AF32635675F132548343E, E6909DB836AF679B4F4D62C7396D6C82769CC7ABB8C919C2AABFE934FCE268F6 ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
13:06:38.0250 0x28c8 Fastfat - ok
13:06:38.0375 0x28c8 [ 2DB7D303C36DDD055215052F118E8E75, BE6E7BBE12A7A4EDF1F1C2935350603970C7426BBCA7A1A6644BB8999123AF17 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
13:06:38.0437 0x28c8 FastUserSwitchingCompatibility - ok
13:06:38.0453 0x28c8 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81, 8307A532AB4D05CBBCE206DC2759497708BF5AAA880BD00F0E4F281D8578A1F5 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys
13:06:38.0468 0x28c8 Fdc - ok
13:06:38.0515 0x28c8 [ B0678A548587C5F1967B0D70BACAD6C1, 7E49910212ED87313F926E4800EA8D34809C287A686CA69B82B79C1A6451F88C ] Fips C:\WINDOWS\system32\drivers\Fips.sys
13:06:38.0546 0x28c8 Fips - ok
13:06:38.0593 0x28c8 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0, 69C271AD5BCEBFD8AE5A769BDD7EC51256DA3A8ADAD5D12E5C0D13F4E82D8805 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys
13:06:38.0609 0x28c8 Flpydisk - ok
13:06:38.0687 0x28c8 [ B2CF4B0786F8212CB92ED2B50C6DB6B0, 280F5CF8A90F7BEDE73ADD0DD0F8952088133A7CA9A3D3B7041957E33B36845D ] FltMgr C:\WINDOWS\system32\DRIVERS\fltMgr.sys
13:06:38.0734 0x28c8 FltMgr - ok
13:06:38.0828 0x28c8 [ 8BA7C024070F2B7FDD98ED8A4BA41789, 47585006F86B2C6016EC54250A416794792D1E4024FF229C120BC25B684AF66A ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
13:06:38.0843 0x28c8 FontCache3.0.0.0 - ok
13:06:38.0875 0x28c8 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A, EC635E071201A766845D48973772CBE0958942B4162F3F5F70660D114CC877E0 ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
13:06:38.0875 0x28c8 Fs_Rec - ok
13:06:38.0953 0x28c8 [ 8F1955CE42E1484714B542F341647778, 8EB3F99625F409D3032561E8AB44BEFBFBFBA4EC873C2151C92A5CAAF7F2AA55 ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
13:06:39.0000 0x28c8 Ftdisk - ok
13:06:39.0031 0x28c8 [ 0A02C63C8B144BD8C86B103DEE7C86A2, 7A3235DD3E1995DD72B212FAEB3ECA2A974434DE9BF6D269EA11BA65A80E7E50 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
13:06:39.0062 0x28c8 Gpc - ok
13:06:39.0171 0x28c8 [ 573C7D0A32852B48F3058CFD8026F511, BC384BBA394AFDCDA1A9ABC858C692AA84A1F0A31AF3DDF7F38D120C027927FB ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
13:06:39.0250 0x28c8 HDAudBus - ok
13:06:39.0359 0x28c8 [ CB66BF85BF599BEFD6C6A57C2E20357F, 55D3A0F9279FF316766F42548FCB61C452942B08A37590C4892DF110BE4E53C6 ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
13:06:39.0375 0x28c8 helpsvc - ok
13:06:39.0437 0x28c8 [ B35DA85E60C0103F2E4104532DA2F12B, E13C9F73DF7713554CB614B36123D75014F5121AA1FC9069733E61758751CBE4 ] HidServ C:\WINDOWS\System32\hidserv.dll
13:06:39.0453 0x28c8 HidServ - ok
13:06:39.0468 0x28c8 [ CCF82C5EC8A7326C3066DE870C06DAF1, 93395FA4C26B2E82DC8B7025ED3BCF583885E5D8C5F60CD6EEAA6335D6A126EC ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys
13:06:39.0468 0x28c8 HidUsb - ok
13:06:39.0531 0x28c8 [ ED29F14101523A6E0E808107405D452C, B8FA987637787BEECC2EB06D36293DAC355523392B49A8C5A9491EEE961917E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
13:06:39.0546 0x28c8 hkmsvc - ok
13:06:39.0562 0x28c8 hpn - ok
13:06:39.0625 0x28c8 [ 30CA91E657CEDE2F95359D6EF186F650, 6BBAFBE50E7819695A79586A086A9952B737E174BA2C63C1F180D97EC4AABA4B ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys
13:06:39.0656 0x28c8 HPZid412 - ok
13:06:39.0687 0x28c8 [ EFD31AFA752AA7C7BBB57BCBE2B01C78, AC671CEE9F8DD9FE6C51069212AEB1736BB914361D4185D1E87068D244BF2B7A ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
13:06:39.0703 0x28c8 HPZipr12 - ok
13:06:39.0734 0x28c8 [ 7AC43C38CA8FD7ED0B0A4466F753E06E, B4D44B366170D247E0145B9435CC678BEE2A2A42CFF7B485E077B3B582557B5A ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys
13:06:39.0750 0x28c8 HPZius12 - ok
13:06:39.0890 0x28c8 [ 702A7E1B3C9263EFBD6AEDE3B6919761, CD60A7A657596890775FA6583800A57BF8435B8F4964C65630835291F7EC38F1 ] HSFHWAZL C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
13:06:40.0046 0x28c8 HSFHWAZL - ok
13:06:40.0671 0x28c8 [ 8D02CB68D53AA36189FAF86FED438884, 99F66C299CEAA2967985CDEA0956C186AD86F5AF52649023D72D6C47C509FCA2 ] HSF_DPV C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
13:06:41.0218 0x28c8 HSF_DPV - ok
13:06:41.0406 0x28c8 [ F80A415EF82CD06FFAF0D971528EAD38, 524D9E9201572929522F6805011783711B7C0F76308B924C89CF75F4B7A1FDF3 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
13:06:41.0562 0x28c8 HTTP - ok
13:06:41.0609 0x28c8 [ 9E4ADB854CEBCFB81A4B36718FEECD16, 677AB64460775686F8366D6BF35D420A2486C3F07338A00A7C2788A5142B9F08 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
13:06:41.0609 0x28c8 HTTPFilter - ok
13:06:41.0625 0x28c8 hwdatacard - ok
13:06:41.0625 0x28c8 hwusbdev - ok
13:06:41.0640 0x28c8 i2omgmt - ok
13:06:41.0640 0x28c8 i2omp - ok
13:06:41.0703 0x28c8 [ E283B97CFBEB86C1D86BAED5F7846A92, 7664F791D08C80DF1E52B34BE69F073AA645610C4BD975F498254807602374AB ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
13:06:41.0734 0x28c8 i8042prt - ok
13:06:45.0125 0x28c8 [ 48846B31BE5A4FA662CCFDE7A1BA86B9, BC653F3ADAD70E766484986F196D4045D2CC6D92E5D827907E734254EE489A33 ] ialm C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
13:06:48.0515 0x28c8 ialm - ok
13:06:48.0625 0x28c8 [ 293131C1DA5F53CB05F75D637739D79C, F5F1A03FB012101FA143A288BCBC048A652A285F7DF533D1D08279E3A4D24326 ] IBMPMDRV C:\WINDOWS\system32\DRIVERS\ibmpmdrv.sys
13:06:48.0625 0x28c8 IBMPMDRV - ok
13:06:48.0671 0x28c8 [ 91FA023C5203503776BCCC9CF96A0C59, A47C788A26E4D2A282DE2EC8A75E1544CAB17A2C5F4CF867026D3B95B3651D1D ] IBMPMSVC C:\WINDOWS\system32\ibmpmsvc.exe
13:06:48.0703 0x28c8 IBMPMSVC - ok
13:06:49.0046 0x28c8 [ C01AC32DC5C03076CFB852CB5DA5229C, A4D7749220B5BC965D96A267F1E02FE8284A230BA249109207BD4B9EA8DFAC96 ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
13:06:49.0328 0x28c8 idsvc - ok
13:06:49.0375 0x28c8 [ 083A052659F5310DD8B6A6CB05EDCF8E, 48D39B03FFB6FAA1529B774443BA12618AE3982D9F65A7B9D18F2269F78B31F4 ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
13:06:49.0406 0x28c8 Imapi - ok
13:06:49.0531 0x28c8 [ D4B413AA210C21E46AEDD2BA5B68D38E, 2309622867AA8FC832A729FA78F48742D4BD6CA0DAFBFB9DDB0772D671E1ED75 ] ImapiService C:\WINDOWS\system32\imapi.exe
13:06:49.0609 0x28c8 ImapiService - ok
13:06:49.0625 0x28c8 ini910u - ok
13:06:49.0625 0x28c8 IntelIde - ok
13:06:49.0671 0x28c8 [ 4C7D2750158ED6E7AD642D97BFFAE351, C05E4799752F090DCB632F07F62ADE38D31534621064D269AD535CA0BDFED448 ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
13:06:49.0703 0x28c8 intelppm - ok
13:06:49.0734 0x28c8 [ 3BB22519A194418D5FEC05D800A19AD0, F6662F440950596DC1382DD1DB5D7891CCEA30A6062BEA942C18445B5F0D8B16 ] Ip6Fw C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
13:06:49.0750 0x28c8 Ip6Fw - ok
13:06:49.0781 0x28c8 [ 731F22BA402EE4B62748ADAF6363C182, 5C3BEBD008A5BE4DC2F92076FF41A10DDC01E10EC7E6552213CFA11970811848 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
13:06:49.0796 0x28c8 IpFilterDriver - ok
13:06:49.0812 0x28c8 [ B87AB476DCF76E72010632B5550955F5, E6E74D3A86A7917A8BAED44F8E97CCD2EB171E4E4B27E9907F60D1523FAF319A ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
13:06:49.0828 0x28c8 IpInIp - ok
13:06:49.0921 0x28c8 [ CC748EA12C6EFFDE940EE98098BF96BB, AF523E21C25D9A1715EFEA573E4F52AF5D4FC9F28A2D613F5DB629C186C439E0 ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
13:06:50.0000 0x28c8 IpNat - ok
13:06:50.0093 0x28c8 [ 23C74D75E36E7158768DD63D92789A91, 394D296F38E7D8EFD91A6EEC301D9CE6AF910E35EB9819F1A9E3363863AEDFDC ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
13:06:50.0125 0x28c8 IPSec - ok
13:06:50.0234 0x28c8 [ ACA5E7B54409F9CB5EED97ED0C81120E, 1E22F442EA77596F58D133F1A5887CDC4F3325DD0836D24A665E1D31287ABFF7 ] irda C:\WINDOWS\system32\DRIVERS\irda.sys
13:06:50.0281 0x28c8 irda - ok
13:06:50.0328 0x28c8 [ C93C9FF7B04D772627A3646D89F7BF89, 805FA48E7A46D4F10240BF880A2468F53DEA36E83004399228AB70DB7D20544A ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
13:06:50.0328 0x28c8 IRENUM - ok
13:06:50.0359 0x28c8 [ 2EFE1DB1EC58A26B0C14BFDA122E246F, E2C67BE65337D1102777F4180D366BE54EBC8EAA35A1FA8FC10DD18C14963371 ] Irmon C:\WINDOWS\System32\irmon.dll
13:06:50.0390 0x28c8 Irmon - ok
13:06:50.0437 0x28c8 [ 6DFB88F64135C525433E87648BDA30DE, 8233EEFBEF36AAA152F2C55D23D7118F0DE40C9C22EB5D9793405A4770889540 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
13:06:50.0453 0x28c8 isapnp - ok
13:06:50.0500 0x28c8 [ 1704D8C4C8807B889E43C649B478A452, E854C90CD301F42BE2520CEDAD35E49DF2D43606CF4EEED861B74882118D04D1 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
13:06:50.0515 0x28c8 Kbdclass - ok
13:06:50.0546 0x28c8 [ B6D6C117D771C98130497265F26D1882, E79CC4EA5C088F988BA61F80764F9CAD9B78BC56A7E17DD54622C75483BC5DF4 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
13:06:50.0562 0x28c8 kbdhid - ok
13:06:50.0671 0x28c8 [ 692BCF44383D056AED41B045A323D378, 1A99DEE83FFAF64E73067FC049C0A4CE07D94E4AE31EFA17B38CEFA9E41D67DC ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
13:06:50.0687 0x28c8 kmixer - ok
13:06:50.0765 0x28c8 [ B467646C54CC746128904E1654C750C1, 3BD71BE3663EA23463D236D8A2A2E42DFA10C502BDB4B6E131FAF0FBA748219E ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
13:06:50.0796 0x28c8 KSecDD - ok
13:06:50.0890 0x28c8 [ 2BBDCB79900990F0716DFCB714E72DE7, 6283789201164A9254632D9A3C8A54FE697717D5F8D5A37804D924DC2B70C8E3 ] LanmanServer C:\WINDOWS\System32\srvsvc.dll
13:06:50.0937 0x28c8 LanmanServer - ok
13:06:51.0046 0x28c8 [ 1869B14B06B44B44AF70548E1EA3303F, 4D63B4DAF580C86F86837C7D1753E2105B4C52E26D4CA0CAAFE83755EFF7AFBE ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
13:06:51.0125 0x28c8 lanmanworkstation - ok
13:06:51.0125 0x28c8 lbrtfdc - ok
13:06:51.0171 0x28c8 [ 636714B7D43C8D0C80449123FD266920, F06F6C7DC49B26EFCAC3570C67BA9BD934F62C6F382DA4DD2AB302C7B970F414 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
13:06:51.0171 0x28c8 LmHosts - ok
13:06:51.0203 0x28c8 [ A027DE1E6C11BD2DAF61F6F276B2299F, E2B7A9EDE85DB440FE6ECBD87976B00F01A5BB5DB8D19A38AE8AE66A9962128E ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
13:06:51.0203 0x28c8 mdmxsdk - ok
13:06:51.0250 0x28c8 [ B7550A7107281D170CE85524B1488C98, A3854B16A65436BEF6BEDE918B43B3BE8F00D303660DB5831DD376271DC43239 ] Messenger C:\WINDOWS\System32\msgsvc.dll
13:06:51.0265 0x28c8 Messenger - ok
13:06:51.0312 0x28c8 [ 4AE068242760A1FB6E1A44BF4E16AFA6, 1FB771162B96AAF787AC24867B818DF8511F0780BB094FA9A38C11D8DBFE68BC ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
13:06:51.0312 0x28c8 mnmdd - ok
13:06:51.0328 0x28c8 [ C2F1D365FD96791B037EE504868065D3, 87BD87E08FD00D115524B049F1A3A719AB86557D68968E7090CD0F271F985CAF ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
13:06:51.0343 0x28c8 mnmsrvc - ok
13:06:51.0593 0x28c8 [ 862F0F2F0B4867C3A85C3AC27BBC631C, 16BDB8B82008E704B80F1C1D768883185034A27FA71880B2D766426E32C9DAD7 ] Mobile Broadband HL Service C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MobileBrServ\mbbservice.exe
13:06:51.0734 0x28c8 Mobile Broadband HL Service - ok
13:06:51.0765 0x28c8 [ 6FB74EBD4EC57A6F1781DE3852CC3362, 0454509D9A31E0202C08AE17294E2682F227D177A3C73B303E4C8332757AFCA1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
13:06:51.0781 0x28c8 Modem - ok
13:06:51.0843 0x28c8 [ B24CE8005DEAB254C0251E15CB71D802, 6804A8ABDAD5EC846E7F8077D1EE9BA45D6226ACFF42C70BE3DE7C8980EF9EC4 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
13:06:51.0859 0x28c8 Mouclass - ok
13:06:51.0890 0x28c8 [ 66A6F73C74E1791464160A7065CE711A, 3C570FA1E8EF976B83759220FE95BAC9D7D48D607F91B113EDE4790D34ACBD46 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
13:06:51.0890 0x28c8 mouhid - ok
13:06:51.0953 0x28c8 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD, 2A5E15ED2C24C6C65EF2F7E1FD93374774076C9D8D451E4422561F4D269C012F ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
13:06:51.0968 0x28c8 MountMgr - ok
13:06:52.0078 0x28c8 [ B4E9C7383A705628AD491CF0F87D901F, 5C0CD7133D4F5B1E0466CDB2A2210ECA57206A8BC41F37BC6324120AE5501C70 ] MozillaMaintenance C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
13:06:52.0140 0x28c8 MozillaMaintenance - ok
13:06:52.0140 0x28c8 mraid35x - ok
13:06:52.0250 0x28c8 [ 11D42BB6206F33FBB3BA0288D3EF81BD, 76ABCFB62C5AC549F58C231F72A99882CDEB74928104B77FE52554765C2B1A22 ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
13:06:52.0359 0x28c8 MRxDAV - ok
13:06:52.0656 0x28c8 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0, DB9B186F7076D7B94F45041AF7B77C1AD2CAB504D683B459C6CB1C22840ED170 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
13:06:52.0906 0x28c8 MRxSmb - ok
13:06:52.0953 0x28c8 [ 35A031AF38C55F92D28AA03EE9F12CC9, 97245D204C886EE8DCCC2DEAC80A0E358A7E0C1982F77389DA50DCF091FC9DDC ] MSDTC C:\WINDOWS\system32\msdtc.exe
13:06:52.0953 0x28c8 MSDTC - ok
13:06:53.0000 0x28c8 [ C941EA2454BA8350021D774DAF0F1027, C940E978C7B66A713A0FDAB54B5F995DF59D089AFCD96221DD3222948CD49BBD ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
13:06:53.0015 0x28c8 Msfs - ok
13:06:53.0015 0x28c8 MSIServer - ok
13:06:53.0062 0x28c8 [ D1575E71568F4D9E14CA56B7B0453BF1, 4ABE0E24786C0D39FA2B885447E56204CA6942FB175E534DCE675D7BCF0B176A ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
13:06:53.0109 0x28c8 MSKSSRV - ok
13:06:53.0125 0x28c8 [ 325BB26842FC7CCC1FCCE2C457317F3E, C07BE560513B1FB91D756494F0BA4AEEB2E1998DE0E1C21EE83DB1183B0CEE91 ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
13:06:53.0125 0x28c8 MSPCLOCK - ok
13:06:53.0140 0x28c8 [ BAD59648BA099DA4A17680B39730CB3D, 9AD4C7C94C186C8815D0BC75DCAFB962158DA6935A244BA243EDDDEB33F9816C ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
13:06:53.0140 0x28c8 MSPQM - ok
13:06:53.0187 0x28c8 [ AF5F4F3F14A8EA2C26DE30F7A1E17136, AC93A1E4ABB0D038B772E429015567E44CC2EDB66C54DBE23A5F98176FAC1520 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
13:06:53.0187 0x28c8 mssmbios - ok
13:06:53.0281 0x28c8 [ DE6A75F5C270E756C5508D94B6CF68F5, FCC972DDC36C2C44D836913F10004C2C33B11C54DEFFF0C63E0FDF901D2F9261 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
13:06:53.0312 0x28c8 Mup - ok
13:06:53.0484 0x28c8 [ 46BB15AE2AC7D025D6D2567B876817BD, 102A101B96D1078C98FA0F871C801A9A8538E20E5686AB0C7680B2F6C92B3165 ] napagent C:\WINDOWS\System32\qagentrt.dll
13:06:53.0593 0x28c8 napagent - ok
13:06:53.0687 0x28c8 [ 1DF7F42665C94B825322FAE71721130D, FE0DCB728471465B39A42A7511F4133021FBA5DF88F88BCB5FE2FF34CFD713F9 ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
13:06:53.0765 0x28c8 NDIS - ok
13:06:53.0812 0x28c8 [ 0109C4F3850DFBAB279542515386AE22, 4F6DB1E499AC853FD36FD603FBB6D3AC9BDCEB298C7FE1FB59A9236CB46729B2 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
13:06:53.0828 0x28c8 NdisTapi - ok
13:06:53.0875 0x28c8 [ F927A4434C5028758A842943EF1A3849, B1AA3AF150C05307461774925901789456B0CCCD03A5E71ADA4AB58455962BEE ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
13:06:53.0890 0x28c8 Ndisuio - ok
13:06:53.0968 0x28c8 [ EDC1531A49C80614B2CFDA43CA8659AB, 494042F790F33721328B4451E79842E21919681CC421A4F9633EC4D383E06097 ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
13:06:54.0015 0x28c8 NdisWan - ok
13:06:54.0078 0x28c8 [ 2F597BB467E05B1FE3830EABD821B8E0, 141497F5A49D47CCE3C9289644F4BD838DCB238F6D8E847FC006652E21FE02AC ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
13:06:54.0093 0x28c8 NDProxy - ok
13:06:54.0125 0x28c8 [ 5D81CF9A2F1A3A756B66CF684911CDF0, 7989C36607CAEA17AFA2C1C9904145CA0714A54B9F712D9D4C1AB140D0B2CC0C ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
13:06:54.0156 0x28c8 NetBIOS - ok
13:06:54.0250 0x28c8 [ 74B2B2F5BEA5E9A3DC021D685551BD3D, 7932B71F98B4122BE88F576BF6D745A757AE378A48924B7F4358837B75640A82 ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
13:06:54.0343 0x28c8 NetBT - ok
13:06:54.0453 0x28c8 [ 8ACE4251BFFD09CE75679FE940E996CC, 81969521B5EAEA09ECA63058BE9697BB69AF2596339CA9DF0CFEDC031DCFDC7E ] NetDDE C:\WINDOWS\system32\netdde.exe
13:06:54.0500 0x28c8 NetDDE - ok
13:06:54.0546 0x28c8 [ 8ACE4251BFFD09CE75679FE940E996CC, 81969521B5EAEA09ECA63058BE9697BB69AF2596339CA9DF0CFEDC031DCFDC7E ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
13:06:54.0546 0x28c8 NetDDEdsdm - ok
13:06:54.0578 0x28c8 [ AFB8261B56CBA0D86AEB6DF682AF9785, 104D96F1F19DD4CE492064ACC9634406A019EAE20B42D03198E400E661897127 ] Netlogon C:\WINDOWS\system32\lsass.exe
13:06:54.0593 0x28c8 Netlogon - ok
13:06:54.0750 0x28c8 [ E6D88F1F6745BF00B57E7855A2AB696C, 12A5EDD853600FF5EBF91E127077745AE1E61E66DBC1D4D4306570F171AF4A39 ] Netman C:\WINDOWS\System32\netman.dll
13:06:54.0859 0x28c8 Netman - ok
13:06:54.0937 0x28c8 [ D22CD77D4F0D63D1169BB35911BFF12D, 85B1FDFA02E1B8EA4FCB9B7EEB687C5C448697FC7EC9D178C5A2F64D2C9CFEE8 ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
13:06:55.0015 0x28c8 NetTcpPortSharing - ok
13:06:58.0796 0x28c8 [ 72062B53186E4A3F5FCBC41EBB62B905, F8C34C6EF26E67423742C50F39FB4888601F3BFC7DD4FD0EEC59A37A21F3D77F ] NETwLx32 C:\WINDOWS\system32\DRIVERS\NETwLx32.sys
13:07:02.0468 0x28c8 NETwLx32 - ok
13:07:02.0687 0x28c8 [ F1B67B6B0751AE0E6E964B02821206A3, 3D5A7593ABDEE2047C5738671C85DC8B95A4ECF58D5D7B04EEE13A689839A540 ] Nla C:\WINDOWS\System32\mswsock.dll
13:07:02.0812 0x28c8 Nla - ok
13:07:02.0859 0x28c8 [ 3182D64AE053D6FB034F44B6DEF8034A, 4ADFC76965BA2A5F488E71789A4E4EA702A74AF42725F72130D1CA919406CF19 ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
13:07:02.0875 0x28c8 Npfs - ok
13:07:02.0906 0x28c8 [ 2ADC0CA9945C65284B3D19BC18765974, A8E2B848E85A3B38350F4134DE9CA6749854B988F9A0087C60D97E19D474CBF3 ] NSCIRDA C:\WINDOWS\system32\DRIVERS\nscirda.sys
13:07:02.0921 0x28c8 NSCIRDA - ok
13:07:03.0234 0x28c8 [ 78A08DD6A8D65E697C18E1DB01C5CDCA, E0E6F3ED05068E32F1D5C2D2B38CDEF4536B8656DB6756C66CF6B40B60C8F3DA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
13:07:03.0546 0x28c8 Ntfs - ok
13:07:03.0593 0x28c8 [ AFB8261B56CBA0D86AEB6DF682AF9785, 104D96F1F19DD4CE492064ACC9634406A019EAE20B42D03198E400E661897127 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
13:07:03.0593 0x28c8 NtLmSsp - ok
13:07:03.0796 0x28c8 [ 56AF4064996FA5BAC9C449B1514B4770, 154602EFEC22728503D4ABA025DF711B0F2CFC983F5E3BF25F2A4BCD1AE250EC ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
13:07:03.0968 0x28c8 NtmsSvc - ok
13:07:03.0984 0x28c8 [ 73C1E1F395918BC2C6DD67AF7591A3AD, B21133A75253EC15E2DFF66D3B480AB1A7E1A2360476C810E7AA55D0F0EB08D4 ] Null C:\WINDOWS\system32\drivers\Null.sys
13:07:04.0000 0x28c8 Null - ok
13:07:04.0031 0x28c8 [ B305F3FAD35083837EF46A0BBCE2FC57, 9D0E0E666D652D0FC9EAB97280A5D67AAF61D6B21929DF7CF8ED72A367720464 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
13:07:04.0046 0x28c8 NwlnkFlt - ok
13:07:04.0062 0x28c8 [ C99B3415198D1AAB7227F2C88FD664B9, DD8DA4B5E804F134AB9233859544C025062902DFC3E8FB8A09A67337A4E73F55 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
13:07:04.0078 0x28c8 NwlnkFwd - ok
13:07:04.0468 0x28c8 [ 785F487A64950F3CB8E9F16253BA3B7B, 02445344BD214370A6D48B1CA04921D8EFCB13E676B5648266DD0E076C0822B6 ] odserv C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
13:07:05.0000 0x28c8 odserv - ok
13:07:05.0109 0x28c8 [ 5A432A042DAE460ABE7199B758E8606C, 6E5D1F477D290905BE27CEBF9572BAC6B05FFEF2FAD901D3C8E11F665F8B9A71 ] ose C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
13:07:05.0187 0x28c8 ose - ok
13:07:05.0250 0x28c8 [ F84785660305B9B903FB3BCA8BA29837, BDBDE61076800415D98759077E9E039C80B55DBE68E31F8BF44A909C6C3D3276 ] Parport C:\WINDOWS\system32\drivers\Parport.sys
13:07:05.0296 0x28c8 Parport - ok
13:07:05.0312 0x28c8 [ BEB3BA25197665D82EC7065B724171C6, 7E71C13BA30CD95CEE8A9CC85E6F48A01F30EDEAADEE69D80AE828BF97E5A5CA ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
13:07:05.0328 0x28c8 PartMgr - ok
13:07:05.0359 0x28c8 [ C2BF987829099A3EAA2CA6A0A90ECB4F, 1DF21EA8E43875CFEECD869407429F82FB449707CFB845718499468E699BAAAA ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
13:07:05.0359 0x28c8 ParVdm - ok
13:07:05.0421 0x28c8 [ 387E8DEDC343AA2D1EFBC30580273ACD, 5F3E642BDB759777E570ED5B22AC7E93CDCD362708F281657AD7BAB44EDEC802 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
13:07:05.0453 0x28c8 PCI - ok
13:07:05.0453 0x28c8 PCIDump - ok
13:07:05.0484 0x28c8 [ 59BA86D9A61CBCF4DF8E598C331F5B82, 822D11C5CE77BFD7B2F25350CCBF92B0B9388EEA6D86ED220B768C720976D839 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
13:07:05.0500 0x28c8 PCIIde - ok
13:07:05.0578 0x28c8 [ A2A966B77D61847D61A3051DF87C8C97, 6CED7CA26DC62B0AAFC83A2E07336DAD25954491201BB8E06103971F3F0B8B51 ] Pcmcia C:\WINDOWS\system32\DRIVERS\pcmcia.sys
13:07:05.0625 0x28c8 Pcmcia - ok
13:07:05.0625 0x28c8 PDCOMP - ok
13:07:05.0656 0x28c8 PDFRAME - ok
13:07:05.0656 0x28c8 PDRELI - ok
13:07:05.0671 0x28c8 PDRFRAME - ok
13:07:05.0671 0x28c8 perc2 - ok
13:07:05.0671 0x28c8 perc2hib - ok
13:07:05.0781 0x28c8 [ A3EDBE9053889FB24AB22492472B39DC, 6F2ED6E04BDE2FCA2A8BF9BD2D1D6923DE6EAECB46F582B6C0BD1CF364D65C9E ] PlugPlay C:\WINDOWS\system32\services.exe
13:07:05.0796 0x28c8 PlugPlay - ok
13:07:05.0859 0x28c8 [ A38B3CE68E7F126190CDE4AA3FDF050F, 12D8F8FC8229BE7B76EF6B62670DDA36187BB3A69FB58FFAFAD75460B15CC76E ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.exe
13:07:05.0906 0x28c8 Pml Driver HPZ12 - ok
13:07:05.0921 0x28c8 [ AFB8261B56CBA0D86AEB6DF682AF9785, 104D96F1F19DD4CE492064ACC9634406A019EAE20B42D03198E400E661897127 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
13:07:05.0921 0x28c8 PolicyAgent - ok
13:07:05.0953 0x28c8 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99, C5F0C8C66A3AF7E7BB04CEDE4AC5306F8387AB384A2107DC5BE413AAE968EFF1 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
13:07:05.0984 0x28c8 PptpMiniport - ok
13:07:06.0078 0x28c8 processor - ok
13:07:06.0093 0x28c8 [ AFB8261B56CBA0D86AEB6DF682AF9785, 104D96F1F19DD4CE492064ACC9634406A019EAE20B42D03198E400E661897127 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
13:07:06.0093 0x28c8 ProtectedStorage - ok
13:07:06.0140 0x28c8 [ 09298EC810B07E5D582CB3A3F9255424, 35473A1BE25AC289474090EB0806AC6B3035DC33D1F3DF97A14BF1E361AC6AC3 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
13:07:06.0187 0x28c8 PSched - ok
13:07:06.0203 0x28c8 [ 80D317BD1C3DBC5D4FE7B1678C60CADD, DA76804B55D0CAB3DDD01EFC06673764AE4860693375C658B6063FB14AF7F12C ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
13:07:06.0218 0x28c8 Ptilink - ok
13:07:06.0218 0x28c8 ql1080 - ok
13:07:06.0218 0x28c8 Ql10wnt - ok
13:07:06.0218 0x28c8 ql12160 - ok
13:07:06.0234 0x28c8 ql1240 - ok
13:07:06.0234 0x28c8 ql1280 - ok
13:07:06.0265 0x28c8 [ FE0D99D6F31E4FAD8159F690D68DED9C, 998685622ABE631984B7E4DBF91AB3594B1F574378D75EB9F6265F4650470692 ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
13:07:06.0265 0x28c8 RasAcd - ok
13:07:06.0343 0x28c8 [ F5BA6CACCDB66C8F048E867563203246, AFEAD8FC02313F7EBC8F9F39E7ED2868852B480BE3902FA7BD0AFD81492AB243 ] RasAuto C:\WINDOWS\System32\rasauto.dll
13:07:06.0375 0x28c8 RasAuto - ok
13:07:06.0390 0x28c8 [ 0207D26DDF796A193CCD9F83047BB5FC, 13613036BCB869FBD7229A0FE25D324710308385D8C35E5D990A40E52BE040DF ] Rasirda C:\WINDOWS\system32\DRIVERS\rasirda.sys
13:07:06.0406 0x28c8 Rasirda - ok
13:07:06.0453 0x28c8 [ 11B4A627BC9614B885C4969BFA5FF8A6, EAE0A412A2B0F68919C32A96B3A08CC1A06585E4998819F5C9051745F63FF5AD ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
13:07:06.0484 0x28c8 Rasl2tp - ok
13:07:06.0609 0x28c8 [ F9A7B66EA345726EDB5862A46B1ECCD5, 5D35429D394D36A1692A7E219BA1A85CD8096FEAE0F90BFE036A63118FEDBF57 ] RasMan C:\WINDOWS\System32\rasmans.dll
13:07:06.0718 0x28c8 RasMan - ok
13:07:06.0781 0x28c8 [ 5BC962F2654137C9909C3D4603587DEE, A5CE5653D0105240F5E86CFAAB89E7917D42D939E2F27A5A7D6979289CA651B8 ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
13:07:06.0796 0x28c8 RasPppoe - ok
13:07:06.0812 0x28c8 [ FDBB1D60066FCFBB7452FD8F9829B242, 10A2DACF944BD000032EBA8C095CB3D879CC55B28C377ADF6E52E508E47444DB ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
13:07:06.0828 0x28c8 Raspti - ok
13:07:06.0953 0x28c8 [ 7AD224AD1A1437FE28D89CF22B17780A, 6645235CA27D671954E3557FA37082881C3D7D47492C71264CD8CB8D108EC801 ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
13:07:07.0046 0x28c8 Rdbss - ok
13:07:07.0062 0x28c8 [ 4912D5B403614CE99C28420F75353332, 975341ECD660209987B5E5171B8315E032439E408CBE8A5986E67AF767F373BB ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
13:07:07.0062 0x28c8 RDPCDD - ok
13:07:07.0203 0x28c8 [ 15CABD0F7C00C47C70124907916AF3F1, 66B5C978B7FB6359AD8BAC9F568FE9D469E358FEAB07B1F129BA9E85F1DF723E ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
13:07:07.0312 0x28c8 rdpdr - ok
13:07:07.0421 0x28c8 [ 43AF5212BD8FB5BA6EED9754358BD8F7, AF330F61CECA4AFA359CEABC5EB3227E6B56A9A2DCE50701381D665122D7356D ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
13:07:07.0484 0x28c8 RDPWD - ok
13:07:07.0593 0x28c8 [ 263AF18AF0F3DB99F574C95F284CCEC9, 2BFA9952E97EFEB386FC56EC2C125080CD12DAC078DBE43C395CB4D9F22165D3 ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
13:07:07.0656 0x28c8 RDSessMgr - ok
13:07:07.0718 0x28c8 [ ED761D453856F795A7FE056E42C36365, EF026585B33415D8FCE94A9F27D7A4396C7C35C88E06A4CF0FEA702401E8597A ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
13:07:07.0750 0x28c8 redbook - ok
13:07:08.0046 0x28c8 [ 03D281098CE722210C48E1E8CAFEA260, 371BFCAF8AC64F321C853DFDC172998F8649B6EBBE515AFBB67AB8D1AE27740C ] RegSrvc C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe
13:07:08.0312 0x28c8 RegSrvc - ok
13:07:08.0390 0x28c8 [ 0E97EC96D6942CEEC2D188CC2EB69A01, D4253B4420BEF19451A55AB91E4834482181A31A31134F6E2AFE05C8E20C81A5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
13:07:08.0406 0x28c8 RemoteAccess - ok
13:07:08.0484 0x28c8 [ E4CD1F3D84E1C2CA0B8CF7501E201593, 649CC0B04F94D407EB6B4C7FDE2C6E4D2B1531307BC67C5775E44D66EF2E4F8A ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
13:07:08.0531 0x28c8 RemoteRegistry - ok
13:07:08.0562 0x28c8 [ 2A02E21867497DF20B8FC95631395169, D89E2D17ED4E1C727847C0E92D2DF68AEB70BF0B956BD2FE024ED70A961759D2 ] RpcLocator C:\WINDOWS\system32\locator.exe
13:07:08.0593 0x28c8 RpcLocator - ok
13:07:08.0828 0x28c8 [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B, ECFBACE3CBF2384948EA1C445BDA3955EB4F44A9874286E6537C67DC1283E5B0 ] RpcSs C:\WINDOWS\System32\rpcss.dll
13:07:08.0843 0x28c8 RpcSs - ok
13:07:08.0921 0x28c8 [ 4BDD71B4B521521499DFD14735C4F398, 7B1498D3C67E56D05B58B7DA319ECB0117C37963AABB0E59B42831C087469DA1 ] RSVP C:\WINDOWS\system32\rsvp.exe
13:07:08.0984 0x28c8 RSVP - ok
13:07:09.0546 0x28c8 [ 91843B70A7867D68FD59E1A60BA9D2B8, 93DD29E5F83AE076E33FFDA30D62EEDDF51CEA72911E385719C43BBAED25DE72 ] S24EventMonitor C:\Programme\Intel\WiFi\bin\S24EvMon.exe
13:07:10.0062 0x28c8 S24EventMonitor - ok
13:07:10.0093 0x28c8 [ 27FC71DA659305E260ACBDA15A318399, 1EBE27909E282454F49D22B4540A2DF8B774466453E928DB98330B9E83206A10 ] s24trans C:\WINDOWS\system32\DRIVERS\s24trans.sys
13:07:10.0109 0x28c8 s24trans - ok
13:07:10.0125 0x28c8 [ AFB8261B56CBA0D86AEB6DF682AF9785, 104D96F1F19DD4CE492064ACC9634406A019EAE20B42D03198E400E661897127 ] SamSs C:\WINDOWS\system32\lsass.exe
13:07:10.0125 0x28c8 SamSs - ok
13:07:10.0203 0x28c8 [ DCEC079FAD95D36C8DD5CB6D779DFE32, F8546552D939A225853A0CE4913701A93738DF02C999D16E141E9A828814BBC6 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
13:07:10.0250 0x28c8 SCardSvr - ok
13:07:10.0390 0x28c8 [ A050194A44D7FA8D7186ED2F4E8367AE, BCDF56D5A2F9E202DC67E7FE4BCC617BCC0BDFF2D221A621020068B17B2855BB ] Schedule C:\WINDOWS\system32\schedsvc.dll
13:07:10.0500 0x28c8 Schedule - ok
13:07:10.0546 0x28c8 [ 90A3935D05B494A5A39D37E71F09A677, F72733A69BC6E1A2BB91D7632FF3463C12563F60FDCC00A2CDD67FF20D479952 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
13:07:10.0562 0x28c8 Secdrv - ok
13:07:10.0593 0x28c8 [ BEE4CFD1D48C23B44CF4B974B0B79B2B, DF3B02D713F8A4602BE75F004074D5DF79AFF2D58FF37110B2A6AC29F680758B ] seclogon C:\WINDOWS\System32\seclogon.dll
13:07:10.0609 0x28c8 seclogon - ok
13:07:10.0640 0x28c8 [ 2AAC9B6ED9EDDFFB721D6452E34D67E3, 95D83F054A6610328D56E56CD948A6618C590231853E56FC20E7557DB61384A4 ] SENS C:\WINDOWS\system32\sens.dll
13:07:10.0671 0x28c8 SENS - ok
13:07:10.0718 0x28c8 [ CF24EB4F0412C82BCD1F4F35A025E31D, B74CB094126F5C23F601C34D53B2DF5BE3E5918230AC9DCFCFFA8E66B3A0FA25 ] Serial C:\WINDOWS\system32\drivers\Serial.sys
13:07:10.0750 0x28c8 Serial - ok
13:07:10.0796 0x28c8 [ 8E6B8C671615D126FDC553D1E2DE5562, CEEC0067514555D5CA489F50E3D7562FCA8DB8E952C3C878604C9277FC77959F ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
13:07:10.0796 0x28c8 Sfloppy - ok
13:07:10.0984 0x28c8 [ CAD058D5F8B889A87CA3EB3CF624DCEF, A7CDCF44261D1F4D820927253EA8EBB63714B7BAFF8B08DE073507D9A7EEA5BB ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
13:07:11.0171 0x28c8 SharedAccess - ok
13:07:11.0265 0x28c8 [ 2DB7D303C36DDD055215052F118E8E75, BE6E7BBE12A7A4EDF1F1C2935350603970C7426BBCA7A1A6644BB8999123AF17 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
13:07:11.0265 0x28c8 ShellHWDetection - ok
13:07:11.0281 0x28c8 Simbad - ok
13:07:13.0093 0x28c8 [ 0F97E7A47A52F4A36969F0FC319654C2, 8A9E5974DE60F993BED44ACAAC469B146D6C91ECB8E3D14BF66E6D1634AC604E ] Skype C2C Service C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe
13:07:14.0890 0x28c8 Skype C2C Service - ok
13:07:15.0031 0x28c8 [ 50D9949020E02B847CD48F1243FCB895, 5BDAD5E44DE5B412645142810C5FCE4B2D9685F928FF4A6B836A9DCE7725BD78 ] SkypeUpdate C:\Programme\Skype\Updater\Updater.exe
13:07:15.0125 0x28c8 SkypeUpdate - ok
13:07:15.0328 0x28c8 [ 37DD3CEF1FFB90D5828BCC44485063A9, C70910CD2E601DF6B068779E313D211925F4980F8C6FB7C5A47F6F072E8663D4 ] sound C:\WINDOWS\assembly\GAC_MSIL\PresentationUI\3.0.0.0__31bf3856ad364e35\age_of_onset\screen.exe
13:07:15.0328 0x28c8 sound - ok
13:07:15.0328 0x28c8 Sparrow - ok
13:07:15.0375 0x28c8 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F, DD17733CBB370FCA08F0296704D7CBEACA3C8F76D0ABE4761C3B1FFDF7481D9E ] splitter C:\WINDOWS\system32\drivers\splitter.sys
13:07:15.0375 0x28c8 splitter - ok
13:07:15.0453 0x28c8 [ 60784F891563FB1B767F70117FC2428F, E0B07F08E60FFBAD36C2E58180F4B2A16DCA47716044CBE0213DF7B74D742F1F ] Spooler C:\WINDOWS\system32\spoolsv.exe
13:07:15.0484 0x28c8 Spooler - ok
13:07:15.0953 0x28c8 [ 71E276F6D189413266EA22171806597B, AF3DF0DEF023ADBC81D742424B57581D7680FA4FA64B761BEAEEE60C9FCD34BF ] sptd C:\WINDOWS\System32\Drivers\sptd.sys
13:07:16.0343 0x28c8 sptd - ok
13:07:16.0406 0x28c8 [ 50FA898F8C032796D3B1B9951BB5A90F, 1C86273EC19EB96D6DB9CE6670C00683B77C99C42CC2F7E75BC50872B93446B1 ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
13:07:16.0437 0x28c8 sr - ok
13:07:16.0546 0x28c8 [ FE77A85495065F3AD59C5C65B6C54182, EB4BAF992F961B2FD5D24BFCB6BCB2142BC32933139A818835FEAB190E4283BB ] srservice C:\WINDOWS\system32\srsvc.dll
13:07:16.0640 0x28c8 srservice - ok
13:07:16.0890 0x28c8 [ 47DDFC2F003F7F9F0592C6874962A2E7, 17C643BD4EB09B5666FE41817DC785BE04A6E491CE79E8E5A702CDBD98E1BDD7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
13:07:17.0140 0x28c8 Srv - ok
13:07:17.0203 0x28c8 [ 4DF5B05DFAEC29E13E1ED6F6EE12C500, 2971D7D45D6942D310D47DBD19B9680D2D29527E79B86133C72217FD29259465 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
13:07:17.0250 0x28c8 SSDPSRV - ok
13:07:17.0250 0x28c8 StarOpen - ok
13:07:17.0453 0x28c8 [ BC2C5985611C5356B24AEB370953DED9, 15CBAB8166827DC098E2B16AB6F49A1441A4CB52AF3588F0AD964CAB596DFE10 ] stisvc C:\WINDOWS\system32\wiaservc.dll
13:07:17.0640 0x28c8 stisvc - ok
13:07:17.0687 0x28c8 [ 3941D127AEF12E93ADDF6FE6EE027E0F, EA1F0E32E1C5E90FA4AAC421DEBBE086512340758D3217A6334E886BCE638B51 ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
13:07:17.0687 0x28c8 swenum - ok
13:07:17.0750 0x28c8 [ 8CE882BCC6CF8A62F2B2323D95CB3D01, B408550A581F3DA222355964AFA4E976AD8471F0AA37573C42C4948AE5A23A3B ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
13:07:17.0781 0x28c8 swmidi - ok
13:07:17.0781 0x28c8 SwPrv - ok
13:07:17.0781 0x28c8 symc810 - ok
13:07:17.0796 0x28c8 symc8xx - ok
13:07:17.0796 0x28c8 sym_hi - ok
13:07:17.0796 0x28c8 sym_u3 - ok
13:07:17.0968 0x28c8 [ 1CDE0A5C0416187B9B89E03980C6E8DE, FF78A9EA10521BDE3744932CF41FFC338C202E991816FF6E8F579C032828DD26 ] SynTP C:\WINDOWS\system32\DRIVERS\SynTP.sys
13:07:18.0125 0x28c8 SynTP - ok
13:07:18.0156 0x28c8 [ 8B83F3ED0F1688B4958F77CD6D2BF290, 546D3602183702B4F53E84413CFA2C933D64C8540378E54A8DCD148F3F36A2DA ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
13:07:18.0203 0x28c8 sysaudio - ok
13:07:18.0281 0x28c8 [ 2903FFFA2523926D6219428040DCE6B9, 4F13181931B0499F6C3F08138054DBCD1F84CB9806999A9172B80DE79D446F62 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
13:07:18.0312 0x28c8 SysmonLog - ok
13:07:18.0484 0x28c8 [ 05903CAC4B98908D55EA5774775B382E, AC3666CBD894D737874A5998DC7F46A0A51A7B23B1835FC735B9AD503A2191CC ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
13:07:18.0640 0x28c8 TapiSrv - ok
13:07:18.0875 0x28c8 [ 9AEFA14BD6B182D61E3119FA5F436D3D, EA29E49434585409272E7901AF89771FE9D6E911A7DC44AB3C7020CFF8A44552 ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
13:07:19.0078 0x28c8 Tcpip - ok
13:07:19.0109 0x28c8 [ 6471A66807F5E104E4885F5B67349397, F35CBFFB8BB235CCE30EF94A5273333900DD49FD506BF9D55D99A320B8A53A5A ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
13:07:19.0109 0x28c8 TDPIPE - ok
13:07:19.0140 0x28c8 [ C56B6D0402371CF3700EB322EF3AAF61, 7743FA4C734BCE38EFB1CA69BC17364D8421E2CD172F856F7E38E7AE1EE93F2F ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
13:07:19.0140 0x28c8 TDTCP - ok
13:07:19.0187 0x28c8 [ 88155247177638048422893737429D9E, B6D4E8691917946332C2208D01F8C8281978C1AD1E9951C5D99DF0D49AC34B3B ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
13:07:19.0203 0x28c8 TermDD - ok
13:07:19.0375 0x28c8 [ B7DE02C863D8F5A005A7BF375375A6A4, 6DE05A7B28CA5A78D58536347FC47F15883EEDBEF487CEA0117CC280FC582DCC ] TermService C:\WINDOWS\System32\termsrv.dll
13:07:19.0546 0x28c8 TermService - ok
13:07:19.0640 0x28c8 [ 2DB7D303C36DDD055215052F118E8E75, BE6E7BBE12A7A4EDF1F1C2935350603970C7426BBCA7A1A6644BB8999123AF17 ] Themes C:\WINDOWS\System32\shsvcs.dll
13:07:19.0656 0x28c8 Themes - ok
13:07:19.0750 0x28c8 [ 03681A1CE77F51586903869A5AB1DEAB, E2EC0A481412166B654682C2F3D953E96E757466135CBD2D813B967EDB13C721 ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe
13:07:19.0781 0x28c8 TlntSvr - ok
13:07:19.0781 0x28c8 TosIde - ok
13:07:19.0843 0x28c8 [ 626504572B175867F30F3215C04B3E2F, 47E87CE9BC666D5CB5953C5D497DC00A7CC28F8EC0A064B3E47700279C5C4B91 ] TrkWks C:\WINDOWS\system32\trkwks.dll
13:07:19.0890 0x28c8 TrkWks - ok
13:07:19.0953 0x28c8 [ 5787B80C2E3C5E2F56C2A233D91FA2C9, 3774905CF77954DFCECDA5BCC7CDE3D0ED72712BFAAD85ADAE5246306447E46C ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
13:07:19.0984 0x28c8 Udfs - ok
13:07:20.0000 0x28c8 ultra - ok
13:07:20.0218 0x28c8 [ 402DDC88356B1BAC0EE3DD1580C76A31, 32A686595710336A6BFD54C03F552AE39439611662F84EF5D24193AE5665C6F3 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
13:07:20.0437 0x28c8 Update - ok
13:07:20.0546 0x28c8 [ 1DFD8975D8C89214B98D9387C1125B49, 0B6B268487C8E45E9B86BF4A0A9DB669E0E45D600DE3C82B63F9986CA9E01082 ] upnphost C:\WINDOWS\System32\upnphost.dll
13:07:20.0656 0x28c8 upnphost - ok
13:07:20.0703 0x28c8 [ 9B11E6118958E63E1FEF129466E2BDA7, 97168BCE3F4A9BB9E6500F05E34851FB957B219C598944FADC28AC0011C0503B ] UPS C:\WINDOWS\System32\ups.exe
13:07:20.0703 0x28c8 UPS - ok
13:07:20.0765 0x28c8 [ 1B611611C28D2DF25BC057D79C6F13FC, B0D86F63E44B40413BBAE6402CC088046CFAE082D41BBC2ED5A916293356B846 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
13:07:20.0781 0x28c8 usbccgp - ok
13:07:20.0812 0x28c8 [ 4BAC8DF07F1D8434FC640E677A62204E, 76C1351AF6752224BF59DEEE0F8665FE699F3DFD679F5BCD01C7D9383E6402A4 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
13:07:20.0843 0x28c8 usbehci - ok
13:07:20.0906 0x28c8 [ 1AB3CDDE553B6E064D2E754EFE20285C, A99C4528C4227B1E96847614745AAFACD3C5F1BDFE435214DBF78740FFB300FE ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
13:07:20.0953 0x28c8 usbhub - ok
|
|
17.12.2014, 18:06
| #24 |
| | Windows XP: Neue Tabs öffnen sich der zweite Teil von TDSS: Code:
ATTFilter 13:07:21.0000 0x28c8 [ A717C8721046828520C9EDF31288FC00, 1530BBE832EDBB0974AD89D723A03FF7A0094B368992D73C2C3E62A181DF1E0A ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
13:07:21.0015 0x28c8 usbprint - ok
13:07:21.0046 0x28c8 [ F8EDE2B6928970DCE3D5614C27D9E7F6, 6E5EBBC8B70C1D593634DAF0C190DEADFDA18C3CBC8F552A76F156F3869EF05B ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
13:07:21.0062 0x28c8 usbscan - ok
13:07:21.0109 0x28c8 [ A32426D9B14A089EAA1D922E0C5801A9, ED1DC52EE45F8EAD3AEC4B1F817BB25634141CF48295494C5947DCE6CF7A9817 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
13:07:21.0125 0x28c8 USBSTOR - ok
13:07:21.0140 0x28c8 [ 26496F9DEE2D787FC3E61AD54821FFE6, 8BE7FF647470B9A951CBB478FAF83D657A15CC78037F42348A6B738F21D523DA ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
13:07:21.0156 0x28c8 usbuhci - ok
13:07:21.0187 0x28c8 [ B4D7B7AD8A9F7C063C5CC3E2C1A0724E, CFA47A71403419CA7C94333B4F7766DFC97C5DCDBC3AD1B106044B93C979A5C5 ] usb_rndisx C:\WINDOWS\system32\DRIVERS\usb8023x.sys
13:07:21.0203 0x28c8 usb_rndisx - ok
13:07:21.0234 0x28c8 [ 0D3A8FAFCEACD8B7625CD549757A7DF1, B9CFDEFCD66AA139F3DC2F967B184669532922563AD5A71769BABDC4370D065E ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
13:07:21.0250 0x28c8 VgaSave - ok
13:07:21.0250 0x28c8 ViaIde - ok
13:07:21.0296 0x28c8 [ A5A712F4E880874A477AF790B5186E1D, FE885ED04C3EAFC379787F836738A2769E43D07CF52DD917D90C38E001957A5E ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
13:07:21.0328 0x28c8 VolSnap - ok
13:07:21.0453 0x28c8 [ 68F106273BE29E7B7EF8266977268E78, 1488AB7A654EBC94C73E1D494067189ACB95BC233980110CAC4C0297CDC4115A ] VSS C:\WINDOWS\System32\vssvc.exe
13:07:21.0546 0x28c8 VSS - ok
13:07:21.0703 0x28c8 [ 7B353059E665F8B7AD2BBEAEF597CF45, 84A4311F18A4B8DCB364741DEA7D18E2363F19564B2EF25214965DC729527068 ] W32Time C:\WINDOWS\system32\w32time.dll
13:07:21.0828 0x28c8 W32Time - ok
13:07:21.0875 0x28c8 [ E20B95BAEDB550F32DD489265C1DA1F6, 5589B2067E6C9FBA290D8C5EADDC198EBAF39C50C3CD7D2BC5CDA7CBFBC445E5 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
13:07:21.0890 0x28c8 Wanarp - ok
13:07:21.0890 0x28c8 WDICA - ok
13:07:21.0953 0x28c8 [ 6768ACF64B18196494413695F0C3A00F, 3A8F8586F1D997D19A8478345338D2AECD785AEABDB61531DD3F92003D3230A5 ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
13:07:22.0000 0x28c8 wdmaud - ok
13:07:22.0062 0x28c8 [ 81727C9873E3905A2FFC1EBD07265002, 6AC2383A1DCBB7FA3DB90FBB874C8E1819F5B7492717FF41E303EFC7BF72F93E ] WebClient C:\WINDOWS\System32\webclnt.dll
13:07:22.0093 0x28c8 WebClient - ok
13:07:22.0531 0x28c8 [ 115946A53B62A6B171FD0ED197C71D52, 498F5926B4EEE368CF7156243197FFB0F7A617D0A5A302A271B7256D74F445F2 ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
13:07:22.0968 0x28c8 winachsf - ok
13:07:23.0125 0x28c8 [ 6F3F3973D97714CC5F906A19FE883729, 7817118BE94D0F6FAE0F9CE48AD70FFE0AEF886CCE09C666768FAB61047F992F ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
13:07:23.0203 0x28c8 winmgmt - ok
13:07:23.0265 0x28c8 [ C51B4A5C05A5475708E3C81C7765B71D, F776D2680BD3407307B7072626F78460361FC5BC38623C9E16F394D300AB25DE ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
13:07:23.0281 0x28c8 WmdmPmSN - ok
13:07:23.0687 0x28c8 [ FFA4D901D46D07A5BAB2D8307FBB51A6, 53C6D04D111EDF774C7F7EEB8D032B372E6244774D56B1B34CF1236027EC9450 ] Wmi C:\WINDOWS\System32\advapi32.dll
13:07:24.0125 0x28c8 Wmi - ok
13:07:24.0234 0x28c8 [ 93908111BA57A6E60EC2FA2DE202105C, F395F25F18D15C6B9FEDB45FD31E10295FFE5517E2BC86ACAC11904EA0664BE2 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
13:07:24.0296 0x28c8 WmiApSrv - ok
13:07:24.0703 0x28c8 [ BF05650BB7DF5E9EBDD25974E22403BB, AF173D89B768CFC7AB03DFADD4F049CAC40AC59A0C9208AF5AB92CB368983077 ] WMPNetworkSvc C:\Programme\Windows Media Player\WMPNetwk.exe
13:07:25.0031 0x28c8 WMPNetworkSvc - ok
13:07:25.0421 0x28c8 [ 15673BD0B86150CB8E27766059C72A9B, 56C23289A8BFF4945EE532CF6D62D3EC81B827CA15A359F30A327789F9FE9CAF ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
13:07:25.0718 0x28c8 WPFFontCache_v0400 - ok
13:07:25.0750 0x28c8 [ 6ABE6E225ADB5A751622A9CC3BC19CE8, 4061C5D0F051DFF1730E2A3BFC1CCA97B29602FC50F10F6B44D93B0D28F42024 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys
13:07:25.0765 0x28c8 WS2IFSL - ok
13:07:25.0843 0x28c8 [ 300B3E84FAF1A5C1F791C159BA28035D, 0194856BDF94C1F274AF70AD558290ACDACDDEA331BD66FEB8E167ABD1E36786 ] wscsvc C:\WINDOWS\system32\wscsvc.dll
13:07:25.0890 0x28c8 wscsvc - ok
13:07:25.0921 0x28c8 [ 7B4FE05202AA6BF9F4DFD0E6A0D8A085, A1DB8909FA73337DB613D01824945485186654364A4DF129B8CB913CF87D1D2E ] wuauserv C:\WINDOWS\system32\wuauserv.dll
13:07:25.0937 0x28c8 wuauserv - ok
13:07:25.0984 0x28c8 [ F15FEAFFFBB3644CCC80C5DA584E6311, 79B3E9AF35976CE49921E9BEA3BA3B4A8AF762FD3F284B62954038B5FFB32471 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
13:07:26.0031 0x28c8 WudfPf - ok
13:07:26.0078 0x28c8 [ 28B524262BCE6DE1F7EF9F510BA3985B, AEFF02B899801A63CBB262757C3D4369E38BFF0690BD085DE60E873DFBE3C3F4 ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
13:07:26.0109 0x28c8 WudfRd - ok
13:07:26.0156 0x28c8 [ 05231C04253C5BC30B26CBAAE680ED89, 5C03C2D7E0B573646D32F4093E2FF2C3BA391C39F5BA37D67F69D38E357FCC3D ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
13:07:26.0187 0x28c8 WudfSvc - ok
13:07:26.0468 0x28c8 [ C4F109C005F6725162D2D12CA751E4A7, AC996B44338328BDD4442FE48406F286A64526F0EC77BE00A19FA7FDB0407CFE ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
13:07:26.0750 0x28c8 WZCSVC - ok
13:07:26.0843 0x28c8 [ 0ADA34871A2E1CD2CAAFED1237A47750, 45BEF8649078BD74C1A347B5F2D3A1958E5A7DCD6C6BA8A2E0CAD277A929C64E ] xmlprov C:\WINDOWS\System32\xmlprov.dll
13:07:26.0890 0x28c8 xmlprov - ok
13:07:26.0906 0x28c8 ================ Scan global ===============================
13:07:26.0968 0x28c8 [ 2C60091CA5F67C3032EAB3B30390C27F, 9E205C8E67F4B61FCFA2A82AA1968D522C3B6410D7075BE813F7F1564D61632E ] C:\WINDOWS\system32\basesrv.dll
13:07:27.0203 0x28c8 [ E62178BC21EAC63A3B9A2DBD46C1B505, CAA5480CC4DAA37758F0CF445F865FD6F4630080B044EF2E606C2F62DAA4061A ] C:\WINDOWS\system32\winsrv.dll
13:07:27.0515 0x28c8 [ E62178BC21EAC63A3B9A2DBD46C1B505, CAA5480CC4DAA37758F0CF445F865FD6F4630080B044EF2E606C2F62DAA4061A ] C:\WINDOWS\system32\winsrv.dll
13:07:27.0593 0x28c8 [ A3EDBE9053889FB24AB22492472B39DC, 6F2ED6E04BDE2FCA2A8BF9BD2D1D6923DE6EAECB46F582B6C0BD1CF364D65C9E ] C:\WINDOWS\system32\services.exe
13:07:27.0593 0x28c8 [ Global ] - ok
13:07:27.0593 0x28c8 ================ Scan MBR ==================================
13:07:27.0640 0x28c8 [ 72B8CE41AF0DE751C946802B3ED844B4 ] \Device\Harddisk0\DR0
13:07:28.0000 0x28c8 \Device\Harddisk0\DR0 - ok
13:07:28.0000 0x28c8 ================ Scan VBR ==================================
13:07:28.0000 0x28c8 [ 94C25F30A8DA0258ADB296CA6ADB0063 ] \Device\Harddisk0\DR0\Partition1
13:07:28.0000 0x28c8 \Device\Harddisk0\DR0\Partition1 - ok
13:07:28.0015 0x28c8 ================ Scan generic autorun ======================
13:07:28.0531 0x28c8 [ 115332A83AC2726FA974D30DB4BFD8DE, D86869A8CA6824CF8D3703420FCF6EC3E7E70CEEF05E230BDE1250C4550C7356 ] C:\Programme\Analog Devices\Core\smax4pnp.exe
13:07:29.0109 0x28c8 SoundMAXPnP - ok
13:07:29.0218 0x28c8 [ 976BB46B1F9D2DAC8B31047DA1CF9E6B, 2D915AA0B6639AAE2284AF5B70E5270DBC47F19CEEFD5C075FD455042C2CF404 ] C:\WINDOWS\system32\igfxtray.exe
13:07:29.0296 0x28c8 IgfxTray - ok
13:07:29.0390 0x28c8 [ 2E11FD52DF7369342522F91EC6D3D5C3, D792B54569D1E7AFD9F9E5FC0585AAE0246C2DC15AAA3550049AB55E5702050A ] C:\WINDOWS\system32\hkcmd.exe
13:07:29.0484 0x28c8 HotKeysCmds - ok
13:07:29.0578 0x28c8 [ 5B32B439FE7EE1E87826E991D1A7672F, 07533F4F10E128260F4BDC799F15BBD29B2F8A6F019FD1DF084BF3A1CB54A10C ] C:\WINDOWS\system32\igfxpers.exe
13:07:29.0656 0x28c8 Persistence - ok
13:07:29.0796 0x28c8 [ 32F4B6D627297C567C7AFA929FE6430E, 601A1027F675B29F022F6C152ECD2FF3EE4F01F479EED66023C66813E50A4D83 ] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
13:07:29.0875 0x28c8 SynTPLpr - ok
13:07:30.0203 0x28c8 [ 73D90A309AB764411A07D4FE7351BB28, 8AB99368A403C9762FFB490A7417097511CECA25B4FB66002569EC4822954A5A ] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
13:07:30.0515 0x28c8 SynTPEnh - ok
13:07:30.0875 0x28c8 [ 798DD8615E7CEFA8BA9833E32FFEAAE2, D1E1010155F15433C2CAC34B5974CB8F137C7102EDEEAF85B1C6946ACD4F8D9C ] C:\Programme\FileZilla FTP Client\locales\sl_SI\eat_drink\fixed_cost.exe
13:07:30.0890 0x28c8 photo_gallery - ok
13:07:42.0765 0x28c8 [ 58920E6A409046BA06548D9D139CE0F0, 73FB33F5A76A3445C494482D520448EE02C0B1B7D3DD2E97BE3A9B15F89C5911 ] C:\Programme\Skype\Phone\Skype.exe
13:07:43.0234 0x28c8 Skype - ok
13:07:43.0296 0x28c8 Have new async UDS detects: 2
13:07:43.0296 0x28c8 sound - detected UDS:DangerousObject.Multi.Generic ( 0 )
13:07:43.0468 0x28c8 sound ( UDS:DangerousObject.Multi.Generic ) - infected
13:07:43.0468 0x28c8 Force sending object to P2P due to detect: sound
13:07:43.0828 0x28c8 Object send P2P result: true
13:07:43.0968 0x28c8 photo_gallery - detected UDS:DangerousObject.Multi.Generic ( 0 )
13:07:43.0984 0x28c8 photo_gallery ( UDS:DangerousObject.Multi.Generic ) - infected
13:07:43.0984 0x28c8 Force sending object to P2P due to detect: C:\Programme\FileZilla FTP Client\locales\sl_SI\eat_drink\fixed_cost.exe
13:07:44.0437 0x28c8 Object send P2P result: true
13:07:47.0484 0x28c8 [ F308D7378BF60B91DA495FCAA1C216E7, 7D67B6D1CE11685F87B3CF9689AF0B089D3340A72C7A0B9633C826AEE49B405E ] C:\Programme\CCleaner\CCleaner.exe
13:07:50.0296 0x28c8 CCleaner Monitoring - ok
13:07:50.0453 0x28c8 [ D8408A5E0D4ECB4193A6738D0B052867, 08DC7706E9E46C65BA740555713D71E3F53A3FE939ECA60A1238E17A2E0A962A ] C:\Dokumente und Einstellungen\User\Anwendungsdaten\Account-weight\account-count.exe
13:07:50.0500 0x28c8 account-code - ok
13:07:50.0671 0x28c8 [ BE838F0B20877D064EC78C6DDB9A0CF6, 948D495A90B7D7890CDB9ABE851BDFCABF18D89BC147AC97061FF154219DDA82 ] C:\DOKUME~1\User\LOKALE~1\Temp\Tycnav\mcjcofbkeos.exe
13:07:50.0671 0x28c8 Suspicious file ( NoAccess ): C:\DOKUME~1\User\LOKALE~1\Temp\Tycnav\mcjcofbkeos.exe. md5: BE838F0B20877D064EC78C6DDB9A0CF6, sha256: 948D495A90B7D7890CDB9ABE851BDFCABF18D89BC147AC97061FF154219DDA82
13:07:50.0953 0x28c8 zxzwkeos - detected Trojan-Spy.Win32.ZBot.gen ( 0 )
13:07:51.0093 0x28c8 zxzwkeos ( Trojan-Spy.Win32.ZBot.gen ) - infected
13:07:51.0093 0x28c8 Force sending object to P2P due to detect: C:\DOKUME~1\User\LOKALE~1\Temp\Tycnav\mcjcofbkeos.exe
13:07:52.0250 0x28c8 Object send P2P result: true
13:07:52.0468 0x28c8 [ A8A39ADEEF5A1255BE960CB04F639A11, B64C7208F179289319601FB5C3581ED947996A2DC3B5A575131773A9E706358C ] C:\Dokumente und Einstellungen\User\Anwendungsdaten\Channel-text\channeldraft.exe
13:07:52.0468 0x28c8 Suspicious file ( NoAccess ): C:\Dokumente und Einstellungen\User\Anwendungsdaten\Channel-text\channeldraft.exe. md5: A8A39ADEEF5A1255BE960CB04F639A11, sha256: B64C7208F179289319601FB5C3581ED947996A2DC3B5A575131773A9E706358C
13:07:52.0468 0x28c8 channel-shock - detected LockedFile.Multi.Generic ( 1 )
13:07:52.0671 0x28c8 Detect turned to UDS exact due to KSN untrusted
13:07:52.0671 0x28c8 channel-shock ( UDS:DangerousObject.Multi.Generic ) - infected
13:07:52.0671 0x28c8 Force sending object to P2P due to detect: C:\Dokumente und Einstellungen\User\Anwendungsdaten\Channel-text\channeldraft.exe
13:07:52.0875 0x28c8 Object send P2P result: true
13:07:53.0171 0x28c8 [ 2B5E3E69ABE05C3BEC8B927D4936688C, 41957818F87E7A52E9D0166C144D825CC23EFB01251A0FA7B16475E3BF2DEE34 ] C:\Dokumente und Einstellungen\User\Anwendungsdaten\Signal-forget\signal_live.exe
13:07:53.0171 0x28c8 Suspicious file ( NoAccess ): C:\Dokumente und Einstellungen\User\Anwendungsdaten\Signal-forget\signal_live.exe. md5: 2B5E3E69ABE05C3BEC8B927D4936688C, sha256: 41957818F87E7A52E9D0166C144D825CC23EFB01251A0FA7B16475E3BF2DEE34
13:07:53.0171 0x28c8 signal-contain - detected LockedFile.Multi.Generic ( 1 )
13:07:53.0375 0x28c8 signal-contain ( LockedFile.Multi.Generic ) - warning
13:07:53.0687 0x28c8 [ AA841C94B5C8644FDFDD025AC4D84504, D88C132685789905041B45410D9003EB7A009B45C298C9D2752033964DE4E340 ] C:\DOKUME~1\User\LOKALE~1\Temp\Markretain\markpull.exe
13:07:53.0687 0x28c8 Suspicious file ( NoAccess ): C:\DOKUME~1\User\LOKALE~1\Temp\Markretain\markpull.exe. md5: AA841C94B5C8644FDFDD025AC4D84504, sha256: D88C132685789905041B45410D9003EB7A009B45C298C9D2752033964DE4E340
13:07:53.0734 0x28c8 markpersuade - detected Trojan-Spy.Win32.ZBot.gen ( 0 )
13:07:53.0890 0x28c8 markpersuade ( Trojan-Spy.Win32.ZBot.gen ) - infected
13:07:53.0890 0x28c8 Force sending object to P2P due to detect: C:\DOKUME~1\User\LOKALE~1\Temp\Markretain\markpull.exe
13:07:54.0093 0x28c8 Object send P2P result: true
13:07:54.0281 0x28c8 [ 01B4E6E990B6C5EA8856D96C7FD044B2, 2266296FD3C8E0DFA657F21406EE4E494477870DFAF7C65BEBCB6FBA8CADC7C6 ] C:\WINDOWS\system32\ctfmon.exe
13:07:54.0296 0x28c8 ctfmon.exe - ok
13:07:54.0406 0x28c8 [ 2B5E3E69ABE05C3BEC8B927D4936688C, 41957818F87E7A52E9D0166C144D825CC23EFB01251A0FA7B16475E3BF2DEE34 ] C:\Dokumente und Einstellungen\User\Anwendungsdaten\Signal-forget\signal_live.exe
13:07:54.0406 0x28c8 Suspicious file ( NoAccess ): C:\Dokumente und Einstellungen\User\Anwendungsdaten\Signal-forget\signal_live.exe. md5: 2B5E3E69ABE05C3BEC8B927D4936688C, sha256: 41957818F87E7A52E9D0166C144D825CC23EFB01251A0FA7B16475E3BF2DEE34
13:07:54.0406 0x28c8 signal-contain - detected LockedFile.Multi.Generic ( 1 )
13:07:54.0406 0x28c8 signal-contain ( LockedFile.Multi.Generic ) - warning
13:07:55.0078 0x28c8 [ 7999235AE6A9F0FE1C007203F03A4618, D552A169E7E5EC43B675120F11E6A1790902C4068FAAFC2DE81DDB5FA50F18E8 ] C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_15_0_0_246_Plugin.exe
13:07:55.0609 0x28c8 FlashPlayerUpdate - ok
13:07:55.0609 0x28c8 Waiting for KSN requests completion. In queue: 4
13:07:56.0609 0x28c8 Have new async UDS detects: 1
13:07:56.0609 0x28c8 account-code - detected UDS:DangerousObject.Multi.Generic ( 0 )
13:07:56.0609 0x28c8 account-code ( UDS:DangerousObject.Multi.Generic ) - infected
13:07:56.0609 0x28c8 Force sending object to P2P due to detect: C:\Dokumente und Einstellungen\User\Anwendungsdaten\Account-weight\account-count.exe
13:07:56.0796 0x28c8 Object send P2P result: true
13:07:57.0250 0x28c8 Win FW state via NFM: enabled
13:07:57.0390 0x28c8 ============================================================
13:07:57.0390 0x28c8 Scan finished
13:07:57.0390 0x28c8 ============================================================
13:07:57.0390 0x28c0 Detected object count: 8
13:07:57.0390 0x28c0 Actual detected object count: 8
13:09:18.0687 0x28c0 sound ( UDS:DangerousObject.Multi.Generic ) - skipped by user
13:09:18.0687 0x28c0 sound ( UDS:DangerousObject.Multi.Generic ) - User select action: Skip
13:09:18.0687 0x28c0 photo_gallery ( UDS:DangerousObject.Multi.Generic ) - skipped by user
13:09:18.0687 0x28c0 photo_gallery ( UDS:DangerousObject.Multi.Generic ) - User select action: Skip
13:09:18.0687 0x28c0 zxzwkeos ( Trojan-Spy.Win32.ZBot.gen ) - skipped by user
13:09:18.0687 0x28c0 zxzwkeos ( Trojan-Spy.Win32.ZBot.gen ) - User select action: Skip
13:09:18.0687 0x28c0 channel-shock ( UDS:DangerousObject.Multi.Generic ) - skipped by user
13:09:18.0687 0x28c0 channel-shock ( UDS:DangerousObject.Multi.Generic ) - User select action: Skip
13:09:18.0703 0x28c0 signal-contain ( LockedFile.Multi.Generic ) - skipped by user
13:09:18.0703 0x28c0 signal-contain ( LockedFile.Multi.Generic ) - User select action: Skip
13:09:18.0703 0x28c0 markpersuade ( Trojan-Spy.Win32.ZBot.gen ) - skipped by user
13:09:18.0703 0x28c0 markpersuade ( Trojan-Spy.Win32.ZBot.gen ) - User select action: Skip
13:09:18.0703 0x28c0 signal-contain ( LockedFile.Multi.Generic ) - skipped by user
13:09:18.0703 0x28c0 signal-contain ( LockedFile.Multi.Generic ) - User select action: Skip
13:09:18.0703 0x28c0 account-code ( UDS:DangerousObject.Multi.Generic ) - skipped by user
13:09:18.0703 0x28c0 account-code ( UDS:DangerousObject.Multi.Generic ) - User select action: Skip
13:09:42.0875 0x065c ============================================================
13:09:42.0875 0x065c Scan started
13:09:42.0875 0x065c Mode: Manual;
13:09:42.0875 0x065c ============================================================
13:09:42.0875 0x065c KSN ping started
13:09:42.0984 0x065c KSN ping finished: true
13:09:44.0328 0x065c ================ Scan system memory ========================
13:09:44.0343 0x065c System memory - ok
13:09:44.0343 0x065c ================ Scan services =============================
13:09:44.0781 0x065c Abiosdsk - ok
13:09:44.0796 0x065c abp480n5 - ok
13:09:44.0921 0x065c [ AC407F1A62C3A300B4F2B5A9F1D55B2C, 31F5FC61B37E22100B3A52A590295A7E827FFC581FA9960C64B9032452AAECED ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
13:09:45.0031 0x065c ACPI - ok
13:09:45.0062 0x065c [ 9E1CA3160DAFB159CA14F83B1E317F75, 13B3E897B0E819BF734449416D9EC6EBCAC89538EC69BF48C068593B82D57004 ] ACPIEC C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
13:09:45.0062 0x065c ACPIEC - ok
13:09:45.0187 0x065c [ BEEE84A79710F705864685B05F1BB172, B3E75F860179EB6C72A902EF9425F57992F73890DAB2C6F9562E8D77ADF4EC5B ] ADIHdAudAddService C:\WINDOWS\system32\drivers\ADIHdAud.sys
13:09:45.0296 0x065c ADIHdAudAddService - ok
13:09:45.0531 0x065c [ 749F94C424524285DCDA84D695ABC12F, E5AD194AF5B8B4FDB3976D3E3F9EF942DECFEC4EBAA9881A8EF7707BB781E4AD ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
13:09:45.0671 0x065c AdobeFlashPlayerUpdateSvc - ok
13:09:45.0671 0x065c adpu160m - ok
13:09:45.0750 0x065c [ 358063AB6C1C4173B735525CDFA65F94, E2C7E27F8E0B4C6A662313FEEE61AF02D9166F4DC40E709DBB6C73EB489A5CC5 ] AEAudioService C:\WINDOWS\system32\drivers\AEAudio.sys
13:09:45.0796 0x065c AEAudioService - ok
13:09:45.0921 0x065c [ 8BED39E3C35D6A489438B8141717A557, 1B5796E56B0927360CE0759641B1151828BC0A9E45620D2B2D880491F5CE33D0 ] aec C:\WINDOWS\system32\drivers\aec.sys
13:09:46.0000 0x065c aec - ok
13:09:46.0109 0x065c [ 1E44BC1E83D8FD2305F8D452DB109CF9, CF5EC07E0B589FA2A4701C6CFD69E893FC3ABF274AD57AE3C13FFE49063B02C8 ] AFD C:\WINDOWS\System32\drivers\afd.sys
13:09:46.0187 0x065c AFD - ok
13:09:46.0187 0x065c Aha154x - ok
13:09:46.0203 0x065c aic78u2 - ok
13:09:46.0203 0x065c aic78xx - ok
13:09:46.0250 0x065c [ 738D80CC01D7BC7584BE917B7F544394, DCC17AAEF5CDDF52FAAC3CC6904EF421CD595F66318A2370BEE261D5C3A8E340 ] Alerter C:\WINDOWS\system32\alrsvc.dll
13:09:46.0265 0x065c Alerter - ok
13:09:46.0312 0x065c [ 190CD73D4984F94D823F9444980513E5, 93A32C2495CCA094F768BA707C74DA5C00B8A88A9236DD1A297439A7C2E6C6FA ] ALG C:\WINDOWS\System32\alg.exe
13:09:46.0328 0x065c ALG - ok
13:09:46.0343 0x065c AliIde - ok
13:09:46.0343 0x065c amsint - ok
13:09:46.0437 0x065c [ D45960BE52C3C610D361977057F98C54, 9186589B502F46B47672CFB8EBD558D51B0F3CBFE4E0DDBA625A4265236518CE ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
13:09:46.0500 0x065c AppMgmt - ok
13:09:46.0500 0x065c asc - ok
13:09:46.0515 0x065c asc3350p - ok
13:09:46.0515 0x065c asc3550 - ok
13:09:46.0687 0x065c [ 776ACEFA0CA9DF0FAA51A5FB2F435705, 72DF7ED6B085BC468994F5B3189506FD726A9A17A9C42ACA1E420D787691361D ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
13:09:46.0703 0x065c aspnet_state - ok
13:09:46.0734 0x065c [ B153AFFAC761E7F5FCFA822B9C4E97BC, 7E60F572A6B3C6219E3C86225AA37243AFFD74337DB7F108B04778042E5CC959 ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
13:09:46.0734 0x065c AsyncMac - ok
13:09:46.0796 0x065c [ 9F3A2F5AA6875C72BF062C712CFA2674, B4DF1D2C56A593C6B54DE57395E3B51D288F547842893B32B0F59228A0CF70B9 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
13:09:46.0859 0x065c atapi - ok
13:09:46.0859 0x065c Atdisk - ok
13:09:46.0937 0x065c [ 9916C1225104BA14794209CFA8012159, 5D6F05F715C52A16D05CAE15C3DFE77A139A7F27F7AE710EC9A10F9EE05115A1 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
13:09:46.0953 0x065c Atmarpc - ok
13:09:47.0015 0x065c [ 58ED0D5452DF7BE732193E7999C6B9A4, 254E2ECF592DDA2E3E6CA9F6F3E77926E2265586A7937BA95199ED47BCDE69A3 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
13:09:47.0046 0x065c AudioSrv - ok
13:09:47.0093 0x065c [ D9F724AA26C010A217C97606B160ED68, 329B5118F2409731D06FDAE85B6ADD64A048292801BCB3546651CEB303111695 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
13:09:47.0093 0x065c audstub - ok
13:09:47.0125 0x065c [ DA1F27D85E0D1525F6621372E7B685E9, 5A81A46A3BDD19DAFC6C87D277267A5D44F3A1B5302F2CC1111D84B7BAD5610D ] Beep C:\WINDOWS\system32\drivers\Beep.sys
13:09:47.0125 0x065c Beep - ok
13:09:47.0390 0x065c [ D6F603772A789BB3228F310D650B8BD1, A539025C70FD998A9B8703DE05CAE5E99BC721D8852EA561EBC2DD20CB371D2E ] BITS C:\WINDOWS\system32\qmgr.dll
13:09:47.0609 0x065c BITS - ok
13:09:47.0687 0x065c [ B71549F23736ADF83A571061C47777FD, A1D0320736EE777030A543DCA086367EB5A5B6F95088B9C22D8E09326C3A39A9 ] Browser C:\WINDOWS\System32\browser.dll
13:09:47.0734 0x065c Browser - ok
13:09:48.0343 0x065c [ D26B5B9A40A2B2191B35C76D5CBF5D2A, 1557739113DA7AA67FB71E898D9E30224DE8022EFF3C333110900CAC8B9FFC54 ] BTKRNL C:\WINDOWS\system32\DRIVERS\btkrnl.sys
13:09:48.0906 0x065c BTKRNL - ok
13:09:49.0203 0x065c [ C261E704B5558BA04DD643A0D998327D, 7BD5EFF71BA6D7120A3CCA63187842E85BCB6FCA77190A90362E3E6F9047E58C ] btwdins C:\Programme\ThinkPad\Bluetooth Software\bin\btwdins.exe
13:09:49.0390 0x065c btwdins - ok
13:09:49.0406 0x065c catchme - ok
13:09:49.0437 0x065c [ 90A673FC8E12A79AFBED2576F6A7AAF9, BDE7858A3457DB979FEDD8577FA6321BF72848E4A7BF9F173C78A6A10CBB3EBE ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
13:09:49.0453 0x065c cbidf2k - ok
13:09:49.0453 0x065c cd20xrnt - ok
13:09:49.0500 0x065c [ C1B486A7658353D33A10CC15211A873B, AA4DD9E7AAE5AAB1146B360B17001F975D2F29A1281CF7B13E7136480410F347 ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
13:09:49.0500 0x065c Cdaudio - ok
13:09:49.0562 0x065c [ C885B02847F5D2FD45A24E219ED93B32, B26B2F8E3A831E2B65EB0C5195B0645CD50E22615CE79C9B0B391CD563B121DB ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
13:09:49.0593 0x065c Cdfs - ok
13:09:49.0656 0x065c [ 1F4260CC5B42272D71F79E570A27A4FE, B51C2A3ED3C309953D0EA45869C8E464C10F2533DADE9E0286AF674979098D1D ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
13:09:49.0687 0x065c Cdrom - ok
13:09:49.0687 0x065c Changer - ok
13:09:49.0718 0x065c [ 28E3040D1F1CA2008CD6B29DFEBC9A5E, ACB458E8A11AA2143734A5A0281973D95158E6402A6453F98F9832D1E19B01F9 ] CiSvc C:\WINDOWS\system32\cisvc.exe
13:09:49.0718 0x065c CiSvc - ok
13:09:49.0750 0x065c [ 778A30ED3C134EB7E406AFC407E9997D, 3E6AD115AB2596EB001BC21AEADDBC75F27C42DB90C986B7AD17743CE631234E ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
13:09:49.0765 0x065c ClipSrv - ok
13:09:49.0890 0x065c [ D87ACAED61E417BBA546CED5E7E36D9C, 14AC6034A5BC0FB2A1AFDAD42BEF4DE641556E54AD30D0C46765660A4BE55462 ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
13:09:49.0921 0x065c clr_optimization_v2.0.50727_32 - ok
13:09:50.0046 0x065c [ C5A75EB48E2344ABDC162BDA79E16841, 6070A8AAFD38FBC6A68A2B10C20117612354DF21B4492D90CA522BFB6870D726 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
13:09:50.0140 0x065c clr_optimization_v4.0.30319_32 - ok
13:09:50.0187 0x065c [ 0F6C187D38D98F8DF904589A5F94D411, DB987093446216CEE913AC27503BF7E23E5A62DF169B355730285DAB64F6ED28 ] CmBatt C:\WINDOWS\system32\DRIVERS\CmBatt.sys
13:09:50.0187 0x065c CmBatt - ok
13:09:50.0187 0x065c CmdIde - ok
13:09:50.0203 0x065c [ 6E4C9F21F0FAE8940661144F41B13203, 731202A0DD021FCF9287FEA631212603AAAC23F9E7F76B2882F913B18A971F1C ] Compbatt C:\WINDOWS\system32\DRIVERS\compbatt.sys
13:09:50.0218 0x065c Compbatt - ok
13:09:50.0218 0x065c COMSysApp - ok
13:09:50.0234 0x065c Cpqarray - ok
13:09:50.0296 0x065c [ 611F824E5C703A5A899F84C5F1699E4D, 9EFA5612FE58E9974E4CC13D39D91D7B5DEA3ED66BEFBED3AAE6D2800FD8162A ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
13:09:50.0343 0x065c CryptSvc - ok
13:09:50.0343 0x065c dac2w2k - ok
13:09:50.0343 0x065c dac960nt - ok
13:09:50.0593 0x065c [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B, ECFBACE3CBF2384948EA1C445BDA3955EB4F44A9874286E6537C67DC1283E5B0 ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
13:09:50.0609 0x065c DcomLaunch - ok
13:09:50.0687 0x065c [ C29A1C9B75BA38FA37F8C44405DEC360, 7476D8BC4380CDE56764B2034AF3741DA4ED00F315E41C9A02B5EAD04374F241 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
13:09:50.0765 0x065c Dhcp - ok
13:09:50.0796 0x065c [ 044452051F3E02E7963599FC8F4F3E25, 584BDDB074618BE76454CF90E74829CFF588B5B5FAEB793E2F7AAD26352DD689 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
13:09:50.0812 0x065c Disk - ok
13:09:50.0828 0x065c dmadmin - ok
13:09:51.0015 0x065c [ 0DCFC8395A99FECBB1EF771CEC7FE4EA, 89B0AEE5BE01B9FE4FF2989FF16DB6121721ACDFCE6D9655C0ACD321D8C308BE ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
13:09:51.0140 0x065c dmboot - ok
13:09:51.0234 0x065c [ 53720AB12B48719D00E327DA470A619A, 800264866A6267C9000A85D00095D57908D059D737E5F28C9C4049B884C46228 ] dmio C:\WINDOWS\system32\drivers\dmio.sys
13:09:51.0296 0x065c dmio - ok
13:09:51.0328 0x065c [ E9317282A63CA4D188C0DF5E09C6AC5F, D41E002F555FE9015EF620975255F58BB79198CA1FF0E09EC950CB450FF77CF7 ] dmload C:\WINDOWS\system32\drivers\dmload.sys
13:09:51.0328 0x065c dmload - ok
13:09:51.0375 0x065c [ 25C83FFBBA13B554EB6D59A9B2E2EE78, 9FBD655ED3E9163AE11EC207F283E387EFBA5A23108EC790BAE4846B35E66F16 ] dmserver C:\WINDOWS\System32\dmserver.dll
13:09:51.0375 0x065c dmserver - ok
13:09:51.0453 0x065c [ 8A208DFCF89792A484E76C40E5F50B45, 4E40E2EB38C6254E7CAA488200E89EE7DEBBBA773890BC6A84313CC68178D54F ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
13:09:51.0468 0x065c DMusic - ok
13:09:51.0546 0x065c [ 407F3227AC618FD1CA54B335B083DE07, 96B8E734648FE9A4EBA59C096C8779BD1A11A93A6303AFD438A406C8122D36C6 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
13:09:51.0562 0x065c Dnscache - ok
13:09:51.0671 0x065c [ 676E36C4FF5BCEA1900F44182B9723E6, 740CF18BD40E00FEA26CF0E6340C5D18F7D0B4390055FAEEC258B3AA790C4AE9 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
13:09:51.0750 0x065c Dot3svc - ok
13:09:51.0750 0x065c dpti2o - ok
13:09:51.0781 0x065c [ 8F5FCFF8E8848AFAC920905FBD9D33C8, C8C6FB97AB0871C8C88A2201525A5CF10D5131CB6980D32692ED7A8F58399AD5 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
13:09:51.0781 0x065c drmkaud - ok
13:09:51.0828 0x065c [ B2C3F71B86E25C3DF78339DDB40A7562, E8B821B0F9DE213C9C5115FDCE3C59F98CB6C4015B3E4A1F96387C81E3EBA56A ] dsNcAdpt C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys
13:09:51.0843 0x065c dsNcAdpt - ok
13:09:52.0250 0x065c [ DBB553EFC611BFC7FC2E658FFDD3AF33, 44C5ABA4412923DDD7EDA633EF75AF8E6719E991F595FF26AEF0C6A5F002529E ] dsNcService C:\Programme\Juniper Networks\Common Files\dsNcService.exe
13:09:52.0609 0x065c dsNcService - ok
13:09:52.0796 0x065c [ 06D94F4543671B497A5F4A0AEDD5E36A, E896A3816405FB381C8490AD1F9799C6D7CE6777D3029B1C19785A5552E284C3 ] e1express C:\WINDOWS\system32\DRIVERS\e1e5132.sys
13:09:52.0921 0x065c e1express - ok
13:09:52.0984 0x065c [ 4E4F2FDDAB0A0736D7671134DCCE91FB, 8E2C57D1A006856C47CBDD5765A9DD317DB205B26DA8BFC70555A506257A1CD9 ] EapHost C:\WINDOWS\System32\eapsvc.dll
13:09:53.0000 0x065c EapHost - ok
13:09:53.0031 0x065c [ 877C18558D70587AA7823A1A308AC96B, 6B336A62112988D855513F45153F73F8470C41A448E9B7438B4A8EC1813AABF1 ] ERSvc C:\WINDOWS\System32\ersvc.dll
13:09:53.0046 0x065c ERSvc - ok
13:09:53.0140 0x065c [ A3EDBE9053889FB24AB22492472B39DC, 6F2ED6E04BDE2FCA2A8BF9BD2D1D6923DE6EAECB46F582B6C0BD1CF364D65C9E ] Eventlog C:\WINDOWS\system32\services.exe
13:09:53.0140 0x065c Eventlog - ok
13:09:53.0343 0x065c [ AF4F6B5739D18CA7972AB53E091CBC74, A399E2CC026730D3A429727AAB48093B9F1E5DD8EB6336519C7F16182FDB3905 ] EventSystem C:\WINDOWS\system32\es.dll
13:09:53.0484 0x065c EventSystem - ok
13:09:54.0015 0x065c [ 33ABDDB21DE2F4BB1B05A5A3A671BD64, 9A27823BE9C035F99729001AD765EF086DFAD7DB2DD546E7E1D0B9F347513A09 ] EvtEng C:\Programme\Intel\WiFi\bin\EvtEng.exe
13:09:54.0484 0x065c EvtEng - ok
13:09:54.0500 0x065c ewusbnet - ok
13:09:54.0609 0x065c [ 38D332A6D56AF32635675F132548343E, E6909DB836AF679B4F4D62C7396D6C82769CC7ABB8C919C2AABFE934FCE268F6 ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
13:09:54.0687 0x065c Fastfat - ok
13:09:54.0796 0x065c [ 2DB7D303C36DDD055215052F118E8E75, BE6E7BBE12A7A4EDF1F1C2935350603970C7426BBCA7A1A6644BB8999123AF17 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
13:09:54.0796 0x065c FastUserSwitchingCompatibility - ok
13:09:54.0828 0x065c [ 92CDD60B6730B9F50F6A1A0C1F8CDC81, 8307A532AB4D05CBBCE206DC2759497708BF5AAA880BD00F0E4F281D8578A1F5 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys
13:09:54.0843 0x065c Fdc - ok
13:09:54.0875 0x065c [ B0678A548587C5F1967B0D70BACAD6C1, 7E49910212ED87313F926E4800EA8D34809C287A686CA69B82B79C1A6451F88C ] Fips C:\WINDOWS\system32\drivers\Fips.sys
13:09:54.0906 0x065c Fips - ok
13:09:54.0921 0x065c [ 9D27E7B80BFCDF1CDD9B555862D5E7F0, 69C271AD5BCEBFD8AE5A769BDD7EC51256DA3A8ADAD5D12E5C0D13F4E82D8805 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys
13:09:54.0937 0x065c Flpydisk - ok
13:09:55.0015 0x065c [ B2CF4B0786F8212CB92ED2B50C6DB6B0, 280F5CF8A90F7BEDE73ADD0DD0F8952088133A7CA9A3D3B7041957E33B36845D ] FltMgr C:\WINDOWS\system32\DRIVERS\fltMgr.sys
13:09:55.0078 0x065c FltMgr - ok
13:09:55.0140 0x065c [ 8BA7C024070F2B7FDD98ED8A4BA41789, 47585006F86B2C6016EC54250A416794792D1E4024FF229C120BC25B684AF66A ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
13:09:55.0156 0x065c FontCache3.0.0.0 - ok
13:09:55.0187 0x065c [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A, EC635E071201A766845D48973772CBE0958942B4162F3F5F70660D114CC877E0 ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
13:09:55.0187 0x065c Fs_Rec - ok
13:09:55.0250 0x065c [ 8F1955CE42E1484714B542F341647778, 8EB3F99625F409D3032561E8AB44BEFBFBFBA4EC873C2151C92A5CAAF7F2AA55 ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
13:09:55.0312 0x065c Ftdisk - ok
13:09:55.0343 0x065c [ 0A02C63C8B144BD8C86B103DEE7C86A2, 7A3235DD3E1995DD72B212FAEB3ECA2A974434DE9BF6D269EA11BA65A80E7E50 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
13:09:55.0359 0x065c Gpc - ok
13:09:55.0484 0x065c [ 573C7D0A32852B48F3058CFD8026F511, BC384BBA394AFDCDA1A9ABC858C692AA84A1F0A31AF3DDF7F38D120C027927FB ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
13:09:55.0562 0x065c HDAudBus - ok
13:09:55.0671 0x065c [ CB66BF85BF599BEFD6C6A57C2E20357F, 55D3A0F9279FF316766F42548FCB61C452942B08A37590C4892DF110BE4E53C6 ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
13:09:55.0687 0x065c helpsvc - ok
13:09:55.0750 0x065c [ B35DA85E60C0103F2E4104532DA2F12B, E13C9F73DF7713554CB614B36123D75014F5121AA1FC9069733E61758751CBE4 ] HidServ C:\WINDOWS\System32\hidserv.dll
13:09:55.0765 0x065c HidServ - ok
13:09:55.0781 0x065c [ CCF82C5EC8A7326C3066DE870C06DAF1, 93395FA4C26B2E82DC8B7025ED3BCF583885E5D8C5F60CD6EEAA6335D6A126EC ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys
13:09:55.0781 0x065c HidUsb - ok
13:09:55.0843 0x065c [ ED29F14101523A6E0E808107405D452C, B8FA987637787BEECC2EB06D36293DAC355523392B49A8C5A9491EEE961917E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
13:09:55.0859 0x065c hkmsvc - ok
13:09:55.0875 0x065c hpn - ok
13:09:55.0937 0x065c [ 30CA91E657CEDE2F95359D6EF186F650, 6BBAFBE50E7819695A79586A086A9952B737E174BA2C63C1F180D97EC4AABA4B ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys
13:09:55.0968 0x065c HPZid412 - ok
13:09:56.0000 0x065c [ EFD31AFA752AA7C7BBB57BCBE2B01C78, AC671CEE9F8DD9FE6C51069212AEB1736BB914361D4185D1E87068D244BF2B7A ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
13:09:56.0015 0x065c HPZipr12 - ok
13:09:56.0046 0x065c [ 7AC43C38CA8FD7ED0B0A4466F753E06E, B4D44B366170D247E0145B9435CC678BEE2A2A42CFF7B485E077B3B582557B5A ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys
13:09:56.0046 0x065c HPZius12 - ok
13:09:56.0203 0x065c [ 702A7E1B3C9263EFBD6AEDE3B6919761, CD60A7A657596890775FA6583800A57BF8435B8F4964C65630835291F7EC38F1 ] HSFHWAZL C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
13:09:56.0328 0x065c HSFHWAZL - ok
13:09:56.0906 0x065c [ 8D02CB68D53AA36189FAF86FED438884, 99F66C299CEAA2967985CDEA0956C186AD86F5AF52649023D72D6C47C509FCA2 ] HSF_DPV C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
13:09:56.0968 0x065c HSF_DPV - ok
13:09:57.0171 0x065c [ F80A415EF82CD06FFAF0D971528EAD38, 524D9E9201572929522F6805011783711B7C0F76308B924C89CF75F4B7A1FDF3 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
13:09:57.0312 0x065c HTTP - ok
13:09:57.0359 0x065c [ 9E4ADB854CEBCFB81A4B36718FEECD16, 677AB64460775686F8366D6BF35D420A2486C3F07338A00A7C2788A5142B9F08 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
13:09:57.0359 0x065c HTTPFilter - ok
13:09:57.0375 0x065c hwdatacard - ok
13:09:57.0375 0x065c hwusbdev - ok
13:09:57.0390 0x065c i2omgmt - ok
13:09:57.0390 0x065c i2omp - ok
13:09:57.0453 0x065c [ E283B97CFBEB86C1D86BAED5F7846A92, 7664F791D08C80DF1E52B34BE69F073AA645610C4BD975F498254807602374AB ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
13:09:57.0484 0x065c i8042prt - ok
13:10:00.0796 0x065c [ 48846B31BE5A4FA662CCFDE7A1BA86B9, BC653F3ADAD70E766484986F196D4045D2CC6D92E5D827907E734254EE489A33 ] ialm C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
13:10:04.0062 0x065c ialm - ok
13:10:04.0171 0x065c [ 293131C1DA5F53CB05F75D637739D79C, F5F1A03FB012101FA143A288BCBC048A652A285F7DF533D1D08279E3A4D24326 ] IBMPMDRV C:\WINDOWS\system32\DRIVERS\ibmpmdrv.sys
13:10:04.0203 0x065c IBMPMDRV - ok
13:10:04.0281 0x065c [ 91FA023C5203503776BCCC9CF96A0C59, A47C788A26E4D2A282DE2EC8A75E1544CAB17A2C5F4CF867026D3B95B3651D1D ] IBMPMSVC C:\WINDOWS\system32\ibmpmsvc.exe
13:10:04.0328 0x065c IBMPMSVC - ok
13:10:04.0703 0x065c [ C01AC32DC5C03076CFB852CB5DA5229C, A4D7749220B5BC965D96A267F1E02FE8284A230BA249109207BD4B9EA8DFAC96 ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
13:10:04.0984 0x065c idsvc - ok
13:10:05.0031 0x065c [ 083A052659F5310DD8B6A6CB05EDCF8E, 48D39B03FFB6FAA1529B774443BA12618AE3982D9F65A7B9D18F2269F78B31F4 ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
13:10:05.0046 0x065c Imapi - ok
13:10:05.0171 0x065c [ D4B413AA210C21E46AEDD2BA5B68D38E, 2309622867AA8FC832A729FA78F48742D4BD6CA0DAFBFB9DDB0772D671E1ED75 ] ImapiService C:\WINDOWS\system32\imapi.exe
13:10:05.0250 0x065c ImapiService - ok
13:10:05.0265 0x065c ini910u - ok
13:10:05.0265 0x065c IntelIde - ok
13:10:05.0312 0x065c [ 4C7D2750158ED6E7AD642D97BFFAE351, C05E4799752F090DCB632F07F62ADE38D31534621064D269AD535CA0BDFED448 ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
13:10:05.0343 0x065c intelppm - ok
13:10:05.0375 0x065c [ 3BB22519A194418D5FEC05D800A19AD0, F6662F440950596DC1382DD1DB5D7891CCEA30A6062BEA942C18445B5F0D8B16 ] Ip6Fw C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
13:10:05.0390 0x065c Ip6Fw - ok
13:10:05.0421 0x065c [ 731F22BA402EE4B62748ADAF6363C182, 5C3BEBD008A5BE4DC2F92076FF41A10DDC01E10EC7E6552213CFA11970811848 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
13:10:05.0437 0x065c IpFilterDriver - ok
13:10:05.0453 0x065c [ B87AB476DCF76E72010632B5550955F5, E6E74D3A86A7917A8BAED44F8E97CCD2EB171E4E4B27E9907F60D1523FAF319A ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
13:10:05.0468 0x065c IpInIp - ok
13:10:05.0578 0x065c [ CC748EA12C6EFFDE940EE98098BF96BB, AF523E21C25D9A1715EFEA573E4F52AF5D4FC9F28A2D613F5DB629C186C439E0 ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
13:10:05.0656 0x065c IpNat - ok
13:10:05.0734 0x065c [ 23C74D75E36E7158768DD63D92789A91, 394D296F38E7D8EFD91A6EEC301D9CE6AF910E35EB9819F1A9E3363863AEDFDC ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
13:10:05.0781 0x065c IPSec - ok
13:10:05.0859 0x065c [ ACA5E7B54409F9CB5EED97ED0C81120E, 1E22F442EA77596F58D133F1A5887CDC4F3325DD0836D24A665E1D31287ABFF7 ] irda C:\WINDOWS\system32\DRIVERS\irda.sys
13:10:05.0921 0x065c irda - ok
13:10:05.0953 0x065c [ C93C9FF7B04D772627A3646D89F7BF89, 805FA48E7A46D4F10240BF880A2468F53DEA36E83004399228AB70DB7D20544A ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
13:10:05.0953 0x065c IRENUM - ok
13:10:05.0984 0x065c [ 2EFE1DB1EC58A26B0C14BFDA122E246F, E2C67BE65337D1102777F4180D366BE54EBC8EAA35A1FA8FC10DD18C14963371 ] Irmon C:\WINDOWS\System32\irmon.dll
13:10:06.0000 0x065c Irmon - ok
13:10:06.0062 0x065c [ 6DFB88F64135C525433E87648BDA30DE, 8233EEFBEF36AAA152F2C55D23D7118F0DE40C9C22EB5D9793405A4770889540 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
13:10:06.0078 0x065c isapnp - ok
13:10:06.0125 0x065c [ 1704D8C4C8807B889E43C649B478A452, E854C90CD301F42BE2520CEDAD35E49DF2D43606CF4EEED861B74882118D04D1 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
13:10:06.0140 0x065c Kbdclass - ok
13:10:06.0187 0x065c [ B6D6C117D771C98130497265F26D1882, E79CC4EA5C088F988BA61F80764F9CAD9B78BC56A7E17DD54622C75483BC5DF4 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
13:10:06.0203 0x065c kbdhid - ok
13:10:06.0312 0x065c [ 692BCF44383D056AED41B045A323D378, 1A99DEE83FFAF64E73067FC049C0A4CE07D94E4AE31EFA17B38CEFA9E41D67DC ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
13:10:06.0406 0x065c kmixer - ok
13:10:06.0484 0x065c [ B467646C54CC746128904E1654C750C1, 3BD71BE3663EA23463D236D8A2A2E42DFA10C502BDB4B6E131FAF0FBA748219E ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
13:10:06.0515 0x065c KSecDD - ok
13:10:06.0609 0x065c [ 2BBDCB79900990F0716DFCB714E72DE7, 6283789201164A9254632D9A3C8A54FE697717D5F8D5A37804D924DC2B70C8E3 ] LanmanServer C:\WINDOWS\System32\srvsvc.dll
13:10:06.0671 0x065c LanmanServer - ok
13:10:06.0765 0x065c [ 1869B14B06B44B44AF70548E1EA3303F, 4D63B4DAF580C86F86837C7D1753E2105B4C52E26D4CA0CAAFE83755EFF7AFBE ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
13:10:06.0843 0x065c lanmanworkstation - ok
13:10:06.0843 0x065c lbrtfdc - ok
13:10:06.0890 0x065c [ 636714B7D43C8D0C80449123FD266920, F06F6C7DC49B26EFCAC3570C67BA9BD934F62C6F382DA4DD2AB302C7B970F414 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
13:10:06.0906 0x065c LmHosts - ok
13:10:06.0921 0x065c [ A027DE1E6C11BD2DAF61F6F276B2299F, E2B7A9EDE85DB440FE6ECBD87976B00F01A5BB5DB8D19A38AE8AE66A9962128E ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
13:10:06.0937 0x065c mdmxsdk - ok
13:10:06.0984 0x065c [ B7550A7107281D170CE85524B1488C98, A3854B16A65436BEF6BEDE918B43B3BE8F00D303660DB5831DD376271DC43239 ] Messenger C:\WINDOWS\System32\msgsvc.dll
13:10:07.0000 0x065c Messenger - ok
13:10:07.0031 0x065c [ 4AE068242760A1FB6E1A44BF4E16AFA6, 1FB771162B96AAF787AC24867B818DF8511F0780BB094FA9A38C11D8DBFE68BC ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
13:10:07.0046 0x065c mnmdd - ok
13:10:07.0062 0x065c [ C2F1D365FD96791B037EE504868065D3, 87BD87E08FD00D115524B049F1A3A719AB86557D68968E7090CD0F271F985CAF ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
13:10:07.0078 0x065c mnmsrvc - ok
13:10:07.0296 0x065c [ 862F0F2F0B4867C3A85C3AC27BBC631C, 16BDB8B82008E704B80F1C1D768883185034A27FA71880B2D766426E32C9DAD7 ] Mobile Broadband HL Service C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MobileBrServ\mbbservice.exe
13:10:07.0421 0x065c Mobile Broadband HL Service - ok
13:10:07.0453 0x065c [ 6FB74EBD4EC57A6F1781DE3852CC3362, 0454509D9A31E0202C08AE17294E2682F227D177A3C73B303E4C8332757AFCA1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
13:10:07.0468 0x065c Modem - ok
13:10:07.0546 0x065c [ B24CE8005DEAB254C0251E15CB71D802, 6804A8ABDAD5EC846E7F8077D1EE9BA45D6226ACFF42C70BE3DE7C8980EF9EC4 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
13:10:07.0562 0x065c Mouclass - ok
13:10:07.0640 0x065c [ 66A6F73C74E1791464160A7065CE711A, 3C570FA1E8EF976B83759220FE95BAC9D7D48D607F91B113EDE4790D34ACBD46 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
13:10:07.0656 0x065c mouhid - ok
13:10:07.0703 0x065c [ A80B9A0BAD1B73637DBCBBA7DF72D3FD, 2A5E15ED2C24C6C65EF2F7E1FD93374774076C9D8D451E4422561F4D269C012F ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
13:10:07.0734 0x065c MountMgr - ok
13:10:07.0843 0x065c [ B4E9C7383A705628AD491CF0F87D901F, 5C0CD7133D4F5B1E0466CDB2A2210ECA57206A8BC41F37BC6324120AE5501C70 ] MozillaMaintenance C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
13:10:07.0906 0x065c MozillaMaintenance - ok
13:10:07.0921 0x065c mraid35x - ok
13:10:08.0046 0x065c [ 11D42BB6206F33FBB3BA0288D3EF81BD, 76ABCFB62C5AC549F58C231F72A99882CDEB74928104B77FE52554765C2B1A22 ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
13:10:08.0156 0x065c MRxDAV - ok
13:10:08.0437 0x065c [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0, DB9B186F7076D7B94F45041AF7B77C1AD2CAB504D683B459C6CB1C22840ED170 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
13:10:08.0734 0x065c MRxSmb - ok
13:10:08.0765 0x065c [ 35A031AF38C55F92D28AA03EE9F12CC9, 97245D204C886EE8DCCC2DEAC80A0E358A7E0C1982F77389DA50DCF091FC9DDC ] MSDTC C:\WINDOWS\system32\msdtc.exe
13:10:08.0765 0x065c MSDTC - ok
13:10:08.0812 0x065c [ C941EA2454BA8350021D774DAF0F1027, C940E978C7B66A713A0FDAB54B5F995DF59D089AFCD96221DD3222948CD49BBD ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
13:10:08.0828 0x065c Msfs - ok
13:10:08.0843 0x065c MSIServer - ok
13:10:08.0875 0x065c [ D1575E71568F4D9E14CA56B7B0453BF1, 4ABE0E24786C0D39FA2B885447E56204CA6942FB175E534DCE675D7BCF0B176A ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
13:10:08.0875 0x065c MSKSSRV - ok
13:10:08.0890 0x065c [ 325BB26842FC7CCC1FCCE2C457317F3E, C07BE560513B1FB91D756494F0BA4AEEB2E1998DE0E1C21EE83DB1183B0CEE91 ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
13:10:08.0890 0x065c MSPCLOCK - ok
13:10:08.0906 0x065c [ BAD59648BA099DA4A17680B39730CB3D, 9AD4C7C94C186C8815D0BC75DCAFB962158DA6935A244BA243EDDDEB33F9816C ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
13:10:08.0906 0x065c MSPQM - ok
13:10:08.0953 0x065c [ AF5F4F3F14A8EA2C26DE30F7A1E17136, AC93A1E4ABB0D038B772E429015567E44CC2EDB66C54DBE23A5F98176FAC1520 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
13:10:08.0968 0x065c mssmbios - ok
13:10:09.0046 0x065c [ DE6A75F5C270E756C5508D94B6CF68F5, FCC972DDC36C2C44D836913F10004C2C33B11C54DEFFF0C63E0FDF901D2F9261 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
13:10:09.0093 0x065c Mup - ok
13:10:09.0234 0x065c [ 46BB15AE2AC7D025D6D2567B876817BD, 102A101B96D1078C98FA0F871C801A9A8538E20E5686AB0C7680B2F6C92B3165 ] napagent C:\WINDOWS\System32\qagentrt.dll
13:10:09.0343 0x065c napagent - ok
13:10:09.0453 0x065c [ 1DF7F42665C94B825322FAE71721130D, FE0DCB728471465B39A42A7511F4133021FBA5DF88F88BCB5FE2FF34CFD713F9 ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
13:10:09.0531 0x065c NDIS - ok
13:10:09.0578 0x065c [ 0109C4F3850DFBAB279542515386AE22, 4F6DB1E499AC853FD36FD603FBB6D3AC9BDCEB298C7FE1FB59A9236CB46729B2 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
13:10:09.0578 0x065c NdisTapi - ok
13:10:09.0625 0x065c [ F927A4434C5028758A842943EF1A3849, B1AA3AF150C05307461774925901789456B0CCCD03A5E71ADA4AB58455962BEE ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
13:10:09.0625 0x065c Ndisuio - ok
13:10:09.0718 0x065c [ EDC1531A49C80614B2CFDA43CA8659AB, 494042F790F33721328B4451E79842E21919681CC421A4F9633EC4D383E06097 ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
13:10:09.0765 0x065c NdisWan - ok
13:10:09.0812 0x065c [ 2F597BB467E05B1FE3830EABD821B8E0, 141497F5A49D47CCE3C9289644F4BD838DCB238F6D8E847FC006652E21FE02AC ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
13:10:09.0843 0x065c NDProxy - ok
13:10:09.0875 0x065c [ 5D81CF9A2F1A3A756B66CF684911CDF0, 7989C36607CAEA17AFA2C1C9904145CA0714A54B9F712D9D4C1AB140D0B2CC0C ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
13:10:09.0890 0x065c NetBIOS - ok
13:10:10.0000 0x065c [ 74B2B2F5BEA5E9A3DC021D685551BD3D, 7932B71F98B4122BE88F576BF6D745A757AE378A48924B7F4358837B75640A82 ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
13:10:10.0093 0x065c NetBT - ok
13:10:10.0156 0x065c [ 8ACE4251BFFD09CE75679FE940E996CC, 81969521B5EAEA09ECA63058BE9697BB69AF2596339CA9DF0CFEDC031DCFDC7E ] NetDDE C:\WINDOWS\system32\netdde.exe
13:10:10.0203 0x065c NetDDE - ok
13:10:10.0250 0x065c [ 8ACE4251BFFD09CE75679FE940E996CC, 81969521B5EAEA09ECA63058BE9697BB69AF2596339CA9DF0CFEDC031DCFDC7E ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
13:10:10.0250 0x065c NetDDEdsdm - ok
13:10:10.0281 0x065c [ AFB8261B56CBA0D86AEB6DF682AF9785, 104D96F1F19DD4CE492064ACC9634406A019EAE20B42D03198E400E661897127 ] Netlogon C:\WINDOWS\system32\lsass.exe
13:10:10.0296 0x065c Netlogon - ok
13:10:10.0453 0x065c [ E6D88F1F6745BF00B57E7855A2AB696C, 12A5EDD853600FF5EBF91E127077745AE1E61E66DBC1D4D4306570F171AF4A39 ] Netman C:\WINDOWS\System32\netman.dll
13:10:10.0562 0x065c Netman - ok
13:10:10.0640 0x065c [ D22CD77D4F0D63D1169BB35911BFF12D, 85B1FDFA02E1B8EA4FCB9B7EEB687C5C448697FC7EC9D178C5A2F64D2C9CFEE8 ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
13:10:10.0703 0x065c NetTcpPortSharing - ok
13:10:14.0406 0x065c [ 72062B53186E4A3F5FCBC41EBB62B905, F8C34C6EF26E67423742C50F39FB4888601F3BFC7DD4FD0EEC59A37A21F3D77F ] NETwLx32 C:\WINDOWS\system32\DRIVERS\NETwLx32.sys
13:10:18.0046 0x065c NETwLx32 - ok
13:10:18.0265 0x065c [ F1B67B6B0751AE0E6E964B02821206A3, 3D5A7593ABDEE2047C5738671C85DC8B95A4ECF58D5D7B04EEE13A689839A540 ] Nla C:\WINDOWS\System32\mswsock.dll
13:10:18.0406 0x065c Nla - ok
13:10:18.0437 0x065c [ 3182D64AE053D6FB034F44B6DEF8034A, 4ADFC76965BA2A5F488E71789A4E4EA702A74AF42725F72130D1CA919406CF19 ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
13:10:18.0453 0x065c Npfs - ok
13:10:18.0484 0x065c [ 2ADC0CA9945C65284B3D19BC18765974, A8E2B848E85A3B38350F4134DE9CA6749854B988F9A0087C60D97E19D474CBF3 ] NSCIRDA C:\WINDOWS\system32\DRIVERS\nscirda.sys
13:10:18.0500 0x065c NSCIRDA - ok
13:10:18.0843 0x065c [ 78A08DD6A8D65E697C18E1DB01C5CDCA, E0E6F3ED05068E32F1D5C2D2B38CDEF4536B8656DB6756C66CF6B40B60C8F3DA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
13:10:19.0125 0x065c Ntfs - ok
13:10:19.0156 0x065c [ AFB8261B56CBA0D86AEB6DF682AF9785, 104D96F1F19DD4CE492064ACC9634406A019EAE20B42D03198E400E661897127 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
13:10:19.0156 0x065c NtLmSsp - ok
13:10:19.0343 0x065c [ 56AF4064996FA5BAC9C449B1514B4770, 154602EFEC22728503D4ABA025DF711B0F2CFC983F5E3BF25F2A4BCD1AE250EC ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
13:10:19.0515 0x065c NtmsSvc - ok
13:10:19.0531 0x065c [ 73C1E1F395918BC2C6DD67AF7591A3AD, B21133A75253EC15E2DFF66D3B480AB1A7E1A2360476C810E7AA55D0F0EB08D4 ] Null C:\WINDOWS\system32\drivers\Null.sys
13:10:19.0546 0x065c Null - ok
13:10:19.0578 0x065c [ B305F3FAD35083837EF46A0BBCE2FC57, 9D0E0E666D652D0FC9EAB97280A5D67AAF61D6B21929DF7CF8ED72A367720464 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
13:10:19.0609 0x065c NwlnkFlt - ok
13:10:19.0625 0x065c [ C99B3415198D1AAB7227F2C88FD664B9, DD8DA4B5E804F134AB9233859544C025062902DFC3E8FB8A09A67337A4E73F55 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
13:10:19.0640 0x065c NwlnkFwd - ok
13:10:20.0046 0x065c [ 785F487A64950F3CB8E9F16253BA3B7B, 02445344BD214370A6D48B1CA04921D8EFCB13E676B5648266DD0E076C0822B6 ] odserv C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
13:10:20.0390 0x065c odserv - ok
13:10:20.0500 0x065c [ 5A432A042DAE460ABE7199B758E8606C, 6E5D1F477D290905BE27CEBF9572BAC6B05FFEF2FAD901D3C8E11F665F8B9A71 ] ose C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
13:10:20.0578 0x065c ose - ok
13:10:20.0640 0x065c [ F84785660305B9B903FB3BCA8BA29837, BDBDE61076800415D98759077E9E039C80B55DBE68E31F8BF44A909C6C3D3276 ] Parport C:\WINDOWS\system32\drivers\Parport.sys
13:10:20.0687 0x065c Parport - ok
13:10:20.0703 0x065c [ BEB3BA25197665D82EC7065B724171C6, 7E71C13BA30CD95CEE8A9CC85E6F48A01F30EDEAADEE69D80AE828BF97E5A5CA ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
13:10:20.0718 0x065c PartMgr - ok
13:10:20.0750 0x065c [ C2BF987829099A3EAA2CA6A0A90ECB4F, 1DF21EA8E43875CFEECD869407429F82FB449707CFB845718499468E699BAAAA ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
13:10:20.0750 0x065c ParVdm - ok
13:10:20.0812 0x065c [ 387E8DEDC343AA2D1EFBC30580273ACD, 5F3E642BDB759777E570ED5B22AC7E93CDCD362708F281657AD7BAB44EDEC802 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
13:10:20.0843 0x065c PCI - ok
13:10:20.0843 0x065c PCIDump - ok
13:10:20.0859 0x065c [ 59BA86D9A61CBCF4DF8E598C331F5B82, 822D11C5CE77BFD7B2F25350CCBF92B0B9388EEA6D86ED220B768C720976D839 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
13:10:20.0875 0x065c PCIIde - ok
13:10:20.0937 0x065c [ A2A966B77D61847D61A3051DF87C8C97, 6CED7CA26DC62B0AAFC83A2E07336DAD25954491201BB8E06103971F3F0B8B51 ] Pcmcia C:\WINDOWS\system32\DRIVERS\pcmcia.sys
13:10:20.0984 0x065c Pcmcia - ok
13:10:21.0000 0x065c PDCOMP - ok
13:10:21.0000 0x065c PDFRAME - ok
13:10:21.0000 0x065c PDRELI - ok
13:10:21.0015 0x065c PDRFRAME - ok
13:10:21.0015 0x065c perc2 - ok
13:10:21.0015 0x065c perc2hib - ok
13:10:21.0109 0x065c [ A3EDBE9053889FB24AB22492472B39DC, 6F2ED6E04BDE2FCA2A8BF9BD2D1D6923DE6EAECB46F582B6C0BD1CF364D65C9E ] PlugPlay C:\WINDOWS\system32\services.exe
13:10:21.0109 0x065c PlugPlay - ok
13:10:21.0187 0x065c [ A38B3CE68E7F126190CDE4AA3FDF050F, 12D8F8FC8229BE7B76EF6B62670DDA36187BB3A69FB58FFAFAD75460B15CC76E ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.exe
13:10:21.0218 0x065c Pml Driver HPZ12 - ok
13:10:21.0250 0x065c [ AFB8261B56CBA0D86AEB6DF682AF9785, 104D96F1F19DD4CE492064ACC9634406A019EAE20B42D03198E400E661897127 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
13:10:21.0250 0x065c PolicyAgent - ok
13:10:21.0281 0x065c [ EFEEC01B1D3CF84F16DDD24D9D9D8F99, C5F0C8C66A3AF7E7BB04CEDE4AC5306F8387AB384A2107DC5BE413AAE968EFF1 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
13:10:21.0312 0x065c PptpMiniport - ok
13:10:21.0406 0x065c processor - ok
13:10:21.0421 0x065c [ AFB8261B56CBA0D86AEB6DF682AF9785, 104D96F1F19DD4CE492064ACC9634406A019EAE20B42D03198E400E661897127 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
13:10:21.0421 0x065c ProtectedStorage - ok
13:10:21.0468 0x065c [ 09298EC810B07E5D582CB3A3F9255424, 35473A1BE25AC289474090EB0806AC6B3035DC33D1F3DF97A14BF1E361AC6AC3 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
13:10:21.0500 0x065c PSched - ok
13:10:21.0531 0x065c [ 80D317BD1C3DBC5D4FE7B1678C60CADD, DA76804B55D0CAB3DDD01EFC06673764AE4860693375C658B6063FB14AF7F12C ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
13:10:21.0546 0x065c Ptilink - ok
13:10:21.0546 0x065c ql1080 - ok
13:10:21.0546 0x065c Ql10wnt - ok
13:10:21.0562 0x065c ql12160 - ok
13:10:21.0562 0x065c ql1240 - ok
13:10:21.0562 0x065c ql1280 - ok
13:10:21.0593 0x065c [ FE0D99D6F31E4FAD8159F690D68DED9C, 998685622ABE631984B7E4DBF91AB3594B1F574378D75EB9F6265F4650470692 ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
13:10:21.0593 0x065c RasAcd - ok
13:10:21.0671 0x065c [ F5BA6CACCDB66C8F048E867563203246, AFEAD8FC02313F7EBC8F9F39E7ED2868852B480BE3902FA7BD0AFD81492AB243 ] RasAuto C:\WINDOWS\System32\rasauto.dll
13:10:21.0718 0x065c RasAuto - ok
13:10:21.0734 0x065c [ 0207D26DDF796A193CCD9F83047BB5FC, 13613036BCB869FBD7229A0FE25D324710308385D8C35E5D990A40E52BE040DF ] Rasirda C:\WINDOWS\system32\DRIVERS\rasirda.sys
13:10:21.0734 0x065c Rasirda - ok
13:10:21.0796 0x065c [ 11B4A627BC9614B885C4969BFA5FF8A6, EAE0A412A2B0F68919C32A96B3A08CC1A06585E4998819F5C9051745F63FF5AD ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
13:10:21.0828 0x065c Rasl2tp - ok
13:10:21.0937 0x065c [ F9A7B66EA345726EDB5862A46B1ECCD5, 5D35429D394D36A1692A7E219BA1A85CD8096FEAE0F90BFE036A63118FEDBF57 ] RasMan C:\WINDOWS\System32\rasmans.dll
13:10:22.0046 0x065c RasMan - ok
13:10:22.0078 0x065c [ 5BC962F2654137C9909C3D4603587DEE, A5CE5653D0105240F5E86CFAAB89E7917D42D939E2F27A5A7D6979289CA651B8 ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
13:10:22.0093 0x065c RasPppoe - ok
13:10:22.0109 0x065c [ FDBB1D60066FCFBB7452FD8F9829B242, 10A2DACF944BD000032EBA8C095CB3D879CC55B28C377ADF6E52E508E47444DB ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
13:10:22.0125 0x065c Raspti - ok
13:10:22.0234 0x065c [ 7AD224AD1A1437FE28D89CF22B17780A, 6645235CA27D671954E3557FA37082881C3D7D47492C71264CD8CB8D108EC801 ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
13:10:22.0328 0x065c Rdbss - ok
13:10:22.0359 0x065c [ 4912D5B403614CE99C28420F75353332, 975341ECD660209987B5E5171B8315E032439E408CBE8A5986E67AF767F373BB ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
13:10:22.0359 0x065c RDPCDD - ok
13:10:22.0500 0x065c [ 15CABD0F7C00C47C70124907916AF3F1, 66B5C978B7FB6359AD8BAC9F568FE9D469E358FEAB07B1F129BA9E85F1DF723E ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
13:10:22.0609 0x065c rdpdr - ok
13:10:22.0718 0x065c [ 43AF5212BD8FB5BA6EED9754358BD8F7, AF330F61CECA4AFA359CEABC5EB3227E6B56A9A2DCE50701381D665122D7356D ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
13:10:22.0781 0x065c RDPWD - ok
13:10:22.0843 0x065c [ 263AF18AF0F3DB99F574C95F284CCEC9, 2BFA9952E97EFEB386FC56EC2C125080CD12DAC078DBE43C395CB4D9F22165D3 ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
13:10:22.0890 0x065c RDSessMgr - ok
13:10:22.0968 0x065c [ ED761D453856F795A7FE056E42C36365, EF026585B33415D8FCE94A9F27D7A4396C7C35C88E06A4CF0FEA702401E8597A ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
13:10:23.0000 0x065c redbook - ok
13:10:23.0296 0x065c [ 03D281098CE722210C48E1E8CAFEA260, 371BFCAF8AC64F321C853DFDC172998F8649B6EBBE515AFBB67AB8D1AE27740C ] RegSrvc C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe
13:10:23.0578 0x065c RegSrvc - ok
13:10:23.0640 0x065c [ 0E97EC96D6942CEEC2D188CC2EB69A01, D4253B4420BEF19451A55AB91E4834482181A31A31134F6E2AFE05C8E20C81A5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
13:10:23.0656 0x065c RemoteAccess - ok
13:10:23.0718 0x065c [ E4CD1F3D84E1C2CA0B8CF7501E201593, 649CC0B04F94D407EB6B4C7FDE2C6E4D2B1531307BC67C5775E44D66EF2E4F8A ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
13:10:23.0750 0x065c RemoteRegistry - ok
13:10:23.0828 0x065c [ 2A02E21867497DF20B8FC95631395169, D89E2D17ED4E1C727847C0E92D2DF68AEB70BF0B956BD2FE024ED70A961759D2 ] RpcLocator C:\WINDOWS\system32\locator.exe
13:10:23.0859 0x065c RpcLocator - ok
13:10:24.0093 0x065c [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B, ECFBACE3CBF2384948EA1C445BDA3955EB4F44A9874286E6537C67DC1283E5B0 ] RpcSs C:\WINDOWS\System32\rpcss.dll
13:10:24.0109 0x065c RpcSs - ok
13:10:24.0187 0x065c [ 4BDD71B4B521521499DFD14735C4F398, 7B1498D3C67E56D05B58B7DA319ECB0117C37963AABB0E59B42831C087469DA1 ] RSVP C:\WINDOWS\system32\rsvp.exe
13:10:24.0250 0x065c RSVP - ok
13:10:24.0796 0x065c [ 91843B70A7867D68FD59E1A60BA9D2B8, 93DD29E5F83AE076E33FFDA30D62EEDDF51CEA72911E385719C43BBAED25DE72 ] S24EventMonitor C:\Programme\Intel\WiFi\bin\S24EvMon.exe
13:10:25.0328 0x065c S24EventMonitor - ok
13:10:25.0359 0x065c [ 27FC71DA659305E260ACBDA15A318399, 1EBE27909E282454F49D22B4540A2DF8B774466453E928DB98330B9E83206A10 ] s24trans C:\WINDOWS\system32\DRIVERS\s24trans.sys
13:10:25.0375 0x065c s24trans - ok
13:10:25.0390 0x065c [ AFB8261B56CBA0D86AEB6DF682AF9785, 104D96F1F19DD4CE492064ACC9634406A019EAE20B42D03198E400E661897127 ] SamSs C:\WINDOWS\system32\lsass.exe
13:10:25.0390 0x065c SamSs - ok
13:10:25.0468 0x065c [ DCEC079FAD95D36C8DD5CB6D779DFE32, F8546552D939A225853A0CE4913701A93738DF02C999D16E141E9A828814BBC6 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
13:10:25.0515 0x065c SCardSvr - ok
13:10:25.0656 0x065c [ A050194A44D7FA8D7186ED2F4E8367AE, BCDF56D5A2F9E202DC67E7FE4BCC617BCC0BDFF2D221A621020068B17B2855BB ] Schedule C:\WINDOWS\system32\schedsvc.dll
13:10:25.0765 0x065c Schedule - ok
13:10:25.0796 0x065c [ 90A3935D05B494A5A39D37E71F09A677, F72733A69BC6E1A2BB91D7632FF3463C12563F60FDCC00A2CDD67FF20D479952 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
13:10:25.0812 0x065c Secdrv - ok
13:10:25.0843 0x065c [ BEE4CFD1D48C23B44CF4B974B0B79B2B, DF3B02D713F8A4602BE75F004074D5DF79AFF2D58FF37110B2A6AC29F680758B ] seclogon C:\WINDOWS\System32\seclogon.dll
13:10:25.0859 0x065c seclogon - ok
13:10:25.0890 0x065c [ 2AAC9B6ED9EDDFFB721D6452E34D67E3, 95D83F054A6610328D56E56CD948A6618C590231853E56FC20E7557DB61384A4 ] SENS C:\WINDOWS\system32\sens.dll
13:10:25.0906 0x065c SENS - ok
13:10:25.0953 0x065c [ CF24EB4F0412C82BCD1F4F35A025E31D, B74CB094126F5C23F601C34D53B2DF5BE3E5918230AC9DCFCFFA8E66B3A0FA25 ] Serial C:\WINDOWS\system32\drivers\Serial.sys
13:10:25.0984 0x065c Serial - ok
13:10:26.0031 0x065c [ 8E6B8C671615D126FDC553D1E2DE5562, CEEC0067514555D5CA489F50E3D7562FCA8DB8E952C3C878604C9277FC77959F ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
13:10:26.0031 0x065c Sfloppy - ok
13:10:26.0234 0x065c [ CAD058D5F8B889A87CA3EB3CF624DCEF, A7CDCF44261D1F4D820927253EA8EBB63714B7BAFF8B08DE073507D9A7EEA5BB ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
13:10:26.0421 0x065c SharedAccess - ok
13:10:26.0500 0x065c [ 2DB7D303C36DDD055215052F118E8E75, BE6E7BBE12A7A4EDF1F1C2935350603970C7426BBCA7A1A6644BB8999123AF17 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
13:10:26.0515 0x065c ShellHWDetection - ok
13:10:26.0515 0x065c Simbad - ok
13:10:28.0281 0x065c [ 0F97E7A47A52F4A36969F0FC319654C2, 8A9E5974DE60F993BED44ACAAC469B146D6C91ECB8E3D14BF66E6D1634AC604E ] Skype C2C Service C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe
13:10:30.0015 0x065c Skype C2C Service - ok
13:10:30.0171 0x065c [ 50D9949020E02B847CD48F1243FCB895, 5BDAD5E44DE5B412645142810C5FCE4B2D9685F928FF4A6B836A9DCE7725BD78 ] SkypeUpdate C:\Programme\Skype\Updater\Updater.exe
13:10:30.0265 0x065c SkypeUpdate - ok
13:10:30.0468 0x065c [ 37DD3CEF1FFB90D5828BCC44485063A9, C70910CD2E601DF6B068779E313D211925F4980F8C6FB7C5A47F6F072E8663D4 ] sound C:\WINDOWS\assembly\GAC_MSIL\PresentationUI\3.0.0.0__31bf3856ad364e35\age_of_onset\screen.exe
13:10:30.0578 0x065c sound - ok
13:10:30.0578 0x065c Have new async UDS detects: 1
13:10:30.0578 0x065c sound - detected UDS:DangerousObject.Multi.Generic ( 0 )
13:10:30.0578 0x065c sound ( UDS:DangerousObject.Multi.Generic ) - infected
13:10:30.0578 0x065c Force sending object to P2P due to detect: sound
13:10:30.0781 0x065c Object send P2P result: true
13:10:30.0921 0x065c Sparrow - ok
13:10:30.0968 0x065c [ AB8B92451ECB048A4D1DE7C3FFCB4A9F, DD17733CBB370FCA08F0296704D7CBEACA3C8F76D0ABE4761C3B1FFDF7481D9E ] splitter C:\WINDOWS\system32\drivers\splitter.sys
13:10:30.0984 0x065c splitter - ok
13:10:31.0046 0x065c [ 60784F891563FB1B767F70117FC2428F, E0B07F08E60FFBAD36C2E58180F4B2A16DCA47716044CBE0213DF7B74D742F1F ] Spooler C:\WINDOWS\system32\spoolsv.exe
13:10:31.0078 0x065c Spooler - ok
13:10:31.0515 0x065c [ 71E276F6D189413266EA22171806597B, AF3DF0DEF023ADBC81D742424B57581D7680FA4FA64B761BEAEEE60C9FCD34BF ] sptd C:\WINDOWS\System32\Drivers\sptd.sys
13:10:31.0906 0x065c sptd - ok
13:10:31.0968 0x065c [ 50FA898F8C032796D3B1B9951BB5A90F, 1C86273EC19EB96D6DB9CE6670C00683B77C99C42CC2F7E75BC50872B93446B1 ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
13:10:32.0000 0x065c sr - ok
13:10:32.0125 0x065c [ FE77A85495065F3AD59C5C65B6C54182, EB4BAF992F961B2FD5D24BFCB6BCB2142BC32933139A818835FEAB190E4283BB ] srservice C:\WINDOWS\system32\srsvc.dll
13:10:32.0218 0x065c srservice - ok
13:10:32.0421 0x065c [ 47DDFC2F003F7F9F0592C6874962A2E7, 17C643BD4EB09B5666FE41817DC785BE04A6E491CE79E8E5A702CDBD98E1BDD7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
13:10:32.0625 0x065c Srv - ok
13:10:32.0703 0x065c [ 4DF5B05DFAEC29E13E1ED6F6EE12C500, 2971D7D45D6942D310D47DBD19B9680D2D29527E79B86133C72217FD29259465 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
13:10:32.0750 0x065c SSDPSRV - ok
13:10:32.0750 0x065c StarOpen - ok
13:10:32.0953 0x065c [ BC2C5985611C5356B24AEB370953DED9, 15CBAB8166827DC098E2B16AB6F49A1441A4CB52AF3588F0AD964CAB596DFE10 ] stisvc C:\WINDOWS\system32\wiaservc.dll
13:10:33.0140 0x065c stisvc - ok
13:10:33.0156 0x065c [ 3941D127AEF12E93ADDF6FE6EE027E0F, EA1F0E32E1C5E90FA4AAC421DEBBE086512340758D3217A6334E886BCE638B51 ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
13:10:33.0156 0x065c swenum - ok
13:10:33.0203 0x065c [ 8CE882BCC6CF8A62F2B2323D95CB3D01, B408550A581F3DA222355964AFA4E976AD8471F0AA37573C42C4948AE5A23A3B ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
13:10:33.0234 0x065c swmidi - ok
13:10:33.0234 0x065c SwPrv - ok
13:10:33.0234 0x065c symc810 - ok
13:10:33.0250 0x065c symc8xx - ok
13:10:33.0250 0x065c sym_hi - ok
13:10:33.0250 0x065c sym_u3 - ok
13:10:33.0437 0x065c [ 1CDE0A5C0416187B9B89E03980C6E8DE, FF78A9EA10521BDE3744932CF41FFC338C202E991816FF6E8F579C032828DD26 ] SynTP C:\WINDOWS\system32\DRIVERS\SynTP.sys
13:10:33.0593 0x065c SynTP - ok
13:10:33.0625 0x065c [ 8B83F3ED0F1688B4958F77CD6D2BF290, 546D3602183702B4F53E84413CFA2C933D64C8540378E54A8DCD148F3F36A2DA ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
13:10:33.0656 0x065c sysaudio - ok
13:10:33.0750 0x065c [ 2903FFFA2523926D6219428040DCE6B9, 4F13181931B0499F6C3F08138054DBCD1F84CB9806999A9172B80DE79D446F62 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
13:10:33.0781 0x065c SysmonLog - ok
13:10:33.0953 0x065c [ 05903CAC4B98908D55EA5774775B382E, AC3666CBD894D737874A5998DC7F46A0A51A7B23B1835FC735B9AD503A2191CC ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
13:10:34.0109 0x065c TapiSrv - ok
13:10:34.0328 0x065c [ 9AEFA14BD6B182D61E3119FA5F436D3D, EA29E49434585409272E7901AF89771FE9D6E911A7DC44AB3C7020CFF8A44552 ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
13:10:34.0515 0x065c Tcpip - ok
13:10:34.0562 0x065c [ 6471A66807F5E104E4885F5B67349397, F35CBFFB8BB235CCE30EF94A5273333900DD49FD506BF9D55D99A320B8A53A5A ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
13:10:34.0562 0x065c TDPIPE - ok
13:10:34.0578 0x065c [ C56B6D0402371CF3700EB322EF3AAF61, 7743FA4C734BCE38EFB1CA69BC17364D8421E2CD172F856F7E38E7AE1EE93F2F ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
13:10:34.0593 0x065c TDTCP - ok
13:10:34.0656 0x065c [ 88155247177638048422893737429D9E, B6D4E8691917946332C2208D01F8C8281978C1AD1E9951C5D99DF0D49AC34B3B ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
13:10:34.0671 0x065c TermDD - ok
13:10:34.0859 0x065c [ B7DE02C863D8F5A005A7BF375375A6A4, 6DE05A7B28CA5A78D58536347FC47F15883EEDBEF487CEA0117CC280FC582DCC ] TermService C:\WINDOWS\System32\termsrv.dll
13:10:35.0015 0x065c TermService - ok
13:10:35.0109 0x065c [ 2DB7D303C36DDD055215052F118E8E75, BE6E7BBE12A7A4EDF1F1C2935350603970C7426BBCA7A1A6644BB8999123AF17 ] Themes C:\WINDOWS\System32\shsvcs.dll
13:10:35.0125 0x065c Themes - ok
13:10:35.0187 0x065c [ 03681A1CE77F51586903869A5AB1DEAB, E2EC0A481412166B654682C2F3D953E96E757466135CBD2D813B967EDB13C721 ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe
13:10:35.0218 0x065c TlntSvr - ok
13:10:35.0218 0x065c TosIde - ok
13:10:35.0296 0x065c [ 626504572B175867F30F3215C04B3E2F, 47E87CE9BC666D5CB5953C5D497DC00A7CC28F8EC0A064B3E47700279C5C4B91 ] TrkWks C:\WINDOWS\system32\trkwks.dll
13:10:35.0343 0x065c TrkWks - ok
13:10:35.0406 0x065c [ 5787B80C2E3C5E2F56C2A233D91FA2C9, 3774905CF77954DFCECDA5BCC7CDE3D0ED72712BFAAD85ADAE5246306447E46C ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
13:10:35.0437 0x065c Udfs - ok
13:10:35.0437 0x065c ultra - ok
13:10:35.0687 0x065c [ 402DDC88356B1BAC0EE3DD1580C76A31, 32A686595710336A6BFD54C03F552AE39439611662F84EF5D24193AE5665C6F3 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
13:10:35.0906 0x065c Update - ok
13:10:36.0031 0x065c [ 1DFD8975D8C89214B98D9387C1125B49, 0B6B268487C8E45E9B86BF4A0A9DB669E0E45D600DE3C82B63F9986CA9E01082 ] upnphost C:\WINDOWS\System32\upnphost.dll
13:10:36.0140 0x065c upnphost - ok
13:10:36.0156 0x065c [ 9B11E6118958E63E1FEF129466E2BDA7, 97168BCE3F4A9BB9E6500F05E34851FB957B219C598944FADC28AC0011C0503B ] UPS C:\WINDOWS\System32\ups.exe
13:10:36.0171 0x065c UPS - ok
13:10:36.0218 0x065c [ 1B611611C28D2DF25BC057D79C6F13FC, B0D86F63E44B40413BBAE6402CC088046CFAE082D41BBC2ED5A916293356B846 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
13:10:36.0234 0x065c usbccgp - ok
13:10:36.0265 0x065c [ 4BAC8DF07F1D8434FC640E677A62204E, 76C1351AF6752224BF59DEEE0F8665FE699F3DFD679F5BCD01C7D9383E6402A4 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
13:10:36.0281 0x065c usbehci - ok
13:10:36.0343 0x065c [ 1AB3CDDE553B6E064D2E754EFE20285C, A99C4528C4227B1E96847614745AAFACD3C5F1BDFE435214DBF78740FFB300FE ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
13:10:36.0375 0x065c usbhub - ok
13:10:36.0437 0x065c [ A717C8721046828520C9EDF31288FC00, 1530BBE832EDBB0974AD89D723A03FF7A0094B368992D73C2C3E62A181DF1E0A ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
13:10:36.0453 0x065c usbprint - ok
13:10:36.0484 0x065c [ F8EDE2B6928970DCE3D5614C27D9E7F6, 6E5EBBC8B70C1D593634DAF0C190DEADFDA18C3CBC8F552A76F156F3869EF05B ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
13:10:36.0500 0x065c usbscan - ok
13:10:36.0546 0x065c [ A32426D9B14A089EAA1D922E0C5801A9, ED1DC52EE45F8EAD3AEC4B1F817BB25634141CF48295494C5947DCE6CF7A9817 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
13:10:36.0562 0x065c USBSTOR - ok
13:10:36.0578 0x065c [ 26496F9DEE2D787FC3E61AD54821FFE6, 8BE7FF647470B9A951CBB478FAF83D657A15CC78037F42348A6B738F21D523DA ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
13:10:36.0593 0x065c usbuhci - ok
13:10:36.0625 0x065c [ B4D7B7AD8A9F7C063C5CC3E2C1A0724E, CFA47A71403419CA7C94333B4F7766DFC97C5DCDBC3AD1B106044B93C979A5C5 ] usb_rndisx C:\WINDOWS\system32\DRIVERS\usb8023x.sys
13:10:36.0640 0x065c usb_rndisx - ok
13:10:36.0671 0x065c [ 0D3A8FAFCEACD8B7625CD549757A7DF1, B9CFDEFCD66AA139F3DC2F967B184669532922563AD5A71769BABDC4370D065E ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
13:10:36.0687 0x065c VgaSave - ok
13:10:36.0687 0x065c ViaIde - ok
13:10:36.0750 0x065c [ A5A712F4E880874A477AF790B5186E1D, FE885ED04C3EAFC379787F836738A2769E43D07CF52DD917D90C38E001957A5E ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
13:10:36.0781 0x065c VolSnap - ok
13:10:36.0906 0x065c [ 68F106273BE29E7B7EF8266977268E78, 1488AB7A654EBC94C73E1D494067189ACB95BC233980110CAC4C0297CDC4115A ] VSS C:\WINDOWS\System32\vssvc.exe
13:10:37.0000 0x065c VSS - ok
13:10:37.0125 0x065c [ 7B353059E665F8B7AD2BBEAEF597CF45, 84A4311F18A4B8DCB364741DEA7D18E2363F19564B2EF25214965DC729527068 ] W32Time C:\WINDOWS\system32\w32time.dll
13:10:37.0218 0x065c W32Time - ok
13:10:37.0250 0x065c [ E20B95BAEDB550F32DD489265C1DA1F6, 5589B2067E6C9FBA290D8C5EADDC198EBAF39C50C3CD7D2BC5CDA7CBFBC445E5 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
13:10:37.0265 0x065c Wanarp - ok
13:10:37.0281 0x065c WDICA - ok
13:10:37.0343 0x065c [ 6768ACF64B18196494413695F0C3A00F, 3A8F8586F1D997D19A8478345338D2AECD785AEABDB61531DD3F92003D3230A5 ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
13:10:37.0390 0x065c wdmaud - ok
13:10:37.0437 0x065c [ 81727C9873E3905A2FFC1EBD07265002, 6AC2383A1DCBB7FA3DB90FBB874C8E1819F5B7492717FF41E303EFC7BF72F93E ] WebClient C:\WINDOWS\System32\webclnt.dll
13:10:37.0484 0x065c WebClient - ok
13:10:37.0921 0x065c [ 115946A53B62A6B171FD0ED197C71D52, 498F5926B4EEE368CF7156243197FFB0F7A617D0A5A302A271B7256D74F445F2 ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
13:10:38.0328 0x065c winachsf - ok
13:10:38.0484 0x065c [ 6F3F3973D97714CC5F906A19FE883729, 7817118BE94D0F6FAE0F9CE48AD70FFE0AEF886CCE09C666768FAB61047F992F ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
13:10:38.0562 0x065c winmgmt - ok
13:10:38.0625 0x065c [ C51B4A5C05A5475708E3C81C7765B71D, F776D2680BD3407307B7072626F78460361FC5BC38623C9E16F394D300AB25DE ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
13:10:38.0625 0x065c WmdmPmSN - ok
13:10:39.0125 0x065c [ FFA4D901D46D07A5BAB2D8307FBB51A6, 53C6D04D111EDF774C7F7EEB8D032B372E6244774D56B1B34CF1236027EC9450 ] Wmi C:\WINDOWS\System32\advapi32.dll
13:10:39.0500 0x065c Wmi - ok
13:10:39.0609 0x065c [ 93908111BA57A6E60EC2FA2DE202105C, F395F25F18D15C6B9FEDB45FD31E10295FFE5517E2BC86ACAC11904EA0664BE2 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
13:10:39.0687 0x065c WmiApSrv - ok
13:10:40.0093 0x065c [ BF05650BB7DF5E9EBDD25974E22403BB, AF173D89B768CFC7AB03DFADD4F049CAC40AC59A0C9208AF5AB92CB368983077 ] WMPNetworkSvc C:\Programme\Windows Media Player\WMPNetwk.exe
13:10:40.0421 0x065c WMPNetworkSvc - ok
13:10:40.0812 0x065c [ 15673BD0B86150CB8E27766059C72A9B, 56C23289A8BFF4945EE532CF6D62D3EC81B827CA15A359F30A327789F9FE9CAF ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
13:10:41.0125 0x065c WPFFontCache_v0400 - ok
13:10:41.0156 0x065c [ 6ABE6E225ADB5A751622A9CC3BC19CE8, 4061C5D0F051DFF1730E2A3BFC1CCA97B29602FC50F10F6B44D93B0D28F42024 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys
13:10:41.0156 0x065c WS2IFSL - ok
13:10:41.0234 0x065c [ 300B3E84FAF1A5C1F791C159BA28035D, 0194856BDF94C1F274AF70AD558290ACDACDDEA331BD66FEB8E167ABD1E36786 ] wscsvc C:\WINDOWS\system32\wscsvc.dll
13:10:41.0281 0x065c wscsvc - ok
13:10:41.0328 0x065c [ 7B4FE05202AA6BF9F4DFD0E6A0D8A085, A1DB8909FA73337DB613D01824945485186654364A4DF129B8CB913CF87D1D2E ] wuauserv C:\WINDOWS\system32\wuauserv.dll
13:10:41.0328 0x065c wuauserv - ok
13:10:41.0390 0x065c [ F15FEAFFFBB3644CCC80C5DA584E6311, 79B3E9AF35976CE49921E9BEA3BA3B4A8AF762FD3F284B62954038B5FFB32471 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
13:10:41.0421 0x065c WudfPf - ok
13:10:41.0468 0x065c [ 28B524262BCE6DE1F7EF9F510BA3985B, AEFF02B899801A63CBB262757C3D4369E38BFF0690BD085DE60E873DFBE3C3F4 ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
13:10:41.0515 0x065c WudfRd - ok
13:10:41.0562 0x065c [ 05231C04253C5BC30B26CBAAE680ED89, 5C03C2D7E0B573646D32F4093E2FF2C3BA391C39F5BA37D67F69D38E357FCC3D ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
13:10:41.0593 0x065c WudfSvc - ok
13:10:41.0875 0x065c [ C4F109C005F6725162D2D12CA751E4A7, AC996B44338328BDD4442FE48406F286A64526F0EC77BE00A19FA7FDB0407CFE ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
13:10:42.0140 0x065c WZCSVC - ok
13:10:42.0203 0x065c [ 0ADA34871A2E1CD2CAAFED1237A47750, 45BEF8649078BD74C1A347B5F2D3A1958E5A7DCD6C6BA8A2E0CAD277A929C64E ] xmlprov C:\WINDOWS\System32\xmlprov.dll
13:10:42.0250 0x065c xmlprov - ok
13:10:42.0265 0x065c ================ Scan global ===============================
13:10:42.0312 0x065c [ 2C60091CA5F67C3032EAB3B30390C27F, 9E205C8E67F4B61FCFA2A82AA1968D522C3B6410D7075BE813F7F1564D61632E ] C:\WINDOWS\system32\basesrv.dll
13:10:42.0546 0x065c [ E62178BC21EAC63A3B9A2DBD46C1B505, CAA5480CC4DAA37758F0CF445F865FD6F4630080B044EF2E606C2F62DAA4061A ] C:\WINDOWS\system32\winsrv.dll
13:10:42.0875 0x065c [ E62178BC21EAC63A3B9A2DBD46C1B505, CAA5480CC4DAA37758F0CF445F865FD6F4630080B044EF2E606C2F62DAA4061A ] C:\WINDOWS\system32\winsrv.dll
13:10:42.0968 0x065c [ A3EDBE9053889FB24AB22492472B39DC, 6F2ED6E04BDE2FCA2A8BF9BD2D1D6923DE6EAECB46F582B6C0BD1CF364D65C9E ] C:\WINDOWS\system32\services.exe
13:10:42.0968 0x065c [ Global ] - ok
13:10:42.0968 0x065c ================ Scan MBR ==================================
13:10:43.0000 0x065c [ 72B8CE41AF0DE751C946802B3ED844B4 ] \Device\Harddisk0\DR0
13:10:43.0343 0x065c \Device\Harddisk0\DR0 - ok
13:10:43.0343 0x065c ================ Scan VBR ==================================
13:10:43.0359 0x065c [ 94C25F30A8DA0258ADB296CA6ADB0063 ] \Device\Harddisk0\DR0\Partition1
13:10:43.0359 0x065c \Device\Harddisk0\DR0\Partition1 - ok
13:10:43.0359 0x065c ================ Scan generic autorun ======================
13:10:43.0906 0x065c [ 115332A83AC2726FA974D30DB4BFD8DE, D86869A8CA6824CF8D3703420FCF6EC3E7E70CEEF05E230BDE1250C4550C7356 ] C:\Programme\Analog Devices\Core\smax4pnp.exe
13:10:44.0437 0x065c SoundMAXPnP - ok
13:10:44.0578 0x065c [ 976BB46B1F9D2DAC8B31047DA1CF9E6B, 2D915AA0B6639AAE2284AF5B70E5270DBC47F19CEEFD5C075FD455042C2CF404 ] C:\WINDOWS\system32\igfxtray.exe
13:10:44.0671 0x065c IgfxTray - ok
13:10:44.0781 0x065c [ 2E11FD52DF7369342522F91EC6D3D5C3, D792B54569D1E7AFD9F9E5FC0585AAE0246C2DC15AAA3550049AB55E5702050A ] C:\WINDOWS\system32\hkcmd.exe
13:10:44.0875 0x065c HotKeysCmds - ok
13:10:44.0968 0x065c [ 5B32B439FE7EE1E87826E991D1A7672F, 07533F4F10E128260F4BDC799F15BBD29B2F8A6F019FD1DF084BF3A1CB54A10C ] C:\WINDOWS\system32\igfxpers.exe
13:10:45.0046 0x065c Persistence - ok
13:10:45.0171 0x065c [ 32F4B6D627297C567C7AFA929FE6430E, 601A1027F675B29F022F6C152ECD2FF3EE4F01F479EED66023C66813E50A4D83 ] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
13:10:45.0250 0x065c SynTPLpr - ok
13:10:45.0562 0x065c [ 73D90A309AB764411A07D4FE7351BB28, 8AB99368A403C9762FFB490A7417097511CECA25B4FB66002569EC4822954A5A ] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
13:10:45.0859 0x065c SynTPEnh - ok
13:10:46.0203 0x065c [ 798DD8615E7CEFA8BA9833E32FFEAAE2, D1E1010155F15433C2CAC34B5974CB8F137C7102EDEEAF85B1C6946ACD4F8D9C ] C:\Programme\FileZilla FTP Client\locales\sl_SI\eat_drink\fixed_cost.exe
13:10:46.0390 0x065c photo_gallery - ok
13:10:46.0390 0x065c Have new async UDS detects: 1
13:10:46.0390 0x065c photo_gallery - detected UDS:DangerousObject.Multi.Generic ( 0 )
13:10:46.0390 0x065c photo_gallery ( UDS:DangerousObject.Multi.Generic ) - infected
13:10:46.0390 0x065c Force sending object to P2P due to detect: C:\Programme\FileZilla FTP Client\locales\sl_SI\eat_drink\fixed_cost.exe
13:10:46.0750 0x065c Object send P2P result: true
13:11:00.0859 0x065c [ 58920E6A409046BA06548D9D139CE0F0, 73FB33F5A76A3445C494482D520448EE02C0B1B7D3DD2E97BE3A9B15F89C5911 ] C:\Programme\Skype\Phone\Skype.exe
13:11:01.0343 0x065c Skype - ok
13:11:04.0453 0x065c [ F308D7378BF60B91DA495FCAA1C216E7, 7D67B6D1CE11685F87B3CF9689AF0B089D3340A72C7A0B9633C826AEE49B405E ] C:\Programme\CCleaner\CCleaner.exe
13:11:07.0765 0x065c CCleaner Monitoring - ok
13:11:07.0906 0x065c [ D8408A5E0D4ECB4193A6738D0B052867, 08DC7706E9E46C65BA740555713D71E3F53A3FE939ECA60A1238E17A2E0A962A ] C:\Dokumente und Einstellungen\User\Anwendungsdaten\Account-weight\account-count.exe
13:11:07.0984 0x065c account-code - ok
13:11:07.0984 0x065c Have new async UDS detects: 1
13:11:07.0984 0x065c account-code - detected UDS:DangerousObject.Multi.Generic ( 0 )
13:11:07.0984 0x065c account-code ( UDS:DangerousObject.Multi.Generic ) - infected
13:11:07.0984 0x065c Force sending object to P2P due to detect: C:\Dokumente und Einstellungen\User\Anwendungsdaten\Account-weight\account-count.exe
13:11:08.0234 0x065c Object send P2P result: true
13:11:08.0578 0x065c [ BE838F0B20877D064EC78C6DDB9A0CF6, 948D495A90B7D7890CDB9ABE851BDFCABF18D89BC147AC97061FF154219DDA82 ] C:\DOKUME~1\User\LOKALE~1\Temp\Tycnav\mcjcofbkeos.exe
13:11:08.0593 0x065c Suspicious file ( NoAccess ): C:\DOKUME~1\User\LOKALE~1\Temp\Tycnav\mcjcofbkeos.exe. md5: BE838F0B20877D064EC78C6DDB9A0CF6, sha256: 948D495A90B7D7890CDB9ABE851BDFCABF18D89BC147AC97061FF154219DDA82
13:11:09.0140 0x065c zxzwkeos - detected Trojan-Spy.Win32.ZBot.gen ( 0 )
13:11:09.0140 0x065c zxzwkeos ( Trojan-Spy.Win32.ZBot.gen ) - infected
13:11:09.0140 0x065c Force sending object to P2P due to detect: C:\DOKUME~1\User\LOKALE~1\Temp\Tycnav\mcjcofbkeos.exe
13:11:09.0484 0x065c Object send P2P result: true
13:11:09.0703 0x065c [ A8A39ADEEF5A1255BE960CB04F639A11, B64C7208F179289319601FB5C3581ED947996A2DC3B5A575131773A9E706358C ] C:\Dokumente und Einstellungen\User\Anwendungsdaten\Channel-text\channeldraft.exe
13:11:09.0703 0x065c Suspicious file ( NoAccess ): C:\Dokumente und Einstellungen\User\Anwendungsdaten\Channel-text\channeldraft.exe. md5: A8A39ADEEF5A1255BE960CB04F639A11, sha256: B64C7208F179289319601FB5C3581ED947996A2DC3B5A575131773A9E706358C
13:11:09.0703 0x065c channel-shock - detected LockedFile.Multi.Generic ( 1 )
13:11:09.0703 0x065c Detect turned to UDS exact due to KSN untrusted
13:11:09.0703 0x065c channel-shock ( UDS:DangerousObject.Multi.Generic ) - infected
13:11:09.0703 0x065c Force sending object to P2P due to detect: C:\Dokumente und Einstellungen\User\Anwendungsdaten\Channel-text\channeldraft.exe
13:11:09.0937 0x065c Object send P2P result: true
13:11:10.0406 0x065c [ 2B5E3E69ABE05C3BEC8B927D4936688C, 41957818F87E7A52E9D0166C144D825CC23EFB01251A0FA7B16475E3BF2DEE34 ] C:\Dokumente und Einstellungen\User\Anwendungsdaten\Signal-forget\signal_live.exe
13:11:10.0406 0x065c Suspicious file ( NoAccess ): C:\Dokumente und Einstellungen\User\Anwendungsdaten\Signal-forget\signal_live.exe. md5: 2B5E3E69ABE05C3BEC8B927D4936688C, sha256: 41957818F87E7A52E9D0166C144D825CC23EFB01251A0FA7B16475E3BF2DEE34
13:11:10.0421 0x065c signal-contain - detected LockedFile.Multi.Generic ( 1 )
13:11:10.0421 0x065c signal-contain ( LockedFile.Multi.Generic ) - warning
13:11:10.0421 0x065c Force sending object to P2P due to detect: C:\Dokumente und Einstellungen\User\Anwendungsdaten\Signal-forget\signal_live.exe
13:11:10.0625 0x065c Object send P2P result: true
13:11:10.0937 0x065c [ AA841C94B5C8644FDFDD025AC4D84504, D88C132685789905041B45410D9003EB7A009B45C298C9D2752033964DE4E340 ] C:\DOKUME~1\User\LOKALE~1\Temp\Markretain\markpull.exe
13:11:10.0937 0x065c Suspicious file ( NoAccess ): C:\DOKUME~1\User\LOKALE~1\Temp\Markretain\markpull.exe. md5: AA841C94B5C8644FDFDD025AC4D84504, sha256: D88C132685789905041B45410D9003EB7A009B45C298C9D2752033964DE4E340
13:11:10.0968 0x065c markpersuade - detected Trojan-Spy.Win32.ZBot.gen ( 0 )
13:11:10.0968 0x065c markpersuade ( Trojan-Spy.Win32.ZBot.gen ) - infected
13:11:10.0968 0x065c Force sending object to P2P due to detect: C:\DOKUME~1\User\LOKALE~1\Temp\Markretain\markpull.exe
13:11:11.0250 0x065c Object send P2P result: true
13:11:11.0437 0x065c [ 01B4E6E990B6C5EA8856D96C7FD044B2, 2266296FD3C8E0DFA657F21406EE4E494477870DFAF7C65BEBCB6FBA8CADC7C6 ] C:\WINDOWS\system32\ctfmon.exe
13:11:11.0453 0x065c ctfmon.exe - ok
13:11:11.0562 0x065c [ 2B5E3E69ABE05C3BEC8B927D4936688C, 41957818F87E7A52E9D0166C144D825CC23EFB01251A0FA7B16475E3BF2DEE34 ] C:\Dokumente und Einstellungen\User\Anwendungsdaten\Signal-forget\signal_live.exe
13:11:11.0562 0x065c Suspicious file ( NoAccess ): C:\Dokumente und Einstellungen\User\Anwendungsdaten\Signal-forget\signal_live.exe. md5: 2B5E3E69ABE05C3BEC8B927D4936688C, sha256: 41957818F87E7A52E9D0166C144D825CC23EFB01251A0FA7B16475E3BF2DEE34
13:11:11.0562 0x065c signal-contain - detected LockedFile.Multi.Generic ( 1 )
13:11:11.0562 0x065c signal-contain ( LockedFile.Multi.Generic ) - warning
13:11:11.0562 0x065c Force sending object to P2P due to detect: C:\Dokumente und Einstellungen\User\Anwendungsdaten\Signal-forget\signal_live.exe
13:11:11.0781 0x065c Object send P2P result: true
13:11:12.0718 0x065c [ 7999235AE6A9F0FE1C007203F03A4618, D552A169E7E5EC43B675120F11E6A1790902C4068FAAFC2DE81DDB5FA50F18E8 ] C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_15_0_0_246_Plugin.exe
13:11:13.0265 0x065c FlashPlayerUpdate - ok
13:11:13.0796 0x065c Win FW state via NFM: enabled
13:11:13.0937 0x065c ============================================================
13:11:13.0937 0x065c Scan finished
13:11:13.0937 0x065c ============================================================
13:11:13.0953 0x2e14 Detected object count: 8
13:11:13.0953 0x2e14 Actual detected object count: 8
13:11:39.0109 0x2e14 sound ( UDS:DangerousObject.Multi.Generic ) - skipped by user
13:11:39.0109 0x2e14 sound ( UDS:DangerousObject.Multi.Generic ) - User select action: Skip
13:11:39.0109 0x2e14 photo_gallery ( UDS:DangerousObject.Multi.Generic ) - skipped by user
13:11:39.0109 0x2e14 photo_gallery ( UDS:DangerousObject.Multi.Generic ) - User select action: Skip
13:11:39.0109 0x2e14 account-code ( UDS:DangerousObject.Multi.Generic ) - skipped by user
13:11:39.0109 0x2e14 account-code ( UDS:DangerousObject.Multi.Generic ) - User select action: Skip
13:11:39.0109 0x2e14 zxzwkeos ( Trojan-Spy.Win32.ZBot.gen ) - skipped by user
13:11:39.0109 0x2e14 zxzwkeos ( Trojan-Spy.Win32.ZBot.gen ) - User select action: Skip
13:11:39.0109 0x2e14 channel-shock ( UDS:DangerousObject.Multi.Generic ) - skipped by user
13:11:39.0109 0x2e14 channel-shock ( UDS:DangerousObject.Multi.Generic ) - User select action: Skip
13:11:39.0125 0x2e14 signal-contain ( LockedFile.Multi.Generic ) - skipped by user
13:11:39.0125 0x2e14 signal-contain ( LockedFile.Multi.Generic ) - User select action: Skip
13:11:39.0125 0x2e14 markpersuade ( Trojan-Spy.Win32.ZBot.gen ) - skipped by user
13:11:39.0125 0x2e14 markpersuade ( Trojan-Spy.Win32.ZBot.gen ) - User select action: Skip
13:11:39.0125 0x2e14 signal-contain ( LockedFile.Multi.Generic ) - skipped by user
13:11:39.0125 0x2e14 signal-contain ( LockedFile.Multi.Generic ) - User select action: Skip
13:11:43.0703 0x08e8 Deinitialize success
Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.08.2.1001
www.malwarebytes.org
Database version: v2014.12.17.02
Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
User :: KATIE [administrator]
17.12.2014 13:19:02
mbar-log-2014-12-17 (13-19-02).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 297799
Time elapsed: 1 hour(s), 6 minute(s), 17 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 1
HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\sound (Trojan.Agent.ED) -> Delete on reboot. [5d89c89bc9b3a78f43eeb93e7091bb45]
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 2
C:\WINDOWS\assembly\GAC_MSIL\PresentationUI\3.0.0.0__31bf3856ad364e35\age_of_onset\screen.exe (Trojan.Agent.ED) -> Delete on reboot. [5d89c89bc9b3a78f43eeb93e7091bb45]
C:\WINDOWS\temp\174.tmp (Backdoor.Bot) -> Delete on reboot. [41a55013582464d218d38e69e21f7d83]
Physical Sectors Detected: 0
(No malicious items detected)
(end)
|
|
17.12.2014, 21:12
| #25 |
| /// the machine /// TB-Ausbilder | Windows XP: Neue Tabs öffnen sich TDSSKILLER nochmal, hinter jedem Fund Cure oder Delete wählen, dann weiter.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
18.12.2014, 01:17
| #26 |
| | Windows XP: Neue Tabs öffnen sich Hallo, konnte TDSS ausführen, nach dem Neustart stürzt das Programm allerdings ab, bevor der Scan startet. viele Grüße, Katie |
|
18.12.2014, 21:00
| #27 |
| /// the machine /// TB-Ausbilder | Windows XP: Neue Tabs öffnen sich Mach mal bei den Optionen von TDSSKiller auf mehr Optionen oder Erweitert klicken, alles anhaken, dann nochmal. Dann sollte es laufen.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
19.12.2014, 19:55
| #28 |
| | Windows XP: Neue Tabs öffnen sich Hallo Schrauber, habe bei Eigenschaften -> erweitert, dann bei Inhalt komprimieren oder Inhalt verschlüsseln angeklickt, TDSS stürzt aber noch immer ab. ist das wichitg, oder egal? Gruß Katie |
|
20.12.2014, 15:42
| #29 |
| /// the machine /// TB-Ausbilder | Windows XP: Neue Tabs öffnen sich Dann poste bitte mal ein frisches FRST log. TDSSKIller stürzt also auch beim nur scannen ab?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
21.12.2014, 16:56
| #30 |
| | Windows XP: Neue Tabs öffnen sich Hallo, hier das neue Log FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-12-2014
Ran by User (administrator) on KATIE on 21-12-2014 02:11:58
Running from C:\Dokumente und Einstellungen\User\Desktop
Loaded Profile: User (Available profiles: User)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
() C:\WINDOWS\system32\ibmpmsvc.exe
(Intel(R) Corporation) C:\Programme\Intel\WiFi\bin\S24EvMon.exe
(Analog Devices, Inc.) C:\Programme\Analog Devices\Core\smax4pnp.exe
(Intel Corporation) C:\WINDOWS\system32\igfxtray.exe
(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
(Synaptics, Inc.) C:\Programme\Synaptics\SynTP\SynTPLpr.exe
(Synaptics, Inc.) C:\Programme\Synaptics\SynTP\SynTPEnh.exe
(Skype Technologies S.A.) C:\Programme\Skype\Phone\Skype.exe
(Piriform Ltd) C:\Programme\CCleaner\CCleaner.exe
(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
(Juniper Networks) C:\Programme\Juniper Networks\Common Files\dsNcService.exe
(Intel(R) Corporation) C:\Programme\Intel\WiFi\bin\EvtEng.exe
(Broadcom Corporation.) C:\Programme\ThinkPad\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\WINDOWS\system32\wbem\unsecapp.exe
(Microsoft Corporation) C:\WINDOWS\system32\wbem\unsecapp.exe
() C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MobileBrServ\mbbService.exe
(HP) C:\WINDOWS\system32\HPZipm12.exe
(Intel(R) Corporation) C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe
(Skype Technologies S.A.) C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
(Broadcom Corporation.) C:\Programme\ThinkPad\Bluetooth Software\bin\btwdins.exe
(Mozilla Corporation) C:\Programme\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SoundMAXPnP] => C:\Programme\Analog Devices\Core\smax4pnp.exe [925696 2005-05-20] (Analog Devices, Inc.)
HKLM\...\Run: [SynTPLpr] => C:\Programme\Synaptics\SynTP\SynTPLpr.exe [126976 2003-06-24] (Synaptics, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Programme\Synaptics\SynTP\SynTPEnh.exe [561152 2003-06-24] (Synaptics, Inc.)
HKLM\...\Run: [photo_gallery] => C:\Programme\FileZilla FTP Client\locales\sl_SI\eat_drink\incoming_call.exe [311808 2014-04-26] (Sakysoft s.r.l.)
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Run: [Skype] => C:\Programme\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Run: [CCleaner Monitoring] => C:\Programme\CCleaner\CCleaner.exe [4811032 2014-09-26] (Piriform Ltd)
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Run: [account-code] => C:\Dokumente und Einstellungen\User\Anwendungsdaten\Account-weight\account-count.exe
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Run: [zxzwkeos] => C:\DOKUME~1\User\LOKALE~1\Temp\Tycnav\mcjcofbkeos.exe <===== ATTENTION
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Run: [channel-shock] => C:\Dokumente und Einstellungen\User\Anwendungsdaten\Channel-text\channeldraft.exe
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Run: [signal-contain] => C:\Dokumente und Einstellungen\User\Anwendungsdaten\Signal-forget\signal_live.exe
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Run: [markpersuade] => C:\DOKUME~1\User\LOKALE~1\Temp\Markretain\markpull.exe <===== ATTENTION
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Run: [access-contain] => C:\Dokumente und Einstellungen\User\Anwendungsdaten\Accessdeal\access-wing.exe
Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk
ShortcutTarget: BTTray.lnk -> C:\Programme\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:4880;https=127.0.0.1:4880;
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Programme\Java\jre6\bin\jp2ssv.dll No File
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\d90tq7ym.default-1413761053703
FF DefaultSearchEngine: Yahoo DE
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_15_0_0_246.dll ()
FF Plugin: @java.com/DTPlugin,version=10.10.2 -> C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Programme\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF user.js: detected! => C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\d90tq7ym.default-1413761053703\user.js
FF Plugin ProgramFiles/Appdata: C:\Programme\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF SearchPlugin: C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\d90tq7ym.default-1413761053703\searchplugins\google-images.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\d90tq7ym.default-1413761053703\searchplugins\google-maps.xml
FF Extension: Cliqz Beta - C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\d90tq7ym.default-1413761053703\Extensions\cliqz@cliqz.com.xpi [2014-10-22]
FF Extension: Search Manager for Mozilla Firefox ™ - C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\d90tq7ym.default-1413761053703\Extensions\{5ccf2762-2b66-4dd5-9997-1103d12d3125}.xpi [2014-12-18]
FF Extension: Newtab - C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\d90tq7ym.default-1413761053703\Extensions\{a535a12b-d6c2-4f95-aef8-29c60aef0888}.xpi [2014-11-27]
FF Extension: Skype Click to Call - C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-12-09]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-09-26]
FF HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\d90tq7ym.default-1413761053703\extensions\cliqz@cliqz.com
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default
CHR Extension: (DivX HiQ) - C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae [2011-10-09]
CHR Extension: (DivX Plus Web Player HTML5 <video>) - C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2011-10-09]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Programme\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2012-07-05]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 btwdins; C:\Programme\ThinkPad\Bluetooth Software\bin\btwdins.exe [349528 2010-09-22] (Broadcom Corporation.)
R2 dsNcService; C:\Programme\Juniper Networks\Common Files\dsNcService.exe [670792 2011-09-08] (Juniper Networks)
R2 EvtEng; C:\Programme\Intel\WiFi\bin\EvtEng.exe [866576 2010-10-19] (Intel(R) Corporation)
R2 IBMPMSVC; C:\WINDOWS\system32\ibmpmsvc.exe [57344 2003-07-03] ()
S2 image_stabilization; C:\WINDOWS\assembly\GAC_MSIL\PresentationUI\3.0.0.0__31bf3856ad364e35\age_of_onset\conversation.exe [189440 2012-04-29] (Company 'gora-sah') [File not signed]
R2 Mobile Broadband HL Service; C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MobileBrServ\mbbservice.exe [239184 2013-01-28] ()
S3 MozillaMaintenance; C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe [114800 2014-12-09] (Mozilla Foundation)
S3 odserv; C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE [440696 2011-07-20] (Microsoft Corporation)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [145184 2006-10-26] (Microsoft Corporation)
R2 RegSrvc; C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe [477456 2010-10-19] (Intel(R) Corporation)
R2 S24EventMonitor; C:\Programme\Intel\WiFi\bin\S24EvMon.exe [966656 2010-10-19] (Intel(R) Corporation) [File not signed]
R2 Skype C2C Service; C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3048136 2012-07-05] (Skype Technologies S.A.)
S2 SkypeUpdate; C:\Programme\Skype\Updater\Updater.exe [172192 2013-10-23] (Skype Technologies)
S3 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)
S2 processor; C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\windows_to_go\web_service.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 AEAudioService; C:\WINDOWS\System32\drivers\AEAudio.sys [93952 2006-08-07] (Andrea Electronics Corporation)
R3 BTKRNL; C:\WINDOWS\System32\DRIVERS\btkrnl.sys [993576 2010-09-23] (Broadcom Corporation.)
R3 dsNcAdpt; C:\WINDOWS\System32\DRIVERS\dsNcAdpt.sys [26624 2011-09-08] (Juniper Networks)
S3 HPZid412; C:\WINDOWS\System32\DRIVERS\HPZid412.sys [49664 2005-10-28] (HP)
S3 HPZipr12; C:\WINDOWS\System32\DRIVERS\HPZipr12.sys [16496 2005-10-28] (HP)
S3 HPZius12; C:\WINDOWS\System32\DRIVERS\HPZius12.sys [21568 2005-10-28] (HP)
R3 HSFHWAZL; C:\WINDOWS\System32\DRIVERS\HSFHWAZL.sys [217016 2010-06-02] (Conexant Systems, Inc.)
R3 HSF_DPV; C:\WINDOWS\System32\DRIVERS\HSF_DPV.sys [993464 2010-06-02] (Conexant Systems, Inc.)
R3 IBMPMDRV; C:\WINDOWS\System32\DRIVERS\ibmpmdrv.sys [11344 2003-07-03] (IBM Corp.)
R3 NETwLx32; C:\WINDOWS\System32\DRIVERS\NETwLx32.sys [6609920 2010-10-07] (Intel Corporation)
R3 Rasirda; C:\WINDOWS\System32\DRIVERS\rasirda.sys [19584 2001-08-17] (Microsoft Corporation)
R2 s24trans; C:\WINDOWS\System32\DRIVERS\s24trans.sys [13952 2010-05-19] (Intel Corporation) [File not signed]
S4 sptd; C:\WINDOWS\System32\Drivers\sptd.sys [717296 2011-03-17] (Duplex Secure Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S4 IntelIde; No ImagePath
S3 StarOpen; No ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-21 02:11 - 2014-12-21 02:14 - 00014833 _____ () C:\Dokumente und Einstellungen\User\Desktop\FRST.txt
2014-12-19 19:46 - 2014-12-19 19:49 - 04187592 ____C (Kaspersky Lab ZAO) C:\Dokumente und Einstellungen\User\Desktop\tdsskiller(1).exe
2014-12-17 23:45 - 2014-12-17 23:53 - 00000000 ____D () C:\TDSSKiller_Quarantine
2014-12-17 19:19 - 2014-12-18 00:55 - 00000000 ___HD () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Accessdeal
2014-12-17 17:57 - 2014-12-21 02:10 - 00000596 _____ () C:\WINDOWS\onsxe.jix
2014-12-17 17:30 - 2014-12-17 17:30 - 01180834 _____ () C:\Dokumente und Einstellungen\User\Desktop\7z935.exe
2014-12-17 13:18 - 2014-12-17 17:37 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes' Anti-Malware (portable)
2014-12-17 13:16 - 2014-12-17 17:04 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Desktop\mbar
2014-12-17 13:12 - 2014-12-17 13:13 - 16448208 _____ (Malwarebytes Corp.) C:\Dokumente und Einstellungen\User\Desktop\mbar-1.08.2.1001.exe
2014-12-17 13:05 - 2014-12-17 13:05 - 04166770 _____ () C:\Dokumente und Einstellungen\User\Desktop\tdsskiller.zip
2014-12-17 01:32 - 2014-12-18 00:55 - 00000000 ___HD () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Signal-forget
2014-12-17 00:57 - 2014-12-17 00:57 - 00000000 ____D () C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\temp
2014-12-17 00:57 - 2014-12-17 00:57 - 00000000 ____D () C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\temp
2014-12-16 23:48 - 2014-12-16 23:48 - 05601641 ____R (Swearware) C:\Dokumente und Einstellungen\User\Desktop\ComboFix.exe
2014-12-16 18:50 - 2014-12-18 00:55 - 00000000 ___HD () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Channel-text
2014-12-16 12:44 - 2014-12-17 01:38 - 00000000 ___HD () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Phkezaain
2014-12-15 23:57 - 2014-12-15 23:57 - 00000690 _____ () C:\WINDOWS\pmueel.neo
2014-12-15 23:54 - 2014-12-21 02:16 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Lokale Einstellungen\temp
2014-12-15 22:33 - 2014-12-18 00:55 - 00000000 ___HD () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Account-weight
2014-12-15 17:29 - 2014-12-15 17:30 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\jxh
2014-12-10 06:07 - 2014-12-11 22:07 - 00000010 _____ () C:\WINDOWS\)†
2014-12-09 09:33 - 2014-12-09 09:33 - 04184008 __RHC (Kaspersky Lab ZAO) C:\Dokumente und Einstellungen\User\Desktop\tdsskiller.exe
2014-12-09 08:15 - 2014-12-09 08:20 - 00000000 ____D () C:\Programme\Mozilla Firefox
2014-12-05 11:06 - 2014-12-05 11:17 - 00000000 ___SD () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\OpenOffice 4.1.1
2014-12-05 11:06 - 2014-12-05 11:06 - 00000853 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\OpenOffice 4.1.1.lnk
2014-12-05 10:56 - 2014-12-05 10:59 - 00000000 ____D () C:\Programme\OpenOffice 4
2014-12-05 10:48 - 2014-12-05 10:50 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Desktop\OpenOffice 4.1.1 (de) Installation Files
2014-12-05 10:12 - 2014-12-05 10:12 - 01174352 _____ () C:\Dokumente und Einstellungen\User\Desktop\OpenOffice - CHIP-Installer.exe
2014-12-04 07:40 - 2014-12-04 07:40 - 00000213 _____ () C:\WINDOWS\afl.rul
2014-12-04 07:36 - 2014-12-04 07:36 - 00475713 _____ () C:\WINDOWS\xtkq.eof
2014-12-04 07:36 - 2014-12-04 07:36 - 00233224 _____ () C:\WINDOWS\ejyt.gwq
2014-12-04 07:35 - 2014-12-21 02:09 - 00000988 _____ () C:\WINDOWS\klwbxnc.zpa
2014-12-03 07:17 - 2014-12-21 02:10 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Desktop\FRST-OlderVersion
2014-12-02 03:47 - 2014-12-02 03:47 - 00000000 ____H () C:\WINDOWS\system32\config\system.tmp.LOG
2014-12-02 03:47 - 2014-12-02 03:47 - 00000000 ____H () C:\WINDOWS\system32\config\software.tmp.LOG
2014-12-02 03:47 - 2014-12-02 03:47 - 00000000 ____H () C:\WINDOWS\system32\config\SAM.tmp.LOG
2014-12-02 03:47 - 2014-12-02 03:47 - 00000000 ____H () C:\WINDOWS\system32\config\default.tmp.LOG
2014-12-02 03:46 - 2014-12-15 23:56 - 00008192 ____H () C:\WINDOWS\system32\config\SECURITY.tmp.LOG
2014-12-02 03:27 - 2014-12-02 03:27 - 00000000 _RSHD () C:\cmdcons
2014-12-02 03:27 - 2011-03-17 10:31 - 00000211 _____ () C:\Boot.bak
2014-12-02 03:27 - 2004-08-03 23:00 - 00262448 __RSH () C:\cmldr
2014-12-02 03:18 - 2011-06-26 07:45 - 00256000 _____ () C:\WINDOWS\PEV.exe
2014-12-02 03:18 - 2010-11-07 18:20 - 00208896 _____ () C:\WINDOWS\MBR.exe
2014-12-02 03:18 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2014-12-02 03:18 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2014-12-02 03:18 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2014-12-02 03:18 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2014-12-02 03:18 - 2000-08-31 01:00 - 00098816 _____ () C:\WINDOWS\sed.exe
2014-12-02 03:18 - 2000-08-31 01:00 - 00080412 _____ () C:\WINDOWS\grep.exe
2014-12-02 03:18 - 2000-08-31 01:00 - 00068096 _____ () C:\WINDOWS\zip.exe
2014-12-02 03:16 - 2014-12-17 00:57 - 00000000 ____D () C:\Qoobox
2014-12-02 03:14 - 2014-12-02 03:14 - 00000000 ___RD () C:\Dokumente und Einstellungen\User\Startmenü\Programme\Verwaltung
2014-12-02 03:12 - 2014-12-15 23:54 - 00000000 ____D () C:\WINDOWS\erdnt
2014-12-01 10:35 - 2014-12-01 10:35 - 00114904 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\6F062457.sys
2014-12-01 09:29 - 2014-12-01 09:29 - 00380416 _____ () C:\Dokumente und Einstellungen\User\Desktop\Gmer-19357.exe
2014-12-01 09:14 - 2014-12-21 02:12 - 00000000 ____D () C:\FRST
2014-12-01 08:58 - 2014-12-21 02:10 - 01113600 _____ (Farbar) C:\Dokumente und Einstellungen\User\Desktop\FRST.exe
2014-11-28 05:09 - 2014-11-30 20:17 - 00000012 _____ () C:\WINDOWS\䌯尺䐀尺
2014-11-28 05:04 - 2014-11-28 05:04 - 00000020 _____ () C:\Dokumente und Einstellungen\User\defogger_reenable
2014-11-28 05:02 - 2014-11-28 05:02 - 00050477 _____ () C:\Dokumente und Einstellungen\User\Desktop\Defogger.exe
2014-11-28 01:35 - 2014-11-28 02:01 - 00000018 _____ () C:\WINDOWS\䌯尺䐀尺䘀尺
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-21 02:16 - 2013-12-06 13:20 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-12-21 02:11 - 2011-03-17 09:14 - 01380939 _____ () C:\WINDOWS\WindowsUpdate.log
2014-12-21 02:07 - 2011-03-17 09:08 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2014-12-21 02:06 - 2011-03-17 09:08 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2014-12-21 02:04 - 2014-03-27 17:31 - 00000220 _____ () C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP – Benachrichtigung – Anmeldung.job
2014-12-21 02:04 - 2011-03-17 09:19 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-12-21 02:04 - 2008-04-14 13:00 - 00013646 _____ () C:\WINDOWS\system32\wpa.dbl
2014-12-21 02:01 - 2011-03-17 09:19 - 00032606 _____ () C:\WINDOWS\SchedLgU.Txt
2014-12-18 16:33 - 2011-10-08 11:24 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Skype
2014-12-18 00:27 - 2012-07-04 13:30 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Desktop\Ornamente
2014-12-17 17:54 - 2008-04-14 13:00 - 00001602 _____ () C:\WINDOWS\win.ini
2014-12-17 14:49 - 2014-10-20 00:37 - 00119000 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-12-17 14:45 - 2014-10-20 00:37 - 00055000 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-12-17 00:53 - 2008-04-14 13:00 - 00000227 _____ () C:\WINDOWS\system.ini
2014-12-15 23:57 - 2011-03-17 10:03 - 28909568 _____ () C:\WINDOWS\system32\config\software.bak
2014-12-15 23:57 - 2011-03-17 10:03 - 04980736 _____ () C:\WINDOWS\system32\config\system.bak
2014-12-15 23:57 - 2011-03-17 10:03 - 00294912 _____ () C:\WINDOWS\system32\config\default.bak
2014-12-15 23:57 - 2011-03-17 09:04 - 00057344 _____ () C:\WINDOWS\system32\config\SECURITY.bak
2014-12-15 23:57 - 2011-03-17 09:04 - 00028672 _____ () C:\WINDOWS\system32\config\SAM.bak
2014-12-10 23:17 - 2012-08-30 18:52 - 00000000 ____D () C:\Programme\Mozilla Maintenance Service
2014-12-10 19:03 - 2011-03-17 09:05 - 00000000 __SHD () C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen\Verlauf
2014-12-10 09:17 - 2013-12-06 13:20 - 00701104 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2014-12-10 09:17 - 2012-01-18 09:01 - 00071344 ____C (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2014-12-09 19:07 - 2013-11-02 13:29 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Desktop\Bewerbung_NEU
2014-12-09 12:19 - 2011-03-17 09:05 - 00000000 ____D () C:\Programme
2014-12-09 06:48 - 2011-03-17 09:56 - 00000000 ____D () C:\WINDOWS\Help
2014-12-08 21:30 - 2012-09-22 18:16 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Desktop\Hartz
2014-12-08 15:00 - 2014-03-27 17:31 - 00000214 _____ () C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP – Monatliche Benachrichtigung.job
2014-12-08 12:44 - 2012-07-04 12:30 - 00015360 ___HC () C:\Dokumente und Einstellungen\User\Desktop\photothumb.db
2014-12-08 12:44 - 2011-09-25 22:22 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Anwendungsdaten\PhotoScape
2014-12-08 12:43 - 2011-03-17 10:09 - 00075216 ____C () C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2014-12-08 12:43 - 2011-03-17 09:27 - 00000000 ___RD () C:\Dokumente und Einstellungen\User\Eigene Dateien\Eigene Bilder
2014-12-08 12:40 - 2011-03-17 09:27 - 00000000 ___HD () C:\Dokumente und Einstellungen\User\Netzwerkumgebung
2014-12-06 06:27 - 2011-03-17 09:04 - 00296456 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-12-05 11:06 - 2011-03-17 09:05 - 00000000 ___RD () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme
2014-12-03 20:13 - 2011-03-17 09:19 - 00000000 ___HD () C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Verlauf
2014-12-03 07:46 - 2011-03-17 09:27 - 00000000 __SHD () C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Verlauf
2014-12-03 07:45 - 2011-03-17 09:19 - 00000000 __SHD () C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Verlauf
2014-12-03 07:41 - 2014-09-12 20:00 - 00000000 ____D () C:\Programme\Security Guard
2014-12-02 03:49 - 2011-03-17 10:02 - 00000000 ____D () C:\WINDOWS\Microsoft.NET
2014-12-02 03:27 - 2011-03-17 10:03 - 00000327 __RSH () C:\boot.ini
2014-12-02 03:14 - 2011-03-17 09:27 - 00000000 ___RD () C:\Dokumente und Einstellungen\User\Startmenü\Programme
2014-11-28 01:55 - 2012-12-13 00:29 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2770660$
2014-11-28 01:46 - 2011-10-09 21:32 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DivX
2014-11-28 01:45 - 2014-11-05 19:30 - 00001351 _____ () C:\WINDOWS\setupapi.log
2014-11-28 01:45 - 2011-10-09 21:35 - 00000000 ____D () C:\Programme\DivX
2014-11-26 03:45 - 2012-11-21 11:21 - 00000000 ____D () C:\Programme\OpenOffice.org 3
2014-11-26 03:43 - 2011-03-17 09:27 - 00000000 ___RD () C:\Dokumente und Einstellungen\User\Startmenü\Programme\Autostart
2014-11-26 03:11 - 2012-03-09 03:00 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2641690$
2014-11-26 03:11 - 2011-03-17 09:56 - 00000000 ____D () C:\WINDOWS\Connection Wizard
2014-11-26 01:50 - 2012-12-13 00:29 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2779562$
2014-11-25 14:36 - 2014-11-04 20:36 - 00000000 ____D () C:\Programme\Optimizer Pro
2014-11-25 14:24 - 2014-11-05 20:12 - 00000157 _____ () C:\Dokumente und Einstellungen\User\Anwendungsdaten\WB.CFG
2014-11-21 18:12 - 2014-11-07 22:20 - 00000001 _____ () C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\DSI.DAT
Some content of TEMP:
====================
C:\Dokumente und Einstellungen\User\Lokale Einstellungen\temp\{11472294-BDA8-4299-BCA4-86EB883A20EB}.exe
C:\Dokumente und Einstellungen\User\Lokale Einstellungen\temp\{5C9CFC5F-D543-457D-A592-7F320B846711}.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
==================== End Of Log ============================
--- --- --- und die addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 21-12-2014
Ran by User at 2014-12-21 02:18:39
Running from C:\Dokumente und Einstellungen\User\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.246 - Adobe Systems Incorporated)
AiO_Scan_CDA (Version: 51.0.230.000 - Hewlett-Packard) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.18 - Piriform)
FileZilla Client 3.8.0 (HKLM\...\FileZilla Client) (Version: 3.8.0 - Tim Kosse)
Hotfix für Windows Media Player 11 (KB939683) (HKLM\...\KB939683) (Version: - Microsoft Corporation)
Hotfix für Windows XP (KB2443685) (HKLM\...\KB2443685) (Version: 1 - Microsoft Corporation)
Hotfix für Windows XP (KB2570791) (HKLM\...\KB2570791) (Version: 1 - Microsoft Corporation)
Hotfix für Windows XP (KB2633952) (HKLM\...\KB2633952) (Version: 1 - Microsoft Corporation)
Hotfix für Windows XP (KB2756822) (HKLM\...\KB2756822) (Version: 1 - Microsoft Corporation)
Hotfix für Windows XP (KB2779562) (HKLM\...\KB2779562) (Version: 1 - Microsoft Corporation)
Hotfix für Windows XP (KB945436) (HKLM\...\KB945436) (Version: 1 - Microsoft Corporation)
Hotfix für Windows XP (KB952287) (HKLM\...\KB952287) (Version: 1 - Microsoft Corporation)
Hotfix für Windows XP (KB959765) (HKLM\...\KB959765) (Version: 1 - Microsoft Corporation)
Hotfix für Windows XP (KB961118) (HKLM\...\KB961118) (Version: 1 - Microsoft Corporation)
HP PSC & OfficeJet 6.1.A (HKLM\...\{27555031-A116-4EC6-9991-7B400142A936}) (Version: - HP)
IBM ThinkPad Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.25.01 - )
IBM ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: - )
Iminent (Version: 4.10.0 - Iminent) Hidden <==== ATTENTION
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - )
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 14.5 - Intel)
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{F8F28729-B336-492C-B4FD-53A9BBDF0482}) (Version: 13.04.0000 - Intel Corporation)
Juniper Networks Network Connect 7.1.0 (HKLM\...\Juniper Network Connect 7.1.0) (Version: 7.1.0.19243 - Juniper Networks)
Juniper Networks, Inc. Setup Client (HKU\S-1-5-21-1547161642-1035525444-1417001333-1003\...\Juniper_Setup_Client) (Version: 7.1.4.13103 - Juniper Networks, Inc.)
Juniper Networks, Inc. Setup Client Activex Control (HKLM\...\Juniper_Setup_Client Activex Control) (Version: 2.1.1.1 - Juniper Networks, Inc.)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Compression Client Pack 1.0 for Windows XP (HKLM\...\MSCompPackV1) (Version: 1 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Meeting 2005 (HKLM\...\{DA56C01D-C70A-401D-ABE2-7188B9FF161F}) (Version: 7.9.3006.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft User-Mode Driver Framework Feature Pack 1.0 (HKLM\...\Wudf01000) (Version: - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mobile Broadband HL Service (HKLM\...\Mobile Broadband HL Service) (Version: 22.001.20.00.03 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 34.0.5 (x86 de) (HKLM\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
NetBeans IDE 8.0 (HKLM\...\nbi-nb-base-8.0.0.0.201403101706) (Version: 8.0 - NetBeans.org)
Notepad++ (HKLM\...\Notepad++) (Version: 6.6.8 - Notepad++ Team)
OpenOffice 4.1.1 (HKLM\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
PhotoScape (HKLM\...\PhotoScape) (Version: - )
Protegere (HKLM\...\Protegere) (Version: - )
QFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden
Scan (Version: 6.0.0.0 - Hewlett-Packard) Hidden
Security Guard (HKLM\...\Security Guard) (Version: - )
Sicherheitsupdate für Microsoft Windows (KB2564958) (HKLM\...\KB2564958) (Version: - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2510531) (HKLM\...\KB2510531-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2544521) (HKLM\...\KB2544521-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2647516) (HKLM\...\KB2647516-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2675157) (HKLM\...\KB2675157-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2699988) (HKLM\...\KB2699988-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2722913) (HKLM\...\KB2722913-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2744842) (HKLM\...\KB2744842-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2761465) (HKLM\...\KB2761465-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2792100) (HKLM\...\KB2792100-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2797052) (HKLM\...\KB2797052-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2799329) (HKLM\...\KB2799329-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2809289) (HKLM\...\KB2809289-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2817183) (HKLM\...\KB2817183-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2879017) (HKLM\...\KB2879017-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2888505) (HKLM\...\KB2888505-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2898785) (HKLM\...\KB2898785-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2909210) (HKLM\...\KB2909210-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2909921) (HKLM\...\KB2909921-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2925418) (HKLM\...\KB2925418-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2936068) (HKLM\...\KB2936068-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Internet Explorer 8 (KB2964358) (HKLM\...\KB2964358-IE8) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows Media Player (KB2378111) (HKLM\...\KB2378111_WM9) (Version: - Microsoft Corporation)
Sicherheitsupdate für Windows Media Player (KB2834904-v2) (HKLM\...\KB2834904-v2_WM11) (Version: - Microsoft Corporation)
Sicherheitsupdate für Windows Media Player (KB952069) (HKLM\...\KB952069_WM9) (Version: - Microsoft Corporation)
Sicherheitsupdate für Windows Media Player (KB954155) (HKLM\...\KB954155_WM9) (Version: - Microsoft Corporation)
Sicherheitsupdate für Windows Media Player (KB973540) (HKLM\...\KB973540_WM9) (Version: - Microsoft Corporation)
Sicherheitsupdate für Windows Media Player (KB975558) (HKLM\...\KB975558_WM8) (Version: - Microsoft Corporation)
Sicherheitsupdate für Windows Media Player (KB978695) (HKLM\...\KB978695_WM9) (Version: - Microsoft Corporation)
Sicherheitsupdate für Windows Media Player 11 (KB954154) (HKLM\...\KB954154_WM11) (Version: - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2079403) (HKLM\...\KB2079403) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2115168) (HKLM\...\KB2115168) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2121546) (HKLM\...\KB2121546) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2229593) (HKLM\...\KB2229593) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2296011) (HKLM\...\KB2296011) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2347290) (HKLM\...\KB2347290) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2360937) (HKLM\...\KB2360937) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2387149) (HKLM\...\KB2387149) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2393802) (HKLM\...\KB2393802) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2412687) (HKLM\...\KB2412687) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2419632) (HKLM\...\KB2419632) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2423089) (HKLM\...\KB2423089) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2440591) (HKLM\...\KB2440591) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2443105) (HKLM\...\KB2443105) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2476490) (HKLM\...\KB2476490) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2476687) (HKLM\...\KB2476687) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2478960) (HKLM\...\KB2478960) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2478971) (HKLM\...\KB2478971) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2479943) (HKLM\...\KB2479943) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2481109) (HKLM\...\KB2481109) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2483185) (HKLM\...\KB2483185) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2485663) (HKLM\...\KB2485663) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2497640) (Version: 1 - Microsoft Corporation) Hidden
Sicherheitsupdate für Windows XP (KB2503658) (HKLM\...\KB2503658) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2503665) (HKLM\...\KB2503665) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2506212) (HKLM\...\KB2506212) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2506223) (HKLM\...\KB2506223) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2507618) (HKLM\...\KB2507618) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2507938) (HKLM\...\KB2507938) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2508272) (HKLM\...\KB2508272) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2508429) (HKLM\...\KB2508429) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2509553) (HKLM\...\KB2509553) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2510581) (Version: 1 - Microsoft Corporation) Hidden
Sicherheitsupdate für Windows XP (KB2511455) (HKLM\...\KB2511455) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2524375) (HKLM\...\KB2524375) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2530548) (Version: 1 - Microsoft Corporation) Hidden
Sicherheitsupdate für Windows XP (KB2535512) (HKLM\...\KB2535512) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2536276) (HKLM\...\KB2536276) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2536276-v2) (HKLM\...\KB2536276-v2) (Version: 2 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2544521) (Version: 1 - Microsoft Corporation) Hidden
Sicherheitsupdate für Windows XP (KB2544893) (HKLM\...\KB2544893) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2544893-v2) (HKLM\...\KB2544893-v2) (Version: 2 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2555917) (HKLM\...\KB2555917) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2559049) (Version: 1 - Microsoft Corporation) Hidden
Sicherheitsupdate für Windows XP (KB2562937) (HKLM\...\KB2562937) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2566454) (HKLM\...\KB2566454) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2567053) (HKLM\...\KB2567053) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2567680) (HKLM\...\KB2567680) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2570222) (HKLM\...\KB2570222) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2570947) (HKLM\...\KB2570947) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2584146) (HKLM\...\KB2584146) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2585542) (HKLM\...\KB2585542) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2586448) (Version: 1 - Microsoft Corporation) Hidden
Sicherheitsupdate für Windows XP (KB2592799) (HKLM\...\KB2592799) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2598479) (HKLM\...\KB2598479) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2603381) (HKLM\...\KB2603381) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2618444) (Version: 1 - Microsoft Corporation) Hidden
Sicherheitsupdate für Windows XP (KB2618451) (HKLM\...\KB2618451) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2619339) (HKLM\...\KB2619339) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2620712) (HKLM\...\KB2620712) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2621440) (HKLM\...\KB2621440) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2624667) (HKLM\...\KB2624667) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2631813) (HKLM\...\KB2631813) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2633171) (HKLM\...\KB2633171) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2639417) (HKLM\...\KB2639417) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2641653) (HKLM\...\KB2641653) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2646524) (HKLM\...\KB2646524) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2647516) (Version: 1 - Microsoft Corporation) Hidden
Sicherheitsupdate für Windows XP (KB2647518) (HKLM\...\KB2647518) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2653956) (HKLM\...\KB2653956) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2655992) (HKLM\...\KB2655992) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2659262) (HKLM\...\KB2659262) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2660465) (HKLM\...\KB2660465) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2661637) (HKLM\...\KB2661637) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2676562) (HKLM\...\KB2676562) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2685939) (HKLM\...\KB2685939) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2686509) (HKLM\...\KB2686509) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2691442) (HKLM\...\KB2691442) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2695962) (HKLM\...\KB2695962) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2698365) (HKLM\...\KB2698365) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2705219) (HKLM\...\KB2705219) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2707511) (HKLM\...\KB2707511) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2709162) (HKLM\...\KB2709162) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2712808) (HKLM\...\KB2712808) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2718523) (HKLM\...\KB2718523) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2719985) (HKLM\...\KB2719985) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2723135) (HKLM\...\KB2723135) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2724197) (HKLM\...\KB2724197) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2727528) (HKLM\...\KB2727528) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2731847) (HKLM\...\KB2731847) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2753842) (HKLM\...\KB2753842) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2753842-v2) (HKLM\...\KB2753842-v2) (Version: 2 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2757638) (HKLM\...\KB2757638) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2758857) (HKLM\...\KB2758857) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2761226) (HKLM\...\KB2761226) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2770660) (HKLM\...\KB2770660) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2778344) (HKLM\...\KB2778344) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2779030) (HKLM\...\KB2779030) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2780091) (HKLM\...\KB2780091) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2799494) (HKLM\...\KB2799494) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2802968) (HKLM\...\KB2802968) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2807986) (HKLM\...\KB2807986) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2808735) (HKLM\...\KB2808735) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2813170) (HKLM\...\KB2813170) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2813345) (HKLM\...\KB2813345) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2820197) (HKLM\...\KB2820197) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2820917) (HKLM\...\KB2820917) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2834886) (HKLM\...\KB2834886) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2845187) (HKLM\...\KB2845187) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2847311) (HKLM\...\KB2847311) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2849470) (HKLM\...\KB2849470) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2850869) (HKLM\...\KB2850869) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2859537) (HKLM\...\KB2859537) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2862152) (HKLM\...\KB2862152) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2862330) (HKLM\...\KB2862330) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2862335) (HKLM\...\KB2862335) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2864063) (HKLM\...\KB2864063) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2868626) (HKLM\...\KB2868626) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2876217) (HKLM\...\KB2876217) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2876331) (HKLM\...\KB2876331) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2883150) (HKLM\...\KB2883150) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2892075) (HKLM\...\KB2892075) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2893294) (HKLM\...\KB2893294) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2893984) (HKLM\...\KB2893984) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2898715) (HKLM\...\KB2898715) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2900986) (HKLM\...\KB2900986) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2914368) (HKLM\...\KB2914368) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2916036) (HKLM\...\KB2916036) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2922229) (HKLM\...\KB2922229) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2929961) (HKLM\...\KB2929961) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB2930275) (HKLM\...\KB2930275) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB923561) (HKLM\...\KB923561) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB923789) (HKLM\...\KB923789) (Version: - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB941569) (HKLM\...\KB941569) (Version: - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB946648) (HKLM\...\KB946648) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB950762) (HKLM\...\KB950762) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB950974) (HKLM\...\KB950974) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB951376-v2) (HKLM\...\KB951376-v2) (Version: 2 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB952004) (HKLM\...\KB952004) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB952954) (HKLM\...\KB952954) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB956572) (HKLM\...\KB956572) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB956744) (HKLM\...\KB956744) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB956802) (HKLM\...\KB956802) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB956844) (HKLM\...\KB956844) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB958644) (HKLM\...\KB958644) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB959426) (HKLM\...\KB959426) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB960803) (HKLM\...\KB960803) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB960859) (HKLM\...\KB960859) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB961501) (HKLM\...\KB961501) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB969059) (HKLM\...\KB969059) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB970430) (HKLM\...\KB970430) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB971657) (HKLM\...\KB971657) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB971961) (Version: 1 - Microsoft Corporation) Hidden
Sicherheitsupdate für Windows XP (KB972270) (HKLM\...\KB972270) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB973507) (HKLM\...\KB973507) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB973869) (HKLM\...\KB973869) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB973904) (HKLM\...\KB973904) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB974112) (HKLM\...\KB974112) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB974318) (HKLM\...\KB974318) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB974392) (HKLM\...\KB974392) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB974571) (HKLM\...\KB974571) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB975025) (HKLM\...\KB975025) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB975467) (HKLM\...\KB975467) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB975560) (HKLM\...\KB975560) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB975562) (HKLM\...\KB975562) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB975713) (Version: 1 - Microsoft Corporation) Hidden
Sicherheitsupdate für Windows XP (KB977816) (HKLM\...\KB977816) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB977914) (HKLM\...\KB977914) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB978338) (HKLM\...\KB978338) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB978542) (HKLM\...\KB978542) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB978601) (HKLM\...\KB978601) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB978706) (HKLM\...\KB978706) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB979309) (HKLM\...\KB979309) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB979482) (HKLM\...\KB979482) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB979687) (HKLM\...\KB979687) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB980436) (HKLM\...\KB980436) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB981322) (HKLM\...\KB981322) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB981997) (HKLM\...\KB981997) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB982132) (HKLM\...\KB982132) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB982665) (HKLM\...\KB982665) (Version: 1 - Microsoft Corporation)
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.1.10441 - Skype Technologies S.A.)
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SoundMAX (HKLM\...\{F0A37341-D692-11D4-A984-009027EC0A9C}) (Version: 5.10.01.4326 - Analog Devices)
ThinkPad Bluetooth with Enhanced Data Rate Software (HKLM\...\{84814E6B-2581-46EC-926A-823BD1C670F6}) (Version: 5.5.0.9700 - Lenovo)
ThinkPad Modem (HKLM\...\CNXT_MODEM_HDA_HSF) (Version: 7.80.7.0 - Conexant Systems)
TUGZip 3.5 (HKLM\...\TUGZip_is1) (Version: - Christian Kindahl)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Windows XP (KB2345886) (HKLM\...\KB2345886) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB2541763) (HKLM\...\KB2541763) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB2607712) (HKLM\...\KB2607712) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB2616676-v2) (HKLM\...\KB2616676-v2) (Version: 2 - Microsoft Corporation)
Update für Windows XP (KB2641690) (HKLM\...\KB2641690) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB2661254-v2) (HKLM\...\KB2661254-v2) (Version: 2 - Microsoft Corporation)
Update für Windows XP (KB2718704) (HKLM\...\KB2718704) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB2736233) (HKLM\...\KB2736233) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB2749655) (HKLM\...\KB2749655) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB2863058) (HKLM\...\KB2863058) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB2904266) (HKLM\...\KB2904266) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB2934207) (HKLM\...\KB2934207) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB898461) (HKLM\...\KB898461) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB951978) (Version: 1 - Microsoft Corporation) Hidden
Update für Windows XP (KB955759) (HKLM\...\KB955759) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB967715) (HKLM\...\KB967715) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB968389) (HKLM\...\KB968389) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB971029) (HKLM\...\KB971029) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB971737) (HKLM\...\KB971737) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB973687) (HKLM\...\KB973687) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB973815) (HKLM\...\KB973815) (Version: 1 - Microsoft Corporation)
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
Windows Genuine Advantage Notifications (KB905474) (HKLM\...\WgaNotify) (Version: 1.9.0040.0 - Microsoft Corporation)
Windows Internet Explorer 8 (HKLM\...\ie8) (Version: 20090308.140743 - Microsoft Corporation)
Windows Media Format 11 runtime (HKLM\...\Windows Media Format Runtime) (Version: - )
Windows Media Player 11 (HKLM\...\Windows Media Player) (Version: - )
WinSCP 5.1.2 (HKLM\...\winscp3_is1) (Version: 5.1.2 - Martin Prikryl)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1547161642-1035525444-1417001333-1003_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Dokumente und Einstellungen\User\Anwendungsdaten\Dropbox\bin\Dropbox.exe /autoplay No File
CustomCLSID: HKU\S-1-5-21-1547161642-1035525444-1417001333-1003_Classes\CLSID\{E69341A3-E6D2-4175-B60C-C9D3D6FA40F6}\localserver32 -> C:\Dokumente und Einstellungen\User\Anwendungsdaten\Dropbox\bin\Dropbox.exe /wiacallback No File
==================== Restore Points =========================
17-10-2014 01:42:56 Systemprüfpunkt
18-10-2014 05:24:59 Systemprüfpunkt
20-10-2014 01:17:29 Systemprüfpunkt
20-10-2014 20:40:51 Software Distribution Service 3.0
21-10-2014 21:12:41 Systemprüfpunkt
23-10-2014 05:27:20 Systemprüfpunkt
24-10-2014 06:05:17 Systemprüfpunkt
25-10-2014 07:02:08 Systemprüfpunkt
30-10-2014 22:21:54 Systemprüfpunkt
01-11-2014 01:39:23 Systemprüfpunkt
06-11-2014 21:36:49 Systemprüfpunkt
11-11-2014 13:02:00 Systemprüfpunkt
12-11-2014 13:50:34 Systemprüfpunkt
13-11-2014 02:51:25 Software Distribution Service 3.0
22-11-2014 19:50:09 Systemprüfpunkt
25-11-2014 15:21:49 Systemprüfpunkt
26-11-2014 03:44:28 OpenOffice.org 3.3 wird entfernt
29-11-2014 23:46:41 Systemprüfpunkt
01-12-2014 11:23:52 Systemprüfpunkt
02-12-2014 23:30:05 Systemprüfpunkt
03-12-2014 07:01:19 Java 7 Update 10 wird entfernt
03-12-2014 07:04:45 Java(TM) 6 Update 22 wird entfernt
04-12-2014 07:13:10 Systemprüfpunkt
05-12-2014 09:14:52 Systemprüfpunkt
05-12-2014 10:55:57 OpenOffice 4.1.1 wird installiert
06-12-2014 11:31:35 Systemprüfpunkt
08-12-2014 12:10:44 Systemprüfpunkt
09-12-2014 21:58:31 Systemprüfpunkt
10-12-2014 19:02:34 Software Distribution Service 3.0
12-12-2014 00:16:28 Systemprüfpunkt
14-12-2014 13:46:20 Systemprüfpunkt
15-12-2014 19:53:12 Systemprüfpunkt
16-12-2014 20:08:45 Systemprüfpunkt
17-12-2014 14:25:59 Malwarebytes Anti-Rootkit Restore Point
18-12-2014 14:54:39 Systemprüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2008-04-14 13:00 - 2014-12-16 12:01 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP – Benachrichtigung – Anmeldung.job => C:\WINDOWS\system32\xp_eos.exe
Task: C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP – Monatliche Benachrichtigung.job => C:\WINDOWS\system32\xp_eos.exe
==================== Loaded Modules (whitelisted) =============
2003-07-03 00:25 - 2003-07-03 00:25 - 00057344 _____ () C:\WINDOWS\system32\ibmpmsvc.exe
2014-03-28 10:35 - 2014-03-28 10:35 - 00093696 _____ () C:\Programme\FileZilla FTP Client\fzshellext.dll
2010-09-22 14:18 - 2010-09-22 14:18 - 00075112 _____ () C:\Programme\ThinkPad\Bluetooth Software\btkeyind.dll
2012-08-09 18:56 - 2008-02-02 22:08 - 01722368 _____ () C:\Programme\TUGZip\Plugins\TzArchive10.tgp
2012-08-09 18:56 - 2007-03-12 22:34 - 00162304 _____ () C:\WINDOWS\system32\ztvunrar36.dll
2012-08-09 18:56 - 2005-02-17 22:15 - 00077824 _____ () C:\Programme\TUGZip\Plugins\TzImage10.tgp
2008-04-14 13:00 - 2008-04-14 13:00 - 00014336 _____ () C:\WINDOWS\system32\msdmo.dll
2014-09-25 19:44 - 2014-09-25 19:44 - 00053248 _____ () C:\Programme\CCleaner\lang\lang-1031.dll
2010-09-22 14:18 - 2010-09-22 14:18 - 02860384 _____ () C:\WINDOWS\system32\btwicons.dll
2013-10-29 12:49 - 2013-01-28 03:49 - 00239184 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MobileBrServ\mbbservice.exe
2014-12-09 08:16 - 2014-12-09 08:19 - 03758192 _____ () C:\Programme\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\90934020.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\98266048.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\90934020.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\98266048.sys => ""="Driver"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: DAEMON Tools Lite => C:\Programme\DAEMON Tools Lite\daemon.exe -autorun
========================= Accounts: ==========================
Administrator (S-1-5-21-1547161642-1035525444-1417001333-500 - Administrator - Enabled)
ASPNET (S-1-5-21-1547161642-1035525444-1417001333-1004 - Limited - Enabled)
Gast (S-1-5-21-1547161642-1035525444-1417001333-501 - Limited - Enabled)
Hilfeassistent (S-1-5-21-1547161642-1035525444-1417001333-1000 - Limited - Disabled)
SUPPORT_388945a0 (S-1-5-21-1547161642-1035525444-1417001333-1002 - Limited - Disabled)
User (S-1-5-21-1547161642-1035525444-1417001333-1003 - Administrator - Enabled) => %SystemDrive%\Dokumente und Einstellungen\User
==================== Faulty Device Manager Devices =============
Name: Biometric Coprocessor
Description: Biometric Coprocessor
Class Guid: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name:
Description:
Class Guid: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (12/20/2014 02:03:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlgeschlagene Anwendung plugin-container.exe, Version 34.0.5.5443, fehlgeschlagenes Modul mozalloc.dll, Version 34.0.5.5443, Fehleradresse 0x00001425.
Das medienspezifische Ereignis für [plugin-container.exe!ws!] wird verarbeitet.
Error: (12/19/2014 07:53:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlgeschlagene Anwendung tdsskiller(1).exe, Version 3.0.0.42, fehlgeschlagenes Modul tdsskiller(1).exe, Version 3.0.0.42, Fehleradresse 0x00899607.
Das medienspezifische Ereignis für [tdsskiller(1).exe!ws!] wird verarbeitet.
Error: (12/19/2014 07:50:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlgeschlagene Anwendung tdsskiller(1).exe, Version 3.0.0.42, fehlgeschlagenes Modul unknown, Version 0.0.0.0, Fehleradresse 0x025b0218.
Das medienspezifische Ereignis für [tdsskiller(1).exe!ws!] wird verarbeitet.
Error: (12/19/2014 07:50:10 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlgeschlagene Anwendung tdsskiller(1).exe, Version 3.0.0.42, fehlgeschlagenes Modul unknown, Version 0.0.0.0, Fehleradresse 0x02710218.
Das medienspezifische Ereignis für [tdsskiller(1).exe!ws!] wird verarbeitet.
Error: (12/19/2014 07:47:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlgeschlagene Anwendung tdsskiller(1).exe, Version 3.0.0.42, fehlgeschlagenes Modul unknown, Version 0.0.0.0, Fehleradresse 0x02020218.
Das medienspezifische Ereignis für [tdsskiller(1).exe!ws!] wird verarbeitet.
Error: (12/19/2014 05:12:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlgeschlagene Anwendung firefox.exe, Version 34.0.5.5443, fehlgeschlagenes Modul unknown, Version 0.0.0.0, Fehleradresse 0x00000001.
Das medienspezifische Ereignis für [firefox.exe!ws!] wird verarbeitet.
Error: (12/18/2014 01:16:35 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlgeschlagene Anwendung tdsskiller.exe, Version 3.0.0.41, fehlgeschlagenes Modul unknown, Version 0.0.0.0, Fehleradresse 0x02330218.
Das medienspezifische Ereignis für [tdsskiller.exe!ws!] wird verarbeitet.
Error: (12/18/2014 01:14:43 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlgeschlagene Anwendung tdsskiller.exe, Version 3.0.0.41, fehlgeschlagenes Modul unknown, Version 0.0.0.0, Fehleradresse 0x01490218.
Das medienspezifische Ereignis für [tdsskiller.exe!ws!] wird verarbeitet.
Error: (12/18/2014 01:05:06 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlgeschlagene Anwendung firefox.exe, Version 34.0.5.5443, fehlgeschlagenes Modul unknown, Version 0.0.0.0, Fehleradresse 0x00000001.
Das medienspezifische Ereignis für [firefox.exe!ws!] wird verarbeitet.
Error: (12/18/2014 01:04:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlgeschlagene Anwendung tdsskiller.exe, Version 3.0.0.41, fehlgeschlagenes Modul tdsskiller.exe, Version 3.0.0.41, Fehleradresse 0x00897607.
Das medienspezifische Ereignis für [tdsskiller.exe!ws!] wird verarbeitet.
System errors:
=============
Error: (12/21/2014 02:09:11 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "app_switching" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (12/21/2014 02:00:58 AM) (Source: Dhcp) (EventID: 1002) (User: )
Description: Die IP-Adresslease 192.168.1.113 für die Netzwerkkarte mit der Netzwerkadresse 0019D2986C9F wurde durch
den DHCP-Server 0.0.0.0 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet).
Error: (12/19/2014 05:03:34 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "video_call" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (12/19/2014 05:03:19 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows-Bilderfassung (WIA)" wurde nicht ordnungsgemäß gestartet.
Error: (12/19/2014 05:03:19 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "RAS-Verbindungsverwaltung" wurde nicht ordnungsgemäß gestartet.
Error: (12/18/2014 01:51:05 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst video_call.
Error: (12/18/2014 01:03:29 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "video_call" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (12/18/2014 00:58:54 AM) (Source: 0) (EventID: 1) (User: )
Description: 0xC0000001HarddiskVolume1
Error: (12/17/2014 05:56:26 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Bluetooth Service" ist vom Dienst "RAS-Verbindungsverwaltung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1070
Error: (12/17/2014 05:56:26 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Automatic Updates" wurde nicht ordnungsgemäß gestartet.
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 CPU T5600 @ 1.83GHz
Percentage of memory in use: 88%
Total physical RAM: 1014.36 MB
Available physical RAM: 120.11 MB
Total Pagefile: 2441.64 MB
Available Pagefile: 1240.28 MB
Total Virtual: 2047.88 MB
Available Virtual: 1894.33 MB
==================== Drives ================================
Drive c: (738) (Fixed) (Total:70.62 GB) (Free:3.6 GB) NTFS ==>[Drive with boot components (Windows XP)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 74.5 GB) (Disk ID: 64DC2669)
Partition 1: (Active) - (Size=70.6 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=3.9 GB) - (Type=12)
==================== End Of Log ============================
|
|
| Themen zu Windows XP: Neue Tabs öffnen sich |
| andere, anleitung, automatisch, browser, chromium, entfernt, fehlercode 28, hallo zusammen, neue tabs mit werbung, neustart, newtab, officejet, optimizer, problem, probleme, programm, pup.optional.dealsfinderpro.a, pup.optional.multisp, quarantäne, required, rogue.multiple, seiten, tabs mit werbung, tabs öffnen, trojan.agent.ded, trojan.agent.ed, werbung, windows, windows xp, zusammen, öffnen |
Linear-Darstellung
