Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   virus/trojaner über skype eingefangen "sie ist auf diesem foto?" (https://www.trojaner-board.de/134076-virus-trojaner-skype-eingefangen-diesem-foto.html)

haenaez 23.04.2013 16:56
virus/trojaner über skype eingefangen "sie ist auf diesem foto?"
 
Servus,

ich hoffe es kann mir hier jemand helfen?! problem ist folgendes:

ich hatte gestern abend über skype eine viererkonferenz mit freunden! plötzlich ploppte das skype-fenster auf, und einer der teilnehmer schickte mir folgenden link:

"sie ist auf diesem foto? hxxp://bit.ly/11yXGzd?img=wreckingchick"

ich gleich draufgeklickt. es ging nur ein weisser bildschirm auf, und gleichzeitig ein download. habe mir dann automatisch 3x eine WinRAR-ZIP datei mit dem namen "pics-367.png" gedownloadet. diese habe ich jedoch geöffnet.

dann hat sich mein skype selbstständig gemacht, und das ebenfalls an leute aus meiner skypeliste geschickt. so nahm das dann seinen lauf, ich schickte es an andere und bekam es von anderen auch wieder.

der link war nicht immer der selbe, es stand aber immer "sie ist auf diesem foto?" vorne dran.

folgende links kamen auch noch bei mir an:

hxxp://url9.de/BFD?bu=wreckingchick
hxxp://is.gd/dQblg4?wow=wreckingchick
hxxp://ow.ly/kjHSD?dnu=wreckingchick

bei einem der teilnehmer von dem gespräch hat sich das dann auch auf facebook überlagert, d.h. seine freunde wurden dort auch angeschrieben.

hoffentlich kann mir hier jemand helfen, muss auch gleich dazu sagen, dass ich mich mit computern nicht sonderlich gut auskenn.

liebe grüsse
haenaez

Hier habe ich den Bericht von AVIRA.

Avira Free Antivirus
Erstellungsdatum der Reportdatei: Dienstag, 23. April 2013 16:26


Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer : Avira Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (plain) [6.1.7600]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : ASUSPRO5IF-PC

Versionsinformationen:
BUILD.DAT : 13.0.0.3499 49286 Bytes 19.03.2013 16:29:00
AVSCAN.EXE : 13.6.0.986 639712 Bytes 22.04.2013 19:07:43
AVSCANRC.DLL : 13.4.0.360 64800 Bytes 22.04.2013 19:07:43
LUKE.DLL : 13.6.0.902 67808 Bytes 22.04.2013 19:07:56
AVSCPLR.DLL : 13.6.0.986 94944 Bytes 22.04.2013 19:08:12
AVREG.DLL : 13.6.0.940 250592 Bytes 22.04.2013 19:08:11
avlode.dll : 13.6.2.940 434912 Bytes 22.04.2013 19:07:42
avlode.rdf : 13.0.0.46 15591 Bytes 22.04.2013 19:08:12
VBASE000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 16:41:09
VBASE001.VDF : 7.11.70.1 2048 Bytes 04.04.2013 16:41:10
VBASE002.VDF : 7.11.70.2 2048 Bytes 04.04.2013 16:41:10
VBASE003.VDF : 7.11.70.3 2048 Bytes 04.04.2013 16:41:10
VBASE004.VDF : 7.11.70.4 2048 Bytes 04.04.2013 16:41:10
VBASE005.VDF : 7.11.70.5 2048 Bytes 04.04.2013 16:41:10
VBASE006.VDF : 7.11.70.6 2048 Bytes 04.04.2013 16:41:10
VBASE007.VDF : 7.11.70.7 2048 Bytes 04.04.2013 16:41:10
VBASE008.VDF : 7.11.70.8 2048 Bytes 04.04.2013 16:41:10
VBASE009.VDF : 7.11.70.9 2048 Bytes 04.04.2013 16:41:10
VBASE010.VDF : 7.11.70.10 2048 Bytes 04.04.2013 16:41:11
VBASE011.VDF : 7.11.70.11 2048 Bytes 04.04.2013 16:41:11
VBASE012.VDF : 7.11.70.12 2048 Bytes 04.04.2013 16:41:11
VBASE013.VDF : 7.11.70.13 2048 Bytes 04.04.2013 16:41:11
VBASE014.VDF : 7.11.70.103 136192 Bytes 05.04.2013 16:40:27
VBASE015.VDF : 7.11.70.183 183808 Bytes 06.04.2013 16:40:59
VBASE016.VDF : 7.11.71.9 145920 Bytes 08.04.2013 16:45:20
VBASE017.VDF : 7.11.71.115 169472 Bytes 10.04.2013 16:41:15
VBASE018.VDF : 7.11.71.197 172544 Bytes 11.04.2013 16:42:17
VBASE019.VDF : 7.11.72.17 135168 Bytes 12.04.2013 16:41:09
VBASE020.VDF : 7.11.72.103 158208 Bytes 15.04.2013 16:41:24
VBASE021.VDF : 7.11.72.137 152064 Bytes 15.04.2013 16:41:24
VBASE022.VDF : 7.11.72.223 159232 Bytes 16.04.2013 16:41:19
VBASE023.VDF : 7.11.73.59 204288 Bytes 18.04.2013 16:41:29
VBASE024.VDF : 7.11.73.133 164864 Bytes 19.04.2013 16:41:31
VBASE025.VDF : 7.11.73.201 225792 Bytes 22.04.2013 16:41:45
VBASE026.VDF : 7.11.73.251 161280 Bytes 23.04.2013 13:25:00
VBASE027.VDF : 7.11.73.252 2048 Bytes 23.04.2013 13:25:00
VBASE028.VDF : 7.11.73.253 2048 Bytes 23.04.2013 13:25:01
VBASE029.VDF : 7.11.73.254 2048 Bytes 23.04.2013 13:25:01
VBASE030.VDF : 7.11.73.255 2048 Bytes 23.04.2013 13:25:01
VBASE031.VDF : 7.11.74.0 2048 Bytes 23.04.2013 13:25:01
Engineversion : 8.2.12.30
AEVDF.DLL : 8.1.2.10 102772 Bytes 10.07.2012 14:14:39
AESCRIPT.DLL : 8.1.4.106 483709 Bytes 11.04.2013 16:42:21
AESCN.DLL : 8.1.10.4 131446 Bytes 26.03.2013 16:57:21
AESBX.DLL : 8.2.5.12 606578 Bytes 14.06.2012 14:20:20
AERDL.DLL : 8.2.0.88 643444 Bytes 10.01.2013 14:25:19
AEPACK.DLL : 8.3.2.6 827767 Bytes 29.03.2013 16:58:01
AEOFFICE.DLL : 8.1.2.56 205180 Bytes 08.03.2013 16:55:58
AEHEUR.DLL : 8.1.4.302 5890425 Bytes 18.04.2013 16:41:36
AEHELP.DLL : 8.1.25.2 258423 Bytes 11.10.2012 14:19:24
AEGEN.DLL : 8.1.7.2 442741 Bytes 26.03.2013 16:57:19
AEEXP.DLL : 8.4.0.22 196982 Bytes 18.04.2013 16:41:39
AEEMU.DLL : 8.1.3.2 393587 Bytes 10.07.2012 14:14:38
AECORE.DLL : 8.1.31.2 201080 Bytes 19.02.2013 16:55:34
AEBB.DLL : 8.1.1.4 53619 Bytes 05.11.2012 14:20:53
AVWINLL.DLL : 13.6.0.480 26480 Bytes 22.04.2013 19:07:25
AVPREF.DLL : 13.6.0.480 51056 Bytes 22.04.2013 19:07:43
AVREP.DLL : 13.6.0.480 178544 Bytes 22.04.2013 19:08:12
AVARKT.DLL : 13.6.0.902 260832 Bytes 22.04.2013 19:07:37
AVEVTLOG.DLL : 13.6.0.902 167648 Bytes 22.04.2013 19:07:39
SQLITE3.DLL : 3.7.0.1 397704 Bytes 22.04.2013 19:08:04
AVSMTP.DLL : 13.6.0.480 62832 Bytes 22.04.2013 19:07:44
NETNT.DLL : 13.6.0.480 16240 Bytes 22.04.2013 19:07:59
RCIMAGE.DLL : 13.4.0.360 4780832 Bytes 22.04.2013 19:07:26
RCTEXT.DLL : 13.6.0.976 69344 Bytes 22.04.2013 19:07:26

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\PROFILES\AVSCAN-20130423-161920-27EAE551.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, Q:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Dienstag, 23. April 2013 16:26

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf nach versteckten Objekten wird begonnen.
Beim Laden des Moduls (AVARKT.DLL) ist folgender Fehler aufgetreten:
Die Datei existiert nicht!
AVARKT.DLL

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '102' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '155' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLANExt.exe' - '80' Modul(e) wurden durchsucht
Durchsuche Prozess 'FBAgent.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'ASLDRSrv.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'GFNEXSrv.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '80' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '168' Modul(e) wurden durchsucht
Durchsuche Prozess 'Connect.Service.ContentService.exe' - '89' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'ALU.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'BatteryLife.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'Net4Switch.exe' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'aspg.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'ATKOSD2.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'sensorsrv.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'ACMON.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'ACEngSvr.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'HControl.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'ADSMTray.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'AsScrPro.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'BBSvc.EXE' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'SeaPort.EXE' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMLSvc.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'RegSrvc.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'SfCtlCom.exe' - '124' Modul(e) wurden durchsucht
Durchsuche Prozess 'ETDCtrl.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'AsusWSService.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxtray.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'hkcmd.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxpers.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'iFrmewrk.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleToolbarNotifier.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'Skype.exe' - '131' Modul(e) wurden durchsucht
Durchsuche Prozess 'SSScheduler.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'SRSPremiumPanel_64.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'PDVD9Serv.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'Boingo Wi-Fi.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'DMedia.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'HControlUser.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'wcourier.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'Updater.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'starter4g.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '90' Modul(e) wurden durchsucht
Durchsuche Prozess 'sftvsa.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'sms.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'WTGService.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'UfSeAgnt.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'service4g.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'EvtEng.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'ATKOSD.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'WDC.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'sftlist.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'CVHSVC.EXE' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'TmProxy.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'ADSMSrv.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'ETDCtrlHelper.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'Opera.exe' - '102' Modul(e) wurden durchsucht
Durchsuche Prozess 'TrustedInstaller.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'RichVideo.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'spmgr.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'AIRecoveryRemind.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'ControlDeck.exe' - '92' Modul(e) wurden durchsucht
Durchsuche Prozess 'TMBMSRV.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'PresentationFontCache.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'sppsvc.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'chrome.exe' - '108' Modul(e) wurden durchsucht
Durchsuche Prozess 'chrome.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'chrome.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'chrome.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchFilterHost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'WMIADAP.EXE' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '111' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '9' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '2193' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <OS>
C:\ProgramData\1911.exe
[FUND] Ist das Trojanische Pferd TR/Kazy.166971
C:\ProgramData\1E2E.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\ProgramData\2A5D.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\ProgramData\3554.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\ProgramData\4542.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\ProgramData\4597.exe
[FUND] Ist das Trojanische Pferd TR/Kazy.166971
C:\ProgramData\5C57.exe
[FUND] Ist das Trojanische Pferd TR/Kazy.166971
C:\ProgramData\6184.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\ProgramData\6CC9.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\ProgramData\789A.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\ProgramData\9773.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\ProgramData\9D1E.exe
[FUND] Ist das Trojanische Pferd TR/Kazy.166971
C:\ProgramData\A46C.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\ProgramData\AFB1.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\ProgramData\BB25.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\ProgramData\cfeabdbcdabeesacfsfdsf.exe
[FUND] Enthält Erkennungsmuster des Wurmes WORM/Skipe.t
C:\ProgramData\DB17.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\ProgramData\E7E1.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\ProgramData\F2F8.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\ProgramData\FE5C.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5YE7PDVO\spwisiaos[1]
[FUND] Ist das Trojanische Pferd TR/Kazy.166971
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\64JU8HJV\newsplala[1]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\64JU8HJV\newsplala[2]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\64JU8HJV\spwisiaos[1]
[FUND] Ist das Trojanische Pferd TR/Kazy.166971
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6D3UTT97\newsplala[1]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6D3UTT97\newsplala[2]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6D3UTT97\newsplala[3]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6D3UTT97\newsplala[4]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6D3UTT97\newsplala[5]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6D3UTT97\spwisiaos[1]
[FUND] Ist das Trojanische Pferd TR/Kazy.166971
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6D3UTT97\spwisiaos[2]
[FUND] Ist das Trojanische Pferd TR/Kazy.166971
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6D3UTT97\spwisiaos[3]
[FUND] Ist das Trojanische Pferd TR/Kazy.166971
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J1VN91U8\newsplala[1]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J1VN91U8\newsplala[2]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J1VN91U8\newsplala[3]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J1VN91U8\newsplala[4]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J1VN91U8\newsplala[5]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J1VN91U8\newsplala[6]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J1VN91U8\newsplala[7]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J1VN91U8\newsplala[8]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
C:\Users\asus pro 5if\AppData\Local\Temp\trqdswabbepsury.exe
[FUND] Ist das Trojanische Pferd TR/Kazy.166807
Beginne mit der Suche in 'D:\' <Data>
Beginne mit der Suche in 'Q:\'
Der zu durchsuchende Pfad Q:\ konnte nicht geöffnet werden!
Systemfehler [5]: Zugriff verweigert

Beginne mit der Desinfektion:
C:\Users\asus pro 5if\AppData\Local\Temp\trqdswabbepsury.exe
[FUND] Ist das Trojanische Pferd TR/Kazy.166807
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J1VN91U8\newsplala[8]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J1VN91U8\newsplala[7]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J1VN91U8\newsplala[6]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J1VN91U8\newsplala[5]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J1VN91U8\newsplala[4]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J1VN91U8\newsplala[3]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J1VN91U8\newsplala[2]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J1VN91U8\newsplala[1]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6D3UTT97\spwisiaos[3]
[FUND] Ist das Trojanische Pferd TR/Kazy.166971
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6D3UTT97\spwisiaos[2]
[FUND] Ist das Trojanische Pferd TR/Kazy.166971
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6D3UTT97\spwisiaos[1]
[FUND] Ist das Trojanische Pferd TR/Kazy.166971
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6D3UTT97\newsplala[5]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6D3UTT97\newsplala[4]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6D3UTT97\newsplala[3]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6D3UTT97\newsplala[2]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6D3UTT97\newsplala[1]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\64JU8HJV\spwisiaos[1]
[FUND] Ist das Trojanische Pferd TR/Kazy.166971
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\64JU8HJV\newsplala[2]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\64JU8HJV\newsplala[1]
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5YE7PDVO\spwisiaos[1]
[FUND] Ist das Trojanische Pferd TR/Kazy.166971
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\FE5C.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\F2F8.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\E7E1.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\DB17.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\cfeabdbcdabeesacfsfdsf.exe
[FUND] Enthält Erkennungsmuster des Wurmes WORM/Skipe.t
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\BB25.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\AFB1.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\A46C.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\9D1E.exe
[FUND] Ist das Trojanische Pferd TR/Kazy.166971
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\9773.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\789A.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\6CC9.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\6184.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\5C57.exe
[FUND] Ist das Trojanische Pferd TR/Kazy.166971
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\4597.exe
[FUND] Ist das Trojanische Pferd TR/Kazy.166971
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\4542.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\3554.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\2A5D.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\1E2E.exe
[FUND] Ist das Trojanische Pferd TR/Ransom.Blocker.bbvx
[WARNUNG] Die Datei wurde ignoriert.
C:\ProgramData\1911.exe
[FUND] Ist das Trojanische Pferd TR/Kazy.166971
[WARNUNG] Die Datei wurde ignoriert.


Ende des Suchlaufs: Dienstag, 23. April 2013 17:47
Benötigte Zeit: 1:19:44 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

26928 Verzeichnisse wurden überprüft
353228 Dateien wurden geprüft
41 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
353187 Dateien ohne Befall
2925 Archive wurden durchsucht
41 Warnungen
0 Hinweise

smeenk 23.04.2013 17:04
Hallo haenaez ich bin smeenk und ich werde versuchen dir mit deinem Problem zu helfen :)


Systemscan mit ZOEK

Bitte lade die zoek.exe von hier: http://hijackthis.nl/smeenk/
  • Bitte deaktiviere während des Scans alle Virenscanner, da sie das Ergebnis beeinflussen.
  • Starte die Zoek.exe mit einem Doppelklick (nur Windows XP-Benutzer).
  • Windows Vista/7 Benutzer starten das Tool bitte per Rechtsklick auf das Icon und wählen "Als Administrator starten".
  • Klicke auf "Options" und wähle die folgenden Optionen aus:
    • Recently Created
    • Startup Information
    • Firefox Look
    • Chrome Look
    • System Restore Point
    • Auto Clean
  • Nun klicke auf "Run script" und warte geduldig, bis der Scan durchgelaufen ist.
  • Wenn das Tool fertig ist, wird sich Notepad mit dem Logfile öffnen (ggfs. erst nach einem Neustart).
    Nachträglich kannst Du den Bericht unter c:\zoek-results.log einsehen.
  • Poste mir das Log File zoek-results.log



Bitte poste in deiner nächsten Antwort:
  • Log von zoek

haenaez 23.04.2013 17:41
Hallo smeenk.

Hab gerade das OTL laufen lassen. Hier der Report.OTL Logfile:
Code:
OTL logfile created on: 23.04.2013 18:19:17 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\asus pro 5if\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,86 Gb Total Physical Memory | 1,48 Gb Available Physical Memory | 51,94% Memory free
5,71 Gb Paging File | 3,60 Gb Available in Paging File | 63,07% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 72,69 Gb Total Space | 38,15 Gb Free Space | 52,48% Space Free | Partition Type: NTFS
Drive D: | 205,87 Gb Total Space | 203,68 Gb Free Space | 98,93% Space Free | Partition Type: NTFS
 
Computer Name: ASUSPRO5IF-PC | User Name: asus pro 5if | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.04.23 17:24:25 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\asus pro 5if\Desktop\OTL.exe
PRC - [2013.04.23 04:07:16 | 001,156,394 | RHS- | M] (The Pidgin developer community) -- C:\Users\Public\sms.exe
PRC - [2013.04.22 21:08:02 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2013.04.22 21:07:40 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.04.22 21:07:40 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2013.02.05 17:48:44 | 000,272,248 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
PRC - [2013.02.05 17:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe
PRC - [2012.03.09 12:38:26 | 000,658,560 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Recovery\AIRecoveryRemind.exe
PRC - [2011.10.13 17:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011.07.09 07:13:42 | 000,397,992 | ---- | M] ({StringFileInfo_CompanyName}) -- C:\Program Files (x86)\Ask.com\Updater\Updater.exe
PRC - [2011.02.07 23:42:10 | 000,477,560 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McUicnt.exe
PRC - [2011.02.02 15:08:16 | 000,018,656 | ---- | M] () -- C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
PRC - [2010.10.12 21:45:30 | 003,054,136 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe
PRC - [2010.08.17 23:55:42 | 005,732,992 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
PRC - [2010.08.12 04:46:34 | 001,597,440 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
PRC - [2010.07.08 19:05:12 | 000,160,992 | R--- | M] (4G Systems GmbH & Co. KG) -- C:\Windows\starter4g.exe
PRC - [2010.07.08 19:05:08 | 000,145,120 | R--- | M] (4G Systems GmbH & Co. KG) -- C:\Windows\service4g.exe
PRC - [2010.06.09 18:55:54 | 001,080,448 | ---- | M] (asus) -- C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe
PRC - [2010.05.03 23:45:50 | 000,182,912 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
PRC - [2010.05.03 23:41:46 | 000,170,624 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
PRC - [2010.04.12 19:03:44 | 000,329,168 | ---- | M] () -- C:\Program Files (x86)\XSManager\WTGService.exe
PRC - [2009.12.15 19:39:38 | 000,096,896 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
PRC - [2009.11.02 23:21:26 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
PRC - [2009.10.01 04:34:22 | 002,314,240 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2009.10.01 04:33:08 | 000,262,144 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2009.09.23 10:11:54 | 001,160,320 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\Net4Switch\Net4Switch.exe
PRC - [2009.08.12 21:32:56 | 000,365,936 | ---- | M] (Boingo Wireless, Inc.) -- C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe
PRC - [2009.07.31 19:38:24 | 000,305,720 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
PRC - [2009.07.06 23:22:04 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
PRC - [2009.06.24 21:30:18 | 000,272,952 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe
PRC - [2009.06.19 19:29:42 | 000,105,016 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
PRC - [2009.06.19 19:29:26 | 002,488,888 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
PRC - [2009.06.16 02:30:42 | 000,084,536 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
PRC - [2008.12.23 02:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
PRC - [2008.03.31 11:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe
PRC - [2007.11.30 20:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
PRC - [2007.08.03 12:24:54 | 000,125,496 | ---- | M] () -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.04.21 03:56:40 | 000,997,888 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\0794d7af09099432ebfb51af1d7f15ae\System.Management.ni.dll
MOD - [2012.04.21 03:51:58 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\6954c7f14ea634672cdacf2cd793497e\PresentationFramework.Aero.ni.dll
MOD - [2012.04.21 03:51:25 | 014,322,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8435718626a24beaeefc98d45ae77127\PresentationFramework.ni.dll
MOD - [2012.04.21 03:51:09 | 012,431,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ff30db6905f8ec024fc808ed8779c0f3\System.Windows.Forms.ni.dll
MOD - [2012.04.21 03:51:01 | 001,586,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\a09ee392fa90849f2e9313a1ebbe0279\System.Drawing.ni.dll
MOD - [2012.04.21 03:50:57 | 012,216,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\c0508b05f5c28e37711f447a66368e75\PresentationCore.ni.dll
MOD - [2012.04.21 03:50:46 | 003,325,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\585ac5899ab444221c8b41df13b194bc\WindowsBase.ni.dll
MOD - [2012.04.21 03:50:40 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49f4cb0755ccc34cd35ff96dc2ef9e3\System.Xml.ni.dll
MOD - [2012.04.21 03:50:36 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\15742b3597258ce67cbe219005c197e5\System.Configuration.ni.dll
MOD - [2012.04.21 03:50:28 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1f14b3e1ee0847f8662f513e67f92547\System.ni.dll
MOD - [2012.03.09 12:39:04 | 000,049,792 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Recovery\RecoveryDVDLang.dll
MOD - [2012.02.25 01:55:21 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll
MOD - [2012.02.08 16:55:30 | 000,131,712 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Recovery\DiskInfo.dll
MOD - [2010.08.12 04:46:34 | 001,597,440 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
MOD - [2010.07.01 20:21:42 | 000,204,800 | ---- | M] () -- C:\Program Files (x86)\asus\VirtualCamera\virtualCamera.ax
MOD - [2010.02.24 00:14:22 | 000,071,680 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\Brightness.dll
MOD - [2010.02.24 00:14:18 | 000,041,472 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\HelpFunc.dll
MOD - [2010.02.24 00:14:10 | 000,050,688 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\P4GControl.dll
MOD - [2010.02.24 00:12:22 | 000,186,880 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\Resolution.dll
MOD - [2010.02.24 00:11:46 | 000,076,288 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\Volume.dll
MOD - [2009.11.02 23:23:36 | 000,013,096 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
MOD - [2009.11.02 23:20:10 | 000,619,816 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
MOD - [2009.09.17 13:41:42 | 000,267,264 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ipswcore.dll
MOD - [2009.09.15 16:45:58 | 000,228,864 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ipswsysmon.dll
MOD - [2009.09.15 10:47:10 | 000,049,152 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ResItf.dll
MOD - [2009.09.11 16:40:20 | 000,084,992 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\cxcmrt.dll
MOD - [2009.08.04 11:50:05 | 000,249,856 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll
MOD - [2009.08.04 11:50:05 | 000,110,592 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_de_31bf3856ad364e35\PresentationCore.resources.dll
MOD - [2009.08.04 11:49:43 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.07.08 11:24:16 | 000,167,424 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ipsw_cfgmgr.dll
MOD - [2009.07.03 13:40:34 | 000,085,504 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\LogonStartup.dll
MOD - [2009.07.03 13:21:16 | 000,042,496 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\iphelper.dll
MOD - [2009.07.03 13:13:56 | 000,297,984 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ipswui.dll
MOD - [2009.07.03 13:13:16 | 000,074,752 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ipswobj.dll
MOD - [2009.07.03 13:12:32 | 000,049,152 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ipswhlp.dll
MOD - [2009.07.03 13:12:24 | 000,065,024 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ipswgblset.dll
MOD - [2009.07.03 13:12:14 | 000,089,088 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ipswds.dll
MOD - [2009.07.01 16:46:24 | 000,461,824 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ipswresmgr.dll
MOD - [2007.11.30 20:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
MOD - [2007.06.15 19:28:36 | 000,147,456 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll
MOD - [2007.06.02 02:08:18 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2012.01.02 22:45:27 | 001,431,888 | ---- | M] (Flexera Software, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64)
SRV:64bit: - [2010.10.09 11:00:14 | 000,859,712 | ---- | M] (Trend Micro Inc.) [Auto | Running] -- C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe -- (SfCtlCom)
SRV:64bit: - [2010.06.22 20:20:42 | 000,379,520 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Windows\SysNative\FBAgent.exe -- (AFBAgent)
SRV:64bit: - [2010.03.05 19:26:38 | 001,425,168 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:64bit: - [2010.03.05 19:07:58 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)
SRV:64bit: - [2010.03.05 19:06:22 | 000,831,760 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:64bit: - [2010.02.23 13:56:42 | 000,570,632 | ---- | M] (Trend Micro Inc.) [On_Demand | Running] -- C:\Program Files\Trend Micro\BM\TMBMSRV.exe -- (TMBMServer)
SRV:64bit: - [2010.02.23 13:56:40 | 000,917,768 | ---- | M] (Trend Micro Inc.) [On_Demand | Running] -- C:\Program Files\Trend Micro\Internet Security\TmProxy.exe -- (TmProxy)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV:64bit: - [2007.08.03 12:24:54 | 000,125,496 | ---- | M] () [On_Demand | Running] -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr)
SRV - [2013.04.22 21:08:02 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.04.22 21:07:40 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2013.04.19 17:15:18 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.02.28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013.02.05 17:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Running] -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService)
SRV - [2011.10.21 15:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.10.13 17:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
SRV - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011.08.07 12:57:46 | 000,080,256 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\ezGOSvc.dll -- (ezGOSvc)
SRV - [2011.02.02 15:08:16 | 000,018,656 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe -- (Autodesk Content Service)
SRV - [2010.07.08 19:05:08 | 000,145,120 | R--- | M] (4G Systems GmbH & Co. KG) [Auto | Running] -- C:\Windows\service4g.exe -- (XS Stick Service)
SRV - [2010.04.12 19:03:44 | 000,329,168 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\XSManager\WTGService.exe -- (WTGService)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.12.15 19:39:38 | 000,096,896 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
SRV - [2009.10.01 04:34:22 | 002,314,240 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2009.10.01 04:33:08 | 000,262,144 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2009.06.16 02:30:42 | 000,084,536 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.03.31 11:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) [On_Demand | Running] -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe -- (ADSMService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013.04.22 21:08:11 | 000,130,016 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2013.04.22 21:08:11 | 000,100,712 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2013.04.22 21:08:11 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.03.01 08:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.11.21 20:55:45 | 000,117,888 | ---- | M] (Mobile Connector) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cmnsusbser.sys -- (cmnsusbser)
DRV:64bit: - [2011.10.01 08:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011.10.01 08:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011.10.01 08:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011.10.01 08:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011.07.12 12:56:50 | 000,342,288 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\tmxpflt.sys -- (tmxpflt)
DRV:64bit: - [2011.07.12 12:56:36 | 000,042,768 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\tmpreflt.sys -- (tmpreflt)
DRV:64bit: - [2011.07.12 12:47:06 | 002,077,456 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vsapint.sys -- (vsapint)
DRV:64bit: - [2011.03.11 08:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.10.12 21:45:23 | 000,035,384 | ---- | M] (ASUSTek Computer Inc) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\AsDsm.sys -- (AsDsm)
DRV:64bit: - [2010.10.12 21:22:22 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.07.21 07:33:49 | 000,129,024 | ---- | M] (ELAN Microelectronic Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)
DRV:64bit: - [2010.06.18 19:38:06 | 000,039,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WDKMD.sys -- (wdkmd)
DRV:64bit: - [2010.04.30 04:19:29 | 010,331,840 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010.03.18 07:21:58 | 007,680,512 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64)
DRV:64bit: - [2010.02.26 10:32:11 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2010.02.25 05:26:57 | 000,115,312 | ---- | M] (JMicron Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\JME.sys -- (JME)
DRV:64bit: - [2010.02.23 13:57:30 | 000,107,536 | ---- | M] (Trend Micro Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tmtdi.sys -- (tmtdi)
DRV:64bit: - [2010.02.03 00:38:29 | 000,271,872 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2010.01.18 11:45:49 | 000,717,368 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2009.09.17 21:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009.08.20 04:41:37 | 001,800,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\snp2uvc.sys -- (SNP2UVC)
DRV:64bit: - [2009.08.18 10:23:31 | 000,143,472 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR)
DRV:64bit: - [2009.08.06 23:24:13 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009.07.20 11:29:39 | 000,015,416 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kbfiltr.sys -- (kbfiltr)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.20 04:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.06.18 21:18:10 | 000,015,928 | ---- | M] (Windows (R) Win 7 DDK provider) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\lullaby.sys -- (lullaby)
DRV:64bit: - [2009.06.10 22:35:57 | 000,056,832 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SiSG664.sys -- (SiSGbeLH)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.13 18:07:20 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor)
DRV:64bit: - [2008.12.08 18:35:52 | 000,061,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2008.05.23 17:27:28 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV:64bit: - [2007.08.03 06:26:48 | 000,017,464 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009.07.03 02:36:14 | 000,015,416 | ---- | M] (ASUS) [Kernel | Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = fbdirecto.net/1/
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ASUT_deDE442
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_169.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
 
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: McAfee Security Scanner + (Enabled) = C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll
CHR - Extension: Skype Click to Call = C:\Users\asus pro 5if\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.10.0.9560_0\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg64.dll (Google Inc.)
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O4:64bit: - HKLM..\Run: [ASUS WebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe ()
O4:64bit: - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd File not found
O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4:64bit: - HKLM..\Run: [UfSeAgnt.exe] C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe (Trend Micro Inc.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe ({StringFileInfo_CompanyName})
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Boingo Wi-Fi] C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk ()
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [RemoteControl9] C:\Program Files (x86)\Cyberlink\PowerDVD9\PDVD9Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [starter4g] C:\Windows\starter4g.exe (4G Systems GmbH & Co. KG)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()
O4 - HKCU..\Run: [Windows Messages Controler] c:\users\public\sms.exe (The Pidgin developer community)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 83.169.184.225 83.169.184.161
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1174BE90-297D-49A5-A42D-A8007AAE5E97}: DhcpNameServer = 83.169.184.225 83.169.184.161
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.01.02 22:48:40 | 000,000,000 | ---D | M] - D:\AutoCAD 2012 - Deutsch -- [ NTFS ]
O33 - MountPoints2\{24d81e20-1472-11e1-a18d-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{24d81e20-1472-11e1-a18d-806e6f6e6963}\Shell\AutoRun\command - "" = F:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.04.23 17:24:25 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\asus pro 5if\Desktop\OTL.exe
[2013.04.23 14:08:44 | 001,156,394 | ---- | C] (The Pidgin developer community) -- C:\ProgramData\F6DE.exe
[2013.04.22 21:29:40 | 000,000,000 | ---D | C] -- C:\Users\asus pro 5if\AppData\Roaming\Avira
[2013.04.22 21:24:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2013.04.22 21:23:39 | 000,130,016 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.04.22 21:23:39 | 000,100,712 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.04.22 21:23:39 | 000,028,600 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.04.22 21:23:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2013.04.19 18:17:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2013.04.19 17:15:25 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee Security Scan
[2013.04.19 17:15:24 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2013.04.19 17:15:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\McAfee Security Scan
[2013.04.19 17:14:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2013.03.31 18:54:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2008.08.12 06:45:20 | 000,155,648 | ---- | C] (ASUS) -- C:\Program Files (x86)\Common Files\MSIactionall.dll
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.04.23 18:27:51 | 000,000,824 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\tmvsthfud.bin
[2013.04.23 18:27:51 | 000,000,824 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\tmvsthfss.bin
[2013.04.23 18:10:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.04.23 17:39:11 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.04.23 17:24:25 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\asus pro 5if\Desktop\OTL.exe
[2013.04.23 17:23:20 | 000,000,000 | ---- | M] () -- C:\Users\asus pro 5if\defogger_reenable
[2013.04.23 17:17:48 | 000,050,477 | ---- | M] () -- C:\Users\asus pro 5if\Desktop\Defogger.exe
[2013.04.23 16:29:23 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.04.23 16:29:23 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.04.23 16:26:59 | 001,614,964 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.04.23 16:26:59 | 000,697,550 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.04.23 16:26:59 | 000,652,828 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.04.23 16:26:59 | 000,148,556 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.04.23 16:26:59 | 000,121,502 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.04.23 16:21:15 | 000,045,056 | ---- | M] () -- C:\Windows\SysNative\acovcnt.exe
[2013.04.23 16:20:57 | 000,002,088 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini
[2013.04.23 16:20:50 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.04.23 16:20:39 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.04.23 16:20:35 | 2299,965,440 | -HS- | M] () -- C:\hiberfil.sys
[2013.04.23 16:19:46 | 000,182,784 | ---- | M] () -- C:\ProgramData\cfeabdbcdabeesacfsfdsf.exe
[2013.04.23 14:08:47 | 001,156,394 | ---- | M] (The Pidgin developer community) -- C:\ProgramData\F6DE.exe
[2013.04.23 05:08:25 | 000,237,568 | ---- | M] () -- C:\ProgramData\4542.exe
[2013.04.23 04:53:22 | 000,020,466 | ---- | M] () -- C:\ProgramData\8750.exe
[2013.04.23 04:38:23 | 000,020,317 | ---- | M] () -- C:\ProgramData\CB03.exe
[2013.04.23 03:38:20 | 000,020,168 | ---- | M] () -- C:\ProgramData\D1E5.exe
[2013.04.23 03:23:18 | 000,020,408 | ---- | M] () -- C:\ProgramData\1329.exe
[2013.04.23 03:08:18 | 000,020,085 | ---- | M] () -- C:\ProgramData\56CC.exe
[2013.04.23 02:53:17 | 000,020,578 | ---- | M] () -- C:\ProgramData\9707.exe
[2013.04.23 02:38:18 | 000,020,430 | ---- | M] () -- C:\ProgramData\DABA.exe
[2013.04.23 02:23:15 | 000,020,404 | ---- | M] () -- C:\ProgramData\193F.exe
[2013.04.23 02:08:14 | 000,020,446 | ---- | M] () -- C:\ProgramData\5890.exe
[2013.04.23 01:53:14 | 000,237,568 | ---- | M] () -- C:\ProgramData\9773.exe
[2013.04.23 01:38:14 | 000,237,568 | ---- | M] () -- C:\ProgramData\DB17.exe
[2013.04.23 01:23:14 | 000,237,568 | ---- | M] () -- C:\ProgramData\1E2E.exe
[2013.04.23 01:08:14 | 000,237,568 | ---- | M] () -- C:\ProgramData\6184.exe
[2013.04.23 00:53:12 | 000,237,568 | ---- | M] () -- C:\ProgramData\A46C.exe
[2013.04.23 00:38:13 | 000,237,568 | ---- | M] () -- C:\ProgramData\E7E1.exe
[2013.04.23 00:23:13 | 000,237,568 | ---- | M] () -- C:\ProgramData\2A5D.exe
[2013.04.23 00:08:12 | 000,237,568 | ---- | M] () -- C:\ProgramData\6CC9.exe
[2013.04.22 23:53:11 | 000,237,568 | ---- | M] () -- C:\ProgramData\AFB1.exe
[2013.04.22 23:38:12 | 000,237,568 | ---- | M] () -- C:\ProgramData\F2F8.exe
[2013.04.22 23:23:11 | 000,237,568 | ---- | M] () -- C:\ProgramData\3554.exe
[2013.04.22 23:08:11 | 000,237,568 | ---- | M] () -- C:\ProgramData\789A.exe
[2013.04.22 22:53:10 | 000,237,568 | ---- | M] () -- C:\ProgramData\BB25.exe
[2013.04.22 22:38:11 | 000,237,568 | ---- | M] () -- C:\ProgramData\FE5C.exe
[2013.04.22 21:24:10 | 000,001,996 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.04.22 21:23:09 | 000,103,424 | ---- | M] () -- C:\ProgramData\4597.exe
[2013.04.22 21:23:01 | 000,001,361 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini
[2013.04.22 21:12:19 | 000,103,424 | ---- | M] () -- C:\ProgramData\1911.exe
[2013.04.22 21:08:11 | 000,130,016 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.04.22 21:08:11 | 000,100,712 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.04.22 21:08:11 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.04.22 20:57:19 | 000,103,424 | ---- | M] () -- C:\ProgramData\5C57.exe
[2013.04.22 20:42:18 | 000,103,424 | ---- | M] () -- C:\ProgramData\9D1E.exe
[2013.04.19 18:17:11 | 000,002,048 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2013.04.19 18:17:11 | 000,002,048 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2013.03.30 20:34:37 | 000,115,030 | ---- | M] () -- C:\Users\asus pro 5if\Desktop\579753_10151516465008057_2062735333_n.jpg
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.04.23 17:23:20 | 000,000,000 | ---- | C] () -- C:\Users\asus pro 5if\defogger_reenable
[2013.04.23 17:17:48 | 000,050,477 | ---- | C] () -- C:\Users\asus pro 5if\Desktop\Defogger.exe
[2013.04.23 05:08:24 | 000,237,568 | ---- | C] () -- C:\ProgramData\4542.exe
[2013.04.23 04:53:22 | 000,020,466 | ---- | C] () -- C:\ProgramData\8750.exe
[2013.04.23 04:38:22 | 000,020,317 | ---- | C] () -- C:\ProgramData\CB03.exe
[2013.04.23 03:38:20 | 000,020,168 | ---- | C] () -- C:\ProgramData\D1E5.exe
[2013.04.23 03:23:18 | 000,020,408 | ---- | C] () -- C:\ProgramData\1329.exe
[2013.04.23 03:08:18 | 000,020,085 | ---- | C] () -- C:\ProgramData\56CC.exe
[2013.04.23 02:53:17 | 000,020,578 | ---- | C] () -- C:\ProgramData\9707.exe
[2013.04.23 02:38:17 | 000,020,430 | ---- | C] () -- C:\ProgramData\DABA.exe
[2013.04.23 02:23:15 | 000,020,404 | ---- | C] () -- C:\ProgramData\193F.exe
[2013.04.23 02:08:14 | 000,020,446 | ---- | C] () -- C:\ProgramData\5890.exe
[2013.04.23 01:53:13 | 000,237,568 | ---- | C] () -- C:\ProgramData\9773.exe
[2013.04.23 01:38:13 | 000,237,568 | ---- | C] () -- C:\ProgramData\DB17.exe
[2013.04.23 01:23:13 | 000,237,568 | ---- | C] () -- C:\ProgramData\1E2E.exe
[2013.04.23 01:08:13 | 000,237,568 | ---- | C] () -- C:\ProgramData\6184.exe
[2013.04.23 00:53:12 | 000,237,568 | ---- | C] () -- C:\ProgramData\A46C.exe
[2013.04.23 00:38:12 | 000,237,568 | ---- | C] () -- C:\ProgramData\E7E1.exe
[2013.04.23 00:23:12 | 000,237,568 | ---- | C] () -- C:\ProgramData\2A5D.exe
[2013.04.23 00:08:11 | 000,237,568 | ---- | C] () -- C:\ProgramData\6CC9.exe
[2013.04.22 23:53:10 | 000,237,568 | ---- | C] () -- C:\ProgramData\AFB1.exe
[2013.04.22 23:38:11 | 000,237,568 | ---- | C] () -- C:\ProgramData\F2F8.exe
[2013.04.22 23:23:10 | 000,237,568 | ---- | C] () -- C:\ProgramData\3554.exe
[2013.04.22 23:08:10 | 000,237,568 | ---- | C] () -- C:\ProgramData\789A.exe
[2013.04.22 22:53:09 | 000,237,568 | ---- | C] () -- C:\ProgramData\BB25.exe
[2013.04.22 22:38:10 | 000,237,568 | ---- | C] () -- C:\ProgramData\FE5C.exe
[2013.04.22 21:24:10 | 000,001,996 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.04.22 21:23:09 | 000,103,424 | ---- | C] () -- C:\ProgramData\4597.exe
[2013.04.22 21:12:18 | 000,103,424 | ---- | C] () -- C:\ProgramData\1911.exe
[2013.04.22 20:57:18 | 000,103,424 | ---- | C] () -- C:\ProgramData\5C57.exe
[2013.04.22 20:42:17 | 000,103,424 | ---- | C] () -- C:\ProgramData\9D1E.exe
[2013.04.22 20:27:14 | 000,182,784 | ---- | C] () -- C:\ProgramData\cfeabdbcdabeesacfsfdsf.exe
[2013.04.19 17:15:24 | 000,002,048 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2013.04.19 17:15:24 | 000,002,048 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2013.03.30 20:34:20 | 000,115,030 | ---- | C] () -- C:\Users\asus pro 5if\Desktop\579753_10151516465008057_2062735333_n.jpg
[2012.01.02 22:46:15 | 000,000,153 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2011.09.11 23:35:44 | 000,080,256 | ---- | C] () -- C:\Windows\SysWow64\ezGOSvc.dll
[2011.08.03 17:02:54 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.04.08 19:31:56 | 000,106,496 | ---- | C] () -- C:\Program Files (x86)\Common Files\CPInstallAction.dll
[2008.05.22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files (x86)\Common Files\banner.jpg
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.01.04 11:59:19 | 014,164,480 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.01.04 11:03:45 | 012,868,096 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 03:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2011.07.27 03:50:04 | 000,000,000 | ---D | M] -- C:\Users\asus pro 5if\AppData\Roaming\Asus WebStorage
[2012.01.03 08:47:51 | 000,000,000 | ---D | M] -- C:\Users\asus pro 5if\AppData\Roaming\Autodesk
[2011.09.15 00:06:52 | 000,000,000 | ---D | M] -- C:\Users\asus pro 5if\AppData\Roaming\go
[2011.07.27 04:21:26 | 000,000,000 | ---D | M] -- C:\Users\asus pro 5if\AppData\Roaming\Opera
[2013.04.22 21:20:21 | 000,000,000 | ---D | M] -- C:\Users\asus pro 5if\AppData\Roaming\SoftGrid Client
[2011.01.07 19:12:36 | 000,000,000 | ---D | M] -- C:\Users\asus pro 5if\AppData\Roaming\TP
[2011.11.21 20:59:23 | 000,000,000 | ---D | M] -- C:\Users\asus pro 5if\AppData\Roaming\XSManager
 
========== Purity Check ==========
 
 

< End of report >
--- --- ---
Und hier der Extra-Report.OTL Logfile:
Code:
OTL Extras logfile created on: 23.04.2013 18:19:17 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\asus pro 5if\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,86 Gb Total Physical Memory | 1,48 Gb Available Physical Memory | 51,94% Memory free
5,71 Gb Paging File | 3,60 Gb Available in Paging File | 63,07% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 72,69 Gb Total Space | 38,15 Gb Free Space | 52,48% Space Free | Partition Type: NTFS
Drive D: | 205,87 Gb Total Space | 203,68 Gb Free Space | 98,93% Space Free | Partition Type: NTFS
 
Computer Name: ASUSPRO5IF-PC | User Name: asus pro 5if | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AutoUpdateDisableNotify" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{098AE4B0-A4AF-4527-BFD4-ACB9BB923E86}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{0AAF5689-91D8-4A2B-91BF-FEC1285C199C}" = rport=445 | protocol=6 | dir=out | app=system |
"{14C6060E-7323-4754-BB6C-72F24A9B5137}" = rport=137 | protocol=17 | dir=out | app=system |
"{19D600CF-24A2-4461-853C-834DF9018D41}" = lport=5353 | protocol=17 | dir=in | name=java(tm) platform se binary |
"{1E1E0279-40AB-4A3D-B3EE-D452D27A71F3}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{204DEEBE-8288-4AF6-97E1-C12AC28C3CFF}" = lport=2869 | protocol=6 | dir=in | app=system |
"{7770326A-74AB-46DB-B2D2-39D25185AFEE}" = lport=445 | protocol=6 | dir=in | app=system |
"{858067AF-1FBC-45EB-88CB-FE41A85427C4}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{8B421DE9-A7FB-48FB-9CEA-7A677607248A}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{8C195C6A-7FDD-4B72-8735-F5AB44E85D1F}" = lport=137 | protocol=17 | dir=in | app=system |
"{8DE65730-1297-4F55-8A0E-53FA67A6E27F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{9694F71B-3818-454D-927C-131C5A21C3FE}" = rport=138 | protocol=17 | dir=out | app=system |
"{999D5188-6B3B-4507-8343-A03601391B28}" = lport=138 | protocol=17 | dir=in | app=system |
"{A09F3E82-BF99-4796-92D3-2B761AA19CA1}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A155824A-E561-4D20-AF75-2564ACD01AEF}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B0753ECF-E009-41B3-A096-3D100DC3A089}" = rport=139 | protocol=6 | dir=out | app=system |
"{BB0F6C10-7BBF-43D5-BC9A-F36921195688}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{BD5569AB-AD88-4B2E-B71F-F4F3D352AD90}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{BE21D6DC-56C8-41C7-8DD9-7A45A2991E20}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{C2A1504B-1B32-4F45-A300-439ED8984B16}" = lport=8182 | protocol=6 | dir=in | name=java(tm) platform se binary |
"{C82F944E-2F54-4600-86D1-1687038E180C}" = lport=139 | protocol=6 | dir=in | app=system |
"{D184196A-3DFC-41A7-9AE8-215F4810DEE7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D58C8CFA-696E-4AAB-BAFB-6AE16D7E8608}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{F6DA3474-D545-4D27-AE9C-56EFAB978F51}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{09BCB1A9-E9FC-4328-9321-450FC2F75AF8}" = dir=in | app=c:\program files\intel\wifi\bin\pandhcpdns.exe |
"{259087F3-C4A5-4685-987E-3AF60D2E0BE8}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{58523C97-7833-4CF2-9CF7-3933F5CDC5F8}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{5BACDE73-E88D-4B82-A7E0-24496322555C}" = dir=in | app=c:\program files (x86)\intel corporation\intel wireless display\widiapp.exe |
"{60D9AA61-C2E3-4EE8-9E80-ED61AB2A624C}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{6A687CAC-7FC0-45FE-B89D-2CA3FA94B5C4}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{76331D57-6B90-44DD-ACD2-B86C023A971F}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector\pdr.exe |
"{780C5F7B-DF24-497C-A3C2-17162799A101}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{7E073AC9-F1F7-4C6B-8645-105668DB6CB1}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd9\powerdvd9.exe |
"{830149EF-FB39-46ED-8246-D9354A9ADE6C}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{8F93CD7A-1E9F-4145-ACFC-64F9DB2EFB35}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{ADE872F1-0B47-4389-AB29-0CE21027BAD2}" = dir=in | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe |
"{BBFA1B1E-7C6A-454F-B907-34B4BF37A7CF}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{BDBCFC44-7B67-48FE-9BF8-3457ECC3A2AC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{EA656545-2D78-4E22-8582-7D1D1B002F9E}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{F1C893A0-935B-40A1-943F-9617F5BF7F02}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{F39B2D50-F3A1-4B97-9158-7B3006BACD96}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd9\powerdvd cinema\powerdvdcinema.exe |
"{F8021BBC-970B-4F98-9A90-AB68160E5923}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{13F4A7F3-EABC-4261-AF6B-1317777F0755}" = Fast Boot
"{1A8BA6CE-822D-4888-89E2-ACBF4308F271}" = Intel(R) PROSet/Wireless WiFi Software
"{3768263E-8BE8-4CEF-9463-6D36F731824B}" = Windows Live Family Safety
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5783F2D7-A001-0407-0102-0060B0CE6BBA}" = AutoCAD 2012 - Deutsch
"{5783F2D7-A001-0407-1102-0060B0CE6BBA}" = AutoCAD 2012 Language Pack - Deutsch
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{718D791F-F4E8-4aa7-98A6-15FDED17BDD0}" = Trend Micro Internet Security
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{91EFE3A1-585E-4F66-B5F6-F118F56C4C47}" = ASUS Power4Gear Hybrid
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9CF4A37B-A8C4-44D7-8C53-13B9D9594BB3}" = Paint.NET v3.5.8
"{9D2B0322-44AE-460E-9283-4D2D7A9205AE}" = Trend Micro Internet Security
"{C298FF86-AB23-4B58-AC53-A23383C07B3A}" = Intel(R) Wireless Display
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"AutoCAD 2012 - Deutsch" = AutoCAD 2012 - Deutsch
"CNXT_AUDIO_HDA" = Conexant HD Audio
"Elantech" = ETDWare PS/2-x64 7.0.5.13_WHQL
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"ProInst" = Intel PROSet Wireless
"USB2.0 UVC VGA WebCam" = USB2.0 UVC VGA WebCam
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{086F9A69-CD39-4893-A9FB-D3A0634CE3F7}" = Autodesk Content Service
"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = ASUS Video Magic
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}" = Wireless Console 3
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron Flash Media Controller Driver
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2B81872B-A054-48DA-BE3B-FA5C164C303A}" = ASUS FancyStart
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail
"{5B65EF64-1DFA-414A-8C94-7BB726158E21}" = ControlDeck
"{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}" = NB Probe
"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{65420DC9-306E-4371-905F-F4DC3B418E52}" = Autodesk Material Library Base Resolution Image Library 2012
"{6B77A7F6-DD63-4F13-A6FF-83137A5AC354}" = ASUS CopyProtect
"{6B96DADA-1A27-4A04-8CB2-CC45168D05FA}" = Windows Live Fotogalerie
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer
"{835686C5-8650-49EB-8CA0-4528B4035495}" = Windows Live Call
"{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}" = Windows Live Messenger
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8C1E2925-14F8-45AA-B999-1E2A74BF5607}" = Windows Live Sync
"{8F0837C2-EE09-4903-88F3-1976FE7FFF4E}" = Autodesk Material Library 2012
"{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{951B0F30-9F1A-4BF6-B3DA-99EB0E917B1C}" = FARO LS 1.1.406.58
"{96DCEE2F-98EE-4F80-8C0F-7C04D1FB9D7F}" = JMicron Ethernet Adapter NDIS Driver
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D48531D-2135-49FC-BC29-ACCDA5396A76}" = ASUS MultiFrame
"{9D6D7811-43B3-463C-BC79-5D1755269989}" = Net4Switch
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}" = ATK Package
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.4.6 MUI
"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar
"{B653A2EC-D816-4498-A4FD-651047AB9DC9}" = Boingo Wi-Fi
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BBED4F90-7AE5-40BF-AFB7-1B495692F4AB}" = syncables desktop SE
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"{D39F0676-163E-4595-A917-E28F99BBD4D2}" = ASUS AI Recovery
"{DF5F687F-8018-4542-9F98-7084E9022917}" = Windows Live Essentials
"{E3739848-5329-48E3-8D28-5BBD6E8BE384}" = CyberLink MediaShow Espresso
"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update
"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{FA2092C5-7979-412D-A962-6485274AE1EE}" = ASUS Data Security Manager
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ASUS WebStorage" = ASUS WebStorage
"Avira AntiVir Desktop" = Avira Free Antivirus
"Google Chrome" = Google Chrome
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = ASUS Video Magic
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}" = CyberLink MediaShow Espresso
"K_Series_ScreenSaver_EN" = K_Series_ScreenSaver_EN
"McAfee Security Scan" = McAfee Security Scan Plus
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"Opera 12.15.1748" = Opera 12.15
"Pontifex II" = Pontifex II
"VLC media player" = VLC media player 1.1.11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.20 (32-Bit)
"XSManager" = XSManager
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Game Organizer" = EasyBits GO
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 19.04.2013 18:36:16 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend
 micro\internet security\component\framework\200\UfNavi.exe".  Die abhängige Assemblierung
 "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 19.04.2013 18:36:16 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend
 micro\internet security\component\framework\200\UfSeAgnt.exe".  Die abhängige Assemblierung
 "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 19.04.2013 18:36:16 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend
 micro\internet security\component\framework\200\UfUpdUi.exe".  Die abhängige Assemblierung
 "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 19.04.2013 18:36:22 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files
 (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder
 Richtliniendatei "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe
 AIR.dll" in Zeile 3.  Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
 des "version"-Attributs im assemblyIdentity-Element ist ungültig.
 
Error - 22.04.2013 18:35:17 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend
 micro\internet security\component\framework\200\TisScan.exe".  Die abhängige Assemblierung
 "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 22.04.2013 18:35:18 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend
 micro\internet security\component\framework\200\UfLogUi.exe".  Die abhängige Assemblierung
 "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 22.04.2013 18:35:18 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend
 micro\internet security\component\framework\200\UfNavi.exe".  Die abhängige Assemblierung
 "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 22.04.2013 18:35:18 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend
 micro\internet security\component\framework\200\UfSeAgnt.exe".  Die abhängige Assemblierung
 "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 22.04.2013 18:35:18 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend
 micro\internet security\component\framework\200\UfUpdUi.exe".  Die abhängige Assemblierung
 "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 22.04.2013 18:35:26 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files
 (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder
 Richtliniendatei "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe
 AIR.dll" in Zeile 3.  Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
 des "version"-Attributs im assemblyIdentity-Element ist ungültig.
 
[ Media Center Events ]
Error - 06.01.2012 06:15:32 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 11:15:32 - Fehler beim Herstellen der Internetverbindung.  11:15:32
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 07.01.2012 05:01:17 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 10:01:17 - Fehler beim Herstellen der Internetverbindung.  10:01:17
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 08.01.2012 04:18:16 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 09:18:16 - Fehler beim Herstellen der Internetverbindung.  09:18:16
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 09.01.2012 02:32:12 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 07:32:12 - Fehler beim Herstellen der Internetverbindung.  07:32:12
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 10.01.2012 08:24:01 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 13:24:01 - Fehler beim Herstellen der Internetverbindung.  13:24:01
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 11.01.2012 04:47:28 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 09:47:27 - Fehler beim Herstellen der Internetverbindung.  09:47:28
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 12.01.2012 09:10:13 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 14:10:13 - Fehler beim Herstellen der Internetverbindung.  14:10:13
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 13.01.2012 20:29:42 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 01:29:42 - Fehler beim Herstellen der Internetverbindung.  01:29:42
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 14.01.2012 22:09:54 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 03:09:54 - Fehler beim Herstellen der Internetverbindung.  03:09:54
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 16.01.2012 00:01:26 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 05:01:26 - Fehler beim Herstellen der Internetverbindung.  05:01:26
-    Serververbindung konnte nicht hergestellt werden.. 
 
[ System Events ]
Error - 09.03.2012 13:10:01 | Computer Name = asuspro5if-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 09.03.2012 13:10:01 | Computer Name = asuspro5if-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 09.03.2012 13:10:01 | Computer Name = asuspro5if-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 09.03.2012 13:10:01 | Computer Name = asuspro5if-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 09.03.2012 13:10:01 | Computer Name = asuspro5if-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 11.03.2012 11:58:31 | Computer Name = asuspro5if-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?11.?03.?2012 um 16:56:23 unerwartet heruntergefahren.
 
Error - 13.03.2012 06:30:51 | Computer Name = asuspro5if-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
 
Error - 13.03.2012 06:30:51 | Computer Name = asuspro5if-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
 
Error - 13.03.2012 06:30:52 | Computer Name = asuspro5if-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
 
Error - 13.03.2012 13:41:45 | Computer Name = asuspro5if-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Avira Browser Schutz" wurde unerwartet beendet. Dies ist
 bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden
 durchgeführt: Neustart des Diensts.
 
 
< End of report >
--- --- ---

haenaez 23.04.2013 17:43
Hallo smeenk.

Hab gerade das OTL laufen lassen. Hier der Report.OTL Logfile:
Code:
OTL logfile created on: 23.04.2013 18:19:17 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\asus pro 5if\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,86 Gb Total Physical Memory | 1,48 Gb Available Physical Memory | 51,94% Memory free
5,71 Gb Paging File | 3,60 Gb Available in Paging File | 63,07% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 72,69 Gb Total Space | 38,15 Gb Free Space | 52,48% Space Free | Partition Type: NTFS
Drive D: | 205,87 Gb Total Space | 203,68 Gb Free Space | 98,93% Space Free | Partition Type: NTFS
 
Computer Name: ASUSPRO5IF-PC | User Name: asus pro 5if | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.04.23 17:24:25 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\asus pro 5if\Desktop\OTL.exe
PRC - [2013.04.23 04:07:16 | 001,156,394 | RHS- | M] (The Pidgin developer community) -- C:\Users\Public\sms.exe
PRC - [2013.04.22 21:08:02 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2013.04.22 21:07:40 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.04.22 21:07:40 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2013.02.05 17:48:44 | 000,272,248 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
PRC - [2013.02.05 17:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe
PRC - [2012.03.09 12:38:26 | 000,658,560 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Recovery\AIRecoveryRemind.exe
PRC - [2011.10.13 17:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011.07.09 07:13:42 | 000,397,992 | ---- | M] ({StringFileInfo_CompanyName}) -- C:\Program Files (x86)\Ask.com\Updater\Updater.exe
PRC - [2011.02.07 23:42:10 | 000,477,560 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McUicnt.exe
PRC - [2011.02.02 15:08:16 | 000,018,656 | ---- | M] () -- C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
PRC - [2010.10.12 21:45:30 | 003,054,136 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe
PRC - [2010.08.17 23:55:42 | 005,732,992 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
PRC - [2010.08.12 04:46:34 | 001,597,440 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
PRC - [2010.07.08 19:05:12 | 000,160,992 | R--- | M] (4G Systems GmbH & Co. KG) -- C:\Windows\starter4g.exe
PRC - [2010.07.08 19:05:08 | 000,145,120 | R--- | M] (4G Systems GmbH & Co. KG) -- C:\Windows\service4g.exe
PRC - [2010.06.09 18:55:54 | 001,080,448 | ---- | M] (asus) -- C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe
PRC - [2010.05.03 23:45:50 | 000,182,912 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
PRC - [2010.05.03 23:41:46 | 000,170,624 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
PRC - [2010.04.12 19:03:44 | 000,329,168 | ---- | M] () -- C:\Program Files (x86)\XSManager\WTGService.exe
PRC - [2009.12.15 19:39:38 | 000,096,896 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
PRC - [2009.11.02 23:21:26 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
PRC - [2009.10.01 04:34:22 | 002,314,240 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2009.10.01 04:33:08 | 000,262,144 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2009.09.23 10:11:54 | 001,160,320 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\Net4Switch\Net4Switch.exe
PRC - [2009.08.12 21:32:56 | 000,365,936 | ---- | M] (Boingo Wireless, Inc.) -- C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe
PRC - [2009.07.31 19:38:24 | 000,305,720 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
PRC - [2009.07.06 23:22:04 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
PRC - [2009.06.24 21:30:18 | 000,272,952 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe
PRC - [2009.06.19 19:29:42 | 000,105,016 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
PRC - [2009.06.19 19:29:26 | 002,488,888 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
PRC - [2009.06.16 02:30:42 | 000,084,536 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
PRC - [2008.12.23 02:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
PRC - [2008.03.31 11:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe
PRC - [2007.11.30 20:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
PRC - [2007.08.03 12:24:54 | 000,125,496 | ---- | M] () -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.04.21 03:56:40 | 000,997,888 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\0794d7af09099432ebfb51af1d7f15ae\System.Management.ni.dll
MOD - [2012.04.21 03:51:58 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\6954c7f14ea634672cdacf2cd793497e\PresentationFramework.Aero.ni.dll
MOD - [2012.04.21 03:51:25 | 014,322,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8435718626a24beaeefc98d45ae77127\PresentationFramework.ni.dll
MOD - [2012.04.21 03:51:09 | 012,431,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ff30db6905f8ec024fc808ed8779c0f3\System.Windows.Forms.ni.dll
MOD - [2012.04.21 03:51:01 | 001,586,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\a09ee392fa90849f2e9313a1ebbe0279\System.Drawing.ni.dll
MOD - [2012.04.21 03:50:57 | 012,216,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\c0508b05f5c28e37711f447a66368e75\PresentationCore.ni.dll
MOD - [2012.04.21 03:50:46 | 003,325,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\585ac5899ab444221c8b41df13b194bc\WindowsBase.ni.dll
MOD - [2012.04.21 03:50:40 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49f4cb0755ccc34cd35ff96dc2ef9e3\System.Xml.ni.dll
MOD - [2012.04.21 03:50:36 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\15742b3597258ce67cbe219005c197e5\System.Configuration.ni.dll
MOD - [2012.04.21 03:50:28 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1f14b3e1ee0847f8662f513e67f92547\System.ni.dll
MOD - [2012.03.09 12:39:04 | 000,049,792 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Recovery\RecoveryDVDLang.dll
MOD - [2012.02.25 01:55:21 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll
MOD - [2012.02.08 16:55:30 | 000,131,712 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Recovery\DiskInfo.dll
MOD - [2010.08.12 04:46:34 | 001,597,440 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
MOD - [2010.07.01 20:21:42 | 000,204,800 | ---- | M] () -- C:\Program Files (x86)\asus\VirtualCamera\virtualCamera.ax
MOD - [2010.02.24 00:14:22 | 000,071,680 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\Brightness.dll
MOD - [2010.02.24 00:14:18 | 000,041,472 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\HelpFunc.dll
MOD - [2010.02.24 00:14:10 | 000,050,688 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\P4GControl.dll
MOD - [2010.02.24 00:12:22 | 000,186,880 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\Resolution.dll
MOD - [2010.02.24 00:11:46 | 000,076,288 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\Volume.dll
MOD - [2009.11.02 23:23:36 | 000,013,096 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
MOD - [2009.11.02 23:20:10 | 000,619,816 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
MOD - [2009.09.17 13:41:42 | 000,267,264 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ipswcore.dll
MOD - [2009.09.15 16:45:58 | 000,228,864 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ipswsysmon.dll
MOD - [2009.09.15 10:47:10 | 000,049,152 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ResItf.dll
MOD - [2009.09.11 16:40:20 | 000,084,992 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\cxcmrt.dll
MOD - [2009.08.04 11:50:05 | 000,249,856 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll
MOD - [2009.08.04 11:50:05 | 000,110,592 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_de_31bf3856ad364e35\PresentationCore.resources.dll
MOD - [2009.08.04 11:49:43 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.07.08 11:24:16 | 000,167,424 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ipsw_cfgmgr.dll
MOD - [2009.07.03 13:40:34 | 000,085,504 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\LogonStartup.dll
MOD - [2009.07.03 13:21:16 | 000,042,496 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\iphelper.dll
MOD - [2009.07.03 13:13:56 | 000,297,984 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ipswui.dll
MOD - [2009.07.03 13:13:16 | 000,074,752 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ipswobj.dll
MOD - [2009.07.03 13:12:32 | 000,049,152 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ipswhlp.dll
MOD - [2009.07.03 13:12:24 | 000,065,024 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ipswgblset.dll
MOD - [2009.07.03 13:12:14 | 000,089,088 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ipswds.dll
MOD - [2009.07.01 16:46:24 | 000,461,824 | ---- | M] () -- C:\Program Files (x86)\ASUS\Net4Switch\ipswresmgr.dll
MOD - [2007.11.30 20:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
MOD - [2007.06.15 19:28:36 | 000,147,456 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll
MOD - [2007.06.02 02:08:18 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2012.01.02 22:45:27 | 001,431,888 | ---- | M] (Flexera Software, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64)
SRV:64bit: - [2010.10.09 11:00:14 | 000,859,712 | ---- | M] (Trend Micro Inc.) [Auto | Running] -- C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe -- (SfCtlCom)
SRV:64bit: - [2010.06.22 20:20:42 | 000,379,520 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Windows\SysNative\FBAgent.exe -- (AFBAgent)
SRV:64bit: - [2010.03.05 19:26:38 | 001,425,168 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:64bit: - [2010.03.05 19:07:58 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)
SRV:64bit: - [2010.03.05 19:06:22 | 000,831,760 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:64bit: - [2010.02.23 13:56:42 | 000,570,632 | ---- | M] (Trend Micro Inc.) [On_Demand | Running] -- C:\Program Files\Trend Micro\BM\TMBMSRV.exe -- (TMBMServer)
SRV:64bit: - [2010.02.23 13:56:40 | 000,917,768 | ---- | M] (Trend Micro Inc.) [On_Demand | Running] -- C:\Program Files\Trend Micro\Internet Security\TmProxy.exe -- (TmProxy)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV:64bit: - [2007.08.03 12:24:54 | 000,125,496 | ---- | M] () [On_Demand | Running] -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr)
SRV - [2013.04.22 21:08:02 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.04.22 21:07:40 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2013.04.19 17:15:18 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.02.28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013.02.05 17:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Running] -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService)
SRV - [2011.10.21 15:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.10.13 17:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
SRV - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011.08.07 12:57:46 | 000,080,256 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\ezGOSvc.dll -- (ezGOSvc)
SRV - [2011.02.02 15:08:16 | 000,018,656 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe -- (Autodesk Content Service)
SRV - [2010.07.08 19:05:08 | 000,145,120 | R--- | M] (4G Systems GmbH & Co. KG) [Auto | Running] -- C:\Windows\service4g.exe -- (XS Stick Service)
SRV - [2010.04.12 19:03:44 | 000,329,168 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\XSManager\WTGService.exe -- (WTGService)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.12.15 19:39:38 | 000,096,896 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
SRV - [2009.10.01 04:34:22 | 002,314,240 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2009.10.01 04:33:08 | 000,262,144 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2009.06.16 02:30:42 | 000,084,536 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.03.31 11:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) [On_Demand | Running] -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe -- (ADSMService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013.04.22 21:08:11 | 000,130,016 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2013.04.22 21:08:11 | 000,100,712 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2013.04.22 21:08:11 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.03.01 08:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.11.21 20:55:45 | 000,117,888 | ---- | M] (Mobile Connector) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cmnsusbser.sys -- (cmnsusbser)
DRV:64bit: - [2011.10.01 08:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011.10.01 08:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011.10.01 08:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011.10.01 08:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011.07.12 12:56:50 | 000,342,288 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\tmxpflt.sys -- (tmxpflt)
DRV:64bit: - [2011.07.12 12:56:36 | 000,042,768 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\tmpreflt.sys -- (tmpreflt)
DRV:64bit: - [2011.07.12 12:47:06 | 002,077,456 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vsapint.sys -- (vsapint)
DRV:64bit: - [2011.03.11 08:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.10.12 21:45:23 | 000,035,384 | ---- | M] (ASUSTek Computer Inc) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\AsDsm.sys -- (AsDsm)
DRV:64bit: - [2010.10.12 21:22:22 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.07.21 07:33:49 | 000,129,024 | ---- | M] (ELAN Microelectronic Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)
DRV:64bit: - [2010.06.18 19:38:06 | 000,039,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WDKMD.sys -- (wdkmd)
DRV:64bit: - [2010.04.30 04:19:29 | 010,331,840 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010.03.18 07:21:58 | 007,680,512 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64)
DRV:64bit: - [2010.02.26 10:32:11 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2010.02.25 05:26:57 | 000,115,312 | ---- | M] (JMicron Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\JME.sys -- (JME)
DRV:64bit: - [2010.02.23 13:57:30 | 000,107,536 | ---- | M] (Trend Micro Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tmtdi.sys -- (tmtdi)
DRV:64bit: - [2010.02.03 00:38:29 | 000,271,872 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2010.01.18 11:45:49 | 000,717,368 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2009.09.17 21:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009.08.20 04:41:37 | 001,800,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\snp2uvc.sys -- (SNP2UVC)
DRV:64bit: - [2009.08.18 10:23:31 | 000,143,472 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR)
DRV:64bit: - [2009.08.06 23:24:13 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009.07.20 11:29:39 | 000,015,416 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kbfiltr.sys -- (kbfiltr)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.20 04:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.06.18 21:18:10 | 000,015,928 | ---- | M] (Windows (R) Win 7 DDK provider) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\lullaby.sys -- (lullaby)
DRV:64bit: - [2009.06.10 22:35:57 | 000,056,832 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SiSG664.sys -- (SiSGbeLH)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.13 18:07:20 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor)
DRV:64bit: - [2008.12.08 18:35:52 | 000,061,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2008.05.23 17:27:28 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV:64bit: - [2007.08.03 06:26:48 | 000,017,464 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009.07.03 02:36:14 | 000,015,416 | ---- | M] (ASUS) [Kernel | Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = fbdirecto.net/1/
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ASUT_deDE442
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_169.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
 
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: McAfee Security Scanner + (Enabled) = C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll
CHR - Extension: Skype Click to Call = C:\Users\asus pro 5if\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.10.0.9560_0\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg64.dll (Google Inc.)
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O4:64bit: - HKLM..\Run: [ASUS WebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe ()
O4:64bit: - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd File not found
O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4:64bit: - HKLM..\Run: [UfSeAgnt.exe] C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe (Trend Micro Inc.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe ({StringFileInfo_CompanyName})
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Boingo Wi-Fi] C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk ()
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [RemoteControl9] C:\Program Files (x86)\Cyberlink\PowerDVD9\PDVD9Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [starter4g] C:\Windows\starter4g.exe (4G Systems GmbH & Co. KG)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()
O4 - HKCU..\Run: [Windows Messages Controler] c:\users\public\sms.exe (The Pidgin developer community)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 83.169.184.225 83.169.184.161
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1174BE90-297D-49A5-A42D-A8007AAE5E97}: DhcpNameServer = 83.169.184.225 83.169.184.161
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.01.02 22:48:40 | 000,000,000 | ---D | M] - D:\AutoCAD 2012 - Deutsch -- [ NTFS ]
O33 - MountPoints2\{24d81e20-1472-11e1-a18d-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{24d81e20-1472-11e1-a18d-806e6f6e6963}\Shell\AutoRun\command - "" = F:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.04.23 17:24:25 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\asus pro 5if\Desktop\OTL.exe
[2013.04.23 14:08:44 | 001,156,394 | ---- | C] (The Pidgin developer community) -- C:\ProgramData\F6DE.exe
[2013.04.22 21:29:40 | 000,000,000 | ---D | C] -- C:\Users\asus pro 5if\AppData\Roaming\Avira
[2013.04.22 21:24:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2013.04.22 21:23:39 | 000,130,016 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.04.22 21:23:39 | 000,100,712 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.04.22 21:23:39 | 000,028,600 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.04.22 21:23:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2013.04.19 18:17:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2013.04.19 17:15:25 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee Security Scan
[2013.04.19 17:15:24 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2013.04.19 17:15:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\McAfee Security Scan
[2013.04.19 17:14:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2013.03.31 18:54:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2008.08.12 06:45:20 | 000,155,648 | ---- | C] (ASUS) -- C:\Program Files (x86)\Common Files\MSIactionall.dll
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.04.23 18:27:51 | 000,000,824 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\tmvsthfud.bin
[2013.04.23 18:27:51 | 000,000,824 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\tmvsthfss.bin
[2013.04.23 18:10:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.04.23 17:39:11 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.04.23 17:24:25 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\asus pro 5if\Desktop\OTL.exe
[2013.04.23 17:23:20 | 000,000,000 | ---- | M] () -- C:\Users\asus pro 5if\defogger_reenable
[2013.04.23 17:17:48 | 000,050,477 | ---- | M] () -- C:\Users\asus pro 5if\Desktop\Defogger.exe
[2013.04.23 16:29:23 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.04.23 16:29:23 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.04.23 16:26:59 | 001,614,964 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.04.23 16:26:59 | 000,697,550 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.04.23 16:26:59 | 000,652,828 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.04.23 16:26:59 | 000,148,556 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.04.23 16:26:59 | 000,121,502 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.04.23 16:21:15 | 000,045,056 | ---- | M] () -- C:\Windows\SysNative\acovcnt.exe
[2013.04.23 16:20:57 | 000,002,088 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini
[2013.04.23 16:20:50 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.04.23 16:20:39 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.04.23 16:20:35 | 2299,965,440 | -HS- | M] () -- C:\hiberfil.sys
[2013.04.23 16:19:46 | 000,182,784 | ---- | M] () -- C:\ProgramData\cfeabdbcdabeesacfsfdsf.exe
[2013.04.23 14:08:47 | 001,156,394 | ---- | M] (The Pidgin developer community) -- C:\ProgramData\F6DE.exe
[2013.04.23 05:08:25 | 000,237,568 | ---- | M] () -- C:\ProgramData\4542.exe
[2013.04.23 04:53:22 | 000,020,466 | ---- | M] () -- C:\ProgramData\8750.exe
[2013.04.23 04:38:23 | 000,020,317 | ---- | M] () -- C:\ProgramData\CB03.exe
[2013.04.23 03:38:20 | 000,020,168 | ---- | M] () -- C:\ProgramData\D1E5.exe
[2013.04.23 03:23:18 | 000,020,408 | ---- | M] () -- C:\ProgramData\1329.exe
[2013.04.23 03:08:18 | 000,020,085 | ---- | M] () -- C:\ProgramData\56CC.exe
[2013.04.23 02:53:17 | 000,020,578 | ---- | M] () -- C:\ProgramData\9707.exe
[2013.04.23 02:38:18 | 000,020,430 | ---- | M] () -- C:\ProgramData\DABA.exe
[2013.04.23 02:23:15 | 000,020,404 | ---- | M] () -- C:\ProgramData\193F.exe
[2013.04.23 02:08:14 | 000,020,446 | ---- | M] () -- C:\ProgramData\5890.exe
[2013.04.23 01:53:14 | 000,237,568 | ---- | M] () -- C:\ProgramData\9773.exe
[2013.04.23 01:38:14 | 000,237,568 | ---- | M] () -- C:\ProgramData\DB17.exe
[2013.04.23 01:23:14 | 000,237,568 | ---- | M] () -- C:\ProgramData\1E2E.exe
[2013.04.23 01:08:14 | 000,237,568 | ---- | M] () -- C:\ProgramData\6184.exe
[2013.04.23 00:53:12 | 000,237,568 | ---- | M] () -- C:\ProgramData\A46C.exe
[2013.04.23 00:38:13 | 000,237,568 | ---- | M] () -- C:\ProgramData\E7E1.exe
[2013.04.23 00:23:13 | 000,237,568 | ---- | M] () -- C:\ProgramData\2A5D.exe
[2013.04.23 00:08:12 | 000,237,568 | ---- | M] () -- C:\ProgramData\6CC9.exe
[2013.04.22 23:53:11 | 000,237,568 | ---- | M] () -- C:\ProgramData\AFB1.exe
[2013.04.22 23:38:12 | 000,237,568 | ---- | M] () -- C:\ProgramData\F2F8.exe
[2013.04.22 23:23:11 | 000,237,568 | ---- | M] () -- C:\ProgramData\3554.exe
[2013.04.22 23:08:11 | 000,237,568 | ---- | M] () -- C:\ProgramData\789A.exe
[2013.04.22 22:53:10 | 000,237,568 | ---- | M] () -- C:\ProgramData\BB25.exe
[2013.04.22 22:38:11 | 000,237,568 | ---- | M] () -- C:\ProgramData\FE5C.exe
[2013.04.22 21:24:10 | 000,001,996 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.04.22 21:23:09 | 000,103,424 | ---- | M] () -- C:\ProgramData\4597.exe
[2013.04.22 21:23:01 | 000,001,361 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini
[2013.04.22 21:12:19 | 000,103,424 | ---- | M] () -- C:\ProgramData\1911.exe
[2013.04.22 21:08:11 | 000,130,016 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.04.22 21:08:11 | 000,100,712 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.04.22 21:08:11 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.04.22 20:57:19 | 000,103,424 | ---- | M] () -- C:\ProgramData\5C57.exe
[2013.04.22 20:42:18 | 000,103,424 | ---- | M] () -- C:\ProgramData\9D1E.exe
[2013.04.19 18:17:11 | 000,002,048 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2013.04.19 18:17:11 | 000,002,048 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2013.03.30 20:34:37 | 000,115,030 | ---- | M] () -- C:\Users\asus pro 5if\Desktop\579753_10151516465008057_2062735333_n.jpg
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.04.23 17:23:20 | 000,000,000 | ---- | C] () -- C:\Users\asus pro 5if\defogger_reenable
[2013.04.23 17:17:48 | 000,050,477 | ---- | C] () -- C:\Users\asus pro 5if\Desktop\Defogger.exe
[2013.04.23 05:08:24 | 000,237,568 | ---- | C] () -- C:\ProgramData\4542.exe
[2013.04.23 04:53:22 | 000,020,466 | ---- | C] () -- C:\ProgramData\8750.exe
[2013.04.23 04:38:22 | 000,020,317 | ---- | C] () -- C:\ProgramData\CB03.exe
[2013.04.23 03:38:20 | 000,020,168 | ---- | C] () -- C:\ProgramData\D1E5.exe
[2013.04.23 03:23:18 | 000,020,408 | ---- | C] () -- C:\ProgramData\1329.exe
[2013.04.23 03:08:18 | 000,020,085 | ---- | C] () -- C:\ProgramData\56CC.exe
[2013.04.23 02:53:17 | 000,020,578 | ---- | C] () -- C:\ProgramData\9707.exe
[2013.04.23 02:38:17 | 000,020,430 | ---- | C] () -- C:\ProgramData\DABA.exe
[2013.04.23 02:23:15 | 000,020,404 | ---- | C] () -- C:\ProgramData\193F.exe
[2013.04.23 02:08:14 | 000,020,446 | ---- | C] () -- C:\ProgramData\5890.exe
[2013.04.23 01:53:13 | 000,237,568 | ---- | C] () -- C:\ProgramData\9773.exe
[2013.04.23 01:38:13 | 000,237,568 | ---- | C] () -- C:\ProgramData\DB17.exe
[2013.04.23 01:23:13 | 000,237,568 | ---- | C] () -- C:\ProgramData\1E2E.exe
[2013.04.23 01:08:13 | 000,237,568 | ---- | C] () -- C:\ProgramData\6184.exe
[2013.04.23 00:53:12 | 000,237,568 | ---- | C] () -- C:\ProgramData\A46C.exe
[2013.04.23 00:38:12 | 000,237,568 | ---- | C] () -- C:\ProgramData\E7E1.exe
[2013.04.23 00:23:12 | 000,237,568 | ---- | C] () -- C:\ProgramData\2A5D.exe
[2013.04.23 00:08:11 | 000,237,568 | ---- | C] () -- C:\ProgramData\6CC9.exe
[2013.04.22 23:53:10 | 000,237,568 | ---- | C] () -- C:\ProgramData\AFB1.exe
[2013.04.22 23:38:11 | 000,237,568 | ---- | C] () -- C:\ProgramData\F2F8.exe
[2013.04.22 23:23:10 | 000,237,568 | ---- | C] () -- C:\ProgramData\3554.exe
[2013.04.22 23:08:10 | 000,237,568 | ---- | C] () -- C:\ProgramData\789A.exe
[2013.04.22 22:53:09 | 000,237,568 | ---- | C] () -- C:\ProgramData\BB25.exe
[2013.04.22 22:38:10 | 000,237,568 | ---- | C] () -- C:\ProgramData\FE5C.exe
[2013.04.22 21:24:10 | 000,001,996 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.04.22 21:23:09 | 000,103,424 | ---- | C] () -- C:\ProgramData\4597.exe
[2013.04.22 21:12:18 | 000,103,424 | ---- | C] () -- C:\ProgramData\1911.exe
[2013.04.22 20:57:18 | 000,103,424 | ---- | C] () -- C:\ProgramData\5C57.exe
[2013.04.22 20:42:17 | 000,103,424 | ---- | C] () -- C:\ProgramData\9D1E.exe
[2013.04.22 20:27:14 | 000,182,784 | ---- | C] () -- C:\ProgramData\cfeabdbcdabeesacfsfdsf.exe
[2013.04.19 17:15:24 | 000,002,048 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2013.04.19 17:15:24 | 000,002,048 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2013.03.30 20:34:20 | 000,115,030 | ---- | C] () -- C:\Users\asus pro 5if\Desktop\579753_10151516465008057_2062735333_n.jpg
[2012.01.02 22:46:15 | 000,000,153 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2011.09.11 23:35:44 | 000,080,256 | ---- | C] () -- C:\Windows\SysWow64\ezGOSvc.dll
[2011.08.03 17:02:54 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.04.08 19:31:56 | 000,106,496 | ---- | C] () -- C:\Program Files (x86)\Common Files\CPInstallAction.dll
[2008.05.22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files (x86)\Common Files\banner.jpg
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.01.04 11:59:19 | 014,164,480 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.01.04 11:03:45 | 012,868,096 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 03:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2011.07.27 03:50:04 | 000,000,000 | ---D | M] -- C:\Users\asus pro 5if\AppData\Roaming\Asus WebStorage
[2012.01.03 08:47:51 | 000,000,000 | ---D | M] -- C:\Users\asus pro 5if\AppData\Roaming\Autodesk
[2011.09.15 00:06:52 | 000,000,000 | ---D | M] -- C:\Users\asus pro 5if\AppData\Roaming\go
[2011.07.27 04:21:26 | 000,000,000 | ---D | M] -- C:\Users\asus pro 5if\AppData\Roaming\Opera
[2013.04.22 21:20:21 | 000,000,000 | ---D | M] -- C:\Users\asus pro 5if\AppData\Roaming\SoftGrid Client
[2011.01.07 19:12:36 | 000,000,000 | ---D | M] -- C:\Users\asus pro 5if\AppData\Roaming\TP
[2011.11.21 20:59:23 | 000,000,000 | ---D | M] -- C:\Users\asus pro 5if\AppData\Roaming\XSManager
 
========== Purity Check ==========
 
 

< End of report >
--- --- ---

Und hier der Extra-Report.OTL Logfile:
Code:
OTL Extras logfile created on: 23.04.2013 18:19:17 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\asus pro 5if\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,86 Gb Total Physical Memory | 1,48 Gb Available Physical Memory | 51,94% Memory free
5,71 Gb Paging File | 3,60 Gb Available in Paging File | 63,07% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 72,69 Gb Total Space | 38,15 Gb Free Space | 52,48% Space Free | Partition Type: NTFS
Drive D: | 205,87 Gb Total Space | 203,68 Gb Free Space | 98,93% Space Free | Partition Type: NTFS
 
Computer Name: ASUSPRO5IF-PC | User Name: asus pro 5if | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AutoUpdateDisableNotify" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{098AE4B0-A4AF-4527-BFD4-ACB9BB923E86}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{0AAF5689-91D8-4A2B-91BF-FEC1285C199C}" = rport=445 | protocol=6 | dir=out | app=system |
"{14C6060E-7323-4754-BB6C-72F24A9B5137}" = rport=137 | protocol=17 | dir=out | app=system |
"{19D600CF-24A2-4461-853C-834DF9018D41}" = lport=5353 | protocol=17 | dir=in | name=java(tm) platform se binary |
"{1E1E0279-40AB-4A3D-B3EE-D452D27A71F3}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{204DEEBE-8288-4AF6-97E1-C12AC28C3CFF}" = lport=2869 | protocol=6 | dir=in | app=system |
"{7770326A-74AB-46DB-B2D2-39D25185AFEE}" = lport=445 | protocol=6 | dir=in | app=system |
"{858067AF-1FBC-45EB-88CB-FE41A85427C4}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{8B421DE9-A7FB-48FB-9CEA-7A677607248A}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{8C195C6A-7FDD-4B72-8735-F5AB44E85D1F}" = lport=137 | protocol=17 | dir=in | app=system |
"{8DE65730-1297-4F55-8A0E-53FA67A6E27F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{9694F71B-3818-454D-927C-131C5A21C3FE}" = rport=138 | protocol=17 | dir=out | app=system |
"{999D5188-6B3B-4507-8343-A03601391B28}" = lport=138 | protocol=17 | dir=in | app=system |
"{A09F3E82-BF99-4796-92D3-2B761AA19CA1}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A155824A-E561-4D20-AF75-2564ACD01AEF}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B0753ECF-E009-41B3-A096-3D100DC3A089}" = rport=139 | protocol=6 | dir=out | app=system |
"{BB0F6C10-7BBF-43D5-BC9A-F36921195688}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{BD5569AB-AD88-4B2E-B71F-F4F3D352AD90}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{BE21D6DC-56C8-41C7-8DD9-7A45A2991E20}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{C2A1504B-1B32-4F45-A300-439ED8984B16}" = lport=8182 | protocol=6 | dir=in | name=java(tm) platform se binary |
"{C82F944E-2F54-4600-86D1-1687038E180C}" = lport=139 | protocol=6 | dir=in | app=system |
"{D184196A-3DFC-41A7-9AE8-215F4810DEE7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D58C8CFA-696E-4AAB-BAFB-6AE16D7E8608}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{F6DA3474-D545-4D27-AE9C-56EFAB978F51}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{09BCB1A9-E9FC-4328-9321-450FC2F75AF8}" = dir=in | app=c:\program files\intel\wifi\bin\pandhcpdns.exe |
"{259087F3-C4A5-4685-987E-3AF60D2E0BE8}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{58523C97-7833-4CF2-9CF7-3933F5CDC5F8}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{5BACDE73-E88D-4B82-A7E0-24496322555C}" = dir=in | app=c:\program files (x86)\intel corporation\intel wireless display\widiapp.exe |
"{60D9AA61-C2E3-4EE8-9E80-ED61AB2A624C}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{6A687CAC-7FC0-45FE-B89D-2CA3FA94B5C4}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{76331D57-6B90-44DD-ACD2-B86C023A971F}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector\pdr.exe |
"{780C5F7B-DF24-497C-A3C2-17162799A101}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{7E073AC9-F1F7-4C6B-8645-105668DB6CB1}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd9\powerdvd9.exe |
"{830149EF-FB39-46ED-8246-D9354A9ADE6C}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{8F93CD7A-1E9F-4145-ACFC-64F9DB2EFB35}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{ADE872F1-0B47-4389-AB29-0CE21027BAD2}" = dir=in | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe |
"{BBFA1B1E-7C6A-454F-B907-34B4BF37A7CF}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{BDBCFC44-7B67-48FE-9BF8-3457ECC3A2AC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{EA656545-2D78-4E22-8582-7D1D1B002F9E}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{F1C893A0-935B-40A1-943F-9617F5BF7F02}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{F39B2D50-F3A1-4B97-9158-7B3006BACD96}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd9\powerdvd cinema\powerdvdcinema.exe |
"{F8021BBC-970B-4F98-9A90-AB68160E5923}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{13F4A7F3-EABC-4261-AF6B-1317777F0755}" = Fast Boot
"{1A8BA6CE-822D-4888-89E2-ACBF4308F271}" = Intel(R) PROSet/Wireless WiFi Software
"{3768263E-8BE8-4CEF-9463-6D36F731824B}" = Windows Live Family Safety
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5783F2D7-A001-0407-0102-0060B0CE6BBA}" = AutoCAD 2012 - Deutsch
"{5783F2D7-A001-0407-1102-0060B0CE6BBA}" = AutoCAD 2012 Language Pack - Deutsch
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{718D791F-F4E8-4aa7-98A6-15FDED17BDD0}" = Trend Micro Internet Security
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{91EFE3A1-585E-4F66-B5F6-F118F56C4C47}" = ASUS Power4Gear Hybrid
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9CF4A37B-A8C4-44D7-8C53-13B9D9594BB3}" = Paint.NET v3.5.8
"{9D2B0322-44AE-460E-9283-4D2D7A9205AE}" = Trend Micro Internet Security
"{C298FF86-AB23-4B58-AC53-A23383C07B3A}" = Intel(R) Wireless Display
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"AutoCAD 2012 - Deutsch" = AutoCAD 2012 - Deutsch
"CNXT_AUDIO_HDA" = Conexant HD Audio
"Elantech" = ETDWare PS/2-x64 7.0.5.13_WHQL
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"ProInst" = Intel PROSet Wireless
"USB2.0 UVC VGA WebCam" = USB2.0 UVC VGA WebCam
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{086F9A69-CD39-4893-A9FB-D3A0634CE3F7}" = Autodesk Content Service
"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = ASUS Video Magic
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}" = Wireless Console 3
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron Flash Media Controller Driver
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2B81872B-A054-48DA-BE3B-FA5C164C303A}" = ASUS FancyStart
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail
"{5B65EF64-1DFA-414A-8C94-7BB726158E21}" = ControlDeck
"{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}" = NB Probe
"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{65420DC9-306E-4371-905F-F4DC3B418E52}" = Autodesk Material Library Base Resolution Image Library 2012
"{6B77A7F6-DD63-4F13-A6FF-83137A5AC354}" = ASUS CopyProtect
"{6B96DADA-1A27-4A04-8CB2-CC45168D05FA}" = Windows Live Fotogalerie
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer
"{835686C5-8650-49EB-8CA0-4528B4035495}" = Windows Live Call
"{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}" = Windows Live Messenger
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8C1E2925-14F8-45AA-B999-1E2A74BF5607}" = Windows Live Sync
"{8F0837C2-EE09-4903-88F3-1976FE7FFF4E}" = Autodesk Material Library 2012
"{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{951B0F30-9F1A-4BF6-B3DA-99EB0E917B1C}" = FARO LS 1.1.406.58
"{96DCEE2F-98EE-4F80-8C0F-7C04D1FB9D7F}" = JMicron Ethernet Adapter NDIS Driver
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D48531D-2135-49FC-BC29-ACCDA5396A76}" = ASUS MultiFrame
"{9D6D7811-43B3-463C-BC79-5D1755269989}" = Net4Switch
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}" = ATK Package
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.4.6 MUI
"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar
"{B653A2EC-D816-4498-A4FD-651047AB9DC9}" = Boingo Wi-Fi
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BBED4F90-7AE5-40BF-AFB7-1B495692F4AB}" = syncables desktop SE
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"{D39F0676-163E-4595-A917-E28F99BBD4D2}" = ASUS AI Recovery
"{DF5F687F-8018-4542-9F98-7084E9022917}" = Windows Live Essentials
"{E3739848-5329-48E3-8D28-5BBD6E8BE384}" = CyberLink MediaShow Espresso
"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update
"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{FA2092C5-7979-412D-A962-6485274AE1EE}" = ASUS Data Security Manager
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ASUS WebStorage" = ASUS WebStorage
"Avira AntiVir Desktop" = Avira Free Antivirus
"Google Chrome" = Google Chrome
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = ASUS Video Magic
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}" = CyberLink MediaShow Espresso
"K_Series_ScreenSaver_EN" = K_Series_ScreenSaver_EN
"McAfee Security Scan" = McAfee Security Scan Plus
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"Opera 12.15.1748" = Opera 12.15
"Pontifex II" = Pontifex II
"VLC media player" = VLC media player 1.1.11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.20 (32-Bit)
"XSManager" = XSManager
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Game Organizer" = EasyBits GO
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 19.04.2013 18:36:16 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend
 micro\internet security\component\framework\200\UfNavi.exe".  Die abhängige Assemblierung
 "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 19.04.2013 18:36:16 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend
 micro\internet security\component\framework\200\UfSeAgnt.exe".  Die abhängige Assemblierung
 "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 19.04.2013 18:36:16 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend
 micro\internet security\component\framework\200\UfUpdUi.exe".  Die abhängige Assemblierung
 "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 19.04.2013 18:36:22 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files
 (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder
 Richtliniendatei "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe
 AIR.dll" in Zeile 3.  Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
 des "version"-Attributs im assemblyIdentity-Element ist ungültig.
 
Error - 22.04.2013 18:35:17 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend
 micro\internet security\component\framework\200\TisScan.exe".  Die abhängige Assemblierung
 "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 22.04.2013 18:35:18 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend
 micro\internet security\component\framework\200\UfLogUi.exe".  Die abhängige Assemblierung
 "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 22.04.2013 18:35:18 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend
 micro\internet security\component\framework\200\UfNavi.exe".  Die abhängige Assemblierung
 "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 22.04.2013 18:35:18 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend
 micro\internet security\component\framework\200\UfSeAgnt.exe".  Die abhängige Assemblierung
 "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 22.04.2013 18:35:18 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend
 micro\internet security\component\framework\200\UfUpdUi.exe".  Die abhängige Assemblierung
 "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 22.04.2013 18:35:26 | Computer Name = asuspro5if-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files
 (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder
 Richtliniendatei "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe
 AIR.dll" in Zeile 3.  Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
 des "version"-Attributs im assemblyIdentity-Element ist ungültig.
 
[ Media Center Events ]
Error - 06.01.2012 06:15:32 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 11:15:32 - Fehler beim Herstellen der Internetverbindung.  11:15:32
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 07.01.2012 05:01:17 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 10:01:17 - Fehler beim Herstellen der Internetverbindung.  10:01:17
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 08.01.2012 04:18:16 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 09:18:16 - Fehler beim Herstellen der Internetverbindung.  09:18:16
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 09.01.2012 02:32:12 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 07:32:12 - Fehler beim Herstellen der Internetverbindung.  07:32:12
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 10.01.2012 08:24:01 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 13:24:01 - Fehler beim Herstellen der Internetverbindung.  13:24:01
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 11.01.2012 04:47:28 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 09:47:27 - Fehler beim Herstellen der Internetverbindung.  09:47:28
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 12.01.2012 09:10:13 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 14:10:13 - Fehler beim Herstellen der Internetverbindung.  14:10:13
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 13.01.2012 20:29:42 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 01:29:42 - Fehler beim Herstellen der Internetverbindung.  01:29:42
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 14.01.2012 22:09:54 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 03:09:54 - Fehler beim Herstellen der Internetverbindung.  03:09:54
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 16.01.2012 00:01:26 | Computer Name = asuspro5if-PC | Source = MCUpdate | ID = 0
Description = 05:01:26 - Fehler beim Herstellen der Internetverbindung.  05:01:26
-    Serververbindung konnte nicht hergestellt werden.. 
 
[ System Events ]
Error - 09.03.2012 13:10:01 | Computer Name = asuspro5if-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 09.03.2012 13:10:01 | Computer Name = asuspro5if-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 09.03.2012 13:10:01 | Computer Name = asuspro5if-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 09.03.2012 13:10:01 | Computer Name = asuspro5if-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 09.03.2012 13:10:01 | Computer Name = asuspro5if-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 11.03.2012 11:58:31 | Computer Name = asuspro5if-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?11.?03.?2012 um 16:56:23 unerwartet heruntergefahren.
 
Error - 13.03.2012 06:30:51 | Computer Name = asuspro5if-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
 
Error - 13.03.2012 06:30:51 | Computer Name = asuspro5if-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
 
Error - 13.03.2012 06:30:52 | Computer Name = asuspro5if-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
 
Error - 13.03.2012 13:41:45 | Computer Name = asuspro5if-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Avira Browser Schutz" wurde unerwartet beendet. Dies ist
 bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden
 durchgeführt: Neustart des Diensts.
 
 
< End of report >
--- --- ---

smeenk 23.04.2013 17:48
Hallo haenaez

Fang erst mal an mit: http://www.trojaner-board.de/134076-...ml#post1051513

Ich werde mich mal deine OTL Logs anschauen :)

haenaez 23.04.2013 18:06
Log von zoeg.

Zoek.exe Version 4.0.0.2 Updated 23-04-2013
Tool run by asus pro 5if on 23.04.2013 at 18:46:54,07.
Microsoft Windows 7 Home Premium 6.1.7600 x64
Running in: Normal Mode Internet Access Detected

==== System Restore Info ======================

23.04.2013 18:49:28 Zoek.exe System Restore Point Created Succesfully.

==== Creating Sample__1851.zip ======================

Copied file C:\ProgramData\1329.exe to sample
Copied file C:\ProgramData\1911.exe to sample
Copied file C:\ProgramData\193F.exe to sample
Copied file C:\ProgramData\1E2E.exe to sample
Copied file C:\ProgramData\2A5D.exe to sample
Copied file C:\ProgramData\3554.exe to sample
Copied file C:\ProgramData\4542.exe to sample
Copied file C:\ProgramData\4597.exe to sample
Copied file C:\ProgramData\56CC.exe to sample
Copied file C:\ProgramData\5890.exe to sample
Copied file C:\ProgramData\5C57.exe to sample
Copied file C:\ProgramData\6184.exe to sample
Copied file C:\ProgramData\6CC9.exe to sample
Copied file C:\ProgramData\789A.exe to sample
Copied file C:\ProgramData\8750.exe to sample
Copied file C:\ProgramData\9707.exe to sample
Copied file C:\ProgramData\9773.exe to sample
Copied file C:\ProgramData\9D1E.exe to sample
Copied file C:\ProgramData\A46C.exe to sample
Copied file C:\ProgramData\AFB1.exe to sample
Copied file C:\ProgramData\BB25.exe to sample
Copied file C:\ProgramData\CB03.exe to sample
Copied file C:\ProgramData\cfeabdbcdabeesacfsfdsf.exe to sample
Copied file C:\ProgramData\D1E5.exe to sample
Copied file C:\ProgramData\DABA.exe to sample
Copied file C:\ProgramData\DB17.exe to sample
Copied file C:\ProgramData\E7E1.exe to sample
Copied file C:\ProgramData\F2F8.exe to sample
Copied file C:\ProgramData\F6DE.exe to sample
Copied file C:\ProgramData\FE5C.exe to sample
sample\1329.exe renamed to 032EE81F55C1F79D3F1301C718AC9E7E
sample\1911.exe renamed to 204744690AB96D6B8A0D050912708706
sample\193F.exe renamed to 405349F16464395CA50415611D5925C9
sample\1E2E.exe renamed to AF31910B2EE4827378BDF7A02ABE9581
sample\2A5D.exe renamed to AF31910B2EE4827378BDF7A02ABE9581
sample\3554.exe renamed to AF31910B2EE4827378BDF7A02ABE9581
sample\4542.exe renamed to AF31910B2EE4827378BDF7A02ABE9581
sample\4597.exe renamed to 204744690AB96D6B8A0D050912708706
sample\56CC.exe renamed to 73C42977AAA12ACB3BD7BD4B81263A94
sample\5890.exe renamed to 4F9BC60A0865F2CC82E32F66CD741B93
sample\5C57.exe renamed to 204744690AB96D6B8A0D050912708706
sample\6184.exe renamed to AF31910B2EE4827378BDF7A02ABE9581
sample\6CC9.exe renamed to AF31910B2EE4827378BDF7A02ABE9581
sample\789A.exe renamed to AF31910B2EE4827378BDF7A02ABE9581
sample\8750.exe renamed to 2FC116E32B4EAEA9D1E58E0B1D7B2587
sample\9707.exe renamed to 4D77B37BEDE83CD7B6F68E3E0BD015E6
sample\9773.exe renamed to AF31910B2EE4827378BDF7A02ABE9581
sample\9D1E.exe renamed to 204744690AB96D6B8A0D050912708706
sample\A46C.exe renamed to AF31910B2EE4827378BDF7A02ABE9581
sample\AFB1.exe renamed to AF31910B2EE4827378BDF7A02ABE9581
sample\BB25.exe renamed to AF31910B2EE4827378BDF7A02ABE9581
sample\CB03.exe renamed to F4DC17FD876B36BE5BE0776964F68858
sample\cfeabdbcdabeesacfsfdsf.exe renamed to 3536EB4749114F43EE7C2F777D9755D8
sample\D1E5.exe renamed to 4DA5BF4B3F8A5373D3750A300F8A3288
sample\DABA.exe renamed to A43437F7543F7917A91568A85078A2C2
sample\DB17.exe renamed to AF31910B2EE4827378BDF7A02ABE9581
sample\E7E1.exe renamed to AF31910B2EE4827378BDF7A02ABE9581
sample\F2F8.exe renamed to AF31910B2EE4827378BDF7A02ABE9581
sample\F6DE.exe renamed to BC9C255F13066B642A74564D62969F3E
sample\FE5C.exe renamed to AF31910B2EE4827378BDF7A02ABE9581

C:\Users\Public\Desktop\sample__1851.zip created successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Files \ Folders ======================

"C:\ProgramData\1329.exe" deleted
"C:\ProgramData\1911.exe" deleted
"C:\ProgramData\193F.exe" deleted
"C:\ProgramData\1E2E.exe" deleted
"C:\ProgramData\2A5D.exe" deleted
"C:\ProgramData\3554.exe" deleted
"C:\ProgramData\4542.exe" deleted
"C:\ProgramData\4597.exe" deleted
"C:\ProgramData\56CC.exe" deleted
"C:\ProgramData\5890.exe" deleted
"C:\ProgramData\5C57.exe" deleted
"C:\ProgramData\6184.exe" deleted
"C:\ProgramData\6CC9.exe" deleted
"C:\ProgramData\789A.exe" deleted
"C:\ProgramData\8750.exe" deleted
"C:\ProgramData\9707.exe" deleted
"C:\ProgramData\9773.exe" deleted
"C:\ProgramData\9D1E.exe" deleted
"C:\ProgramData\A46C.exe" deleted
"C:\ProgramData\AFB1.exe" deleted
"C:\ProgramData\BB25.exe" deleted
"C:\ProgramData\CB03.exe" deleted
"C:\ProgramData\cfeabdbcdabeesacfsfdsf.exe" deleted
"C:\ProgramData\D1E5.exe" deleted
"C:\ProgramData\DABA.exe" deleted
"C:\ProgramData\DB17.exe" deleted
"C:\ProgramData\E7E1.exe" deleted
"C:\ProgramData\F2F8.exe" deleted
"C:\ProgramData\F6DE.exe" deleted
"C:\ProgramData\FE5C.exe" deleted
"C:\Program Files (x86)\Ask.com\Updater\Updater.exe" deleted
"C:\Program Files (x86)\Ask.com" deleted
"C:\ProgramData\Partner" deleted
"C:\Users\asus pro 5if\AppData\Local\AskToolbar" deleted
"C:\Users\asus pro 5if\AppData\LocalLow\AskToolbar" deleted
"C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}" deleted
"C:\Program Files (x86)\Ask.com\Updater" deleted

==== Files Recently Created / Modified ======================

====== C:\Windows ====
====== C:\Users\ASUSPR~1\AppData\Local\Temp ====
2013-04-23 02:07:15 BC9C255F13066B642A74564D62969F3E 1156394 --sh--r- C:\Users\ASUSPR~1\AppData\Local\Temp\gkwyafijexvsxxp.exe
2013-04-22 18:27:52 F9BF3B996F36310815C286D87290C9E7 71680 ---ha-w- C:\Users\ASUSPR~1\AppData\Local\Temp\trqdswabbepsury.exe
====== C:\Windows\SysWOW64 =====
====== C:\Windows\SysWOW64\drivers =====
====== C:\Windows\Sysnative =====
====== C:\Windows\Sysnative\drivers =====
2013-04-22 19:23:39 490FA25161BF3E51993EB724ECF0ACEB 28600 ----a-w- C:\Windows\Sysnative\drivers\avkmgr.sys
2013-04-22 19:23:39 488486DAD09A5B6C6DBB8B990A8B2307 130016 ----a-w- C:\Windows\Sysnative\drivers\avipbb.sys
2013-04-22 19:23:39 09E6069EF94B345061B4BD3CEBD974C8 100712 ----a-w- C:\Windows\Sysnative\drivers\avgntflt.sys
====== C:\Windows\Tasks ======
====== C:\Windows\Temp ======
======= C:\Program Files =====
======= C:\Program Files (x86) =====
2013-04-22 19:23:32 -------- d-----w- C:\Program Files (x86)\Avira
2013-04-19 15:14:16 -------- d-----w- C:\Program Files (x86)\Common Files\Skype
======= C: =====
====== C:\Users\asus pro 5if\AppData\Roaming ======
2013-04-22 19:29:40 -------- d-----w- C:\users\asus pro 5if\AppData\Roaming\Avira
====== C:\Users\asus pro 5if ======
2013-04-23 15:23:20 D41D8CD98F00B204E9800998ECF8427E 0 ----a-w- C:\Users\asus pro 5if\defogger_reenable
2013-04-23 02:07:16 BC9C255F13066B642A74564D62969F3E 1156394 --sh--r- C:\Users\Public\sms.exe
2013-04-22 19:24:10 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2013-03-31 16:54:23 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

====== C: exe-files ==
2013-04-23 15:24:25 4ADCFEE16EE9978F06157634669D36FB 602112 ----a-w- C:\Users\asus pro 5if\Desktop\OTL.exe
2013-04-23 15:17:48 9146F21288AB749C4C729343F5F285A1 50477 ----a-w- C:\Users\asus pro 5if\Desktop\Defogger.exe
2013-04-23 12:08:44 BC9C255F13066B642A74564D62969F3E 1156394 ----a-w- C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6D3UTT97\brilliant[1].exe
2013-04-23 02:07:16 BC9C255F13066B642A74564D62969F3E 1156394 --sh--r- C:\Users\Public\sms.exe
2013-04-23 02:07:15 BC9C255F13066B642A74564D62969F3E 1156394 --sh--r- C:\Users\asus pro 5if\AppData\Local\Temp\gkwyafijexvsxxp.exe
2013-04-22 19:23:40 D9A92E6DD41C5ADC045AE485026AA40C 86752 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
2013-04-22 19:23:40 C67EBE5C9DA7462D2FF6394979D06EA2 91872 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\setuppending.exe
2013-04-22 19:23:40 81EC06B6E2B5492B07801D40EB14B628 87264 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\wsctool.exe
2013-04-22 19:23:40 7D9DA7DF9535859A4EFC16F69BFE4A8A 83680 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\ipmgui.exe
2013-04-22 19:23:40 715A90A0E5FC7F59DCD4C233ED492F4A 98544 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\licmgr.exe
2013-04-22 19:23:40 52577CD89C018C505EAAA23BFE2EC4AD 767200 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\setup.exe
2013-04-22 19:23:40 22DC787A09D2EC7E3F1138A26C41083C 46960 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\updrgui.exe
2013-04-22 19:23:40 1E2252D50AA9A0EB0E8B6B759329C21B 600288 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\update.exe
2013-04-22 19:23:40 12D4E394014C6A9EFB34D64AE4E64CE0 170864 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\inssda64.exe
2013-04-22 19:23:40 115E8B275EB47437B99D82EAD0096611 144096 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\guardgui.exe
2013-04-22 19:23:40 0267F39053F152F834127AAFF8C25417 454368 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\fact.exe
2013-04-22 19:23:39 EDAE538F742A20D0E4DBEAD2FA6136F2 58080 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avupgsvc.exe
2013-04-22 19:23:39 AD74CCA501DA08EF395E520D9C258F81 5655248 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\apntoolbarinstaller.exe
2013-04-22 19:23:39 93A912072351DFEF975F12EFAD18BD9F 145096 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\apnstub.exe
2013-04-22 19:23:39 84554FFDF324A863892527284FF6C091 181984 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avrestart.exe
2013-04-22 19:23:39 6F2974248B974B6DE037A6C682B59414 248032 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
2013-04-22 19:23:39 6920D1FAEA58A2526D7EA20F8D2349A5 330976 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
2013-04-22 19:23:39 66A7A38F7C439153B758548375EB9E5E 110816 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
2013-04-22 19:23:39 63A5363103A02C654209E686EAF7F723 84704 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avadmin.exe
2013-04-22 19:23:39 5A123AABB571AEA78AE63AF5E372F796 565472 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
2013-04-22 19:23:39 5A06D4AA070B80464A272D67FCC5D7AF 285408 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe
2013-04-22 19:23:39 505E37F4F60B3803116E2733A429D928 639712 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
2013-04-22 19:23:39 1DC531FEBA4778A73775E64590DBE053 426208 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avconfig.exe
2013-04-22 19:23:39 14D4F782EF8E75C0785A093BE10F8FC6 232672 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avwebloader.exe
2013-04-22 19:23:39 14855274B4E742D704909C8F32734BA9 165512 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avwsc.exe
2013-04-22 19:23:39 01A043A11C1058EB7FBAE4EC248C0065 345312 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
2013-04-22 19:06:40 4754539F6D178B84DE28DBCBE7CDA23A 2092792 ----a-w- C:\Users\asus pro 5if\Downloads\avira_free_antivirus (3).exe
2013-04-22 19:06:34 4754539F6D178B84DE28DBCBE7CDA23A 2092792 ----a-w- C:\Users\asus pro 5if\Downloads\avira_free_antivirus (2).exe
2013-04-22 19:06:32 4754539F6D178B84DE28DBCBE7CDA23A 2092792 ----a-w- C:\Users\asus pro 5if\Downloads\avira_free_antivirus (1).exe
2013-04-22 19:06:23 4754539F6D178B84DE28DBCBE7CDA23A 2092792 ----a-w- C:\Users\asus pro 5if\Downloads\avira_free_antivirus.exe
2013-04-22 18:27:52 F9BF3B996F36310815C286D87290C9E7 71680 ---ha-w- C:\Users\asus pro 5if\AppData\Local\Temp\trqdswabbepsury.exe
2013-04-19 16:16:57 F608E124FDC5E74A433F0B9675E5E9B5 1152168 ----a-w- C:\Windows\Temp\contentDATs.exe
2013-04-19 16:16:57 F608E124FDC5E74A433F0B9675E5E9B5 1152168 ----a-w- C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\contentDATs[1].exe
=== C: other files ==
2013-04-23 16:51:39 F67F808F196C071FCA662316BB93D36A 1476769 ----a-w- C:\Users\Public\Desktop\sample__1851.zip
2013-04-22 19:23:40 E310FCBA8884EEBD9017C3D01B6D0BCF 100680 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\sweb.zip
2013-04-22 19:23:39 490FA25161BF3E51993EB724ECF0ACEB 28600 ----a-w- C:\Windows\System32\drivers\avkmgr.sys
2013-04-22 19:23:39 490FA25161BF3E51993EB724ECF0ACEB 28600 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avkmgr.sys
2013-04-22 19:23:39 488486DAD09A5B6C6DBB8B990A8B2307 130016 ----a-w- C:\Windows\System32\drivers\avipbb.sys
2013-04-22 19:23:39 488486DAD09A5B6C6DBB8B990A8B2307 130016 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avipbb.sys
2013-04-22 19:23:39 09E6069EF94B345061B4BD3CEBD974C8 100712 ----a-w- C:\Windows\System32\drivers\avgntflt.sys
2013-04-22 19:23:39 09E6069EF94B345061B4BD3CEBD974C8 100712 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avgntflt.sys

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-21-4187337081-3060065340-850818916-1000\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
"Skype"="C:\Program Files (x86)\Skype\Phone\Skype.exe /minimized /regrun"
"Windows Messages Controler"="c:\users\public\sms.exe"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl9"="C:\Program Files (x86)\Cyberlink\PowerDVD9\PDVD9Serv.exe"
"UpdatePSTShortCut"="C:\Program Files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe C:\Program Files (x86)\Cyberlink\DVD Suite UpdateWithCreateOnce Software\CyberLink\PowerStarter"
"UpdateLBPShortCut"="C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe C:\Program Files (x86)\CyberLink\LabelPrint UpdateWithCreateOnce Software\CyberLink\LabelPrint\2.5"
"UpdateP2GoShortCut"="C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe C:\Program Files (x86)\CyberLink\Power2Go UpdateWithCreateOnce SOFTWARE\CyberLink\Power2Go\6.0"
"ATKMEDIA"="C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe"
"HControlUser"="C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe"
"Wireless Console 3"="C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe"
"ApnUpdater"="C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
"Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher"="C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"starter4g"="C:\Windows\starter4g.exe"
"avgnt"="C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe /min"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
"Skype"="C:\Program Files (x86)\Skype\Phone\Skype.exe /minimized /regrun"
"Windows Messages Controler"="c:\users\public\sms.exe"

==== Startup Registry Enabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUS WebStorage"="C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe"
"UfSeAgnt.exe"="C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
"IgfxTray"="C:\Windows\system32\igfxtray.exe"
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe"
"Persistence"="C:\Windows\system32\igfxpers.exe"
"SmartAudio"="C:\Program Files\CONEXANT\SAII\SAIICpl.exe /t"
"IntelWireless"="C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe /tf Intel Wireless Tray"
"ETDWare"="%ProgramFiles%\Elantech\ETDCtrl.exe "

==== Startup Registry Disabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe Reader Speed Launcher]
"command"="\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe\""
"hkey"="HKLM"
"item"="Adobe Reader Speed Launcher"
"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ADSMTray]
"command"="C:\\Program Files (x86)\\ASUS\\ASUS Data Security Manager\\ADSMTray.exe"
"hkey"="HKLM"
"item"="ADSMTray"
"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ASUS Screen Saver Protector]
"command"="C:\\Windows\\AsScrPro.exe"
"hkey"="HKLM"
"item"="ASUS Screen Saver Protector"
"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\CLMLServer]
"command"="\"C:\\Program Files (x86)\\CyberLink\\Power2Go\\CLMLSvc.exe\""
"hkey"="HKLM"
"item"="CLMLServer"
"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"


==== Startup Folders ======================

2010-10-12 19:44:51 2617 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FancyStart daemon.lnk
2013-04-19 15:15:24 2048 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
2010-10-12 19:30:37 2855 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SRS Premium Sound.lnk

==== Task Scheduler Jobs ======================

C:\Windows\tasks\Adobe Flash Player Updater.job --a------ C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [19.04.2013 17:15]
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [12.10.2010 21:13]
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [12.10.2010 21:13]
C:\Windows\tasks\Net4Switch.job --a------ C:\Program Files (x86)\ASUS\Net4Switch\Net4Switch.exe [23.09.2009 10:11]

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx[02.03.2012 11:53]

Skype Click to Call - asus pro 5if - Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"
{67A2568C-7A0A-4EED-AECC-B5405DE63B64} Google Url="hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-4187337081-3060065340-850818916-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully
HKEY_USERS\S-1-5-21-4187337081-3060065340-850818916-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully
HKEY_USERS\S-1-5-21-4187337081-3060065340-850818916-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully
HKEY_USERS\S-1-5-21-4187337081-3060065340-850818916-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully
HKEY_USERS\S-1-5-21-4187337081-3060065340-850818916-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully
HKEY_USERS\S-1-5-21-4187337081-3060065340-850818916-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully
HKEY_USERS\S-1-5-21-4187337081-3060065340-850818916-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5C255C8A-E604-49b4-9D64-90988571CECB} deleted successfully
HKEY_USERS\S-1-5-21-4187337081-3060065340-850818916-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} deleted successfully
HKEY_USERS\S-1-5-21-4187337081-3060065340-850818916-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-4187337081-3060065340-850818916-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully
HKEY_USERS\S-1-5-21-4187337081-3060065340-850818916-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Gast\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Gast\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\users\asus pro 5if\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

After Reboot

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\ASUSPR~1\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\asus pro 5if\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted
"C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted

smeenk 23.04.2013 19:28
Es ist eine Zip-datei erstellt worden: C:\Users\Public\Desktop\sample__1851.zip
Kannst Du diese Datei hier hochladen: daten-hoster.de - Daten kostenlos hochladen, speichern und teilen
Nachher bekommst du eine Link, poste diesen Link hier in dein nächstes Beitrag.



Öffne nochmal ZOEK und kopiere untenstehende Code in das Textfeld:

Code:
C:\Users\Public\sms.exe;f
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run];r
"ApnUpdater"=-;r
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run];r
"Windows Messages Controler"=-;r
filesrcm;
Drucke "Run Script".

Poste mir das Logfile ;)

haenaez 23.04.2013 19:49
Hier der Link der filehosting:

daten-hoster.de - Download-Seite für sample__1851.zip

Hier das Log-File:

Zoek.exe Version 4.0.0.2 Updated 23-04-2013
Tool run by asus pro 5if on 23.04.2013 at 20:35:57,98.
Microsoft Windows 7 Home Premium 6.1.7600 x64
Running in: Normal Mode Internet Access Detected

==== Older Logs ======================

C:\zoek-results23.04.2013-1859.log 24804 bytes

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ApnUpdater"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Messages Controler"=-

==== Deleting Files \ Folders ======================

"C:\Users\Public\sms.exe" deleted

==== Files Recently Created / Modified ======================

====== C:\Windows ====
====== C:\Users\ASUSPR~1\AppData\Local\Temp ====
====== C:\Windows\SysWOW64 =====
====== C:\Windows\SysWOW64\drivers =====
====== C:\Windows\Sysnative =====
====== C:\Windows\Sysnative\drivers =====
2013-04-22 19:23:39 490FA25161BF3E51993EB724ECF0ACEB 28600 ----a-w- C:\Windows\Sysnative\drivers\avkmgr.sys
2013-04-22 19:23:39 488486DAD09A5B6C6DBB8B990A8B2307 130016 ----a-w- C:\Windows\Sysnative\drivers\avipbb.sys
2013-04-22 19:23:39 09E6069EF94B345061B4BD3CEBD974C8 100712 ----a-w- C:\Windows\Sysnative\drivers\avgntflt.sys
====== C:\Windows\Tasks ======
====== C:\Windows\Temp ======
======= C:\Program Files =====
======= C:\Program Files (x86) =====
2013-04-22 19:23:32 -------- d-----w- C:\Program Files (x86)\Avira
2013-04-19 15:14:16 -------- d-----w- C:\Program Files (x86)\Common Files\Skype
======= C: =====
====== C:\Users\asus pro 5if\AppData\Roaming ======
2013-04-23 16:56:06 -------- d-----w- C:\users\asus pro 5if\AppData\Local\Temp
2013-04-22 19:29:40 -------- d-----w- C:\users\asus pro 5if\AppData\Roaming\Avira
====== C:\Users\asus pro 5if ======
2013-04-23 15:23:20 D41D8CD98F00B204E9800998ECF8427E 0 ----a-w- C:\Users\asus pro 5if\defogger_reenable
2013-04-22 19:24:10 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2013-03-31 16:54:23 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

====== C: exe-files ==
2013-04-23 15:24:25 4ADCFEE16EE9978F06157634669D36FB 602112 ----a-w- C:\Users\asus pro 5if\Desktop\OTL.exe
2013-04-23 15:17:48 9146F21288AB749C4C729343F5F285A1 50477 ----a-w- C:\Users\asus pro 5if\Desktop\Defogger.exe
2013-04-22 19:23:40 D9A92E6DD41C5ADC045AE485026AA40C 86752 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
2013-04-22 19:23:40 C67EBE5C9DA7462D2FF6394979D06EA2 91872 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\setuppending.exe
2013-04-22 19:23:40 81EC06B6E2B5492B07801D40EB14B628 87264 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\wsctool.exe
2013-04-22 19:23:40 7D9DA7DF9535859A4EFC16F69BFE4A8A 83680 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\ipmgui.exe
2013-04-22 19:23:40 715A90A0E5FC7F59DCD4C233ED492F4A 98544 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\licmgr.exe
2013-04-22 19:23:40 52577CD89C018C505EAAA23BFE2EC4AD 767200 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\setup.exe
2013-04-22 19:23:40 22DC787A09D2EC7E3F1138A26C41083C 46960 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\updrgui.exe
2013-04-22 19:23:40 1E2252D50AA9A0EB0E8B6B759329C21B 600288 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\update.exe
2013-04-22 19:23:40 12D4E394014C6A9EFB34D64AE4E64CE0 170864 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\inssda64.exe
2013-04-22 19:23:40 115E8B275EB47437B99D82EAD0096611 144096 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\guardgui.exe
2013-04-22 19:23:40 0267F39053F152F834127AAFF8C25417 454368 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\fact.exe
2013-04-22 19:23:39 EDAE538F742A20D0E4DBEAD2FA6136F2 58080 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avupgsvc.exe
2013-04-22 19:23:39 AD74CCA501DA08EF395E520D9C258F81 5655248 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\apntoolbarinstaller.exe
2013-04-22 19:23:39 93A912072351DFEF975F12EFAD18BD9F 145096 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\apnstub.exe
2013-04-22 19:23:39 84554FFDF324A863892527284FF6C091 181984 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avrestart.exe
2013-04-22 19:23:39 6F2974248B974B6DE037A6C682B59414 248032 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
2013-04-22 19:23:39 6920D1FAEA58A2526D7EA20F8D2349A5 330976 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
2013-04-22 19:23:39 66A7A38F7C439153B758548375EB9E5E 110816 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
2013-04-22 19:23:39 63A5363103A02C654209E686EAF7F723 84704 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avadmin.exe
2013-04-22 19:23:39 5A123AABB571AEA78AE63AF5E372F796 565472 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
2013-04-22 19:23:39 5A06D4AA070B80464A272D67FCC5D7AF 285408 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe
2013-04-22 19:23:39 505E37F4F60B3803116E2733A429D928 639712 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
2013-04-22 19:23:39 1DC531FEBA4778A73775E64590DBE053 426208 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avconfig.exe
2013-04-22 19:23:39 14D4F782EF8E75C0785A093BE10F8FC6 232672 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avwebloader.exe
2013-04-22 19:23:39 14855274B4E742D704909C8F32734BA9 165512 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avwsc.exe
2013-04-22 19:23:39 01A043A11C1058EB7FBAE4EC248C0065 345312 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
2013-04-22 19:06:40 4754539F6D178B84DE28DBCBE7CDA23A 2092792 ----a-w- C:\Users\asus pro 5if\Downloads\avira_free_antivirus (3).exe
2013-04-22 19:06:34 4754539F6D178B84DE28DBCBE7CDA23A 2092792 ----a-w- C:\Users\asus pro 5if\Downloads\avira_free_antivirus (2).exe
2013-04-22 19:06:32 4754539F6D178B84DE28DBCBE7CDA23A 2092792 ----a-w- C:\Users\asus pro 5if\Downloads\avira_free_antivirus (1).exe
2013-04-22 19:06:23 4754539F6D178B84DE28DBCBE7CDA23A 2092792 ----a-w- C:\Users\asus pro 5if\Downloads\avira_free_antivirus.exe
=== C: other files ==
2013-04-23 16:51:39 F67F808F196C071FCA662316BB93D36A 1476769 ----a-w- C:\Users\Public\Desktop\sample__1851.zip
2013-04-22 19:23:40 E310FCBA8884EEBD9017C3D01B6D0BCF 100680 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\sweb.zip
2013-04-22 19:23:39 490FA25161BF3E51993EB724ECF0ACEB 28600 ----a-w- C:\Windows\System32\drivers\avkmgr.sys
2013-04-22 19:23:39 490FA25161BF3E51993EB724ECF0ACEB 28600 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avkmgr.sys
2013-04-22 19:23:39 488486DAD09A5B6C6DBB8B990A8B2307 130016 ----a-w- C:\Windows\System32\drivers\avipbb.sys
2013-04-22 19:23:39 488486DAD09A5B6C6DBB8B990A8B2307 130016 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avipbb.sys
2013-04-22 19:23:39 09E6069EF94B345061B4BD3CEBD974C8 100712 ----a-w- C:\Windows\System32\drivers\avgntflt.sys
2013-04-22 19:23:39 09E6069EF94B345061B4BD3CEBD974C8 100712 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avgntflt.sys

smeenk 23.04.2013 20:02
Zitat:
Zitat von haenaez (Beitrag 1051582)
Hier der Link der filehosting:

daten-hoster.de - Download-Seite für sample__1851.zip
Leider ist der link nicht Klickbar
Es sollte ungefähr so aussehen:
Code:
http://daten-hoster.de/????
Merkst Du momentan noch einige Probleme?

haenaez 23.04.2013 20:07
Hello smeenk.

Ich probiers nochmal:

daten-hoster.de - Download-Seite für sample__1851.zip

Und nein ich habe momentan keine Probleme mehr.

daten-hoster.de - Download-Seite für sample__1851.zip

smeenk 23.04.2013 20:11
Leider kann ich mich der Zip-datei nicht runterladen, weil es kein Link ist :(

Ich melde mich wieder, zuerst Kaffee trinken ;)

haenaez 23.04.2013 20:12
Hi smeenk.

Irgendwie funktioniert das mit dem Linke net.
Leider weiß ich nicht warum.
Ich mache mall nach dem http ein Leerzeichen mit rein.

http ://www.daten-hoster.de/file/details/430933/sample__1851.zip

smeenk 23.04.2013 20:48
Zitat:
Zitat von haenaez (Beitrag 1051599)
Hello smeenk.

Ich probiers nochmal:

daten-hoster.de - Download-Seite für sample__1851.zip

Und nein ich habe momentan keine Probleme mehr.

daten-hoster.de - Download-Seite für sample__1851.zip
Vielleicht wird den Link durch das Board-software geändert.

Versuch es mal mit Code-Tags: [code] der link hier [/code]

haenaez 23.04.2013 20:52
Code:
hxxp://www.daten-hoster.de/file/details/430933/sample__1851.zip

smeenk 23.04.2013 21:02
Grossartig, dein letzter Versuch hat geklappt :abklatsch:

Öffne nochmal ZOEK und kopiere untenstehende Code in das Textfeld:

Code:
C:\Windows\SysNative\drivers\etc\tmvsthfud.bin;f
C:\Windows\SysNative\drivers\etc\tmvsthfss.bin;f
C:\Users\Public\Desktop\sample__1851.zip;f
Drucke "Run Script".

Poste mir das neue Log von Zoek.

Lass dein virenscanner nochmal scannen um zu sehen ob der noch etwas findet ;)


Alle Zeitangaben in WEZ +1. Es ist jetzt 17:02 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131