Trojaner-Board
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   BKA/GVU-Virus vollständig entfernen (https://www.trojaner-board.de/131227-bka-gvu-virus-vollstaendig-entfernen.html)

Jamal 18.02.2013 19:22
BKA/GVU-Virus vollständig entfernen
 
Hallo Trojaner-Board-Team.

Habe mir Ende letzter Woche über wetter.com den bekannten GVU/BKA-Trojaner eingefangen. Gestern startete ich einen ersten Versuch den Rechner zu "desinfizieren" und habe folgende Schritte durchgeführt:
1. Da Abgesicherter Modus automatisch heruntergefahren wurde über das Tool "System reparieren" bei Systemstart wurde der PC auf einen früheren Termin zurückgesetzt.
2. Nachdem damit das "Hauptsymptom" (der geblockte Desktop) behoben war habe ich mit Malwarebytes Anti-Malware, adwcleaner und ComboFix sowie eines komplett Systemchecks mit Antivir versucht den PC zu entseuchen.

(Die Logs von Antivir, mbam und Combofix sind vorhanden)

Anschließend spielte ich ca. 140 Windows-Updates auf den Rechner. (Die leider etwas vernachlässigt wurden)

Das ganze war anscheinend nicht von Erfolg gekrönt, heute meldete die Firewall einen geblockten Prozesse: idfa.exe aus dem Ordner C Appdata/Roaming. Ein erneuter Check mit mbam Ergab 8 Funde (Log vorhanden).

Um forenkonform zu bleiben habe ich nun Defogger, OTL und GMER ausgeführt, die Logs im Folgenden:OTL Logfile:
Code:
OTL logfile created on: 18.02.2013 18:13:30 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\pc\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,99 Gb Total Physical Memory | 7,71 Gb Available Physical Memory | 85,77% Memory free
17,98 Gb Paging File | 16,59 Gb Available in Paging File | 92,25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 916,86 Gb Total Space | 687,44 Gb Free Space | 74,98% Space Free | Partition Type: NTFS
Drive I: | 7,70 Gb Total Space | 1,60 Gb Free Space | 20,85% Space Free | Partition Type: FAT32
 
Computer Name: PC-PC | User Name: pc | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.02.18 18:02:48 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\pc\Desktop\OTL.exe
PRC - [2013.02.17 18:28:47 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2013.02.17 18:28:04 | 000,385,248 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.02.17 18:28:04 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2013.01.19 20:01:35 | 000,281,224 | ---- | M] (Quick Heal Technologies Pvt. Ltd.) -- C:\Users\pc\AppData\Roaming\Tuyf\idfa.exe
PRC - [2012.10.10 21:23:42 | 001,258,856 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2011.06.28 13:58:32 | 002,345,984 | ---- | M] (Koninklijke Philips Electronics N.V.) -- C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe
PRC - [2010.06.21 10:14:30 | 000,308,736 | ---- | M] () -- C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2010.06.21 10:14:30 | 000,308,736 | ---- | M] () -- C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe
 
 
========== Services (SafeList) ==========
 
SRV - [2013.02.17 18:28:47 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.02.17 18:28:04 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.10.10 21:23:42 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2010.09.21 13:49:00 | 002,286,976 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013.02.17 18:29:13 | 000,129,216 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2013.02.17 18:29:13 | 000,027,800 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2013.02.17 18:29:12 | 000,099,912 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 07:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2010.09.16 18:33:42 | 001,918,976 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athurx.sys -- (athur)
DRV:64bit: - [2010.06.26 10:23:39 | 000,834,544 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2010.02.08 04:45:06 | 000,024,064 | ---- | M] (WiFi Media Connect) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wfmcvad.sys -- (WFMC_VAD)
DRV:64bit: - [2009.07.14 02:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009.07.14 02:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:35:02 | 000,281,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1y60x64.sys -- (e1yexpress)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.03 00:58:24 | 000,507,392 | ---- | M] (ITETech                  ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AF15BDA.sys -- (AF15BDA)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = BC 90 9F 0A 50 3A CB 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_110.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Users\pc\AppData\Local\Google\Google Earth\plugin\npgeplugin.dll (Google)
 
 
[2012.11.06 21:03:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\pc\AppData\Roaming\mozilla\Firefox\Profiles\0\extensions
[2012.11.06 21:03:55 | 000,214,127 | ---- | M] () (No name found) -- C:\Users\pc\AppData\Roaming\mozilla\firefox\profiles\0\extensions\freehdsport@freehdsport.tv.xpi
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.de/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - homepage: hxxp://www.google.de/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.250.6 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U25 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Users\pc\AppData\Local\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll
CHR - Extension: Google Drive = C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Mail = C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2013.02.17 18:02:11 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKCU..\Run: [Ysydyvagig] C:\Users\pc\AppData\Roaming\Tuyf\idfa.exe (Quick Heal Technologies Pvt. Ltd.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{35F4AA8F-2F60-4825-803F-85B0950A4145}: DhcpNameServer = 134.93.48.210 134.93.48.196
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E8A1D9CF-AD92-4CA0-99BB-D5A129FCC3B5}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.02.18 18:08:11 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\pc\Desktop\OTL.exe
[2013.02.18 17:42:45 | 000,000,000 | ---D | C] -- C:\Users\pc\AppData\Roaming\Ufyq
[2013.02.18 17:42:45 | 000,000,000 | ---D | C] -- C:\Users\pc\AppData\Roaming\Tuyf
[2013.02.18 17:42:45 | 000,000,000 | ---D | C] -- C:\Users\pc\AppData\Roaming\Siyhas
[2013.02.18 17:42:23 | 000,076,400 | ---- | C] (Quick Heal Technologies Pvt. Ltd.) -- C:\Users\pc\AppData\Roaming\kb3.exe
[2013.02.17 21:13:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2013.02.17 19:14:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation
[2013.02.17 18:39:22 | 000,000,000 | ---D | C] -- C:\Users\pc\AppData\Roaming\Avira
[2013.02.17 18:33:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2013.02.17 18:33:48 | 000,129,216 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.02.17 18:33:48 | 000,099,912 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.02.17 18:33:48 | 000,027,800 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.02.17 18:33:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2013.02.17 18:33:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2013.02.17 18:09:58 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.02.17 18:03:24 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013.02.17 17:56:47 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.02.17 17:56:47 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.02.17 17:56:47 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.02.17 17:56:12 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.02.17 17:55:58 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.02.17 17:40:37 | 000,000,000 | ---D | C] -- C:\Users\pc\AppData\Roaming\Malwarebytes
[2013.02.17 17:40:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.02.17 17:40:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.02.17 17:40:28 | 000,024,176 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.02.17 17:40:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013.02.17 17:39:29 | 000,000,000 | ---D | C] -- C:\Users\pc\AppData\Local\Programs
[2013.02.17 17:38:54 | 000,000,000 | ---D | C] -- C:\Users\pc\Desktop\antivirusproggis
[2013.02.14 16:36:04 | 000,000,000 | ---D | C] -- C:\Users\pc\AppData\Roaming\Zuew
[2013.02.01 12:36:25 | 000,000,000 | ---D | C] -- C:\Users\pc\AppData\Local\Cyberlink
[2013.02.01 12:36:24 | 000,000,000 | ---D | C] -- C:\Users\pc\Documents\My Videos
[2013.02.01 12:35:12 | 000,000,000 | ---D | C] -- C:\ProgramData\CyberLink
[2013.02.01 12:35:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Nikon
[2013.02.01 12:35:07 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PhotoDirector 3
[2013.02.01 12:34:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CyberLink
[2013.02.01 12:33:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Temp
[2013.02.01 12:33:41 | 000,000,000 | ---D | C] -- C:\ProgramData\install_clap
 
========== Files - Modified Within 30 Days ==========
 
[2013.02.18 18:15:00 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.02.18 18:11:10 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.02.18 18:10:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.02.18 18:10:43 | 2945,847,295 | -HS- | M] () -- C:\hiberfil.sys
[2013.02.18 18:09:57 | 000,014,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.18 18:09:57 | 000,014,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.18 18:09:23 | 000,000,020 | ---- | M] () -- C:\Users\pc\defogger_reenable
[2013.02.18 18:09:06 | 001,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.02.18 18:09:06 | 000,643,628 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.02.18 18:09:06 | 000,606,992 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.02.18 18:09:06 | 000,126,188 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.02.18 18:09:06 | 000,103,370 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.02.18 18:02:48 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\pc\Desktop\OTL.exe
[2013.02.18 18:02:16 | 000,050,477 | ---- | M] () -- C:\Users\pc\Desktop\Defogger.exe
[2013.02.18 17:42:23 | 000,076,400 | ---- | M] (Quick Heal Technologies Pvt. Ltd.) -- C:\Users\pc\AppData\Roaming\kb3.exe
[2013.02.17 21:10:44 | 000,416,336 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.02.17 19:20:28 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.02.17 19:20:28 | 000,072,822 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2013.02.17 18:33:59 | 000,001,994 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.02.17 18:29:13 | 000,129,216 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.02.17 18:29:13 | 000,027,800 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.02.17 18:29:12 | 000,099,912 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.02.17 18:02:11 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.02.17 17:40:29 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.02.09 16:48:21 | 003,918,396 | ---- | M] () -- C:\Users\pc\Desktop\IMG_6538.JPG
[2013.02.01 12:35:07 | 000,001,505 | ---- | M] () -- C:\Users\Public\Desktop\CyberLink PhotoDirector 3.lnk
[2013.01.23 21:11:03 | 001,140,736 | ---- | M] () -- C:\Users\pc\Desktop\GetAttachment.pot
 
========== Files Created - No Company Name ==========
 
[2013.02.18 18:09:22 | 000,000,020 | ---- | C] () -- C:\Users\pc\defogger_reenable
[2013.02.18 18:08:18 | 000,050,477 | ---- | C] () -- C:\Users\pc\Desktop\Defogger.exe
[2013.02.17 19:39:31 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2013.02.17 19:20:28 | 000,072,822 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.02.17 19:20:28 | 000,072,822 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2013.02.17 19:06:23 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2013.02.17 18:33:59 | 000,001,994 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.02.17 17:56:47 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.02.17 17:56:47 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.02.17 17:56:47 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.02.17 17:56:47 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.02.17 17:56:47 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.02.17 17:40:29 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.02.09 16:48:20 | 003,918,396 | ---- | C] () -- C:\Users\pc\Desktop\IMG_6538.JPG
[2013.02.01 12:35:07 | 000,001,505 | ---- | C] () -- C:\Users\Public\Desktop\CyberLink PhotoDirector 3.lnk
[2013.01.23 21:11:03 | 001,140,736 | ---- | C] () -- C:\Users\pc\Desktop\GetAttachment.pot
[2011.04.28 16:41:59 | 000,000,600 | ---- | C] () -- C:\Users\pc\AppData\Local\PUTTY.RND
[2010.12.10 00:24:42 | 000,007,602 | ---- | C] () -- C:\Users\pc\AppData\Local\Resmon.ResmonCfg
[2010.06.18 16:27:02 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:30:56 | 014,165,504 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 02:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2010.06.26 10:36:36 | 000,000,000 | ---D | M] -- C:\Users\pc\AppData\Roaming\DAEMON Tools Lite
[2010.08.15 18:27:58 | 000,000,000 | ---D | M] -- C:\Users\pc\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.04.24 23:35:02 | 000,000,000 | ---D | M] -- C:\Users\pc\AppData\Roaming\FileZilla
[2012.02.16 18:58:10 | 000,000,000 | ---D | M] -- C:\Users\pc\AppData\Roaming\ICQ
[2008.04.26 10:38:56 | 000,000,000 | ---D | M] -- C:\Users\pc\AppData\Roaming\Opera
[2013.02.18 17:42:45 | 000,000,000 | ---D | M] -- C:\Users\pc\AppData\Roaming\Siyhas
[2013.02.18 17:42:45 | 000,000,000 | ---D | M] -- C:\Users\pc\AppData\Roaming\Tuyf
[2013.02.18 17:43:16 | 000,000,000 | ---D | M] -- C:\Users\pc\AppData\Roaming\Ufyq
[2011.10.23 20:42:15 | 000,000,000 | ---D | M] -- C:\Users\pc\AppData\Roaming\XBMC
[2013.02.17 16:25:18 | 000,000,000 | ---D | M] -- C:\Users\pc\AppData\Roaming\Zuew
 
========== Purity Check ==========
 
 

< End of report >
--- --- ---




Ich hoffe die Angaben sind vollständig.

Vielen Dank schonmal im Voraus für die Hilfe,

Mit freundlichen Grüßen,
Jamal

Der OTL Extras Log:

OTL EXTRAS Logfile:
OTL Logfile:
Code:
OTL Extras logfile created on: 18.02.2013 18:13:30 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\pc\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,99 Gb Total Physical Memory | 7,71 Gb Available Physical Memory | 85,77% Memory free
17,98 Gb Paging File | 16,59 Gb Available in Paging File | 92,25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 916,86 Gb Total Space | 687,44 Gb Free Space | 74,98% Space Free | Partition Type: NTFS
Drive I: | 7,70 Gb Total Space | 1,60 Gb Free Space | 20,85% Space Free | Partition Type: FAT32
 
Computer Name: PC-PC | User Name: pc | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
.jse[@ = JSEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.wsf[@ = WSFFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.jse [@ = JSEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files (x86)\Opera\opera.exe" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
wsffile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files (x86)\Opera\opera.exe" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
wsffile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{167035DE-E9B7-410F-BED0-A9559097AAD4}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4D5EEA2B-5E56-44AE-9A93-8E5C016B3055}" = rport=10243 | protocol=6 | dir=out | app=system |
"{4F103CEB-D44D-427E-8AD2-67D04DFD1D60}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{57CCBB38-5B99-4800-A6BB-441DA9983537}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{600061AF-5E78-43CD-87E6-19D00B120536}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{601FFEAF-C4EE-429E-9DA2-49504B1188A4}" = lport=2869 | protocol=6 | dir=in | app=system |
"{6934D9E5-30E1-4524-A0AF-F529EED228C0}" = lport=10243 | protocol=6 | dir=in | app=system |
"{6C6A2413-AE74-4462-ADE9-B5112AC33C44}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{6EF012DB-F973-4B35-A2C7-C119C16B5E60}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{795D1175-58AF-4483-A546-9C2447B0E285}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8322DD19-2F01-4351-A019-79FC550DE0D4}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |
"{8DC9A4CB-CB05-4F5A-BE5F-66D462BA23E8}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{9D2A8C88-AF87-41F8-8DEB-8E98C08F14B9}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A077629F-FAE7-4F2E-9E5A-E96CE81C8B2E}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{A23FC620-19B8-403B-A2A2-B9ED59C9A940}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AA935FC8-124F-443D-A94A-A8A77C4452AD}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B6929ADC-A628-44BF-B38F-84EA7200662E}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{C8758779-492D-4037-B236-1FEC80750631}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D5D28E66-F00D-4215-83FC-CB46D2680206}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F82DB053-1BEE-4D91-830B-23BD4E1E179F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00BD609B-38C8-4E9C-BF9F-5F8F8BF28FFB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{060498C4-763C-4E99-B70C-133409A1C84B}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe |
"{0790550A-FAD9-4154-BADF-18B7DCBB65CA}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{07E4848E-6B47-49F5-8E33-8390DC11CCB7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1547F9D4-4E23-41B6-B099-8EDF87930457}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{15CA6C37-619A-46BD-983D-372BE410801A}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{17879ABD-4604-4CE2-A1C1-D0CDC212683A}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{1C10CF8C-C400-46B1-B11F-FE3FF13E6549}" = protocol=6 | dir=in | app=c:\program files (x86)\philips\wi-fi mediaconnect\wi-fi mediaconnect.exe |
"{1CB5199B-E7EB-4208-A432-5B1BEFC9F474}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{240AB0E2-FEE8-4D9D-977D-A963B83C8410}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe |
"{26B29C07-4749-4A82-960C-2D86B51AB131}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{2B32C4FB-3BC8-42F9-8568-B614E63D4487}" = protocol=6 | dir=out | app=system |
"{31B9EF43-D4EF-446E-93A0-267A099238E7}" = protocol=1 | dir=out | name=winulum |
"{32960A06-08C7-459E-B722-27BCE98879E9}" = protocol=17 | dir=in | app=c:\program files (x86)\arcsoft\totalmedia 3\totalmedia.exe |
"{352BF790-355E-4FE0-8563-25F774490BF8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3574BDFA-632F-4F01-8D91-AE8285110075}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{42D6DBB7-844F-42EF-B9F7-6C8F16B2C6A0}" = protocol=6 | dir=in | app=c:\program files (x86)\arcsoft\totalmedia 3\totalmedia.exe |
"{43F2D7D0-5C84-40E0-AE64-49873475295E}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{4BBBFE14-2231-4B8F-8327-79F79CA2006D}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe |
"{57393FE5-35E1-496B-AB20-C3E5B3870703}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{5A517A47-8F75-4581-88B1-65E62C9FC2E1}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{5E7D87AE-DDC7-4D67-A2FF-01A2C6FDA8DC}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{657FD387-6613-4745-8338-98F7A3544384}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{659D08D4-8A3D-4E2F-8A33-09ED90028591}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe |
"{7D40EC24-B5A2-4580-8CBD-650B48E74D3B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8903593E-2C52-4B1A-B513-B40268145D9B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{9260B6DA-E8CC-4939-A947-3052C569CC0D}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{9C2EC05C-AD82-4C65-BB90-E4429B652F6F}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe |
"{9EFEB637-E8B6-478C-8007-52DF2449201E}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe |
"{AC10BE99-5E61-4607-922C-05F2FA5664EE}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{B9B0EEBB-596B-4ECC-A9CF-810CCA2E01ED}" = protocol=1 | dir=in | name=winulum |
"{BDF08A4E-72FF-4006-ACE6-EF3E8CFB4DF6}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{D3CC3C07-268C-46C6-A590-7AC81A0A65E1}" = protocol=17 | dir=in | app=c:\program files (x86)\philips\wi-fi mediaconnect\wi-fi mediaconnect.exe |
"{D566B2A9-17B2-4888-B6C2-5C439CBFA610}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{DBB78D83-D004-467C-9E5B-879BA0EBE28F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E1619E52-36CE-4ECC-9337-ACAA90FBECF3}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{E3F879C0-9207-49F2-AE7E-8727F6E7D79D}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe |
"{E9C066BD-43DF-4102-AE00-111C57F5E5D6}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{ED129829-F94F-4920-A442-5248C0E25361}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe |
"{EF34D2C7-69E8-4A99-9334-0F40261A0284}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{FEFD3862-5EED-4CED-8E11-847C96697785}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{09378625-D567-42A6-B4F3-6D83516C82DB}C:\users\pc\appdata\local\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\users\pc\appdata\local\google\google earth\client\googleearth.exe |
"TCP Query User{253C68EF-D22D-4BE1-97CA-48F762B9054D}C:\program files (x86)\icq7.2\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe |
"TCP Query User{2C7C55F2-5DC4-483A-9AA4-DDB6ACA420F3}C:\windows\syswow64\java.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\java.exe |
"TCP Query User{45CFD23D-9F45-45D9-AD8D-957359FD6E70}C:\users\pc\appdata\local\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\users\pc\appdata\local\google\google earth\client\googleearth.exe |
"TCP Query User{4A85530D-429A-4226-9143-C84BDAF60ACA}C:\users\pc\appdata\roaming\tuyf\idfa.exe" = protocol=6 | dir=in | app=c:\users\pc\appdata\roaming\tuyf\idfa.exe |
"TCP Query User{7C5993C7-E8BC-438B-A7A1-07C95CEEE0B6}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe |
"TCP Query User{997DC2E8-FD19-4E39-8D7A-F47DAAB04E00}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"TCP Query User{AAC1F72C-AE5E-4E1B-A52E-64A182E7D6EF}C:\program files (x86)\counter-strike 1.6\hl.exe" = protocol=6 | dir=in | app=c:\program files (x86)\counter-strike 1.6\hl.exe |
"TCP Query User{AEC95464-B826-45E9-985A-0C7D2105AE35}C:\program files (x86)\counter-strike 1.6\hl.exe" = protocol=6 | dir=in | app=c:\program files (x86)\counter-strike 1.6\hl.exe |
"TCP Query User{B6418A48-001C-4962-870A-3F9C3590CC23}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"TCP Query User{BE980D1C-88C4-4D7A-B580-8DEEC1E802C5}C:\program files (x86)\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"UDP Query User{07E1EA30-6DC6-459C-B809-349F5779FEFD}C:\program files (x86)\counter-strike 1.6\hl.exe" = protocol=17 | dir=in | app=c:\program files (x86)\counter-strike 1.6\hl.exe |
"UDP Query User{172FEFB9-D5E7-4699-BDBB-A6DCF27C64E2}C:\users\pc\appdata\local\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\users\pc\appdata\local\google\google earth\client\googleearth.exe |
"UDP Query User{1A67FE01-E77F-4AB0-B27F-2C23F4B9A0BE}C:\program files (x86)\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"UDP Query User{302ADF43-A86A-453C-80F6-6712EBAA8376}C:\windows\syswow64\java.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\java.exe |
"UDP Query User{3B425FE2-F773-4F7E-9A14-17867EE62DB6}C:\program files (x86)\counter-strike 1.6\hl.exe" = protocol=17 | dir=in | app=c:\program files (x86)\counter-strike 1.6\hl.exe |
"UDP Query User{81C681CD-DF65-4727-9C08-EB33F4B1D04B}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"UDP Query User{82C22B70-79B7-486F-9801-90354416291E}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe |
"UDP Query User{85359E2C-B753-4271-9258-09F58CB6FCCF}C:\users\pc\appdata\roaming\tuyf\idfa.exe" = protocol=17 | dir=in | app=c:\users\pc\appdata\roaming\tuyf\idfa.exe |
"UDP Query User{A918492B-0427-4FE2-BF0F-117CBDDB26D8}C:\program files (x86)\icq7.2\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe |
"UDP Query User{B90FBCD2-EDE7-4672-B046-099FEDAA6E2D}C:\users\pc\appdata\local\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\users\pc\appdata\local\google\google earth\client\googleearth.exe |
"UDP Query User{BCAAF969-3147-43BA-B2C7-4228C0423C47}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0A35B15C-9CCD-4C0C-BD5B-34ABF8C95813}_is1" = ICQ 7.2 Build #3525 Banner Remover 1.0
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2461F1D6-8749-498C-866C-4EF27C0B40F8}" = Update
"{268CF0B8-CA38-4E20-9E99-514A07F7C1F1}" = ArcSoft TotalMedia 3
"{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java(TM) 6 Update 25
"{39337565-330E-4ab6-A9AE-AC81E0720B10}" = CyberLink PhotoDirector 3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{9E48FF52-082C-4CC2-BB67-6E10D09C0431}" = Windows Live UX Platform Language Pack
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA58346A-A5D7-4659-91D6-38D07345BDCF}" = Wi-Fi MediaConnect
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch
"{B9A431FF-FDB1-40E5-B5F3-215290FD62DE}" = TP-LINK Drahtlos Tool
"{BE06114F-559D-11E0-B5A1-001D0926B1BF}" = Google Earth
"{C171FBBE-E471-4509-AA63-DB2FB61F778E}" = FileBot
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"Counter-Strike 1.6" = Counter-Strike 1.6
"FileZilla Client" = FileZilla Client 3.2.7.1
"Google Chrome" = Google Chrome
"InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}" = CyberLink PhotoDirector 3
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Opera 12.14.1738" = Opera 12.14
"PDFTK Builder_is1" = PDFTK Builder 3.5.3
"Shutter_is1" = Shutter
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.6
"WinLiveSuite" = Windows Live Essentials
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"XBMC" = XBMC
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 10.04.2012 15:19:50 | Computer Name = pc-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: vlc.exe, Version: 1.1.6.0, Zeitstempel:
 0x4d3caf1f  Name des fehlerhaften Moduls: libmkv_plugin.dll, Version: 0.0.0.0, Zeitstempel:
 0x4d3caf24  Ausnahmecode: 0x40000015  Fehleroffset: 0x00081a11  ID des fehlerhaften Prozesses:
 0xcc4  Startzeit der fehlerhaften Anwendung: 0x01cd174ee3ae6b1c  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\VideoLAN\VLC\vlc.exe  Pfad des fehlerhaften Moduls:
 C:\Program Files (x86)\VideoLAN\VLC\plugins\libmkv_plugin.dll  Berichtskennung: 23e5ffce-8342-11e1-9293-002268493d27
 
Error - 21.05.2012 16:04:12 | Computer Name = pc-PC | Source = Application Hang | ID = 1002
Description = Programm vlc.exe, Version 1.1.6.0 kann nicht mehr unter Windows ausgeführt
 werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 8d0    Startzeit:
01cd377c18937140    Endzeit: 17    Anwendungspfad: C:\Program Files (x86)\VideoLAN\VLC\vlc.exe

Berichts-ID:
 
 
Error - 20.06.2012 12:18:23 | Computer Name = pc-PC | Source = Application Hang | ID = 1002
Description = Programm AcroRd32.exe, Version 9.3.2.163 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 4bc    Startzeit:
01cd4f0048c2e015    Endzeit: 5    Anwendungspfad: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

Berichts-ID:
 8cf25a74-baf3-11e1-8798-002268493d27 
 
Error - 22.08.2012 15:38:40 | Computer Name = pc-PC | Source = Application Hang | ID = 1002
Description = Programm opera.exe, Version 12.0.1467.0 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: d24    Startzeit:
01cd8098cf38f987    Endzeit: 5    Anwendungspfad: C:\Program Files (x86)\Opera\opera.exe

Berichts-ID:
 f7e82f60-ec90-11e1-9685-002268493d27 
 
Error - 18.09.2012 14:55:29 | Computer Name = pc-PC | Source = Application Hang | ID = 1002
Description = Programm opera.exe, Version 12.2.1578.0 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: a24    Startzeit:
01cd95c48db797e3    Endzeit: 6    Anwendungspfad: C:\Program Files (x86)\Opera\opera.exe

Berichts-ID:
 62e6824e-01c2-11e2-84b2-002268493d27 
 
Error - 28.11.2012 11:07:25 | Computer Name = pc-PC | Source = Application Hang | ID = 1002
Description = Programm Explorer.EXE, Version 6.1.7600.16385 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: 74c    Startzeit: 01cdcd79abb8408a    Endzeit: 0    Anwendungspfad: C:\Windows\Explorer.EXE

Berichts-ID:
 4da74849-396d-11e2-9ade-002268493d27 
 
Error - 14.02.2013 11:38:25 | Computer Name = pc-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: avgnt.exe, Version: 10.0.13.18, Zeitstempel:
 0x4beab9be  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:
 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00014a3f  ID des fehlerhaften Prozesses:
 0x9e4  Startzeit der fehlerhaften Anwendung: 0x01ce0ac94cb19fbf  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe  Pfad des fehlerhaften
 Moduls: unknown  Berichtskennung: 91cb5a9b-76bc-11e2-983b-002268493d27
 
Error - 17.02.2013 14:33:55 | Computer Name = pc-PC | Source = MsiInstaller | ID = 11935
Description =
 
Error - 17.02.2013 16:09:06 | Computer Name = pc-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: nvSCPAPISvr.exe, Version: 7.17.13.697,
 Zeitstempel: 0x506b2e31  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x74816a64  ID des fehlerhaften
 Prozesses: 0x350  Startzeit der fehlerhaften Anwendung: 0x01ce0d4a409e8c14  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
Pfad
 des fehlerhaften Moduls: unknown  Berichtskennung: e1593a3c-793d-11e2-a3f6-002268493d27
 
Error - 17.02.2013 16:09:10 | Computer Name = pc-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: daemonu.exe, Version: 1.10.8.0, Zeitstempel:
 0x506b2bc8  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:
 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x74816a64  ID des fehlerhaften Prozesses:
 0xaa8  Startzeit der fehlerhaften Anwendung: 0x01ce0d4a9caea48d  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
Pfad
 des fehlerhaften Moduls: unknown  Berichtskennung: e3e311e6-793d-11e2-a3f6-002268493d27
 
[ System Events ]
Error - 17.02.2013 16:06:22 | Computer Name = pc-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.    Modulpfad:
 C:\Windows\system32\athExt.dll  Fehlercode: 126 
 
Error - 17.02.2013 16:08:22 | Computer Name = pc-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist
 bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden
 durchgeführt: Neustart des Diensts.
 
Error - 17.02.2013 16:08:44 | Computer Name = pc-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 Google Update-Dienst (gupdate) erreicht.
 
Error - 17.02.2013 16:08:44 | Computer Name = pc-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1053
 
Error - 17.02.2013 16:10:53 | Computer Name = pc-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.    Modulpfad:
 C:\Windows\system32\athExt.dll  Fehlercode: 126 
 
Error - 17.02.2013 16:12:23 | Computer Name = pc-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler
beendet:  %%16405
 
Error - 17.02.2013 16:14:47 | Computer Name = pc-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80242016 fehlgeschlagen: Update für die Kompatibilitätsansichtsliste für
 Internet Explorer*8 für Windows 7 für x64-basierte Systeme (KB2598845)
 
Error - 17.02.2013 16:14:47 | Computer Name = pc-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80242016 fehlgeschlagen: Sicherheitsupdate für Internet Explorer 8 unter
 Windows 7 für x64-basierte Systeme (KB2797052)
 
Error - 18.02.2013 11:10:06 | Computer Name = pc-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.    Modulpfad:
 C:\Windows\system32\athExt.dll  Fehlercode: 126 
 
Error - 18.02.2013 12:26:15 | Computer Name = pc-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.    Modulpfad:
 C:\Windows\system32\athExt.dll  Fehlercode: 126 
 
 
< End of report >
--- --- ---

--- --- ---

Der OTL Extras Log:

OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 18.02.2013 18:13:30 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\pc\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,99 Gb Total Physical Memory | 7,71 Gb Available Physical Memory | 85,77% Memory free
17,98 Gb Paging File | 16,59 Gb Available in Paging File | 92,25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 916,86 Gb Total Space | 687,44 Gb Free Space | 74,98% Space Free | Partition Type: NTFS
Drive I: | 7,70 Gb Total Space | 1,60 Gb Free Space | 20,85% Space Free | Partition Type: FAT32
 
Computer Name: PC-PC | User Name: pc | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
.jse[@ = JSEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.wsf[@ = WSFFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.jse [@ = JSEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files (x86)\Opera\opera.exe" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
wsffile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files (x86)\Opera\opera.exe" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
wsffile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{167035DE-E9B7-410F-BED0-A9559097AAD4}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4D5EEA2B-5E56-44AE-9A93-8E5C016B3055}" = rport=10243 | protocol=6 | dir=out | app=system |
"{4F103CEB-D44D-427E-8AD2-67D04DFD1D60}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{57CCBB38-5B99-4800-A6BB-441DA9983537}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{600061AF-5E78-43CD-87E6-19D00B120536}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{601FFEAF-C4EE-429E-9DA2-49504B1188A4}" = lport=2869 | protocol=6 | dir=in | app=system |
"{6934D9E5-30E1-4524-A0AF-F529EED228C0}" = lport=10243 | protocol=6 | dir=in | app=system |
"{6C6A2413-AE74-4462-ADE9-B5112AC33C44}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{6EF012DB-F973-4B35-A2C7-C119C16B5E60}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{795D1175-58AF-4483-A546-9C2447B0E285}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8322DD19-2F01-4351-A019-79FC550DE0D4}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |
"{8DC9A4CB-CB05-4F5A-BE5F-66D462BA23E8}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{9D2A8C88-AF87-41F8-8DEB-8E98C08F14B9}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A077629F-FAE7-4F2E-9E5A-E96CE81C8B2E}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{A23FC620-19B8-403B-A2A2-B9ED59C9A940}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AA935FC8-124F-443D-A94A-A8A77C4452AD}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B6929ADC-A628-44BF-B38F-84EA7200662E}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{C8758779-492D-4037-B236-1FEC80750631}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D5D28E66-F00D-4215-83FC-CB46D2680206}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F82DB053-1BEE-4D91-830B-23BD4E1E179F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00BD609B-38C8-4E9C-BF9F-5F8F8BF28FFB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{060498C4-763C-4E99-B70C-133409A1C84B}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe |
"{0790550A-FAD9-4154-BADF-18B7DCBB65CA}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{07E4848E-6B47-49F5-8E33-8390DC11CCB7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1547F9D4-4E23-41B6-B099-8EDF87930457}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{15CA6C37-619A-46BD-983D-372BE410801A}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{17879ABD-4604-4CE2-A1C1-D0CDC212683A}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{1C10CF8C-C400-46B1-B11F-FE3FF13E6549}" = protocol=6 | dir=in | app=c:\program files (x86)\philips\wi-fi mediaconnect\wi-fi mediaconnect.exe |
"{1CB5199B-E7EB-4208-A432-5B1BEFC9F474}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{240AB0E2-FEE8-4D9D-977D-A963B83C8410}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe |
"{26B29C07-4749-4A82-960C-2D86B51AB131}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{2B32C4FB-3BC8-42F9-8568-B614E63D4487}" = protocol=6 | dir=out | app=system |
"{31B9EF43-D4EF-446E-93A0-267A099238E7}" = protocol=1 | dir=out | name=winulum |
"{32960A06-08C7-459E-B722-27BCE98879E9}" = protocol=17 | dir=in | app=c:\program files (x86)\arcsoft\totalmedia 3\totalmedia.exe |
"{352BF790-355E-4FE0-8563-25F774490BF8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3574BDFA-632F-4F01-8D91-AE8285110075}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{42D6DBB7-844F-42EF-B9F7-6C8F16B2C6A0}" = protocol=6 | dir=in | app=c:\program files (x86)\arcsoft\totalmedia 3\totalmedia.exe |
"{43F2D7D0-5C84-40E0-AE64-49873475295E}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{4BBBFE14-2231-4B8F-8327-79F79CA2006D}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe |
"{57393FE5-35E1-496B-AB20-C3E5B3870703}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{5A517A47-8F75-4581-88B1-65E62C9FC2E1}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{5E7D87AE-DDC7-4D67-A2FF-01A2C6FDA8DC}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{657FD387-6613-4745-8338-98F7A3544384}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{659D08D4-8A3D-4E2F-8A33-09ED90028591}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe |
"{7D40EC24-B5A2-4580-8CBD-650B48E74D3B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8903593E-2C52-4B1A-B513-B40268145D9B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{9260B6DA-E8CC-4939-A947-3052C569CC0D}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{9C2EC05C-AD82-4C65-BB90-E4429B652F6F}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe |
"{9EFEB637-E8B6-478C-8007-52DF2449201E}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe |
"{AC10BE99-5E61-4607-922C-05F2FA5664EE}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{B9B0EEBB-596B-4ECC-A9CF-810CCA2E01ED}" = protocol=1 | dir=in | name=winulum |
"{BDF08A4E-72FF-4006-ACE6-EF3E8CFB4DF6}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{D3CC3C07-268C-46C6-A590-7AC81A0A65E1}" = protocol=17 | dir=in | app=c:\program files (x86)\philips\wi-fi mediaconnect\wi-fi mediaconnect.exe |
"{D566B2A9-17B2-4888-B6C2-5C439CBFA610}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{DBB78D83-D004-467C-9E5B-879BA0EBE28F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E1619E52-36CE-4ECC-9337-ACAA90FBECF3}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{E3F879C0-9207-49F2-AE7E-8727F6E7D79D}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe |
"{E9C066BD-43DF-4102-AE00-111C57F5E5D6}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{ED129829-F94F-4920-A442-5248C0E25361}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe |
"{EF34D2C7-69E8-4A99-9334-0F40261A0284}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{FEFD3862-5EED-4CED-8E11-847C96697785}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{09378625-D567-42A6-B4F3-6D83516C82DB}C:\users\pc\appdata\local\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\users\pc\appdata\local\google\google earth\client\googleearth.exe |
"TCP Query User{253C68EF-D22D-4BE1-97CA-48F762B9054D}C:\program files (x86)\icq7.2\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe |
"TCP Query User{2C7C55F2-5DC4-483A-9AA4-DDB6ACA420F3}C:\windows\syswow64\java.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\java.exe |
"TCP Query User{45CFD23D-9F45-45D9-AD8D-957359FD6E70}C:\users\pc\appdata\local\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\users\pc\appdata\local\google\google earth\client\googleearth.exe |
"TCP Query User{4A85530D-429A-4226-9143-C84BDAF60ACA}C:\users\pc\appdata\roaming\tuyf\idfa.exe" = protocol=6 | dir=in | app=c:\users\pc\appdata\roaming\tuyf\idfa.exe |
"TCP Query User{7C5993C7-E8BC-438B-A7A1-07C95CEEE0B6}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe |
"TCP Query User{997DC2E8-FD19-4E39-8D7A-F47DAAB04E00}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"TCP Query User{AAC1F72C-AE5E-4E1B-A52E-64A182E7D6EF}C:\program files (x86)\counter-strike 1.6\hl.exe" = protocol=6 | dir=in | app=c:\program files (x86)\counter-strike 1.6\hl.exe |
"TCP Query User{AEC95464-B826-45E9-985A-0C7D2105AE35}C:\program files (x86)\counter-strike 1.6\hl.exe" = protocol=6 | dir=in | app=c:\program files (x86)\counter-strike 1.6\hl.exe |
"TCP Query User{B6418A48-001C-4962-870A-3F9C3590CC23}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"TCP Query User{BE980D1C-88C4-4D7A-B580-8DEEC1E802C5}C:\program files (x86)\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"UDP Query User{07E1EA30-6DC6-459C-B809-349F5779FEFD}C:\program files (x86)\counter-strike 1.6\hl.exe" = protocol=17 | dir=in | app=c:\program files (x86)\counter-strike 1.6\hl.exe |
"UDP Query User{172FEFB9-D5E7-4699-BDBB-A6DCF27C64E2}C:\users\pc\appdata\local\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\users\pc\appdata\local\google\google earth\client\googleearth.exe |
"UDP Query User{1A67FE01-E77F-4AB0-B27F-2C23F4B9A0BE}C:\program files (x86)\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"UDP Query User{302ADF43-A86A-453C-80F6-6712EBAA8376}C:\windows\syswow64\java.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\java.exe |
"UDP Query User{3B425FE2-F773-4F7E-9A14-17867EE62DB6}C:\program files (x86)\counter-strike 1.6\hl.exe" = protocol=17 | dir=in | app=c:\program files (x86)\counter-strike 1.6\hl.exe |
"UDP Query User{81C681CD-DF65-4727-9C08-EB33F4B1D04B}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"UDP Query User{82C22B70-79B7-486F-9801-90354416291E}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe |
"UDP Query User{85359E2C-B753-4271-9258-09F58CB6FCCF}C:\users\pc\appdata\roaming\tuyf\idfa.exe" = protocol=17 | dir=in | app=c:\users\pc\appdata\roaming\tuyf\idfa.exe |
"UDP Query User{A918492B-0427-4FE2-BF0F-117CBDDB26D8}C:\program files (x86)\icq7.2\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe |
"UDP Query User{B90FBCD2-EDE7-4672-B046-099FEDAA6E2D}C:\users\pc\appdata\local\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\users\pc\appdata\local\google\google earth\client\googleearth.exe |
"UDP Query User{BCAAF969-3147-43BA-B2C7-4228C0423C47}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0A35B15C-9CCD-4C0C-BD5B-34ABF8C95813}_is1" = ICQ 7.2 Build #3525 Banner Remover 1.0
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2461F1D6-8749-498C-866C-4EF27C0B40F8}" = Update
"{268CF0B8-CA38-4E20-9E99-514A07F7C1F1}" = ArcSoft TotalMedia 3
"{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java(TM) 6 Update 25
"{39337565-330E-4ab6-A9AE-AC81E0720B10}" = CyberLink PhotoDirector 3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{9E48FF52-082C-4CC2-BB67-6E10D09C0431}" = Windows Live UX Platform Language Pack
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA58346A-A5D7-4659-91D6-38D07345BDCF}" = Wi-Fi MediaConnect
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch
"{B9A431FF-FDB1-40E5-B5F3-215290FD62DE}" = TP-LINK Drahtlos Tool
"{BE06114F-559D-11E0-B5A1-001D0926B1BF}" = Google Earth
"{C171FBBE-E471-4509-AA63-DB2FB61F778E}" = FileBot
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"Counter-Strike 1.6" = Counter-Strike 1.6
"FileZilla Client" = FileZilla Client 3.2.7.1
"Google Chrome" = Google Chrome
"InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}" = CyberLink PhotoDirector 3
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Opera 12.14.1738" = Opera 12.14
"PDFTK Builder_is1" = PDFTK Builder 3.5.3
"Shutter_is1" = Shutter
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.6
"WinLiveSuite" = Windows Live Essentials
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"XBMC" = XBMC
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 10.04.2012 15:19:50 | Computer Name = pc-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: vlc.exe, Version: 1.1.6.0, Zeitstempel:
 0x4d3caf1f  Name des fehlerhaften Moduls: libmkv_plugin.dll, Version: 0.0.0.0, Zeitstempel:
 0x4d3caf24  Ausnahmecode: 0x40000015  Fehleroffset: 0x00081a11  ID des fehlerhaften Prozesses:
 0xcc4  Startzeit der fehlerhaften Anwendung: 0x01cd174ee3ae6b1c  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\VideoLAN\VLC\vlc.exe  Pfad des fehlerhaften Moduls:
 C:\Program Files (x86)\VideoLAN\VLC\plugins\libmkv_plugin.dll  Berichtskennung: 23e5ffce-8342-11e1-9293-002268493d27
 
Error - 21.05.2012 16:04:12 | Computer Name = pc-PC | Source = Application Hang | ID = 1002
Description = Programm vlc.exe, Version 1.1.6.0 kann nicht mehr unter Windows ausgeführt
 werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 8d0    Startzeit:
01cd377c18937140    Endzeit: 17    Anwendungspfad: C:\Program Files (x86)\VideoLAN\VLC\vlc.exe

Berichts-ID:
 
 
Error - 20.06.2012 12:18:23 | Computer Name = pc-PC | Source = Application Hang | ID = 1002
Description = Programm AcroRd32.exe, Version 9.3.2.163 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 4bc    Startzeit:
01cd4f0048c2e015    Endzeit: 5    Anwendungspfad: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

Berichts-ID:
 8cf25a74-baf3-11e1-8798-002268493d27 
 
Error - 22.08.2012 15:38:40 | Computer Name = pc-PC | Source = Application Hang | ID = 1002
Description = Programm opera.exe, Version 12.0.1467.0 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: d24    Startzeit:
01cd8098cf38f987    Endzeit: 5    Anwendungspfad: C:\Program Files (x86)\Opera\opera.exe

Berichts-ID:
 f7e82f60-ec90-11e1-9685-002268493d27 
 
Error - 18.09.2012 14:55:29 | Computer Name = pc-PC | Source = Application Hang | ID = 1002
Description = Programm opera.exe, Version 12.2.1578.0 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: a24    Startzeit:
01cd95c48db797e3    Endzeit: 6    Anwendungspfad: C:\Program Files (x86)\Opera\opera.exe

Berichts-ID:
 62e6824e-01c2-11e2-84b2-002268493d27 
 
Error - 28.11.2012 11:07:25 | Computer Name = pc-PC | Source = Application Hang | ID = 1002
Description = Programm Explorer.EXE, Version 6.1.7600.16385 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: 74c    Startzeit: 01cdcd79abb8408a    Endzeit: 0    Anwendungspfad: C:\Windows\Explorer.EXE

Berichts-ID:
 4da74849-396d-11e2-9ade-002268493d27 
 
Error - 14.02.2013 11:38:25 | Computer Name = pc-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: avgnt.exe, Version: 10.0.13.18, Zeitstempel:
 0x4beab9be  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:
 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00014a3f  ID des fehlerhaften Prozesses:
 0x9e4  Startzeit der fehlerhaften Anwendung: 0x01ce0ac94cb19fbf  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe  Pfad des fehlerhaften
 Moduls: unknown  Berichtskennung: 91cb5a9b-76bc-11e2-983b-002268493d27
 
Error - 17.02.2013 14:33:55 | Computer Name = pc-PC | Source = MsiInstaller | ID = 11935
Description =
 
Error - 17.02.2013 16:09:06 | Computer Name = pc-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: nvSCPAPISvr.exe, Version: 7.17.13.697,
 Zeitstempel: 0x506b2e31  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x74816a64  ID des fehlerhaften
 Prozesses: 0x350  Startzeit der fehlerhaften Anwendung: 0x01ce0d4a409e8c14  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
Pfad
 des fehlerhaften Moduls: unknown  Berichtskennung: e1593a3c-793d-11e2-a3f6-002268493d27
 
Error - 17.02.2013 16:09:10 | Computer Name = pc-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: daemonu.exe, Version: 1.10.8.0, Zeitstempel:
 0x506b2bc8  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:
 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x74816a64  ID des fehlerhaften Prozesses:
 0xaa8  Startzeit der fehlerhaften Anwendung: 0x01ce0d4a9caea48d  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
Pfad
 des fehlerhaften Moduls: unknown  Berichtskennung: e3e311e6-793d-11e2-a3f6-002268493d27
 
[ System Events ]
Error - 17.02.2013 16:06:22 | Computer Name = pc-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.    Modulpfad:
 C:\Windows\system32\athExt.dll  Fehlercode: 126 
 
Error - 17.02.2013 16:08:22 | Computer Name = pc-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist
 bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden
 durchgeführt: Neustart des Diensts.
 
Error - 17.02.2013 16:08:44 | Computer Name = pc-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 Google Update-Dienst (gupdate) erreicht.
 
Error - 17.02.2013 16:08:44 | Computer Name = pc-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1053
 
Error - 17.02.2013 16:10:53 | Computer Name = pc-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.    Modulpfad:
 C:\Windows\system32\athExt.dll  Fehlercode: 126 
 
Error - 17.02.2013 16:12:23 | Computer Name = pc-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler
beendet:  %%16405
 
Error - 17.02.2013 16:14:47 | Computer Name = pc-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80242016 fehlgeschlagen: Update für die Kompatibilitätsansichtsliste für
 Internet Explorer*8 für Windows 7 für x64-basierte Systeme (KB2598845)
 
Error - 17.02.2013 16:14:47 | Computer Name = pc-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80242016 fehlgeschlagen: Sicherheitsupdate für Internet Explorer 8 unter
 Windows 7 für x64-basierte Systeme (KB2797052)
 
Error - 18.02.2013 11:10:06 | Computer Name = pc-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.    Modulpfad:
 C:\Windows\system32\athExt.dll  Fehlercode: 126 
 
Error - 18.02.2013 12:26:15 | Computer Name = pc-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.    Modulpfad:
 C:\Windows\system32\athExt.dll  Fehlercode: 126 
 
 
< End of report >
--- --- ---

Jamal 18.02.2013 19:26
Und der GMER Log:

GMER Logfile:
Code:
GMER 2.1.18952 - GMER - Rootkit Detector and Remover
Rootkit scan 2013-02-18 18:53:07
Windows 6.1.7600  x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 WDC_WD10EAVS-00D7B1 rev.01.01A01 931,51GB
Running: GMER_2.1.18952.exe; Driver: C:\Users\pc\AppData\Local\Temp\pxldapoc.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess          00000000772108ac 4 bytes [68, 9D, 3D, CC]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess + 5      00000000772108b1 1 byte [C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\SysWOW64\ntdll.dll!NtdllDefWindowProc_W          000000007722260d 6 bytes [68, 68, 1C, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                    000000007722c4aa 6 bytes [68, C8, 3E, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\SysWOW64\ntdll.dll!NtdllDefWindowProc_A          0000000077232a93 6 bytes [68, AE, 1C, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\SysWOW64\ntdll.dll!NtdllDialogWndProc_W          0000000077254170 6 bytes [68, F4, 1C, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\SysWOW64\ntdll.dll!NtdllDialogWndProc_A          000000007725e6b5 6 bytes [68, 3A, 1D, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\kernel32.dll!GetFileAttributesExW      00000000761332f2 6 bytes [68, 31, 41, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\kernel32.dll!ExitProcess                000000007613734e 6 bytes [68, F0, 40, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!GetDC                        0000000075df7246 4 bytes [68, 14, A8, CA]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!GetDC + 5                    0000000075df724b 1 byte [C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!ReleaseDC                    0000000075df730e 6 bytes [68, 92, A8, CA, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!GetWindowDC                  0000000075df79d8 4 bytes [68, 53, A8, CA]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!GetWindowDC + 5              0000000075df79dd 1 byte [C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!TranslateMessage            0000000075df7d79 6 bytes [68, 51, B4, CA, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!GetMessageW                  0000000075df7e92 6 bytes [68, 88, 52, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!GetMessageA                  0000000075df811b 6 bytes [68, B0, 52, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!RegisterClassW              0000000075df8bd6 6 bytes [68, 6C, 1F, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!RegisterClassExW            0000000075df9ed3 6 bytes [68, 06, 20, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!RegisterClassExA            0000000075dfdd6d 6 bytes [68, 58, 20, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!PeekMessageW                0000000075e00112 6 bytes [68, D8, 52, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!CallWindowProcW              0000000075e00abb 6 bytes [68, 9E, 1E, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!GetCursorPos                0000000075e00e0d 6 bytes [68, BB, 50, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!EndPaint                    0000000075e00e9a 4 bytes [68, 79, A7, CA]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!EndPaint + 5                0000000075e00e9f 1 byte [C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!BeginPaint                  0000000075e00eba 4 bytes [68, 09, A7, CA]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!BeginPaint + 5              0000000075e00ebf 1 byte [C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!GetMessagePos                0000000075e02bc7 6 bytes [68, 89, 50, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!GetCapture                  0000000075e02dbd 6 bytes [68, E9, 51, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!ReleaseCapture              0000000075e02ec4 6 bytes [68, 99, 51, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!SetCapture                  0000000075e02ed1 4 bytes [68, 3F, 51, CC]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!SetCapture + 5              0000000075e02ed6 1 byte [C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!GetDCEx                      0000000075e03001 4 bytes [68, B9, A7, CA]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!GetDCEx + 5                  0000000075e03006 1 byte [C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!RegisterClassA              0000000075e04b80 6 bytes [68, B9, 1F, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!CallWindowProcA              0000000075e07af4 6 bytes [68, E7, 1E, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!DefFrameProcA                0000000075e0808f 6 bytes [68, C9, 1D, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!DefMDIChildProcA            0000000075e081e0 6 bytes [68, 58, 1E, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!DefFrameProcW                0000000075e08632 6 bytes [68, 80, 1D, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!DefMDIChildProcW            0000000075e08807 6 bytes [68, 12, 1E, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!PeekMessageA                0000000075e1ed58 6 bytes [68, 03, 53, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!GetUpdateRgn                0000000075e1f1fe 6 bytes [68, 65, A9, CA, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!GetUpdateRect                0000000075e2011b 6 bytes [68, D2, A8, CA, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!SwitchDesktop                0000000075e397e4 6 bytes [68, 4A, 1C, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!SetCursorPos                0000000075e39c8d 6 bytes [68, 02, 51, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!GetClipboardData            0000000075e39f3b 6 bytes [68, 00, B6, CA, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!OpenInputDesktop            0000000075e5895b 4 bytes [68, FA, 1B, CB]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\USER32.dll!OpenInputDesktop + 5        0000000075e58960 1 byte [C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserW      000000007675bbdb 6 bytes [68, AE, 41, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserA      00000000767914fd 6 bytes [68, 97, 41, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WS2_32.dll!closesocket                  00000000765e3bed 6 bytes [68, C1, 17, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                  00000000765e6737 6 bytes [68, D2, 13, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WS2_32.dll!WSASend                      00000000765e68a7 6 bytes [68, 1A, 18, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WS2_32.dll!send                        00000000765ec4c8 6 bytes [68, F9, 17, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WS2_32.dll!gethostbyname                00000000765f7133 6 bytes [68, 62, 13, CC, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WININET.dll!InternetCloseHandle        00000000763dc664 6 bytes [68, F7, DC, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA              00000000763de13a 6 bytes [68, 97, DE, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WININET.dll!InternetReadFile            00000000763df8d8 6 bytes [68, 64, DD, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable  00000000763e3184 6 bytes [68, 6B, DE, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WININET.dll!HttpOpenRequestA            0000000076405761 6 bytes [68, 39, DA, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WININET.dll!HttpOpenRequestW            0000000076405fef 6 bytes [68, F5, D9, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WININET.dll!HttpSendRequestW            000000007640632d 6 bytes [68, 7D, DA, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WININET.dll!InternetReadFileExA        000000007640fa49 6 bytes [68, 92, DD, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW          000000007641f564 6 bytes [68, 27, DB, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WININET.dll!HttpEndRequestA            000000007641f639 6 bytes [68, 61, DC, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WININET.dll!InternetSetFilePointer      0000000076434f2f 6 bytes [68, 11, DE, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WININET.dll!HttpSendRequestA            000000007643525a 6 bytes [68, D2, DA, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA          000000007647ece5 6 bytes [68, C4, DB, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\WININET.dll!HttpEndRequestW            000000007647edb7 6 bytes [68, AC, DC, CB, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe[2184] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore          00000000763412b0 6 bytes [68, D6, F4, CB, 00, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                                                  00000000772108ac 6 bytes [68, 9D, 3D, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\SysWOW64\ntdll.dll!NtdllDefWindowProc_W                                                  000000007722260d 6 bytes [68, 68, 1C, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                            000000007722c4aa 6 bytes [68, C8, 3E, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\SysWOW64\ntdll.dll!NtdllDefWindowProc_A                                                  0000000077232a93 6 bytes [68, AE, 1C, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\SysWOW64\ntdll.dll!NtdllDialogWndProc_W                                                  0000000077254170 6 bytes [68, F4, 1C, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\SysWOW64\ntdll.dll!NtdllDialogWndProc_A                                                  000000007725e6b5 6 bytes [68, 3A, 1D, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\kernel32.dll!GetFileAttributesExW                                              00000000761332f2 6 bytes [68, 31, 41, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\kernel32.dll!ExitProcess                                                        000000007613734e 6 bytes [68, F0, 40, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!GetDC                                                                0000000075df7246 6 bytes [68, 14, A8, 45, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!ReleaseDC                                                            0000000075df730e 6 bytes [68, 92, A8, 45, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!GetWindowDC                                                          0000000075df79d8 6 bytes [68, 53, A8, 45, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!TranslateMessage                                                    0000000075df7d79 6 bytes [68, 51, B4, 45, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!GetMessageW                                                          0000000075df7e92 6 bytes [68, 88, 52, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!GetMessageA                                                          0000000075df811b 6 bytes [68, B0, 52, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!RegisterClassW                                                      0000000075df8bd6 6 bytes [68, 6C, 1F, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!RegisterClassExW                                                    0000000075df9ed3 6 bytes [68, 06, 20, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!RegisterClassExA                                                    0000000075dfdd6d 6 bytes [68, 58, 20, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!PeekMessageW                                                        0000000075e00112 6 bytes [68, D8, 52, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!CallWindowProcW                                                      0000000075e00abb 6 bytes [68, 9E, 1E, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!GetCursorPos                                                        0000000075e00e0d 6 bytes [68, BB, 50, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!EndPaint                                                            0000000075e00e9a 6 bytes [68, 79, A7, 45, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!BeginPaint                                                          0000000075e00eba 6 bytes [68, 09, A7, 45, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!GetMessagePos                                                        0000000075e02bc7 6 bytes [68, 89, 50, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!GetCapture                                                          0000000075e02dbd 6 bytes [68, E9, 51, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!ReleaseCapture                                                      0000000075e02ec4 6 bytes [68, 99, 51, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!SetCapture                                                          0000000075e02ed1 6 bytes [68, 3F, 51, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!GetDCEx                                                              0000000075e03001 6 bytes [68, B9, A7, 45, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!RegisterClassA                                                      0000000075e04b80 6 bytes [68, B9, 1F, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!CallWindowProcA                                                      0000000075e07af4 6 bytes [68, E7, 1E, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!DefFrameProcA                                                        0000000075e0808f 6 bytes [68, C9, 1D, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!DefMDIChildProcA                                                    0000000075e081e0 6 bytes [68, 58, 1E, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!DefFrameProcW                                                        0000000075e08632 6 bytes [68, 80, 1D, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!DefMDIChildProcW                                                    0000000075e08807 6 bytes [68, 12, 1E, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!PeekMessageA                                                        0000000075e1ed58 6 bytes [68, 03, 53, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!GetUpdateRgn                                                        0000000075e1f1fe 6 bytes [68, 65, A9, 45, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!GetUpdateRect                                                        0000000075e2011b 6 bytes [68, D2, A8, 45, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!SwitchDesktop                                                        0000000075e397e4 6 bytes [68, 4A, 1C, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!SetCursorPos                                                        0000000075e39c8d 6 bytes [68, 02, 51, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!GetClipboardData                                                    0000000075e39f3b 6 bytes [68, 00, B6, 45, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\USER32.dll!OpenInputDesktop                                                    0000000075e5895b 6 bytes [68, FA, 1B, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserW                                              000000007675bbdb 6 bytes [68, AE, 41, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserA                                              00000000767914fd 6 bytes [68, 97, 41, 47, 02, C3]
?      C:\Windows\system32\mmsys.cpl [2644] entry point in ".data" section                                                                        0000000073d41152
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\SysWOW64\WINMM.dll!PlaySoundW                                                            0000000071ed2d12 6 bytes [68, EC, 41, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\SysWOW64\WINMM.dll!PlaySound                                                            0000000071ef3dad 6 bytes [68, C5, 41, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WS2_32.dll!closesocket                                                          00000000765e3bed 6 bytes [68, C1, 17, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                                                          00000000765e6737 6 bytes [68, D2, 13, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WS2_32.dll!WSASend                                                              00000000765e68a7 6 bytes [68, 1A, 18, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WS2_32.dll!send                                                                00000000765ec4c8 6 bytes [68, F9, 17, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WS2_32.dll!gethostbyname                                                        00000000765f7133 6 bytes [68, 62, 13, 47, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                                                  00000000763412b0 6 bytes [68, D6, F4, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                                                00000000763dc664 6 bytes [68, F7, DC, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                                                      00000000763de13a 6 bytes [68, 97, DE, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WININET.dll!InternetReadFile                                                    00000000763df8d8 6 bytes [68, 64, DD, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable                                          00000000763e3184 6 bytes [68, 6B, DE, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WININET.dll!HttpOpenRequestA                                                    0000000076405761 6 bytes [68, 39, DA, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WININET.dll!HttpOpenRequestW                                                    0000000076405fef 6 bytes [68, F5, D9, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                                                    000000007640632d 6 bytes [68, 7D, DA, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                                                000000007640fa49 6 bytes [68, 92, DD, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                                                  000000007641f564 6 bytes [68, 27, DB, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WININET.dll!HttpEndRequestA                                                    000000007641f639 6 bytes [68, 61, DC, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WININET.dll!InternetSetFilePointer                                              0000000076434f2f 6 bytes [68, 11, DE, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                                                    000000007643525a 6 bytes [68, D2, DA, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                                                  000000007647ece5 6 bytes [68, C4, DB, 46, 02, C3]
.text  C:\Windows\SysWOW64\rundll32.exe[2644] C:\Windows\syswow64\WININET.dll!HttpEndRequestW                                                    000000007647edb7 6 bytes [68, AC, DC, 46, 02, C3]
.text  C:\Users\pc\AppData\Roaming\Tuyf\idfa.exe[2964] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                                                00000000765e6737 6 bytes [68, D2, 13, 42, 00, C3]
.text  C:\Users\pc\AppData\Roaming\Tuyf\idfa.exe[2964] C:\Windows\syswow64\WS2_32.dll!gethostbyname                                              00000000765f7133 6 bytes [68, 62, 13, 42, 00, C3]
.text  C:\Users\pc\AppData\Roaming\Tuyf\idfa.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                    0000000074cf1465 2 bytes [CF, 74]
.text  C:\Users\pc\AppData\Roaming\Tuyf\idfa.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                  0000000074cf14bb 2 bytes [CF, 74]
.text  ...                                                                                                                                        * 2
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                                                    00000000772108ac 4 bytes [68, 9D, 3D, 07]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess + 5                                                00000000772108b1 1 byte [C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\SysWOW64\ntdll.dll!NtdllDefWindowProc_W                                                    000000007722260d 6 bytes [68, 68, 1C, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                              000000007722c4aa 6 bytes [68, C8, 3E, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\SysWOW64\ntdll.dll!NtdllDefWindowProc_A                                                    0000000077232a93 6 bytes [68, AE, 1C, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\SysWOW64\ntdll.dll!NtdllDialogWndProc_W                                                    0000000077254170 6 bytes [68, F4, 1C, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\SysWOW64\ntdll.dll!NtdllDialogWndProc_A                                                    000000007725e6b5 6 bytes [68, 3A, 1D, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\kernel32.dll!GetFileAttributesExW                                                00000000761332f2 6 bytes [68, 31, 41, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\kernel32.dll!ExitProcess                                                          000000007613734e 6 bytes [68, F0, 40, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!GetDC                                                                  0000000075df7246 4 bytes [68, 14, A8, 05]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!GetDC + 5                                                              0000000075df724b 1 byte [C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!ReleaseDC                                                              0000000075df730e 6 bytes [68, 92, A8, 05, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!GetWindowDC                                                            0000000075df79d8 4 bytes [68, 53, A8, 05]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!GetWindowDC + 5                                                        0000000075df79dd 1 byte [C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!TranslateMessage                                                      0000000075df7d79 6 bytes [68, 51, B4, 05, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!GetMessageW                                                            0000000075df7e92 6 bytes [68, 88, 52, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!GetMessageA                                                            0000000075df811b 6 bytes [68, B0, 52, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!RegisterClassW                                                        0000000075df8bd6 6 bytes [68, 6C, 1F, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!RegisterClassExW                                                      0000000075df9ed3 6 bytes [68, 06, 20, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!RegisterClassExA                                                      0000000075dfdd6d 6 bytes [68, 58, 20, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!PeekMessageW                                                          0000000075e00112 6 bytes [68, D8, 52, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!CallWindowProcW                                                        0000000075e00abb 6 bytes [68, 9E, 1E, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!GetCursorPos                                                          0000000075e00e0d 6 bytes [68, BB, 50, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!EndPaint                                                              0000000075e00e9a 4 bytes [68, 79, A7, 05]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!EndPaint + 5                                                          0000000075e00e9f 1 byte [C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!BeginPaint                                                            0000000075e00eba 4 bytes [68, 09, A7, 05]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!BeginPaint + 5                                                        0000000075e00ebf 1 byte [C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!GetMessagePos                                                          0000000075e02bc7 6 bytes [68, 89, 50, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!GetCapture                                                            0000000075e02dbd 6 bytes [68, E9, 51, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!ReleaseCapture                                                        0000000075e02ec4 6 bytes [68, 99, 51, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!SetCapture                                                            0000000075e02ed1 4 bytes [68, 3F, 51, 07]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!SetCapture + 5                                                        0000000075e02ed6 1 byte [C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!GetDCEx                                                                0000000075e03001 4 bytes [68, B9, A7, 05]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!GetDCEx + 5                                                            0000000075e03006 1 byte [C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!RegisterClassA                                                        0000000075e04b80 6 bytes [68, B9, 1F, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!CallWindowProcA                                                        0000000075e07af4 6 bytes [68, E7, 1E, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!DefFrameProcA                                                          0000000075e0808f 6 bytes [68, C9, 1D, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!DefMDIChildProcA                                                      0000000075e081e0 6 bytes [68, 58, 1E, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!DefFrameProcW                                                          0000000075e08632 6 bytes [68, 80, 1D, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!DefMDIChildProcW                                                      0000000075e08807 6 bytes [68, 12, 1E, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!PeekMessageA                                                          0000000075e1ed58 6 bytes [68, 03, 53, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!GetUpdateRgn                                                          0000000075e1f1fe 6 bytes [68, 65, A9, 05, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!GetUpdateRect                                                          0000000075e2011b 6 bytes [68, D2, A8, 05, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!SwitchDesktop                                                          0000000075e397e4 6 bytes [68, 4A, 1C, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!SetCursorPos                                                          0000000075e39c8d 6 bytes [68, 02, 51, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!GetClipboardData                                                      0000000075e39f3b 6 bytes [68, 00, B6, 05, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!OpenInputDesktop                                                      0000000075e5895b 4 bytes [68, FA, 1B, 06]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\USER32.dll!OpenInputDesktop + 5                                                  0000000075e58960 1 byte [C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserW                                                000000007675bbdb 6 bytes [68, AE, 41, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserA                                                00000000767914fd 6 bytes [68, 97, 41, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WS2_32.dll!closesocket                                                            00000000765e3bed 6 bytes [68, C1, 17, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                                                            00000000765e6737 6 bytes [68, D2, 13, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WS2_32.dll!WSASend                                                                00000000765e68a7 6 bytes [68, 1A, 18, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WS2_32.dll!send                                                                  00000000765ec4c8 6 bytes [68, F9, 17, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WS2_32.dll!gethostbyname                                                          00000000765f7133 6 bytes [68, 62, 13, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                                                    00000000763412b0 6 bytes [68, D6, F4, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                                                  00000000763dc664 6 bytes [68, F7, DC, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                                                        00000000763de13a 6 bytes [68, 97, DE, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WININET.dll!InternetReadFile                                                      00000000763df8d8 6 bytes [68, 64, DD, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable                                            00000000763e3184 6 bytes [68, 6B, DE, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WININET.dll!HttpOpenRequestA                                                      0000000076405761 6 bytes [68, 39, DA, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WININET.dll!HttpOpenRequestW                                                      0000000076405fef 6 bytes [68, F5, D9, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                                                      000000007640632d 6 bytes [68, 7D, DA, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                                                  000000007640fa49 6 bytes [68, 92, DD, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                                                    000000007641f564 6 bytes [68, 27, DB, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WININET.dll!HttpEndRequestA                                                      000000007641f639 6 bytes [68, 61, DC, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WININET.dll!InternetSetFilePointer                                                0000000076434f2f 6 bytes [68, 11, DE, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                                                      000000007643525a 6 bytes [68, D2, DA, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                                                    000000007647ece5 6 bytes [68, C4, DB, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\syswow64\WININET.dll!HttpEndRequestW                                                      000000007647edb7 6 bytes [68, AC, DC, 06, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\SysWOW64\WINMM.dll!PlaySoundW                                                              0000000071ed2d12 6 bytes [68, EC, 41, 07, 00, C3]
.text  C:\Windows\SysWOW64\ctfmon.exe[2448] C:\Windows\SysWOW64\WINMM.dll!PlaySound                                                              0000000071ef3dad 6 bytes [68, C5, 41, 07, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                  00000000772108ac 4 bytes [68, 9D, 3D, 1B]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess + 5              00000000772108b1 1 byte [C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\SysWOW64\ntdll.dll!NtdllDefWindowProc_W                  000000007722260d 6 bytes [68, 68, 1C, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                            000000007722c4aa 6 bytes [68, C8, 3E, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\SysWOW64\ntdll.dll!NtdllDefWindowProc_A                  0000000077232a93 6 bytes [68, AE, 1C, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\SysWOW64\ntdll.dll!NtdllDialogWndProc_W                  0000000077254170 6 bytes [68, F4, 1C, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\SysWOW64\ntdll.dll!NtdllDialogWndProc_A                  000000007725e6b5 6 bytes [68, 3A, 1D, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\kernel32.dll!GetFileAttributesExW              00000000761332f2 6 bytes [68, 31, 41, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\kernel32.dll!ExitProcess                        000000007613734e 6 bytes [68, F0, 40, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!GetDC                                0000000075df7246 4 bytes [68, 14, A8, 19]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!GetDC + 5                            0000000075df724b 1 byte [C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!ReleaseDC                            0000000075df730e 6 bytes [68, 92, A8, 19, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!GetWindowDC                          0000000075df79d8 4 bytes [68, 53, A8, 19]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!GetWindowDC + 5                      0000000075df79dd 1 byte [C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!TranslateMessage                    0000000075df7d79 6 bytes [68, 51, B4, 19, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!GetMessageW                          0000000075df7e92 6 bytes [68, 88, 52, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!GetMessageA                          0000000075df811b 6 bytes [68, B0, 52, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!RegisterClassW                      0000000075df8bd6 6 bytes [68, 6C, 1F, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!RegisterClassExW                    0000000075df9ed3 6 bytes [68, 06, 20, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!RegisterClassExA                    0000000075dfdd6d 6 bytes [68, 58, 20, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!PeekMessageW                        0000000075e00112 6 bytes [68, D8, 52, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!CallWindowProcW                      0000000075e00abb 6 bytes [68, 9E, 1E, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!GetCursorPos                        0000000075e00e0d 6 bytes [68, BB, 50, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!EndPaint                            0000000075e00e9a 4 bytes [68, 79, A7, 19]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!EndPaint + 5                        0000000075e00e9f 1 byte [C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!BeginPaint                          0000000075e00eba 4 bytes [68, 09, A7, 19]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!BeginPaint + 5                      0000000075e00ebf 1 byte [C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!GetMessagePos                        0000000075e02bc7 6 bytes [68, 89, 50, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!GetCapture                          0000000075e02dbd 6 bytes [68, E9, 51, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!ReleaseCapture                      0000000075e02ec4 6 bytes [68, 99, 51, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!SetCapture                          0000000075e02ed1 4 bytes [68, 3F, 51, 1B]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!SetCapture + 5                      0000000075e02ed6 1 byte [C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!GetDCEx                              0000000075e03001 4 bytes [68, B9, A7, 19]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!GetDCEx + 5                          0000000075e03006 1 byte [C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!RegisterClassA                      0000000075e04b80 6 bytes [68, B9, 1F, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!CallWindowProcA                      0000000075e07af4 6 bytes [68, E7, 1E, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!DefFrameProcA                        0000000075e0808f 6 bytes [68, C9, 1D, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!DefMDIChildProcA                    0000000075e081e0 6 bytes [68, 58, 1E, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!DefFrameProcW                        0000000075e08632 6 bytes [68, 80, 1D, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!DefMDIChildProcW                    0000000075e08807 6 bytes [68, 12, 1E, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!PeekMessageA                        0000000075e1ed58 6 bytes [68, 03, 53, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!GetUpdateRgn                        0000000075e1f1fe 6 bytes [68, 65, A9, 19, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!GetUpdateRect                        0000000075e2011b 6 bytes [68, D2, A8, 19, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!SwitchDesktop                        0000000075e397e4 6 bytes [68, 4A, 1C, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!SetCursorPos                        0000000075e39c8d 6 bytes [68, 02, 51, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!GetClipboardData                    0000000075e39f3b 6 bytes [68, 00, B6, 19, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!OpenInputDesktop                    0000000075e5895b 4 bytes [68, FA, 1B, 1A]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\USER32.dll!OpenInputDesktop + 5                0000000075e58960 1 byte [C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserW              000000007675bbdb 6 bytes [68, AE, 41, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserA              00000000767914fd 6 bytes [68, 97, 41, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WS2_32.dll!closesocket                          00000000765e3bed 6 bytes [68, C1, 17, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                          00000000765e6737 6 bytes [68, D2, 13, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WS2_32.dll!WSASend                              00000000765e68a7 6 bytes [68, 1A, 18, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WS2_32.dll!send                                00000000765ec4c8 6 bytes [68, F9, 17, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WS2_32.dll!gethostbyname                        00000000765f7133 6 bytes [68, 62, 13, 1B, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                  00000000763412b0 6 bytes [68, D6, F4, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                00000000763dc664 6 bytes [68, F7, DC, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                      00000000763de13a 6 bytes [68, 97, DE, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WININET.dll!InternetReadFile                    00000000763df8d8 6 bytes [68, 64, DD, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable          00000000763e3184 6 bytes [68, 6B, DE, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WININET.dll!HttpOpenRequestA                    0000000076405761 6 bytes [68, 39, DA, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WININET.dll!HttpOpenRequestW                    0000000076405fef 6 bytes [68, F5, D9, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                    000000007640632d 6 bytes [68, 7D, DA, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                000000007640fa49 6 bytes [68, 92, DD, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                  000000007641f564 6 bytes [68, 27, DB, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WININET.dll!HttpEndRequestA                    000000007641f639 6 bytes [68, 61, DC, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WININET.dll!InternetSetFilePointer              0000000076434f2f 6 bytes [68, 11, DE, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                    000000007643525a 6 bytes [68, D2, DA, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                  000000007647ece5 6 bytes [68, C4, DB, 1A, 00, C3]
.text  C:\Program Files (x86)\Philips\Wi-Fi MediaConnect\HTSRecover.exe[3168] C:\Windows\syswow64\WININET.dll!HttpEndRequestW                    000000007647edb7 6 bytes [68, AC, DC, 1A, 00, C3]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[596] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69      0000000074cf1465 2 bytes [CF, 74]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[596] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155    0000000074cf14bb 2 bytes [CF, 74]
.text  ...                                                                                                                                        * 2

---- Threads - GMER 2.1 ----

Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [1380:2596]                                                                            000007fefb9f2a88
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [1380:2588]                                                                            000007fef043c0b0
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [1380:1288]                                                                            000007fef7845124
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [1380:2912]                                                                            000007fef03a9e68
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [1380:948]                                                                              000007fef043c0b0

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                                         
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                        (null)
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                        0x00 0x00 0x00 0x00 ...
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                        0
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                    0x20 0x0A 0xEF 0xB6 ...
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                                                 
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                              0x20 0x01 0x00 0x00 ...
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                            0x78 0x26 0x7F 0xE2 ...
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                                           
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                      0x0E 0x20 0x67 0x95 ...
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                     
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                            (null)
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                            0x00 0x00 0x00 0x00 ...
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                            0
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                        0x20 0x0A 0xEF 0xB6 ...
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)                             
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                                  0x20 0x01 0x00 0x00 ...
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                                0x78 0x26 0x7F 0xE2 ...
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)                       
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                          0x0E 0x20 0x67 0x95 ...

---- EOF - GMER 2.1 ----
--- --- ---

markusg 18.02.2013 19:29
hi
als Info, bitte antworte dir, solltest du mal wieder ein Thema erstellen, nicht selbst, denn dann ist das Thema in arbeit und du bekommst deine Antwort erst evtl. später.
Poste noch die malwarebytes, combofix und sonstigen Logs.
aja, und combofix und andere Remover nicht mehr auf eigene Faust einsetzen bitte.

Jamal 18.02.2013 19:37
Hallo,
Danke schonmal für die schnelle Antwort, habe selbst geantwortet da die Anzahl maximal erlaubter Textzeichen überschritten war im ersten Post.

Hier die weiteren Logs von gestern (chronologisch):

Antivir:


Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Sonntag, 17. Februar 2013 16:53

Es wird nach 5003594 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer : Avira AntiVir Personal - Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 x64
Windowsversion : (plain) [6.1.7600]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : PC-PC

Versionsinformationen:
BUILD.DAT : 10.2.0.719 36070 Bytes 25.10.2012 10:38:00
AVSCAN.EXE : 10.3.0.7 484008 Bytes 04.07.2011 15:02:09
AVSCAN.DLL : 10.0.5.0 57192 Bytes 04.07.2011 15:02:09
LUKE.DLL : 10.3.0.5 45416 Bytes 04.07.2011 15:02:10
LUKERES.DLL : 10.0.0.0 13672 Bytes 14.01.2010 09:59:47
AVSCPLR.DLL : 10.3.0.7 119656 Bytes 04.07.2011 15:02:10
AVREG.DLL : 10.3.0.9 88833 Bytes 28.07.2011 20:01:18
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 07:05:36
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 19:54:45
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 14:23:35
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 13:12:53
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 13:12:56
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.06.2012 19:56:08
VBASE006.VDF : 7.11.41.250 4902400 Bytes 06.09.2012 20:47:28
VBASE007.VDF : 7.11.50.230 3904512 Bytes 22.11.2012 18:07:28
VBASE008.VDF : 7.11.60.10 6627328 Bytes 07.02.2013 15:30:48
VBASE009.VDF : 7.11.60.11 2048 Bytes 07.02.2013 15:30:48
VBASE010.VDF : 7.11.60.12 2048 Bytes 07.02.2013 15:30:48
VBASE011.VDF : 7.11.60.13 2048 Bytes 07.02.2013 15:30:48
VBASE012.VDF : 7.11.60.14 2048 Bytes 07.02.2013 15:30:48
VBASE013.VDF : 7.11.60.62 351232 Bytes 08.02.2013 15:30:49
VBASE014.VDF : 7.11.60.115 190976 Bytes 09.02.2013 15:30:49
VBASE015.VDF : 7.11.60.177 282624 Bytes 11.02.2013 14:26:50
VBASE016.VDF : 7.11.60.249 215552 Bytes 13.02.2013 14:26:50
VBASE017.VDF : 7.11.60.250 2048 Bytes 13.02.2013 14:26:50
VBASE018.VDF : 7.11.60.251 2048 Bytes 13.02.2013 14:26:50
VBASE019.VDF : 7.11.60.252 2048 Bytes 13.02.2013 14:26:50
VBASE020.VDF : 7.11.60.253 2048 Bytes 13.02.2013 14:26:50
VBASE021.VDF : 7.11.60.254 2048 Bytes 13.02.2013 14:26:50
VBASE022.VDF : 7.11.60.255 2048 Bytes 13.02.2013 14:26:50
VBASE023.VDF : 7.11.61.0 2048 Bytes 13.02.2013 14:26:51
VBASE024.VDF : 7.11.61.1 2048 Bytes 13.02.2013 14:26:51
VBASE025.VDF : 7.11.61.2 2048 Bytes 13.02.2013 14:26:52
VBASE026.VDF : 7.11.61.3 2048 Bytes 13.02.2013 14:26:52
VBASE027.VDF : 7.11.61.4 2048 Bytes 13.02.2013 14:26:52
VBASE028.VDF : 7.11.61.5 2048 Bytes 13.02.2013 14:26:53
VBASE029.VDF : 7.11.61.6 2048 Bytes 13.02.2013 14:26:53
VBASE030.VDF : 7.11.61.7 2048 Bytes 13.02.2013 14:26:53
VBASE031.VDF : 7.11.61.30 93696 Bytes 14.02.2013 14:26:54
Engineversion : 8.2.10.250
AEVDF.DLL : 8.1.2.10 102772 Bytes 18.07.2012 13:25:29
AESCRIPT.DLL : 8.1.4.88 471417 Bytes 09.02.2013 15:30:55
AESCN.DLL : 8.1.10.0 131445 Bytes 14.12.2012 09:42:25
AESBX.DLL : 8.2.5.12 606578 Bytes 17.06.2012 17:56:57
AERDL.DLL : 8.2.0.88 643444 Bytes 11.01.2013 09:47:46
AEPACK.DLL : 8.3.1.2 819574 Bytes 27.12.2012 14:36:12
AEOFFICE.DLL : 8.1.2.50 201084 Bytes 09.11.2012 14:02:55
AEHEUR.DLL : 8.1.4.198 5751159 Bytes 09.02.2013 15:30:55
AEHELP.DLL : 8.1.25.2 258423 Bytes 12.10.2012 10:59:16
AEGEN.DLL : 8.1.6.16 434549 Bytes 27.01.2013 16:18:41
AEEXP.DLL : 8.3.0.24 188787 Bytes 09.02.2013 15:30:56
AEEMU.DLL : 8.1.3.2 393587 Bytes 18.07.2012 13:25:27
AECORE.DLL : 8.1.30.0 201079 Bytes 14.12.2012 09:42:23
AEBB.DLL : 8.1.1.4 53619 Bytes 09.11.2012 14:02:49
AVWINLL.DLL : 10.0.0.0 19304 Bytes 14.01.2010 09:59:10
AVPREF.DLL : 10.0.3.2 44904 Bytes 04.07.2011 15:02:09
AVREP.DLL : 10.0.0.10 174120 Bytes 22.05.2011 18:40:57
AVARKT.DLL : 10.0.26.1 255336 Bytes 04.07.2011 15:02:09
AVEVTLOG.DLL : 10.0.0.9 203112 Bytes 04.07.2011 15:02:09
SQLITE3.DLL : 3.6.19.0 355688 Bytes 28.01.2010 10:57:53
AVSMTP.DLL : 10.0.0.17 63848 Bytes 16.03.2010 13:38:54
NETNT.DLL : 10.0.0.0 11624 Bytes 19.02.2010 12:40:55
RCIMAGE.DLL : 10.0.0.35 2589544 Bytes 04.07.2011 15:02:09
RCTEXT.DLL : 10.0.64.0 98664 Bytes 04.07.2011 15:02:09

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\program files (x86)\avira\antivir desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Abweichende Gefahrenkategorien........: +JOKE,

Beginn des Suchlaufs: Sonntag, 17. Februar 2013 16:53

Der Suchlauf nach versteckten Objekten wird begonnen.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'HTSRecover.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'ctfmon.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'Wi-Fi MediaConnect.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '48' Modul(e) wurden durchsucht

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '200' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'
C:\Users\pc\AppData\Local\Temp\jar_cache2072437953027560202.tmp
[0] Archivtyp: ZIP
--> Gooer.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Rilly.DX
--> Millll.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.RM
--> Siizi.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Strex.AV
--> Ziinni.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Treams.IW.3

Beginne mit der Desinfektion:
C:\Users\pc\AppData\Local\Temp\jar_cache2072437953027560202.tmp
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Treams.IW.3
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '577ca4b2.qua' verschoben!


Ende des Suchlaufs: Sonntag, 17. Februar 2013 17:34
Benötigte Zeit: 40:54 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

22204 Verzeichnisse wurden überprüft
325221 Dateien wurden geprüft
4 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
1 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
325217 Dateien ohne Befall
4007 Archive wurden durchsucht
0 Warnungen
1 Hinweise
493390 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden



Malwarebytes Anti-Malware 1.70.0.1100
Malwarebytes : Free anti-malware download

Datenbank Version: v2012.12.14.11

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
pc :: PC-PC [Administrator]

17.02.2013 17:41:23
mbam-log-2013-02-17 (17-41-23).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 204141
Laufzeit: 1 Minute(n), 7 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 6
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 2
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser|{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten: ;áÃzÊ;XA³0öm»Áµ -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten: -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\pc\AppData\Roaming\skype.dat (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Malwarebytes Anti-Malware 1.70.0.1100
Malwarebytes : Free anti-malware download

Datenbank Version: v2012.12.14.11

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
pc :: PC-PC [Administrator]

17.02.2013 17:41:23
MBAM-log-2013-02-17 (17-46-10).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 204141
Laufzeit: 1 Minute(n), 7 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 6
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 2
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser|{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten: ;áÃzÊ;XA³0öm»Áµ -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten: -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\pc\AppData\Roaming\skype.dat (Trojan.Agent) -> Keine Aktion durchgeführt.

(Ende)


ComboFix:
Combofix Logfile:
Code:
ComboFix 13-02-15.01 - pc 17.02.2013  17:58:41.1.8 - x64
Microsoft Windows 7 Home Premium  6.1.7600.0.1252.49.1031.18.9207.7750 [GMT 1:00]
ausgeführt von:: c:\users\pc\Desktop\antivirusproggis\ComboFix.exe
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\pc\AppData\Roaming\Mionit
c:\users\pc\AppData\Roaming\Mionit\dygay.ycy
c:\windows\SysWow64\AF15BDAEX.dll
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-01-17 bis 2013-02-17  ))))))))))))))))))))))))))))))
.
.
2013-02-17 17:02 . 2013-02-17 17:02        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-02-17 16:40 . 2013-02-17 16:40        --------        d-----w-        c:\users\pc\AppData\Roaming\Malwarebytes
2013-02-17 16:40 . 2013-02-17 16:40        --------        d-----w-        c:\programdata\Malwarebytes
2013-02-17 16:40 . 2013-02-17 16:40        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2013-02-17 16:40 . 2012-12-14 15:49        24176        ----a-w-        c:\windows\system32\drivers\mbam.sys
2013-02-17 16:39 . 2013-02-17 16:39        --------        d-----w-        c:\users\pc\AppData\Local\Programs
2013-02-17 15:53 . 2013-02-17 15:53        --------        d-----w-        c:\users\pc\AppData\Roaming\Avira
2013-02-14 15:36 . 2013-02-17 15:25        --------        d-----w-        c:\users\pc\AppData\Roaming\Zuew
2013-02-01 11:36 . 2013-02-01 11:36        --------        d-----w-        c:\users\Public\CyberLink
2013-02-01 11:36 . 2013-02-01 11:36        --------        d-----w-        c:\users\pc\AppData\Local\Cyberlink
2013-02-01 11:35 . 2013-02-01 11:37        --------        d-----w-        c:\programdata\CyberLink
2013-02-01 11:35 . 2013-02-01 11:35        --------        d-----w-        c:\program files (x86)\Common Files\Nikon
2013-02-01 11:34 . 2013-02-01 11:34        --------        d-----w-        c:\program files (x86)\CyberLink
2013-02-01 11:33 . 2013-02-01 11:33        --------        d-----w-        c:\programdata\install_clap
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-25 21:04 . 2012-06-13 21:43        697272        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-11-25 21:04 . 2011-12-06 15:54        73656        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2010-11-04 281768]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Wi-Fi MediaConnect.lnk - c:\program files (x86)\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe [2012-8-21 2345984]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R3 athur;Wireless Network Adapter Service;c:\windows\system32\DRIVERS\athurx.sys [2010-09-16 1918976]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-06-26 834544]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-05-02 136360]
S3 e1yexpress;Intel(R) Gigabit-Netzwerkverbindungstreiber;c:\windows\system32\DRIVERS\e1y60x64.sys [2009-06-10 281088]
S3 WFMC_VAD;WFMCVAD (WDM);c:\windows\system32\DRIVERS\wfmcvad.sys [2010-02-08 24064]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-02-04 17:10        1607120        ----a-w-        c:\program files (x86)\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-25 21:05]
.
2013-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-25 21:05]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2010-11-03 1580368]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
.
.
------- Dateityp-Verknüpfung -------
.
JSEFile=%SystemRoot%\SysWow64\CScript.exe "%1" %*
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-02-17  18:03:23
ComboFix-quarantined-files.txt  2013-02-17 17:03
.
Vor Suchlauf: 7 Verzeichnis(se), 743.650.988.032 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 744.548.691.968 Bytes frei
.
- - End Of File - - 38940C92D2D9FCD87AD3AFEF05912C79
--- --- ---



Die MBAM-Logs von heute:

Malwarebytes Anti-Malware 1.70.0.1100
Malwarebytes : Free anti-malware download

Datenbank Version: v2012.12.14.11

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
pc :: PC-PC [Administrator]

18.02.2013 17:54:14
mbam-log-2013-02-18 (17-54-14).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 227661
Laufzeit: 1 Minute(n), 35 Sekunde(n)

Infizierte Speicherprozesse: 1
C:\Users\pc\crss.exe (Trojan.Agent) -> 4288 -> Löschen bei Neustart.

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 3
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Profile Manager2 (Trojan.Agent) -> Daten: C:\Users\pc\crss.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Document Explorer2 (Trojan.Agent) -> Daten: C:\Users\pc\Documents\crss.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Download Manager2 (Trojan.Agent) -> Daten: C:\Users\pc\Downloads\crss.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
C:\Users\pc\wgsdgsdgdsgsd.exe (Exploit.Drop.GS) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\pc\crss.exe (Trojan.Agent) -> Löschen bei Neustart.
C:\Users\pc\Documents\crss.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\pc\Downloads\crss.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)


Malwarebytes Anti-Malware 1.70.0.1100
Malwarebytes : Free anti-malware download

Datenbank Version: v2012.12.14.11

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
pc :: PC-PC [Administrator]

18.02.2013 17:54:14
MBAM-log-2013-02-18 (18-01-31).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 227661
Laufzeit: 1 Minute(n), 35 Sekunde(n)

Infizierte Speicherprozesse: 1
C:\Users\pc\crss.exe (Trojan.Agent) -> 4288 -> Keine Aktion durchgeführt.

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 3
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Profile Manager2 (Trojan.Agent) -> Daten: C:\Users\pc\crss.exe -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Document Explorer2 (Trojan.Agent) -> Daten: C:\Users\pc\Documents\crss.exe -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Download Manager2 (Trojan.Agent) -> Daten: C:\Users\pc\Downloads\crss.exe -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
C:\Users\pc\wgsdgsdgdsgsd.exe (Exploit.Drop.GS) -> Keine Aktion durchgeführt.
C:\Users\pc\crss.exe (Trojan.Agent) -> Keine Aktion durchgeführt.
C:\Users\pc\Documents\crss.exe (Trojan.Agent) -> Keine Aktion durchgeführt.
C:\Users\pc\Downloads\crss.exe (Trojan.Agent) -> Keine Aktion durchgeführt.

(Ende)

markusg 18.02.2013 21:24
hi,
http://www.trojaner-board.de/125889-...en-posten.html
schau bitte obs weitere Avira Funde gibt, und poste sie

Jamal 19.02.2013 13:43
Antivir-Log von gestern Abend:



Avira Free Antivirus
Erstellungsdatum der Reportdatei: Montag, 18. Februar 2013 21:50


Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer : Avira Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (plain) [6.1.7600]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : PC-PC

Versionsinformationen:
BUILD.DAT : 13.0.0.3185 47702 Bytes 30.01.2013 10:05:00
AVSCAN.EXE : 13.6.0.584 640224 Bytes 17.02.2013 17:28:06
AVSCANRC.DLL : 13.4.0.360 64800 Bytes 17.02.2013 17:28:07
LUKE.DLL : 13.6.0.602 67808 Bytes 17.02.2013 17:28:33
AVSCPLR.DLL : 13.6.0.628 94432 Bytes 17.02.2013 17:29:14
AVREG.DLL : 13.6.0.600 250592 Bytes 17.02.2013 17:29:14
avlode.dll : 13.6.2.624 434912 Bytes 17.02.2013 17:29:15
avlode.rdf : 13.0.0.38 15231 Bytes 17.02.2013 17:29:14
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 07:05:36
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 19:54:45
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 14:23:35
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 13:12:53
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 13:12:56
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.06.2012 19:56:08
VBASE006.VDF : 7.11.41.250 4902400 Bytes 06.09.2012 20:47:28
VBASE007.VDF : 7.11.50.230 3904512 Bytes 22.11.2012 18:07:28
VBASE008.VDF : 7.11.60.10 6627328 Bytes 07.02.2013 15:30:48
VBASE009.VDF : 7.11.60.11 2048 Bytes 07.02.2013 15:30:48
VBASE010.VDF : 7.11.60.12 2048 Bytes 07.02.2013 15:30:48
VBASE011.VDF : 7.11.60.13 2048 Bytes 07.02.2013 15:30:48
VBASE012.VDF : 7.11.60.14 2048 Bytes 07.02.2013 15:30:48
VBASE013.VDF : 7.11.60.62 351232 Bytes 08.02.2013 15:30:49
VBASE014.VDF : 7.11.60.115 190976 Bytes 09.02.2013 15:30:49
VBASE015.VDF : 7.11.60.177 282624 Bytes 11.02.2013 14:26:50
VBASE016.VDF : 7.11.60.249 215552 Bytes 13.02.2013 14:26:50
VBASE017.VDF : 7.11.61.65 151040 Bytes 15.02.2013 17:17:52
VBASE018.VDF : 7.11.61.135 159232 Bytes 18.02.2013 15:15:49
VBASE019.VDF : 7.11.61.136 2048 Bytes 18.02.2013 15:15:49
VBASE020.VDF : 7.11.61.137 2048 Bytes 18.02.2013 15:15:49
VBASE021.VDF : 7.11.61.138 2048 Bytes 18.02.2013 15:15:49
VBASE022.VDF : 7.11.61.139 2048 Bytes 18.02.2013 15:15:49
VBASE023.VDF : 7.11.61.140 2048 Bytes 18.02.2013 15:15:49
VBASE024.VDF : 7.11.61.141 2048 Bytes 18.02.2013 15:15:50
VBASE025.VDF : 7.11.61.142 2048 Bytes 18.02.2013 15:15:50
VBASE026.VDF : 7.11.61.143 2048 Bytes 18.02.2013 15:15:50
VBASE027.VDF : 7.11.61.144 2048 Bytes 18.02.2013 15:15:50
VBASE028.VDF : 7.11.61.145 2048 Bytes 18.02.2013 15:15:50
VBASE029.VDF : 7.11.61.146 2048 Bytes 18.02.2013 15:15:50
VBASE030.VDF : 7.11.61.147 2048 Bytes 18.02.2013 15:15:50
VBASE031.VDF : 7.11.61.154 103936 Bytes 18.02.2013 15:15:50
Engineversion : 8.2.12.2
AEVDF.DLL : 8.1.2.10 102772 Bytes 18.07.2012 13:25:29
AESCRIPT.DLL : 8.1.4.92 471418 Bytes 17.02.2013 17:17:58
AESCN.DLL : 8.1.10.0 131445 Bytes 14.12.2012 09:42:25
AESBX.DLL : 8.2.5.12 606578 Bytes 17.06.2012 17:56:57
AERDL.DLL : 8.2.0.88 643444 Bytes 11.01.2013 09:47:46
AEPACK.DLL : 8.3.1.2 819574 Bytes 27.12.2012 14:36:12
AEOFFICE.DLL : 8.1.2.50 201084 Bytes 09.11.2012 14:02:55
AEHEUR.DLL : 8.1.4.206 5747064 Bytes 17.02.2013 17:17:58
AEHELP.DLL : 8.1.25.2 258423 Bytes 12.10.2012 10:59:16
AEGEN.DLL : 8.1.6.16 434549 Bytes 27.01.2013 16:18:41
AEEXP.DLL : 8.4.0.0 188788 Bytes 17.02.2013 17:17:59
AEEMU.DLL : 8.1.3.2 393587 Bytes 18.07.2012 13:25:27
AECORE.DLL : 8.1.31.0 201079 Bytes 17.02.2013 17:17:54
AEBB.DLL : 8.1.1.4 53619 Bytes 09.11.2012 14:02:49
AVWINLL.DLL : 13.6.0.480 26480 Bytes 17.02.2013 17:27:33
AVPREF.DLL : 13.6.0.480 51056 Bytes 17.02.2013 17:28:06
AVREP.DLL : 13.6.0.480 178544 Bytes 17.02.2013 17:29:14
AVARKT.DLL : 13.6.0.624 260832 Bytes 17.02.2013 17:28:01
AVEVTLOG.DLL : 13.6.0.600 167648 Bytes 17.02.2013 17:28:03
SQLITE3.DLL : 3.7.0.1 397704 Bytes 17.02.2013 17:28:52
AVSMTP.DLL : 13.6.0.480 62832 Bytes 17.02.2013 17:28:08
NETNT.DLL : 13.6.0.480 16240 Bytes 17.02.2013 17:28:40
RCIMAGE.DLL : 13.4.0.360 4780832 Bytes 17.02.2013 17:27:34
RCTEXT.DLL : 13.6.0.480 68976 Bytes 17.02.2013 17:27:35

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\program files (x86)\avira\antivir desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Abweichende Gefahrenkategorien........: +JOKE,

Beginn des Suchlaufs: Montag, 18. Februar 2013 21:50

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf nach versteckten Objekten wird begonnen.
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM\LastServiceStopMissed
[HINWEIS] Der Registrierungseintrag ist nicht sichtbar.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Media Player NSS\3.0\Events\{DDD75310-B80E-4D48-9342-7562D0437A0A}
[HINWEIS] Der Registrierungseintrag ist nicht sichtbar.
HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0013\Linkage\UpperBind
[HINWEIS] Der Registrierungseintrag ist nicht sichtbar.
HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{0E1B2448-CEBF-4188-A340-CA6621D2FC9E}\Connection\Name
[HINWEIS] Der Registrierungseintrag ist nicht sichtbar.
HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage\Bind
[HINWEIS] Der Registrierungseintrag ist nicht sichtbar.
HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage\Route
[HINWEIS] Der Registrierungseintrag ist nicht sichtbar.
HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage\Export
[HINWEIS] Der Registrierungseintrag ist nicht sichtbar.
HKEY_USERS\S-1-5-21-3416115630-340451511-4130199794-1000\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.100\CheckSetting
[HINWEIS] Der Registrierungseintrag ist nicht sichtbar.
HKEY_USERS\S-1-5-21-3416115630-340451511-4130199794-1000\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.102\CheckSetting
[HINWEIS] Der Registrierungseintrag ist nicht sichtbar.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '103' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '159' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvxdsync.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '151' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'Wi-Fi MediaConnect.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvtray.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'ctfmon.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'HTSRecover.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'idfa.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '96' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '123' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'daemonu.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'sppsvc.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '113' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '1714' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'


Ende des Suchlaufs: Montag, 18. Februar 2013 22:40
Benötigte Zeit: 50:13 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

25129 Verzeichnisse wurden überprüft
471675 Dateien wurden geprüft
0 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
471675 Dateien ohne Befall
11052 Archive wurden durchsucht
0 Warnungen
9 Hinweise
702005 Objekte wurden beim Rootkitscan durchsucht
9 Versteckte Objekte wurden gefunden

markusg 19.02.2013 13:47
das nächste Mal lies richtig bitte. lies mal was oben steht.
ich wollte kein neues Log.

Jamal 19.02.2013 13:50
OKay, sorry. Antivir gibt keine Funde aus.
Nach meiner ersten antiviralen Therapie am Sonntag kam beim Scan mit Antivir ebenfalls kein Fund raus. Nachdem der PC dann wieder wenige Stunden am Internet war meldete sicher aber die Firewall zu Wort und MBAM wurde wieder fündig.

markusg 19.02.2013 13:53
ok, weiter:
[OTLFIX]

Jamal 19.02.2013 14:01
Wie Fixe ich mit OTL? Weiß nicht wie ich son Fix-File erstelle. Danke schomal.

markusg 19.02.2013 17:39
sorry,
Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Jamal 19.02.2013 17:46
Ergebnis von TDSS-Killer:

"No threats found"

markusg 19.02.2013 19:08
log posten bitte.

Jamal 19.02.2013 19:25
17:43:41.0344 3356 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
17:43:41.0344 3356 ============================================================
17:43:41.0344 3356 Current date / time: 2013/02/19 17:43:41.0344
17:43:41.0344 3356 SystemInfo:
17:43:41.0344 3356
17:43:41.0344 3356 OS Version: 6.1.7600 ServicePack: 0.0
17:43:41.0344 3356 Product type: Workstation
17:43:41.0344 3356 ComputerName: PC-PC
17:43:41.0344 3356 UserName: pc
17:43:41.0344 3356 Windows directory: C:\Windows
17:43:41.0344 3356 System windows directory: C:\Windows
17:43:41.0344 3356 Running under WOW64
17:43:41.0344 3356 Processor architecture: Intel x64
17:43:41.0344 3356 Number of processors: 8
17:43:41.0344 3356 Page size: 0x1000
17:43:41.0344 3356 Boot type: Normal boot
17:43:41.0344 3356 ============================================================
17:43:42.0202 3356 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
17:43:42.0217 3356 Drive \Device\Harddisk1\DR2 - Size: 0x1ED8A8000 (7.71 Gb), SectorSize: 0x200, Cylinders: 0x3EE, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
17:43:42.0217 3356 ============================================================
17:43:42.0217 3356 \Device\Harddisk0\DR0:
17:43:42.0217 3356 MBR partitions:
17:43:42.0217 3356 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1D4C800, BlocksNum 0x729B9800
17:43:42.0217 3356 \Device\Harddisk1\DR2:
17:43:42.0217 3356 MBR partitions:
17:43:42.0217 3356 \Device\Harddisk1\DR2\Partition1: MBR, Type 0xB, StartLBA 0x2B0, BlocksNum 0xF6C290
17:43:42.0217 3356 ============================================================
17:43:42.0233 3356 C: <-> \Device\Harddisk0\DR0\Partition1
17:43:42.0233 3356 ============================================================
17:43:42.0233 3356 Initialize success
17:43:42.0233 3356 ============================================================
17:44:17.0364 3024 ============================================================
17:44:17.0364 3024 Scan started
17:44:17.0364 3024 Mode: Manual; SigCheck; TDLFS;
17:44:17.0364 3024 ============================================================
17:44:17.0957 3024 ================ Scan system memory ========================
17:44:17.0957 3024 System memory - ok
17:44:17.0957 3024 ================ Scan services =============================
17:44:18.0066 3024 [ 1B00662092F9F9568B995902F0CC40D5 ] 1394ohci C:\Windows\system32\DRIVERS\1394ohci.sys
17:44:18.0128 3024 1394ohci - ok
17:44:18.0160 3024 [ 6F11E88748CDEFD2F76AA215F97DDFE5 ] ACPI C:\Windows\system32\DRIVERS\ACPI.sys
17:44:18.0175 3024 ACPI - ok
17:44:18.0175 3024 [ 63B05A0420CE4BF0E4AF6DCC7CADA254 ] AcpiPmi C:\Windows\system32\DRIVERS\acpipmi.sys
17:44:18.0206 3024 AcpiPmi - ok
17:44:18.0253 3024 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
17:44:18.0269 3024 adp94xx - ok
17:44:18.0300 3024 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
17:44:18.0300 3024 adpahci - ok
17:44:18.0331 3024 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
17:44:18.0331 3024 adpu320 - ok
17:44:18.0362 3024 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
17:44:18.0409 3024 AeLookupSvc - ok
17:44:18.0456 3024 [ 0517E1670A58213E3F206066CD209273 ] AF15BDA C:\Windows\system32\DRIVERS\AF15BDA.sys
17:44:18.0472 3024 AF15BDA - ok
17:44:18.0565 3024 [ 0D0E5281784C2C526BA43C2ECD374288 ] Afc C:\Windows\syswow64\drivers\Afc.sys
17:44:18.0565 3024 Afc - ok
17:44:18.0628 3024 [ DB9D6C6B2CD95A9CA414D045B627422E ] AFD C:\Windows\system32\drivers\afd.sys
17:44:18.0643 3024 AFD - ok
17:44:18.0674 3024 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\DRIVERS\agp440.sys
17:44:18.0690 3024 agp440 - ok
17:44:18.0721 3024 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe
17:44:18.0752 3024 ALG - ok
17:44:18.0768 3024 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\DRIVERS\aliide.sys
17:44:18.0784 3024 aliide - ok
17:44:18.0799 3024 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\DRIVERS\amdide.sys
17:44:18.0799 3024 amdide - ok
17:44:18.0815 3024 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
17:44:18.0846 3024 AmdK8 - ok
17:44:18.0846 3024 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
17:44:18.0877 3024 AmdPPM - ok
17:44:18.0924 3024 [ 7A4B413614C055935567CF88A9734D38 ] amdsata C:\Windows\system32\DRIVERS\amdsata.sys
17:44:18.0924 3024 amdsata - ok
17:44:18.0955 3024 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
17:44:18.0971 3024 amdsbs - ok
17:44:18.0986 3024 [ B4AD0CACBAB298671DD6F6EF7E20679D ] amdxata C:\Windows\system32\DRIVERS\amdxata.sys
17:44:19.0002 3024 amdxata - ok
17:44:19.0080 3024 [ 459465DA28E49B358ECFE0D788F328F4 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
17:44:19.0080 3024 AntiVirSchedulerService - ok
17:44:19.0142 3024 [ BCDD17E8469D647A71B347C4B6F86685 ] AntiVirService C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
17:44:19.0142 3024 AntiVirService - ok
17:44:19.0174 3024 [ 42FD751B27FA0E9C69BB39F39E409594 ] AppID C:\Windows\system32\drivers\appid.sys
17:44:19.0205 3024 AppID - ok
17:44:19.0236 3024 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll
17:44:19.0283 3024 AppIDSvc - ok
17:44:19.0314 3024 [ D065BE66822847B7F127D1F90158376E ] Appinfo C:\Windows\System32\appinfo.dll
17:44:19.0330 3024 Appinfo - ok
17:44:19.0392 3024 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\DRIVERS\arc.sys
17:44:19.0408 3024 arc - ok
17:44:19.0423 3024 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
17:44:19.0439 3024 arcsas - ok
17:44:19.0454 3024 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
17:44:19.0501 3024 AsyncMac - ok
17:44:19.0517 3024 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\DRIVERS\atapi.sys
17:44:19.0532 3024 atapi - ok
17:44:19.0595 3024 [ 417B9BAB376E8E50F6770196656FD348 ] athur C:\Windows\system32\DRIVERS\athurx.sys
17:44:19.0642 3024 athur - ok
17:44:19.0673 3024 [ 07721A77180EDD4D39CCB865BF63C7FD ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
17:44:19.0735 3024 AudioEndpointBuilder - ok
17:44:19.0766 3024 [ 07721A77180EDD4D39CCB865BF63C7FD ] AudioSrv C:\Windows\System32\Audiosrv.dll
17:44:19.0798 3024 AudioSrv - ok
17:44:19.0829 3024 [ BFE9598EBC3934CF8D876A303849C896 ] avgntflt C:\Windows\system32\DRIVERS\avgntflt.sys
17:44:19.0829 3024 avgntflt - ok
17:44:19.0891 3024 [ F74D86A9FB35FA5F24627B8DBBF3A9A4 ] avipbb C:\Windows\system32\DRIVERS\avipbb.sys
17:44:19.0907 3024 avipbb - ok
17:44:19.0907 3024 [ CD0E732347BF09717E0BDDC0C66699AB ] avkmgr C:\Windows\system32\DRIVERS\avkmgr.sys
17:44:19.0922 3024 avkmgr - ok
17:44:19.0938 3024 [ B20B5FA5CA050E9926E4D1DB81501B32 ] AxInstSV C:\Windows\System32\AxInstSV.dll
17:44:19.0969 3024 AxInstSV - ok
17:44:20.0016 3024 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys
17:44:20.0047 3024 b06bdrv - ok
17:44:20.0094 3024 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
17:44:20.0125 3024 b57nd60a - ok
17:44:20.0172 3024 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll
17:44:20.0172 3024 BDESVC - ok
17:44:20.0188 3024 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys
17:44:20.0219 3024 Beep - ok
17:44:20.0281 3024 [ 4992C609A6315671463E30F6512BC022 ] BFE C:\Windows\System32\bfe.dll
17:44:20.0359 3024 BFE - ok
17:44:20.0390 3024 [ 7F0C323FE3DA28AA4AA1BDA3F575707F ] BITS C:\Windows\system32\qmgr.dll
17:44:20.0453 3024 BITS - ok
17:44:20.0484 3024 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
17:44:20.0515 3024 blbdrive - ok
17:44:20.0531 3024 [ 19D20159708E152267E53B66677A4995 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
17:44:20.0562 3024 bowser - ok
17:44:20.0593 3024 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
17:44:20.0609 3024 BrFiltLo - ok
17:44:20.0609 3024 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
17:44:20.0624 3024 BrFiltUp - ok
17:44:20.0656 3024 [ 5C2F352A4E961D72518261257AAE204B ] BridgeMP C:\Windows\system32\DRIVERS\bridge.sys
17:44:20.0687 3024 BridgeMP - ok
17:44:20.0718 3024 [ 6B054C67AAA87843504E8E3C09102009 ] Browser C:\Windows\System32\browser.dll
17:44:20.0734 3024 Browser - ok
17:44:20.0749 3024 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys
17:44:20.0780 3024 Brserid - ok
17:44:20.0780 3024 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
17:44:20.0812 3024 BrSerWdm - ok
17:44:20.0812 3024 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
17:44:20.0812 3024 BrUsbMdm - ok
17:44:20.0827 3024 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
17:44:20.0843 3024 BrUsbSer - ok
17:44:20.0858 3024 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
17:44:20.0874 3024 BTHMODEM - ok
17:44:20.0936 3024 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll
17:44:20.0983 3024 bthserv - ok
17:44:21.0014 3024 catchme - ok
17:44:21.0046 3024 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
17:44:21.0077 3024 cdfs - ok
17:44:21.0108 3024 [ 83D2D75E1EFB81B3450C18131443F7DB ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
17:44:21.0139 3024 cdrom - ok
17:44:21.0170 3024 [ 312E2F82AF11E79906898AC3E3D58A1F ] CertPropSvc C:\Windows\System32\certprop.dll
17:44:21.0202 3024 CertPropSvc - ok
17:44:21.0202 3024 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\DRIVERS\circlass.sys
17:44:21.0233 3024 circlass - ok
17:44:21.0264 3024 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys
17:44:21.0280 3024 CLFS - ok
17:44:21.0342 3024 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
17:44:21.0342 3024 clr_optimization_v2.0.50727_32 - ok
17:44:21.0389 3024 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
17:44:21.0389 3024 clr_optimization_v2.0.50727_64 - ok
17:44:21.0436 3024 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
17:44:21.0451 3024 CmBatt - ok
17:44:21.0482 3024 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\DRIVERS\cmdide.sys
17:44:21.0482 3024 cmdide - ok
17:44:21.0529 3024 [ CA7720B73446FDDEC5C69519C1174C98 ] CNG C:\Windows\system32\Drivers\cng.sys
17:44:21.0545 3024 CNG - ok
17:44:21.0560 3024 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
17:44:21.0560 3024 Compbatt - ok
17:44:21.0592 3024 [ F26B3A86F6FA87CA360B879581AB4123 ] CompositeBus C:\Windows\system32\DRIVERS\CompositeBus.sys
17:44:21.0607 3024 CompositeBus - ok
17:44:21.0623 3024 COMSysApp - ok
17:44:21.0638 3024 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
17:44:21.0654 3024 crcdisk - ok
17:44:21.0685 3024 [ BAF19B633933A9FB4883D27D66C39E9A ] CryptSvc C:\Windows\system32\cryptsvc.dll
17:44:21.0701 3024 CryptSvc - ok
17:44:21.0732 3024 [ 7266972E86890E2B30C0C322E906B027 ] DcomLaunch C:\Windows\system32\rpcss.dll
17:44:21.0779 3024 DcomLaunch - ok
17:44:21.0826 3024 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll
17:44:21.0872 3024 defragsvc - ok
17:44:21.0919 3024 [ 9C253CE7311CA60FC11C774692A13208 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
17:44:21.0935 3024 DfsC - ok
17:44:21.0966 3024 [ CE3B9562D997F69B330D181A8875960F ] Dhcp C:\Windows\system32\dhcpcore.dll
17:44:21.0982 3024 Dhcp - ok
17:44:21.0997 3024 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys
17:44:22.0028 3024 discache - ok
17:44:22.0060 3024 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\DRIVERS\disk.sys
17:44:22.0075 3024 Disk - ok
17:44:22.0106 3024 [ 85CF424C74A1D5EC33533E1DBFF9920A ] Dnscache C:\Windows\System32\dnsrslvr.dll
17:44:22.0138 3024 Dnscache - ok
17:44:22.0169 3024 [ 14452ACDB09B70964C8C21BF80A13ACB ] dot3svc C:\Windows\System32\dot3svc.dll
17:44:22.0231 3024 dot3svc - ok
17:44:22.0247 3024 [ 8C2BA6BEA949EE6E68385F5692BAFB94 ] DPS C:\Windows\system32\dps.dll
17:44:22.0294 3024 DPS - ok
17:44:22.0325 3024 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
17:44:22.0340 3024 drmkaud - ok
17:44:22.0387 3024 [ 1633B9ABF52784A1331476397A48CBEF ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
17:44:22.0403 3024 DXGKrnl - ok
17:44:22.0434 3024 [ 50AD8FC1DC800FF36087994C8F7FDFF2 ] e1yexpress C:\Windows\system32\DRIVERS\e1y60x64.sys
17:44:22.0450 3024 e1yexpress - ok
17:44:22.0465 3024 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll
17:44:22.0512 3024 EapHost - ok
17:44:22.0590 3024 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys
17:44:22.0684 3024 ebdrv - ok
17:44:22.0699 3024 [ 156F6159457D0AA7E59B62681B56EB90 ] EFS C:\Windows\System32\lsass.exe
17:44:22.0730 3024 EFS - ok
17:44:22.0793 3024 [ 47C071994C3F649F23D9CD075AC9304A ] ehRecvr C:\Windows\ehome\ehRecvr.exe
17:44:22.0808 3024 ehRecvr - ok
17:44:22.0840 3024 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe
17:44:22.0855 3024 ehSched - ok
17:44:22.0902 3024 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
17:44:22.0918 3024 elxstor - ok
17:44:22.0933 3024 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\DRIVERS\errdev.sys
17:44:22.0949 3024 ErrDev - ok
17:44:22.0980 3024 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll
17:44:23.0042 3024 EventSystem - ok
17:44:23.0089 3024 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys
17:44:23.0136 3024 exfat - ok
17:44:23.0167 3024 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys
17:44:23.0214 3024 fastfat - ok
17:44:23.0261 3024 [ D607B2F1BEE3992AA6C2C92C0A2F0855 ] Fax C:\Windows\system32\fxssvc.exe
17:44:23.0308 3024 Fax - ok
17:44:23.0323 3024 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\DRIVERS\fdc.sys
17:44:23.0339 3024 fdc - ok
17:44:23.0339 3024 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll
17:44:23.0386 3024 fdPHost - ok
17:44:23.0401 3024 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll
17:44:23.0432 3024 FDResPub - ok
17:44:23.0448 3024 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
17:44:23.0448 3024 FileInfo - ok
17:44:23.0464 3024 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
17:44:23.0495 3024 Filetrace - ok
17:44:23.0510 3024 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
17:44:23.0510 3024 flpydisk - ok
17:44:23.0557 3024 [ F7866AF72ABBAF84B1FA5AA195378C59 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
17:44:23.0573 3024 FltMgr - ok
17:44:23.0713 3024 [ BC00505CFDA789ED3BE95D2FF38C4875 ] FontCache C:\Windows\system32\FntCache.dll
17:44:23.0744 3024 FontCache - ok
17:44:23.0791 3024 [ 8D89E3131C27FDD6932189CB785E1B7A ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
17:44:23.0791 3024 FontCache3.0.0.0 - ok
17:44:23.0838 3024 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
17:44:23.0838 3024 FsDepends - ok
17:44:24.0025 3024 [ D3E3F93D67821A2DB2B3D9FAC2DC2064 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
17:44:24.0025 3024 Fs_Rec - ok
17:44:24.0088 3024 [ AE87BA80D0EC3B57126ED2CDC15B24ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
17:44:24.0088 3024 fvevol - ok
17:44:24.0103 3024 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
17:44:24.0119 3024 gagp30kx - ok
17:44:24.0150 3024 [ FE5AB4525BC2EC68B9119A6E5D40128B ] gpsvc C:\Windows\System32\gpsvc.dll
17:44:24.0181 3024 gpsvc - ok
17:44:24.0244 3024 [ 506708142BC63DABA64F2D3AD1DCD5BF ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
17:44:24.0244 3024 gupdate - ok
17:44:24.0259 3024 [ 506708142BC63DABA64F2D3AD1DCD5BF ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
17:44:24.0275 3024 gupdatem - ok
17:44:24.0275 3024 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
17:44:24.0290 3024 hcw85cir - ok
17:44:24.0306 3024 [ 6410F6F415B2A5A9037224C41DA8BF12 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
17:44:24.0322 3024 HdAudAddService - ok
17:44:24.0337 3024 [ 0A49913402747A0B67DE940FB42CBDBB ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
17:44:24.0353 3024 HDAudBus - ok
17:44:24.0353 3024 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
17:44:24.0368 3024 HidBatt - ok
17:44:24.0368 3024 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
17:44:24.0400 3024 HidBth - ok
17:44:24.0415 3024 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
17:44:24.0446 3024 HidIr - ok
17:44:24.0478 3024 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\System32\hidserv.dll
17:44:24.0524 3024 hidserv - ok
17:44:24.0556 3024 [ B3BF6B5B50006DEF50B66306D99FCF6F ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
17:44:24.0571 3024 HidUsb - ok
17:44:24.0602 3024 [ EFA58EDE58DD74388FFD04CB32681518 ] hkmsvc C:\Windows\system32\kmsvc.dll
17:44:24.0634 3024 hkmsvc - ok
17:44:24.0649 3024 [ 046B2673767CA626E2CFB7FDF735E9E8 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
17:44:24.0680 3024 HomeGroupListener - ok
17:44:24.0712 3024 [ 06A7422224D9865A5613710A089987DF ] HomeGroupProvider C:\Windows\system32\provsvc.dll
17:44:24.0743 3024 HomeGroupProvider - ok
17:44:24.0758 3024 [ 0886D440058F203EBA0E1825E4355914 ] HpSAMD C:\Windows\system32\DRIVERS\HpSAMD.sys
17:44:24.0774 3024 HpSAMD - ok
17:44:24.0790 3024 [ CEE049CAC4EFA7F4E1E4AD014414A5D4 ] HTTP C:\Windows\system32\drivers\HTTP.sys
17:44:24.0836 3024 HTTP - ok
17:44:24.0852 3024 [ F17766A19145F111856378DF337A5D79 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
17:44:24.0852 3024 hwpolicy - ok
17:44:24.0883 3024 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
17:44:24.0883 3024 i8042prt - ok
17:44:24.0914 3024 [ D83EFB6FD45DF9D55E9A1AFC63640D50 ] iaStorV C:\Windows\system32\DRIVERS\iaStorV.sys
17:44:24.0930 3024 iaStorV - ok
17:44:24.0977 3024 [ 2F2BE70D3E02B6FA877921AB9516D43C ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
17:44:24.0992 3024 idsvc - ok
17:44:25.0008 3024 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
17:44:25.0008 3024 iirsp - ok
17:44:25.0039 3024 [ C5B4683680DF085B57BC53E5EF34861F ] IKEEXT C:\Windows\System32\ikeext.dll
17:44:25.0102 3024 IKEEXT - ok
17:44:25.0117 3024 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\DRIVERS\intelide.sys
17:44:25.0133 3024 intelide - ok
17:44:25.0148 3024 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
17:44:25.0180 3024 intelppm - ok
17:44:25.0195 3024 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll
17:44:25.0242 3024 IPBusEnum - ok
17:44:25.0273 3024 [ 722DD294DF62483CECAAE6E094B4D695 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
17:44:25.0289 3024 IpFilterDriver - ok
17:44:25.0304 3024 [ F8E058D17363EC580E4B7232778B6CB5 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
17:44:25.0336 3024 iphlpsvc - ok
17:44:25.0351 3024 [ E2B4A4494DB7CB9B89B55CA268C337C5 ] IPMIDRV C:\Windows\system32\DRIVERS\IPMIDrv.sys
17:44:25.0351 3024 IPMIDRV - ok
17:44:25.0351 3024 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys
17:44:25.0398 3024 IPNAT - ok
17:44:25.0429 3024 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
17:44:25.0460 3024 IRENUM - ok
17:44:25.0460 3024 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\DRIVERS\isapnp.sys
17:44:25.0476 3024 isapnp - ok
17:44:25.0507 3024 [ FA4D2557DE56D45B0A346F93564BE6E1 ] iScsiPrt C:\Windows\system32\DRIVERS\msiscsi.sys
17:44:25.0507 3024 iScsiPrt - ok
17:44:25.0538 3024 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
17:44:25.0538 3024 kbdclass - ok
17:44:25.0570 3024 [ 6DEF98F8541E1B5DCEB2C822A11F7323 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
17:44:25.0585 3024 kbdhid - ok
17:44:25.0601 3024 [ 156F6159457D0AA7E59B62681B56EB90 ] KeyIso C:\Windows\system32\lsass.exe
17:44:25.0616 3024 KeyIso - ok
17:44:25.0632 3024 [ 4F4B5FDE429416877DE7143044582EB5 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
17:44:25.0648 3024 KSecDD - ok
17:44:25.0679 3024 [ 6F40465A44ECDC1731BEFAFEC5BDD03C ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
17:44:25.0679 3024 KSecPkg - ok
17:44:25.0710 3024 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
17:44:25.0757 3024 ksthunk - ok
17:44:25.0788 3024 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll
17:44:25.0835 3024 KtmRm - ok
17:44:25.0882 3024 [ 81F1D04D4D0E433099365127375FD501 ] LanmanServer C:\Windows\System32\srvsvc.dll
17:44:25.0913 3024 LanmanServer - ok
17:44:25.0928 3024 [ 27026EAC8818E8A6C00A1CAD2F11D29A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
17:44:25.0960 3024 LanmanWorkstation - ok
17:44:26.0006 3024 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
17:44:26.0022 3024 lltdio - ok
17:44:26.0053 3024 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll
17:44:26.0100 3024 lltdsvc - ok
17:44:26.0116 3024 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll
17:44:26.0147 3024 lmhosts - ok
17:44:26.0162 3024 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
17:44:26.0178 3024 LSI_FC - ok
17:44:26.0194 3024 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
17:44:26.0194 3024 LSI_SAS - ok
17:44:26.0209 3024 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
17:44:26.0225 3024 LSI_SAS2 - ok
17:44:26.0225 3024 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
17:44:26.0240 3024 LSI_SCSI - ok
17:44:26.0256 3024 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys
17:44:26.0272 3024 luafv - ok
17:44:26.0287 3024 [ F84C8F1000BC11E3B7B23CBD3BAFF111 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
17:44:26.0318 3024 Mcx2Svc - ok
17:44:26.0334 3024 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
17:44:26.0350 3024 megasas - ok
17:44:26.0365 3024 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
17:44:26.0381 3024 MegaSR - ok
17:44:26.0443 3024 [ FAFE367D032ED82E9332B4C741A20216 ] Microsoft Office Groove Audit Service C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe
17:44:26.0459 3024 Microsoft Office Groove Audit Service - ok
17:44:26.0474 3024 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll
17:44:26.0521 3024 MMCSS - ok
17:44:26.0552 3024 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys
17:44:26.0584 3024 Modem - ok
17:44:26.0615 3024 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys
17:44:26.0630 3024 monitor - ok
17:44:26.0646 3024 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
17:44:26.0662 3024 mouclass - ok
17:44:26.0662 3024 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
17:44:26.0677 3024 mouhid - ok
17:44:26.0693 3024 [ 791AF66C4D0E7C90A3646066386FB571 ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
17:44:26.0693 3024 mountmgr - ok
17:44:26.0708 3024 [ 609D1D87649ECC19796F4D76D4C15CEA ] mpio C:\Windows\system32\DRIVERS\mpio.sys
17:44:26.0724 3024 mpio - ok
17:44:26.0740 3024 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
17:44:26.0755 3024 mpsdrv - ok
17:44:26.0786 3024 [ AECAB449567D1846DAD63ECE49E893E3 ] MpsSvc C:\Windows\system32\mpssvc.dll
17:44:26.0849 3024 MpsSvc - ok
17:44:26.0864 3024 [ 30524261BB51D96D6FCBAC20C810183C ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
17:44:26.0911 3024 MRxDAV - ok
17:44:26.0942 3024 [ 040D62A9D8AD28922632137ACDD984F2 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
17:44:26.0958 3024 mrxsmb - ok
17:44:26.0974 3024 [ F0067552F8F9B33D7C59403AB808A3CB ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
17:44:26.0989 3024 mrxsmb10 - ok
17:44:27.0005 3024 [ 3C142D31DE9F2F193218A53FE2632051 ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
17:44:27.0005 3024 mrxsmb20 - ok
17:44:27.0036 3024 [ 5C37497276E3B3A5488B23A326A754B7 ] msahci C:\Windows\system32\DRIVERS\msahci.sys
17:44:27.0036 3024 msahci - ok
17:44:27.0052 3024 [ 8D27B597229AED79430FB9DB3BCBFBD0 ] msdsm C:\Windows\system32\DRIVERS\msdsm.sys
17:44:27.0067 3024 msdsm - ok
17:44:27.0083 3024 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe
17:44:27.0098 3024 MSDTC - ok
17:44:27.0098 3024 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys
17:44:27.0145 3024 Msfs - ok
17:44:27.0161 3024 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
17:44:27.0208 3024 mshidkmdf - ok
17:44:27.0223 3024 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\DRIVERS\msisadrv.sys
17:44:27.0239 3024 msisadrv - ok
17:44:27.0254 3024 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
17:44:27.0286 3024 MSiSCSI - ok
17:44:27.0286 3024 msiserver - ok
17:44:27.0317 3024 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
17:44:27.0364 3024 MSKSSRV - ok
17:44:27.0379 3024 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
17:44:27.0410 3024 MSPCLOCK - ok
17:44:27.0410 3024 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
17:44:27.0457 3024 MSPQM - ok
17:44:27.0488 3024 [ 89CB141AA8616D8C6A4610FA26C60964 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
17:44:27.0504 3024 MsRPC - ok
17:44:27.0520 3024 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
17:44:27.0520 3024 mssmbios - ok
17:44:27.0520 3024 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
17:44:27.0566 3024 MSTEE - ok
17:44:27.0582 3024 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
17:44:27.0613 3024 MTConfig - ok
17:44:27.0644 3024 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys
17:44:27.0660 3024 Mup - ok
17:44:27.0676 3024 [ 4987E079A4530FA737A128BE54B63B12 ] napagent C:\Windows\system32\qagentRT.dll
17:44:27.0707 3024 napagent - ok
17:44:27.0754 3024 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
17:44:27.0785 3024 NativeWifiP - ok
17:44:27.0816 3024 [ CAD515DBD07D082BB317D9928CE8962C ] NDIS C:\Windows\system32\drivers\ndis.sys
17:44:27.0847 3024 NDIS - ok
17:44:27.0863 3024 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
17:44:27.0894 3024 NdisCap - ok
17:44:27.0894 3024 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
17:44:27.0941 3024 NdisTapi - ok
17:44:27.0972 3024 [ F105BA1E22BF1F2EE8F005D4305E4BEC ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
17:44:28.0019 3024 Ndisuio - ok
17:44:28.0034 3024 [ 557DFAB9CA1FCB036AC77564C010DAD3 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
17:44:28.0066 3024 NdisWan - ok
17:44:28.0081 3024 [ 659B74FB74B86228D6338D643CD3E3CF ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
17:44:28.0097 3024 NDProxy - ok
17:44:28.0112 3024 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
17:44:28.0144 3024 NetBIOS - ok
17:44:28.0159 3024 [ 9162B273A44AB9DCE5B44362731D062A ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
17:44:28.0175 3024 NetBT - ok
17:44:28.0190 3024 [ 156F6159457D0AA7E59B62681B56EB90 ] Netlogon C:\Windows\system32\lsass.exe
17:44:28.0206 3024 Netlogon - ok
17:44:28.0237 3024 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll
17:44:28.0284 3024 Netman - ok
17:44:28.0315 3024 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll
17:44:28.0362 3024 netprofm - ok
17:44:28.0378 3024 [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
17:44:28.0393 3024 NetTcpPortSharing - ok
17:44:28.0409 3024 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
17:44:28.0409 3024 nfrd960 - ok
17:44:28.0440 3024 [ D9A0CE66046D6EFA0C61BAA885CBA0A8 ] NlaSvc C:\Windows\System32\nlasvc.dll
17:44:28.0471 3024 NlaSvc - ok
17:44:28.0471 3024 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys
17:44:28.0502 3024 Npfs - ok
17:44:28.0518 3024 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll
17:44:28.0565 3024 nsi - ok
17:44:28.0565 3024 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
17:44:28.0596 3024 nsiproxy - ok
17:44:28.0674 3024 [ 184C189D4FC416978550FC599BB4EDDA ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
17:44:28.0721 3024 Ntfs - ok
17:44:28.0736 3024 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys
17:44:28.0768 3024 Null - ok
17:44:28.0986 3024 [ 5104BAC2DA2A5BDD86AC6B0708B00F06 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
17:44:29.0142 3024 nvlddmkm - ok
17:44:29.0173 3024 [ 3E38712941E9BB4DDBEE00AFFE3FED3D ] nvraid C:\Windows\system32\DRIVERS\nvraid.sys
17:44:29.0189 3024 nvraid - ok
17:44:29.0204 3024 [ 477DC4D6DEB99BE37084C9AC6D013DA1 ] nvstor C:\Windows\system32\DRIVERS\nvstor.sys
17:44:29.0204 3024 nvstor - ok
17:44:29.0236 3024 [ DDFAFCE89A5C93D04712B86F94E9FCBA ] nvsvc C:\Windows\system32\nvvsvc.exe
17:44:29.0267 3024 nvsvc - ok
17:44:29.0345 3024 [ 84E035225474E48CD3A6A3CE52332095 ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
17:44:29.0360 3024 nvUpdatusService - ok
17:44:29.0360 3024 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\DRIVERS\nv_agp.sys
17:44:29.0376 3024 nv_agp - ok
17:44:29.0454 3024 [ 84DE1DD996B48B05ACE31AD015FA108A ] odserv C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
17:44:29.0454 3024 odserv - ok
17:44:29.0470 3024 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\DRIVERS\ohci1394.sys
17:44:29.0485 3024 ohci1394 - ok
17:44:29.0516 3024 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
17:44:29.0516 3024 ose - ok
17:44:29.0548 3024 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
17:44:29.0579 3024 p2pimsvc - ok
17:44:29.0610 3024 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll
17:44:29.0626 3024 p2psvc - ok
17:44:29.0626 3024 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\DRIVERS\parport.sys
17:44:29.0641 3024 Parport - ok
17:44:29.0657 3024 [ 90061B1ACFE8CCAA5345750FFE08D8B8 ] partmgr C:\Windows\system32\drivers\partmgr.sys
17:44:29.0657 3024 partmgr - ok
17:44:29.0688 3024 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll
17:44:29.0704 3024 PcaSvc - ok
17:44:29.0735 3024 [ F36F6504009F2FB0DFD1B17A116AD74B ] pci C:\Windows\system32\DRIVERS\pci.sys
17:44:29.0750 3024 pci - ok
17:44:29.0750 3024 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\DRIVERS\pciide.sys
17:44:29.0766 3024 pciide - ok
17:44:29.0766 3024 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
17:44:29.0782 3024 pcmcia - ok
17:44:29.0797 3024 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys
17:44:29.0813 3024 pcw - ok
17:44:29.0828 3024 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys
17:44:29.0860 3024 PEAUTH - ok
17:44:29.0922 3024 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe
17:44:29.0922 3024 PerfHost - ok
17:44:29.0969 3024 [ 557E9A86F65F0DE18C9B6751DFE9D3F1 ] pla C:\Windows\system32\pla.dll
17:44:30.0031 3024 pla - ok
17:44:30.0094 3024 [ 98B1721B8718164293B9701B98C52D77 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
17:44:30.0109 3024 PlugPlay - ok
17:44:30.0125 3024 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
17:44:30.0156 3024 PNRPAutoReg - ok
17:44:30.0172 3024 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
17:44:30.0187 3024 PNRPsvc - ok
17:44:30.0218 3024 [ 166EB40D1F5B47E615DE3D0FFFE5F243 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
17:44:30.0250 3024 PolicyAgent - ok
17:44:30.0265 3024 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll
17:44:30.0312 3024 Power - ok
17:44:30.0359 3024 [ 27CC19E81BA5E3403C48302127BDA717 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
17:44:30.0390 3024 PptpMiniport - ok
17:44:30.0421 3024 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\DRIVERS\processr.sys
17:44:30.0421 3024 Processor - ok
17:44:30.0468 3024 [ 97293447431311C06703368AD0F6C4BE ] ProfSvc C:\Windows\system32\profsvc.dll
17:44:30.0484 3024 ProfSvc - ok
17:44:30.0484 3024 [ 156F6159457D0AA7E59B62681B56EB90 ] ProtectedStorage C:\Windows\system32\lsass.exe
17:44:30.0499 3024 ProtectedStorage - ok
17:44:30.0530 3024 [ EE992183BD8EAEFD9973F352E587A299 ] Psched C:\Windows\system32\DRIVERS\pacer.sys
17:44:30.0546 3024 Psched - ok
17:44:30.0593 3024 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
17:44:30.0640 3024 ql2300 - ok
17:44:30.0640 3024 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
17:44:30.0655 3024 ql40xx - ok
17:44:30.0671 3024 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll
17:44:30.0686 3024 QWAVE - ok
17:44:30.0702 3024 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
17:44:30.0733 3024 QWAVEdrv - ok
17:44:30.0749 3024 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
17:44:30.0780 3024 RasAcd - ok
17:44:30.0811 3024 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
17:44:30.0842 3024 RasAgileVpn - ok
17:44:30.0858 3024 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll
17:44:30.0905 3024 RasAuto - ok
17:44:30.0920 3024 [ 87A6E852A22991580D6D39ADC4790463 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
17:44:30.0967 3024 Rasl2tp - ok
17:44:30.0983 3024 [ 47394ED3D16D053F5906EFE5AB51CC83 ] RasMan C:\Windows\System32\rasmans.dll
17:44:31.0014 3024 RasMan - ok
17:44:31.0061 3024 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
17:44:31.0108 3024 RasPppoe - ok
17:44:31.0139 3024 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
17:44:31.0186 3024 RasSstp - ok
17:44:31.0217 3024 [ 3BAC8142102C15D59A87757C1D41DCE5 ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
17:44:31.0264 3024 rdbss - ok
17:44:31.0279 3024 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
17:44:31.0295 3024 rdpbus - ok
17:44:31.0310 3024 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
17:44:31.0342 3024 RDPCDD - ok
17:44:31.0357 3024 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
17:44:31.0404 3024 RDPENCDD - ok
17:44:31.0420 3024 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
17:44:31.0451 3024 RDPREFMP - ok
17:44:31.0498 3024 [ 447DE7E3DEA39D422C1504F245B668B1 ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
17:44:31.0513 3024 RDPWD - ok
17:44:31.0544 3024 [ 634B9A2181D98F15941236886164EC8B ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
17:44:31.0544 3024 rdyboost - ok
17:44:31.0576 3024 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll
17:44:31.0607 3024 RemoteAccess - ok
17:44:31.0654 3024 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll
17:44:31.0700 3024 RemoteRegistry - ok
17:44:31.0716 3024 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
17:44:31.0763 3024 RpcEptMapper - ok
17:44:31.0778 3024 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe
17:44:31.0810 3024 RpcLocator - ok
17:44:31.0825 3024 [ 7266972E86890E2B30C0C322E906B027 ] RpcSs C:\Windows\system32\rpcss.dll
17:44:31.0856 3024 RpcSs - ok
17:44:31.0888 3024 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
17:44:31.0934 3024 rspndr - ok
17:44:31.0950 3024 [ 156F6159457D0AA7E59B62681B56EB90 ] SamSs C:\Windows\system32\lsass.exe
17:44:31.0950 3024 SamSs - ok
17:44:31.0981 3024 [ E3BBB89983DAF5622C1D50CF49F28227 ] sbp2port C:\Windows\system32\DRIVERS\sbp2port.sys
17:44:31.0981 3024 sbp2port - ok
17:44:31.0997 3024 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll
17:44:32.0028 3024 SCardSvr - ok
17:44:32.0044 3024 [ C94DA20C7E3BA1DCA269BC8460D98387 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
17:44:32.0090 3024 scfilter - ok
17:44:32.0137 3024 [ 624D0F5FF99428BB90A5B8A4123E918E ] Schedule C:\Windows\system32\schedsvc.dll
17:44:32.0184 3024 Schedule - ok
17:44:32.0200 3024 [ 312E2F82AF11E79906898AC3E3D58A1F ] SCPolicySvc C:\Windows\System32\certprop.dll
17:44:32.0231 3024 SCPolicySvc - ok
17:44:32.0246 3024 [ 765A27C3279CE11D14CB9E4F5869FCA5 ] SDRSVC C:\Windows\System32\SDRSVC.dll
17:44:32.0278 3024 SDRSVC - ok
17:44:32.0309 3024 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys
17:44:32.0340 3024 secdrv - ok
17:44:32.0340 3024 [ 463B386EBC70F98DA5DFF85F7E654346 ] seclogon C:\Windows\system32\seclogon.dll
17:44:32.0371 3024 seclogon - ok
17:44:32.0387 3024 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\system32\sens.dll
17:44:32.0402 3024 SENS - ok
17:44:32.0418 3024 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll
17:44:32.0449 3024 SensrSvc - ok
17:44:32.0465 3024 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
17:44:32.0480 3024 Serenum - ok
17:44:32.0512 3024 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\DRIVERS\serial.sys
17:44:32.0543 3024 Serial - ok
17:44:32.0558 3024 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
17:44:32.0574 3024 sermouse - ok
17:44:32.0605 3024 [ C3BC61CE47FF6F4E88AB8A3B429A36AF ] SessionEnv C:\Windows\system32\sessenv.dll
17:44:32.0636 3024 SessionEnv - ok
17:44:32.0636 3024 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\DRIVERS\sffdisk.sys
17:44:32.0668 3024 sffdisk - ok
17:44:32.0683 3024 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\DRIVERS\sffp_mmc.sys
17:44:32.0699 3024 sffp_mmc - ok
17:44:32.0699 3024 [ 5588B8C6193EB1522490C122EB94DFFA ] sffp_sd C:\Windows\system32\DRIVERS\sffp_sd.sys
17:44:32.0714 3024 sffp_sd - ok
17:44:32.0714 3024 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
17:44:32.0730 3024 sfloppy - ok
17:44:32.0761 3024 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll
17:44:32.0792 3024 SharedAccess - ok
17:44:32.0808 3024 [ 0298AC45D0EFFFB2DB4BAA7DD186E7BF ] ShellHWDetection C:\Windows\System32\shsvcs.dll
17:44:32.0824 3024 ShellHWDetection - ok
17:44:32.0839 3024 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
17:44:32.0855 3024 SiSRaid2 - ok
17:44:32.0855 3024 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
17:44:32.0870 3024 SiSRaid4 - ok
17:44:32.0886 3024 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys
17:44:32.0933 3024 Smb - ok
17:44:32.0964 3024 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe
17:44:32.0980 3024 SNMPTRAP - ok
17:44:32.0980 3024 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys
17:44:32.0980 3024 spldr - ok
17:44:33.0026 3024 [ 567977DC43CC13C4C35ED7084C0B84D5 ] Spooler C:\Windows\System32\spoolsv.exe
17:44:33.0058 3024 Spooler - ok
17:44:33.0136 3024 [ 913D843498553A1BC8F8DBAD6358E49F ] sppsvc C:\Windows\system32\sppsvc.exe
17:44:33.0214 3024 sppsvc - ok
17:44:33.0229 3024 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll
17:44:33.0260 3024 sppuinotify - ok
17:44:33.0307 3024 [ 602884696850C86434530790B110E8EB ] sptd C:\Windows\System32\Drivers\sptd.sys
17:44:33.0338 3024 sptd - ok
17:44:33.0385 3024 [ 2408C0366D96BCDF63E8F1C78E4A29C5 ] srv C:\Windows\system32\DRIVERS\srv.sys
17:44:33.0385 3024 srv - ok
17:44:33.0448 3024 [ 76548F7B818881B47D8D1AE1BE9C11F8 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
17:44:33.0479 3024 srv2 - ok
17:44:33.0650 3024 [ 0AF6E19D39C70844C5CAA8FB0183C36E ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
17:44:33.0666 3024 srvnet - ok
17:44:33.0713 3024 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
17:44:33.0931 3024 SSDPSRV - ok
17:44:33.0947 3024 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll
17:44:33.0978 3024 SstpSvc - ok
17:44:34.0072 3024 [ F0359F7CE712D69ACEF0886BDB4792ED ] Stereo Service C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
17:44:34.0087 3024 Stereo Service - ok
17:44:34.0118 3024 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
17:44:34.0134 3024 stexstor - ok
17:44:34.0165 3024 [ 52D0E33B681BD0F33FDC08812FEE4F7D ] stisvc C:\Windows\System32\wiaservc.dll
17:44:34.0181 3024 stisvc - ok
17:44:34.0196 3024 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
17:44:34.0212 3024 swenum - ok
17:44:34.0368 3024 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll
17:44:34.0399 3024 swprv - ok
17:44:34.0446 3024 [ 3C1284516A62078FB68F768DE4F1A7BE ] SysMain C:\Windows\system32\sysmain.dll
17:44:34.0508 3024 SysMain - ok
17:44:34.0524 3024 [ 238935C3CF2854886DC7CBB2A0E2CC66 ] TabletInputService C:\Windows\System32\TabSvc.dll
17:44:34.0540 3024 TabletInputService - ok
17:44:34.0571 3024 [ 884264AC597B690C5707C89723BB8E7B ] TapiSrv C:\Windows\System32\tapisrv.dll
17:44:34.0602 3024 TapiSrv - ok
17:44:34.0618 3024 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll
17:44:34.0649 3024 TBS - ok
17:44:34.0711 3024 [ 5CFB7AB8F9524D1A1E14369DE63B83CC ] Tcpip C:\Windows\system32\drivers\tcpip.sys
17:44:34.0758 3024 Tcpip - ok
17:44:34.0805 3024 [ 5CFB7AB8F9524D1A1E14369DE63B83CC ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
17:44:34.0836 3024 TCPIP6 - ok
17:44:34.0867 3024 [ 76D078AF6F587B162D50210F761EB9ED ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
17:44:34.0898 3024 tcpipreg - ok
17:44:34.0898 3024 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
17:44:34.0914 3024 TDPIPE - ok
17:44:34.0930 3024 [ 7518F7BCFD4B308ABC9192BACAF6C970 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
17:44:34.0961 3024 TDTCP - ok
17:44:34.0992 3024 [ 079125C4B17B01FCAEEBCE0BCB290C0F ] tdx C:\Windows\system32\DRIVERS\tdx.sys
17:44:35.0023 3024 tdx - ok
17:44:35.0039 3024 [ C448651339196C0E869A355171875522 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
17:44:35.0054 3024 TermDD - ok
17:44:35.0117 3024 [ 0F05EC2887BFE197AD82A13287D2F404 ] TermService C:\Windows\System32\termsrv.dll
17:44:35.0164 3024 TermService - ok
17:44:35.0195 3024 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll
17:44:35.0226 3024 Themes - ok
17:44:35.0226 3024 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll
17:44:35.0257 3024 THREADORDER - ok
17:44:35.0273 3024 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll
17:44:35.0304 3024 TrkWks - ok
17:44:35.0366 3024 [ 840F7FB849F5887A49BA18C13B2DA920 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
17:44:35.0382 3024 TrustedInstaller - ok
17:44:35.0398 3024 [ 61B96C26131E37B24E93327A0BD1FB95 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
17:44:35.0429 3024 tssecsrv - ok
17:44:35.0460 3024 [ 3836171A2CDF3AF8EF10856DB9835A70 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
17:44:35.0476 3024 tunnel - ok
17:44:35.0507 3024 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
17:44:35.0507 3024 uagp35 - ok
17:44:35.0522 3024 [ D47BAEAD86C65D4F4069D7CE0A4EDCEB ] udfs C:\Windows\system32\DRIVERS\udfs.sys
17:44:35.0569 3024 udfs - ok
17:44:35.0600 3024 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe
17:44:35.0632 3024 UI0Detect - ok
17:44:35.0647 3024 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\DRIVERS\uliagpkx.sys
17:44:35.0663 3024 uliagpkx - ok
17:44:35.0678 3024 [ EAB6C35E62B1B0DB0D1B48B671D3A117 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
17:44:35.0694 3024 umbus - ok
17:44:35.0694 3024 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
17:44:35.0710 3024 UmPass - ok
17:44:35.0710 3024 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll
17:44:35.0741 3024 upnphost - ok
17:44:35.0788 3024 [ 77B01BC848298223A95D4EC23E1785A1 ] usbaudio C:\Windows\system32\drivers\usbaudio.sys
17:44:35.0803 3024 usbaudio - ok
17:44:35.0819 3024 [ B26AFB54A534D634523C4FB66765B026 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
17:44:35.0834 3024 usbccgp - ok
17:44:35.0866 3024 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\DRIVERS\usbcir.sys
17:44:35.0881 3024 usbcir - ok
17:44:35.0897 3024 [ 2EA4AFF7BE7EB4632E3AA8595B0803B5 ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
17:44:35.0928 3024 usbehci - ok
17:44:35.0959 3024 [ 4C9042B8DF86C1E8E6240C218B99B39B ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
17:44:35.0959 3024 usbhub - ok
17:44:35.0975 3024 [ 58E546BBAF87664FC57E0F6081E4F609 ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys
17:44:35.0990 3024 usbohci - ok
17:44:36.0006 3024 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
17:44:36.0006 3024 usbprint - ok
17:44:36.0022 3024 [ 080D3820DA6C046BE82FC8B45A893E83 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
17:44:36.0037 3024 USBSTOR - ok
17:44:36.0037 3024 [ 81FB2216D3A60D1284455D511797DB3D ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
17:44:36.0053 3024 usbuhci - ok
17:44:36.0068 3024 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll
17:44:36.0115 3024 UxSms - ok
17:44:36.0131 3024 [ 156F6159457D0AA7E59B62681B56EB90 ] VaultSvc C:\Windows\system32\lsass.exe
17:44:36.0131 3024 VaultSvc - ok
17:44:36.0162 3024 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\DRIVERS\vdrvroot.sys
17:44:36.0178 3024 vdrvroot - ok
17:44:36.0193 3024 [ 44D73E0BBC1D3C8981304BA15135C2F2 ] vds C:\Windows\System32\vds.exe
17:44:36.0209 3024 vds - ok
17:44:36.0209 3024 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
17:44:36.0224 3024 vga - ok
17:44:36.0240 3024 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys
17:44:36.0271 3024 VgaSave - ok
17:44:36.0302 3024 [ C82E748660F62A242B2DFAC1442F22A4 ] vhdmp C:\Windows\system32\DRIVERS\vhdmp.sys
17:44:36.0302 3024 vhdmp - ok
17:44:36.0318 3024 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\DRIVERS\viaide.sys
17:44:36.0334 3024 viaide - ok
17:44:36.0334 3024 [ 2B1A3DAE2B4E70DBBA822B7A03FBD4A3 ] volmgr C:\Windows\system32\DRIVERS\volmgr.sys
17:44:36.0349 3024 volmgr - ok
17:44:36.0365 3024 [ 99B0CBB569CA79ACAED8C91461D765FB ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
17:44:36.0380 3024 volmgrx - ok
17:44:36.0412 3024 [ 9E425AC5C9A5A973273D169F43B4F5E1 ] volsnap C:\Windows\system32\DRIVERS\volsnap.sys
17:44:36.0412 3024 volsnap - ok
17:44:36.0427 3024 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
17:44:36.0443 3024 vsmraid - ok
17:44:36.0474 3024 [ 787898BF9FB6D7BD87A36E2D95C899BA ] VSS C:\Windows\system32\vssvc.exe
17:44:36.0536 3024 VSS - ok
17:44:36.0552 3024 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys
17:44:36.0568 3024 vwifibus - ok
17:44:36.0583 3024 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
17:44:36.0599 3024 vwififlt - ok
17:44:36.0630 3024 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll
17:44:36.0661 3024 W32Time - ok
17:44:36.0677 3024 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
17:44:36.0708 3024 WacomPen - ok
17:44:36.0739 3024 [ 47CA49400643EFFD3F1C9A27E1D69324 ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
17:44:36.0770 3024 WANARP - ok
17:44:36.0786 3024 [ 47CA49400643EFFD3F1C9A27E1D69324 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
17:44:36.0817 3024 Wanarpv6 - ok
17:44:36.0848 3024 [ 5AB1BB85BD8B5089CC5D64200DEDAE68 ] wbengine C:\Windows\system32\wbengine.exe
17:44:36.0895 3024 wbengine - ok
17:44:36.0911 3024 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
17:44:36.0926 3024 WbioSrvc - ok
17:44:36.0958 3024 [ DD1BAE8EBFC653824D29CCF8C9054D68 ] wcncsvc C:\Windows\System32\wcncsvc.dll
17:44:36.0989 3024 wcncsvc - ok
17:44:37.0004 3024 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
17:44:37.0020 3024 WcsPlugInService - ok
17:44:37.0051 3024 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\DRIVERS\wd.sys
17:44:37.0051 3024 Wd - ok
17:44:37.0098 3024 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
17:44:37.0129 3024 Wdf01000 - ok
17:44:37.0145 3024 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll
17:44:37.0160 3024 WdiServiceHost - ok
17:44:37.0160 3024 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll
17:44:37.0176 3024 WdiSystemHost - ok
17:44:37.0207 3024 [ 733006127F235BE7C35354EBEE7B9A7B ] WebClient C:\Windows\System32\webclnt.dll
17:44:37.0223 3024 WebClient - ok
17:44:37.0254 3024 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll
17:44:37.0285 3024 Wecsvc - ok
17:44:37.0301 3024 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll
17:44:37.0348 3024 wercplsupport - ok
17:44:37.0379 3024 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll
17:44:37.0426 3024 WerSvc - ok
17:44:37.0472 3024 [ C48CA80FDC6926A9FC2F520379BDB635 ] WFMC_VAD C:\Windows\system32\DRIVERS\wfmcvad.sys
17:44:37.0488 3024 WFMC_VAD - ok
17:44:37.0519 3024 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
17:44:37.0550 3024 WfpLwf - ok
17:44:37.0566 3024 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys
17:44:37.0566 3024 WIMMount - ok
17:44:37.0582 3024 WinDefend - ok
17:44:37.0582 3024 WinHttpAutoProxySvc - ok
17:44:37.0628 3024 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
17:44:37.0660 3024 Winmgmt - ok
17:44:37.0706 3024 [ 41FBB751936B387F9179E7F03A74FE29 ] WinRM C:\Windows\system32\WsmSvc.dll
17:44:37.0800 3024 WinRM - ok
17:44:37.0847 3024 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll
17:44:37.0894 3024 Wlansvc - ok
17:44:37.0987 3024 [ 7E47C328FC4768CB8BEAFBCFAFA70362 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
17:44:38.0018 3024 wlidsvc - ok
17:44:38.0034 3024 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\DRIVERS\wmiacpi.sys
17:44:38.0050 3024 WmiAcpi - ok
17:44:38.0081 3024 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
17:44:38.0112 3024 wmiApSrv - ok
17:44:38.0143 3024 WMPNetworkSvc - ok
17:44:38.0174 3024 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll
17:44:38.0174 3024 WPCSvc - ok
17:44:38.0190 3024 [ 2E57DDF2880A7E52E76F41C7E96D327B ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
17:44:38.0221 3024 WPDBusEnum - ok
17:44:38.0237 3024 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
17:44:38.0284 3024 ws2ifsl - ok
17:44:38.0330 3024 [ 8F9F3969933C02DA96EB0F84576DB43E ] wscsvc C:\Windows\system32\wscsvc.dll
17:44:38.0346 3024 wscsvc - ok
17:44:38.0346 3024 WSearch - ok
17:44:38.0424 3024 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll
17:44:38.0486 3024 wuauserv - ok
17:44:38.0518 3024 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
17:44:38.0518 3024 WudfPf - ok
17:44:38.0564 3024 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
17:44:38.0580 3024 WUDFRd - ok
17:44:38.0611 3024 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
17:44:38.0642 3024 wudfsvc - ok
17:44:38.0674 3024 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll
17:44:38.0689 3024 WwanSvc - ok
17:44:38.0705 3024 ================ Scan global ===============================
17:44:38.0736 3024 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
17:44:38.0767 3024 [ 3FB74FF230B5D240A57AE1C4A3D0459D ] C:\Windows\system32\winsrv.dll
17:44:38.0767 3024 [ 3FB74FF230B5D240A57AE1C4A3D0459D ] C:\Windows\system32\winsrv.dll
17:44:38.0798 3024 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
17:44:38.0830 3024 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
17:44:38.0830 3024 [Global] - ok
17:44:38.0830 3024 ================ Scan MBR ==================================
17:44:38.0845 3024 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
17:44:39.0095 3024 \Device\Harddisk0\DR0 - ok
17:44:39.0095 3024 [ DDAE9D649DB12F6AFF24483F2C298989 ] \Device\Harddisk1\DR2
17:44:39.0235 3024 \Device\Harddisk1\DR2 - ok
17:44:39.0235 3024 ================ Scan VBR ==================================
17:44:39.0235 3024 [ E8FD5CF8D38B369D39120E92FC9CF441 ] \Device\Harddisk0\DR0\Partition1
17:44:39.0235 3024 \Device\Harddisk0\DR0\Partition1 - ok
17:44:39.0235 3024 [ 5E87D1BAAD606D761BC409A448090562 ] \Device\Harddisk1\DR2\Partition1
17:44:39.0235 3024 \Device\Harddisk1\DR2\Partition1 - ok
17:44:39.0235 3024 ============================================================
17:44:39.0235 3024 Scan finished
17:44:39.0235 3024 ============================================================
17:44:39.0251 3736 Detected object count: 0
17:44:39.0251 3736 Actual detected object count: 0

markusg 19.02.2013 21:28
hi,
Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.


Alle Zeitangaben in WEZ +1. Es ist jetzt 19:51 Uhr.
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19