Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Bitdefender: Passwortgeschützte Objekte sind nicht zu finden (https://www.trojaner-board.de/130409-bitdefender-passwortgeschuetzte-objekte-finden.html)

duddl 31.01.2013 16:15
Bitdefender: Passwortgeschützte Objekte sind nicht zu finden
 
Hallo zusammen

ich lasse bei mir zur Zeit wegen langsamem PC öfters den bitdefender 2013 nach malware scannen. Zum Schluss des Scans wird mir folgendes angezeigt:

"388 Objekte konnten wegen des Passwortschutzes nicht gescannt werden; es wird empfohlen einen Kontextscan für die passwortgeschützten Objekte durchzuführen. Machen Sie einen Rechtsklick auf jedes passwortgeschützte Objekt und geben Sie das Passwort ein, um den Scan fortzufahren."

Ich kann aber auf keine Datei einen Rechtsklick machen und jetzt weiß ich nicht was ich tun soll und wann ich überhaupt einen Passwortschutz erstellt habe.

P.S: Die meisten passwortgeschützten Objekte sind von spybot, den ich aber schon lange deinstalliert hatte.

Vielleicht kann mir jemand von Euch helfen? Danke.

cosinus 01.02.2013 11:39
:hallo:

Zitat:
Vielleicht kann mir jemand von Euch helfen? Danke.
Und wobei genau soll man jetzt helfen? :confused:

duddl 01.02.2013 14:25
Ich möchte nur wissen, ob das sehr schlimm ist, wenn das Antivirenprogramm Dateien nicht öffnen kann, um zu schauen ob sich da vielleicht Malware befindet.

Und wie man den Passwortschutz bei diesen Objekten entfernt.

cosinus 01.02.2013 14:50
Ist dieser Zusammenhang denn schwierig nachzuvolleziehen? :wtf:
Was bitte soll ein fremder Virenscanner in passwortgeschützten Archiven eines anderen Scanners rumsuchen? :balla:
Welchen Sinn soll das bitte ergeben?
Und wie bitte soll eine Gefahr davon ausgehen, wenn niemand außer Spybot mehr das Passwort zu diesen Archiven hat und somit keiner mehr die ZIPs entpacken kann?

duddl 01.02.2013 14:56
es gibt aber auch eine andere Datei die er nichdt durchsuchen kann.
nämlich die Lautstärke oder Volume. Da bringt er eine fehlermeldung

cosinus 01.02.2013 15:38
Zitat:
Zitat von duddl (Beitrag 1003518)
es gibt aber auch eine andere Datei die er nichdt durchsuchen kann.
nämlich die Lautstärke oder Volume. Da bringt er eine fehlermeldung
Sry, welchen Sinn macht es die Lautstärke nach Schädlingen zu überprüfen :balla:
Könntest du bitte mal das Log komplett posten :glaskugel:

duddl 01.02.2013 18:20
Das scannt das Programm selber.
Ich poste es gleich rein.

cosinus 01.02.2013 18:23
Wieso neuer Scan? Wäre es nicht sinnvoller die vorhandenen Logs erstmal zu posten? :rolleyes:

duddl 01.02.2013 18:29
hab den letzten scan gelöscht

wie bekomme ich die screenshots hier ins forum?

cosinus 01.02.2013 18:32
Das war sehr clever SCNR :applaus:

duddl 01.02.2013 18:35
wie bekomme ich die screeshots hier ins forum ??!

wie bekomme ich den screenshot hier ins forum??!

cosinus 01.02.2013 18:42
In den Anhang oder hier hochladen => Saved.im und hier im Beitrag verlinken

duddl 01.02.2013 18:46
C:\Users\Info\Documents\1359727427_1_01.xml

ich kann das protokoll dort nicht hochladen da es "kein bild" ist

C:\Users\Info\Documents\1359727427_1_01.xml

cosinus 01.02.2013 18:53
Jetzt verrate mir nur noch wie ich Zugriff auf deine lokalen Dateien bekomme! :D

duddl 01.02.2013 18:55
Code:
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0002.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0005.zip=>Windows/ntbtlog.txt
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0003.zip=>Log-0003.md5
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0003.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectDraw-0000.zip=>130113-210425.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0007.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0002.zip=>Quarantine.lst
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_th.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0000.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0001.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0003.zip=>Log-0003.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0004.zip=>DoubleClick-0004.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Management Console-0000.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0004.zip=>Macromedia.FlashPlayer.Cookies-0004.md5
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0004.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0005.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_lv.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0008.zip=>130116-173830.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0007.zip=>Windows/setupact.log
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0001.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0004.zip=>Macromedia.FlashPlayer.Cookies-0004.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_en-GB.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0000.zip=>MS DirectInput-0000.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0002.zip=>130114-202358.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\CasaleMedia-0003.zip=>CasaleMedia-0003.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0001.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0002.zip=>Windows-0002.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/FacebookCrashHandler.exe
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0001.zip=>130114-152110.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0002.zip=>Users/Info/AppData/Roaming/Macromedia/Flash Player/#SharedObjects/2W5HE6WH/skype.com/#ui/preferences.sol
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_es.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0000.zip=>MS Direct3D-0000.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectDraw-0001.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0002.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0003.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0001.zip=>130114-152110.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_uk.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0000.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0000.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0003.zip=>Verlauf-0003.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0004.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0004.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_bg.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0003.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_ja.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0001.zip=>MS DirectInput-0001.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0003.zip=>130115-154940.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0003.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0003.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0004.zip=>130116-173830.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0000.zip=>130113-210425.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0007.zip=>Windows/ntbtlog.txt
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\CasaleMedia-0000.zip=>130113-210425.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_fr.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_nl.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0006.zip=>Log-0006.md5
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0003.zip=>DoubleClick-0003.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_ro.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0001.zip=>130114-152110.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0002.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0004.zip=>Windows/setupact.log
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/FacebookUpdate.exe
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0006.zip=>Log-0006.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0000.zip=>130113-210425.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0005.zip=>130116-173830.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Tradedoubler-0000.zip=>130113-210425.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\CasaleMedia-0002.zip=>CasaleMedia-0002.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0002.zip=>MS DirectInput-0002.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0000.zip=>130113-210425.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0004.zip=>130114-152110.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0002.zip=>Windows Explorer-0002.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Quarantine.lst
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0001.zip=>Users/Info/AppData/Roaming/Macromedia/Flash Player/#SharedObjects/2W5HE6WH/skype.com/#ui/preferences.sol
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Management Console-0001.zip=>MS Management Console-0001.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\System Volume Information\{c5f76447-6b01-11e2-b6ed-e4115bf9b2f0}{3808876b-c176-4e48-b7ae-04046e6cc752}

(object was not found)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\CasaleMedia-0001.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_gu.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0000.zip=>Verlauf-0000.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_es-419.dll
Password-protected
Not scanned (file was password-protected)
File: C:\System Volume Information\{56169e89-6af9-11e2-9238-e4115bf9b2f0}{3808876b-c176-4e48-b7ae-04046e6cc752}

(object was not found)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_da.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_sr.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0001.zip=>Quarantine.lst
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0000.zip=>MediaPlex-0000.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0004.zip=>130115-161725.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0002.zip=>130114-202358.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_de.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_sv.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Management Console-0001.zip=>130115-154940.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0001.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0001.zip=>Cookie-0001.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0005.zip=>Quarantine.lst
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0005.zip=>130120-181221.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Tradedoubler-0000.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0004.zip=>MediaPlex-0004.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0005.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0003.zip=>MS DirectInput-0003.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0001.zip=>Log-0001.md5
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0000.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0003.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_ta.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0004.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0002.zip=>130115-154940.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0003.zip=>130116-173830.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_te.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0002.zip=>DoubleClick-0002.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0001.zip=>Log-0001.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0008.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_fil.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0003.zip=>Quarantine.lst
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0001.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0006.zip=>130120-181221.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0002.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Management Console-0001.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectDraw-0002.zip=>130114-202358.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0001.zip=>Windows/setupact.log
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0005.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0006.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\CasaleMedia-0003.zip=>130115-154940.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0005.zip=>130120-181221.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\CasaleMedia-0001.zip=>CasaleMedia-0001.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0002.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0002.zip=>130114-152110.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0002.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_el.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0004.zip=>Windows-0004.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0004.zip=>MS DirectInput-0004.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0003.zip=>130115-154940.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0000.zip=>Users/Info/AppData/Roaming/Macromedia/Flash Player/#SharedObjects/2W5HE6WH/skype.com/#ui/preferences.sol
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0004.zip=>130116-173830.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0001.zip=>130114-152110.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_et.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0000.zip=>130113-210425.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Tradedoubler-0003.zip=>130115-154940.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_zh-TW.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0000.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_is.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectDraw-0002.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0003.zip=>130115-154940.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0003.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0004.zip=>130116-173830.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0004.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_mr.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_iw.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0000.zip=>130113-210425.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0001.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0001.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0000.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\System Volume Information\{31a3bfb9-6a32-11e2-9295-e4115bf9b2f0}{3808876b-c176-4e48-b7ae-04046e6cc752}

(object was not found)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0005.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0005.zip=>Verlauf-0005.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0005.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0004.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0000.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0000.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0003.zip=>Cookie-0003.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0004.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0004.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\FehlenderAnwendungspfad.zip=>sbRecovery.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0001.zip=>130114-202358.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0003.zip=>Windows Explorer-0003.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0005.zip=>MS DirectInput-0005.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0004.zip=>Log-0004.md5
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectDraw-0000.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0001.zip=>DoubleClick-0001.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\CasaleMedia-0002.zip=>130114-202358.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0004.zip=>Log-0004.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\System Volume Information\{c5f7641a-6b01-11e2-b6ed-e4115bf9b2f0}{3808876b-c176-4e48-b7ae-04046e6cc752}

(object was not found)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0003.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0000.zip=>130113-210425.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0006.zip=>Windows/setupact.log
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\CasaleMedia-0000.zip=>CasaleMedia-0000.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectDraw-0000.zip=>MS DirectDraw-0000.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectDraw-0001.zip=>MS DirectDraw-0001.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectDraw-0002.zip=>MS DirectDraw-0002.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0001.zip=>Windows-0001.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0002.zip=>130114-202358.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Tradedoubler-0002.zip=>130114-202358.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_cs.dll
Password-protected
Not scanned (file was password-protected)
File: C:\System Volume Information\{c5f76443-6b01-11e2-b6ed-e4115bf9b2f0}{3808876b-c176-4e48-b7ae-04046e6cc752}

(object was not found)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0002.zip=>130114-202358.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\CasaleMedia-0002.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>130120-181221.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_sk.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0001.zip=>Cache-0001.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Wordpad-0000.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Management Console-0000.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0005.zip=>MS Direct3D-0005.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0003.zip=>Cache-0003.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0002.zip=>Verlauf-0002.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0005.zip=>130120-181221.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0001.zip=>130114-152110.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0005.zip=>Cache-0005.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0003.zip=>130115-154940.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0002.zip=>Quarantine.lst
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0002.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0006.zip=>Quarantine.lst
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0003.zip=>MediaPlex-0003.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Tradedoubler-0001.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0003.zip=>130115-154940.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0004.zip=>130116-173830.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_hi.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0000.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\System Volume Information\{31a3bfbd-6a32-11e2-9295-e4115bf9b2f0}{3808876b-c176-4e48-b7ae-04046e6cc752}

(object was not found)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0005.zip=>Cookie-0005.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0001.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0004.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}

(object was not found)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0000.zip=>DoubleClick-0000.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0005.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0000.zip=>Quarantine.lst
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_hu.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0002.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0007.zip=>Log-0007.md5
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0004.zip=>Quarantine.lst
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0003.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_lt.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0001.zip=>130114-152110.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0003.zip=>Windows/setupact.log
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_tr.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0007.zip=>Log-0007.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0003.zip=>Users/Info/AppData/Roaming/Macromedia/Flash Player/#SharedObjects/2W5HE6WH/a.affil.io/s/af.swf/afstorage.sol
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0003.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0000.zip=>130113-210425.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_id.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0003.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0001.zip=>130113-210425.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0003.zip=>130115-154940.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0004.zip=>130116-173830.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_ar.dll
Password-protected
Not scanned (file was password-protected)
File: C:\System Volume Information\{31a3bf08-6a32-11e2-9295-e4115bf9b2f0}{3808876b-c176-4e48-b7ae-04046e6cc752}

(object was not found)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_pt-PT.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0006.zip=>Windows/ntbtlog.txt
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0004.zip=>Windows Explorer-0004.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0006.zip=>Windows-0006.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0000.zip=>130113-210425.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0000.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0001.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_it.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0004.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0005.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Wordpad-0000.zip=>130113-210425.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_ms.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0004.zip=>MS Direct3D-0004.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0006.zip=>130115-154940.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0007.zip=>130116-173830.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0002.zip=>130114-202358.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0002.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0002.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/FacebookUpdate.exe
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0001.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0002.zip=>130114-202358.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0005.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0001.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0001.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0004.zip=>130120-181221.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0005.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0002.zip=>Log-0002.md5
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectDraw-0001.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0002.zip=>Log-0002.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0000.zip=>Windows/setupact.log
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0000.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0004.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_pt-BR.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_ru.dll
Password-protected
Not scanned (file was password-protected)
File: C:\System Volume Information\{31a3bf7d-6a32-11e2-9295-e4115bf9b2f0}{3808876b-c176-4e48-b7ae-04046e6cc752}

(object was not found)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0008.zip=>Windows/setupact.log
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0000.zip=>Cookie-0000.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0005.zip=>130120-181221.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0002.zip=>130114-202358.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/FacebookUpdateHelper.msi
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0003.zip=>Windows-0003.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0005.zip=>130120-181221.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Tradedoubler-0003.zip=>Tradedoubler-0003.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Management Console-0000.zip=>MS Management Console-0000.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0008.zip=>Windows/ntbtlog.txt
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Wordpad-0000.zip=>MS Wordpad-0000.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_kn.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0005.zip=>130114-202358.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\CasaleMedia-0003.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0001.zip=>130114-152110.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0003.zip=>MS Direct3D-0003.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_sl.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_zh-CN.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Management Console-0001.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0004.zip=>Verlauf-0004.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0003.zip=>130115-154940.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0000.zip=>130113-210425.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0003.zip=>Quarantine.lst
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0002.zip=>MediaPlex-0002.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0007.zip=>Quarantine.lst
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0003.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\System Volume Information\{26e60037-6861-11e2-9543-e4115bf9b2f0}{3808876b-c176-4e48-b7ae-04046e6cc752}

(object was not found)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0003.zip=>130114-152110.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Tradedoubler-0002.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0001.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Tradedoubler-0002.zip=>Tradedoubler-0002.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0002.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectDraw-0001.zip=>130114-152110.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0005.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0000.zip=>Macromedia.FlashPlayer.Cookies-0000.md5
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0006.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0005.zip=>Log-0005.md5
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_hr.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0001.zip=>Quarantine.lst
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_pl.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0000.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0003.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0004.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0000.zip=>Macromedia.FlashPlayer.Cookies-0000.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0005.zip=>Log-0005.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0000.zip=>130113-210425.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0000.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0004.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0000.zip=>Windows-0000.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0002.zip=>Cookie-0002.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0000.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0000.zip=>Windows Explorer-0000.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Facebook.Messenger-0000.md5
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0004.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Tradedoubler-0001.zip=>Tradedoubler-0001.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\FehlenderAnwendungspfad.zip=>sbRecovery.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_en.dll
Password-protected
Not scanned (file was password-protected)
File: C:\System Volume Information\{31a3befb-6a32-11e2-9295-e4115bf9b2f0}{3808876b-c176-4e48-b7ae-04046e6cc752}

(object was not found)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdate.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Facebook.Messenger-0000.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_ml.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0004.zip=>Users/Info/AppData/Roaming/Macromedia/Flash Player/#SharedObjects/2W5HE6WH/skype.com/#ui/preferences.sol
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectDraw-0000.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0001.zip=>Macromedia.FlashPlayer.Cookies-0001.md5
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0001.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0002.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0002.zip=>MS Direct3D-0002.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0005.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0006.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0001.zip=>Verlauf-0001.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0002.zip=>130114-202358.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0001.zip=>Macromedia.FlashPlayer.Cookies-0001.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0003.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0005.zip=>130120-181221.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_fa.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_ur.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0003.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0002.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\System Volume Information\{26e60015-6861-11e2-9543-e4115bf9b2f0}{3808876b-c176-4e48-b7ae-04046e6cc752}

(object was not found)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0002.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0002.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_fi.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Tradedoubler-0000.zip=>Tradedoubler-0000.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0000.zip=>Log-0000.md5
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_bn.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\CasaleMedia-0001.zip=>130114-152110.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0003.zip=>130115-154940.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0004.zip=>130116-173830.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0000.zip=>Log-0000.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\System Volume Information\{26e6003b-6861-11e2-9543-e4115bf9b2f0}{3808876b-c176-4e48-b7ae-04046e6cc752}

(object was not found)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectDraw-0002.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0002.zip=>Macromedia.FlashPlayer.Cookies-0002.md5
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_no.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_vi.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0008.zip=>Log-0008.md5
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0005.zip=>DoubleClick-0005.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0002.zip=>Windows/setupact.log
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0001.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Wordpad-0000.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_ca.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0001.zip=>130114-152110.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0002.zip=>Macromedia.FlashPlayer.Cookies-0002.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0005.zip=>Quarantine.reg
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0008.zip=>Log-0008.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0005.zip=>130116-173830.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Tradedoubler-0001.zip=>130114-152110.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0001.zip=>130114-152110.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0004.zip=>Cookie-0004.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0003.zip=>130115-154940.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0004.zip=>130116-173830.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0005.zip=>Windows-0005.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0003.zip=>Users/Info/AppData/Roaming/Macromedia/Flash Player/#SharedObjects/2W5HE6WH/skype.com/#ui/preferences.sol
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\CasaleMedia-0000.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_ko.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0001.zip=>MS Direct3D-0001.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0000.zip=>Cache-0000.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0003.zip=>Macromedia.FlashPlayer.Cookies-0003.md5
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Management Console-0000.zip=>130113-210425.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0000.zip=>130113-210425.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0002.zip=>Cache-0002.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Facebook.Messenger-0000.zip=>Users/Info/AppData/Local/Facebook/Update/1.2.205.0/goopdateres_or.dll
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0004.zip=>Cache-0004.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0000.zip=>Quarantine.lst
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Macromedia.FlashPlayer.Cookies-0003.zip=>Macromedia.FlashPlayer.Cookies-0003.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0004.zip=>130115-161725.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0001.zip=>MediaPlex-0001.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0004.zip=>Quarantine.lst
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0000.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0008.zip=>Quarantine.lst
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0004.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Explorer-0001.zip=>Windows Explorer-0001.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0002.zip=>130114-202358.xml
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0005.zip=>MediaPlex-0005.sfv
Password-protected
Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Quarantine\Tradedoubler-0003.zip=>Quarantine.ini
Password-protected
Not scanned (file was password-protected)

[-]Detailed Scan Summary
fast alles ist vom schon lange gelöschten spybot

asd.png - Saved.im

http://saved.im/mtg5mzgxb3p1/asd.png

Vor allem sind aber die Voume-Objekte wichtig, die er findet.
Denn bei meinem PC geht die Lautstärkenregelung nicht mehr und ich kann sie nicht mehr bedienen.

cosinus 02.02.2013 15:02
Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
  • Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.

  • Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.

  • Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!

  • Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!

  • Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.


Erstmal eine Kontrolle mit OTL bitte:
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in CODE-Tags in den Thread.

duddl 02.02.2013 15:31
OTL Logfile:
Code:
OTL logfile created on: 02.02.2013 15:12:34 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Info\Downloads
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,61 Gb Total Physical Memory | 0,88 Gb Available Physical Memory | 33,74% Memory free
5,21 Gb Paging File | 2,38 Gb Available in Paging File | 45,75% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 596,07 Gb Total Space | 523,02 Gb Free Space | 87,75% Space Free | Partition Type: NTFS
 
Computer Name: ALEXANDER-HP630 | User Name: Info | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Info\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Bitdefender\Bitdefender 2013\vsserv.exe (Bitdefender)
PRC - C:\Programme\Bitdefender\Bitdefender 2013\bdagent.exe (Bitdefender)
PRC - C:\Programme\Origin\Origin.exe (Electronic Arts)
PRC - C:\Programme\Google\Update\1.3.21.124\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe (Freemake)
PRC - C:\ProgramData\BrowserProtect\2.6.1040.25\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe ()
PRC - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe (1und1 Mail und Media GmbH)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\System32\IntelCpHeciSvc.exe (Intel Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Programme\Bitdefender\Bitdefender 2013\updatesrv.exe (Bitdefender)
PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Programme\program\soffice.exe (OpenOffice.org)
PRC - C:\Programme\program\soffice.bin (OpenOffice.org)
PRC - C:\Programme\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Programme\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Programme\Bluetooth Suite\Ath_CoexAgent.exe (Atheros)
PRC - C:\Programme\Bluetooth Suite\BtvStack.exe (Atheros Communications)
PRC - C:\Programme\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)
PRC - C:\Programme\Bluetooth Suite\AdminService.exe (Atheros Commnucations)
PRC - C:\Programme\ArcSoft\TotalMedia 3.5\TMMonitor.exe (ArcSoft, Inc.)
PRC - C:\Programme\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Realsil Microelectronics Inc.)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\audiodg.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\Info\AppData\Local\Google\Chrome\User Data\PepperFlash\11.5.31.138\pepflashplayer.dll ()
MOD - C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll ()
MOD - C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\PepperFlash\pepflashplayer.dll ()
MOD - C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\pdf.dll ()
MOD - C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\libglesv2.dll ()
MOD - C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\libegl.dll ()
MOD - C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\ffmpegsumo.dll ()
MOD - C:\Programme\Origin\tufao.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\346a7a67978cead8e2ff52c6d80bbeb7\IAStorUtil.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\500a8ae2a5d27132d87ccac9f97b0069\IAStorCommon.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\0ac577a8ad6528ff03b50db5eeeac8be\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\865d2bf19a7af7fab8660a42d92550fe\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf827fe7bc99d9bcf0ba3621054ef527\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\c1a66b44c4780c039576eaf18f4cd8dc\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll ()
MOD - C:\ProgramData\BrowserProtect\2.6.1040.25\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe ()
MOD - c:\ProgramData\BrowserProtect\2.6.1040.25\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll ()
MOD - C:\Programme\Bitdefender\Bitdefender 2013\txmlutil.dll ()
MOD - C:\Windows\System32\IccLibDll.dll ()
MOD - C:\Programme\program\libxml2.dll ()
MOD - C:\Programme\program\libxslt.dll ()
MOD - C:\Programme\Bitdefender\Bitdefender 2013\bdmetrics.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\System32\msjetoledb40.dll ()
MOD - C:\Programme\ArcSoft\TotalMedia 3.5\AbilisWinUsb.dll ()
MOD - C:\Programme\ArcSoft\TotalMedia 3.5\VendorCmdRW.dll ()
MOD - C:\Programme\ArcSoft\TotalMedia 3.5\uPiApi.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (BdDesktopParental) -- C:\Programme\Bitdefender\Bitdefender 2013\bdparentalservice.exe (Bitdefender)
SRV - (VSSERV) -- C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe (Bitdefender)
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (Freemake Improver) -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe (Freemake)
SRV - (BrowserProtect) -- C:\ProgramData\BrowserProtect\2.6.1040.25\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe ()
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (cphs) -- C:\Windows\System32\IntelCpHeciSvc.exe (Intel Corporation)
SRV - (UPDATESRV) -- C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe (Bitdefender)
SRV - (SkypeUpdate) -- C:\Programme\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Skype C2C Service) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (HPWMISVC) -- C:\Programme\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Development Company, L.P.)
SRV - (IAStorDataMgrSvc) -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (Atheros Bt&Wlan Coex Agent) -- C:\Programme\Bluetooth Suite\Ath_CoexAgent.exe (Atheros)
SRV - (AtherosSvc) -- C:\Programme\Bluetooth Suite\AdminService.exe (Atheros Commnucations)
SRV - (IconMan_R) -- C:\Programme\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Realsil Microelectronics Inc.)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (ACDaemon) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (ZTEusbser6k) -- system32\DRIVERS\ZTEusbser6k.sys File not found
DRV - (ZTEusbnmea) -- system32\DRIVERS\ZTEusbnmea.sys File not found
DRV - (ZTEusbmdm6k) -- system32\DRIVERS\ZTEusbmdm6k.sys File not found
DRV - (VGPU) -- System32\drivers\rdvgkmd.sys File not found
DRV - (tsusbhub) -- system32\drivers\tsusbhub.sys File not found
DRV - (Synth3dVsc) -- System32\drivers\synth3dvsc.sys File not found
DRV - (massfilter) -- system32\drivers\massfilter.sys File not found
DRV - (AVFSFilter) -- system32\DRIVERS\avfsfilter.sys File not found
DRV - (avckf) -- C:\Windows\System32\drivers\avckf.sys (BitDefender)
DRV - (avc3) -- C:\Windows\System32\drivers\avc3.sys (BitDefender)
DRV - (BDSandBox) -- C:\Windows\System32\drivers\bdsandbox.sys (BitDefender SRL)
DRV - (avchv) -- C:\Windows\System32\drivers\avchv.sys (BitDefender)
DRV - (trufos) -- C:\Windows\System32\drivers\trufos.sys (BitDefender S.R.L.)
DRV - (bdselfpr) -- C:\Programme\Bitdefender\Bitdefender 2013\bdselfpr.sys (BitDefender LLC)
DRV - (gzflt) -- C:\Windows\System32\drivers\gzflt.sys (BitDefender LLC)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (BdfNdisf) -- c:\Programme\Common Files\Bitdefender\Bitdefender Firewall\bdfndisf6.sys (BitDefender LLC)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Qualcomm Atheros Communications, Inc.)
DRV - (IntcDAud) -- C:\Windows\System32\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV - (bdfwfpf) -- C:\Programme\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys (BitDefender LLC)
DRV - (RTL2832U_IRHID) -- C:\Windows\System32\drivers\RTL2832U_IRHID.sys (Realtek)
DRV - (RTL2832UBDA) -- C:\Windows\System32\drivers\RTL2832UBDA.sys (REALTEK SEMICONDUCTOR Corp.)
DRV - (RTL2832UUSB) -- C:\Windows\System32\drivers\RTL2832UUSB.sys (REALTEK SEMICONDUCTOR Corp.)
DRV - (BtFilter) -- C:\Windows\System32\drivers\btfilter.sys (Atheros)
DRV - (BTATH_RCP) -- C:\Windows\System32\drivers\btath_rcp.sys (Atheros)
DRV - (BTATH_A2DP) -- C:\Windows\System32\drivers\btath_a2dp.sys (Atheros)
DRV - (BTATH_HCRP) -- C:\Windows\System32\drivers\btath_hcrp.sys (Atheros)
DRV - (BTATH_LWFLT) -- C:\Windows\System32\drivers\btath_lwflt.sys (Atheros)
DRV - (AthBTPort) -- C:\Windows\System32\drivers\btath_flt.sys (Atheros)
DRV - (BTATH_BUS) -- C:\Windows\System32\drivers\btath_bus.sys (Atheros)
DRV - (RSPCIESTOR) -- C:\Windows\System32\drivers\RtsPStor.sys (Realtek Semiconductor Corp.)
DRV - (npf) -- C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (MEI) -- C:\Windows\System32\drivers\HECI.sys (Intel Corporation)
DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (Afc) -- C:\Windows\System32\drivers\afc.sys (Arcsoft, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=cd92cf51-342e-492a-8fab-a7200a248b0b&searchtype=ds&q={searchTerms}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=484&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=0727329469794586&q={searchTerms}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = WEB.DE Suche - die Suchmaschine
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = SearchCompletion Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=cd92cf51-342e-492a-8fab-a7200a248b0b&searchtype=ds&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=cd92cf51-342e-492a-8fab-a7200a248b0b&searchtype=ds&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = SearchCompletion Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=cd92cf51-342e-492a-8fab-a7200a248b0b&searchtype=ds&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = SearchCompletion Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=cd92cf51-342e-492a-8fab-a7200a248b0b&searchtype=ds&q={searchTerms}
IE - HKCU\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No CLSID value found
IE - HKCU\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=cd92cf51-342e-492a-8fab-a7200a248b0b&searchtype=ds&q={searchTerms}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&r=
IE - HKCU\..\SearchScopes\{09038620-190C-402B-A92F-18864E6AB22F}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://www.claro-search.com/?q={searchTerms}&affID=114506&tt=0113_6&babsrc=SP_clro&mntrId=2ab28cb800000000000026de2ba841cd
IE - HKCU\..\SearchScopes\{5A817CF6-92D5-4DE5-AC38-82DF8A73EF28}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{649041DE-18B4-47FD-86BD-87083B1A78B7}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848
IE - HKCU\..\SearchScopes\{6B1D1FB7-7233-4F7C-802C-21A1DDB12754}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{81CE708B-5104-4C62-B333-94B417473B29}: "URL" = hxxp://go.mail.com/br/ie8_search_web/?su={searchTerms}
IE - HKCU\..\SearchScopes\{86AEB91E-A7FB-4FE6-9B06-55574E9AF728}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKCU\..\SearchScopes\{9961BF31-9CCC-4D28-88B7-BB30137CE397}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=33AEA8D2-0C95-4F29-9D70-B3155A83F187&apn_sauid=E46F4EB1-1B8C-45C9-ACE4-A4DEA1A35778
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=484&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=0727329469794586&q={searchTerms}
IE - HKCU\..\SearchScopes\{B0E0A740-E869-436E-8FD7-58BEA90AF721}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-flv
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin:  File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Info\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Info\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fmconverter@gmail.com: C:\Program Files\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\ [2012.12.18 16:27:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.26 09:58:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\bdThunderbird@bitdefender.com: C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext [2013.01.28 17:59:27 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{58bd07eb-0ee0-4df0-8121-dc9b693373df}: C:\ProgramData\BrowserProtect\2.6.1040.25\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension [2013.01.06 17:36:04 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.26 09:58:30 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2012.12.29 13:41:45 | 000,000,000 | ---D | M] (No name found) -- \mozilla\Firefox\extensions
[2012.12.29 13:41:45 | 000,000,000 | ---D | M] (No name found) -- \mozilla\Firefox\extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}
[2013.01.10 16:51:41 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.11.17 15:23:28 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.01.10 16:51:41 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\distribution\extensions
[2013.01.10 16:51:41 | 000,000,000 | ---D | M] (WEB.DE MailCheck) -- C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de
[2013.01.26 09:58:30 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2013.01.05 16:11:17 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.01.05 16:11:17 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.12.18 14:54:52 | 000,003,195 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Complitly.xml
[2013.01.05 16:11:17 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2013.01.05 16:11:17 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.01.05 15:41:40 | 000,002,687 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2013.01.05 16:11:17 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.01.05 16:11:17 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: Google
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter},
CHR - homepage: Google
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Info\AppData\Local\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Info\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - Extension: Red Ball Jump = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahkigbfemaalcamljnhhpidckcenneai\1.3_0\
CHR - Extension: Angry Birds = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.5.0.7_0\
CHR - Extension: YouTube = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Angry birds = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjdhpighfhhhjpkjehlcpamdmpckhnll\1.2_0\
CHR - Extension: Google-Suche = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: Bad Piggies HD = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\gokpccjacnihibhbdgjeglpgiodeolpm\3.2.4_0\
CHR - Extension: Google Mail-Checker = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff\4.4.0_0\
CHR - Extension: Minecraft = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlpgoledhpdldmmhcgfcaecodnkmoiea\0.0.0.8_0\
CHR - Extension: Doodle Jump = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\nojaabckpfdijgbnlhdlhjheiappijbp\2.3.1_0\
CHR - Extension: BrowserProtect = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgafcinpmmpklohkojmllohdhomoefph\1.0_0\
CHR - Extension: Google Mail = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
 
O1 HOSTS File: ([2013.01.15 15:49:14 | 000,445,034 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        全讯网,åšå½©ä¼˜æƒ*,皇å†*æ*£ç½‘cr67com,皇å†*比分,皇å†*å³æ—¶æŒ‡æ•°,太阳城代ç†112scg,tt娱ä¹åŸŽ8bc8,网上真钱娱
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        ²©²Êͨ,²©²ÊÍø,½ð±¦²©188,²©²ÊͨÆÀ¼¶,°Ù¼ÒÀÖ,°ÂÃî°Ù¼ÒÀÖ
O1 - Hosts: 127.0.0.1        100sexlinks.com - Informationen zum Thema Sex links. Diese Website steht zum Verkauf!
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 127.0.0.1        www.123fporn.info
O1 - Hosts: 15284 more lines...
O2 - BHO: (WEB.DE Konfiguration) - {17166733-40EA-4432-A85C-AE672FF0E236} - C:\ProgramData\1und1InternetExplorerAddon\BHOXML.dll (1&1 Mail & Media GmbH)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Programme\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (WEB.DE MailCheck BHO) - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (WEB.DE MailCheck) - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (WEB.DE MailCheck) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [AthBtTray] C:\Program Files\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)
O4 - HKLM..\Run: [AtherosBtStack] C:\Program Files\Bluetooth Suite\BtvStack.exe (Atheros Communications)
O4 - HKLM..\Run: [Bdagent] C:\Programme\Bitdefender\Bitdefender 2013\bdagent.exe (Bitdefender)
O4 - HKLM..\Run: [HP Quick Launch] C:\Programme\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [IAStorIcon] C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [MailCheck IE Broker] C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe (1und1 Mail und Media GmbH)
O4 - HKLM..\Run: [WEB.DE MailCheck Broker] C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe (1und1 Mail und Media GmbH)
O4 - HKCU..\Run: [EADM] C:\Program Files\Origin\Origin.exe (Electronic Arts)
O4 - HKCU..\Run: [Facebook Update] C:\Users\Info\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - Startup: C:\Users\Info\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Programme\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O8 - Extra context menu item: Free YouTube Download - C:\Users\Info\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Programme\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455}  (ExentInf Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1442A48A-A5DF-411E-9A01-E478F1A8202E}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4E70BA11-C8F2-4E5A-AE19-2A1638EC9218}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\webde {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O20 - AppInit_DLLs: (c:\progra~2\browse~2\261040~1.25\{c16c1~1\browse~1.dll) - c:\ProgramData\BrowserProtect\2.6.1040.25\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{a59db7fb-088d-11e2-a4a2-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{a59db7fb-088d-11e2-a4a2-806e6f6e6963}\Shell\AutoRun\command - "" = D:\setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.02.02 12:31:21 | 000,000,000 | -H-D | C] -- C:\Users\Info\Documents\Freemake_do_not_remove_this_folder634954050811576309
[2013.01.31 17:44:42 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\100_FUJI
[2013.01.31 16:32:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Dumps
[2013.01.30 18:22:34 | 000,000,000 | ---D | C] -- C:\Windows\System32\Extensions
[2013.01.30 18:22:12 | 000,000,000 | ---D | C] -- C:\Intel
[2013.01.30 18:22:12 | 000,000,000 | ---D | C] -- \Intel
[2013.01.30 17:22:13 | 000,000,000 | ---D | C] -- C:\Windows\System32\searchplugins
[2013.01.30 16:59:10 | 000,482,928 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\avckf.sys
[2013.01.30 16:58:59 | 000,625,128 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\avc3.sys
[2013.01.29 14:16:06 | 000,072,704 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\bdvedisk.sys
[2013.01.28 17:59:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitdefender 2013
[2013.01.28 17:59:36 | 000,000,000 | ---D | C] -- C:\ProgramData\BDLogging
[2013.01.28 17:59:00 | 000,511,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\capicom.dll
[2013.01.28 17:59:00 | 000,077,192 | ---- | C] (BitDefender LLC) -- C:\Windows\System32\drivers\BdfNdisf6.sys
[2013.01.28 17:59:00 | 000,066,392 | ---- | C] (BitDefender SRL) -- C:\Windows\System32\drivers\bdsandbox.sys
[2013.01.28 17:58:55 | 000,242,504 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\avchv.sys
[2013.01.28 17:39:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Bitdefender
[2013.01.28 17:31:31 | 000,161,312 | ---- | C] (BitDefender LLC) -- C:\Windows\System32\drivers\gzflt.sys
[2013.01.28 17:31:29 | 000,343,456 | ---- | C] (BitDefender S.R.L.) -- C:\Windows\System32\drivers\trufos.sys
[2013.01.28 17:31:29 | 000,000,000 | ---D | C] -- C:\Program Files\Bitdefender
[2013.01.28 17:22:47 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Bitdefender
[2013.01.28 17:11:04 | 000,000,000 | ---D | C] -- C:\ProgramData\SpeedMaxPc
[2013.01.27 19:20:17 | 000,000,000 | -H-D | C] -- C:\Users\Info\Documents\Freemake_do_not_remove_this_folder634949112175897653
[2013.01.27 19:15:41 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\Freemake
[2013.01.26 22:05:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.01.22 15:50:57 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\FOLDER01
[2013.01.21 19:23:03 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core
[2013.01.21 19:19:38 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\FIFA 12
[2013.01.21 17:35:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FIFA 12
[2013.01.21 16:23:40 | 000,000,000 | ---D | C] -- C:\Program Files\Origin Games
[2013.01.21 16:23:28 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Local\Origin
[2013.01.21 16:22:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
[2013.01.21 16:22:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts
[2013.01.21 16:22:34 | 000,000,000 | ---D | C] -- C:\Program Files\Origin
[2013.01.21 14:18:26 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Local\Facebook
[2013.01.18 19:19:35 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Local\360Amigo
[2013.01.15 14:35:06 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2013.01.14 18:21:34 | 000,000,000 | ---D | C] -- C:\ProgramData\clp
[2013.01.12 08:14:11 | 000,000,000 | -H-D | C] -- C:\Program Files\Common Files\EAInstaller
[2013.01.12 08:14:09 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_43.dll
[2013.01.12 08:14:09 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_7.dll
[2013.01.12 08:14:08 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_43.dll
[2013.01.12 08:14:08 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_6.dll
[2013.01.12 08:14:08 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_43.dll
[2013.01.12 08:14:08 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_4.dll
[2013.01.12 08:14:07 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_6.dll
[2013.01.12 08:14:07 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_7.dll
[2013.01.12 08:14:06 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_42.dll
[2013.01.12 08:14:06 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_5.dll
[2013.01.12 08:14:06 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_5.dll
[2013.01.12 08:14:05 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_42.dll
[2013.01.12 08:14:05 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_42.dll
[2013.01.12 08:14:05 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_42.dll
[2013.01.12 08:14:04 | 004,178,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_41.dll
[2013.01.12 08:14:04 | 000,517,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_4.dll
[2013.01.12 08:14:04 | 000,235,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_4.dll
[2013.01.12 08:14:04 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_3.dll
[2013.01.12 08:14:04 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_6.dll
[2013.01.12 08:14:03 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_40.dll
[2013.01.12 08:14:03 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_40.dll
[2013.01.12 08:14:03 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_3.dll
[2013.01.12 08:14:03 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_3.dll
[2013.01.12 08:14:03 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_2.dll
[2013.01.12 08:14:02 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_39.dll
[2013.01.12 08:14:02 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_2.dll
[2013.01.12 08:14:02 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_2.dll
[2013.01.12 08:14:02 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_1.dll
[2013.01.12 08:14:02 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_5.dll
[2013.01.12 08:14:01 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_39.dll
[2013.01.12 08:14:01 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_1.dll
[2013.01.12 08:14:01 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_39.dll
[2013.01.12 08:14:01 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_0.dll
[2013.01.12 08:14:00 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_38.dll
[2013.01.12 08:14:00 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_38.dll
[2013.01.12 08:14:00 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_0.dll
[2013.01.12 08:14:00 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_38.dll
[2013.01.12 08:14:00 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_1.dll
[2013.01.12 08:14:00 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_4.dll
[2013.01.12 08:13:59 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_37.dll
[2013.01.12 08:13:59 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_37.dll
[2013.01.12 08:13:59 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_37.dll
[2013.01.12 08:13:59 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_10.dll
[2013.01.12 08:13:59 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_0.dll
[2013.01.12 08:13:59 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_3.dll
[2013.01.12 08:13:58 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_36.dll
[2013.01.12 08:13:58 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_36.dll
[2013.01.12 08:13:58 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_36.dll
[2013.01.12 08:13:57 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_35.dll
[2013.01.12 08:13:57 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_35.dll
[2013.01.12 08:13:57 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_35.dll
[2013.01.12 08:13:57 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_9.dll
[2013.01.12 08:13:56 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_2.dll
[2013.01.11 15:32:07 | 000,000,000 | ---D | C] -- C:\Program Files\Vodafone-Sicherheitspaket
[2013.01.11 15:31:15 | 000,000,000 | ---D | C] -- C:\ProgramData\fssg
[2013.01.11 15:29:10 | 000,000,000 | ---D | C] -- C:\ProgramData\f-secure
[2013.01.10 18:36:19 | 000,000,000 | ---D | C] -- C:\Windows\System32\Wat
[2013.01.09 21:06:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2013.01.09 18:20:18 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Local\Electronic_Arts_Inc
[2013.01.09 15:27:51 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013.01.09 15:23:42 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2013.01.09 15:23:41 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
[2013.01.08 17:11:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Origin
[2013.01.06 17:36:05 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserProtect
[2013.01.06 16:10:36 | 000,000,000 | ---D | C] -- C:\ProgramData\BrowserProtect
[2013.01.06 16:07:32 | 000,017,464 | ---- | C] (PerformerSoft LLC) -- C:\Windows\System32\roboot.exe
[2013.01.06 15:59:56 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2013.01.05 21:30:37 | 000,000,000 | ---D | C] -- C:\Macromedia
[2013.01.05 21:30:37 | 000,000,000 | ---D | C] -- \Macromedia
[2013.01.05 19:40:22 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Local\Windows Live Writer
[2013.01.05 19:35:51 | 000,000,000 | ---D | C] -- C:\Users\Info\Tracing
[2013.01.05 19:30:56 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_43.dll
[2013.01.05 19:30:56 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_7.dll
[2013.01.05 19:30:56 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_5.dll
[2013.01.05 19:30:55 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_43.dll
[2013.01.05 19:30:22 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_42.dll
[2013.01.05 19:28:27 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_32.dll
[2013.01.05 19:27:44 | 000,000,000 | R--D | C] -- C:\Users\Info\SkyDrive
[2013.01.05 19:27:44 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SkyDrive
[2013.01.05 19:27:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft SkyDrive
[2013.01.05 19:25:51 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Local\Windows Live
[2013.01.05 19:25:35 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Windows Live
[2013.01.05 16:01:01 | 000,000,000 | ---D | C] -- C:\Program Files\Two Worlds Pinball
[2013.01.05 15:42:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Wincert
[2013.01.05 15:41:40 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess
[2013.01.04 21:08:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WEB.DE MailCheck
[2013.01.04 21:07:15 | 000,000,000 | ---D | C] -- C:\ProgramData\1&1 Mail & Media GmbH
[2013.01.04 21:05:42 | 000,000,000 | ---D | C] -- C:\ProgramData\UUdb
 
========== Files - Modified Within 30 Days ==========
 
[2013.02.02 15:07:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.02.02 14:51:17 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.02.02 14:40:46 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3437191235-2556486254-1160177188-1000UA.job
[2013.02.02 14:36:21 | 000,662,014 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.02.02 14:36:21 | 000,623,856 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.02.02 14:36:21 | 000,133,648 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.02.02 14:36:21 | 000,110,030 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.02.02 14:34:03 | 000,009,904 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.02 14:34:03 | 000,009,904 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.02 13:26:32 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3437191235-2556486254-1160177188-1000UA.job
[2013.02.02 12:40:31 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3437191235-2556486254-1160177188-1000Core.job
[2013.02.02 08:33:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.02.01 21:16:18 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.02.01 19:42:52 | 000,002,370 | ---- | M] () -- C:\Users\Info\Desktop\Google Chrome.lnk
[2013.02.01 18:42:54 | 000,107,093 | ---- | M] () -- C:\Users\Info\Documents\1359727427_1_01.xml
[2013.02.01 18:17:20 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3437191235-2556486254-1160177188-1000Core.job
[2013.01.30 20:15:23 | 000,028,507 | ---- | M] () -- C:\Users\Info\Documents\41434262.pdf
[2013.01.30 18:24:06 | 2099,662,848 | -HS- | M] () -- C:\hiberfil.sys
[2013.01.30 16:59:10 | 000,482,928 | ---- | M] (BitDefender) -- C:\Windows\System32\drivers\avckf.sys
[2013.01.30 16:58:59 | 000,625,128 | ---- | M] (BitDefender) -- C:\Windows\System32\drivers\avc3.sys
[2013.01.30 16:56:16 | 000,066,392 | ---- | M] (BitDefender SRL) -- C:\Windows\System32\drivers\bdsandbox.sys
[2013.01.29 17:38:37 | 000,000,385 | ---- | M] () -- C:\Windows\System32\user_gensett.xml
[2013.01.29 17:16:58 | 000,000,648 | ---- | M] () -- C:\Users\Info\Desktop\Scanner and Camera Wizard.lnk
[2013.01.29 15:59:56 | 001,652,485 | ---- | M] () -- C:\Users\Info\Documents\userguide.pdf
[2013.01.29 14:16:06 | 000,072,704 | ---- | M] (BitDefender) -- C:\Windows\System32\drivers\bdvedisk.sys
[2013.01.28 18:07:16 | 001,553,496 | ---- | M] () -- C:\ProgramData\1359390656.bdinstall.bin
[2013.01.28 18:00:07 | 000,253,404 | -H-- | M] () -- C:\bdr-ld01
[2013.01.28 18:00:07 | 000,009,216 | -H-- | M] () -- C:\bdr-ld01.mbr
[2013.01.28 18:00:07 | 000,000,308 | -H-- | M] () -- C:\bdr-cf01
[2013.01.28 17:59:52 | 000,002,126 | ---- | M] () -- C:\Users\Public\Desktop\Bitdefender Internet Security 2013.lnk
[2013.01.28 17:59:52 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_avchv_01009.Wdf
[2013.01.21 17:35:06 | 000,001,196 | ---- | M] () -- C:\Users\Public\Desktop\FIFA 12.lnk
[2013.01.21 16:22:37 | 000,000,941 | ---- | M] () -- C:\Users\Public\Desktop\Origin.lnk
[2013.01.20 10:48:30 | 000,009,892 | ---- | M] () -- C:\Users\Info\Documents\vodafone-codes.odt
[2013.01.19 13:57:53 | 000,000,455 | ---- | M] () -- C:\Users\Info\Documents\Dokument.rtf
[2013.01.15 18:24:57 | 000,001,264 | ---- | M] () -- C:\Users\Info\Desktop\Free YouTube Download.lnk
[2013.01.15 15:49:14 | 000,445,034 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20130116-173755.backup
[2013.01.15 15:49:14 | 000,445,034 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2013.01.14 15:49:25 | 000,059,392 | R--- | M] () -- C:\Windows\System32\streamhlp.dll
[2013.01.13 12:56:09 | 000,000,017 | ---- | M] () -- C:\Users\Info\AppData\Local\resmon.resmoncfg
[2013.01.13 10:14:00 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.01.13 10:14:00 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.01.12 11:59:28 | 000,000,820 | ---- | M] () -- C:\Windows\wininit.ini
[2013.01.10 18:30:58 | 000,002,324 | ---- | M] () -- C:\Windows\epplauncher.mif
[2013.01.10 16:52:21 | 000,001,109 | ---- | M] () -- C:\Users\Info\Desktop\Mozilla Firefox.lnk
[2013.01.09 21:06:08 | 000,002,170 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2013.01.09 15:40:12 | 000,320,432 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.01.09 15:37:39 | 000,008,489 | ---- | M] () -- C:\Users\Info\Documents\Noch zu erledigen.odt
[2013.01.06 16:12:59 | 000,001,133 | ---- | M] () -- C:\Users\Info\Desktop\Pinball.lnk
[2013.01.05 19:32:40 | 000,000,020 | ---- | M] () -- C:\Windows\¤óœ
 
========== Files Created - No Company Name ==========
 
[2013.02.01 18:45:06 | 000,107,093 | ---- | C] () -- C:\Users\Info\Documents\1359727427_1_01.xml
[2013.01.30 20:15:20 | 000,028,507 | ---- | C] () -- C:\Users\Info\Documents\41434262.pdf
[2013.01.29 17:38:37 | 000,000,385 | ---- | C] () -- C:\Windows\System32\user_gensett.xml
[2013.01.29 17:17:59 | 000,000,648 | ---- | C] () -- C:\Users\Info\Desktop\Scanner and Camera Wizard.lnk
[2013.01.29 15:59:53 | 001,652,485 | ---- | C] () -- C:\Users\Info\Documents\userguide.pdf
[2013.01.28 18:07:16 | 001,553,496 | ---- | C] () -- C:\ProgramData\1359390656.bdinstall.bin
[2013.01.28 18:00:07 | 000,000,308 | -H-- | C] () -- C:\bdr-cf01
[2013.01.28 18:00:07 | 000,000,308 | -H-- | C] () -- \bdr-cf01
[2013.01.28 17:59:52 | 000,002,126 | ---- | C] () -- C:\Users\Public\Desktop\Bitdefender Internet Security 2013.lnk
[2013.01.28 17:59:52 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_avchv_01009.Wdf
[2013.01.28 17:39:30 | 035,184,777 | -H-- | C] () -- C:\bdr-im01.gz
[2013.01.28 17:39:30 | 035,184,777 | -H-- | C] () -- \bdr-im01.gz
[2013.01.28 17:39:30 | 002,294,848 | -H-- | C] () -- C:\bdr-bz01
[2013.01.28 17:39:30 | 002,294,848 | -H-- | C] () -- \bdr-bz01
[2013.01.28 17:39:30 | 000,253,404 | -H-- | C] () -- C:\bdr-ld01
[2013.01.28 17:39:30 | 000,253,404 | -H-- | C] () -- \bdr-ld01
[2013.01.28 17:39:30 | 000,009,216 | -H-- | C] () -- C:\bdr-ld01.mbr
[2013.01.28 17:39:30 | 000,009,216 | -H-- | C] () -- \bdr-ld01.mbr
[2013.01.21 17:35:06 | 000,001,196 | ---- | C] () -- C:\Users\Public\Desktop\FIFA 12.lnk
[2013.01.21 16:22:37 | 000,000,941 | ---- | C] () -- C:\Users\Public\Desktop\Origin.lnk
[2013.01.20 10:48:26 | 000,009,892 | ---- | C] () -- C:\Users\Info\Documents\vodafone-codes.odt
[2013.01.19 13:57:53 | 000,000,455 | ---- | C] () -- C:\Users\Info\Documents\Dokument.rtf
[2013.01.15 18:24:57 | 000,001,264 | ---- | C] () -- C:\Users\Info\Desktop\Free YouTube Download.lnk
[2013.01.14 15:49:03 | 000,059,392 | R--- | C] () -- C:\Windows\System32\streamhlp.dll
[2013.01.13 12:56:09 | 000,000,017 | ---- | C] () -- C:\Users\Info\AppData\Local\resmon.resmoncfg
[2013.01.10 18:30:58 | 000,002,324 | ---- | C] () -- C:\Windows\epplauncher.mif
[2013.01.10 16:51:58 | 000,001,109 | ---- | C] () -- C:\Users\Info\Desktop\Mozilla Firefox.lnk
[2013.01.10 16:51:52 | 000,001,121 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013.01.09 21:06:08 | 000,002,170 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2013.01.09 20:46:10 | 000,001,094 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.01.09 20:46:10 | 000,001,090 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.01.06 15:59:56 | 000,001,133 | ---- | C] () -- C:\Users\Info\Desktop\Pinball.lnk
[2013.01.05 19:32:39 | 000,000,020 | ---- | C] () -- C:\Windows\¤óœ
[2013.01.01 14:37:00 | 005,746,780 | ---- | C] ( ) -- C:\Windows\System32\RTKISDBT.dll
[2012.12.29 19:05:53 | 000,000,820 | ---- | C] () -- C:\Windows\wininit.ini
[2012.12.18 14:54:52 | 000,000,000 | RHS- | C] () -- \MSDOS.SYS
[2012.12.18 14:54:52 | 000,000,000 | RHS- | C] () -- \IO.SYS
[2012.12.14 02:02:20 | 000,064,512 | ---- | C] () -- C:\Windows\System32\igdde32.dll
[2012.12.14 02:02:20 | 000,009,728 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2012.12.14 02:02:20 | 000,000,268 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2012.11.17 16:39:51 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2012.10.22 17:40:04 | 000,272,928 | ---- | C] () -- C:\Windows\System32\igvpkrng600.bin
[2012.10.22 17:39:46 | 000,963,452 | ---- | C] () -- C:\Windows\System32\igcodeckrng600.bin
[2012.10.22 17:39:44 | 000,094,208 | ---- | C] () -- C:\Windows\System32\IccLibDll.dll
[2012.10.03 17:15:43 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2012.10.03 17:14:43 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2012.09.29 10:40:45 | 000,000,557 | ---- | C] () -- \NetworkCfg.xml
[2012.09.27 11:25:26 | 2099,662,848 | -HS- | C] () -- \hiberfil.sys
[2012.08.13 10:08:08 | 000,014,217 | ---- | C] () -- C:\Program Files\readme.html
[2012.07.27 21:47:36 | 000,159,232 | ---- | C] () -- C:\Windows\System32\clinfo.exe
[2012.05.08 13:15:36 | 000,000,005 | ---- | C] () -- C:\Program Files\basis-link
[2011.09.15 02:11:16 | 001,048,576 | ---- | C] () -- C:\Windows\System32\syndata.bin
[2011.08.17 06:48:34 | 000,262,080 | ---- | C] () -- C:\Windows\System32\SynPS2.bin
[2011.05.09 17:19:48 | 000,246,804 | ---- | C] () -- C:\Windows\System32\drivers\AtherosBt.bin
[2011.02.11 22:23:34 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2009.07.14 03:04:04 | 000,000,024 | ---- | C] () -- \autoexec.bat
[2009.07.14 03:04:04 | 000,000,010 | ---- | C] () -- \config.sys
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >
--- --- ---


Code:
OTL Extras logfile created on: 02.02.2013 15:35:44 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Info\Downloads
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,61 Gb Total Physical Memory | 0,97 Gb Available Physical Memory | 37,13% Memory free
5,21 Gb Paging File | 2,60 Gb Available in Paging File | 49,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 596,07 Gb Total Space | 523,02 Gb Free Space | 87,75% Space Free | Partition Type: NTFS
 
Computer Name: ALEXANDER-HP630 | User Name: Info | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- Reg Error: Key error. File not found
.js [@ = JSFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
.vbe [@ = VBEFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Opera\Opera.exe" "%1"
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
jsfile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
vbefile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
vbsfile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
wsffile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistApplianMP] -- "C:\Program Files\Applian Technologies\Applian FLV and Media Player\amp.exe" -I skins2 --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithApplianMP] -- "C:\Program Files\Applian Technologies\Applian FLV and Media Player\amp.exe" -I skins2 --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01DBE142-27E9-4773-A0CD-B304003A5DF7}" = lport=137 | protocol=17 | dir=in | app=system |
"{12F58715-4624-4FD1-B010-BDBB1E7B080E}" = rport=137 | protocol=17 | dir=out | app=system |
"{1D2089B8-89D0-4BA7-A5B4-8F155E15D214}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{32A2271E-7150-4DA8-8C6D-BEE0170453F2}" = lport=138 | protocol=17 | dir=in | app=system |
"{37CFFEA8-E16F-43E4-BF1A-F88551A92DE4}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{39748B89-9815-4550-B841-532E2154ACF6}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3D59763D-1ED3-4C74-BDFA-8A8FCC9FC525}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{3EB7CAEB-87BB-4EA0-B067-ACC73089BC53}" = rport=139 | protocol=6 | dir=out | app=system |
"{4361BAA7-7834-412A-9E44-1BA065BD74E0}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4839B456-FDA6-4BEB-8D20-3376989267D7}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{49BABFCE-DC11-4F95-ACBC-9C8BE5EDC36D}" = lport=139 | protocol=6 | dir=in | app=system |
"{4DE142EE-3AC5-4683-A93D-73C964D0A799}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{56A0396B-6F40-4055-A5C3-5063299FB17E}" = rport=138 | protocol=17 | dir=out | app=system |
"{66F5B08D-0A57-46B4-AA17-F10C3C22F759}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{8C8F29E3-63A1-4816-81E5-EE4150655CFB}" = lport=445 | protocol=6 | dir=in | app=system |
"{90695147-1B32-4BF1-929C-80FA22015799}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{A86F6B4F-9E54-4DB3-AA76-A0A683C3E610}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{AFC82FD5-38F0-4F3E-9E7D-057741979768}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C4066647-0930-4F92-AED6-7BFA6D998905}" = lport=10243 | protocol=6 | dir=in | app=system |
"{EAB4A630-A4D2-4BD4-8678-B51E957BE3FC}" = lport=2869 | protocol=6 | dir=in | app=system |
"{EFE6FD3C-175A-4490-963E-25D99B7C8EA2}" = rport=445 | protocol=6 | dir=out | app=system |
"{F5167275-B910-4332-8B20-73F7A0B8BBCF}" = rport=10243 | protocol=6 | dir=out | app=system |
"{FFA4C39C-5201-4494-9C67-A43E86E58075}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06D07C9B-2AD0-4369-AB48-298D5D18296B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{0AF7B335-6CF4-4D3E-8667-438F4A4EADDA}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{0EF11821-6B20-4B64-B16D-78286893BD9C}" = protocol=6 | dir=in | app=c:\program files\origin games\fifa 12\game\fifa.exe |
"{1253855C-B82A-4533-A923-299F385CEE73}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{15EA55BC-0D82-4443-B1D0-D1D174C8B98A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{22426AD1-EBC0-4797-9212-938F2CC1C28B}" = protocol=17 | dir=in | app=c:\program files\origin games\fifa 12\game\fifa.exe |
"{3367344A-00FA-45DB-846E-477E214F9D96}" = protocol=17 | dir=in | app=c:\program files\arcsoft\totalmedia 3.5\totalmedia.exe |
"{36C659E4-9313-4E22-A9CA-B5B3FE55F6F6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{47A7770A-CDF0-42BE-B810-BC82EC215190}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4CF43D84-0084-43ED-B110-3D63EDF671BC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{4E9C997D-58B2-4974-9A3B-5B3FBC9FBDDD}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{56C412F1-E835-4D39-900E-6D379181359B}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{5E76D313-567F-495F-8B8C-24A65DD02DA5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6156A7B9-18E4-4FF5-AF53-F97D16C2D1AF}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{664CA150-E671-4567-90EC-299E6D3B4035}" = protocol=6 | dir=out | app=system |
"{80C8EE46-FD19-483A-B00E-A9CCE3000760}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{8CC52C5F-AA3B-41D7-A1B7-203AA9B2C047}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{94D74F6B-79F1-46DB-A69A-A8B39BE3639D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AB6B0AAB-C44F-418A-969C-D4712E88839F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{ACE84729-F7CE-40F2-BBFE-1E21659DB267}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{C748BC4C-7AC6-484E-BB5E-5A0AB2B16430}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C95F78A8-49C0-44EC-99C4-940067C828E7}" = protocol=6 | dir=in | app=c:\program files\arcsoft\totalmedia 3.5\totalmedia.exe |
"{DAD0094F-D544-4CED-A3C4-ECC5FD4C9F36}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{E72A7411-CB21-440F-B894-74A43100BFD3}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{E9182B6C-9065-48DF-8991-4E7BE3001FE6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{101A497C-7EF6-4001-834D-E5FA1C70FEFA}" = Bluetooth Win7 Suite
"{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}" = BrowserProtect
"{1B6C0E95-182C-48E0-9C4B-4F916308249C}" = iTunes
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{2C26B97F-698E-4E04-B398-8203B147859B}_is1" = TOPP Vorlagen-Druckstudio (5156)
"{33FFD86B-569C-9E8D-6659-A1F84D07CAD0}" = AMD Catalyst Install Manager
"{3877C901-7B90-4727-A639-B6ED2DD59D43}" = ESU for Microsoft Windows 7
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{53B17A98-5BF0-40BC-AAFF-850A357975AC}" = HP Quick Launch
"{6F545E5E-4595-11E2-93B6-B8AC6F97B88E}" = Google Earth
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74292F90-895A-4FC6-A692-9641532B1B63}" = ArcSoft TotalMedia 3.5
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.5) - Deutsch
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{BBBA20E0-D9F3-4C6F-83AC-D66EFC0BFA93}" = Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista
"{C1594429-8296-4652-BF54-9DBE4932A44C}" = Realtek PCIE Card Reader
"{CCE825DB-347A-4004-A186-5F4A6FDD8547}" = Apple Application Support
"{DDBB7C89-1A09-441E-AA0F-6AA465755C17}" = REALTEK DTV USB DEVICE
"{E2E7A0E8-77C4-495F-8FA3-63DAEDAA2DB3}" = F-Secure PSC Prerequisites
"{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0
"{EA8ADAA9-6671-4839-A51E-0C6792B78F3E}" = FIFA 12
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{FCB3772C-B7D0-4933-B1A9-3707EBACC573}" = Intel(R) SDK for OpenCL - CPU Only Runtime Package
"1&1 Mail & Media GmbH 1und1InternetExplorerAddon" = WEB.DE Internet Explorer Addon
"1&1 Mail & Media GmbH 1und1Softwareaktualisierung" = WEB.DE Softwareaktualisierung
"1&1 Mail & Media GmbH Toolbar FF" = WEB.DE MailCheck für Mozilla Firefox
"1&1 Mail & Media GmbH Toolbar IE8" = WEB.DE MailCheck für Internet Explorer
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Applian FLV and Media Player" = Applian FLV and Media Player 3.1.1.12
"Bitdefender" = Bitdefender Internet Security 2013
"Complitly_is1" = Complitly
"Finale NotePad 2012" = Finale NotePad 2012
"Free YouTube Download_is1" = Free YouTube Download version 3.1.42.1212
"Freemake Video Converter_is1" = Freemake Video Converter Version 3.2.0
"freeocr_is1" = FreeOCR v4.2
"LOGO!Soft Comfort V6.1" = LOGO!Soft Comfort V6.1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 18.0.1 (x86 de)" = Mozilla Firefox 18.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Origin" = Origin
"SLABCOMM&10C4&EA60" = Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)
"SynTPDeinstKey" = Synaptics TouchPad Driver
"Two Worlds Pinball" = Two Worlds Pinball
"WinPcapInst" = WinPcap 4.1.2
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 27.01.2013 05:09:14 | Computer Name = Alexander-HP630 | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.
 
Error - 28.01.2013 09:10:26 | Computer Name = Alexander-HP630 | Source = Windows Backup | ID = 4104
Description =
 
Error - 28.01.2013 12:28:15 | Computer Name = Alexander-HP630 | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.
 
Error - 28.01.2013 12:57:40 | Computer Name = Alexander-HP630 | Source = Software Protection Platform Service | ID = 8193
Description = Fehler beim Lizenzaktivierungsplaner (sppuinotify.dll). Fehlercode:
0x80070005
 
Error - 29.01.2013 11:29:17 | Computer Name = Alexander-HP630 | Source = Google Update | ID = 20
Description =
 
Error - 29.01.2013 12:38:50 | Computer Name = Alexander-HP630 | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.
 
Error - 30.01.2013 11:24:07 | Computer Name = Alexander-HP630 | Source = Microsoft-Windows-RestartManager | ID = 10006
Description = Die Anwendung oder der Dienst "Windows-Explorer" konnte nicht heruntergefahren
 werden.
 
Error - 30.01.2013 12:24:04 | Computer Name = Alexander-HP630 | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.
 
Error - 30.01.2013 12:25:24 | Computer Name = Alexander-HP630 | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: HPWMISVC.exe, Version: 2.7.1.0, Zeitstempel:
 0x4f544fe9  Name des fehlerhaften Moduls: OLEAUT32.dll, Version: 6.1.7601.17676,
Zeitstempel: 0x4e58702a  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00004660  ID des fehlerhaften
 Prozesses: 0xa04  Startzeit der fehlerhaften Anwendung: 0x01cdff063bd5a110  Pfad der
 fehlerhaften Anwendung: C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\system32\OLEAUT32.dll  Berichtskennung: a5876286-6af9-11e2-9238-e4115bf9b2f0
 
Error - 30.01.2013 13:24:41 | Computer Name = Alexander-HP630 | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.
 
[ Media Center Events ]
Error - 03.12.2012 14:10:35 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 19:10:35 - Fehler beim Herstellen der Internetverbindung.  19:10:35
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 03.12.2012 14:10:44 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 19:10:40 - Fehler beim Herstellen der Internetverbindung.  19:10:40
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 04.12.2012 09:37:39 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 14:37:39 - Fehler beim Herstellen der Internetverbindung.  14:37:39
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 04.12.2012 09:37:47 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 14:37:44 - Fehler beim Herstellen der Internetverbindung.  14:37:44
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 05.12.2012 12:09:49 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 17:09:49 - Directory konnte nicht abgerufen werden (Fehler: Timeout
 für Vorgang überschritten) 
 
Error - 06.12.2012 11:54:39 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 16:54:39 - Fehler beim Herstellen der Internetverbindung.  16:54:39
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 06.12.2012 11:54:48 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 16:54:44 - Fehler beim Herstellen der Internetverbindung.  16:54:44
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 14.12.2012 10:40:37 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 15:40:37 - Fehler beim Herstellen der Internetverbindung.  15:40:37
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 14.12.2012 10:40:47 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 15:40:43 - Fehler beim Herstellen der Internetverbindung.  15:40:43
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 15.12.2012 15:52:47 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 20:52:47 - Fehler beim Herstellen der Internetverbindung.  20:52:47
-    Serververbindung konnte nicht hergestellt werden.. 
 
[ System Events ]
Error - 29.01.2013 13:24:44 | Computer Name = Alexander-HP630 | Source = DCOM | ID = 10010
Description =
 
Error - 30.01.2013 09:40:27 | Computer Name = Alexander-HP630 | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst lmhosts erreicht.
 
Error - 30.01.2013 09:40:27 | Computer Name = Alexander-HP630 | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst IPBusEnum erreicht.
 
Error - 30.01.2013 09:41:37 | Computer Name = Alexander-HP630 | Source = BTHUSB | ID = 327697
Description = Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen
 und wird nicht verwendet. Der Treiber wurde entladen.
 
Error - 30.01.2013 10:17:43 | Computer Name = Alexander-HP630 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "TuneUp Designerweiterung" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%1083
 
Error - 30.01.2013 12:24:44 | Computer Name = Alexander-HP630 | Source = bowser | ID = 8003
Description =
 
Error - 30.01.2013 12:24:56 | Computer Name = Alexander-HP630 | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst HPWMISVC erreicht.
 
Error - 30.01.2013 12:25:47 | Computer Name = Alexander-HP630 | Source = WMPNetworkSvc | ID = 866306
Description =
 
Error - 30.01.2013 12:25:48 | Computer Name = Alexander-HP630 | Source = WMPNetworkSvc | ID = 866306
Description =
 
Error - 30.01.2013 12:25:47 | Computer Name = Alexander-HP630 | Source = Service Control Manager | ID = 7034
Description = Dienst "HPWMISVC" wurde unerwartet beendet. Dies ist bereits 1 Mal
 passiert.
 
 
< End of report >

duddl 02.02.2013 15:48
Code:
OTL logfile created on: 02.02.2013 15:35:44 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Info\Downloads
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,61 Gb Total Physical Memory | 0,97 Gb Available Physical Memory | 37,13% Memory free
5,21 Gb Paging File | 2,60 Gb Available in Paging File | 49,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 596,07 Gb Total Space | 523,02 Gb Free Space | 87,75% Space Free | Partition Type: NTFS
 
Computer Name: ALEXANDER-HP630 | User Name: Info | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.02.02 15:10:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Info\Downloads\OTL.exe
PRC - [2013.01.30 16:58:47 | 001,343,472 | ---- | M] (Bitdefender) -- C:\Programme\Bitdefender\Bitdefender 2013\vsserv.exe
PRC - [2013.01.30 16:57:44 | 001,615,368 | ---- | M] (Bitdefender) -- C:\Programme\Bitdefender\Bitdefender 2013\bdagent.exe
PRC - [2013.01.25 19:57:46 | 003,494,992 | ---- | M] (Electronic Arts) -- C:\Programme\Origin\Origin.exe
PRC - [2013.01.09 20:46:08 | 000,212,432 | ---- | M] (Google Inc.) -- C:\Programme\Google\Update\1.3.21.124\GoogleCrashHandler.exe
PRC - [2012.12.28 11:40:08 | 000,101,376 | ---- | M] (Freemake) -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
PRC - [2012.12.25 09:53:30 | 002,547,816 | ---- | M] () -- C:\ProgramData\BrowserProtect\2.6.1040.25\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
PRC - [2012.12.21 10:15:42 | 001,463,000 | ---- | M] (1und1 Mail und Media GmbH) -- C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe
PRC - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.12.14 02:02:14 | 000,277,616 | ---- | M] (Intel Corporation) -- C:\Windows\System32\IntelCpHeciSvc.exe
PRC - [2012.11.23 03:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2012.11.13 19:32:27 | 000,055,544 | ---- | M] (Bitdefender) -- C:\Programme\Bitdefender\Bitdefender 2013\updatesrv.exe
PRC - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012.08.13 10:08:08 | 010,376,704 | ---- | M] (OpenOffice.org) -- C:\Programme\program\soffice.exe
PRC - [2012.08.13 10:08:08 | 010,368,512 | ---- | M] (OpenOffice.org) -- C:\Programme\program\soffice.bin
PRC - [2012.03.05 12:38:38 | 000,578,944 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Programme\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
PRC - [2012.03.05 12:38:38 | 000,035,200 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Programme\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
PRC - [2011.05.20 09:10:26 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2011.05.20 09:10:12 | 000,284,440 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2011.05.09 17:28:38 | 000,146,592 | ---- | M] (Atheros) -- C:\Programme\Bluetooth Suite\Ath_CoexAgent.exe
PRC - [2011.05.09 17:27:12 | 000,498,848 | ---- | M] (Atheros Communications) -- C:\Programme\Bluetooth Suite\BtvStack.exe
PRC - [2011.05.09 17:27:08 | 000,302,240 | ---- | M] (Atheros Commnucations) -- C:\Programme\Bluetooth Suite\AthBtTray.exe
PRC - [2011.05.09 17:27:06 | 000,076,960 | ---- | M] (Atheros Commnucations) -- C:\Programme\Bluetooth Suite\AdminService.exe
PRC - [2011.04.19 15:03:52 | 000,268,864 | ---- | M] (ArcSoft, Inc.) -- C:\Programme\ArcSoft\TotalMedia 3.5\TMMonitor.exe
PRC - [2010.12.27 15:30:22 | 001,817,088 | ---- | M] (Realsil Microelectronics Inc.) -- C:\Programme\Realtek\Realtek PCIE Card Reader\RIconMan.exe
PRC - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 13:17:41 | 001,174,016 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.03.18 11:19:26 | 000,207,360 | ---- | M] (ArcSoft Inc.) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
PRC - [2010.03.18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.02.02 09:46:09 | 012,459,888 | ---- | M] () -- C:\Users\Info\AppData\Local\Google\Chrome\User Data\PepperFlash\11.5.31.138\pepflashplayer.dll
MOD - [2013.01.26 03:35:06 | 000,460,240 | ---- | M] () -- C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll
MOD - [2013.01.26 03:35:05 | 012,459,472 | ---- | M] () -- C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\PepperFlash\pepflashplayer.dll
MOD - [2013.01.26 03:35:04 | 004,012,496 | ---- | M] () -- C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\pdf.dll
MOD - [2013.01.26 03:34:19 | 000,597,968 | ---- | M] () -- C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\libglesv2.dll
MOD - [2013.01.26 03:34:18 | 000,124,368 | ---- | M] () -- C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\libegl.dll
MOD - [2013.01.26 03:34:16 | 001,552,848 | ---- | M] () -- C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\ffmpegsumo.dll
MOD - [2013.01.25 19:57:56 | 000,062,976 | ---- | M] () -- C:\Programme\Origin\tufao.dll
MOD - [2013.01.09 16:06:10 | 000,491,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\346a7a67978cead8e2ff52c6d80bbeb7\IAStorUtil.ni.dll
MOD - [2013.01.09 16:06:10 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\500a8ae2a5d27132d87ccac9f97b0069\IAStorCommon.ni.dll
MOD - [2013.01.09 15:45:05 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\0ac577a8ad6528ff03b50db5eeeac8be\System.Web.ni.dll
MOD - [2013.01.09 15:44:49 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll
MOD - [2013.01.09 15:43:57 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\865d2bf19a7af7fab8660a42d92550fe\System.Windows.Forms.ni.dll
MOD - [2013.01.09 15:43:44 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll
MOD - [2013.01.09 15:43:16 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf827fe7bc99d9bcf0ba3621054ef527\WindowsBase.ni.dll
MOD - [2013.01.09 15:43:03 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\c1a66b44c4780c039576eaf18f4cd8dc\System.Xml.ni.dll
MOD - [2013.01.09 15:42:54 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll
MOD - [2013.01.09 15:42:52 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013.01.09 15:42:04 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll
MOD - [2012.12.25 09:53:30 | 002,547,816 | ---- | M] () -- C:\ProgramData\BrowserProtect\2.6.1040.25\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
MOD - [2012.12.25 09:51:45 | 002,202,728 | ---- | M] () -- c:\ProgramData\BrowserProtect\2.6.1040.25\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll
MOD - [2012.11.13 19:13:19 | 000,203,840 | ---- | M] () -- C:\Programme\Bitdefender\Bitdefender 2013\txmlutil.dll
MOD - [2012.10.22 17:39:44 | 000,094,208 | ---- | M] () -- C:\Windows\System32\IccLibDll.dll
MOD - [2012.08.10 15:51:32 | 000,985,088 | ---- | M] () -- C:\Programme\program\libxml2.dll
MOD - [2012.08.10 15:50:56 | 000,170,496 | ---- | M] () -- C:\Programme\program\libxslt.dll
MOD - [2012.04.27 15:08:08 | 000,092,600 | ---- | M] () -- C:\Programme\Bitdefender\Bitdefender 2013\bdmetrics.dll
MOD - [2010.11.13 01:02:21 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.07.14 02:15:45 | 000,364,544 | ---- | M] () -- C:\Windows\System32\msjetoledb40.dll
MOD - [2008.11.26 16:59:32 | 000,131,584 | ---- | M] () -- C:\Programme\ArcSoft\TotalMedia 3.5\AbilisWinUsb.dll
MOD - [2008.10.22 16:01:00 | 000,200,704 | ---- | M] () -- C:\Programme\ArcSoft\TotalMedia 3.5\VendorCmdRW.dll
MOD - [2007.04.19 09:33:00 | 000,035,584 | ---- | M] () -- C:\Programme\ArcSoft\TotalMedia 3.5\uPiApi.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2013.01.30 16:59:25 | 000,062,688 | ---- | M] (Bitdefender) [Disabled | Stopped] -- C:\Programme\Bitdefender\Bitdefender 2013\bdparentalservice.exe -- (BdDesktopParental)
SRV - [2013.01.30 16:58:47 | 001,343,472 | ---- | M] (Bitdefender) [Auto | Running] -- C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe -- (VSSERV)
SRV - [2013.01.26 09:58:29 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.01.13 10:14:03 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.01.10 18:36:17 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2012.12.28 11:40:08 | 000,101,376 | ---- | M] (Freemake) [Auto | Running] -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe -- (Freemake Improver)
SRV - [2012.12.25 09:53:30 | 002,547,816 | ---- | M] () [Auto | Running] -- C:\ProgramData\BrowserProtect\2.6.1040.25\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe -- (BrowserProtect)
SRV - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.12.14 02:02:14 | 000,277,616 | ---- | M] (Intel Corporation) [On_Demand | Running] -- C:\Windows\System32\IntelCpHeciSvc.exe -- (cphs)
SRV - [2012.11.13 19:32:27 | 000,055,544 | ---- | M] (Bitdefender) [Auto | Running] -- C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe -- (UPDATESRV)
SRV - [2012.11.09 11:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.03.05 12:38:38 | 000,035,200 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Auto | Running] -- C:\Programme\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe -- (HPWMISVC)
SRV - [2011.05.20 09:10:26 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2011.05.09 17:28:38 | 000,146,592 | ---- | M] (Atheros) [Auto | Running] -- C:\Programme\Bluetooth Suite\Ath_CoexAgent.exe -- (Atheros Bt&Wlan Coex Agent)
SRV - [2011.05.09 17:27:06 | 000,076,960 | ---- | M] (Atheros Commnucations) [Auto | Running] -- C:\Programme\Bluetooth Suite\AdminService.exe -- (AtherosSvc)
SRV - [2010.12.27 15:30:22 | 001,817,088 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Programme\Realtek\Realtek PCIE Card Reader\RIconMan.exe -- (IconMan_R)
SRV - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.03.18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tsusbhub.sys -- (tsusbhub)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\synth3dvsc.sys -- (Synth3dVsc)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\massfilter.sys -- (massfilter)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\avfsfilter.sys -- (AVFSFilter)
DRV - [2013.01.30 16:59:10 | 000,482,928 | ---- | M] (BitDefender) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\avckf.sys -- (avckf)
DRV - [2013.01.30 16:58:59 | 000,625,128 | ---- | M] (BitDefender) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avc3.sys -- (avc3)
DRV - [2013.01.30 16:56:16 | 000,066,392 | ---- | M] (BitDefender SRL) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\bdsandbox.sys -- (BDSandBox)
DRV - [2012.11.02 13:17:14 | 000,242,504 | ---- | M] (BitDefender) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avchv.sys -- (avchv)
DRV - [2012.10.31 12:13:10 | 000,343,456 | ---- | M] (BitDefender S.R.L.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\trufos.sys -- (trufos)
DRV - [2012.10.02 11:31:18 | 000,134,136 | ---- | M] (BitDefender LLC) [Kernel | System | Running] -- C:\Programme\Bitdefender\Bitdefender 2013\bdselfpr.sys -- (bdselfpr)
DRV - [2012.08.29 17:24:08 | 000,161,312 | ---- | M] (BitDefender LLC) [File_System | Boot | Running] -- C:\Windows\System32\drivers\gzflt.sys -- (gzflt)
DRV - [2012.08.27 14:50:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2012.07.06 14:13:12 | 000,077,192 | ---- | M] (BitDefender LLC) [Kernel | System | Running] -- c:\Programme\Common Files\Bitdefender\Bitdefender Firewall\bdfndisf6.sys -- (BdfNdisf)
DRV - [2012.06.20 09:43:02 | 002,957,312 | ---- | M] (Qualcomm Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2012.06.19 07:39:10 | 000,289,792 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcDAud.sys -- (IntcDAud)
DRV - [2011.11.14 19:16:27 | 000,090,704 | ---- | M] (BitDefender LLC) [Kernel | System | Running] -- C:\Programme\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys -- (bdfwfpf)
DRV - [2011.06.13 13:06:10 | 000,042,728 | ---- | M] (Realtek) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL2832U_IRHID.sys -- (RTL2832U_IRHID)
DRV - [2011.05.17 14:48:22 | 000,188,520 | ---- | M] (REALTEK SEMICONDUCTOR Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL2832UBDA.sys -- (RTL2832UBDA)
DRV - [2011.05.17 14:48:22 | 000,032,872 | ---- | M] (REALTEK SEMICONDUCTOR Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL2832UUSB.sys -- (RTL2832UUSB)
DRV - [2011.05.09 17:27:18 | 000,243,872 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btfilter.sys -- (BtFilter)
DRV - [2011.05.09 17:27:18 | 000,141,088 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_rcp.sys -- (BTATH_RCP)
DRV - [2011.05.09 17:27:16 | 000,259,232 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_a2dp.sys -- (BTATH_A2DP)
DRV - [2011.05.09 17:27:16 | 000,175,776 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_hcrp.sys -- (BTATH_HCRP)
DRV - [2011.05.09 17:27:16 | 000,049,312 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_lwflt.sys -- (BTATH_LWFLT)
DRV - [2011.05.09 17:27:16 | 000,034,976 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_flt.sys -- (AthBTPort)
DRV - [2011.05.09 17:27:16 | 000,024,736 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btath_bus.sys -- (BTATH_BUS)
DRV - [2011.02.15 10:37:10 | 000,251,496 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RtsPStor.sys -- (RSPCIESTOR)
DRV - [2011.02.11 22:23:34 | 000,035,088 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\npf.sys -- (npf)
DRV - [2010.11.20 13:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 13:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 13:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2010.11.20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 10:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 10:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.10.19 22:33:40 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HECI.sys -- (MEI)
DRV - [2009.07.14 00:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2005.02.23 14:58:56 | 000,011,776 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\afc.sys -- (Afc)
 
 
========== Standard Registry (All) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =  [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=cd92cf51-342e-492a-8fab-a7200a248b0b&searchtype=ds&q={searchTerms}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=484&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=0727329469794586&q={searchTerms}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
 
IE - HKU\S-1-5-20\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
 
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://google.com/
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.web.de/br/ie9_startpage
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.searchcompletion.com/?si=10195&home=1
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=cd92cf51-342e-492a-8fab-a7200a248b0b&searchtype=ds&q={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=cd92cf51-342e-492a-8fab-a7200a248b0b&searchtype=ds&q={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.searchcompletion.com/?si=10195&home=1
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=cd92cf51-342e-492a-8fab-a7200a248b0b&searchtype=ds&q={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = hxxp://search.searchcompletion.com/?si=10195&home=1
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=cd92cf51-342e-492a-8fab-a7200a248b0b&searchtype=ds&q={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No CLSID value found
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=cd92cf51-342e-492a-8fab-a7200a248b0b&searchtype=ds&q={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&r=
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{09038620-190C-402B-A92F-18864E6AB22F}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://www.claro-search.com/?q={searchTerms}&affID=114506&tt=0113_6&babsrc=SP_clro&mntrId=2ab28cb800000000000026de2ba841cd
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{5A817CF6-92D5-4DE5-AC38-82DF8A73EF28}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{649041DE-18B4-47FD-86BD-87083B1A78B7}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{6B1D1FB7-7233-4F7C-802C-21A1DDB12754}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{81CE708B-5104-4C62-B333-94B417473B29}: "URL" = hxxp://go.mail.com/br/ie8_search_web/?su={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{86AEB91E-A7FB-4FE6-9B06-55574E9AF728}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{9961BF31-9CCC-4D28-88B7-BB30137CE397}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=33AEA8D2-0C95-4F29-9D70-B3155A83F187&apn_sauid=E46F4EB1-1B8C-45C9-ACE4-A4DEA1A35778
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=484&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=0727329469794586&q={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{B0E0A740-E869-436E-8FD7-58BEA90AF721}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-flv
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin:  File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Info\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Info\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fmconverter@gmail.com: C:\Program Files\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\ [2012.12.18 16:27:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.26 09:58:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\bdThunderbird@bitdefender.com: C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext [2013.01.28 17:59:27 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{58bd07eb-0ee0-4df0-8121-dc9b693373df}: C:\ProgramData\BrowserProtect\2.6.1040.25\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension [2013.01.06 17:36:04 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.26 09:58:30 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2012.12.29 13:41:45 | 000,000,000 | ---D | M] (No name found) -- \mozilla\Firefox\extensions
[2012.12.29 13:41:45 | 000,000,000 | ---D | M] (No name found) -- \mozilla\Firefox\extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}
[2013.01.10 16:51:41 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.11.17 15:23:28 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.01.26 09:58:30 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013.01.10 16:51:41 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\distribution\extensions
[2013.01.10 16:51:41 | 000,000,000 | ---D | M] (WEB.DE MailCheck) -- C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de
[2013.01.26 09:58:30 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2013.01.05 16:11:17 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.01.05 16:11:17 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.12.18 14:54:52 | 000,003,195 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Complitly.xml
[2013.01.05 16:11:17 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2013.01.05 16:11:17 | 000,002,669 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2013.01.05 16:11:17 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.01.05 15:41:40 | 000,002,687 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2013.01.05 16:11:17 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.01.05 16:11:17 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
[2012.12.16 12:20:16 | 000,000,894 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter},
CHR - homepage: hxxp://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Info\AppData\Local\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Info\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - Extension: Red Ball Jump = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahkigbfemaalcamljnhhpidckcenneai\1.3_0\
CHR - Extension: Angry Birds = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.5.0.7_0\
CHR - Extension: YouTube = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Angry birds = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjdhpighfhhhjpkjehlcpamdmpckhnll\1.2_0\
CHR - Extension: Google-Suche = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: Bad Piggies HD = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\gokpccjacnihibhbdgjeglpgiodeolpm\3.2.4_0\
CHR - Extension: Google Mail-Checker = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff\4.4.0_0\
CHR - Extension: Minecraft = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlpgoledhpdldmmhcgfcaecodnkmoiea\0.0.0.8_0\
CHR - Extension: Doodle Jump = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\nojaabckpfdijgbnlhdlhjheiappijbp\2.3.1_0\
CHR - Extension: BrowserProtect = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgafcinpmmpklohkojmllohdhomoefph\1.0_0\
CHR - Extension: Google Mail = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
 
O1 HOSTS File: ([2013.01.15 15:49:14 | 000,445,034 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 127.0.0.1        www.123fporn.info
O1 - Hosts: 15284 more lines...
O2 - BHO: (WEB.DE Konfiguration) - {17166733-40EA-4432-A85C-AE672FF0E236} - C:\ProgramData\1und1InternetExplorerAddon\BHOXML.dll (1&1 Mail & Media GmbH)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Programme\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (WEB.DE MailCheck BHO) - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (WEB.DE MailCheck) - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\Toolbar\WebBrowser: (no name) - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No CLSID value found.
O3 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\Toolbar\WebBrowser: (WEB.DE MailCheck) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [AthBtTray] C:\Program Files\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)
O4 - HKLM..\Run: [AtherosBtStack] C:\Program Files\Bluetooth Suite\BtvStack.exe (Atheros Communications)
O4 - HKLM..\Run: [Bdagent] C:\Programme\Bitdefender\Bitdefender 2013\bdagent.exe (Bitdefender)
O4 - HKLM..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [HP Quick Launch] C:\Programme\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [IAStorIcon] C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [MailCheck IE Broker] C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe (1und1 Mail und Media GmbH)
O4 - HKLM..\Run: [Persistence] C:\Windows\System32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated)
O4 - HKLM..\Run: [WEB.DE MailCheck Broker] C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe (1und1 Mail und Media GmbH)
O4 - HKU\.DEFAULT..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-18..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000..\Run: [EADM] C:\Program Files\Origin\Origin.exe (Electronic Arts)
O4 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000..\Run: [Facebook Update] C:\Users\Info\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000..\Run: [Skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Info\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Programme\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\Software\Policies\Microsoft\Internet Explorer\Recovery present
O8 - Extra context menu item: Free YouTube Download - C:\Users\Info\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Programme\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\nlaapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\wshbth.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000030 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000031 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000032 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000033 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000034 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000035 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000036 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000037 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455}  (ExentInf Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1442A48A-A5DF-411E-9A01-E478F1A8202E}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4E70BA11-C8F2-4E5A-AE19-2A1638EC9218}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\webde {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\progra~2\browse~2\261040~1.25\{c16c1~1\browse~1.dll) - c:\ProgramData\BrowserProtect\2.6.1040.25\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{a59db7fb-088d-11e2-a4a2-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{a59db7fb-088d-11e2-a4a2-806e6f6e6963}\Shell\AutoRun\command - "" = D:\setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.02.02 12:31:21 | 000,000,000 | -H-D | C] -- C:\Users\Info\Documents\Freemake_do_not_remove_this_folder634954050811576309
[2013.01.31 17:44:42 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\100_FUJI
[2013.01.31 16:32:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Dumps
[2013.01.30 18:22:34 | 000,000,000 | ---D | C] -- C:\Windows\System32\Extensions
[2013.01.30 18:22:12 | 000,000,000 | ---D | C] -- C:\Intel
[2013.01.30 18:22:12 | 000,000,000 | ---D | C] -- \Intel
[2013.01.30 17:22:13 | 000,000,000 | ---D | C] -- C:\Windows\System32\searchplugins
[2013.01.30 16:59:10 | 000,482,928 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\avckf.sys
[2013.01.30 16:58:59 | 000,625,128 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\avc3.sys
[2013.01.29 14:16:06 | 000,072,704 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\bdvedisk.sys
[2013.01.28 17:59:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitdefender 2013
[2013.01.28 17:59:36 | 000,000,000 | ---D | C] -- C:\ProgramData\BDLogging
[2013.01.28 17:59:00 | 000,511,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\capicom.dll
[2013.01.28 17:59:00 | 000,077,192 | ---- | C] (BitDefender LLC) -- C:\Windows\System32\drivers\BdfNdisf6.sys
[2013.01.28 17:59:00 | 000,066,392 | ---- | C] (BitDefender SRL) -- C:\Windows\System32\drivers\bdsandbox.sys
[2013.01.28 17:58:55 | 000,242,504 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\avchv.sys
[2013.01.28 17:39:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Bitdefender
[2013.01.28 17:31:31 | 000,161,312 | ---- | C] (BitDefender LLC) -- C:\Windows\System32\drivers\gzflt.sys
[2013.01.28 17:31:29 | 000,343,456 | ---- | C] (BitDefender S.R.L.) -- C:\Windows\System32\drivers\trufos.sys
[2013.01.28 17:31:29 | 000,000,000 | ---D | C] -- C:\Program Files\Bitdefender
[2013.01.28 17:22:47 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Bitdefender
[2013.01.28 17:11:04 | 000,000,000 | ---D | C] -- C:\ProgramData\SpeedMaxPc
[2013.01.27 19:20:17 | 000,000,000 | -H-D | C] -- C:\Users\Info\Documents\Freemake_do_not_remove_this_folder634949112175897653
[2013.01.27 19:15:41 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\Freemake
[2013.01.26 22:05:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.01.22 15:50:57 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\FOLDER01
[2013.01.21 19:23:03 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core
[2013.01.21 19:19:38 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\FIFA 12
[2013.01.21 17:35:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FIFA 12
[2013.01.21 16:23:40 | 000,000,000 | ---D | C] -- C:\Program Files\Origin Games
[2013.01.21 16:23:28 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Local\Origin
[2013.01.21 16:22:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
[2013.01.21 16:22:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts
[2013.01.21 16:22:34 | 000,000,000 | ---D | C] -- C:\Program Files\Origin
[2013.01.21 14:18:26 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Local\Facebook
[2013.01.18 19:19:35 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Local\360Amigo
[2013.01.15 14:35:06 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2013.01.14 18:21:34 | 000,000,000 | ---D | C] -- C:\ProgramData\clp
[2013.01.12 08:14:11 | 000,000,000 | -H-D | C] -- C:\Program Files\Common Files\EAInstaller
[2013.01.12 08:14:09 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_43.dll
[2013.01.12 08:14:09 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_7.dll
[2013.01.12 08:14:08 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_43.dll
[2013.01.12 08:14:08 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_6.dll
[2013.01.12 08:14:08 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_43.dll
[2013.01.12 08:14:08 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_4.dll
[2013.01.12 08:14:07 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_6.dll
[2013.01.12 08:14:07 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_7.dll
[2013.01.12 08:14:06 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_42.dll
[2013.01.12 08:14:06 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_5.dll
[2013.01.12 08:14:06 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_5.dll
[2013.01.12 08:14:05 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_42.dll
[2013.01.12 08:14:05 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_42.dll
[2013.01.12 08:14:05 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_42.dll
[2013.01.12 08:14:04 | 004,178,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_41.dll
[2013.01.12 08:14:04 | 000,517,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_4.dll
[2013.01.12 08:14:04 | 000,235,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_4.dll
[2013.01.12 08:14:04 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_3.dll
[2013.01.12 08:14:04 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_6.dll
[2013.01.12 08:14:03 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_40.dll
[2013.01.12 08:14:03 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_40.dll
[2013.01.12 08:14:03 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_3.dll
[2013.01.12 08:14:03 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_3.dll
[2013.01.12 08:14:03 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_2.dll
[2013.01.12 08:14:02 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_39.dll
[2013.01.12 08:14:02 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_2.dll
[2013.01.12 08:14:02 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_2.dll
[2013.01.12 08:14:02 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_1.dll
[2013.01.12 08:14:02 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_5.dll
[2013.01.12 08:14:01 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_39.dll
[2013.01.12 08:14:01 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_1.dll
[2013.01.12 08:14:01 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_39.dll
[2013.01.12 08:14:01 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_0.dll
[2013.01.12 08:14:00 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_38.dll
[2013.01.12 08:14:00 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_38.dll
[2013.01.12 08:14:00 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_0.dll
[2013.01.12 08:14:00 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_38.dll
[2013.01.12 08:14:00 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_1.dll
[2013.01.12 08:14:00 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_4.dll
[2013.01.12 08:13:59 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_37.dll
[2013.01.12 08:13:59 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_37.dll
[2013.01.12 08:13:59 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_37.dll
[2013.01.12 08:13:59 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_10.dll
[2013.01.12 08:13:59 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_0.dll
[2013.01.12 08:13:59 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_3.dll
[2013.01.12 08:13:58 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_36.dll
[2013.01.12 08:13:58 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_36.dll
[2013.01.12 08:13:58 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_36.dll
[2013.01.12 08:13:57 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_35.dll
[2013.01.12 08:13:57 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_35.dll
[2013.01.12 08:13:57 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_35.dll
[2013.01.12 08:13:57 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_9.dll
[2013.01.12 08:13:56 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_2.dll
[2013.01.11 15:32:07 | 000,000,000 | ---D | C] -- C:\Program Files\Vodafone-Sicherheitspaket
[2013.01.11 15:31:15 | 000,000,000 | ---D | C] -- C:\ProgramData\fssg
[2013.01.11 15:29:10 | 000,000,000 | ---D | C] -- C:\ProgramData\f-secure
[2013.01.10 18:36:19 | 000,000,000 | ---D | C] -- C:\Windows\System32\Wat
[2013.01.09 21:06:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2013.01.09 18:20:18 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Local\Electronic_Arts_Inc
[2013.01.09 15:27:51 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013.01.09 15:23:42 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2013.01.09 15:23:41 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
[2013.01.08 17:11:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Origin
[2013.01.06 17:36:05 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserProtect
[2013.01.06 16:10:36 | 000,000,000 | ---D | C] -- C:\ProgramData\BrowserProtect
[2013.01.06 16:07:32 | 000,017,464 | ---- | C] (PerformerSoft LLC) -- C:\Windows\System32\roboot.exe
[2013.01.06 15:59:56 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2013.01.05 21:30:37 | 000,000,000 | ---D | C] -- C:\Macromedia
[2013.01.05 21:30:37 | 000,000,000 | ---D | C] -- \Macromedia
[2013.01.05 19:40:22 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Local\Windows Live Writer
[2013.01.05 19:35:51 | 000,000,000 | ---D | C] -- C:\Users\Info\Tracing
[2013.01.05 19:30:56 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_43.dll
[2013.01.05 19:30:56 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_7.dll
[2013.01.05 19:30:56 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_5.dll
[2013.01.05 19:30:55 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_43.dll
[2013.01.05 19:30:22 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_42.dll
[2013.01.05 19:28:27 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_32.dll
[2013.01.05 19:27:44 | 000,000,000 | R--D | C] -- C:\Users\Info\SkyDrive
[2013.01.05 19:27:44 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SkyDrive
[2013.01.05 19:27:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft SkyDrive
[2013.01.05 19:25:51 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Local\Windows Live
[2013.01.05 19:25:35 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Windows Live
[2013.01.05 16:01:01 | 000,000,000 | ---D | C] -- C:\Program Files\Two Worlds Pinball
[2013.01.05 15:42:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Wincert
[2013.01.05 15:41:40 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess
[2013.01.04 21:08:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WEB.DE MailCheck
[2013.01.04 21:07:15 | 000,000,000 | ---D | C] -- C:\ProgramData\1&1 Mail & Media GmbH
[2013.01.04 21:05:42 | 000,000,000 | ---D | C] -- C:\ProgramData\UUdb
 
========== Files - Modified Within 30 Days ==========
 
[2013.02.02 15:07:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.02.02 14:51:17 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.02.02 14:40:46 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3437191235-2556486254-1160177188-1000UA.job
[2013.02.02 14:36:21 | 000,662,014 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.02.02 14:36:21 | 000,623,856 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.02.02 14:36:21 | 000,133,648 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.02.02 14:36:21 | 000,110,030 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.02.02 14:34:03 | 000,009,904 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.02 14:34:03 | 000,009,904 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.02 13:26:32 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3437191235-2556486254-1160177188-1000UA.job
[2013.02.02 12:40:31 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3437191235-2556486254-1160177188-1000Core.job
[2013.02.02 08:33:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.02.01 21:16:18 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.02.01 19:42:52 | 000,002,370 | ---- | M] () -- C:\Users\Info\Desktop\Google Chrome.lnk
[2013.02.01 18:42:54 | 000,107,093 | ---- | M] () -- C:\Users\Info\Documents\1359727427_1_01.xml
[2013.02.01 18:17:20 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3437191235-2556486254-1160177188-1000Core.job
[2013.01.30 20:15:23 | 000,028,507 | ---- | M] () -- C:\Users\Info\Documents\41434262.pdf
[2013.01.30 18:24:06 | 2099,662,848 | -HS- | M] () -- C:\hiberfil.sys
[2013.01.30 16:59:10 | 000,482,928 | ---- | M] (BitDefender) -- C:\Windows\System32\drivers\avckf.sys
[2013.01.30 16:58:59 | 000,625,128 | ---- | M] (BitDefender) -- C:\Windows\System32\drivers\avc3.sys
[2013.01.30 16:56:16 | 000,066,392 | ---- | M] (BitDefender SRL) -- C:\Windows\System32\drivers\bdsandbox.sys
[2013.01.29 17:38:37 | 000,000,385 | ---- | M] () -- C:\Windows\System32\user_gensett.xml
[2013.01.29 17:16:58 | 000,000,648 | ---- | M] () -- C:\Users\Info\Desktop\Scanner and Camera Wizard.lnk
[2013.01.29 15:59:56 | 001,652,485 | ---- | M] () -- C:\Users\Info\Documents\userguide.pdf
[2013.01.29 14:16:06 | 000,072,704 | ---- | M] (BitDefender) -- C:\Windows\System32\drivers\bdvedisk.sys
[2013.01.28 18:07:16 | 001,553,496 | ---- | M] () -- C:\ProgramData\1359390656.bdinstall.bin
[2013.01.28 18:00:07 | 000,253,404 | -H-- | M] () -- C:\bdr-ld01
[2013.01.28 18:00:07 | 000,009,216 | -H-- | M] () -- C:\bdr-ld01.mbr
[2013.01.28 18:00:07 | 000,000,308 | -H-- | M] () -- C:\bdr-cf01
[2013.01.28 17:59:52 | 000,002,126 | ---- | M] () -- C:\Users\Public\Desktop\Bitdefender Internet Security 2013.lnk
[2013.01.28 17:59:52 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_avchv_01009.Wdf
[2013.01.21 17:35:06 | 000,001,196 | ---- | M] () -- C:\Users\Public\Desktop\FIFA 12.lnk
[2013.01.21 16:22:37 | 000,000,941 | ---- | M] () -- C:\Users\Public\Desktop\Origin.lnk
[2013.01.20 10:48:30 | 000,009,892 | ---- | M] () -- C:\Users\Info\Documents\vodafone-codes.odt
[2013.01.19 13:57:53 | 000,000,455 | ---- | M] () -- C:\Users\Info\Documents\Dokument.rtf
[2013.01.15 18:24:57 | 000,001,264 | ---- | M] () -- C:\Users\Info\Desktop\Free YouTube Download.lnk
[2013.01.15 15:49:14 | 000,445,034 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20130116-173755.backup
[2013.01.15 15:49:14 | 000,445,034 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2013.01.14 15:49:25 | 000,059,392 | R--- | M] () -- C:\Windows\System32\streamhlp.dll
[2013.01.13 12:56:09 | 000,000,017 | ---- | M] () -- C:\Users\Info\AppData\Local\resmon.resmoncfg
[2013.01.13 10:14:00 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.01.13 10:14:00 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.01.12 11:59:28 | 000,000,820 | ---- | M] () -- C:\Windows\wininit.ini
[2013.01.10 18:30:58 | 000,002,324 | ---- | M] () -- C:\Windows\epplauncher.mif
[2013.01.10 16:52:21 | 000,001,109 | ---- | M] () -- C:\Users\Info\Desktop\Mozilla Firefox.lnk
[2013.01.09 21:06:08 | 000,002,170 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2013.01.09 15:40:12 | 000,320,432 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.01.09 15:37:39 | 000,008,489 | ---- | M] () -- C:\Users\Info\Documents\Noch zu erledigen.odt
[2013.01.06 16:12:59 | 000,001,133 | ---- | M] () -- C:\Users\Info\Desktop\Pinball.lnk
[2013.01.05 19:32:40 | 000,000,020 | ---- | M] () -- C:\Windows\¤óœ
 
========== Files Created - No Company Name ==========
 
[2013.02.01 18:45:06 | 000,107,093 | ---- | C] () -- C:\Users\Info\Documents\1359727427_1_01.xml
[2013.01.30 20:15:20 | 000,028,507 | ---- | C] () -- C:\Users\Info\Documents\41434262.pdf
[2013.01.29 17:38:37 | 000,000,385 | ---- | C] () -- C:\Windows\System32\user_gensett.xml
[2013.01.29 17:17:59 | 000,000,648 | ---- | C] () -- C:\Users\Info\Desktop\Scanner and Camera Wizard.lnk
[2013.01.29 15:59:53 | 001,652,485 | ---- | C] () -- C:\Users\Info\Documents\userguide.pdf
[2013.01.28 18:07:16 | 001,553,496 | ---- | C] () -- C:\ProgramData\1359390656.bdinstall.bin
[2013.01.28 18:00:07 | 000,000,308 | -H-- | C] () -- C:\bdr-cf01
[2013.01.28 18:00:07 | 000,000,308 | -H-- | C] () -- \bdr-cf01
[2013.01.28 17:59:52 | 000,002,126 | ---- | C] () -- C:\Users\Public\Desktop\Bitdefender Internet Security 2013.lnk
[2013.01.28 17:59:52 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_avchv_01009.Wdf
[2013.01.28 17:39:30 | 035,184,777 | -H-- | C] () -- C:\bdr-im01.gz
[2013.01.28 17:39:30 | 035,184,777 | -H-- | C] () -- \bdr-im01.gz
[2013.01.28 17:39:30 | 002,294,848 | -H-- | C] () -- C:\bdr-bz01
[2013.01.28 17:39:30 | 002,294,848 | -H-- | C] () -- \bdr-bz01
[2013.01.28 17:39:30 | 000,253,404 | -H-- | C] () -- C:\bdr-ld01
[2013.01.28 17:39:30 | 000,253,404 | -H-- | C] () -- \bdr-ld01
[2013.01.28 17:39:30 | 000,009,216 | -H-- | C] () -- C:\bdr-ld01.mbr
[2013.01.28 17:39:30 | 000,009,216 | -H-- | C] () -- \bdr-ld01.mbr
[2013.01.21 17:35:06 | 000,001,196 | ---- | C] () -- C:\Users\Public\Desktop\FIFA 12.lnk
[2013.01.21 16:22:37 | 000,000,941 | ---- | C] () -- C:\Users\Public\Desktop\Origin.lnk
[2013.01.20 10:48:26 | 000,009,892 | ---- | C] () -- C:\Users\Info\Documents\vodafone-codes.odt
[2013.01.19 13:57:53 | 000,000,455 | ---- | C] () -- C:\Users\Info\Documents\Dokument.rtf
[2013.01.15 18:24:57 | 000,001,264 | ---- | C] () -- C:\Users\Info\Desktop\Free YouTube Download.lnk
[2013.01.14 15:49:03 | 000,059,392 | R--- | C] () -- C:\Windows\System32\streamhlp.dll
[2013.01.13 12:56:09 | 000,000,017 | ---- | C] () -- C:\Users\Info\AppData\Local\resmon.resmoncfg
[2013.01.10 18:30:58 | 000,002,324 | ---- | C] () -- C:\Windows\epplauncher.mif
[2013.01.10 16:51:58 | 000,001,109 | ---- | C] () -- C:\Users\Info\Desktop\Mozilla Firefox.lnk
[2013.01.10 16:51:52 | 000,001,121 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013.01.09 21:06:08 | 000,002,170 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2013.01.09 20:46:10 | 000,001,094 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.01.09 20:46:10 | 000,001,090 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.01.06 15:59:56 | 000,001,133 | ---- | C] () -- C:\Users\Info\Desktop\Pinball.lnk
[2013.01.05 19:32:39 | 000,000,020 | ---- | C] () -- C:\Windows\¤óœ
[2013.01.01 14:37:00 | 005,746,780 | ---- | C] ( ) -- C:\Windows\System32\RTKISDBT.dll
[2012.12.29 19:05:53 | 000,000,820 | ---- | C] () -- C:\Windows\wininit.ini
[2012.12.18 14:54:52 | 000,000,000 | RHS- | C] () -- \MSDOS.SYS
[2012.12.18 14:54:52 | 000,000,000 | RHS- | C] () -- \IO.SYS
[2012.12.14 02:02:20 | 000,064,512 | ---- | C] () -- C:\Windows\System32\igdde32.dll
[2012.12.14 02:02:20 | 000,009,728 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2012.12.14 02:02:20 | 000,000,268 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2012.11.17 16:39:51 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2012.10.22 17:40:04 | 000,272,928 | ---- | C] () -- C:\Windows\System32\igvpkrng600.bin
[2012.10.22 17:39:46 | 000,963,452 | ---- | C] () -- C:\Windows\System32\igcodeckrng600.bin
[2012.10.22 17:39:44 | 000,094,208 | ---- | C] () -- C:\Windows\System32\IccLibDll.dll
[2012.10.03 17:15:43 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2012.10.03 17:14:43 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2012.09.29 10:40:45 | 000,000,557 | ---- | C] () -- \NetworkCfg.xml
[2012.09.27 11:25:26 | 2099,662,848 | -HS- | C] () -- \hiberfil.sys
[2012.08.13 10:08:08 | 000,014,217 | ---- | C] () -- C:\Program Files\readme.html
[2012.07.27 21:47:36 | 000,159,232 | ---- | C] () -- C:\Windows\System32\clinfo.exe
[2012.05.08 13:15:36 | 000,000,005 | ---- | C] () -- C:\Program Files\basis-link
[2011.09.15 02:11:16 | 001,048,576 | ---- | C] () -- C:\Windows\System32\syndata.bin
[2011.08.17 06:48:34 | 000,262,080 | ---- | C] () -- C:\Windows\System32\SynPS2.bin
[2011.05.09 17:19:48 | 000,246,804 | ---- | C] () -- C:\Windows\System32\drivers\AtherosBt.bin
[2011.02.11 22:23:34 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2009.07.14 03:04:04 | 000,000,024 | ---- | C] () -- \autoexec.bat
[2009.07.14 03:04:04 | 000,000,010 | ---- | C] () -- \config.sys
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2013.01.04 21:07:15 | 000,000,000 | ---D | M] -- C:\Users\All Users\1&1 Mail & Media GmbH
[2012.12.01 14:09:40 | 000,000,000 | ---D | M] -- C:\Users\All Users\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2013.01.04 11:30:14 | 000,000,000 | ---D | M] -- C:\Users\All Users\1und1InternetExplorerAddon
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\All Users\Anwendungsdaten
[2012.11.17 16:05:17 | 000,000,000 | ---D | M] -- C:\Users\All Users\Ask
[2013.01.31 16:34:47 | 000,000,000 | ---D | M] -- C:\Users\All Users\BDLogging
[2013.01.28 18:00:38 | 000,000,000 | ---D | M] -- C:\Users\All Users\Bitdefender
[2013.01.05 15:41:40 | 000,000,000 | ---D | M] -- C:\Users\All Users\boost_interprocess
[2013.01.06 16:10:36 | 000,000,000 | ---D | M] -- C:\Users\All Users\BrowserProtect
[2013.01.14 18:51:40 | 000,000,000 | ---D | M] -- C:\Users\All Users\clp
[2012.12.18 16:34:38 | 000,000,000 | -H-D | M] -- C:\Users\All Users\Common Files
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\All Users\Desktop
[2013.01.04 11:30:12 | 000,000,000 | ---D | M] -- C:\Users\All Users\DesktopIcons
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\All Users\Dokumente
[2013.01.31 16:39:30 | 000,000,000 | ---D | M] -- C:\Users\All Users\Dumps
[2013.01.21 19:23:03 | 000,000,000 | ---D | M] -- C:\Users\All Users\EA Core
[2013.01.21 19:23:26 | 000,000,000 | ---D | M] -- C:\Users\All Users\Electronic Arts
[2013.01.14 19:16:39 | 000,000,000 | ---D | M] -- C:\Users\All Users\f-secure
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\All Users\Favoriten
[2012.12.28 22:58:50 | 000,000,000 | ---D | M] -- C:\Users\All Users\Freemake
[2013.01.13 11:01:55 | 000,000,000 | ---D | M] -- C:\Users\All Users\fssg
[2012.10.20 13:20:59 | 000,000,000 | ---D | M] -- C:\Users\All Users\MakeMusic
[2013.01.21 16:24:28 | 000,000,000 | ---D | M] -- C:\Users\All Users\Origin
[2012.12.28 21:13:22 | 000,000,000 | ---D | M] -- C:\Users\All Users\PC Drivers HeadQuarters
[2013.01.28 17:14:52 | 000,000,000 | ---D | M] -- C:\Users\All Users\SpeedMaxPc
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\All Users\Startmenü
[2012.09.27 20:04:57 | 000,000,000 | ---D | M] -- C:\Users\All Users\Synaptics
[2012.12.18 17:54:13 | 000,000,000 | ---D | M] -- C:\Users\All Users\TEMP
[2012.12.18 16:34:56 | 000,000,000 | ---D | M] -- C:\Users\All Users\TuneUp Software
[2013.01.04 21:05:42 | 000,000,000 | ---D | M] -- C:\Users\All Users\UUdb
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\All Users\Vorlagen
[2013.01.06 17:36:04 | 000,000,000 | ---D | M] -- C:\Users\All Users\Wincert
[2013.01.06 16:26:41 | 000,000,000 | -HSD | M] -- C:\Users\All Users\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Anwendungsdaten
[2009.07.14 03:37:05 | 000,000,000 | -H-D | M] -- C:\Users\Default\AppData
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Cookies
[2009.07.14 03:04:25 | 000,000,000 | R--D | M] -- C:\Users\Default\Desktop
[2012.09.27 11:32:36 | 000,000,000 | R--D | M] -- C:\Users\Default\Documents
[2009.07.14 03:04:25 | 000,000,000 | R--D | M] -- C:\Users\Default\Downloads
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Druckumgebung
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Eigene Dateien
[2009.07.14 03:04:25 | 000,000,000 | R--D | M] -- C:\Users\Default\Favorites
[2013.01.12 21:29:16 | 000,000,000 | R--D | M] -- C:\Users\Default\Links
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Lokale Einstellungen
[2009.07.14 03:04:25 | 000,000,000 | R--D | M] -- C:\Users\Default\Music
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Netzwerkumgebung
[2009.07.14 03:04:25 | 000,000,000 | R--D | M] -- C:\Users\Default\Pictures
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Recent
[2009.07.14 03:04:25 | 000,000,000 | ---D | M] -- C:\Users\Default\Saved Games
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\SendTo
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Startmenü
[2009.07.14 03:04:25 | 000,000,000 | R--D | M] -- C:\Users\Default\Videos
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Vorlagen
[2012.09.29 08:41:30 | 000,000,000 | ---D | M] -- C:\Users\Info\.LOGOComfort6.1
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Anwendungsdaten
[2013.01.30 18:12:08 | 000,000,000 | -H-D | M] -- C:\Users\Info\AppData
[2012.10.03 17:47:55 | 000,000,000 | R--D | M] -- C:\Users\Info\Contacts
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Cookies
[2013.01.31 16:39:30 | 000,000,000 | R--D | M] -- C:\Users\Info\Desktop
[2013.02.02 12:32:46 | 000,000,000 | R--D | M] -- C:\Users\Info\Documents
[2013.02.02 15:27:02 | 000,000,000 | R--D | M] -- C:\Users\Info\Downloads
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Druckumgebung
[2012.09.27 11:34:15 | 000,000,000 | -HSD | M] -- C:\Users\Info\Eigene Dateien
[2013.02.01 18:52:18 | 000,000,000 | R--D | M] -- C:\Users\Info\Favorites
[2012.09.29 08:38:24 | 000,000,000 | -H-D | M] -- C:\Users\Info\InstallAnywhere
[2013.01.05 19:27:44 | 000,000,000 | R--D | M] -- C:\Users\Info\Links
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Lokale Einstellungen
[2013.01.09 17:20:50 | 000,000,000 | R--D | M] -- C:\Users\Info\Music
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Netzwerkumgebung
[2013.02.01 19:11:14 | 000,000,000 | R--D | M] -- C:\Users\Info\Pictures
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Recent
[2012.10.03 17:47:55 | 000,000,000 | R--D | M] -- C:\Users\Info\Saved Games
[2012.10.07 10:03:30 | 000,000,000 | R--D | M] -- C:\Users\Info\Searches
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\SendTo
[2013.01.12 21:29:22 | 000,000,000 | R--D | M] -- C:\Users\Info\SkyDrive
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Startmenü
[2013.01.19 10:08:21 | 000,000,000 | ---D | M] -- C:\Users\Info\Tracing
[2013.01.27 19:23:39 | 000,000,000 | R--D | M] -- C:\Users\Info\Videos
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Vorlagen
[2012.11.17 16:39:29 | 000,000,000 | ---D | M] -- C:\Users\Malisa\Desktop
[2013.01.30 19:51:57 | 000,000,000 | RH-D | M] -- C:\Users\Public\Desktop
[2012.10.20 15:03:02 | 000,000,000 | R--D | M] -- C:\Users\Public\Documents
[2009.07.14 05:41:57 | 000,000,000 | R--D | M] -- C:\Users\Public\Downloads
[2009.07.14 03:04:25 | 000,000,000 | RH-D | M] -- C:\Users\Public\Favorites
[2012.09.27 11:54:46 | 000,000,000 | RH-D | M] -- C:\Users\Public\Libraries
[2012.10.01 13:20:41 | 000,000,000 | R--D | M] -- C:\Users\Public\Music
[2009.07.14 05:41:57 | 000,000,000 | R--D | M] -- C:\Users\Public\Pictures
[2012.10.02 13:02:43 | 000,000,000 | R--D | M] -- C:\Users\Public\Recorded TV
[2009.07.14 05:41:57 | 000,000,000 | R--D | M] -- C:\Users\Public\Videos
 
========== Purity Check ==========
 
 

< End of report >

cosinus 02.02.2013 16:32
Malwarebytes Anti-Rootkit http://img.trojaner-board.de/malware...otkit/logo.png

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Entpacke das Archiv auf deinem Desktop.
  • Im neu erstellten Ordner starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

duddl 02.02.2013 16:48
Ich kann die heruntergeladene Datei nicht öffnen.
Welches Programm soll ich dazu verwenden?

cosinus 02.02.2013 16:53
Das ist ein ZIP-Archiv, logischerweise mit sowas wie 7zip, WinRAR oder einem anderen Packer

duddl 02.02.2013 19:49
Code:
Malwarebytes Anti-Rootkit BETA 1.01.0.1017
www.malwarebytes.org

Database version: v2013.02.02.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Info :: ALEXANDER-HP630 [administrator]

02.02.2013 19:24:47
mbar-log-2013-02-02 (19-24-47).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 28452
Time elapsed: 17 minute(s), 11 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 2
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{C1ED9DA0-AFD0-4B90-AC6A-D3874F591014} (PUP.Datamngr) -> Delete on reboot.
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{F34C9277-6577-4DFF-B2D7-7D58092F272F} (PUP.Datamngr) -> Delete on reboot.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
Der findet ständig diese Registry-Fehler, sonst aber nichts.
Die hat er nach dem Neustart und dem 2. Scan aber nicht behoben.

ich kaufe mir sowieso tuneup utilities. vielleicht kann der die Probleme beheben?!

cosinus 03.02.2013 01:33
Bitte nun Logs mit GMER (<<< klick für Anleitung) und aswMBR (Anleitung etwas weiter unten) erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim zweiten Mal nicht will, lass es einfach weg und führ nur aswMBR aus.

aswMBR-Download => aswMBR.exe - speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

duddl 03.02.2013 09:22
Gmer findet rootkit, ich weiß aber nicht, wie man es entfernen kann:

ich kann gmer auch im anhang nicht hochladen, da es viel zu groß ist.
Das ist das rot-markierte Objekt, das er findet:

Module (noname) (***hidden***) 85E2C000-860DF000 (2830336 bytes)

Das ist von aswMBR:

Code:
aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2013-02-03 09:40:32
-----------------------------
09:40:32.795    OS Version: Windows 6.1.7601 Service Pack 1
09:40:32.795    Number of processors: 2 586 0x2A07
09:40:32.799    ComputerName: ALEXANDER-HP630  UserName: Info
09:40:35.031    Initialize success
09:41:55.996    AVAST engine defs: 13020201
09:42:20.866    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
09:42:20.869    Disk 0 Vendor: WDC_WD64 01.0 Size: 610480MB BusType: 3
09:42:21.177    Disk 0 MBR read successfully
09:42:21.181    Disk 0 MBR scan
09:42:21.312    Disk 0 Windows 7 default MBR code
09:42:21.322    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
09:42:21.372    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      610379 MB offset 206848
09:42:21.515    Disk 0 scanning sectors +1250263040
09:42:21.974    Disk 0 scanning C:\Windows\system32\drivers
09:43:45.411    Service scanning
09:43:49.787    Service BdfNdisf c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys **LOCKED** 5
09:43:49.859    Service bdfwfpf C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys **LOCKED** 5
09:43:50.225    Service bdselfpr C:\Program Files\Bitdefender\Bitdefender 2013\bdselfpr.sys **LOCKED** 5
09:44:20.641    Modules scanning
09:46:51.622    Disk 0 trace - called modules:
09:46:51.682    ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys halmacpi.dll
09:46:52.287    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x88104440]
09:46:52.337    3 CLASSPNP.SYS[8b27659e] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x85e06028]
09:46:54.340    AVAST engine scan C:\Windows
09:51:45.593    AVAST engine scan C:\Windows\system32
09:51:55.961    Disk 0 MBR has been saved successfully to "C:\Users\Info\Documents\MBR.dat"
09:51:56.303    The log file has been saved successfully to "C:\Users\Info\Documents\aswMBR.txt"


aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2013-02-03 09:40:32
-----------------------------
09:40:32.795    OS Version: Windows 6.1.7601 Service Pack 1
09:40:32.795    Number of processors: 2 586 0x2A07
09:40:32.799    ComputerName: ALEXANDER-HP630  UserName: Info
09:40:35.031    Initialize success
09:41:55.996    AVAST engine defs: 13020201
09:42:20.866    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
09:42:20.869    Disk 0 Vendor: WDC_WD64 01.0 Size: 610480MB BusType: 3
09:42:21.177    Disk 0 MBR read successfully
09:42:21.181    Disk 0 MBR scan
09:42:21.312    Disk 0 Windows 7 default MBR code
09:42:21.322    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
09:42:21.372    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      610379 MB offset 206848
09:42:21.515    Disk 0 scanning sectors +1250263040
09:42:21.974    Disk 0 scanning C:\Windows\system32\drivers
09:43:45.411    Service scanning
09:43:49.787    Service BdfNdisf c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys **LOCKED** 5
09:43:49.859    Service bdfwfpf C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys **LOCKED** 5
09:43:50.225    Service bdselfpr C:\Program Files\Bitdefender\Bitdefender 2013\bdselfpr.sys **LOCKED** 5
09:44:20.641    Modules scanning
09:46:51.622    Disk 0 trace - called modules:
09:46:51.682    ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys halmacpi.dll
09:46:52.287    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x88104440]
09:46:52.337    3 CLASSPNP.SYS[8b27659e] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x85e06028]
09:46:54.340    AVAST engine scan C:\Windows
09:51:45.593    AVAST engine scan C:\Windows\system32
09:51:55.961    Disk 0 MBR has been saved successfully to "C:\Users\Info\Documents\MBR.dat"
09:51:56.303    The log file has been saved successfully to "C:\Users\Info\Documents\aswMBR.txt"
10:04:45.288    AVAST engine scan C:\Windows\system32\drivers
10:05:34.716    AVAST engine scan C:\Users\Info
10:22:18.009    AVAST engine scan C:\ProgramData
10:23:44.445    Scan finished successfully
10:56:33.185    Disk 0 MBR has been saved successfully to "C:\Users\Info\Documents\MBR.dat"
10:56:33.340    The log file has been saved successfully to "C:\Users\Info\Documents\aswMBR.txt"

cosinus 03.02.2013 22:21
Das GMER-Log bitte zippen und anhängen, aber nur als Ausnahme da es ja zu groß ist. Ansonsten die Logs immer direkt und in CODE-Tags posten

duddl 04.02.2013 14:12
Ich kann aber diese Zip-Öffner nciht installieren oder verwenden, da es zu unsicher ist und viren beinhalten könnte.

cosinus 04.02.2013 14:44
Zitat:
Ich kann aber diese Zip-Öffner nciht installieren oder verwenden, da es zu unsicher ist und viren beinhalten könnte.
Sry wer behauptet das? :balla:
Einfach 7zip installieren und weitermachen....

Bitte auch mal (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehlalarm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtg4nzy0ywy5/settings_2012-09-04.png

duddl 04.02.2013 16:35
Code:
16:30:12.0180 5916        TDSS rootkit removing tool 2.7.42.0 Jun 25 2012 21:18:44
16:30:14.0183 5916        ============================================================
16:30:14.0183 5916        Current date / time: 2013/02/04 16:30:14.0183
16:30:14.0183 5916        SystemInfo:
16:30:14.0183 5916       
16:30:14.0183 5916        OS Version: 6.1.7601 ServicePack: 1.0
16:30:14.0183 5916        Product type: Workstation
16:30:14.0183 5916        ComputerName: ALEXANDER-HP630
16:30:14.0184 5916        UserName: Info
16:30:14.0184 5916        Windows directory: C:\Windows
16:30:14.0184 5916        System windows directory: C:\Windows
16:30:14.0184 5916        Processor architecture: Intel x86
16:30:14.0184 5916        Number of processors: 2
16:30:14.0184 5916        Page size: 0x1000
16:30:14.0184 5916        Boot type: Normal boot
16:30:14.0184 5916        ============================================================
16:30:15.0394 5916        Drive \Device\Harddisk0\DR0 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
16:30:15.0398 5916        ============================================================
16:30:15.0398 5916        \Device\Harddisk0\DR0:
16:30:15.0398 5916        MBR partitions:
16:30:15.0398 5916        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
16:30:15.0398 5916        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x4A825800
16:30:15.0398 5916        ============================================================
16:30:15.0509 5916        C: <-> \Device\Harddisk0\DR0\Partition1
16:30:15.0509 5916        ============================================================
16:30:15.0509 5916        Initialize success
16:30:15.0509 5916        ============================================================
16:31:03.0188 6580        ============================================================
16:31:03.0188 6580        Scan started
16:31:03.0188 6580        Mode: Manual; SigCheck; TDLFS;
16:31:03.0188 6580        ============================================================
16:31:12.0098 6580        1394ohci        (1b133875b8aa8ac48969bd3458afe9f5) C:\Windows\system32\drivers\1394ohci.sys
16:31:13.0761 6580        1394ohci - ok
16:31:14.0348 6580        ACDaemon        (adc420616c501b45d26c0fd3ef1e54e4) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
16:31:14.0484 6580        ACDaemon - ok
16:31:14.0663 6580        ACPI            (cea80c80bed809aa0da6febc04733349) C:\Windows\system32\drivers\ACPI.sys
16:31:14.0812 6580        ACPI - ok
16:31:14.0932 6580        AcpiPmi        (1efbc664abff416d1d07db115dcb264f) C:\Windows\system32\drivers\acpipmi.sys
16:31:15.0023 6580        AcpiPmi - ok
16:31:15.0171 6580        AdobeARMservice (3927397ac60d943daf8808affed582b7) C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
16:31:15.0200 6580        AdobeARMservice - ok
16:31:15.0306 6580        AdobeFlashPlayerUpdateSvc (424877cb9d5517f980ff7baca2eb379d) C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
16:31:15.0415 6580        AdobeFlashPlayerUpdateSvc - ok
16:31:15.0521 6580        adp94xx        (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
16:31:15.0567 6580        adp94xx - ok
16:31:15.0805 6580        adpahci        (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
16:31:15.0853 6580        adpahci - ok
16:31:15.0926 6580        adpu320        (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
16:31:15.0969 6580        adpu320 - ok
16:31:16.0016 6580        AeLookupSvc    (8b5eefeec1e6d1a72a06c526628ad161) C:\Windows\System32\aelupsvc.dll
16:31:16.0076 6580        AeLookupSvc - ok
16:31:16.0140 6580        Afc            (a7b8a3a79d35215d798a300df49ed23f) C:\Windows\system32\drivers\Afc.sys
16:31:16.0189 6580        Afc ( UnsignedFile.Multi.Generic ) - warning
16:31:16.0189 6580        Afc - detected UnsignedFile.Multi.Generic (1)
16:31:16.0321 6580        AFD            (9ebbba55060f786f0fcaa3893bfa2806) C:\Windows\system32\drivers\afd.sys
16:31:16.0481 6580        AFD - ok
16:31:16.0699 6580        agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\drivers\agp440.sys
16:31:16.0739 6580        agp440 - ok
16:31:16.0997 6580        aic78xx        (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
16:31:17.0061 6580        aic78xx - ok
16:31:17.0279 6580        ALG            (18a54e132947cd98fea9accc57f98f13) C:\Windows\System32\alg.exe
16:31:17.0463 6580        ALG - ok
16:31:17.0501 6580        aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\drivers\aliide.sys
16:31:17.0537 6580        aliide - ok
16:31:17.0608 6580        amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\drivers\amdagp.sys
16:31:17.0645 6580        amdagp - ok
16:31:17.0724 6580        amdide          (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\drivers\amdide.sys
16:31:17.0782 6580        amdide - ok
16:31:17.0851 6580        AmdK8          (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
16:31:17.0923 6580        AmdK8 - ok
16:31:17.0956 6580        AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
16:31:17.0993 6580        AmdPPM - ok
16:31:18.0028 6580        amdsata        (e7f4d42d8076ec60e21715cd11743a0d) C:\Windows\system32\drivers\amdsata.sys
16:31:18.0121 6580        amdsata - ok
16:31:18.0302 6580        amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
16:31:18.0379 6580        amdsbs - ok
16:31:18.0444 6580        amdxata        (146459d2b08bfdcbfa856d9947043c81) C:\Windows\system32\drivers\amdxata.sys
16:31:18.0486 6580        amdxata - ok
16:31:18.0616 6580        AppID          (aea177f783e20150ace5383ee368da19) C:\Windows\system32\drivers\appid.sys
16:31:18.0951 6580        AppID - ok
16:31:18.0978 6580        AppIDSvc        (62a9c86cb6085e20db4823e4e97826f5) C:\Windows\System32\appidsvc.dll
16:31:19.0054 6580        AppIDSvc - ok
16:31:19.0262 6580        Appinfo        (fb1959012294d6ad43e5304df65e3c26) C:\Windows\System32\appinfo.dll
16:31:19.0334 6580        Appinfo - ok
16:31:19.0448 6580        AppMgmt        (a45d184df6a8803da13a0b329517a64a) C:\Windows\System32\appmgmts.dll
16:31:19.0545 6580        AppMgmt - ok
16:31:19.0591 6580        arc            (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
16:31:19.0674 6580        arc - ok
16:31:19.0704 6580        arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
16:31:19.0753 6580        arcsas - ok
16:31:19.0794 6580        AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
16:31:19.0933 6580        AsyncMac - ok
16:31:20.0002 6580        atapi          (338c86357871c167a96ab976519bf59e) C:\Windows\system32\drivers\atapi.sys
16:31:20.0154 6580        atapi - ok
16:31:20.0189 6580        AthBTPort      (882edbafcc227852c9dca23ea48d2e78) C:\Windows\system32\DRIVERS\btath_flt.sys
16:31:20.0229 6580        AthBTPort - ok
16:31:20.0477 6580        Atheros Bt&Wlan Coex Agent (650f111d5cda64c10ae4b9d1ba9d4fff) C:\Program Files\Bluetooth Suite\Ath_CoexAgent.exe
16:31:20.0562 6580        Atheros Bt&Wlan Coex Agent - ok
16:31:20.0647 6580        AtherosSvc      (3d850acded547319ecb0aa98b79d5770) C:\Program Files\Bluetooth Suite\adminservice.exe
16:31:20.0721 6580        AtherosSvc - ok
16:31:21.0083 6580        athr            (cfe432e8eeacbcea3dbf53ea76978a65) C:\Windows\system32\DRIVERS\athr.sys
16:31:21.0423 6580        athr - ok
16:31:21.0893 6580        AudioEndpointBuilder (ce3b4e731638d2ef62fcb419be0d39f0) C:\Windows\System32\Audiosrv.dll
16:31:21.0989 6580        AudioEndpointBuilder - ok
16:31:21.0996 6580        Audiosrv        (ce3b4e731638d2ef62fcb419be0d39f0) C:\Windows\System32\Audiosrv.dll
16:31:22.0074 6580        Audiosrv - ok
16:31:22.0239 6580        avc3            (f3d3b0affd227aa2bfc80c1a4536baa0) C:\Windows\system32\DRIVERS\avc3.sys
16:31:22.0564 6580        avc3 - ok
16:31:22.0633 6580        avchv          (7f9b99b564e7c9fbb6729ed95b5bbb24) C:\Windows\system32\DRIVERS\avchv.sys
16:31:22.0702 6580        avchv - ok
16:31:22.0849 6580        avckf          (c7be750843a8a39167187fd28634a25e) C:\Windows\system32\DRIVERS\avckf.sys
16:31:22.0938 6580        avckf - ok
16:31:22.0951 6580        AVFSFilter - ok
16:31:23.0165 6580        AxInstSV        (6e30d02aac9cac84f421622e3a2f6178) C:\Windows\System32\AxInstSV.dll
16:31:23.0584 6580        AxInstSV - ok
16:31:23.0761 6580        b06bdrv        (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
16:31:23.0908 6580        b06bdrv - ok
16:31:24.0125 6580        b57nd60x        (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
16:31:24.0211 6580        b57nd60x - ok
16:31:24.0563 6580        BdDesktopParental (7f68862a3a4be1a032b5bf3a992423e1) C:\Program Files\Bitdefender\Bitdefender 2013\bdparentalservice.exe
16:31:24.0647 6580        BdDesktopParental - ok
16:31:24.0824 6580        BDESVC          (ee1e9c3bb8228ae423dd38db69128e71) C:\Windows\System32\bdesvc.dll
16:31:24.0962 6580        BDESVC - ok
16:31:25.0300 6580        BdfNdisf        (2c8f82dc54215b2fe064eff996f39d9b) c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys
16:31:25.0355 6580        BdfNdisf - ok
16:31:25.0411 6580        bdfwfpf        (2f66c9df34134419928bac00e21e2679) C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys
16:31:25.0534 6580        bdfwfpf - ok
16:31:25.0685 6580        BDSandBox      (b6cbfc9d825bb2d955620cd4d8ef07f9) C:\Windows\system32\drivers\bdsandbox.sys
16:31:25.0723 6580        BDSandBox - ok
16:31:26.0040 6580        bdselfpr        (a7478f77584f8db6ad74b2bbe1144886) C:\Program Files\Bitdefender\Bitdefender 2013\bdselfpr.sys
16:31:26.0281 6580        bdselfpr - ok
16:31:26.0355 6580        Beep            (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
16:31:26.0480 6580        Beep - ok
16:31:26.0863 6580        BFE            (1e2bac209d184bb851e1a187d8a29136) C:\Windows\System32\bfe.dll
16:31:26.0985 6580        BFE - ok
16:31:27.0119 6580        BITS            (e585445d5021971fae10393f0f1c3961) C:\Windows\System32\qmgr.dll
16:31:27.0216 6580        BITS - ok
16:31:27.0263 6580        blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
16:31:27.0407 6580        blbdrive - ok
16:31:27.0850 6580        Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe
16:31:27.0943 6580        Bonjour Service - ok
16:31:28.0029 6580        bowser          (8f2da3028d5fcbd1a060a3de64cd6506) C:\Windows\system32\DRIVERS\bowser.sys
16:31:28.0091 6580        bowser - ok
16:31:28.0140 6580        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
16:31:28.0254 6580        BrFiltLo - ok
16:31:28.0263 6580        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
16:31:28.0297 6580        BrFiltUp - ok
16:31:28.0464 6580        Browser        (3daa727b5b0a45039b0e1c9a211b8400) C:\Windows\System32\browser.dll
16:31:28.0549 6580        Browser - ok
16:31:28.0894 6580        Brserid        (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
16:31:29.0090 6580        Brserid - ok
16:31:29.0207 6580        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
16:31:29.0273 6580        BrSerWdm - ok
16:31:29.0361 6580        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
16:31:29.0441 6580        BrUsbMdm - ok
16:31:29.0453 6580        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
16:31:29.0527 6580        BrUsbSer - ok
16:31:30.0311 6580        BTATH_A2DP      (e5b321f18a1d8b6b8dd397d92ba5946a) C:\Windows\system32\drivers\btath_a2dp.sys
16:31:30.0399 6580        BTATH_A2DP - ok
16:31:30.0481 6580        BTATH_BUS      (429a2013b16a38496d2c5459f382636e) C:\Windows\system32\DRIVERS\btath_bus.sys
16:31:30.0511 6580        BTATH_BUS - ok
16:31:31.0061 6580        BTATH_HCRP      (f31e369db8258b28e3dcf66705aea9e9) C:\Windows\system32\DRIVERS\btath_hcrp.sys
16:31:31.0237 6580        BTATH_HCRP - ok
16:31:31.0411 6580        BTATH_LWFLT    (6651798266fde23159d961463a63a77d) C:\Windows\system32\DRIVERS\btath_lwflt.sys
16:31:31.0442 6580        BTATH_LWFLT - ok
16:31:31.0994 6580        BTATH_RCP      (08ef5298df80bc136523bcd2ed8b9c37) C:\Windows\system32\DRIVERS\btath_rcp.sys
16:31:32.0092 6580        BTATH_RCP - ok
16:31:32.0572 6580        BtFilter        (fee4e106761695da368c1855d58a4fd5) C:\Windows\system32\DRIVERS\btfilter.sys
16:31:32.0683 6580        BtFilter - ok
16:31:32.0889 6580        BthEnum        (2865a5c8e98c70c605f417908cebb3a4) C:\Windows\system32\drivers\BthEnum.sys
16:31:32.0981 6580        BthEnum - ok
16:31:33.0170 6580        BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
16:31:33.0227 6580        BTHMODEM - ok
16:31:33.0379 6580        BthPan          (ad1872e5829e8a2c3b5b4b641c3eab0e) C:\Windows\system32\DRIVERS\bthpan.sys
16:31:33.0421 6580        BthPan - ok
16:31:34.0284 6580        BTHPORT        (c2fbf6d271d9a94d839c416bf186ead9) C:\Windows\System32\Drivers\BTHport.sys
16:31:34.0570 6580        BTHPORT - ok
16:31:34.0694 6580        bthserv        (1df19c96eef6c29d1c3e1a8678e07190) C:\Windows\system32\bthserv.dll
16:31:34.0793 6580        bthserv - ok
16:31:34.0845 6580        BTHUSB          (c81e9413a25a439f436b1d4b6a0cf9e9) C:\Windows\System32\Drivers\BTHUSB.sys
16:31:34.0890 6580        BTHUSB - ok
16:31:35.0041 6580        cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
16:31:35.0123 6580        cdfs - ok
16:31:35.0439 6580        cdrom          (be167ed0fdb9c1fa1133953c18d5a6c9) C:\Windows\system32\drivers\cdrom.sys
16:31:35.0587 6580        cdrom - ok
16:31:35.0831 6580        CertPropSvc    (319c6b309773d063541d01df8ac6f55f) C:\Windows\System32\certprop.dll
16:31:36.0153 6580        CertPropSvc - ok
16:31:36.0322 6580        circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
16:31:36.0367 6580        circlass - ok
16:31:36.0489 6580        CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
16:31:36.0561 6580        CLFS - ok
16:31:36.0850 6580        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:31:36.0984 6580        clr_optimization_v2.0.50727_32 - ok
16:31:37.0446 6580        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:31:37.0503 6580        clr_optimization_v4.0.30319_32 - ok
16:31:37.0567 6580        CmBatt          (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
16:31:37.0603 6580        CmBatt - ok
16:31:37.0688 6580        cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\drivers\cmdide.sys
16:31:37.0720 6580        cmdide - ok
16:31:37.0855 6580        CNG            (247b4ce2dab1160cd422d532d5241e1f) C:\Windows\system32\Drivers\cng.sys
16:31:37.0980 6580        CNG - ok
16:31:38.0070 6580        Compbatt        (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
16:31:38.0104 6580        Compbatt - ok
16:31:38.0173 6580        CompositeBus    (cbe8c58a8579cfe5fccf809e6f114e89) C:\Windows\system32\drivers\CompositeBus.sys
16:31:38.0211 6580        CompositeBus - ok
16:31:38.0215 6580        COMSysApp - ok
16:31:38.0456 6580        cphs            (2155d9c6f9ef97e149bb5a75d608524d) C:\Windows\system32\IntelCpHeciSvc.exe
16:31:38.0555 6580        cphs - ok
16:31:38.0718 6580        crcdisk        (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
16:31:38.0752 6580        crcdisk - ok
16:31:39.0162 6580        CryptSvc        (96c0e38905cfd788313be8e11dae3f2f) C:\Windows\system32\cryptsvc.dll
16:31:39.0361 6580        CryptSvc - ok
16:31:39.0887 6580        CSC            (3c2177a897b4ca2788c6fb0c3fd81d4b) C:\Windows\system32\drivers\csc.sys
16:31:40.0223 6580        CSC - ok
16:31:40.0632 6580        CscService      (15f93b37f6801943360d9eb42485d5d3) C:\Windows\System32\cscsvc.dll
16:31:40.0741 6580        CscService - ok
16:31:40.0947 6580        DcomLaunch      (7660f01d3b38aca1747e397d21d790af) C:\Windows\system32\rpcss.dll
16:31:41.0002 6580        DcomLaunch - ok
16:31:41.0095 6580        defragsvc      (8d6e10a2d9a5eed59562d9b82cf804e1) C:\Windows\System32\defragsvc.dll
16:31:41.0154 6580        defragsvc - ok
16:31:41.0339 6580        DfsC            (f024449c97ec1e464aaffda18593db88) C:\Windows\system32\Drivers\dfsc.sys
16:31:41.0546 6580        DfsC - ok
16:31:41.0597 6580        Dhcp            (e9e01eb683c132f7fa27cd607b8a2b63) C:\Windows\system32\dhcpcore.dll
16:31:41.0743 6580        Dhcp - ok
16:31:41.0840 6580        discache        (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
16:31:41.0897 6580        discache - ok
16:31:41.0977 6580        Disk            (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
16:31:42.0018 6580        Disk - ok
16:31:42.0165 6580        Dnscache        (33ef4861f19a0736b11314aad9ae28d0) C:\Windows\System32\dnsrslvr.dll
16:31:42.0220 6580        Dnscache - ok
16:31:42.0374 6580        dot3svc        (366ba8fb4b7bb7435e3b9eacb3843f67) C:\Windows\System32\dot3svc.dll
16:31:42.0427 6580        dot3svc - ok
16:31:42.0725 6580        DPS            (8ec04ca86f1d68da9e11952eb85973d6) C:\Windows\system32\dps.dll
16:31:42.0796 6580        DPS - ok
16:31:42.0840 6580        drmkaud        (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
16:31:42.0877 6580        drmkaud - ok
16:31:43.0471 6580        DXGKrnl        (23f5d28378a160352ba8f817bd8c71cb) C:\Windows\System32\drivers\dxgkrnl.sys
16:31:43.0717 6580        DXGKrnl - ok
16:31:43.0778 6580        E1G60          (22ef8965101685add128f03a2b03ce16) C:\Windows\system32\DRIVERS\E1G60I32.sys
16:31:43.0818 6580        E1G60 - ok
16:31:44.0261 6580        EapHost        (8600142fa91c1b96367d3300ad0f3f3a) C:\Windows\System32\eapsvc.dll
16:31:44.0356 6580        EapHost - ok
16:31:44.0972 6580        ebdrv          (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
16:31:45.0283 6580        ebdrv - ok
16:31:47.0046 6580        EFS            (81951f51e318aecc2d68559e47485cc4) C:\Windows\System32\lsass.exe
16:31:47.0131 6580        EFS - ok
16:31:47.0761 6580        ehRecvr        (a8c362018efc87beb013ee28f29c0863) C:\Windows\ehome\ehRecvr.exe
16:31:48.0242 6580        ehRecvr - ok
16:31:48.0608 6580        ehSched        (d389bff34f80caede417bf9d1507996a) C:\Windows\ehome\ehsched.exe
16:31:49.0007 6580        ehSched - ok
16:31:49.0511 6580        elxstor        (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
16:31:49.0739 6580        elxstor - ok
16:31:49.0831 6580        ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\drivers\errdev.sys
16:31:49.0866 6580        ErrDev - ok
16:31:50.0644 6580        EventSystem    (f6916efc29d9953d5d0df06882ae8e16) C:\Windows\system32\es.dll
16:31:50.0727 6580        EventSystem - ok
16:31:50.0825 6580        exfat          (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
16:31:51.0104 6580        exfat - ok
16:31:51.0232 6580        fastfat        (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
16:31:51.0298 6580        fastfat - ok
16:31:51.0525 6580        Fax            (967ea5b213e9984cbe270205df37755b) C:\Windows\system32\fxssvc.exe
16:31:51.0711 6580        Fax - ok
16:31:51.0781 6580        fdc            (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
16:31:51.0822 6580        fdc - ok
16:31:51.0875 6580        fdPHost        (f3222c893bd2f5821a0179e5c71e88fb) C:\Windows\system32\fdPHost.dll
16:31:52.0025 6580        fdPHost - ok
16:31:52.0200 6580        FDResPub        (7dbe8cbfe79efbdeb98c9fb08d3a9a5b) C:\Windows\system32\fdrespub.dll
16:31:52.0392 6580        FDResPub - ok
16:31:52.0431 6580        FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
16:31:52.0470 6580        FileInfo - ok
16:31:52.0508 6580        Filetrace      (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
16:31:52.0579 6580        Filetrace - ok
16:31:52.0637 6580        flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
16:31:52.0772 6580        flpydisk - ok
16:31:52.0819 6580        FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
16:31:52.0853 6580        FltMgr - ok
16:31:52.0981 6580        FontCache      (fa6c66e4364d7da57aade5dcc03bb999) C:\Windows\system32\FntCache.dll
16:31:53.0062 6580        FontCache - ok
16:31:53.0185 6580        FontCache3.0.0.0 (e56f39f6b7fda0ac77a79b0fd3de1a2f) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
16:31:53.0249 6580        FontCache3.0.0.0 - ok
16:31:53.0379 6580        Freemake Improver (f386bb621dd0f7ea2781f67c1c728771) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
16:31:53.0586 6580        Freemake Improver ( UnsignedFile.Multi.Generic ) - warning
16:31:53.0586 6580        Freemake Improver - detected UnsignedFile.Multi.Generic (1)
16:31:53.0670 6580        FsDepends      (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
16:31:53.0719 6580        FsDepends - ok
16:31:53.0787 6580        Fs_Rec          (7dae5ebcc80e45d3253f4923dc424d05) C:\Windows\system32\drivers\Fs_Rec.sys
16:31:53.0863 6580        Fs_Rec - ok
16:31:53.0969 6580        fvevol          (8a73e79089b282100b9393b644cb853b) C:\Windows\system32\DRIVERS\fvevol.sys
16:31:54.0019 6580        fvevol - ok
16:31:54.0089 6580        gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
16:31:54.0153 6580        gagp30kx - ok
16:31:54.0202 6580        GEARAspiWDM    (185ada973b5020655cee342059a86cbb) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
16:31:54.0256 6580        GEARAspiWDM - ok
16:31:54.0356 6580        gpsvc          (e897eaf5ed6ba41e081060c9b447a673) C:\Windows\System32\gpsvc.dll
16:31:54.0446 6580        gpsvc - ok
16:31:54.0579 6580        gupdate        (506708142bc63daba64f2d3ad1dcd5bf) C:\Program Files\Google\Update\GoogleUpdate.exe
16:31:54.0750 6580        gupdate - ok
16:31:54.0754 6580        gupdatem        (506708142bc63daba64f2d3ad1dcd5bf) C:\Program Files\Google\Update\GoogleUpdate.exe
16:31:54.0835 6580        gupdatem - ok
16:31:54.0914 6580        gzflt          (479664fa3e1bd3e0b828971a0d500d4e) C:\Windows\system32\DRIVERS\gzflt.sys
16:31:55.0118 6580        gzflt - ok
16:31:55.0187 6580        hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
16:31:55.0314 6580        hcw85cir - ok
16:31:55.0493 6580        HdAudAddService (a5ef29d5315111c80a5c1abad14c8972) C:\Windows\system32\drivers\HdAudio.sys
16:31:55.0582 6580        HdAudAddService - ok
16:31:55.0636 6580        HDAudBus        (9036377b8a6c15dc2eec53e489d159b5) C:\Windows\system32\drivers\HDAudBus.sys
16:31:55.0726 6580        HDAudBus - ok
16:31:55.0809 6580        HidBatt        (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
16:31:55.0872 6580        HidBatt - ok
16:31:55.0906 6580        HidBth          (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
16:31:55.0958 6580        HidBth - ok
16:31:55.0985 6580        HidIr          (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
16:31:56.0074 6580        HidIr - ok
16:31:56.0118 6580        hidserv        (2bc6f6a1992b3a77f5f41432ca6b3b6b) C:\Windows\system32\hidserv.dll
16:31:56.0253 6580        hidserv - ok
16:31:56.0328 6580        HidUsb          (10c19f8290891af023eaec0832e1eb4d) C:\Windows\system32\DRIVERS\hidusb.sys
16:31:56.0464 6580        HidUsb - ok
16:31:56.0505 6580        hkmsvc          (196b4e3f4cccc24af836ce58facbb699) C:\Windows\system32\kmsvc.dll
16:31:56.0572 6580        hkmsvc - ok
16:31:56.0613 6580        HomeGroupListener (6658f4404de03d75fe3ba09f7aba6a30) C:\Windows\system32\ListSvc.dll
16:31:56.0672 6580        HomeGroupListener - ok
16:31:56.0896 6580        HomeGroupProvider (dbc02d918fff1cad628acbe0c0eaa8e8) C:\Windows\system32\provsvc.dll
16:31:57.0042 6580        HomeGroupProvider - ok
16:31:57.0110 6580        HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\drivers\HpSAMD.sys
16:31:57.0154 6580        HpSAMD - ok
16:31:57.0272 6580        HPWMISVC        (2bec76bdcd1bc080210325e7b5094834) C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
16:31:57.0414 6580        HPWMISVC - ok
16:31:57.0531 6580        HTTP            (871917b07a141bff43d76d8844d48106) C:\Windows\system32\drivers\HTTP.sys
16:31:57.0650 6580        HTTP - ok
16:31:57.0692 6580        hwpolicy        (0c4e035c7f105f1299258c90886c64c5) C:\Windows\system32\drivers\hwpolicy.sys
16:31:57.0783 6580        hwpolicy - ok
16:31:57.0838 6580        i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys
16:31:57.0990 6580        i8042prt - ok
16:31:58.0063 6580        iaStor          (db81f413fa4e3f328cad7b5d59ef3f21) C:\Windows\system32\DRIVERS\iaStor.sys
16:31:58.0182 6580        iaStor - ok
16:31:58.0258 6580        IAStorDataMgrSvc (d41861e56e7552c13674d7f147a02464) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
16:31:58.0301 6580        IAStorDataMgrSvc - ok
16:31:58.0362 6580        iaStorV        (a3cae5d281db4cff7cff8233507ee5ad) C:\Windows\system32\drivers\iaStorV.sys
16:31:58.0482 6580        iaStorV - ok
16:31:58.0687 6580        IconMan_R      (e4693409d06785477a49fb34afae1b92) C:\Program Files\Realtek\Realtek PCIE Card Reader\RIconMan.exe
16:31:58.0856 6580        IconMan_R ( UnsignedFile.Multi.Generic ) - warning
16:31:58.0856 6580        IconMan_R - detected UnsignedFile.Multi.Generic (1)
16:31:59.0746 6580        idsvc          (c521d7eb6497bb1af6afa89e322fb43c) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
16:32:00.0248 6580        idsvc - ok
16:32:00.0933 6580        igfx            (8cc51204bce551b90b45e97be446c48b) C:\Windows\system32\DRIVERS\igdkmd32.sys
16:32:01.0418 6580        igfx - ok
16:32:02.0155 6580        iirsp          (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
16:32:02.0201 6580        iirsp - ok
16:32:02.0369 6580        IKEEXT          (f95622f161474511b8d80d6b093aa610) C:\Windows\System32\ikeext.dll
16:32:02.0477 6580        IKEEXT - ok
16:32:02.0568 6580        IntcDAud        (6a6e1b319a47fa7af2ae6b6815ae9854) C:\Windows\system32\DRIVERS\IntcDAud.sys
16:32:02.0677 6580        IntcDAud - ok
16:32:02.0807 6580        intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\drivers\intelide.sys
16:32:02.0863 6580        intelide - ok
16:32:02.0938 6580        intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
16:32:02.0999 6580        intelppm - ok
16:32:03.0108 6580        IPBusEnum      (acb364b9075a45c0736e5c47be5cae19) C:\Windows\system32\ipbusenum.dll
16:32:03.0177 6580        IPBusEnum - ok
16:32:03.0216 6580        IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
16:32:03.0302 6580        IpFilterDriver - ok
16:32:03.0441 6580        iphlpsvc        (4d65a07b795d6674312f879d09aa7663) C:\Windows\System32\iphlpsvc.dll
16:32:03.0634 6580        iphlpsvc - ok
16:32:03.0681 6580        IPMIDRV        (4bd7134618c1d2a27466a099062547bf) C:\Windows\system32\drivers\IPMIDrv.sys
16:32:03.0729 6580        IPMIDRV - ok
16:32:03.0791 6580        IPNAT          (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
16:32:03.0865 6580        IPNAT - ok
16:32:03.0976 6580        iPod Service    (ef1c51222117b37afbff8f4642ea8c62) C:\Program Files\iPod\bin\iPodService.exe
16:32:04.0055 6580        iPod Service - ok
16:32:04.0079 6580        IRENUM          (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
16:32:04.0173 6580        IRENUM - ok
16:32:04.0217 6580        isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\drivers\isapnp.sys
16:32:04.0282 6580        isapnp - ok
16:32:04.0336 6580        iScsiPrt        (cb7a9abb12b8415bce5d74994c7ba3ae) C:\Windows\system32\drivers\msiscsi.sys
16:32:04.0388 6580        iScsiPrt - ok
16:32:04.0422 6580        kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys
16:32:04.0475 6580        kbdclass - ok
16:32:04.0533 6580        kbdhid          (9e3ced91863e6ee98c24794d05e27a71) C:\Windows\system32\DRIVERS\kbdhid.sys
16:32:04.0587 6580        kbdhid - ok
16:32:04.0628 6580        KeyIso          (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
16:32:04.0652 6580        KeyIso - ok
16:32:04.0682 6580        KSecDD          (b7895b4182c0d16f6efadeb8081e8d36) C:\Windows\system32\Drivers\ksecdd.sys
16:32:04.0725 6580        KSecDD - ok
16:32:04.0753 6580        KSecPkg        (d30159ac9237519fbc62c6ec247d2d46) C:\Windows\system32\Drivers\ksecpkg.sys
16:32:04.0817 6580        KSecPkg - ok
16:32:04.0880 6580        KtmRm          (89a7b9cc98d0d80c6f31b91c0a310fcd) C:\Windows\system32\msdtckrm.dll
16:32:04.0987 6580        KtmRm - ok
16:32:05.0054 6580        LanmanServer    (d64af876d53eca3668bb97b51b4e70ab) C:\Windows\system32\srvsvc.dll
16:32:05.0163 6580        LanmanServer - ok
16:32:05.0215 6580        LanmanWorkstation (58405e4f68ba8e4057c6e914f326aba2) C:\Windows\System32\wkssvc.dll
16:32:05.0301 6580        LanmanWorkstation - ok
16:32:05.0351 6580        lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
16:32:05.0409 6580        lltdio - ok
16:32:05.0498 6580        lltdsvc        (5700673e13a2117fa3b9020c852c01e2) C:\Windows\System32\lltdsvc.dll
16:32:05.0593 6580        lltdsvc - ok
16:32:05.0606 6580        lmhosts        (55ca01ba19d0006c8f2639b6c045e08b) C:\Windows\System32\lmhsvc.dll
16:32:05.0658 6580        lmhosts - ok
16:32:05.0692 6580        LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
16:32:05.0741 6580        LSI_FC - ok
16:32:05.0918 6580        LSI_SAS        (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
16:32:06.0045 6580        LSI_SAS - ok
16:32:06.0083 6580        LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
16:32:06.0123 6580        LSI_SAS2 - ok
16:32:06.0179 6580        LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
16:32:06.0231 6580        LSI_SCSI - ok
16:32:06.0256 6580        luafv          (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
16:32:06.0352 6580        luafv - ok
16:32:06.0364 6580        massfilter - ok
16:32:06.0404 6580        Mcx2Svc        (bfb9ee8ee977efe85d1a3105abef6dd1) C:\Windows\system32\Mcx2Svc.dll
16:32:06.0434 6580        Mcx2Svc - ok
16:32:06.0467 6580        megasas        (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
16:32:06.0545 6580        megasas - ok
16:32:06.0581 6580        MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
16:32:06.0704 6580        MegaSR - ok
16:32:06.0750 6580        MEI            (d86ac00883b9c98b570e7643aaf8e554) C:\Windows\system32\DRIVERS\HECI.sys
16:32:06.0802 6580        MEI - ok
16:32:06.0855 6580        MEMSWEEP2 - ok
16:32:06.0908 6580        MMCSS          (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll
16:32:07.0000 6580        MMCSS - ok
16:32:07.0060 6580        Modem          (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
16:32:07.0117 6580        Modem - ok
16:32:07.0169 6580        monitor        (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
16:32:07.0231 6580        monitor - ok
16:32:07.0279 6580        mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys
16:32:07.0316 6580        mouclass - ok
16:32:07.0358 6580        mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
16:32:07.0393 6580        mouhid - ok
16:32:07.0442 6580        mountmgr        (fc8771f45ecccfd89684e38842539b9b) C:\Windows\system32\drivers\mountmgr.sys
16:32:07.0559 6580        mountmgr - ok
16:32:07.0643 6580        MozillaMaintenance (9c3758018ded02f4ae53cca1c5f084a2) C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
16:32:07.0695 6580        MozillaMaintenance - ok
16:32:07.0753 6580        mpio            (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\Windows\system32\drivers\mpio.sys
16:32:07.0868 6580        mpio - ok
16:32:07.0938 6580        mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
16:32:08.0045 6580        mpsdrv - ok
16:32:08.0125 6580        MpsSvc          (9835584e999d25004e1ee8e5f3e3b881) C:\Windows\system32\mpssvc.dll
16:32:08.0223 6580        MpsSvc - ok
16:32:08.0271 6580        MRxDAV          (ceb46ab7c01c9f825f8cc6babc18166a) C:\Windows\system32\drivers\mrxdav.sys
16:32:08.0327 6580        MRxDAV - ok
16:32:08.0385 6580        mrxsmb          (5d16c921e3671636c0eba3bbaac5fd25) C:\Windows\system32\DRIVERS\mrxsmb.sys
16:32:08.0453 6580        mrxsmb - ok
16:32:08.0493 6580        mrxsmb10        (6d17a4791aca19328c685d256349fefc) C:\Windows\system32\DRIVERS\mrxsmb10.sys
16:32:08.0604 6580        mrxsmb10 - ok
16:32:08.0628 6580        mrxsmb20        (b81f204d146000be76651a50670a5e9e) C:\Windows\system32\DRIVERS\mrxsmb20.sys
16:32:08.0703 6580        mrxsmb20 - ok
16:32:08.0756 6580        msahci          (012c5f4e9349e711e11e0f19a8589f0a) C:\Windows\system32\drivers\msahci.sys
16:32:08.0798 6580        msahci - ok
16:32:08.0843 6580        msdsm          (55055f8ad8be27a64c831322a780a228) C:\Windows\system32\drivers\msdsm.sys
16:32:08.0900 6580        msdsm - ok
16:32:08.0939 6580        MSDTC          (e1bce74a3bd9902b72599c0192a07e27) C:\Windows\System32\msdtc.exe
16:32:09.0055 6580        MSDTC - ok
16:32:09.0103 6580        Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
16:32:09.0158 6580        Msfs - ok
16:32:09.0216 6580        mshidkmdf      (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
16:32:09.0265 6580        mshidkmdf - ok
16:32:09.0309 6580        msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\drivers\msisadrv.sys
16:32:09.0384 6580        msisadrv - ok
16:32:09.0445 6580        MSiSCSI        (90f7d9e6b6f27e1a707d4a297f077828) C:\Windows\system32\iscsiexe.dll
16:32:09.0510 6580        MSiSCSI - ok
16:32:09.0521 6580        msiserver - ok
16:32:09.0573 6580        MSKSSRV        (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
16:32:09.0649 6580        MSKSSRV - ok
16:32:09.0669 6580        MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
16:32:09.0745 6580        MSPCLOCK - ok
16:32:09.0756 6580        MSPQM          (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
16:32:09.0810 6580        MSPQM - ok
16:32:09.0845 6580        MsRPC          (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
16:32:09.0914 6580        MsRPC - ok
16:32:09.0963 6580        mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\drivers\mssmbios.sys
16:32:10.0035 6580        mssmbios - ok
16:32:10.0088 6580        MSTEE          (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
16:32:10.0151 6580        MSTEE - ok
16:32:10.0190 6580        MTConfig        (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
16:32:10.0249 6580        MTConfig - ok
16:32:10.0274 6580        Mup            (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
16:32:10.0330 6580        Mup - ok
16:32:10.0409 6580        napagent        (61d57a5d7c6d9afe10e77dae6e1b445e) C:\Windows\system32\qagentRT.dll
16:32:10.0483 6580        napagent - ok
16:32:10.0525 6580        NativeWifiP    (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys
16:32:10.0649 6580        NativeWifiP - ok
16:32:11.0008 6580        NDIS            (e7c54812a2aaf43316eb6930c1ffa108) C:\Windows\system32\drivers\ndis.sys
16:32:11.0226 6580        NDIS - ok
16:32:11.0303 6580        NdisCap        (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys
16:32:11.0358 6580        NdisCap - ok
16:32:11.0378 6580        NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys
16:32:11.0431 6580        NdisTapi - ok
16:32:11.0626 6580        Ndisuio        (d8a65dafb3eb41cbb622745676fcd072) C:\Windows\system32\DRIVERS\ndisuio.sys
16:32:11.0680 6580        Ndisuio - ok
16:32:11.0872 6580        NdisWan        (38fbe267e7e6983311179230facb1017) C:\Windows\system32\DRIVERS\ndiswan.sys
16:32:11.0967 6580        NdisWan - ok
16:32:12.0070 6580        NDProxy        (a4bdc541e69674fbff1a8ff00be913f2) C:\Windows\system32\drivers\NDProxy.sys
16:32:12.0129 6580        NDProxy - ok
16:32:12.0215 6580        NetBIOS        (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys
16:32:12.0278 6580        NetBIOS - ok
16:32:12.0417 6580        NetBT          (280122ddcf04b378edd1ad54d71c1e54) C:\Windows\system32\DRIVERS\netbt.sys
16:32:12.0626 6580        NetBT - ok
16:32:12.0722 6580        Netlogon        (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
16:32:12.0745 6580        Netlogon - ok
16:32:12.0902 6580        Netman          (7cccfca7510684768da22092d1fa4db2) C:\Windows\System32\netman.dll
16:32:12.0962 6580        Netman - ok
16:32:13.0051 6580        netprofm        (8c338238c16777a802d6a9211eb2ba50) C:\Windows\System32\netprofm.dll
16:32:13.0170 6580        netprofm - ok
16:32:13.0373 6580        NetTcpPortSharing (f476ec40033cdb91efbe73eb99b8362d) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
16:32:13.0407 6580        NetTcpPortSharing - ok
16:32:13.0474 6580        nfrd960        (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys
16:32:13.0513 6580        nfrd960 - ok
16:32:13.0764 6580        NlaSvc          (912084381d30d8b89ec4e293053f4710) C:\Windows\System32\nlasvc.dll
16:32:13.0848 6580        NlaSvc - ok
16:32:13.0954 6580        npf            (b48dc6abcd3aeff8618350ccbdc6b09a) C:\Windows\system32\drivers\npf.sys
16:32:13.0993 6580        npf - ok
16:32:14.0146 6580        Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
16:32:14.0202 6580        Npfs - ok
16:32:14.0360 6580        nsi            (ba387e955e890c8a88306d9b8d06bf17) C:\Windows\system32\nsisvc.dll
16:32:14.0410 6580        nsi - ok
16:32:14.0489 6580        nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys
16:32:14.0564 6580        nsiproxy - ok
16:32:14.0716 6580        Ntfs            (33c3093d09017cfe2e219f2472bff6eb) C:\Windows\system32\drivers\Ntfs.sys
16:32:14.0843 6580        Ntfs - ok
16:32:17.0467 6580        Null            (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
16:32:17.0528 6580        Null - ok
16:32:17.0633 6580        nvraid          (af2eec9580c1d32fb7eaf105d9784061) C:\Windows\system32\drivers\nvraid.sys
16:32:17.0749 6580        nvraid - ok
16:32:17.0810 6580        nvstor          (9283c58ebaa2618f93482eb5dabcec82) C:\Windows\system32\drivers\nvstor.sys
16:32:17.0899 6580        nvstor - ok
16:32:17.0937 6580        nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\drivers\nv_agp.sys
16:32:18.0004 6580        nv_agp - ok
16:32:18.0062 6580        ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\drivers\ohci1394.sys
16:32:18.0099 6580        ohci1394 - ok
16:32:18.0171 6580        p2pimsvc        (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll
16:32:18.0248 6580        p2pimsvc - ok
16:32:18.0300 6580        p2psvc          (59c3ddd501e39e006dac31bf55150d91) C:\Windows\system32\p2psvc.dll
16:32:18.0353 6580        p2psvc - ok
16:32:18.0397 6580        Parport        (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
16:32:18.0435 6580        Parport - ok
16:32:18.0510 6580        partmgr        (3f34a1b4c5f6475f320c275e63afce9b) C:\Windows\system32\drivers\partmgr.sys
16:32:18.0548 6580        partmgr - ok
16:32:18.0574 6580        Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
16:32:18.0642 6580        Parvdm - ok
16:32:18.0679 6580        PcaSvc          (358ab7956d3160000726574083dfc8a6) C:\Windows\System32\pcasvc.dll
16:32:18.0727 6580        PcaSvc - ok
16:32:18.0776 6580        pci            (673e55c3498eb970088e812ea820aa8f) C:\Windows\system32\drivers\pci.sys
16:32:18.0827 6580        pci - ok
16:32:18.0845 6580        pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\drivers\pciide.sys
16:32:18.0930 6580        pciide - ok
16:32:18.0973 6580        pcmcia          (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
16:32:19.0061 6580        pcmcia - ok
16:32:19.0088 6580        pcw            (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
16:32:19.0137 6580        pcw - ok
16:32:19.0250 6580        PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
16:32:19.0343 6580        PEAUTH - ok
16:32:19.0473 6580        PeerDistSvc    (af4d64d2a57b9772cf3801950b8058a6) C:\Windows\system32\peerdistsvc.dll
16:32:19.0559 6580        PeerDistSvc - ok
16:32:19.0776 6580        pla            (414bba67a3ded1d28437eb66aeb8a720) C:\Windows\system32\pla.dll
16:32:19.0912 6580        pla - ok
16:32:20.0837 6580        PlugPlay        (ec7bc28d207da09e79b3e9faf8b232ca) C:\Windows\system32\umpnpmgr.dll
16:32:20.0955 6580        PlugPlay - ok
16:32:21.0009 6580        PNRPAutoReg    (63ff8572611249931eb16bb8eed6afc8) C:\Windows\system32\pnrpauto.dll
16:32:21.0057 6580        PNRPAutoReg - ok
16:32:21.0229 6580        PNRPsvc        (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll
16:32:21.0286 6580        PNRPsvc - ok
16:32:21.0372 6580        PolicyAgent    (53946b69ba0836bd95b03759530c81ec) C:\Windows\System32\ipsecsvc.dll
16:32:21.0465 6580        PolicyAgent - ok
16:32:21.0556 6580        Power          (f87d30e72e03d579a5199ccb3831d6ea) C:\Windows\system32\umpo.dll
16:32:21.0686 6580        Power - ok
16:32:21.0801 6580        PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys
16:32:21.0868 6580        PptpMiniport - ok
16:32:21.0897 6580        Processor      (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
16:32:21.0957 6580        Processor - ok
16:32:22.0027 6580        ProfSvc        (43ca4ccc22d52fb58e8988f0198851d0) C:\Windows\system32\profsvc.dll
16:32:22.0141 6580        ProfSvc - ok
16:32:22.0175 6580        ProtectedStorage (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
16:32:22.0203 6580        ProtectedStorage - ok
16:32:22.0301 6580        Psched          (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
16:32:22.0431 6580        Psched - ok
16:32:22.0575 6580        ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
16:32:22.0760 6580        ql2300 - ok
16:32:23.0188 6580        ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
16:32:23.0256 6580        ql40xx - ok
16:32:23.0362 6580        QWAVE          (31ac809e7707eb580b2bdb760390765a) C:\Windows\system32\qwave.dll
16:32:23.0429 6580        QWAVE - ok
16:32:23.0460 6580        QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
16:32:23.0528 6580        QWAVEdrv - ok
16:32:23.0566 6580        RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys
16:32:23.0643 6580        RasAcd - ok
16:32:23.0796 6580        RasAgileVpn    (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
16:32:23.0866 6580        RasAgileVpn - ok
16:32:24.0383 6580        RasAuto        (a60f1839849c0c00739787fd5ec03f13) C:\Windows\System32\rasauto.dll
16:32:24.0441 6580        RasAuto - ok
16:32:24.0726 6580        Rasl2tp        (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys
16:32:24.0797 6580        Rasl2tp - ok
16:32:25.0485 6580        RasMan          (cb9e04dc05eacf5b9a36ca276d475006) C:\Windows\System32\rasmans.dll
16:32:25.0600 6580        RasMan - ok
16:32:25.0920 6580        RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys
16:32:26.0019 6580        RasPppoe - ok
16:32:26.0066 6580        RasSstp        (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys
16:32:26.0152 6580        RasSstp - ok
16:32:26.0383 6580        rdbss          (d528bc58a489409ba40334ebf96a311b) C:\Windows\system32\DRIVERS\rdbss.sys
16:32:26.0508 6580        rdbss - ok
16:32:26.0600 6580        rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys
16:32:26.0703 6580        rdpbus - ok
16:32:26.0770 6580        RDPCDD          (23dae03f29d253ae74c44f99e515f9a1) C:\Windows\system32\DRIVERS\RDPCDD.sys
16:32:26.0844 6580        RDPCDD - ok
16:32:26.0899 6580        RDPDR          (b973fcfc50dc1434e1970a146f7e3885) C:\Windows\system32\drivers\rdpdr.sys
16:32:26.0981 6580        RDPDR - ok
16:32:27.0029 6580        RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys
16:32:27.0150 6580        RDPENCDD - ok
16:32:27.0202 6580        RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys
16:32:27.0251 6580        RDPREFMP - ok
16:32:27.0318 6580        RdpVideoMiniport (68a0387f58e226deee23d9715955572a) C:\Windows\system32\drivers\rdpvideominiport.sys
16:32:27.0377 6580        RdpVideoMiniport - ok
16:32:27.0467 6580        RDPWD          (f031683e6d1fea157abb2ff260b51e61) C:\Windows\system32\drivers\RDPWD.sys
16:32:27.0555 6580        RDPWD - ok
16:32:27.0672 6580        rdyboost        (518395321dc96fe2c9f0e96ac743b656) C:\Windows\system32\drivers\rdyboost.sys
16:32:27.0721 6580        rdyboost - ok
16:32:27.0784 6580        RemoteAccess    (7b5e1419717fac363a31cc302895217a) C:\Windows\System32\mprdim.dll
16:32:27.0854 6580        RemoteAccess - ok
16:32:27.0892 6580        RemoteRegistry  (cb9a8683f4ef2bf99e123d79950d7935) C:\Windows\system32\regsvc.dll
16:32:27.0992 6580        RemoteRegistry - ok
16:32:28.0542 6580        RFCOMM          (cb928d9e6daf51879dd6ba8d02f01321) C:\Windows\system32\DRIVERS\rfcomm.sys
16:32:28.0692 6580        RFCOMM - ok
16:32:28.0915 6580        RpcEptMapper    (78d072f35bc45d9e4e1b61895c152234) C:\Windows\System32\RpcEpMap.dll
16:32:29.0045 6580        RpcEptMapper - ok
16:32:29.0161 6580        RpcLocator      (94d36c0e44677dd26981d2bfeef2a29d) C:\Windows\system32\locator.exe
16:32:29.0193 6580        RpcLocator - ok
16:32:29.0865 6580        RpcSs          (7660f01d3b38aca1747e397d21d790af) C:\Windows\system32\rpcss.dll
16:32:29.0921 6580        RpcSs - ok
16:32:30.0218 6580        RSPCIESTOR      (4ada96cdedca3ca8dd70f51575f6a7af) C:\Windows\system32\DRIVERS\RtsPStor.sys
16:32:30.0310 6580        RSPCIESTOR - ok
16:32:30.0359 6580        rspndr          (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys
16:32:30.0436 6580        rspndr - ok
16:32:30.0683 6580        RTL2832UBDA    (0085adfe591291b219badf2d3ebd0beb) C:\Windows\system32\drivers\RTL2832UBDA.sys
16:32:30.0751 6580        RTL2832UBDA - ok
16:32:30.0786 6580        RTL2832UUSB    (653347dbf9ce61b104f237d7b2b33ccf) C:\Windows\system32\Drivers\RTL2832UUSB.sys
16:32:30.0827 6580        RTL2832UUSB - ok
16:32:30.0857 6580        RTL2832U_IRHID  (13ab7ec17c94acfe93f96ec96bd6b05d) C:\Windows\system32\DRIVERS\RTL2832U_IRHID.sys
16:32:30.0921 6580        RTL2832U_IRHID - ok
16:32:30.0988 6580        RTL8167        (fb3ca58c5447432b8e10c0df3d4d2a1b) C:\Windows\system32\DRIVERS\Rt86win7.sys
16:32:31.0065 6580        RTL8167 - ok
16:32:31.0098 6580        s3cap          (7fa7f2e249a5dcbb7970630e15e1f482) C:\Windows\system32\drivers\vms3cap.sys
16:32:31.0222 6580        s3cap - ok
16:32:31.0280 6580        SamSs          (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
16:32:31.0312 6580        SamSs - ok
16:32:31.0366 6580        sbp2port        (05d860da1040f111503ac416ccef2bca) C:\Windows\system32\drivers\sbp2port.sys
16:32:31.0442 6580        sbp2port - ok
16:32:31.0476 6580        SCardSvr        (8fc518ffe9519c2631d37515a68009c4) C:\Windows\System32\SCardSvr.dll
16:32:31.0566 6580        SCardSvr - ok
16:32:31.0630 6580        scfilter        (0693b5ec673e34dc147e195779a4dcf6) C:\Windows\system32\DRIVERS\scfilter.sys
16:32:31.0696 6580        scfilter - ok
16:32:31.0782 6580        Schedule        (a04bb13f8a72f8b6e8b4071723e4e336) C:\Windows\system32\schedsvc.dll
16:32:31.0866 6580        Schedule - ok
16:32:31.0901 6580        SCPolicySvc    (319c6b309773d063541d01df8ac6f55f) C:\Windows\System32\certprop.dll
16:32:31.0952 6580        SCPolicySvc - ok
16:32:32.0051 6580        SDRSVC          (08236c4bce5edd0a0318a438af28e0f7) C:\Windows\System32\SDRSVC.dll
16:32:32.0116 6580        SDRSVC - ok
16:32:32.0191 6580        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
16:32:32.0282 6580        secdrv - ok
16:32:32.0350 6580        seclogon        (a59b3a4442c52060cc7a85293aa3546f) C:\Windows\system32\seclogon.dll
16:32:32.0396 6580        seclogon - ok
16:32:32.0485 6580        SENS            (dcb7fcdcc97f87360f75d77425b81737) C:\Windows\System32\sens.dll
16:32:32.0533 6580        SENS - ok
16:32:32.0615 6580        SensrSvc        (50087fe1ee447009c9cc2997b90de53f) C:\Windows\system32\sensrsvc.dll
16:32:32.0676 6580        SensrSvc - ok
16:32:32.0698 6580        Serenum        (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
16:32:32.0743 6580        Serenum - ok
16:32:32.0785 6580        Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
16:32:33.0035 6580        Serial - ok
16:32:33.0160 6580        sermouse        (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
16:32:33.0198 6580        sermouse - ok
16:32:33.0267 6580        SessionEnv      (4ae380f39a0032eab7dd953030b26d28) C:\Windows\system32\sessenv.dll
16:32:33.0333 6580        SessionEnv - ok
16:32:33.0391 6580        sffdisk        (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\drivers\sffdisk.sys
16:32:33.0426 6580        sffdisk - ok
16:32:33.0460 6580        sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\drivers\sffp_mmc.sys
16:32:33.0496 6580        sffp_mmc - ok
16:32:33.0530 6580        sffp_sd        (6d4ccaedc018f1cf52866bbbaa235982) C:\Windows\system32\drivers\sffp_sd.sys
16:32:33.0567 6580        sffp_sd - ok
16:32:33.0629 6580        sfloppy        (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
16:32:33.0684 6580        sfloppy - ok
16:32:34.0013 6580        SharedAccess    (d1a079a0de2ea524513b6930c24527a2) C:\Windows\System32\ipnathlp.dll
16:32:34.0152 6580        SharedAccess - ok
16:32:34.0307 6580        ShellHWDetection (414da952a35bf5d50192e28263b40577) C:\Windows\System32\shsvcs.dll
16:32:34.0378 6580        ShellHWDetection - ok
16:32:34.0513 6580        sisagp          (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\drivers\sisagp.sys
16:32:34.0554 6580        sisagp - ok
16:32:34.0595 6580        SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
16:32:34.0631 6580        SiSRaid2 - ok
16:32:34.0699 6580        SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
16:32:34.0760 6580        SiSRaid4 - ok
16:32:35.0376 6580        Skype C2C Service (388ae59fe75f1b959dfa0900923c61bb) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
16:32:35.0568 6580        Skype C2C Service - ok
16:32:35.0814 6580        SkypeUpdate    (a4fab5f7818a69da6e740943cb8f7ca9) C:\Program Files\Skype\Updater\Updater.exe
16:32:35.0947 6580        SkypeUpdate - ok
16:32:36.0370 6580        Smb            (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
16:32:36.0429 6580        Smb - ok
16:32:36.0554 6580        SNMPTRAP        (6a984831644eca1a33ffeae4126f4f37) C:\Windows\System32\snmptrap.exe
16:32:36.0614 6580        SNMPTRAP - ok
16:32:36.0728 6580        spldr          (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
16:32:36.0761 6580        spldr - ok
16:32:37.0005 6580        Spooler        (866a43013535dc8587c258e43579c764) C:\Windows\System32\spoolsv.exe
16:32:37.0130 6580        Spooler - ok
16:32:37.0661 6580        sppsvc          (cf87a1de791347e75b98885214ced2b8) C:\Windows\system32\sppsvc.exe
16:32:37.0908 6580        sppsvc - ok
16:32:38.0382 6580        sppuinotify    (b0180b20b065d89232a78a40fe56eaa6) C:\Windows\system32\sppuinotify.dll
16:32:38.0439 6580        sppuinotify - ok
16:32:39.0082 6580        srv            (e4c2764065d66ea1d2d3ebc28fe99c46) C:\Windows\system32\DRIVERS\srv.sys
16:32:39.0264 6580        srv - ok
16:32:39.0659 6580        srv2            (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\Windows\system32\DRIVERS\srv2.sys
16:32:39.0750 6580        srv2 - ok
16:32:40.0198 6580        srvnet          (be6bd660caa6f291ae06a718a4fa8abc) C:\Windows\system32\DRIVERS\srvnet.sys
16:32:40.0303 6580        srvnet - ok
16:32:40.0789 6580        SSDPSRV        (d887c9fd02ac9fa880f6e5027a43e118) C:\Windows\System32\ssdpsrv.dll
16:32:40.0862 6580        SSDPSRV - ok
16:32:40.0975 6580        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
16:32:41.0010 6580        ssmdrv - ok
16:32:41.0454 6580        SstpSvc        (d318f23be45d5e3a107469eb64815b50) C:\Windows\system32\sstpsvc.dll
16:32:41.0559 6580        SstpSvc - ok
16:32:41.0696 6580        stexstor        (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
16:32:41.0729 6580        stexstor - ok
16:32:42.0005 6580        StiSvc          (e1fb3706030fb4578a0d72c2fc3689e4) C:\Windows\System32\wiaservc.dll
16:32:42.0083 6580        StiSvc - ok
16:32:42.0176 6580        storflt        (472af0311073dceceaa8fa18ba2bdf89) C:\Windows\system32\drivers\vmstorfl.sys
16:32:42.0214 6580        storflt - ok
16:32:42.0403 6580        storvsc        (dcaffd62259e0bdb433dd67b5bb37619) C:\Windows\system32\drivers\storvsc.sys
16:32:42.0438 6580        storvsc - ok
16:32:42.0483 6580        swenum          (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\drivers\swenum.sys
16:32:42.0517 6580        swenum - ok
16:32:42.0631 6580        swprv          (a28bd92df340e57b024ba433165d34d7) C:\Windows\System32\swprv.dll
16:32:42.0782 6580        swprv - ok
16:32:42.0819 6580        Synth3dVsc - ok
16:32:43.0224 6580        SynTP          (6dd49e1a5fa0f01824652f1a0a8866fb) C:\Windows\system32\DRIVERS\SynTP.sys
16:32:43.0386 6580        SynTP - ok
16:32:43.0755 6580        SysMain        (36650d618ca34c9d357dfd3d89b2c56f) C:\Windows\system32\sysmain.dll
16:32:43.0886 6580        SysMain - ok
16:32:43.0986 6580        TabletInputService (763fecdc3d30c815fe72dd57936c6cd1) C:\Windows\System32\TabSvc.dll
16:32:44.0031 6580        TabletInputService - ok
16:32:44.0157 6580        TapiSrv        (613bf4820361543956909043a265c6ac) C:\Windows\System32\tapisrv.dll
16:32:44.0215 6580        TapiSrv - ok
16:32:44.0285 6580        TBS            (b799d9fdb26111737f58288d8dc172d9) C:\Windows\System32\tbssvc.dll
16:32:44.0340 6580        TBS - ok
16:32:44.0563 6580        Tcpip          (a5ebb8f648000e88b7d9390b514976bf) C:\Windows\system32\drivers\tcpip.sys
16:32:45.0138 6580        Tcpip - ok
16:32:45.0849 6580        TCPIP6          (a5ebb8f648000e88b7d9390b514976bf) C:\Windows\system32\DRIVERS\tcpip.sys
16:32:45.0950 6580        TCPIP6 - ok
16:32:46.0989 6580        tcpipreg        (cca24162e055c3714ce5a88b100c64ed) C:\Windows\system32\drivers\tcpipreg.sys
16:32:47.0058 6580        tcpipreg - ok
16:32:47.0178 6580        TDPIPE          (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\Windows\system32\drivers\tdpipe.sys
16:32:47.0286 6580        TDPIPE - ok
16:32:47.0392 6580        TDTCP          (2c2c5afe7ee4f620d69c23c0617651a8) C:\Windows\system32\drivers\tdtcp.sys
16:32:47.0446 6580        TDTCP - ok
16:32:47.0729 6580        tdx            (b459575348c20e8121d6039da063c704) C:\Windows\system32\DRIVERS\tdx.sys
16:32:47.0864 6580        tdx - ok
16:32:48.0012 6580        TermDD          (04dbf4b01ea4bf25a9a3e84affac9b20) C:\Windows\system32\drivers\termdd.sys
16:32:48.0062 6580        TermDD - ok
16:32:48.0711 6580        TermService    (382c804c92811be57829d8e550a900e2) C:\Windows\System32\termsrv.dll
16:32:48.0809 6580        TermService - ok
16:32:49.0029 6580        Themes          (42fb6afd6b79d9fe07381609172e7ca4) C:\Windows\system32\themeservice.dll
16:32:49.0071 6580        Themes - ok
16:32:49.0146 6580        THREADORDER    (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll
16:32:49.0190 6580        THREADORDER - ok
16:32:49.0294 6580        TrkWks          (4792c0378db99a9bc2ae2de6cfff0c3a) C:\Windows\System32\trkwks.dll
16:32:49.0342 6580        TrkWks - ok
16:32:49.0500 6580        trufos          (f2aee22231046cad8d2f94d2c0f9befb) C:\Windows\system32\DRIVERS\trufos.sys
16:32:49.0560 6580        trufos - ok
16:32:50.0118 6580        TrustedInstaller (2c49b175aee1d4364b91b531417fe583) C:\Windows\servicing\TrustedInstaller.exe
16:32:50.0238 6580        TrustedInstaller - ok
16:32:50.0301 6580        tssecsrv        (254bb140eee3c59d6114c1a86b636877) C:\Windows\system32\DRIVERS\tssecsrv.sys
16:32:50.0353 6580        tssecsrv - ok
16:32:50.0680 6580        TsUsbFlt        (fd1d6c73e6333be727cbcc6054247654) C:\Windows\system32\drivers\tsusbflt.sys
16:32:50.0777 6580        TsUsbFlt - ok
16:32:50.0785 6580        tsusbhub - ok
16:32:51.0198 6580        tunnel          (b2fa25d9b17a68bb93d58b0556e8c90d) C:\Windows\system32\DRIVERS\tunnel.sys
16:32:51.0271 6580        tunnel - ok
16:32:51.0358 6580        uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
16:32:51.0394 6580        uagp35 - ok
16:32:52.0035 6580        udfs            (ee43346c7e4b5e63e54f927babbb32ff) C:\Windows\system32\DRIVERS\udfs.sys
16:32:52.0153 6580        udfs - ok
16:32:52.0303 6580        UI0Detect      (8344fd4fce927880aa1aa7681d4927e5) C:\Windows\system32\UI0Detect.exe
16:32:52.0623 6580        UI0Detect - ok
16:32:52.0845 6580        uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\drivers\uliagpkx.sys
16:32:52.0905 6580        uliagpkx - ok
16:32:53.0019 6580        umbus          (d295bed4b898f0fd999fcfa9b32b071b) C:\Windows\system32\DRIVERS\umbus.sys
16:32:53.0071 6580        umbus - ok
16:32:53.0178 6580        UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
16:32:53.0210 6580        UmPass - ok
16:32:53.0341 6580        UmRdpService    (409994a8eaceee4e328749c0353527a0) C:\Windows\System32\umrdp.dll
16:32:53.0373 6580        UmRdpService - ok
16:32:53.0659 6580        UPDATESRV      (32be9dff9a8dfe2eaca30e0a63c523ae) C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe
16:32:53.0701 6580        UPDATESRV - ok
16:32:54.0205 6580        upnphost        (833fbb672460efce8011d262175fad33) C:\Windows\System32\upnphost.dll
16:32:54.0295 6580        upnphost - ok
16:32:54.0756 6580        usbccgp        (7e72e7d7e0757d59481d530fd2b0bfae) C:\Windows\system32\DRIVERS\usbccgp.sys
16:32:54.0868 6580        usbccgp - ok
16:32:55.0077 6580        usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\drivers\usbcir.sys
16:32:55.0118 6580        usbcir - ok
16:32:55.0324 6580        usbehci        (cfbce999c057d78979a181c9c60f208e) C:\Windows\system32\drivers\usbehci.sys
16:32:55.0359 6580        usbehci - ok
16:32:55.0415 6580        usbhub          (9d22aad9ac6a07c691a1113e5f860868) C:\Windows\system32\drivers\usbhub.sys
16:32:55.0576 6580        usbhub - ok
16:32:55.0692 6580        usbohci        (a6fb7957ea7afb1165991e54ce934b74) C:\Windows\system32\drivers\usbohci.sys
16:32:55.0784 6580        usbohci - ok
16:32:55.0883 6580        usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
16:32:55.0941 6580        usbprint - ok
16:32:56.0022 6580        usbscan        (576096ccbc07e7c4ea4f5e6686d6888f) C:\Windows\system32\DRIVERS\usbscan.sys
16:32:56.0060 6580        usbscan - ok
16:32:56.0199 6580        USBSTOR        (bf63ebfc6979fefb2bc03df7989a0c1a) C:\Windows\system32\DRIVERS\USBSTOR.SYS
16:32:56.0242 6580        USBSTOR - ok
16:32:56.0278 6580        usbuhci        (78780c3ebce17405b1ccd07a3a8a7d72) C:\Windows\system32\drivers\usbuhci.sys
16:32:56.0309 6580        usbuhci - ok
16:32:56.0350 6580        usbvideo        (45f4e7bf43db40a6c6b4d92c76cbc3f2) C:\Windows\System32\Drivers\usbvideo.sys
16:32:56.0392 6580        usbvideo - ok
16:32:56.0577 6580        UxSms          (081e6e1c91aec36758902a9f727cd23c) C:\Windows\System32\uxsms.dll
16:32:56.0639 6580        UxSms - ok
16:32:56.0754 6580        VaultSvc        (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
16:32:56.0778 6580        VaultSvc - ok
16:32:56.0921 6580        vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\drivers\vdrvroot.sys
16:32:56.0980 6580        vdrvroot - ok
16:32:57.0682 6580        vds            (c3cd30495687c2a2f66a65ca6fd89be9) C:\Windows\System32\vds.exe
16:32:57.0857 6580        vds - ok
16:32:57.0953 6580        vga            (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
16:32:58.0003 6580        vga - ok
16:32:58.0056 6580        VgaSave        (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
16:32:58.0110 6580        VgaSave - ok
16:32:58.0123 6580        VGPU - ok
16:32:58.0394 6580        vhdmp          (5461686cca2fda57b024547733ab42e3) C:\Windows\system32\drivers\vhdmp.sys
16:32:58.0544 6580        vhdmp - ok
16:32:58.0732 6580        viaagp          (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\drivers\viaagp.sys
16:32:58.0776 6580        viaagp - ok
16:32:58.0841 6580        ViaC7          (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
16:32:59.0008 6580        ViaC7 - ok
16:32:59.0146 6580        viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\drivers\viaide.sys
16:32:59.0187 6580        viaide - ok
16:32:59.0348 6580        vmbus          (c2f2911156fdc7817c52829c86da494e) C:\Windows\system32\drivers\vmbus.sys
16:32:59.0449 6580        vmbus - ok
16:32:59.0513 6580        VMBusHID        (d4d77455211e204f370d08f4963063ce) C:\Windows\system32\drivers\VMBusHID.sys
16:32:59.0547 6580        VMBusHID - ok
16:32:59.0655 6580        volmgr          (4c63e00f2f4b5f86ab48a58cd990f212) C:\Windows\system32\drivers\volmgr.sys
16:32:59.0701 6580        volmgr - ok
16:32:59.0827 6580        volmgrx        (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
16:32:59.0915 6580        volmgrx - ok
16:33:00.0341 6580        volsnap        (f497f67932c6fa693d7de2780631cfe7) C:\Windows\system32\drivers\volsnap.sys
16:33:00.0483 6580        volsnap - ok
16:33:00.0761 6580        vsmraid        (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
16:33:00.0840 6580        vsmraid - ok
16:33:01.0197 6580        VSS            (209a3b1901b83aeb8527ed211cce9e4c) C:\Windows\system32\vssvc.exe
16:33:01.0509 6580        VSS - ok
16:33:02.0207 6580        VSSERV          (9e4307e413fe90098ac21cc7b9de4146) C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe
16:33:02.0318 6580        VSSERV - ok
16:33:02.0625 6580        vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\system32\DRIVERS\vwifibus.sys
16:33:02.0664 6580        vwifibus - ok
16:33:02.0855 6580        vwififlt        (7090d3436eeb4e7da3373090a23448f7) C:\Windows\system32\DRIVERS\vwififlt.sys
16:33:03.0085 6580        vwififlt - ok
16:33:03.0189 6580        vwifimp        (a3f04cbea6c2a10e6cb01f8b47611882) C:\Windows\system32\DRIVERS\vwifimp.sys
16:33:03.0261 6580        vwifimp - ok
16:33:03.0466 6580        W32Time        (55187fd710e27d5095d10a472c8baf1c) C:\Windows\system32\w32time.dll
16:33:03.0566 6580        W32Time - ok
16:33:03.0597 6580        WacomPen        (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
16:33:03.0767 6580        WacomPen - ok
16:33:04.0070 6580        WANARP          (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
16:33:04.0191 6580        WANARP - ok
16:33:04.0202 6580        Wanarpv6        (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
16:33:04.0275 6580        Wanarpv6 - ok
16:33:04.0414 6580        WatAdminSvc - ok
16:33:04.0986 6580        wbengine        (691e3285e53dca558e1a84667f13e15a) C:\Windows\system32\wbengine.exe
16:33:05.0290 6580        wbengine - ok
16:33:05.0545 6580        WbioSrvc        (9614b5d29dc76ac3c29f6d2d3aa70e67) C:\Windows\System32\wbiosrvc.dll
16:33:05.0586 6580        WbioSrvc - ok
16:33:06.0857 6580        wcncsvc        (34eee0dfaadb4f691d6d5308a51315dc) C:\Windows\System32\wcncsvc.dll
16:33:06.0949 6580        wcncsvc - ok
16:33:07.0052 6580        WcsPlugInService (5d930b6357a6d2af4d7653bdabbf352f) C:\Windows\System32\WcsPlugInService.dll
16:33:07.0107 6580        WcsPlugInService - ok
16:33:07.0476 6580        Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
16:33:07.0510 6580        Wd - ok
16:33:08.0561 6580        Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
16:33:08.0891 6580        Wdf01000 - ok
16:33:09.0204 6580        WdiServiceHost  (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll
16:33:10.0052 6580        WdiServiceHost - ok
16:33:10.0060 6580        WdiSystemHost  (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll
16:33:10.0090 6580        WdiSystemHost - ok
16:33:10.0252 6580        WebClient      (a9d880f97530d5b8fee278923349929d) C:\Windows\System32\webclnt.dll
16:33:10.0319 6580        WebClient - ok
16:33:10.0690 6580        Wecsvc          (760f0afe937a77cff27153206534f275) C:\Windows\system32\wecsvc.dll
16:33:10.0763 6580        Wecsvc - ok
16:33:11.0052 6580        wercplsupport  (ac804569bb2364fb6017370258a4091b) C:\Windows\System32\wercplsupport.dll
16:33:11.0176 6580        wercplsupport - ok
16:33:11.0395 6580        WerSvc          (08e420d873e4fd85241ee2421b02c4a4) C:\Windows\System32\WerSvc.dll
16:33:11.0499 6580        WerSvc - ok
16:33:11.0538 6580        WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
16:33:11.0593 6580        WfpLwf - ok
16:33:11.0672 6580        WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
16:33:11.0709 6580        WIMMount - ok
16:33:12.0104 6580        WinDefend      (3fae8f94296001c32eab62cd7d82e0fd) C:\Program Files\Windows Defender\mpsvc.dll
16:33:12.0156 6580        WinDefend - ok
16:33:12.0170 6580        WinHttpAutoProxySvc - ok
16:33:13.0192 6580        Winmgmt        (f62e510b6ad4c21eb9fe8668ed251826) C:\Windows\system32\wbem\WMIsvc.dll
16:33:13.0287 6580        Winmgmt - ok
16:33:14.0818 6580        WinRM          (1b91cd34ea3a90ab6a4ef0550174f4cc) C:\Windows\system32\WsmSvc.dll
16:33:14.0925 6580        WinRM - ok
16:33:15.0479 6580        WinUsb          (a67e5f9a400f3bd1be3d80613b45f708) C:\Windows\system32\DRIVERS\WinUsb.sys
16:33:15.0552 6580        WinUsb - ok
16:33:15.0678 6580        Wlansvc        (16935c98ff639d185086a3529b1f2067) C:\Windows\System32\wlansvc.dll
16:33:15.0909 6580        Wlansvc - ok
16:33:16.0021 6580        WmiAcpi        (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\drivers\wmiacpi.sys
16:33:16.0055 6580        WmiAcpi - ok
16:33:16.0502 6580        wmiApSrv        (6eb6b66517b048d87dc1856ddf1f4c3f) C:\Windows\system32\wbem\WmiApSrv.exe
16:33:16.0824 6580        wmiApSrv - ok
16:33:17.0195 6580        WMPNetworkSvc  (3b40d3a61aa8c21b88ae57c58ab3122e) C:\Program Files\Windows Media Player\wmpnetwk.exe
16:33:17.0714 6580        WMPNetworkSvc - ok
16:33:18.0172 6580        WPCSvc          (a2f0ec770a92f2b3f9de6d518e11409c) C:\Windows\System32\wpcsvc.dll
16:33:18.0368 6580        WPCSvc - ok
16:33:18.0556 6580        WPDBusEnum      (aa53356d60af47eacc85bc617a4f3f66) C:\Windows\system32\wpdbusenum.dll
16:33:18.0829 6580        WPDBusEnum - ok
16:33:19.0181 6580        ws2ifsl        (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
16:33:19.0265 6580        ws2ifsl - ok
16:33:19.0419 6580        wscsvc          (6f5d49efe0e7164e03ae773a3fe25340) C:\Windows\System32\wscsvc.dll
16:33:19.0778 6580        wscsvc - ok
16:33:19.0885 6580        WSearch - ok
16:33:20.0303 6580        wuauserv        (fc3ec24fce372c89423e015a2ac1a31e) C:\Windows\system32\wuaueng.dll
16:33:20.0422 6580        wuauserv - ok
16:33:21.0153 6580        WudfPf          (e714a1c0354636837e20ccbf00888ee7) C:\Windows\system32\drivers\WudfPf.sys
16:33:21.0230 6580        WudfPf - ok
16:33:21.0323 6580        WUDFRd          (1023ee888c9b47178c5293ed5336ab69) C:\Windows\system32\DRIVERS\WUDFRd.sys
16:33:21.0394 6580        WUDFRd - ok
16:33:21.0650 6580        wudfsvc        (8d1e1e529a2c9e9b6a85b55a345f7629) C:\Windows\System32\WUDFSvc.dll
16:33:21.0769 6580        wudfsvc - ok
16:33:21.0973 6580        WwanSvc        (ff2d745b560f7c71b31f30f4d49f73d2) C:\Windows\System32\wwansvc.dll
16:33:22.0023 6580        WwanSvc - ok
16:33:22.0048 6580        ZTEusbmdm6k - ok
16:33:22.0062 6580        ZTEusbnmea - ok
16:33:22.0073 6580        ZTEusbser6k - ok
16:33:22.0153 6580        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
16:33:34.0077 6580        \Device\Harddisk0\DR0 - ok
16:33:34.0139 6580        Boot (0x1200)  (54ba4c37d203c2b279e01a9f91269268) \Device\Harddisk0\DR0\Partition0
16:33:34.0142 6580        \Device\Harddisk0\DR0\Partition0 - ok
16:33:34.0198 6580        Boot (0x1200)  (ec5907c4c3860910eb67263b34c7422c) \Device\Harddisk0\DR0\Partition1
16:33:34.0200 6580        \Device\Harddisk0\DR0\Partition1 - ok
16:33:34.0200 6580        ============================================================
16:33:34.0200 6580        Scan finished
16:33:34.0200 6580        ============================================================
16:33:34.0220 3908        Detected object count: 3
16:33:34.0220 3908        Actual detected object count: 3
16:34:31.0968 3908        Afc ( UnsignedFile.Multi.Generic ) - skipped by user
16:34:31.0968 3908        Afc ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:34:31.0970 3908        Freemake Improver ( UnsignedFile.Multi.Generic ) - skipped by user
16:34:31.0970 3908        Freemake Improver ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:34:31.0973 3908        IconMan_R ( UnsignedFile.Multi.Generic ) - skipped by user
16:34:31.0973 3908        IconMan_R ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 04.02.2013 16:43
Unauffällig :)

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Danach eine Kontrolle mit OTL bitte:
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles in CODE-Tags hier in den Thread.

duddl 04.02.2013 17:05
Code:
# AdwCleaner v2.110 - Datei am 04/02/2013 um 16:55:58 erstellt
# Aktualisiert am 03/02/2013 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (32 bits)
# Benutzer : Info - ALEXANDER-HP630
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Info\Downloads\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
Datei Gelöscht : C:\Program Files\Mozilla FireFox\searchplugins\Search_Results.xml
Datei Gelöscht : C:\Users\Info\AppData\Roaming\Mozilla\Firefox\Profiles\pqp2dpcc.default\searchplugins\BrowserProtect.xml
Ordner Gelöscht : C:\Program Files\Conduit
Ordner Gelöscht : C:\Program Files\DomaIQ Uninstaller
Ordner Gelöscht : C:\Program Files\Mozilla Firefox\Extensions\ffxtlbr@babylon.com
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\Users\Info\AppData\Local\APN
Ordner Gelöscht : C:\Users\Info\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Info\AppData\LocalLow\BabylonToolbar
Ordner Gelöscht : C:\Users\Info\AppData\LocalLow\Claro LTD
Ordner Gelöscht : C:\Users\Info\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Info\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\Info\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Info\AppData\Roaming\DataMgr
Ordner Gelöscht : C:\Users\Info\AppData\Roaming\fbDownloader
Ordner Gelöscht : C:\Users\Info\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\Info\AppData\Roaming\PerformerSoft

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\59578cdbbc6fbe49
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\BabylonToolbar
Schlüssel Gelöscht : HKCU\Software\Complitly
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\DataMngr
Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\bhphemoobgnikcoofkgackkaimpfmenm
Schlüssel Gelöscht : HKCU\Software\ilivid
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{000F18F2-09EB-4A59-82B2-5AE4184C39C3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9E131A93-EED7-4BEB-B015-A0ADB30B5646}
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\SOFTWARE\59578cdbbc6fbe49
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{442F13BC-2031-42D5-9520-437F65271153}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C3110516-8EFC-49D6-8B72-69354F332062}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Complitly.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetup.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C9AE652B-8C99-4AC2-B556-8B501182874E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{01BCB858-2F62-4F06-A8F4-48F927C15333}
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bhphemoobgnikcoofkgackkaimpfmenm
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\defdhglnppeioeflggkmglipcecffkhk
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLivid_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLivid_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividMediaBar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividMediaBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Complitly_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Results Toolbar
Schlüssel Gelöscht : HKLM\Software\PIP
Schlüssel Gelöscht : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [DataMgr]
Wert Gelöscht : HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel [Homepage]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16457

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Search Page] = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=cd92cf51-342e-492a-8fab-a7200a248b0b&searchtype=ds&q={searchTerms} --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.yhs.delta-search.com/?affID=119586&tt=030213_yh&babsrc=HP_ss&mntrId=2ab28cb800000000000026de2ba841cd --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Default_Search_URL] = hxxp://search.searchcompletion.com/?si=10195&home=1 --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Search Bar] = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=cd92cf51-342e-492a-8fab-a7200a248b0b&searchtype=ds&q={searchTerms} --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Default_Page_URL] = hxxp://search.searchcompletion.com/?si=10195&home=1 --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=cd92cf51-342e-492a-8fab-a7200a248b0b&searchtype=ds&q={searchTerms} --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Search - Search Page] = hxxp://search.searchcompletion.com/?si=10195&home=1 --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=cd92cf51-342e-492a-8fab-a7200a248b0b&searchtype=ds&q={searchTerms} --> hxxp://www.google.com

-\\ Mozilla Firefox v18.0.1 (de)

Datei : C:\Users\Info\AppData\Roaming\Mozilla\Firefox\Profiles\pqp2dpcc.default\prefs.js

C:\Users\Info\AppData\Roaming\Mozilla\Firefox\Profiles\pqp2dpcc.default\user.js ... Gelöscht !

Gelöscht : user_pref("extensions.BabylonToolbar_i.newTab", true);
Gelöscht : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://www.yhs.delta-search.com/?affID=119586&tt[...]

-\\ Google Chrome v24.0.1312.57

Datei : C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [336 octets] - [04/02/2013 16:54:40]
AdwCleaner[S2].txt - [9197 octets] - [04/02/2013 16:55:58]

########## EOF - C:\AdwCleaner[S2].txt - [9257 octets] ##########

cosinus 04.02.2013 20:49
Kommt OTL noch?

duddl 04.02.2013 21:03
Ja kommt gleich

das scannt so langsam

Code:
OTL logfile created on: 04.02.2013 21:04:40 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Info\Downloads
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,61 Gb Total Physical Memory | 0,89 Gb Available Physical Memory | 34,29% Memory free
5,21 Gb Paging File | 3,61 Gb Available in Paging File | 69,25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 596,07 Gb Total Space | 523,95 Gb Free Space | 87,90% Space Free | Partition Type: NTFS
 
Computer Name: ALEXANDER-HP630 | User Name: Info | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Info\Downloads\OTL (1).exe (OldTimer Tools)
PRC - C:\Programme\Bitdefender\Bitdefender 2013\vsserv.exe (Bitdefender)
PRC - C:\Programme\Bitdefender\Bitdefender 2013\bdagent.exe (Bitdefender)
PRC - C:\Programme\Bitdefender\Bitdefender 2013\odscanui.exe (Bitdefender)
PRC - C:\Programme\Google\Update\1.3.21.124\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe (1und1 Mail und Media GmbH)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Programme\Bitdefender\Bitdefender 2013\updatesrv.exe (Bitdefender)
PRC - C:\Programme\program\soffice.exe (OpenOffice.org)
PRC - C:\Programme\program\soffice.bin (OpenOffice.org)
PRC - C:\Programme\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Programme\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Programme\Bluetooth Suite\Ath_CoexAgent.exe (Atheros)
PRC - C:\Programme\Bluetooth Suite\BtvStack.exe (Atheros Communications)
PRC - C:\Programme\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)
PRC - C:\Programme\Bluetooth Suite\AdminService.exe (Atheros Commnucations)
PRC - C:\Programme\ArcSoft\TotalMedia 3.5\TMMonitor.exe (ArcSoft, Inc.)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\audiodg.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\Info\AppData\Local\Google\Chrome\User Data\PepperFlash\11.5.31.138\pepflashplayer.dll ()
MOD - C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll ()
MOD - C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\pdf.dll ()
MOD - C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\libglesv2.dll ()
MOD - C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\libegl.dll ()
MOD - C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\ffmpegsumo.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\346a7a67978cead8e2ff52c6d80bbeb7\IAStorUtil.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\500a8ae2a5d27132d87ccac9f97b0069\IAStorCommon.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\865d2bf19a7af7fab8660a42d92550fe\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf827fe7bc99d9bcf0ba3621054ef527\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\c1a66b44c4780c039576eaf18f4cd8dc\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll ()
MOD - C:\Programme\Bitdefender\Bitdefender 2013\txmlutil.dll ()
MOD - C:\Windows\System32\IccLibDll.dll ()
MOD - C:\Programme\program\libxml2.dll ()
MOD - C:\Programme\Bitdefender\Bitdefender 2013\bdmetrics.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\System32\msjetoledb40.dll ()
MOD - C:\Programme\ArcSoft\TotalMedia 3.5\AbilisWinUsb.dll ()
MOD - C:\Programme\ArcSoft\TotalMedia 3.5\VendorCmdRW.dll ()
MOD - C:\Programme\ArcSoft\TotalMedia 3.5\uPiApi.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (WatAdminSvc) -- C:\Windows\system32\Wat\WatAdminSvc.exe File not found
SRV - (IconMan_R) -- C:\Program Files\Realtek\Realtek PCIE Card Reader\RIconMan.exe File not found
SRV - (BdDesktopParental) -- C:\Programme\Bitdefender\Bitdefender 2013\bdparentalservice.exe (Bitdefender)
SRV - (VSSERV) -- C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe (Bitdefender)
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (cphs) -- C:\Windows\System32\IntelCpHeciSvc.exe (Intel Corporation)
SRV - (UPDATESRV) -- C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe (Bitdefender)
SRV - (HPWMISVC) -- C:\Programme\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Development Company, L.P.)
SRV - (IAStorDataMgrSvc) -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (Atheros Bt&Wlan Coex Agent) -- C:\Programme\Bluetooth Suite\Ath_CoexAgent.exe (Atheros)
SRV - (AtherosSvc) -- C:\Programme\Bluetooth Suite\AdminService.exe (Atheros Commnucations)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (ACDaemon) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (ZTEusbser6k) -- system32\DRIVERS\ZTEusbser6k.sys File not found
DRV - (ZTEusbnmea) -- system32\DRIVERS\ZTEusbnmea.sys File not found
DRV - (ZTEusbmdm6k) -- system32\DRIVERS\ZTEusbmdm6k.sys File not found
DRV - (VGPU) -- System32\drivers\rdvgkmd.sys File not found
DRV - (tsusbhub) -- system32\drivers\tsusbhub.sys File not found
DRV - (Synth3dVsc) -- System32\drivers\synth3dvsc.sys File not found
DRV - (MEMSWEEP2) -- C:\Windows\system32\C541.tmp File not found
DRV - (massfilter) -- system32\drivers\massfilter.sys File not found
DRV - (AVFSFilter) -- system32\DRIVERS\avfsfilter.sys File not found
DRV - (40517705) -- system32\drivers\04373023.sys File not found
DRV - (avckf) -- C:\Windows\System32\drivers\avckf.sys (BitDefender)
DRV - (avc3) -- C:\Windows\System32\drivers\avc3.sys (BitDefender)
DRV - (BDSandBox) -- C:\Windows\System32\drivers\bdsandbox.sys (BitDefender SRL)
DRV - (avchv) -- C:\Windows\System32\drivers\avchv.sys (BitDefender)
DRV - (trufos) -- C:\Windows\System32\drivers\trufos.sys (BitDefender S.R.L.)
DRV - (bdselfpr) -- C:\Programme\Bitdefender\Bitdefender 2013\bdselfpr.sys (BitDefender LLC)
DRV - (gzflt) -- C:\Windows\System32\drivers\gzflt.sys (BitDefender LLC)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (BdfNdisf) -- c:\Programme\Common Files\Bitdefender\Bitdefender Firewall\bdfndisf6.sys (BitDefender LLC)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Qualcomm Atheros Communications, Inc.)
DRV - (IntcDAud) -- C:\Windows\System32\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV - (bdfwfpf) -- C:\Programme\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys (BitDefender LLC)
DRV - (RTL2832U_IRHID) -- C:\Windows\System32\drivers\RTL2832U_IRHID.sys (Realtek)
DRV - (RTL2832UBDA) -- C:\Windows\System32\drivers\RTL2832UBDA.sys (REALTEK SEMICONDUCTOR Corp.)
DRV - (RTL2832UUSB) -- C:\Windows\System32\drivers\RTL2832UUSB.sys (REALTEK SEMICONDUCTOR Corp.)
DRV - (BtFilter) -- C:\Windows\System32\drivers\btfilter.sys (Atheros)
DRV - (BTATH_RCP) -- C:\Windows\System32\drivers\btath_rcp.sys (Atheros)
DRV - (BTATH_A2DP) -- C:\Windows\System32\drivers\btath_a2dp.sys (Atheros)
DRV - (BTATH_HCRP) -- C:\Windows\System32\drivers\btath_hcrp.sys (Atheros)
DRV - (BTATH_LWFLT) -- C:\Windows\System32\drivers\btath_lwflt.sys (Atheros)
DRV - (AthBTPort) -- C:\Windows\System32\drivers\btath_flt.sys (Atheros)
DRV - (BTATH_BUS) -- C:\Windows\System32\drivers\btath_bus.sys (Atheros)
DRV - (RSPCIESTOR) -- C:\Windows\System32\drivers\RtsPStor.sys (Realtek Semiconductor Corp.)
DRV - (npf) -- C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (MEI) -- C:\Windows\System32\drivers\HECI.sys (Intel Corporation)
DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.web.de/br/ie9_startpage
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://www.google.com
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No CLSID value found
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&r=
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{09038620-190C-402B-A92F-18864E6AB22F}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{5A817CF6-92D5-4DE5-AC38-82DF8A73EF28}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{649041DE-18B4-47FD-86BD-87083B1A78B7}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{6B1D1FB7-7233-4F7C-802C-21A1DDB12754}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{81CE708B-5104-4C62-B333-94B417473B29}: "URL" = hxxp://go.mail.com/br/ie8_search_web/?su={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{86AEB91E-A7FB-4FE6-9B06-55574E9AF728}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{9961BF31-9CCC-4D28-88B7-BB30137CE397}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=33AEA8D2-0C95-4F29-9D70-B3155A83F187&apn_sauid=E46F4EB1-1B8C-45C9-ACE4-A4DEA1A35778
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{B0E0A740-E869-436E-8FD7-58BEA90AF721}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-flv
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin:  File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Info\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Info\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fmconverter@gmail.com: C:\Program Files\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\ [2012.12.18 16:27:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.26 09:58:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\bdThunderbird@bitdefender.com: C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext [2013.01.28 17:59:27 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.26 09:58:30 | 000,000,000 | ---D | M]
 
[2012.12.29 13:41:45 | 000,000,000 | ---D | M] (No name found) -- \mozilla\Firefox\extensions
[2012.12.29 13:41:45 | 000,000,000 | ---D | M] (No name found) -- \mozilla\Firefox\extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}
[2013.02.04 19:10:17 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013.01.10 16:51:41 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\distribution\extensions
[2013.01.10 16:51:41 | 000,000,000 | ---D | M] (WEB.DE MailCheck) -- C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de
[2013.01.26 09:58:30 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2013.01.05 16:11:17 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.01.05 16:11:17 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.12.18 14:54:52 | 000,003,195 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Complitly.xml
[2013.01.05 16:11:17 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2013.01.05 16:11:17 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.01.05 16:11:17 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.01.05 16:11:17 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter},
CHR - homepage: hxxp://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Info\AppData\Local\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Info\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - Extension: Red Ball Jump = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahkigbfemaalcamljnhhpidckcenneai\1.3_0\
CHR - Extension: Angry Birds = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.5.0.7_0\
CHR - Extension: YouTube = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Angry birds = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjdhpighfhhhjpkjehlcpamdmpckhnll\1.2_0\
CHR - Extension: Google-Suche = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: Bad Piggies HD = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\gokpccjacnihibhbdgjeglpgiodeolpm\3.2.4_0\
CHR - Extension: Google Mail-Checker = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff\4.4.0_0\
CHR - Extension: Minecraft = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlpgoledhpdldmmhcgfcaecodnkmoiea\0.0.0.8_0\
CHR - Extension: 2 Parking Spongebob = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\nchinpmlhegmkiljhpcbffccipmogpmn\0.0.1.2_0\
CHR - Extension: Doodle Jump = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\nojaabckpfdijgbnlhdlhjheiappijbp\2.3.1_0\
CHR - Extension: Google Mail = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
 
O1 HOSTS File: ([2013.01.15 15:49:14 | 000,445,034 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 127.0.0.1        www.123fporn.info
O1 - Hosts: 15284 more lines...
O2 - BHO: (WEB.DE Konfiguration) - {17166733-40EA-4432-A85C-AE672FF0E236} - C:\ProgramData\1und1InternetExplorerAddon\BHOXML.dll (1&1 Mail & Media GmbH)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll File not found
O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Programme\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O2 - BHO: (WEB.DE MailCheck BHO) - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (WEB.DE MailCheck) - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O3 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\Toolbar\WebBrowser: (no name) - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No CLSID value found.
O3 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\Toolbar\WebBrowser: (WEB.DE MailCheck) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [AthBtTray] C:\Program Files\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)
O4 - HKLM..\Run: [AtherosBtStack] C:\Program Files\Bluetooth Suite\BtvStack.exe (Atheros Communications)
O4 - HKLM..\Run: [Bdagent] C:\Programme\Bitdefender\Bitdefender 2013\bdagent.exe (Bitdefender)
O4 - HKLM..\Run: [HP Quick Launch] C:\Programme\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [IAStorIcon] C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [MailCheck IE Broker] C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe (1und1 Mail und Media GmbH)
O4 - HKLM..\Run: [WEB.DE MailCheck Broker] C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe (1und1 Mail und Media GmbH)
O4 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000..\Run: [Facebook Update] C:\Users\Info\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000..\Run: [SCheck] C:\Users\Info\AppData\Roaming\SCheck\SCheck.exe ()
O4 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000..\Run: [Smart Driver Updater] C:\Program Files\Smart Driver Updater\SDULauncher.exe File not found
O4 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000..\Run: [SSync] C:\Users\Info\AppData\Roaming\SSync\SSync.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Info\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Programme\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\Software\Policies\Microsoft\Internet Explorer\Recovery present
O8 - Extra context menu item: Free YouTube Download - C:\Users\Info\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Programme\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455}  (ExentInf Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1442A48A-A5DF-411E-9A01-E478F1A8202E}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4E70BA11-C8F2-4E5A-AE19-2A1638EC9218}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\webde {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O20 - AppInit_DLLs: (c:\progra~2\browse~2\261095~1.52\{c16c1~1\browse~1.dll) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{a59db7fb-088d-11e2-a4a2-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{a59db7fb-088d-11e2-a4a2-806e6f6e6963}\Shell\AutoRun\command - "" = D:\setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (MACHINE BootExecut)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.02.04 19:12:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.02.04 19:12:23 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2013.02.04 19:12:22 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2013.02.04 17:36:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DLL Killer
[2013.02.04 17:34:12 | 002,023,424 | ---- | C] (Inprise Corporation) -- C:\Windows\System32\VCL50.BPL
[2013.02.04 17:34:12 | 000,248,832 | ---- | C] (Inprise Corporation) -- C:\Windows\System32\VCLX50.BPL
[2013.02.04 17:34:12 | 000,025,600 | ---- | C] (Inprise Corporation) -- C:\Windows\System32\BORLNDMM.DLL
[2013.02.04 17:34:11 | 001,496,064 | ---- | C] (Inprise Corporation) -- C:\Windows\System32\CC3250MT.DLL
[2013.02.04 17:34:11 | 000,000,000 | ---D | C] -- C:\Program Files\DLL Killer
[2013.02.04 17:33:32 | 000,299,520 | ---- | C] (InstallShield Corporation, Inc.) -- C:\Windows\uninst.exe
[2013.02.04 17:23:28 | 000,000,000 | ---D | C] -- C:\Program Files\DLLSuite
[2013.02.04 16:40:44 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2013.02.04 16:40:44 | 000,000,000 | ---D | C] -- \TDSSKiller_Quarantine
[2013.02.04 16:17:23 | 000,000,000 | ---D | C] -- C:\Program Files\Smart Driver Updater
[2013.02.04 16:16:25 | 002,128,984 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Info\Documents\TDSSKiller.exe
[2013.02.03 20:22:43 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\Add-in Express
[2013.02.03 18:30:00 | 000,000,000 | -H-D | C] -- C:\Users\Info\Documents\Freemake_do_not_remove_this_folder634955130001352811
[2013.02.03 15:13:29 | 000,000,000 | ---D | C] -- C:\Users\Info\Pavark
[2013.02.02 18:57:06 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\mbar
[2013.02.02 12:31:21 | 000,000,000 | -H-D | C] -- C:\Users\Info\Documents\Freemake_do_not_remove_this_folder634954050811576309
[2013.01.31 17:44:42 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\100_FUJI
[2013.01.31 16:32:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Dumps
[2013.01.30 18:22:34 | 000,000,000 | ---D | C] -- C:\Windows\System32\Extensions
[2013.01.30 18:22:12 | 000,000,000 | ---D | C] -- C:\Intel
[2013.01.30 18:22:12 | 000,000,000 | ---D | C] -- \Intel
[2013.01.30 17:22:13 | 000,000,000 | ---D | C] -- C:\Windows\System32\searchplugins
[2013.01.30 16:59:10 | 000,482,928 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\avckf.sys
[2013.01.30 16:58:59 | 000,625,128 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\avc3.sys
[2013.01.29 14:16:06 | 000,072,704 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\bdvedisk.sys
[2013.01.28 17:59:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitdefender 2013
[2013.01.28 17:59:36 | 000,000,000 | ---D | C] -- C:\ProgramData\BDLogging
[2013.01.28 17:59:00 | 000,511,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\capicom.dll
[2013.01.28 17:59:00 | 000,077,192 | ---- | C] (BitDefender LLC) -- C:\Windows\System32\drivers\BdfNdisf6.sys
[2013.01.28 17:59:00 | 000,066,392 | ---- | C] (BitDefender SRL) -- C:\Windows\System32\drivers\bdsandbox.sys
[2013.01.28 17:58:55 | 000,242,504 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\avchv.sys
[2013.01.28 17:39:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Bitdefender
[2013.01.28 17:31:31 | 000,161,312 | ---- | C] (BitDefender LLC) -- C:\Windows\System32\drivers\gzflt.sys
[2013.01.28 17:31:29 | 000,343,456 | ---- | C] (BitDefender S.R.L.) -- C:\Windows\System32\drivers\trufos.sys
[2013.01.28 17:31:29 | 000,000,000 | ---D | C] -- C:\Program Files\Bitdefender
[2013.01.28 17:22:47 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Bitdefender
[2013.01.28 17:11:04 | 000,000,000 | ---D | C] -- C:\ProgramData\SpeedMaxPc
[2013.01.27 19:20:17 | 000,000,000 | -H-D | C] -- C:\Users\Info\Documents\Freemake_do_not_remove_this_folder634949112175897653
[2013.01.27 19:15:41 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\Freemake
[2013.01.26 22:05:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.01.22 15:50:57 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\FOLDER01
[2013.01.21 19:23:03 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core
[2013.01.21 19:19:38 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\FIFA 12
[2013.01.21 16:22:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts
[2013.01.21 14:18:26 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Local\Facebook
[2013.01.18 19:19:35 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Local\360Amigo
[2013.01.15 14:35:06 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2013.01.14 18:21:34 | 000,000,000 | ---D | C] -- C:\ProgramData\clp
[2013.01.12 08:14:11 | 000,000,000 | -H-D | C] -- C:\Program Files\Common Files\EAInstaller
[2013.01.12 08:14:09 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_43.dll
[2013.01.12 08:14:09 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_7.dll
[2013.01.12 08:14:08 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_43.dll
[2013.01.12 08:14:08 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_6.dll
[2013.01.12 08:14:08 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_43.dll
[2013.01.12 08:14:08 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_4.dll
[2013.01.12 08:14:07 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_6.dll
[2013.01.12 08:14:07 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_7.dll
[2013.01.12 08:14:06 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_42.dll
[2013.01.12 08:14:06 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_5.dll
[2013.01.12 08:14:06 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_5.dll
[2013.01.12 08:14:05 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_42.dll
[2013.01.12 08:14:05 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_42.dll
[2013.01.12 08:14:05 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_42.dll
[2013.01.12 08:14:04 | 004,178,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_41.dll
[2013.01.12 08:14:04 | 000,517,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_4.dll
[2013.01.12 08:14:04 | 000,235,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_4.dll
[2013.01.12 08:14:04 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_3.dll
[2013.01.12 08:14:04 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_6.dll
[2013.01.12 08:14:03 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_40.dll
[2013.01.12 08:14:03 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_40.dll
[2013.01.12 08:14:03 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_3.dll
[2013.01.12 08:14:03 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_3.dll
[2013.01.12 08:14:03 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_2.dll
[2013.01.12 08:14:02 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_39.dll
[2013.01.12 08:14:02 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_2.dll
[2013.01.12 08:14:02 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_2.dll
[2013.01.12 08:14:02 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_1.dll
[2013.01.12 08:14:02 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_5.dll
[2013.01.12 08:14:01 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_39.dll
[2013.01.12 08:14:01 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_1.dll
[2013.01.12 08:14:01 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_39.dll
[2013.01.12 08:14:01 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_0.dll
[2013.01.12 08:14:00 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_38.dll
[2013.01.12 08:14:00 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_38.dll
[2013.01.12 08:14:00 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_0.dll
[2013.01.12 08:14:00 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_38.dll
[2013.01.12 08:14:00 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_1.dll
[2013.01.12 08:14:00 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_4.dll
[2013.01.12 08:13:59 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_37.dll
[2013.01.12 08:13:59 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_37.dll
[2013.01.12 08:13:59 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_37.dll
[2013.01.12 08:13:59 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_10.dll
[2013.01.12 08:13:59 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_0.dll
[2013.01.12 08:13:59 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_3.dll
[2013.01.12 08:13:58 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_36.dll
[2013.01.12 08:13:58 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_36.dll
[2013.01.12 08:13:58 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_36.dll
[2013.01.12 08:13:57 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_35.dll
[2013.01.12 08:13:57 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_35.dll
[2013.01.12 08:13:57 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_35.dll
[2013.01.12 08:13:57 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_9.dll
[2013.01.12 08:13:56 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_2.dll
[2013.01.11 15:32:07 | 000,000,000 | ---D | C] -- C:\Program Files\Vodafone-Sicherheitspaket
[2013.01.11 15:31:15 | 000,000,000 | ---D | C] -- C:\ProgramData\fssg
[2013.01.11 15:29:10 | 000,000,000 | ---D | C] -- C:\ProgramData\f-secure
[2013.01.10 18:36:19 | 000,000,000 | ---D | C] -- C:\Windows\System32\Wat
[2013.01.09 21:06:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2013.01.09 18:20:18 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Local\Electronic_Arts_Inc
[2013.01.09 15:27:51 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013.01.09 15:23:42 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2013.01.09 15:23:41 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
[2013.01.08 17:11:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Origin
[2013.01.06 16:07:32 | 000,018,360 | ---- | C] (Systweak Inc., (www.systweak.com)) -- C:\Windows\System32\roboot.exe
[2013.01.06 15:59:56 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2013.01.05 21:30:37 | 000,000,000 | ---D | C] -- C:\Macromedia
[2013.01.05 21:30:37 | 000,000,000 | ---D | C] -- \Macromedia
 
========== Files - Modified Within 30 Days ==========
 
[2013.02.04 21:06:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.02.04 20:51:01 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.02.04 20:51:00 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.02.04 20:48:11 | 000,662,014 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.02.04 20:48:11 | 000,623,856 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.02.04 20:48:11 | 000,133,648 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.02.04 20:48:11 | 000,110,030 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.02.04 20:41:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.02.04 20:41:17 | 2099,662,848 | -HS- | M] () -- C:\hiberfil.sys
[2013.02.04 20:26:49 | 000,009,904 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.04 20:26:49 | 000,009,904 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.04 19:40:01 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3437191235-2556486254-1160177188-1000UA.job
[2013.02.04 19:26:01 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3437191235-2556486254-1160177188-1000UA.job
[2013.02.04 19:04:42 | 000,552,152 | ---- | M] () -- C:\Users\Info\Documents\partypass.pdf
[2013.02.04 17:36:17 | 000,000,992 | ---- | M] () -- C:\Users\Info\Documents\DLLkiller.lnk
[2013.02.04 16:57:29 | 000,000,787 | ---- | M] () -- C:\Users\Info\Desktop\adwcleaner.lnk
[2013.02.04 16:26:03 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3437191235-2556486254-1160177188-1000Core.job
[2013.02.04 16:16:26 | 002,128,984 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Info\Documents\TDSSKiller.exe
[2013.02.04 16:07:58 | 000,000,787 | ---- | M] () -- C:\Users\Info\Desktop\TDSS rootkit removing tool.lnk
[2013.02.04 14:07:07 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3437191235-2556486254-1160177188-1000Core.job
[2013.02.03 17:30:58 | 000,001,656 | ---- | M] () -- C:\Windows\System32\ASOROSet.bin
[2013.02.01 19:42:52 | 000,002,370 | ---- | M] () -- C:\Users\Info\Desktop\Google Chrome.lnk
[2013.02.01 18:42:54 | 000,107,093 | ---- | M] () -- C:\Users\Info\Documents\1359727427_1_01.xml
[2013.01.30 20:15:23 | 000,028,507 | ---- | M] () -- C:\Users\Info\Documents\41434262.pdf
[2013.01.30 16:59:10 | 000,482,928 | ---- | M] (BitDefender) -- C:\Windows\System32\drivers\avckf.sys
[2013.01.30 16:58:59 | 000,625,128 | ---- | M] (BitDefender) -- C:\Windows\System32\drivers\avc3.sys
[2013.01.30 16:56:16 | 000,066,392 | ---- | M] (BitDefender SRL) -- C:\Windows\System32\drivers\bdsandbox.sys
[2013.01.29 17:38:37 | 000,000,385 | ---- | M] () -- C:\Windows\System32\user_gensett.xml
[2013.01.29 17:16:58 | 000,000,648 | ---- | M] () -- C:\Users\Info\Desktop\Scanner and Camera Wizard.lnk
[2013.01.29 15:59:56 | 001,652,485 | ---- | M] () -- C:\Users\Info\Documents\userguide.pdf
[2013.01.29 14:16:06 | 000,072,704 | ---- | M] (BitDefender) -- C:\Windows\System32\drivers\bdvedisk.sys
[2013.01.28 18:07:16 | 001,553,496 | ---- | M] () -- C:\ProgramData\1359390656.bdinstall.bin
[2013.01.28 18:00:07 | 000,253,404 | -H-- | M] () -- C:\bdr-ld01
[2013.01.28 18:00:07 | 000,009,216 | -H-- | M] () -- C:\bdr-ld01.mbr
[2013.01.28 18:00:07 | 000,000,308 | -H-- | M] () -- C:\bdr-cf01
[2013.01.28 17:59:52 | 000,002,126 | ---- | M] () -- C:\Users\Public\Desktop\Bitdefender Internet Security 2013.lnk
[2013.01.28 17:59:52 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_avchv_01009.Wdf
[2013.01.20 10:48:30 | 000,009,892 | ---- | M] () -- C:\Users\Info\Documents\vodafone-codes.odt
[2013.01.19 13:57:53 | 000,000,455 | ---- | M] () -- C:\Users\Info\Documents\Dokument.rtf
[2013.01.15 18:24:57 | 000,001,264 | ---- | M] () -- C:\Users\Info\Desktop\Free YouTube Download.lnk
[2013.01.15 15:49:14 | 000,445,034 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20130116-173755.backup
[2013.01.15 15:49:14 | 000,445,034 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2013.01.14 15:49:25 | 000,059,392 | R--- | M] () -- C:\Windows\System32\streamhlp.dll
[2013.01.13 12:56:09 | 000,000,017 | ---- | M] () -- C:\Users\Info\AppData\Local\resmon.resmoncfg
[2013.01.13 10:14:00 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.01.13 10:14:00 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.01.12 11:59:28 | 000,000,820 | ---- | M] () -- C:\Windows\wininit.ini
[2013.01.10 18:30:58 | 000,002,324 | ---- | M] () -- C:\Windows\epplauncher.mif
[2013.01.10 16:52:21 | 000,001,109 | ---- | M] () -- C:\Users\Info\Desktop\Mozilla Firefox.lnk
[2013.01.09 21:06:08 | 000,002,170 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2013.01.09 15:40:12 | 000,320,432 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.01.09 15:37:39 | 000,008,489 | ---- | M] () -- C:\Users\Info\Documents\Noch zu erledigen.odt
[2013.01.06 16:12:59 | 000,001,133 | ---- | M] () -- C:\Users\Info\Desktop\Pinball.lnk
 
========== Files Created - No Company Name ==========
 
[2013.02.04 20:45:42 | 014,386,176 | ---- | C] () -- C:\Users\Info\Documents\GTA - SanAndreas.exe
[2013.02.04 19:04:41 | 000,552,152 | ---- | C] () -- C:\Users\Info\Documents\partypass.pdf
[2013.02.04 17:36:17 | 000,000,992 | ---- | C] () -- C:\Users\Info\Documents\DLLkiller.lnk
[2013.02.04 17:34:12 | 000,147,456 | ---- | C] () -- C:\Windows\System32\BCBSMP50.BPL
[2013.02.04 16:57:29 | 000,000,787 | ---- | C] () -- C:\Users\Info\Desktop\adwcleaner.lnk
[2013.02.04 16:07:58 | 000,000,787 | ---- | C] () -- C:\Users\Info\Desktop\TDSS rootkit removing tool.lnk
[2013.02.02 19:42:23 | 000,001,656 | ---- | C] () -- C:\Windows\System32\ASOROSet.bin
[2013.02.01 18:45:06 | 000,107,093 | ---- | C] () -- C:\Users\Info\Documents\1359727427_1_01.xml
[2013.01.30 20:15:20 | 000,028,507 | ---- | C] () -- C:\Users\Info\Documents\41434262.pdf
[2013.01.29 17:38:37 | 000,000,385 | ---- | C] () -- C:\Windows\System32\user_gensett.xml
[2013.01.29 17:17:59 | 000,000,648 | ---- | C] () -- C:\Users\Info\Desktop\Scanner and Camera Wizard.lnk
[2013.01.29 15:59:53 | 001,652,485 | ---- | C] () -- C:\Users\Info\Documents\userguide.pdf
[2013.01.28 18:07:16 | 001,553,496 | ---- | C] () -- C:\ProgramData\1359390656.bdinstall.bin
[2013.01.28 18:00:07 | 000,000,308 | -H-- | C] () -- C:\bdr-cf01
[2013.01.28 18:00:07 | 000,000,308 | -H-- | C] () -- \bdr-cf01
[2013.01.28 17:59:52 | 000,002,126 | ---- | C] () -- C:\Users\Public\Desktop\Bitdefender Internet Security 2013.lnk
[2013.01.28 17:59:52 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_avchv_01009.Wdf
[2013.01.28 17:39:30 | 035,184,777 | -H-- | C] () -- C:\bdr-im01.gz
[2013.01.28 17:39:30 | 035,184,777 | -H-- | C] () -- \bdr-im01.gz
[2013.01.28 17:39:30 | 002,294,848 | -H-- | C] () -- C:\bdr-bz01
[2013.01.28 17:39:30 | 002,294,848 | -H-- | C] () -- \bdr-bz01
[2013.01.28 17:39:30 | 000,253,404 | -H-- | C] () -- C:\bdr-ld01
[2013.01.28 17:39:30 | 000,253,404 | -H-- | C] () -- \bdr-ld01
[2013.01.28 17:39:30 | 000,009,216 | -H-- | C] () -- C:\bdr-ld01.mbr
[2013.01.28 17:39:30 | 000,009,216 | -H-- | C] () -- \bdr-ld01.mbr
[2013.01.20 10:48:26 | 000,009,892 | ---- | C] () -- C:\Users\Info\Documents\vodafone-codes.odt
[2013.01.19 13:57:53 | 000,000,455 | ---- | C] () -- C:\Users\Info\Documents\Dokument.rtf
[2013.01.15 18:24:57 | 000,001,264 | ---- | C] () -- C:\Users\Info\Desktop\Free YouTube Download.lnk
[2013.01.14 15:49:03 | 000,059,392 | R--- | C] () -- C:\Windows\System32\streamhlp.dll
[2013.01.13 12:56:09 | 000,000,017 | ---- | C] () -- C:\Users\Info\AppData\Local\resmon.resmoncfg
[2013.01.10 18:30:58 | 000,002,324 | ---- | C] () -- C:\Windows\epplauncher.mif
[2013.01.10 16:51:58 | 000,001,109 | ---- | C] () -- C:\Users\Info\Desktop\Mozilla Firefox.lnk
[2013.01.10 16:51:52 | 000,001,121 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013.01.09 21:06:08 | 000,002,170 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2013.01.09 20:46:10 | 000,001,094 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.01.09 20:46:10 | 000,001,090 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.01.06 15:59:56 | 000,001,133 | ---- | C] () -- C:\Users\Info\Desktop\Pinball.lnk
[2013.01.01 14:37:00 | 005,746,780 | ---- | C] ( ) -- C:\Windows\System32\RTKISDBT.dll
[2012.12.29 19:05:53 | 000,000,820 | ---- | C] () -- C:\Windows\wininit.ini
[2012.12.18 14:54:52 | 000,000,000 | RHS- | C] () -- \MSDOS.SYS
[2012.12.18 14:54:52 | 000,000,000 | RHS- | C] () -- \IO.SYS
[2012.12.14 02:02:20 | 000,064,512 | ---- | C] () -- C:\Windows\System32\igdde32.dll
[2012.12.14 02:02:20 | 000,009,728 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2012.12.14 02:02:20 | 000,000,268 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2012.11.17 16:39:51 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2012.10.22 17:40:04 | 000,272,928 | ---- | C] () -- C:\Windows\System32\igvpkrng600.bin
[2012.10.22 17:39:46 | 000,963,452 | ---- | C] () -- C:\Windows\System32\igcodeckrng600.bin
[2012.10.22 17:39:44 | 000,094,208 | ---- | C] () -- C:\Windows\System32\IccLibDll.dll
[2012.10.03 17:15:43 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2012.10.03 17:14:43 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2012.09.29 10:40:45 | 000,000,557 | ---- | C] () -- \NetworkCfg.xml
[2012.09.27 11:25:26 | 2099,662,848 | -HS- | C] () -- \hiberfil.sys
[2012.08.13 10:08:08 | 000,014,217 | ---- | C] () -- C:\Program Files\readme.html
[2012.07.27 21:47:36 | 000,159,232 | ---- | C] () -- C:\Windows\System32\clinfo.exe
[2012.05.08 13:15:36 | 000,000,005 | ---- | C] () -- C:\Program Files\basis-link
[2011.09.15 02:11:16 | 001,048,576 | ---- | C] () -- C:\Windows\System32\syndata.bin
[2011.08.17 06:48:34 | 000,262,080 | ---- | C] () -- C:\Windows\System32\SynPS2.bin
[2011.05.09 17:19:48 | 000,246,804 | ---- | C] () -- C:\Windows\System32\drivers\AtherosBt.bin
[2011.02.11 22:23:34 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2009.07.14 03:04:04 | 000,000,024 | ---- | C] () -- \autoexec.bat
[2009.07.14 03:04:04 | 000,000,010 | ---- | C] () -- \config.sys
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2013.01.04 21:07:15 | 000,000,000 | ---D | M] -- C:\Users\All Users\1&1 Mail & Media GmbH
[2013.02.03 21:34:02 | 000,000,000 | ---D | M] -- C:\Users\All Users\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2013.01.04 11:30:14 | 000,000,000 | ---D | M] -- C:\Users\All Users\1und1InternetExplorerAddon
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\All Users\Anwendungsdaten
[2013.01.31 16:34:47 | 000,000,000 | ---D | M] -- C:\Users\All Users\BDLogging
[2013.01.28 18:00:38 | 000,000,000 | ---D | M] -- C:\Users\All Users\Bitdefender
[2013.01.14 18:51:40 | 000,000,000 | ---D | M] -- C:\Users\All Users\clp
[2012.12.18 16:34:38 | 000,000,000 | -H-D | M] -- C:\Users\All Users\Common Files
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\All Users\Desktop
[2013.01.04 11:30:12 | 000,000,000 | ---D | M] -- C:\Users\All Users\DesktopIcons
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\All Users\Dokumente
[2013.01.31 16:39:30 | 000,000,000 | ---D | M] -- C:\Users\All Users\Dumps
[2013.01.21 19:23:03 | 000,000,000 | ---D | M] -- C:\Users\All Users\EA Core
[2013.01.21 19:23:26 | 000,000,000 | ---D | M] -- C:\Users\All Users\Electronic Arts
[2013.01.14 19:16:39 | 000,000,000 | ---D | M] -- C:\Users\All Users\f-secure
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\All Users\Favoriten
[2012.12.28 22:58:50 | 000,000,000 | ---D | M] -- C:\Users\All Users\Freemake
[2013.01.13 11:01:55 | 000,000,000 | ---D | M] -- C:\Users\All Users\fssg
[2012.10.20 13:20:59 | 000,000,000 | ---D | M] -- C:\Users\All Users\MakeMusic
[2013.02.02 21:46:20 | 000,000,000 | ---D | M] -- C:\Users\All Users\Origin
[2012.12.28 21:13:22 | 000,000,000 | ---D | M] -- C:\Users\All Users\PC Drivers HeadQuarters
[2013.02.04 14:28:17 | 000,000,000 | ---D | M] -- C:\Users\All Users\SpeedMaxPc
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\All Users\Startmenü
[2012.09.27 20:04:57 | 000,000,000 | ---D | M] -- C:\Users\All Users\Synaptics
[2012.12.18 17:54:13 | 000,000,000 | ---D | M] -- C:\Users\All Users\TEMP
[2012.12.18 16:34:56 | 000,000,000 | ---D | M] -- C:\Users\All Users\TuneUp Software
[2013.01.04 21:05:42 | 000,000,000 | ---D | M] -- C:\Users\All Users\UUdb
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\All Users\Vorlagen
[2013.01.06 17:36:04 | 000,000,000 | ---D | M] -- C:\Users\All Users\Wincert
[2013.01.06 16:26:41 | 000,000,000 | -HSD | M] -- C:\Users\All Users\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Anwendungsdaten
[2009.07.14 03:37:05 | 000,000,000 | -H-D | M] -- C:\Users\Default\AppData
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Cookies
[2009.07.14 03:04:25 | 000,000,000 | R--D | M] -- C:\Users\Default\Desktop
[2012.09.27 11:32:36 | 000,000,000 | R--D | M] -- C:\Users\Default\Documents
[2009.07.14 03:04:25 | 000,000,000 | R--D | M] -- C:\Users\Default\Downloads
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Druckumgebung
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Eigene Dateien
[2009.07.14 03:04:25 | 000,000,000 | R--D | M] -- C:\Users\Default\Favorites
[2013.01.12 21:29:16 | 000,000,000 | R--D | M] -- C:\Users\Default\Links
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Lokale Einstellungen
[2009.07.14 03:04:25 | 000,000,000 | R--D | M] -- C:\Users\Default\Music
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Netzwerkumgebung
[2009.07.14 03:04:25 | 000,000,000 | R--D | M] -- C:\Users\Default\Pictures
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Recent
[2009.07.14 03:04:25 | 000,000,000 | ---D | M] -- C:\Users\Default\Saved Games
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\SendTo
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Startmenü
[2009.07.14 03:04:25 | 000,000,000 | R--D | M] -- C:\Users\Default\Videos
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Vorlagen
[2012.09.29 08:41:30 | 000,000,000 | ---D | M] -- C:\Users\Info\.LOGOComfort6.1
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Anwendungsdaten
[2013.01.30 18:12:08 | 000,000,000 | -H-D | M] -- C:\Users\Info\AppData
[2012.10.03 17:47:55 | 000,000,000 | R--D | M] -- C:\Users\Info\Contacts
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Cookies
[2013.02.04 17:32:56 | 000,000,000 | R--D | M] -- C:\Users\Info\Desktop
[2013.02.04 20:45:42 | 000,000,000 | R--D | M] -- C:\Users\Info\Documents
[2013.02.04 21:03:14 | 000,000,000 | R--D | M] -- C:\Users\Info\Downloads
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Druckumgebung
[2012.09.27 11:34:15 | 000,000,000 | -HSD | M] -- C:\Users\Info\Eigene Dateien
[2013.02.01 18:52:18 | 000,000,000 | R--D | M] -- C:\Users\Info\Favorites
[2012.09.29 08:38:24 | 000,000,000 | -H-D | M] -- C:\Users\Info\InstallAnywhere
[2013.01.05 19:27:44 | 000,000,000 | R--D | M] -- C:\Users\Info\Links
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Lokale Einstellungen
[2013.01.09 17:20:50 | 000,000,000 | R--D | M] -- C:\Users\Info\Music
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Netzwerkumgebung
[2013.02.03 15:14:43 | 000,000,000 | ---D | M] -- C:\Users\Info\Pavark
[2013.02.01 19:11:14 | 000,000,000 | R--D | M] -- C:\Users\Info\Pictures
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Recent
[2012.10.03 17:47:55 | 000,000,000 | R--D | M] -- C:\Users\Info\Saved Games
[2012.10.07 10:03:30 | 000,000,000 | R--D | M] -- C:\Users\Info\Searches
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\SendTo
[2013.01.12 21:29:22 | 000,000,000 | R--D | M] -- C:\Users\Info\SkyDrive
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Startmenü
[2013.01.19 10:08:21 | 000,000,000 | ---D | M] -- C:\Users\Info\Tracing
[2013.02.03 18:33:28 | 000,000,000 | R--D | M] -- C:\Users\Info\Videos
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Vorlagen
[2012.11.17 16:39:29 | 000,000,000 | ---D | M] -- C:\Users\Malisa\Desktop
[2013.02.04 19:19:24 | 000,000,000 | RH-D | M] -- C:\Users\Public\Desktop
[2012.10.20 15:03:02 | 000,000,000 | R--D | M] -- C:\Users\Public\Documents
[2009.07.14 05:41:57 | 000,000,000 | R--D | M] -- C:\Users\Public\Downloads
[2009.07.14 03:04:25 | 000,000,000 | RH-D | M] -- C:\Users\Public\Favorites
[2012.09.27 11:54:46 | 000,000,000 | RH-D | M] -- C:\Users\Public\Libraries
[2012.10.01 13:20:41 | 000,000,000 | R--D | M] -- C:\Users\Public\Music
[2009.07.14 05:41:57 | 000,000,000 | R--D | M] -- C:\Users\Public\Pictures
[2012.10.02 13:02:43 | 000,000,000 | R--D | M] -- C:\Users\Public\Recorded TV
[2009.07.14 05:41:57 | 000,000,000 | R--D | M] -- C:\Users\Public\Videos
 
========== Purity Check ==========
 
 

< End of report >

duddl 04.02.2013 21:35
Code:
OTL logfile created on: 04.02.2013 21:04:40 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Info\Downloads
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,61 Gb Total Physical Memory | 0,89 Gb Available Physical Memory | 34,29% Memory free
5,21 Gb Paging File | 3,61 Gb Available in Paging File | 69,25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 596,07 Gb Total Space | 523,95 Gb Free Space | 87,90% Space Free | Partition Type: NTFS
 
Computer Name: ALEXANDER-HP630 | User Name: Info | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Info\Downloads\OTL (1).exe (OldTimer Tools)
PRC - C:\Programme\Bitdefender\Bitdefender 2013\vsserv.exe (Bitdefender)
PRC - C:\Programme\Bitdefender\Bitdefender 2013\bdagent.exe (Bitdefender)
PRC - C:\Programme\Bitdefender\Bitdefender 2013\odscanui.exe (Bitdefender)
PRC - C:\Programme\Google\Update\1.3.21.124\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe (1und1 Mail und Media GmbH)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Programme\Bitdefender\Bitdefender 2013\updatesrv.exe (Bitdefender)
PRC - C:\Programme\program\soffice.exe (OpenOffice.org)
PRC - C:\Programme\program\soffice.bin (OpenOffice.org)
PRC - C:\Programme\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Programme\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Programme\Bluetooth Suite\Ath_CoexAgent.exe (Atheros)
PRC - C:\Programme\Bluetooth Suite\BtvStack.exe (Atheros Communications)
PRC - C:\Programme\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)
PRC - C:\Programme\Bluetooth Suite\AdminService.exe (Atheros Commnucations)
PRC - C:\Programme\ArcSoft\TotalMedia 3.5\TMMonitor.exe (ArcSoft, Inc.)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\audiodg.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\Info\AppData\Local\Google\Chrome\User Data\PepperFlash\11.5.31.138\pepflashplayer.dll ()
MOD - C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll ()
MOD - C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\pdf.dll ()
MOD - C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\libglesv2.dll ()
MOD - C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\libegl.dll ()
MOD - C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\ffmpegsumo.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\346a7a67978cead8e2ff52c6d80bbeb7\IAStorUtil.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\500a8ae2a5d27132d87ccac9f97b0069\IAStorCommon.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\865d2bf19a7af7fab8660a42d92550fe\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf827fe7bc99d9bcf0ba3621054ef527\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\c1a66b44c4780c039576eaf18f4cd8dc\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll ()
MOD - C:\Programme\Bitdefender\Bitdefender 2013\txmlutil.dll ()
MOD - C:\Windows\System32\IccLibDll.dll ()
MOD - C:\Programme\program\libxml2.dll ()
MOD - C:\Programme\Bitdefender\Bitdefender 2013\bdmetrics.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\System32\msjetoledb40.dll ()
MOD - C:\Programme\ArcSoft\TotalMedia 3.5\AbilisWinUsb.dll ()
MOD - C:\Programme\ArcSoft\TotalMedia 3.5\VendorCmdRW.dll ()
MOD - C:\Programme\ArcSoft\TotalMedia 3.5\uPiApi.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (WatAdminSvc) -- C:\Windows\system32\Wat\WatAdminSvc.exe File not found
SRV - (IconMan_R) -- C:\Program Files\Realtek\Realtek PCIE Card Reader\RIconMan.exe File not found
SRV - (BdDesktopParental) -- C:\Programme\Bitdefender\Bitdefender 2013\bdparentalservice.exe (Bitdefender)
SRV - (VSSERV) -- C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe (Bitdefender)
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (cphs) -- C:\Windows\System32\IntelCpHeciSvc.exe (Intel Corporation)
SRV - (UPDATESRV) -- C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe (Bitdefender)
SRV - (HPWMISVC) -- C:\Programme\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Development Company, L.P.)
SRV - (IAStorDataMgrSvc) -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (Atheros Bt&Wlan Coex Agent) -- C:\Programme\Bluetooth Suite\Ath_CoexAgent.exe (Atheros)
SRV - (AtherosSvc) -- C:\Programme\Bluetooth Suite\AdminService.exe (Atheros Commnucations)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (ACDaemon) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (ZTEusbser6k) -- system32\DRIVERS\ZTEusbser6k.sys File not found
DRV - (ZTEusbnmea) -- system32\DRIVERS\ZTEusbnmea.sys File not found
DRV - (ZTEusbmdm6k) -- system32\DRIVERS\ZTEusbmdm6k.sys File not found
DRV - (VGPU) -- System32\drivers\rdvgkmd.sys File not found
DRV - (tsusbhub) -- system32\drivers\tsusbhub.sys File not found
DRV - (Synth3dVsc) -- System32\drivers\synth3dvsc.sys File not found
DRV - (MEMSWEEP2) -- C:\Windows\system32\C541.tmp File not found
DRV - (massfilter) -- system32\drivers\massfilter.sys File not found
DRV - (AVFSFilter) -- system32\DRIVERS\avfsfilter.sys File not found
DRV - (40517705) -- system32\drivers\04373023.sys File not found
DRV - (avckf) -- C:\Windows\System32\drivers\avckf.sys (BitDefender)
DRV - (avc3) -- C:\Windows\System32\drivers\avc3.sys (BitDefender)
DRV - (BDSandBox) -- C:\Windows\System32\drivers\bdsandbox.sys (BitDefender SRL)
DRV - (avchv) -- C:\Windows\System32\drivers\avchv.sys (BitDefender)
DRV - (trufos) -- C:\Windows\System32\drivers\trufos.sys (BitDefender S.R.L.)
DRV - (bdselfpr) -- C:\Programme\Bitdefender\Bitdefender 2013\bdselfpr.sys (BitDefender LLC)
DRV - (gzflt) -- C:\Windows\System32\drivers\gzflt.sys (BitDefender LLC)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (BdfNdisf) -- c:\Programme\Common Files\Bitdefender\Bitdefender Firewall\bdfndisf6.sys (BitDefender LLC)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Qualcomm Atheros Communications, Inc.)
DRV - (IntcDAud) -- C:\Windows\System32\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV - (bdfwfpf) -- C:\Programme\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys (BitDefender LLC)
DRV - (RTL2832U_IRHID) -- C:\Windows\System32\drivers\RTL2832U_IRHID.sys (Realtek)
DRV - (RTL2832UBDA) -- C:\Windows\System32\drivers\RTL2832UBDA.sys (REALTEK SEMICONDUCTOR Corp.)
DRV - (RTL2832UUSB) -- C:\Windows\System32\drivers\RTL2832UUSB.sys (REALTEK SEMICONDUCTOR Corp.)
DRV - (BtFilter) -- C:\Windows\System32\drivers\btfilter.sys (Atheros)
DRV - (BTATH_RCP) -- C:\Windows\System32\drivers\btath_rcp.sys (Atheros)
DRV - (BTATH_A2DP) -- C:\Windows\System32\drivers\btath_a2dp.sys (Atheros)
DRV - (BTATH_HCRP) -- C:\Windows\System32\drivers\btath_hcrp.sys (Atheros)
DRV - (BTATH_LWFLT) -- C:\Windows\System32\drivers\btath_lwflt.sys (Atheros)
DRV - (AthBTPort) -- C:\Windows\System32\drivers\btath_flt.sys (Atheros)
DRV - (BTATH_BUS) -- C:\Windows\System32\drivers\btath_bus.sys (Atheros)
DRV - (RSPCIESTOR) -- C:\Windows\System32\drivers\RtsPStor.sys (Realtek Semiconductor Corp.)
DRV - (npf) -- C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (MEI) -- C:\Windows\System32\drivers\HECI.sys (Intel Corporation)
DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.web.de/br/ie9_startpage
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://www.google.com
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No CLSID value found
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&r=
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{09038620-190C-402B-A92F-18864E6AB22F}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{5A817CF6-92D5-4DE5-AC38-82DF8A73EF28}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{649041DE-18B4-47FD-86BD-87083B1A78B7}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{6B1D1FB7-7233-4F7C-802C-21A1DDB12754}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{81CE708B-5104-4C62-B333-94B417473B29}: "URL" = hxxp://go.mail.com/br/ie8_search_web/?su={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{86AEB91E-A7FB-4FE6-9B06-55574E9AF728}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{9961BF31-9CCC-4D28-88B7-BB30137CE397}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=33AEA8D2-0C95-4F29-9D70-B3155A83F187&apn_sauid=E46F4EB1-1B8C-45C9-ACE4-A4DEA1A35778
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{B0E0A740-E869-436E-8FD7-58BEA90AF721}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-flv
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin:  File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Info\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Info\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fmconverter@gmail.com: C:\Program Files\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\ [2012.12.18 16:27:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.26 09:58:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\bdThunderbird@bitdefender.com: C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext [2013.01.28 17:59:27 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.26 09:58:30 | 000,000,000 | ---D | M]
 
[2012.12.29 13:41:45 | 000,000,000 | ---D | M] (No name found) -- \mozilla\Firefox\extensions
[2012.12.29 13:41:45 | 000,000,000 | ---D | M] (No name found) -- \mozilla\Firefox\extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}
[2013.02.04 19:10:17 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013.01.10 16:51:41 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\distribution\extensions
[2013.01.10 16:51:41 | 000,000,000 | ---D | M] (WEB.DE MailCheck) -- C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de
[2013.01.26 09:58:30 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2013.01.05 16:11:17 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.01.05 16:11:17 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.12.18 14:54:52 | 000,003,195 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Complitly.xml
[2013.01.05 16:11:17 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2013.01.05 16:11:17 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.01.05 16:11:17 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.01.05 16:11:17 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter},
CHR - homepage: hxxp://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Info\AppData\Local\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Info\AppData\Local\Google\Chrome\Application\24.0.1312.57\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Info\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - Extension: Red Ball Jump = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahkigbfemaalcamljnhhpidckcenneai\1.3_0\
CHR - Extension: Angry Birds = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.5.0.7_0\
CHR - Extension: YouTube = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Angry birds = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjdhpighfhhhjpkjehlcpamdmpckhnll\1.2_0\
CHR - Extension: Google-Suche = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: Bad Piggies HD = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\gokpccjacnihibhbdgjeglpgiodeolpm\3.2.4_0\
CHR - Extension: Google Mail-Checker = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff\4.4.0_0\
CHR - Extension: Minecraft = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlpgoledhpdldmmhcgfcaecodnkmoiea\0.0.0.8_0\
CHR - Extension: 2 Parking Spongebob = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\nchinpmlhegmkiljhpcbffccipmogpmn\0.0.1.2_0\
CHR - Extension: Doodle Jump = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\nojaabckpfdijgbnlhdlhjheiappijbp\2.3.1_0\
CHR - Extension: Google Mail = C:\Users\Info\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
 
O1 HOSTS File: ([2013.01.15 15:49:14 | 000,445,034 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 127.0.0.1        www.123fporn.info
O1 - Hosts: 15284 more lines...
O2 - BHO: (WEB.DE Konfiguration) - {17166733-40EA-4432-A85C-AE672FF0E236} - C:\ProgramData\1und1InternetExplorerAddon\BHOXML.dll (1&1 Mail & Media GmbH)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll File not found
O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Programme\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O2 - BHO: (WEB.DE MailCheck BHO) - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (WEB.DE MailCheck) - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O3 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\Toolbar\WebBrowser: (no name) - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No CLSID value found.
O3 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\..\Toolbar\WebBrowser: (WEB.DE MailCheck) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [AthBtTray] C:\Program Files\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)
O4 - HKLM..\Run: [AtherosBtStack] C:\Program Files\Bluetooth Suite\BtvStack.exe (Atheros Communications)
O4 - HKLM..\Run: [Bdagent] C:\Programme\Bitdefender\Bitdefender 2013\bdagent.exe (Bitdefender)
O4 - HKLM..\Run: [HP Quick Launch] C:\Programme\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [IAStorIcon] C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [MailCheck IE Broker] C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe (1und1 Mail und Media GmbH)
O4 - HKLM..\Run: [WEB.DE MailCheck Broker] C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe (1und1 Mail und Media GmbH)
O4 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000..\Run: [Facebook Update] C:\Users\Info\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000..\Run: [SCheck] C:\Users\Info\AppData\Roaming\SCheck\SCheck.exe ()
O4 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000..\Run: [Smart Driver Updater] C:\Program Files\Smart Driver Updater\SDULauncher.exe File not found
O4 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000..\Run: [SSync] C:\Users\Info\AppData\Roaming\SSync\SSync.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Info\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Programme\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3437191235-2556486254-1160177188-1000\Software\Policies\Microsoft\Internet Explorer\Recovery present
O8 - Extra context menu item: Free YouTube Download - C:\Users\Info\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Programme\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455}  (ExentInf Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1442A48A-A5DF-411E-9A01-E478F1A8202E}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4E70BA11-C8F2-4E5A-AE19-2A1638EC9218}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\webde {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O20 - AppInit_DLLs: (c:\progra~2\browse~2\261095~1.52\{c16c1~1\browse~1.dll) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{a59db7fb-088d-11e2-a4a2-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{a59db7fb-088d-11e2-a4a2-806e6f6e6963}\Shell\AutoRun\command - "" = D:\setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (MACHINE BootExecut)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.02.04 19:12:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.02.04 19:12:23 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2013.02.04 19:12:22 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2013.02.04 17:36:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DLL Killer
[2013.02.04 17:34:12 | 002,023,424 | ---- | C] (Inprise Corporation) -- C:\Windows\System32\VCL50.BPL
[2013.02.04 17:34:12 | 000,248,832 | ---- | C] (Inprise Corporation) -- C:\Windows\System32\VCLX50.BPL
[2013.02.04 17:34:12 | 000,025,600 | ---- | C] (Inprise Corporation) -- C:\Windows\System32\BORLNDMM.DLL
[2013.02.04 17:34:11 | 001,496,064 | ---- | C] (Inprise Corporation) -- C:\Windows\System32\CC3250MT.DLL
[2013.02.04 17:34:11 | 000,000,000 | ---D | C] -- C:\Program Files\DLL Killer
[2013.02.04 17:33:32 | 000,299,520 | ---- | C] (InstallShield Corporation, Inc.) -- C:\Windows\uninst.exe
[2013.02.04 17:23:28 | 000,000,000 | ---D | C] -- C:\Program Files\DLLSuite
[2013.02.04 16:40:44 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2013.02.04 16:40:44 | 000,000,000 | ---D | C] -- \TDSSKiller_Quarantine
[2013.02.04 16:17:23 | 000,000,000 | ---D | C] -- C:\Program Files\Smart Driver Updater
[2013.02.04 16:16:25 | 002,128,984 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Info\Documents\TDSSKiller.exe
[2013.02.03 20:22:43 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\Add-in Express
[2013.02.03 18:30:00 | 000,000,000 | -H-D | C] -- C:\Users\Info\Documents\Freemake_do_not_remove_this_folder634955130001352811
[2013.02.03 15:13:29 | 000,000,000 | ---D | C] -- C:\Users\Info\Pavark
[2013.02.02 18:57:06 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\mbar
[2013.02.02 12:31:21 | 000,000,000 | -H-D | C] -- C:\Users\Info\Documents\Freemake_do_not_remove_this_folder634954050811576309
[2013.01.31 17:44:42 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\100_FUJI
[2013.01.31 16:32:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Dumps
[2013.01.30 18:22:34 | 000,000,000 | ---D | C] -- C:\Windows\System32\Extensions
[2013.01.30 18:22:12 | 000,000,000 | ---D | C] -- C:\Intel
[2013.01.30 18:22:12 | 000,000,000 | ---D | C] -- \Intel
[2013.01.30 17:22:13 | 000,000,000 | ---D | C] -- C:\Windows\System32\searchplugins
[2013.01.30 16:59:10 | 000,482,928 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\avckf.sys
[2013.01.30 16:58:59 | 000,625,128 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\avc3.sys
[2013.01.29 14:16:06 | 000,072,704 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\bdvedisk.sys
[2013.01.28 17:59:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitdefender 2013
[2013.01.28 17:59:36 | 000,000,000 | ---D | C] -- C:\ProgramData\BDLogging
[2013.01.28 17:59:00 | 000,511,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\capicom.dll
[2013.01.28 17:59:00 | 000,077,192 | ---- | C] (BitDefender LLC) -- C:\Windows\System32\drivers\BdfNdisf6.sys
[2013.01.28 17:59:00 | 000,066,392 | ---- | C] (BitDefender SRL) -- C:\Windows\System32\drivers\bdsandbox.sys
[2013.01.28 17:58:55 | 000,242,504 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\avchv.sys
[2013.01.28 17:39:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Bitdefender
[2013.01.28 17:31:31 | 000,161,312 | ---- | C] (BitDefender LLC) -- C:\Windows\System32\drivers\gzflt.sys
[2013.01.28 17:31:29 | 000,343,456 | ---- | C] (BitDefender S.R.L.) -- C:\Windows\System32\drivers\trufos.sys
[2013.01.28 17:31:29 | 000,000,000 | ---D | C] -- C:\Program Files\Bitdefender
[2013.01.28 17:22:47 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Bitdefender
[2013.01.28 17:11:04 | 000,000,000 | ---D | C] -- C:\ProgramData\SpeedMaxPc
[2013.01.27 19:20:17 | 000,000,000 | -H-D | C] -- C:\Users\Info\Documents\Freemake_do_not_remove_this_folder634949112175897653
[2013.01.27 19:15:41 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\Freemake
[2013.01.26 22:05:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.01.22 15:50:57 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\FOLDER01
[2013.01.21 19:23:03 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core
[2013.01.21 19:19:38 | 000,000,000 | ---D | C] -- C:\Users\Info\Documents\FIFA 12
[2013.01.21 16:22:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts
[2013.01.21 14:18:26 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Local\Facebook
[2013.01.18 19:19:35 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Local\360Amigo
[2013.01.15 14:35:06 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2013.01.14 18:21:34 | 000,000,000 | ---D | C] -- C:\ProgramData\clp
[2013.01.12 08:14:11 | 000,000,000 | -H-D | C] -- C:\Program Files\Common Files\EAInstaller
[2013.01.12 08:14:09 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_43.dll
[2013.01.12 08:14:09 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_7.dll
[2013.01.12 08:14:08 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_43.dll
[2013.01.12 08:14:08 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_6.dll
[2013.01.12 08:14:08 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_43.dll
[2013.01.12 08:14:08 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_4.dll
[2013.01.12 08:14:07 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_6.dll
[2013.01.12 08:14:07 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_7.dll
[2013.01.12 08:14:06 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_42.dll
[2013.01.12 08:14:06 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_5.dll
[2013.01.12 08:14:06 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_5.dll
[2013.01.12 08:14:05 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_42.dll
[2013.01.12 08:14:05 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_42.dll
[2013.01.12 08:14:05 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_42.dll
[2013.01.12 08:14:04 | 004,178,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_41.dll
[2013.01.12 08:14:04 | 000,517,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_4.dll
[2013.01.12 08:14:04 | 000,235,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_4.dll
[2013.01.12 08:14:04 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_3.dll
[2013.01.12 08:14:04 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_6.dll
[2013.01.12 08:14:03 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_40.dll
[2013.01.12 08:14:03 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_40.dll
[2013.01.12 08:14:03 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_3.dll
[2013.01.12 08:14:03 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_3.dll
[2013.01.12 08:14:03 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_2.dll
[2013.01.12 08:14:02 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_39.dll
[2013.01.12 08:14:02 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_2.dll
[2013.01.12 08:14:02 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_2.dll
[2013.01.12 08:14:02 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_1.dll
[2013.01.12 08:14:02 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_5.dll
[2013.01.12 08:14:01 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_39.dll
[2013.01.12 08:14:01 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_1.dll
[2013.01.12 08:14:01 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_39.dll
[2013.01.12 08:14:01 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_0.dll
[2013.01.12 08:14:00 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_38.dll
[2013.01.12 08:14:00 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_38.dll
[2013.01.12 08:14:00 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_0.dll
[2013.01.12 08:14:00 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_38.dll
[2013.01.12 08:14:00 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_1.dll
[2013.01.12 08:14:00 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_4.dll
[2013.01.12 08:13:59 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_37.dll
[2013.01.12 08:13:59 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_37.dll
[2013.01.12 08:13:59 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_37.dll
[2013.01.12 08:13:59 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_10.dll
[2013.01.12 08:13:59 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_0.dll
[2013.01.12 08:13:59 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_3.dll
[2013.01.12 08:13:58 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_36.dll
[2013.01.12 08:13:58 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_36.dll
[2013.01.12 08:13:58 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_36.dll
[2013.01.12 08:13:57 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_35.dll
[2013.01.12 08:13:57 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_35.dll
[2013.01.12 08:13:57 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_35.dll
[2013.01.12 08:13:57 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_9.dll
[2013.01.12 08:13:56 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_2.dll
[2013.01.11 15:32:07 | 000,000,000 | ---D | C] -- C:\Program Files\Vodafone-Sicherheitspaket
[2013.01.11 15:31:15 | 000,000,000 | ---D | C] -- C:\ProgramData\fssg
[2013.01.11 15:29:10 | 000,000,000 | ---D | C] -- C:\ProgramData\f-secure
[2013.01.10 18:36:19 | 000,000,000 | ---D | C] -- C:\Windows\System32\Wat
[2013.01.09 21:06:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2013.01.09 18:20:18 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Local\Electronic_Arts_Inc
[2013.01.09 15:27:51 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013.01.09 15:23:42 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2013.01.09 15:23:41 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
[2013.01.08 17:11:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Origin
[2013.01.06 16:07:32 | 000,018,360 | ---- | C] (Systweak Inc., (www.systweak.com)) -- C:\Windows\System32\roboot.exe
[2013.01.06 15:59:56 | 000,000,000 | ---D | C] -- C:\Users\Info\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2013.01.05 21:30:37 | 000,000,000 | ---D | C] -- C:\Macromedia
[2013.01.05 21:30:37 | 000,000,000 | ---D | C] -- \Macromedia
 
========== Files - Modified Within 30 Days ==========
 
[2013.02.04 21:06:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.02.04 20:51:01 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.02.04 20:51:00 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.02.04 20:48:11 | 000,662,014 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.02.04 20:48:11 | 000,623,856 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.02.04 20:48:11 | 000,133,648 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.02.04 20:48:11 | 000,110,030 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.02.04 20:41:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.02.04 20:41:17 | 2099,662,848 | -HS- | M] () -- C:\hiberfil.sys
[2013.02.04 20:26:49 | 000,009,904 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.04 20:26:49 | 000,009,904 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.04 19:40:01 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3437191235-2556486254-1160177188-1000UA.job
[2013.02.04 19:26:01 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3437191235-2556486254-1160177188-1000UA.job
[2013.02.04 19:04:42 | 000,552,152 | ---- | M] () -- C:\Users\Info\Documents\partypass.pdf
[2013.02.04 17:36:17 | 000,000,992 | ---- | M] () -- C:\Users\Info\Documents\DLLkiller.lnk
[2013.02.04 16:57:29 | 000,000,787 | ---- | M] () -- C:\Users\Info\Desktop\adwcleaner.lnk
[2013.02.04 16:26:03 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3437191235-2556486254-1160177188-1000Core.job
[2013.02.04 16:16:26 | 002,128,984 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Info\Documents\TDSSKiller.exe
[2013.02.04 16:07:58 | 000,000,787 | ---- | M] () -- C:\Users\Info\Desktop\TDSS rootkit removing tool.lnk
[2013.02.04 14:07:07 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3437191235-2556486254-1160177188-1000Core.job
[2013.02.03 17:30:58 | 000,001,656 | ---- | M] () -- C:\Windows\System32\ASOROSet.bin
[2013.02.01 19:42:52 | 000,002,370 | ---- | M] () -- C:\Users\Info\Desktop\Google Chrome.lnk
[2013.02.01 18:42:54 | 000,107,093 | ---- | M] () -- C:\Users\Info\Documents\1359727427_1_01.xml
[2013.01.30 20:15:23 | 000,028,507 | ---- | M] () -- C:\Users\Info\Documents\41434262.pdf
[2013.01.30 16:59:10 | 000,482,928 | ---- | M] (BitDefender) -- C:\Windows\System32\drivers\avckf.sys
[2013.01.30 16:58:59 | 000,625,128 | ---- | M] (BitDefender) -- C:\Windows\System32\drivers\avc3.sys
[2013.01.30 16:56:16 | 000,066,392 | ---- | M] (BitDefender SRL) -- C:\Windows\System32\drivers\bdsandbox.sys
[2013.01.29 17:38:37 | 000,000,385 | ---- | M] () -- C:\Windows\System32\user_gensett.xml
[2013.01.29 17:16:58 | 000,000,648 | ---- | M] () -- C:\Users\Info\Desktop\Scanner and Camera Wizard.lnk
[2013.01.29 15:59:56 | 001,652,485 | ---- | M] () -- C:\Users\Info\Documents\userguide.pdf
[2013.01.29 14:16:06 | 000,072,704 | ---- | M] (BitDefender) -- C:\Windows\System32\drivers\bdvedisk.sys
[2013.01.28 18:07:16 | 001,553,496 | ---- | M] () -- C:\ProgramData\1359390656.bdinstall.bin
[2013.01.28 18:00:07 | 000,253,404 | -H-- | M] () -- C:\bdr-ld01
[2013.01.28 18:00:07 | 000,009,216 | -H-- | M] () -- C:\bdr-ld01.mbr
[2013.01.28 18:00:07 | 000,000,308 | -H-- | M] () -- C:\bdr-cf01
[2013.01.28 17:59:52 | 000,002,126 | ---- | M] () -- C:\Users\Public\Desktop\Bitdefender Internet Security 2013.lnk
[2013.01.28 17:59:52 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_avchv_01009.Wdf
[2013.01.20 10:48:30 | 000,009,892 | ---- | M] () -- C:\Users\Info\Documents\vodafone-codes.odt
[2013.01.19 13:57:53 | 000,000,455 | ---- | M] () -- C:\Users\Info\Documents\Dokument.rtf
[2013.01.15 18:24:57 | 000,001,264 | ---- | M] () -- C:\Users\Info\Desktop\Free YouTube Download.lnk
[2013.01.15 15:49:14 | 000,445,034 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20130116-173755.backup
[2013.01.15 15:49:14 | 000,445,034 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2013.01.14 15:49:25 | 000,059,392 | R--- | M] () -- C:\Windows\System32\streamhlp.dll
[2013.01.13 12:56:09 | 000,000,017 | ---- | M] () -- C:\Users\Info\AppData\Local\resmon.resmoncfg
[2013.01.13 10:14:00 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.01.13 10:14:00 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.01.12 11:59:28 | 000,000,820 | ---- | M] () -- C:\Windows\wininit.ini
[2013.01.10 18:30:58 | 000,002,324 | ---- | M] () -- C:\Windows\epplauncher.mif
[2013.01.10 16:52:21 | 000,001,109 | ---- | M] () -- C:\Users\Info\Desktop\Mozilla Firefox.lnk
[2013.01.09 21:06:08 | 000,002,170 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2013.01.09 15:40:12 | 000,320,432 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.01.09 15:37:39 | 000,008,489 | ---- | M] () -- C:\Users\Info\Documents\Noch zu erledigen.odt
[2013.01.06 16:12:59 | 000,001,133 | ---- | M] () -- C:\Users\Info\Desktop\Pinball.lnk
 
========== Files Created - No Company Name ==========
 
[2013.02.04 20:45:42 | 014,386,176 | ---- | C] () -- C:\Users\Info\Documents\GTA - SanAndreas.exe
[2013.02.04 19:04:41 | 000,552,152 | ---- | C] () -- C:\Users\Info\Documents\partypass.pdf
[2013.02.04 17:36:17 | 000,000,992 | ---- | C] () -- C:\Users\Info\Documents\DLLkiller.lnk
[2013.02.04 17:34:12 | 000,147,456 | ---- | C] () -- C:\Windows\System32\BCBSMP50.BPL
[2013.02.04 16:57:29 | 000,000,787 | ---- | C] () -- C:\Users\Info\Desktop\adwcleaner.lnk
[2013.02.04 16:07:58 | 000,000,787 | ---- | C] () -- C:\Users\Info\Desktop\TDSS rootkit removing tool.lnk
[2013.02.02 19:42:23 | 000,001,656 | ---- | C] () -- C:\Windows\System32\ASOROSet.bin
[2013.02.01 18:45:06 | 000,107,093 | ---- | C] () -- C:\Users\Info\Documents\1359727427_1_01.xml
[2013.01.30 20:15:20 | 000,028,507 | ---- | C] () -- C:\Users\Info\Documents\41434262.pdf
[2013.01.29 17:38:37 | 000,000,385 | ---- | C] () -- C:\Windows\System32\user_gensett.xml
[2013.01.29 17:17:59 | 000,000,648 | ---- | C] () -- C:\Users\Info\Desktop\Scanner and Camera Wizard.lnk
[2013.01.29 15:59:53 | 001,652,485 | ---- | C] () -- C:\Users\Info\Documents\userguide.pdf
[2013.01.28 18:07:16 | 001,553,496 | ---- | C] () -- C:\ProgramData\1359390656.bdinstall.bin
[2013.01.28 18:00:07 | 000,000,308 | -H-- | C] () -- C:\bdr-cf01
[2013.01.28 18:00:07 | 000,000,308 | -H-- | C] () -- \bdr-cf01
[2013.01.28 17:59:52 | 000,002,126 | ---- | C] () -- C:\Users\Public\Desktop\Bitdefender Internet Security 2013.lnk
[2013.01.28 17:59:52 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_avchv_01009.Wdf
[2013.01.28 17:39:30 | 035,184,777 | -H-- | C] () -- C:\bdr-im01.gz
[2013.01.28 17:39:30 | 035,184,777 | -H-- | C] () -- \bdr-im01.gz
[2013.01.28 17:39:30 | 002,294,848 | -H-- | C] () -- C:\bdr-bz01
[2013.01.28 17:39:30 | 002,294,848 | -H-- | C] () -- \bdr-bz01
[2013.01.28 17:39:30 | 000,253,404 | -H-- | C] () -- C:\bdr-ld01
[2013.01.28 17:39:30 | 000,253,404 | -H-- | C] () -- \bdr-ld01
[2013.01.28 17:39:30 | 000,009,216 | -H-- | C] () -- C:\bdr-ld01.mbr
[2013.01.28 17:39:30 | 000,009,216 | -H-- | C] () -- \bdr-ld01.mbr
[2013.01.20 10:48:26 | 000,009,892 | ---- | C] () -- C:\Users\Info\Documents\vodafone-codes.odt
[2013.01.19 13:57:53 | 000,000,455 | ---- | C] () -- C:\Users\Info\Documents\Dokument.rtf
[2013.01.15 18:24:57 | 000,001,264 | ---- | C] () -- C:\Users\Info\Desktop\Free YouTube Download.lnk
[2013.01.14 15:49:03 | 000,059,392 | R--- | C] () -- C:\Windows\System32\streamhlp.dll
[2013.01.13 12:56:09 | 000,000,017 | ---- | C] () -- C:\Users\Info\AppData\Local\resmon.resmoncfg
[2013.01.10 18:30:58 | 000,002,324 | ---- | C] () -- C:\Windows\epplauncher.mif
[2013.01.10 16:51:58 | 000,001,109 | ---- | C] () -- C:\Users\Info\Desktop\Mozilla Firefox.lnk
[2013.01.10 16:51:52 | 000,001,121 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013.01.09 21:06:08 | 000,002,170 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2013.01.09 20:46:10 | 000,001,094 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.01.09 20:46:10 | 000,001,090 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.01.06 15:59:56 | 000,001,133 | ---- | C] () -- C:\Users\Info\Desktop\Pinball.lnk
[2013.01.01 14:37:00 | 005,746,780 | ---- | C] ( ) -- C:\Windows\System32\RTKISDBT.dll
[2012.12.29 19:05:53 | 000,000,820 | ---- | C] () -- C:\Windows\wininit.ini
[2012.12.18 14:54:52 | 000,000,000 | RHS- | C] () -- \MSDOS.SYS
[2012.12.18 14:54:52 | 000,000,000 | RHS- | C] () -- \IO.SYS
[2012.12.14 02:02:20 | 000,064,512 | ---- | C] () -- C:\Windows\System32\igdde32.dll
[2012.12.14 02:02:20 | 000,009,728 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2012.12.14 02:02:20 | 000,000,268 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2012.11.17 16:39:51 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2012.10.22 17:40:04 | 000,272,928 | ---- | C] () -- C:\Windows\System32\igvpkrng600.bin
[2012.10.22 17:39:46 | 000,963,452 | ---- | C] () -- C:\Windows\System32\igcodeckrng600.bin
[2012.10.22 17:39:44 | 000,094,208 | ---- | C] () -- C:\Windows\System32\IccLibDll.dll
[2012.10.03 17:15:43 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2012.10.03 17:14:43 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2012.09.29 10:40:45 | 000,000,557 | ---- | C] () -- \NetworkCfg.xml
[2012.09.27 11:25:26 | 2099,662,848 | -HS- | C] () -- \hiberfil.sys
[2012.08.13 10:08:08 | 000,014,217 | ---- | C] () -- C:\Program Files\readme.html
[2012.07.27 21:47:36 | 000,159,232 | ---- | C] () -- C:\Windows\System32\clinfo.exe
[2012.05.08 13:15:36 | 000,000,005 | ---- | C] () -- C:\Program Files\basis-link
[2011.09.15 02:11:16 | 001,048,576 | ---- | C] () -- C:\Windows\System32\syndata.bin
[2011.08.17 06:48:34 | 000,262,080 | ---- | C] () -- C:\Windows\System32\SynPS2.bin
[2011.05.09 17:19:48 | 000,246,804 | ---- | C] () -- C:\Windows\System32\drivers\AtherosBt.bin
[2011.02.11 22:23:34 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2009.07.14 03:04:04 | 000,000,024 | ---- | C] () -- \autoexec.bat
[2009.07.14 03:04:04 | 000,000,010 | ---- | C] () -- \config.sys
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2013.01.04 21:07:15 | 000,000,000 | ---D | M] -- C:\Users\All Users\1&1 Mail & Media GmbH
[2013.02.03 21:34:02 | 000,000,000 | ---D | M] -- C:\Users\All Users\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2013.01.04 11:30:14 | 000,000,000 | ---D | M] -- C:\Users\All Users\1und1InternetExplorerAddon
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\All Users\Anwendungsdaten
[2013.01.31 16:34:47 | 000,000,000 | ---D | M] -- C:\Users\All Users\BDLogging
[2013.01.28 18:00:38 | 000,000,000 | ---D | M] -- C:\Users\All Users\Bitdefender
[2013.01.14 18:51:40 | 000,000,000 | ---D | M] -- C:\Users\All Users\clp
[2012.12.18 16:34:38 | 000,000,000 | -H-D | M] -- C:\Users\All Users\Common Files
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\All Users\Desktop
[2013.01.04 11:30:12 | 000,000,000 | ---D | M] -- C:\Users\All Users\DesktopIcons
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\All Users\Dokumente
[2013.01.31 16:39:30 | 000,000,000 | ---D | M] -- C:\Users\All Users\Dumps
[2013.01.21 19:23:03 | 000,000,000 | ---D | M] -- C:\Users\All Users\EA Core
[2013.01.21 19:23:26 | 000,000,000 | ---D | M] -- C:\Users\All Users\Electronic Arts
[2013.01.14 19:16:39 | 000,000,000 | ---D | M] -- C:\Users\All Users\f-secure
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\All Users\Favoriten
[2012.12.28 22:58:50 | 000,000,000 | ---D | M] -- C:\Users\All Users\Freemake
[2013.01.13 11:01:55 | 000,000,000 | ---D | M] -- C:\Users\All Users\fssg
[2012.10.20 13:20:59 | 000,000,000 | ---D | M] -- C:\Users\All Users\MakeMusic
[2013.02.02 21:46:20 | 000,000,000 | ---D | M] -- C:\Users\All Users\Origin
[2012.12.28 21:13:22 | 000,000,000 | ---D | M] -- C:\Users\All Users\PC Drivers HeadQuarters
[2013.02.04 14:28:17 | 000,000,000 | ---D | M] -- C:\Users\All Users\SpeedMaxPc
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\All Users\Startmenü
[2012.09.27 20:04:57 | 000,000,000 | ---D | M] -- C:\Users\All Users\Synaptics
[2012.12.18 17:54:13 | 000,000,000 | ---D | M] -- C:\Users\All Users\TEMP
[2012.12.18 16:34:56 | 000,000,000 | ---D | M] -- C:\Users\All Users\TuneUp Software
[2013.01.04 21:05:42 | 000,000,000 | ---D | M] -- C:\Users\All Users\UUdb
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\All Users\Vorlagen
[2013.01.06 17:36:04 | 000,000,000 | ---D | M] -- C:\Users\All Users\Wincert
[2013.01.06 16:26:41 | 000,000,000 | -HSD | M] -- C:\Users\All Users\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Anwendungsdaten
[2009.07.14 03:37:05 | 000,000,000 | -H-D | M] -- C:\Users\Default\AppData
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Cookies
[2009.07.14 03:04:25 | 000,000,000 | R--D | M] -- C:\Users\Default\Desktop
[2012.09.27 11:32:36 | 000,000,000 | R--D | M] -- C:\Users\Default\Documents
[2009.07.14 03:04:25 | 000,000,000 | R--D | M] -- C:\Users\Default\Downloads
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Druckumgebung
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Eigene Dateien
[2009.07.14 03:04:25 | 000,000,000 | R--D | M] -- C:\Users\Default\Favorites
[2013.01.12 21:29:16 | 000,000,000 | R--D | M] -- C:\Users\Default\Links
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Lokale Einstellungen
[2009.07.14 03:04:25 | 000,000,000 | R--D | M] -- C:\Users\Default\Music
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Netzwerkumgebung
[2009.07.14 03:04:25 | 000,000,000 | R--D | M] -- C:\Users\Default\Pictures
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Recent
[2009.07.14 03:04:25 | 000,000,000 | ---D | M] -- C:\Users\Default\Saved Games
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\SendTo
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Startmenü
[2009.07.14 03:04:25 | 000,000,000 | R--D | M] -- C:\Users\Default\Videos
[2012.09.27 11:32:36 | 000,000,000 | -HSD | M] -- C:\Users\Default\Vorlagen
[2012.09.29 08:41:30 | 000,000,000 | ---D | M] -- C:\Users\Info\.LOGOComfort6.1
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Anwendungsdaten
[2013.01.30 18:12:08 | 000,000,000 | -H-D | M] -- C:\Users\Info\AppData
[2012.10.03 17:47:55 | 000,000,000 | R--D | M] -- C:\Users\Info\Contacts
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Cookies
[2013.02.04 17:32:56 | 000,000,000 | R--D | M] -- C:\Users\Info\Desktop
[2013.02.04 20:45:42 | 000,000,000 | R--D | M] -- C:\Users\Info\Documents
[2013.02.04 21:03:14 | 000,000,000 | R--D | M] -- C:\Users\Info\Downloads
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Druckumgebung
[2012.09.27 11:34:15 | 000,000,000 | -HSD | M] -- C:\Users\Info\Eigene Dateien
[2013.02.01 18:52:18 | 000,000,000 | R--D | M] -- C:\Users\Info\Favorites
[2012.09.29 08:38:24 | 000,000,000 | -H-D | M] -- C:\Users\Info\InstallAnywhere
[2013.01.05 19:27:44 | 000,000,000 | R--D | M] -- C:\Users\Info\Links
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Lokale Einstellungen
[2013.01.09 17:20:50 | 000,000,000 | R--D | M] -- C:\Users\Info\Music
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Netzwerkumgebung
[2013.02.03 15:14:43 | 000,000,000 | ---D | M] -- C:\Users\Info\Pavark
[2013.02.01 19:11:14 | 000,000,000 | R--D | M] -- C:\Users\Info\Pictures
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Recent
[2012.10.03 17:47:55 | 000,000,000 | R--D | M] -- C:\Users\Info\Saved Games
[2012.10.07 10:03:30 | 000,000,000 | R--D | M] -- C:\Users\Info\Searches
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\SendTo
[2013.01.12 21:29:22 | 000,000,000 | R--D | M] -- C:\Users\Info\SkyDrive
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Startmenü
[2013.01.19 10:08:21 | 000,000,000 | ---D | M] -- C:\Users\Info\Tracing
[2013.02.03 18:33:28 | 000,000,000 | R--D | M] -- C:\Users\Info\Videos
[2012.09.27 11:34:16 | 000,000,000 | -HSD | M] -- C:\Users\Info\Vorlagen
[2012.11.17 16:39:29 | 000,000,000 | ---D | M] -- C:\Users\Malisa\Desktop
[2013.02.04 19:19:24 | 000,000,000 | RH-D | M] -- C:\Users\Public\Desktop
[2012.10.20 15:03:02 | 000,000,000 | R--D | M] -- C:\Users\Public\Documents
[2009.07.14 05:41:57 | 000,000,000 | R--D | M] -- C:\Users\Public\Downloads
[2009.07.14 03:04:25 | 000,000,000 | RH-D | M] -- C:\Users\Public\Favorites
[2012.09.27 11:54:46 | 000,000,000 | RH-D | M] -- C:\Users\Public\Libraries
[2012.10.01 13:20:41 | 000,000,000 | R--D | M] -- C:\Users\Public\Music
[2009.07.14 05:41:57 | 000,000,000 | R--D | M] -- C:\Users\Public\Pictures
[2012.10.02 13:02:43 | 000,000,000 | R--D | M] -- C:\Users\Public\Recorded TV
[2009.07.14 05:41:57 | 000,000,000 | R--D | M] -- C:\Users\Public\Videos
 
========== Purity Check ==========
 
 

< End of report >
Code:
OTL Extras logfile created on: 04.02.2013 21:04:40 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Info\Downloads
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,61 Gb Total Physical Memory | 0,89 Gb Available Physical Memory | 34,29% Memory free
5,21 Gb Paging File | 3,61 Gb Available in Paging File | 69,25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 596,07 Gb Total Space | 523,95 Gb Free Space | 87,90% Space Free | Partition Type: NTFS
 
Computer Name: ALEXANDER-HP630 | User Name: Info | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- Reg Error: Key error. File not found
.js [@ = JSFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
.vbe [@ = VBEFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Opera\Opera.exe" "%1"
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
jsfile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
vbefile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
vbsfile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
wsffile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
Directory [AddToPlaylistApplianMP] -- "C:\Program Files\Applian Technologies\Applian FLV and Media Player\amp.exe" -I skins2 --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithApplianMP] -- "C:\Program Files\Applian Technologies\Applian FLV and Media Player\amp.exe" -I skins2 --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01DBE142-27E9-4773-A0CD-B304003A5DF7}" = lport=137 | protocol=17 | dir=in | app=system |
"{12F58715-4624-4FD1-B010-BDBB1E7B080E}" = rport=137 | protocol=17 | dir=out | app=system |
"{1D2089B8-89D0-4BA7-A5B4-8F155E15D214}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{224B05CF-0DBA-4484-A39E-0A09105D7DBC}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
"{32A2271E-7150-4DA8-8C6D-BEE0170453F2}" = lport=138 | protocol=17 | dir=in | app=system |
"{37CFFEA8-E16F-43E4-BF1A-F88551A92DE4}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{39748B89-9815-4550-B841-532E2154ACF6}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3D59763D-1ED3-4C74-BDFA-8A8FCC9FC525}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{3EB7CAEB-87BB-4EA0-B067-ACC73089BC53}" = rport=139 | protocol=6 | dir=out | app=system |
"{4361BAA7-7834-412A-9E44-1BA065BD74E0}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4839B456-FDA6-4BEB-8D20-3376989267D7}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{49BABFCE-DC11-4F95-ACBC-9C8BE5EDC36D}" = lport=139 | protocol=6 | dir=in | app=system |
"{4DE142EE-3AC5-4683-A93D-73C964D0A799}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{56A0396B-6F40-4055-A5C3-5063299FB17E}" = rport=138 | protocol=17 | dir=out | app=system |
"{66F5B08D-0A57-46B4-AA17-F10C3C22F759}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{8C8F29E3-63A1-4816-81E5-EE4150655CFB}" = lport=445 | protocol=6 | dir=in | app=system |
"{90695147-1B32-4BF1-929C-80FA22015799}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{A86F6B4F-9E54-4DB3-AA76-A0A683C3E610}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{AFC82FD5-38F0-4F3E-9E7D-057741979768}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C4066647-0930-4F92-AED6-7BFA6D998905}" = lport=10243 | protocol=6 | dir=in | app=system |
"{DA9D116C-FD54-4B46-894A-A888B8A50FAC}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
"{EAB4A630-A4D2-4BD4-8678-B51E957BE3FC}" = lport=2869 | protocol=6 | dir=in | app=system |
"{EFE6FD3C-175A-4490-963E-25D99B7C8EA2}" = rport=445 | protocol=6 | dir=out | app=system |
"{F5167275-B910-4332-8B20-73F7A0B8BBCF}" = rport=10243 | protocol=6 | dir=out | app=system |
"{FFA4C39C-5201-4494-9C67-A43E86E58075}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06D07C9B-2AD0-4369-AB48-298D5D18296B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{0AF7B335-6CF4-4D3E-8667-438F4A4EADDA}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{1253855C-B82A-4533-A923-299F385CEE73}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{15EA55BC-0D82-4443-B1D0-D1D174C8B98A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{3367344A-00FA-45DB-846E-477E214F9D96}" = protocol=17 | dir=in | app=c:\program files\arcsoft\totalmedia 3.5\totalmedia.exe |
"{36C659E4-9313-4E22-A9CA-B5B3FE55F6F6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{47A7770A-CDF0-42BE-B810-BC82EC215190}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4CF43D84-0084-43ED-B110-3D63EDF671BC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{4E9C997D-58B2-4974-9A3B-5B3FBC9FBDDD}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{56C412F1-E835-4D39-900E-6D379181359B}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{5E76D313-567F-495F-8B8C-24A65DD02DA5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6156A7B9-18E4-4FF5-AF53-F97D16C2D1AF}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{664CA150-E671-4567-90EC-299E6D3B4035}" = protocol=6 | dir=out | app=system |
"{791C8FDF-21B4-4874-B18A-F02E0285293E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{80C8EE46-FD19-483A-B00E-A9CCE3000760}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{8CC52C5F-AA3B-41D7-A1B7-203AA9B2C047}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{94D74F6B-79F1-46DB-A69A-A8B39BE3639D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AB6B0AAB-C44F-418A-969C-D4712E88839F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{ACE84729-F7CE-40F2-BBFE-1E21659DB267}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{C95F78A8-49C0-44EC-99C4-940067C828E7}" = protocol=6 | dir=in | app=c:\program files\arcsoft\totalmedia 3.5\totalmedia.exe |
"{DAD0094F-D544-4CED-A3C4-ECC5FD4C9F36}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{E72A7411-CB21-440F-B894-74A43100BFD3}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{E9182B6C-9065-48DF-8991-4E7BE3001FE6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{101A497C-7EF6-4001-834D-E5FA1C70FEFA}" = Bluetooth Win7 Suite
"{1845470B-EB14-4ABC-835B-E36C693DC07D}" = Skype™ 6.1
"{1B6C0E95-182C-48E0-9C4B-4F916308249C}" = iTunes
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{2C26B97F-698E-4E04-B398-8203B147859B}_is1" = TOPP Vorlagen-Druckstudio (5156)
"{33FFD86B-569C-9E8D-6659-A1F84D07CAD0}" = AMD Catalyst Install Manager
"{3877C901-7B90-4727-A639-B6ED2DD59D43}" = ESU for Microsoft Windows 7
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{53B17A98-5BF0-40BC-AAFF-850A357975AC}" = HP Quick Launch
"{6F545E5E-4595-11E2-93B6-B8AC6F97B88E}" = Google Earth
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74292F90-895A-4FC6-A692-9641532B1B63}" = ArcSoft TotalMedia 3.5
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.5) - Deutsch
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{BBBA20E0-D9F3-4C6F-83AC-D66EFC0BFA93}" = Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista
"{C1594429-8296-4652-BF54-9DBE4932A44C}" = Realtek PCIE Card Reader
"{CCE825DB-347A-4004-A186-5F4A6FDD8547}" = Apple Application Support
"{DDBB7C89-1A09-441E-AA0F-6AA465755C17}" = REALTEK DTV USB DEVICE
"{E2E7A0E8-77C4-495F-8FA3-63DAEDAA2DB3}" = F-Secure PSC Prerequisites
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{FCB3772C-B7D0-4933-B1A9-3707EBACC573}" = Intel(R) SDK for OpenCL - CPU Only Runtime Package
"1&1 Mail & Media GmbH 1und1InternetExplorerAddon" = WEB.DE Internet Explorer Addon
"1&1 Mail & Media GmbH 1und1Softwareaktualisierung" = WEB.DE Softwareaktualisierung
"1&1 Mail & Media GmbH Toolbar FF" = WEB.DE MailCheck für Mozilla Firefox
"1&1 Mail & Media GmbH Toolbar IE8" = WEB.DE MailCheck für Internet Explorer
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Applian FLV and Media Player" = Applian FLV and Media Player 3.1.1.12
"Bitdefender" = Bitdefender Internet Security 2013
"DLL Killer" = DLL Killer
"Finale NotePad 2012" = Finale NotePad 2012
"Free YouTube Download_is1" = Free YouTube Download version 3.1.42.1212
"Freemake Video Converter_is1" = Freemake Video Converter Version 3.2.0
"freeocr_is1" = FreeOCR v4.2
"LOGO!Soft Comfort V6.1" = LOGO!Soft Comfort V6.1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 18.0.1 (x86 de)" = Mozilla Firefox 18.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"SLABCOMM&10C4&EA60" = Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)
"SynTPDeinstKey" = Synaptics TouchPad Driver
"Two Worlds Pinball" = Two Worlds Pinball
"WinPcapInst" = WinPcap 4.1.2
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 02.02.2013 03:35:20 | Computer Name = Alexander-HP630 | Source = Google Update | ID = 20
Description =
 
Error - 02.02.2013 14:31:19 | Computer Name = Alexander-HP630 | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.
 
Error - 02.02.2013 14:33:00 | Computer Name = Alexander-HP630 | Source = MsiInstaller | ID = 11609
Description =
 
Error - 03.02.2013 12:32:20 | Computer Name = Alexander-HP630 | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.
 
Error - 03.02.2013 14:01:01 | Computer Name = Alexander-HP630 | Source = Windows Backup | ID = 4104
Description =
 
Error - 03.02.2013 16:34:46 | Computer Name = Alexander-HP630 | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.
 
Error - 04.02.2013 09:16:10 | Computer Name = Alexander-HP630 | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: jre-7u13-windows-i586-iftw.exe, Version:
 7.0.130.20, Zeitstempel: 0x51097186  Name des fehlerhaften Moduls: JavaIC.dll, Version:
 1.2.0.0, Zeitstempel: 0x503c027e  Ausnahmecode: 0xc0000417  Fehleroffset: 0x0000534b
ID
 des fehlerhaften Prozesses: 0x10f4  Startzeit der fehlerhaften Anwendung: 0x01ce02d995df7f45
Pfad
 der fehlerhaften Anwendung: C:\Users\Info\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
Pfad
 des fehlerhaften Moduls: C:\Users\Info\AppData\Local\Temp\JavaIC.dll  Berichtskennung:
 0a84688c-6ecd-11e2-b616-e4115bf9b2f0
 
Error - 04.02.2013 11:21:25 | Computer Name = Alexander-HP630 | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: TDSSKiller.exe, Version: 0.0.0.0,
 Zeitstempel: 0x4fe89d84  Name des fehlerhaften Moduls: BrowserProtect.dll_unloaded,
 Version: 0.0.0.0, Zeitstempel: 0x50f6d408  Ausnahmecode: 0xc0000005  Fehleroffset:
0x57e54f97  ID des fehlerhaften Prozesses: 0x11ac  Startzeit der fehlerhaften Anwendung:
 0x01ce02eaa3d0a079  Pfad der fehlerhaften Anwendung: C:\Users\Info\Desktop\Kaspersky
 TDSSKiller\TDSSKiller.exe  Pfad des fehlerhaften Moduls: BrowserProtect.dll  Berichtskennung:
 89603e59-6ede-11e2-b616-e4115bf9b2f0
 
Error - 04.02.2013 11:23:19 | Computer Name = Alexander-HP630 | Source = Microsoft-Windows-CAPI2 | ID = 512
Description = Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer"
 nicht initialisiert werden.  Details: Could not open the EventSystem service for query.

System
 Error: Element nicht gefunden.  .
 
Error - 04.02.2013 11:46:28 | Computer Name = Alexander-HP630 | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.
 
[ Media Center Events ]
Error - 03.12.2012 14:10:35 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 19:10:35 - Fehler beim Herstellen der Internetverbindung.  19:10:35
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 03.12.2012 14:10:44 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 19:10:40 - Fehler beim Herstellen der Internetverbindung.  19:10:40
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 04.12.2012 09:37:39 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 14:37:39 - Fehler beim Herstellen der Internetverbindung.  14:37:39
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 04.12.2012 09:37:47 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 14:37:44 - Fehler beim Herstellen der Internetverbindung.  14:37:44
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 05.12.2012 12:09:49 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 17:09:49 - Directory konnte nicht abgerufen werden (Fehler: Timeout
 für Vorgang überschritten) 
 
Error - 06.12.2012 11:54:39 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 16:54:39 - Fehler beim Herstellen der Internetverbindung.  16:54:39
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 06.12.2012 11:54:48 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 16:54:44 - Fehler beim Herstellen der Internetverbindung.  16:54:44
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 14.12.2012 10:40:37 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 15:40:37 - Fehler beim Herstellen der Internetverbindung.  15:40:37
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 14.12.2012 10:40:47 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 15:40:43 - Fehler beim Herstellen der Internetverbindung.  15:40:43
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 15.12.2012 15:52:47 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 20:52:47 - Fehler beim Herstellen der Internetverbindung.  20:52:47
-    Serververbindung konnte nicht hergestellt werden.. 
 
[ System Events ]
Error - 04.02.2013 12:09:24 | Computer Name = Alexander-HP630 | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
Error - 04.02.2013 12:09:25 | Computer Name = Alexander-HP630 | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
Error - 04.02.2013 12:09:25 | Computer Name = Alexander-HP630 | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
Error - 04.02.2013 12:09:26 | Computer Name = Alexander-HP630 | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
Error - 04.02.2013 12:09:26 | Computer Name = Alexander-HP630 | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
Error - 04.02.2013 12:12:15 | Computer Name = Alexander-HP630 | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80070643 fehlgeschlagen: Skype 5.10 für Windows (KB2727727)
 
Error - 04.02.2013 12:15:17 | Computer Name = Alexander-HP630 | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80070643 fehlgeschlagen: Skype 5.10 für Windows (KB2727727)
 
Error - 04.02.2013 12:16:20 | Computer Name = Alexander-HP630 | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80070643 fehlgeschlagen: Skype 5.10 für Windows (KB2727727)
 
Error - 04.02.2013 12:18:49 | Computer Name = Alexander-HP630 | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80070643 fehlgeschlagen: Skype 5.10 für Windows (KB2727727)
 
Error - 04.02.2013 12:44:17 | Computer Name = Alexander-HP630 | Source = DCOM | ID = 10010
Description =
 
 
< End of report >
Code:
OTL Extras logfile created on: 04.02.2013 21:04:40 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Info\Downloads
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,61 Gb Total Physical Memory | 0,89 Gb Available Physical Memory | 34,29% Memory free
5,21 Gb Paging File | 3,61 Gb Available in Paging File | 69,25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 596,07 Gb Total Space | 523,95 Gb Free Space | 87,90% Space Free | Partition Type: NTFS
 
Computer Name: ALEXANDER-HP630 | User Name: Info | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- Reg Error: Key error. File not found
.js [@ = JSFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
.vbe [@ = VBEFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Opera\Opera.exe" "%1"
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
jsfile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
vbefile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
vbsfile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
wsffile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
Directory [AddToPlaylistApplianMP] -- "C:\Program Files\Applian Technologies\Applian FLV and Media Player\amp.exe" -I skins2 --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithApplianMP] -- "C:\Program Files\Applian Technologies\Applian FLV and Media Player\amp.exe" -I skins2 --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01DBE142-27E9-4773-A0CD-B304003A5DF7}" = lport=137 | protocol=17 | dir=in | app=system |
"{12F58715-4624-4FD1-B010-BDBB1E7B080E}" = rport=137 | protocol=17 | dir=out | app=system |
"{1D2089B8-89D0-4BA7-A5B4-8F155E15D214}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{224B05CF-0DBA-4484-A39E-0A09105D7DBC}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
"{32A2271E-7150-4DA8-8C6D-BEE0170453F2}" = lport=138 | protocol=17 | dir=in | app=system |
"{37CFFEA8-E16F-43E4-BF1A-F88551A92DE4}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{39748B89-9815-4550-B841-532E2154ACF6}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3D59763D-1ED3-4C74-BDFA-8A8FCC9FC525}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{3EB7CAEB-87BB-4EA0-B067-ACC73089BC53}" = rport=139 | protocol=6 | dir=out | app=system |
"{4361BAA7-7834-412A-9E44-1BA065BD74E0}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4839B456-FDA6-4BEB-8D20-3376989267D7}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{49BABFCE-DC11-4F95-ACBC-9C8BE5EDC36D}" = lport=139 | protocol=6 | dir=in | app=system |
"{4DE142EE-3AC5-4683-A93D-73C964D0A799}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{56A0396B-6F40-4055-A5C3-5063299FB17E}" = rport=138 | protocol=17 | dir=out | app=system |
"{66F5B08D-0A57-46B4-AA17-F10C3C22F759}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{8C8F29E3-63A1-4816-81E5-EE4150655CFB}" = lport=445 | protocol=6 | dir=in | app=system |
"{90695147-1B32-4BF1-929C-80FA22015799}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{A86F6B4F-9E54-4DB3-AA76-A0A683C3E610}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{AFC82FD5-38F0-4F3E-9E7D-057741979768}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C4066647-0930-4F92-AED6-7BFA6D998905}" = lport=10243 | protocol=6 | dir=in | app=system |
"{DA9D116C-FD54-4B46-894A-A888B8A50FAC}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
"{EAB4A630-A4D2-4BD4-8678-B51E957BE3FC}" = lport=2869 | protocol=6 | dir=in | app=system |
"{EFE6FD3C-175A-4490-963E-25D99B7C8EA2}" = rport=445 | protocol=6 | dir=out | app=system |
"{F5167275-B910-4332-8B20-73F7A0B8BBCF}" = rport=10243 | protocol=6 | dir=out | app=system |
"{FFA4C39C-5201-4494-9C67-A43E86E58075}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06D07C9B-2AD0-4369-AB48-298D5D18296B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{0AF7B335-6CF4-4D3E-8667-438F4A4EADDA}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{1253855C-B82A-4533-A923-299F385CEE73}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{15EA55BC-0D82-4443-B1D0-D1D174C8B98A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{3367344A-00FA-45DB-846E-477E214F9D96}" = protocol=17 | dir=in | app=c:\program files\arcsoft\totalmedia 3.5\totalmedia.exe |
"{36C659E4-9313-4E22-A9CA-B5B3FE55F6F6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{47A7770A-CDF0-42BE-B810-BC82EC215190}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4CF43D84-0084-43ED-B110-3D63EDF671BC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{4E9C997D-58B2-4974-9A3B-5B3FBC9FBDDD}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{56C412F1-E835-4D39-900E-6D379181359B}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{5E76D313-567F-495F-8B8C-24A65DD02DA5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6156A7B9-18E4-4FF5-AF53-F97D16C2D1AF}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{664CA150-E671-4567-90EC-299E6D3B4035}" = protocol=6 | dir=out | app=system |
"{791C8FDF-21B4-4874-B18A-F02E0285293E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{80C8EE46-FD19-483A-B00E-A9CCE3000760}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{8CC52C5F-AA3B-41D7-A1B7-203AA9B2C047}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{94D74F6B-79F1-46DB-A69A-A8B39BE3639D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AB6B0AAB-C44F-418A-969C-D4712E88839F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{ACE84729-F7CE-40F2-BBFE-1E21659DB267}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{C95F78A8-49C0-44EC-99C4-940067C828E7}" = protocol=6 | dir=in | app=c:\program files\arcsoft\totalmedia 3.5\totalmedia.exe |
"{DAD0094F-D544-4CED-A3C4-ECC5FD4C9F36}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{E72A7411-CB21-440F-B894-74A43100BFD3}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{E9182B6C-9065-48DF-8991-4E7BE3001FE6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{101A497C-7EF6-4001-834D-E5FA1C70FEFA}" = Bluetooth Win7 Suite
"{1845470B-EB14-4ABC-835B-E36C693DC07D}" = Skype™ 6.1
"{1B6C0E95-182C-48E0-9C4B-4F916308249C}" = iTunes
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{2C26B97F-698E-4E04-B398-8203B147859B}_is1" = TOPP Vorlagen-Druckstudio (5156)
"{33FFD86B-569C-9E8D-6659-A1F84D07CAD0}" = AMD Catalyst Install Manager
"{3877C901-7B90-4727-A639-B6ED2DD59D43}" = ESU for Microsoft Windows 7
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{53B17A98-5BF0-40BC-AAFF-850A357975AC}" = HP Quick Launch
"{6F545E5E-4595-11E2-93B6-B8AC6F97B88E}" = Google Earth
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74292F90-895A-4FC6-A692-9641532B1B63}" = ArcSoft TotalMedia 3.5
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.5) - Deutsch
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{BBBA20E0-D9F3-4C6F-83AC-D66EFC0BFA93}" = Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista
"{C1594429-8296-4652-BF54-9DBE4932A44C}" = Realtek PCIE Card Reader
"{CCE825DB-347A-4004-A186-5F4A6FDD8547}" = Apple Application Support
"{DDBB7C89-1A09-441E-AA0F-6AA465755C17}" = REALTEK DTV USB DEVICE
"{E2E7A0E8-77C4-495F-8FA3-63DAEDAA2DB3}" = F-Secure PSC Prerequisites
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{FCB3772C-B7D0-4933-B1A9-3707EBACC573}" = Intel(R) SDK for OpenCL - CPU Only Runtime Package
"1&1 Mail & Media GmbH 1und1InternetExplorerAddon" = WEB.DE Internet Explorer Addon
"1&1 Mail & Media GmbH 1und1Softwareaktualisierung" = WEB.DE Softwareaktualisierung
"1&1 Mail & Media GmbH Toolbar FF" = WEB.DE MailCheck für Mozilla Firefox
"1&1 Mail & Media GmbH Toolbar IE8" = WEB.DE MailCheck für Internet Explorer
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Applian FLV and Media Player" = Applian FLV and Media Player 3.1.1.12
"Bitdefender" = Bitdefender Internet Security 2013
"DLL Killer" = DLL Killer
"Finale NotePad 2012" = Finale NotePad 2012
"Free YouTube Download_is1" = Free YouTube Download version 3.1.42.1212
"Freemake Video Converter_is1" = Freemake Video Converter Version 3.2.0
"freeocr_is1" = FreeOCR v4.2
"LOGO!Soft Comfort V6.1" = LOGO!Soft Comfort V6.1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 18.0.1 (x86 de)" = Mozilla Firefox 18.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"SLABCOMM&10C4&EA60" = Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)
"SynTPDeinstKey" = Synaptics TouchPad Driver
"Two Worlds Pinball" = Two Worlds Pinball
"WinPcapInst" = WinPcap 4.1.2
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3437191235-2556486254-1160177188-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 02.02.2013 03:35:20 | Computer Name = Alexander-HP630 | Source = Google Update | ID = 20
Description =
 
Error - 02.02.2013 14:31:19 | Computer Name = Alexander-HP630 | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.
 
Error - 02.02.2013 14:33:00 | Computer Name = Alexander-HP630 | Source = MsiInstaller | ID = 11609
Description =
 
Error - 03.02.2013 12:32:20 | Computer Name = Alexander-HP630 | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.
 
Error - 03.02.2013 14:01:01 | Computer Name = Alexander-HP630 | Source = Windows Backup | ID = 4104
Description =
 
Error - 03.02.2013 16:34:46 | Computer Name = Alexander-HP630 | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.
 
Error - 04.02.2013 09:16:10 | Computer Name = Alexander-HP630 | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: jre-7u13-windows-i586-iftw.exe, Version:
 7.0.130.20, Zeitstempel: 0x51097186  Name des fehlerhaften Moduls: JavaIC.dll, Version:
 1.2.0.0, Zeitstempel: 0x503c027e  Ausnahmecode: 0xc0000417  Fehleroffset: 0x0000534b
ID
 des fehlerhaften Prozesses: 0x10f4  Startzeit der fehlerhaften Anwendung: 0x01ce02d995df7f45
Pfad
 der fehlerhaften Anwendung: C:\Users\Info\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
Pfad
 des fehlerhaften Moduls: C:\Users\Info\AppData\Local\Temp\JavaIC.dll  Berichtskennung:
 0a84688c-6ecd-11e2-b616-e4115bf9b2f0
 
Error - 04.02.2013 11:21:25 | Computer Name = Alexander-HP630 | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: TDSSKiller.exe, Version: 0.0.0.0,
 Zeitstempel: 0x4fe89d84  Name des fehlerhaften Moduls: BrowserProtect.dll_unloaded,
 Version: 0.0.0.0, Zeitstempel: 0x50f6d408  Ausnahmecode: 0xc0000005  Fehleroffset:
0x57e54f97  ID des fehlerhaften Prozesses: 0x11ac  Startzeit der fehlerhaften Anwendung:
 0x01ce02eaa3d0a079  Pfad der fehlerhaften Anwendung: C:\Users\Info\Desktop\Kaspersky
 TDSSKiller\TDSSKiller.exe  Pfad des fehlerhaften Moduls: BrowserProtect.dll  Berichtskennung:
 89603e59-6ede-11e2-b616-e4115bf9b2f0
 
Error - 04.02.2013 11:23:19 | Computer Name = Alexander-HP630 | Source = Microsoft-Windows-CAPI2 | ID = 512
Description = Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer"
 nicht initialisiert werden.  Details: Could not open the EventSystem service for query.

System
 Error: Element nicht gefunden.  .
 
Error - 04.02.2013 11:46:28 | Computer Name = Alexander-HP630 | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.
 
[ Media Center Events ]
Error - 03.12.2012 14:10:35 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 19:10:35 - Fehler beim Herstellen der Internetverbindung.  19:10:35
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 03.12.2012 14:10:44 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 19:10:40 - Fehler beim Herstellen der Internetverbindung.  19:10:40
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 04.12.2012 09:37:39 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 14:37:39 - Fehler beim Herstellen der Internetverbindung.  14:37:39
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 04.12.2012 09:37:47 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 14:37:44 - Fehler beim Herstellen der Internetverbindung.  14:37:44
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 05.12.2012 12:09:49 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 17:09:49 - Directory konnte nicht abgerufen werden (Fehler: Timeout
 für Vorgang überschritten) 
 
Error - 06.12.2012 11:54:39 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 16:54:39 - Fehler beim Herstellen der Internetverbindung.  16:54:39
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 06.12.2012 11:54:48 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 16:54:44 - Fehler beim Herstellen der Internetverbindung.  16:54:44
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 14.12.2012 10:40:37 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 15:40:37 - Fehler beim Herstellen der Internetverbindung.  15:40:37
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 14.12.2012 10:40:47 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 15:40:43 - Fehler beim Herstellen der Internetverbindung.  15:40:43
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 15.12.2012 15:52:47 | Computer Name = Alexander-PC | Source = MCUpdate | ID = 0
Description = 20:52:47 - Fehler beim Herstellen der Internetverbindung.  20:52:47
-    Serververbindung konnte nicht hergestellt werden.. 
 
[ System Events ]
Error - 04.02.2013 12:09:24 | Computer Name = Alexander-HP630 | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
Error - 04.02.2013 12:09:25 | Computer Name = Alexander-HP630 | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
Error - 04.02.2013 12:09:25 | Computer Name = Alexander-HP630 | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
Error - 04.02.2013 12:09:26 | Computer Name = Alexander-HP630 | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
Error - 04.02.2013 12:09:26 | Computer Name = Alexander-HP630 | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
Error - 04.02.2013 12:12:15 | Computer Name = Alexander-HP630 | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80070643 fehlgeschlagen: Skype 5.10 für Windows (KB2727727)
 
Error - 04.02.2013 12:15:17 | Computer Name = Alexander-HP630 | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80070643 fehlgeschlagen: Skype 5.10 für Windows (KB2727727)
 
Error - 04.02.2013 12:16:20 | Computer Name = Alexander-HP630 | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80070643 fehlgeschlagen: Skype 5.10 für Windows (KB2727727)
 
Error - 04.02.2013 12:18:49 | Computer Name = Alexander-HP630 | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80070643 fehlgeschlagen: Skype 5.10 für Windows (KB2727727)
 
Error - 04.02.2013 12:44:17 | Computer Name = Alexander-HP630 | Source = DCOM | ID = 10010
Description =
 
 
< End of report >
Hab glaub aus versehen alles 2mal reingepostet
sry

cosinus 04.02.2013 22:01
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes - denk bitte vorher daran, Malwarebytes über den Updatebutton zu aktualisieren

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


duddl 04.02.2013 22:29
Code:
Malwarebytes Anti-Malware (Test) 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.02.04.08

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Info :: ALEXANDER-HP630 [Administrator]

Schutz: Deaktiviert

04.02.2013 22:09:32
mbam-log-2013-02-04 (22-09-32).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 205877
Laufzeit: 20 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

cosinus 04.02.2013 22:37
Fehlt noch ESET...das dauert etwas länger das Tool, melde dich einfach wenn du das LOg hast und poste es auch dann

duddl 05.02.2013 15:40
ja mach ich aber das geht ja wirklich sehr langsam manchmal scannt es auch gar nicht

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6889
# api_version=3.0.2
# EOSSerial=1e4893a7b628994a8a698e1fc6842ef6
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-02-05 01:01:52
# local_time=2013-02-05 02:01:52 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 678915 111700503 0 0
# scanned=5071
# found=0
# cleaned=0
# scan_time=56773
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6889
# api_version=3.0.2
# EOSSerial=1e4893a7b628994a8a698e1fc6842ef6
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-02-05 07:06:44
# local_time=2013-02-05 08:06:44 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=5893 16776574 100 94 704407 111722395 0 0
# scanned=101398
# found=0
# cleaned=0
# scan_time=21516

cosinus 06.02.2013 09:31
Sieht soweit ok aus

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

duddl 06.02.2013 14:28
Gibt es auch noch ein Programm gegen cokkies für google chrome?
Ich benutze fast nur diesen

cosinus 06.02.2013 14:39
Weiß ich nicht. Chrome benutze ich fast garnicht. :p

duddl 06.02.2013 16:24
Ok auf jeden Fall danke für alles.

Ich habe jedoch noch ein Problem: Immer wenn der PC hochgefahren ist, kommt von Bitdefender die Meldung "bösartige Anwendung gefunden" und zeigt mir folgenden Ordner an:
"Die Anwendung C:/Users/Info/AppData/Roaming/SSync/SSync.exe wurde als möglicherweise schädlich erkannt."

Diesen Ordner finde ich aber nie. Ist der wirklich gefährlich?

cosinus 06.02.2013 16:39
http://www.trojaner-board.de/59624-a...-sichtbar.html

Dann solltest du die Datei auch sehen

duddl 06.02.2013 16:59
das ssync.exe ist aber nicht zu finden ist das denn gefährlich oder schädlich?

cosinus 06.02.2013 21:12
Lässt sich nicht eindeutig sagen. Man kann jeder Datei einen beliebigen Dateinamen verpassen.
Wenn sie nicht zu finden ist, wurde sie schon gelöscht oder du lässt dir immer noch nicht alle Objekte anzeigen. Ist denn zumindest der Ordner C:/Users/Info/AppData/Roaming/SSync/ für dich sichtbar?

duddl 07.02.2013 14:12
nein ich weiß auch nicht wie man danach sucht.

cosinus 07.02.2013 14:15
Ja, die Windows-Suchefunktion ist schon wirklich fies versteckt :rofl:

Wenn du den Ordner nicht siehst, dann ist er entweder nicht mehr da oder du lässt dir nicht alle Dateien anzeigen. Mehr Möglichkeiten gibt es nicht, abgesehen von...ähm das erzähl ich lieber ein anderes mal :pfeiff:

duddl 07.02.2013 19:43
ja ich weiß nicht ganz genau wie man nach ordnern sucht und ich finde das ssync wirklich nicht aber ich möchte es löschen

cosinus 08.02.2013 12:16
Warum willst du es löschen? Du weiß doch nichtmal ob es tatsächlich ein Schädling ist :wtf:
Schonmal davon gehört, dass Virenscanner Fehlalarme haben?

Botte mal von einer Live-CD wie zB Xubuntu im Probiermodu. Schau darüber nach der Ordner und die Datei existieren. Anleitung von Markus K. (mmk) zB da => http://www.trojaner-board.de/82533-d...ted-magic.html

duddl 09.02.2013 13:47
Bei jedem Windows Start kommt die Warnung, dass diese Datei auf die dnscache zugreifen will und dass es meinem PC schaden könnte.

cosinus 11.02.2013 08:43
Schön und weiter?!
Was ist mit meiner anderen Anweisung?


Alle Zeitangaben in WEZ +1. Es ist jetzt 17:19 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19