Trojaner o.ä. über Facebook eingefangen
 

Hallo liebes Trojaner-Board-Team,

ich habe mir wohl einen Trojaner oder ähnliches über Facebook eingefangen und da ich mir scheinbar nicht selber helfen kann, wende ich mich nun an euch. Der Trojaner verbreitet sich über Facebook schneeballsystemartig, indem er Gruppeneinladung verschickt und zu einer Browsererweiterung verleitet, welche vermutlich eine Schadsoftware enthält. Diese habe ich mir wohl in einem unachtsamen Moment installiert. Ich habe zahlreiche verschiedene Antivirenprogramme durchlaufen lassen, es konnte aber nichts gefunden werden, nur Antivir hat einen Fund gemeldet.

Exportierte Ereignisse:

10.06.2013 17:43 [System-Scanner] Malware gefunden
Die Datei 'C:\Users\Mothership\AppData\Local\Temp\5G3doOjT.exe.part'
enthielt einen Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen' [adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '56e559e4.qua'
verschoben!

Klare Symtome, wie z.b. dubiose Umleitungen etc., kann ich aber nicht benennen.

Ich habe eine Loganalyse nach Anleitung gemacht:

OTL logfile created on: 11.06.2013 11:35:34 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = D:\Downloads
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 0,92 Gb Available Physical Memory | 46,02% Memory free
4,00 Gb Paging File | 2,58 Gb Available in Paging File | 64,52% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 29,30 Gb Total Space | 3,70 Gb Free Space | 12,62% Space Free | Partition Type: NTFS
Drive D: | 82,49 Gb Total Space | 14,15 Gb Free Space | 17,16% Space Free | Partition Type: NTFS
Drive E: | 3,73 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

Computer Name: MOTHERSHIP-PC | User Name: Mothership | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013.06.11 11:24:09 | 000,602,112 | ---- | M] (OldTimer Tools) -- D:\Downloads\OTL.exe
PRC - [2013.06.11 11:22:20 | 000,050,477 | ---- | M] () -- D:\Downloads\Defogger.exe
PRC - [2013.06.10 14:49:20 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2013.06.10 14:48:22 | 000,562,744 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe
PRC - [2013.06.10 14:48:19 | 000,079,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2013.06.10 14:48:12 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2013.06.10 14:48:11 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.05.27 00:28:05 | 000,920,472 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2013.05.25 02:47:30 | 027,776,968 | ---- | M] (Dropbox, Inc.) -- C:\Users\Mothership\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.05.09 10:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastUI.exe
PRC - [2013.05.04 02:01:59 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2013.04.30 12:04:48 | 001,185,872 | ---- | M] (CallingID Ltd.) -- C:\Programme\Ask.com\CallingIDSDK\CIDGlobalLight.exe
PRC - [2013.04.30 12:03:00 | 001,648,264 | ---- | M] (Ask) -- C:\Programme\Ask.com\Updater\Updater.exe
PRC - [2013.03.20 15:38:50 | 000,162,856 | ---- | M] (Geek Software GmbH) -- C:\Programme\PDF24\pdf24.exe
PRC - [2012.11.30 04:55:25 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 14:17:41 | 001,174,016 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2010.10.19 19:34:26 | 003,791,872 | ---- | M] (Native Instruments GmbH) -- C:\Programme\Common Files\Native Instruments\Hardware\NIHardwareService.exe
PRC - [2007.01.11 04:02:00 | 000,113,664 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE


========== Modules (No Company Name) ==========

MOD - [2013.06.11 11:22:20 | 000,050,477 | ---- | M] () -- D:\Downloads\Defogger.exe
MOD - [2013.05.27 00:28:05 | 003,128,728 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll
MOD - [2013.03.13 22:48:52 | 024,978,944 | ---- | M] () -- C:\Users\Mothership\AppData\Roaming\Dropbox\bin\libcef.dll
MOD - [2012.11.14 01:32:50 | 003,558,400 | ---- | M] () -- C:\Users\Mothership\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll
MOD - [2012.02.20 21:29:04 | 000,087,912 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012.02.20 21:28:42 | 001,242,472 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010.03.15 11:28:22 | 000,141,824 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll


========== Services (SafeList) ==========

SRV - [2013.06.10 14:49:20 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.06.10 14:48:22 | 000,562,744 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService)
SRV - [2013.06.10 14:48:12 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2013.05.27 00:28:05 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.05.15 10:41:33 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.02.28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013.01.06 17:27:11 | 000,040,960 | ---- | M] () [Auto | Stopped] -- C:\Users\Mothership\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe -- (SearchAnonymizer)
SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.10.19 19:34:26 | 003,791,872 | ---- | M] (Native Instruments GmbH) [Auto | Running] -- C:\Programme\Common Files\Native Instruments\Hardware\NIHardwareService.exe -- (NIHardwareService)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.01.11 04:02:00 | 000,113,664 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE -- (EPSON_PM_RPCV4_01)
SRV - [2006.10.26 19:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)


========== Driver Services (SafeList) ==========

DRV - [2013.06.10 14:49:57 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2013.06.10 14:49:56 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2013.06.10 14:49:56 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2013.06.10 14:49:56 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2012.08.23 16:44:32 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2012.08.23 16:40:25 | 000,049,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2012.05.21 04:09:00 | 000,181,432 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm)
DRV - [2012.05.21 04:09:00 | 000,080,824 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus)
DRV - [2012.01.18 06:44:52 | 004,332,960 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC)
DRV - [2012.01.18 06:44:28 | 000,312,096 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2012.01.09 18:59:32 | 000,468,272 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\System32\drivers\klif.sys -- (KLIF)
DRV - [2012.01.09 18:59:30 | 000,133,208 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\kl1.sys -- (KL1)
DRV - [2012.01.09 18:59:30 | 000,011,352 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\System32\drivers\kl2.sys -- (kl2)
DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2009.10.30 13:44:28 | 000,399,424 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rldjif2u.sys -- (RL_DJIFIE2_USB)
DRV - [2009.10.30 13:44:26 | 000,039,488 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rldjif2a.sys -- (RL_DJIFIE2_WDM)
DRV - [2009.10.30 13:44:24 | 000,030,784 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rldjif2m.sys -- (RL_DJIFIE2_MIDI)
DRV - [2009.07.14 01:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\serial.sys -- (Serial)
DRV - [2009.07.14 00:13:45 | 001,068,032 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32)
DRV - [2006.12.10 14:47:00 | 004,445,120 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.zonealarm.com/?Source=Homepage&oemCode=ZLN27411605806974-1001&toolbarId=base&affiliateId=1025&Lan=de&utid=62f97eff0000000000000019d24a8b3e
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 16 01 C3 AF 33 43 CD 01 [binary data]
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826464F524D3D4945385352 43&st={searchTerms}&clid=18e79530-8358-4382-bf03-23860a403c7f&pid=fotofreeware&k=0
IE - HKCU\..\SearchScopes\{0C9873AC-1757-440D-8D88-1393B5172F0E}: "URL" = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=18e79530-8358-4382-bf03-23860a403c7f&pid=fotofreeware&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{3B9197ED-BD29-41A6-8E53-4CD5E024BEAF}: "URL" = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=18e79530-8358-4382-bf03-23860a403c7f&pid=fotofreeware&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{41BE9CBB-0DCF-48A7-9668-5BCFF5259B20}: "URL" = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=18e79530-8358-4382-bf03-23860a403c7f&pid=fotofreeware&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{5ED95C19-8E54-463D-B426-324BA6499635}: "URL" = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=18e79530-8358-4382-bf03-23860a403c7f&pid=fotofreeware&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{606E4978-3F19-41FB-9A0A-F768B06A07E7}: "URL" = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=18e79530-8358-4382-bf03-23860a403c7f&pid=fotofreeware&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{A56BD767-C982-4D61-AB7E-E4D2018FABEE}: "URL" = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=18e79530-8358-4382-bf03-23860a403c7f&pid=fotofreeware&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{EADC7EE9-3FDE-43FB-9BF4-0C142C9CC6C4}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=8e3e7b12-cd24-42fa-a964-cbf78a28a59a&apn_sauid=97FD2C56-FF47-4BC1-A179-FD02B863A6EB
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programm\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.05.29 11:31:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\extension@preispilot.com: C:\Users\Mothership\AppData\Roaming\Mozilla\Firefox\Profiles\di786wvb.default\extensions\extension@preispilot.com
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.05.29 11:31:37 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2013.05.27 00:28:07 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions
[2013.05.27 00:28:07 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [Ocs_SM] C:\Users\Mothership\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS)
O4 - HKLM..\Run: [PDFPrint] C:\Programme\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKCU..\Run: [EPSON Stylus DX7400 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE (SEIKO EPSON CORPORATION)
O4 - Startup: C:\Users\Mothership\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Mothership\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: PokerStars.eu - {07BA1DA9-F501-4796-8728-74D1B91A6CD5} - C:\Programme\PokerStars.EU\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{26BC9CD2-F583-4867-89A9-80B0959143A3}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013.06.10 18:15:18 | 000,000,000 | ---D | C] -- C:\Windows\rescache
[2013.06.10 15:11:24 | 000,229,648 | ---- | C] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2013.06.10 15:09:34 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2013.06.10 15:07:55 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2013.06.10 14:55:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2013.06.10 14:54:52 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
[2013.06.10 14:54:28 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2013.06.10 14:54:27 | 000,135,136 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avipbb.sys
[2013.06.10 14:54:27 | 000,084,744 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avgntflt.sys
[2013.06.10 14:54:27 | 000,037,352 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avkmgr.sys
[2013.06.10 14:54:07 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2013.06.08 13:59:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.06.08 13:59:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.06.08 13:58:59 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013.06.08 13:58:58 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013.05.29 12:15:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013.05.29 12:14:31 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013.05.29 12:14:30 | 000,000,000 | ---D | C] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2013.05.29 11:31:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2013.05.29 11:31:05 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2013.05.27 00:27:54 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013.06.11 11:41:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.06.11 11:22:41 | 000,000,000 | ---- | M] () -- C:\Users\Mothership\defogger_reenable
[2013.06.11 10:43:42 | 000,014,752 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.11 10:43:42 | 000,014,752 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.11 10:31:00 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.10 22:07:54 | 1609,179,136 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.10 15:11:25 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2013.06.10 14:55:07 | 000,002,012 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.06.10 14:49:57 | 000,028,520 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2013.06.10 14:49:56 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avipbb.sys
[2013.06.10 14:49:56 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avgntflt.sys
[2013.06.10 14:49:56 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avkmgr.sys
[2013.06.08 13:59:06 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.06.06 10:47:31 | 000,001,059 | ---- | M] () -- C:\Users\Mothership\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.06.06 10:47:14 | 000,001,037 | ---- | M] () -- C:\Users\Mothership\Desktop\Dropbox.lnk
[2013.06.05 11:33:44 | 000,000,000 | ---- | M] () -- C:\Windows\System32\drivers\lvuvc.hs
[2013.05.29 17:36:56 | 000,013,386 | ---- | M] () -- C:\Windows\System32\cc_20130529_173635.reg
[2013.05.29 16:44:49 | 001,854,376 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.05.29 16:44:49 | 000,513,378 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.05.29 16:44:49 | 000,299,952 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.05.29 16:44:49 | 000,037,816 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.05.29 12:15:31 | 000,001,535 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2013.05.29 11:31:18 | 000,001,815 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2013.05.16 11:06:35 | 000,309,544 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013.06.11 11:22:41 | 000,000,000 | ---- | C] () -- C:\Users\Mothership\defogger_reenable
[2013.06.10 14:55:07 | 000,002,012 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.06.08 13:59:06 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.05.29 17:36:45 | 000,013,386 | ---- | C] () -- C:\Windows\System32\cc_20130529_173635.reg
[2013.05.29 12:15:31 | 000,001,535 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2013.05.29 11:31:17 | 000,001,815 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2013.05.02 12:16:50 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2013.02.12 22:46:23 | 000,079,360 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2013.01.11 00:16:05 | 000,007,604 | ---- | C] () -- C:\Users\Mothership\AppData\Local\Resmon.ResmonCfg
[2013.01.06 17:29:52 | 000,019,553 | ---- | C] () -- C:\Windows\hpqins13.dat
[2013.01.06 17:27:24 | 000,338,432 | ---- | C] () -- C:\Windows\System32\sqlite36_engine.dll
[2012.09.24 21:38:51 | 000,175,616 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2012.09.19 17:03:24 | 000,111,932 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat
[2012.09.19 17:03:24 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat
[2012.09.19 17:03:24 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat
[2012.09.19 17:03:24 | 000,026,154 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat
[2012.09.19 17:03:24 | 000,024,903 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat
[2012.09.19 17:03:24 | 000,021,390 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat
[2012.09.19 17:03:24 | 000,020,148 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat
[2012.09.19 17:03:24 | 000,011,811 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat
[2012.09.19 17:03:24 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat
[2012.09.19 17:03:24 | 000,001,146 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_DU.dat
[2012.09.19 17:03:24 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat
[2012.09.19 17:03:24 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat
[2012.09.19 17:03:24 | 000,001,136 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat
[2012.09.19 17:03:24 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat
[2012.09.19 17:03:24 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat
[2012.09.19 17:03:24 | 000,001,120 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_IT.dat
[2012.09.19 17:03:24 | 000,001,107 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_GE.dat
[2012.09.19 17:03:24 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat
[2012.09.19 17:03:24 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2012.06.26 23:49:44 | 000,006,656 | ---- | C] () -- C:\Users\Mothership\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.06.05 17:26:32 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2012.01.18 06:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll
[2012.01.18 06:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll
[2012.01.18 06:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe
[2012.01.18 06:22:54 | 000,028,418 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini

========== ZeroAccess Check ==========

[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========


========== Purity Check ==========



< End of report >




Zweites Log:




OTL Extras logfile created on: 11.06.2013 11:35:35 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = D:\Downloads
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 0,92 Gb Available Physical Memory | 46,02% Memory free
4,00 Gb Paging File | 2,58 Gb Available in Paging File | 64,52% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 29,30 Gb Total Space | 3,70 Gb Free Space | 12,62% Space Free | Partition Type: NTFS
Drive D: | 82,49 Gb Total Space | 14,15 Gb Free Space | 17,16% Space Free | Partition Type: NTFS
Drive E: | 3,73 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

Computer Name: MOTHERSHIP-PC | User Name: Mothership | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1231C90A-2363-4139-B84F-3A47E1AE7782}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1701976C-B577-4952-8F2C-561A61E03905}" = lport=2869 | protocol=6 | dir=in | app=system |
"{1D4CC4CA-0D4B-43B0-AD48-451DC35B2889}" = rport=138 | protocol=17 | dir=out | app=system |
"{1ED78D7F-92AF-44AF-BBDE-9D5C9354697B}" = lport=10243 | protocol=6 | dir=in | app=system |
"{2815F5BD-CB60-480C-9A8A-2BF2A9364E4E}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{29BBBBD4-28C5-4486-9A31-BC4ACB9A67CE}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2C84C9A1-E6DF-45D4-8364-21C6D5404D9A}" = lport=139 | protocol=6 | dir=in | app=system |
"{32A6CFE2-243B-4C40-A15A-DF40374E3402}" = lport=138 | protocol=17 | dir=in | app=system |
"{3A477834-69E5-4808-885A-8CEC77127489}" = rport=10243 | protocol=6 | dir=out | app=system |
"{53BA9454-21BF-427E-83D3-8310E8A74A6D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{65DEF3AF-9A5F-4B73-8894-C7F20BB4E6A4}" = rport=137 | protocol=17 | dir=out | app=system |
"{65ECC847-BBF3-488C-B751-636D13E4683B}" = rport=445 | protocol=6 | dir=out | app=system |
"{662FBECE-4B2C-4DA0-968F-037CD034089E}" = lport=445 | protocol=6 | dir=in | app=system |
"{6FB0FF43-66A1-4D3B-9F13-151720D556E2}" = rport=139 | protocol=6 | dir=out | app=system |
"{72D9B467-4F89-4F01-A9CE-65594BE861AB}" = lport=137 | protocol=17 | dir=in | app=system |
"{7668B17D-4580-42D2-BF2E-D865E9CE8FE1}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7B42040A-0C94-4155-BCAB-1002860F3602}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{84BA3DDF-6EAC-4217-BC34-90EEBF576723}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8EEA1C2E-C109-46EF-A97D-A6BA03F6C7C5}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A68F9916-9BEA-4C0C-AF00-14B3B3954B9D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A6FCA4ED-337C-42F5-AD54-6C941A124511}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{C506A3F2-9F9B-4DA9-9989-A8522EA8D441}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{EF318D1F-0C64-46FF-8697-FA2068406AA8}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00397A3B-3A7D-494E-B02D-909A29896674}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{09264416-ED54-4569-9077-DAA622FA5696}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{0FBA3D52-3B31-4432-AB52-8F355F0F3B50}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{14EFC7BF-FF55-4B98-8771-E5B39D4AD6E2}" = protocol=17 | dir=in | app=c:\users\mothership\appdata\roaming\dropbox\bin\dropbox.exe |
"{1552B5E3-D809-4FB2-8341-5D458C7A3AB4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{2183E4AC-C62E-44E7-A549-234FA8E30F67}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{259343EB-F235-4734-A770-5730063DFC8E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{358CD64C-BDA7-42F0-B152-D2BE0DD75F85}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{387A51CA-E1AE-4448-9987-D41B62C791FD}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3EC91718-E26D-4402-B0CE-A2982D6ADEC6}" = protocol=6 | dir=in | app=c:\windows\system32\msiexec.exe |
"{4A504F6E-EE7F-4D5D-9379-CFFC1A8EF6C0}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{4DA35E0B-6631-4844-B8C5-82D6D8FC7777}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{558B4A79-F3C5-4A50-BCAC-0398ACF2BAF7}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe |
"{98095B58-679B-47F5-9890-437B7C21482E}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{9DE03E2B-6950-441B-AEF3-4E95A4D5DD33}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{9E110E30-8520-445F-9481-256B412568DF}" = protocol=17 | dir=in | app=d:\game\coh gold\reliccoh.exe |
"{9F48B3C8-44AE-498C-9B00-FFA5311C7397}" = protocol=6 | dir=in | app=d:\game\coh gold\relicdownloader\relicdownloader.exe |
"{9FC6FD74-55CF-47F7-A949-A161C2C506DA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{9FFC8F92-CC6E-4396-8EA2-9A47599E7373}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{A2D661A5-3F70-49AB-A7AB-45F5634C92DB}" = protocol=6 | dir=in | app=d:\game\coh gold\reliccoh.exe |
"{B2C9A51A-18C7-4EF4-94CD-C147D9B08B15}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{BDE3B1C3-3A54-4D88-AD1B-7F5AA7EFA77A}" = protocol=6 | dir=in | app=c:\users\mothership\appdata\roaming\dropbox\bin\dropbox.exe |
"{CA76AF02-D11B-4AA5-BDF2-30C0BB7D0B0D}" = protocol=17 | dir=in | app=d:\game\coh gold\relicdownloader\relicdownloader.exe |
"{CB1BBF24-20D7-43BB-93EC-D329F9B411D3}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{CB3A8916-4811-4B31-B88B-8B21ACC8674D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{D6DC7BEA-9C1C-4DA2-AF09-B11B9F165F1F}" = protocol=17 | dir=in | app=c:\windows\system32\msiexec.exe |
"{E582A099-0FD0-401C-8E4B-0CA77CBFB07E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E881DF2F-19B8-40F5-938F-F26D352B10E0}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe |
"{F0FBD4E6-3107-4E45-80CA-7CED7FD235D5}" = dir=in | app=d:\programm\itunes\itunes.exe |
"{F663DA6F-9181-4ADD-9D0D-3354E225AFB3}" = protocol=6 | dir=out | app=system |
"{F9BFC443-9009-481E-821E-CFEC1C2534E8}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0886900B-B2F3-452C-B580-60F1253F7F80}" = Native Instruments Controller Editor
"{0B8565BA-BAD5-4732-B122-5FD78EFC50A9}" = Native Instruments Service Center
"{0D8E6567-7082-48DB-A305-293873AC8B39}_is1" = Preispilot für Firefox
"{11E568E0-3244-4BCB-875E-F334269DFDCB}" = iTunes
"{14574B7F-75D1-4718-B7F2-EBF6E2862A35}" = Company of Heroes - FAKEMSI
"{14DC0059-00F1-4F62-BD1A-AB23CD51A95E}" = Adobe AIR
"{199E6632-EB28-4F73-AECB-3E192EB92D18}" = Company of Heroes - FAKEMSI
"{25724802-CC14-4B90-9F3B-3D6955EE27B1}" = Company of Heroes - FAKEMSI
"{2AAC4085-DCBF-417B-AEBD-182197839240}" = Native Instruments Traktor
"{32C4A4EB-C97D-414E-99C5-38F8DFD31D5D}" = Company of Heroes - FAKEMSI
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{50193078-F553-4EBA-AA77-64C9FAA12F98}" = Company of Heroes - FAKEMSI
"{51D718D1-DA81-4FAD-919F-5C1CE3C33379}" = Company of Heroes - FAKEMSI
"{53652DA6-AD2D-4B0F-80BA-6F3CFE2B48D7}" = ZoneAlarm Security
"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
"{66F78C51-D108-4F0C-A93C-1CBE74CE338F}" = Company of Heroes - FAKEMSI
"{6ADCBB79-7B9A-449B-AE31-E1C7116042B9}" = ZoneAlarm Firewall
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74852D78-260B-0612-89EE-D414414CFF60}" = GameFly
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7F4B1592-222F-4E5F-A100-E5AFD61A0BB3}" = Company of Heroes - FAKEMSI
"{80D03817-7943-4839-8E96-B9F924C5E67D}" = Company of Heroes - FAKEMSI
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 5.4.0
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{90120000-0016-0000-0000-0000000FF1CE}" = Microsoft Office Excel 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0000-0000-0000000FF1CE}" = Microsoft Office PowerPoint 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-001B-0000-0000-0000000FF1CE}" = Microsoft Office Word 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{925F1DB6-E86E-4378-9091-D1F68B0583C9}" = iCloud
"{97E5205F-EA4F-438F-B211-F1846419F1C1}" = Company of Heroes - FAKEMSI
"{99A7722D-9ACB-43F3-A222-ABC7133F159E}" = Company of Heroes - FAKEMSI
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A048F6D6-BECE-D521-9BC9-B8806BFB118C}" = Beatport Downloader
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.7) - Deutsch
"{AD32654E-90CF-42F2-8CB3-88DA6F1AA11A}" = ZoneAlarm Security
"{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime
"{BA801B94-C28D-46EE-B806-E1E021A3D519}" = Company of Heroes - FAKEMSI
"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D4D244D1-05E0-4D24-86A2-B2433C435671}" = Company of Heroes - FAKEMSI
"{DC996B67-77AB-4392-A0D3-BA998CA10916}_is1" = Easy Video Cutter 2.3
"{E14ADE0E-75F3-4A46-87E5-26692DD626EC}" = Apple Mobile Device Support
"{E25ED28D-3F3F-4707-8DFA-66CA75FB9329}" = ZoneAlarm Firewall
"{EAF636A9-F664-4703-A659-85A894DA264F}" = Company of Heroes - FAKEMSI
"{F012A635-8E2C-4AF2-BD46-C508D00289B2}" = ZoneAlarm Antivirus
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"1ClickDownload" = HDVidCodec
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"AviSynth" = AviSynth 2.5
"CCleaner" = CCleaner
"com.beatport.BeatportDownloader" = Beatport Downloader
"Company of Heroes" = Company of Heroes
"DesktopIconAmazon" = Desktop Icon für Amazon
"Eastern Front" = Eastern Front
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"EXCEL" = Microsoft Office Excel 2007
"ffdshow_is1" = ffdshow v1.2.4422 [2012-04-09]
"GameFly" = GameFly
"KLiteCodecPack_is1" = K-Lite Codec Pack 7.1.0 (Basic)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"Mendeley Desktop" = Mendeley Desktop 1.5.2
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"MozBackup" = MozBackup 1.5.1
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Native Instruments Controller Editor" = Native Instruments Controller Editor
"Native Instruments Service Center" = Native Instruments Service Center
"Native Instruments Traktor" = Native Instruments Traktor
"NVIDIA Drivers" = NVIDIA Drivers
"Panzer Corps1.03" = Panzer Corps
"PartyPoker" = PartyPoker
"PokerStars.eu" = PokerStars.eu
"POWERPOINT" = Microsoft Office PowerPoint 2007
"SearchAnonymizer" = SearchAnonymizer
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TreeSize Free_is1" = TreeSize Free V2.7
"USB_AUDIO_DEusb-audio.deRLDJIF2" = Digital Jockey - IE2
"VLC media player" = VLC media player 2.0.3
"WaveLabPro" = WaveLab 6
"WinRAR archiver" = WinRAR
"WORD" = Microsoft Office Word 2007
"ZoneAlarm LTD Toolbar" = ZoneAlarm LTD Toolbar

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Avira SearchFree Toolbar plus Web Protection Updater
"Dropbox" = Dropbox

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 08.06.2013 07:53:06 | Computer Name = Mothership-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 63366436

Error - 08.06.2013 07:53:06 | Computer Name = Mothership-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 63366436

Error - 10.06.2013 11:00:19 | Computer Name = Mothership-PC | Source = ESENT | ID = 486
Description = Windows (2708) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0002A.log"
nach "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSStmp.log" zu
verschieben, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die
Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen.
Fehler -1032 (0xfffffbf8) beim Verschieben von Dateien.

Error - 10.06.2013 11:00:19 | Computer Name = Mothership-PC | Source = ESENT | ID = 413
Description = Windows (2708) Windows: Neue Protokolldatei konnte nicht erstellt
werden, weil die Datenbank nicht auf das Protokolllaufwerk schreiben kann. Das Laufwerk
ist möglicherweise schreibgeschützt, falsch konfiguriert, beschädigt oder hat zu
wenig freien Speicherplatz. Fehler -1032.

Error - 10.06.2013 11:00:19 | Computer Name = Mothership-PC | Source = ESENT | ID = 492
Description = Windows (2708) Windows: Die Protokolldatei-Reihenfolge in "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\"
wurde durch einen schwerwiegenden Fehler angehalten. Für die Datenbank, die diese
Protokolldatei-Reihenfolge verwendet, sind keine weiteren Aktualisierungen möglich.
Bitte korrigieren Sie das Problem, und starten Sie erneut, oder führen Sie eine
Wiederherstellung aus einer Sicherung durch.

Error - 10.06.2013 13:10:04 | Computer Name = Mothership-PC | Source = Windows Search Service | ID = 7040
Description =

Error - 10.06.2013 13:10:04 | Computer Name = Mothership-PC | Source = Windows Search Service | ID = 7042
Description =

Error - 10.06.2013 13:10:05 | Computer Name = Mothership-PC | Source = ESENT | ID = 104
Description = Windows (2708) Windows: Das Datenbankmodul hat die Instanz (0) mit
dem Fehler (-510) beendet.

Error - 11.06.2013 04:30:56 | Computer Name = Mothership-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 11.06.2013 04:30:57 | Computer Name = Mothership-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 43129644

Error - 11.06.2013 04:30:57 | Computer Name = Mothership-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 43129644

[ OSession Events ]
Error - 19.01.2013 09:58:41 | Computer Name = Mothership-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 869
seconds with 180 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 07.01.2013 14:12:18 | Computer Name = Mothership-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst Netman erreicht.

Error - 07.01.2013 15:02:56 | Computer Name = Mothership-PC | Source = BROWSER | ID = 8032
Description =

Error - 08.01.2013 04:31:49 | Computer Name = Mothership-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?08.?01.?2013 um 09:28:20 unerwartet heruntergefahren.

Error - 08.01.2013 14:40:47 | Computer Name = Mothership-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?08.?01.?2013 um 19:39:09 unerwartet heruntergefahren.

Error - 08.01.2013 17:50:07 | Computer Name = Mothership-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error - 09.01.2013 17:16:36 | Computer Name = Mothership-PC | Source = BROWSER | ID = 8032
Description =

Error - 09.01.2013 18:01:08 | Computer Name = Mothership-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error - 10.01.2013 18:21:59 | Computer Name = Mothership-PC | Source = DCOM | ID = 10010
Description =

Error - 10.01.2013 19:00:32 | Computer Name = Mothership-PC | Source = BROWSER | ID = 8032
Description =

Error - 13.01.2013 02:13:05 | Computer Name = Mothership-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.


< End of report >


Die Anlayse mit Gmer führte zu einem Systemabsturz.


Kann mir bitte jemand helfen.

MFG

hi
hast du mal den Link zur erweiterung, als private Nachicht?

Den Link zur firefox erweiterung? dazu müsste ich die facebook gruppe suchen und die videoverlinkung verfolgen und dann geht der ganze spaß von vorne los, dass meine komplette freundesliste einladung erhält usw. Eine andere Möglichkeit fällt mir nicht ein, den Link zu finden.

Aber einen Link mit möglicherweise hilfreichen Informationen hab ich gefunden und dir geschickt.

is das ne öffendlich verfügbare fb gruppe? dann köntest du mir den Link zu der als private nachicht sendenb

Ich habe den Gruppennamen gegoogelt und dir dazu vorhin einen Link geschickt. Hast du den erhalten?

hi, schaun wir mal weiter.
Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop

• Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
• Drücke Start Scan
  
• Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
  TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
  Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

OK, hier also das Ergebniss:

20:23:59.0189 4988 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
20:23:59.0517 4988 ============================================================
20:23:59.0517 4988 Current date / time: 2013/06/11 20:23:59.0517
20:23:59.0517 4988 SystemInfo:
20:23:59.0517 4988
20:23:59.0517 4988 OS Version: 6.1.7601 ServicePack: 1.0
20:23:59.0517 4988 Product type: Workstation
20:23:59.0517 4988 ComputerName: MOTHERSHIP-PC
20:23:59.0517 4988 UserName: Mothership
20:23:59.0517 4988 Windows directory: C:\Windows
20:23:59.0517 4988 System windows directory: C:\Windows
20:23:59.0517 4988 Processor architecture: Intel x86
20:23:59.0517 4988 Number of processors: 2
20:23:59.0517 4988 Page size: 0x1000
20:23:59.0517 4988 Boot type: Normal boot
20:23:59.0517 4988 ============================================================
20:24:00.0843 4988 Drive \Device\Harddisk0\DR0 - Size: 0x1BF2975E00 (111.79 Gb), SectorSize: 0x200, Cylinders: 0x3901, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
20:24:00.0890 4988 ============================================================
20:24:00.0890 4988 \Device\Harddisk0\DR0:
20:24:00.0890 4988 MBR partitions:
20:24:00.0890 4988 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x3A98000
20:24:00.0890 4988 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x3A98800, BlocksNum 0xA4FB000
20:24:00.0890 4988 ============================================================
20:24:00.0937 4988 C: <-> \Device\Harddisk0\DR0\Partition1
20:24:00.0968 4988 D: <-> \Device\Harddisk0\DR0\Partition2
20:24:00.0968 4988 ============================================================
20:24:00.0968 4988 Initialize success
20:24:00.0968 4988 ============================================================
20:25:16.0441 5772 ============================================================
20:25:16.0441 5772 Scan started
20:25:16.0441 5772 Mode: Manual; SigCheck; TDLFS;
20:25:16.0441 5772 ============================================================
20:25:17.0034 5772 ================ Scan system memory ========================
20:25:17.0034 5772 System memory - ok
20:25:17.0034 5772 ================ Scan services =============================
20:25:17.0283 5772 [ 1B133875B8AA8AC48969BD3458AFE9F5 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
20:25:17.0502 5772 1394ohci - ok
20:25:17.0564 5772 [ CEA80C80BED809AA0DA6FEBC04733349 ] ACPI C:\Windows\system32\drivers\ACPI.sys
20:25:17.0611 5772 ACPI - ok
20:25:17.0658 5772 [ 1EFBC664ABFF416D1D07DB115DCB264F ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
20:25:17.0782 5772 AcpiPmi - ok
20:25:17.0907 5772 [ ADDA5E1951B90D3D23C56D3CF0622ADC ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
20:25:17.0938 5772 AdobeARMservice - ok
20:25:18.0032 5772 [ F040037B149FD0F5A5044AE563390FA7 ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
20:25:18.0063 5772 AdobeFlashPlayerUpdateSvc - ok
20:25:18.0141 5772 [ 21E785EBD7DC90A06391141AAC7892FB ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
20:25:18.0188 5772 adp94xx - ok
20:25:18.0313 5772 [ 0C676BC278D5B59FF5ABD57BBE9123F2 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
20:25:18.0344 5772 adpahci - ok
20:25:18.0375 5772 [ 7C7B5EE4B7B822EC85321FE23A27DB33 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
20:25:18.0391 5772 adpu320 - ok
20:25:18.0422 5772 [ 8B5EEFEEC1E6D1A72A06C526628AD161 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
20:25:18.0469 5772 AeLookupSvc - ok
20:25:18.0531 5772 [ 9EBBBA55060F786F0FCAA3893BFA2806 ] AFD C:\Windows\system32\drivers\afd.sys
20:25:18.0609 5772 AFD - ok
20:25:18.0640 5772 [ 507812C3054C21CEF746B6EE3D04DD6E ] agp440 C:\Windows\system32\drivers\agp440.sys
20:25:18.0656 5772 agp440 - ok
20:25:18.0718 5772 [ 8B30250D573A8F6B4BD23195160D8707 ] aic78xx C:\Windows\system32\DRIVERS\djsvs.sys
20:25:18.0734 5772 aic78xx - ok
20:25:18.0781 5772 [ 18A54E132947CD98FEA9ACCC57F98F13 ] ALG C:\Windows\System32\alg.exe
20:25:18.0828 5772 ALG - ok
20:25:18.0859 5772 [ 0D40BCF52EA90FC7DF2AEAB6503DEA44 ] aliide C:\Windows\system32\drivers\aliide.sys
20:25:18.0874 5772 aliide - ok
20:25:18.0890 5772 [ 3C6600A0696E90A463771C7422E23AB5 ] amdagp C:\Windows\system32\drivers\amdagp.sys
20:25:18.0921 5772 amdagp - ok
20:25:18.0952 5772 [ CD5914170297126B6266860198D1D4F0 ] amdide C:\Windows\system32\drivers\amdide.sys
20:25:18.0968 5772 amdide - ok
20:25:19.0015 5772 [ 00DDA200D71BAC534BF56A9DB5DFD666 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
20:25:19.0062 5772 AmdK8 - ok
20:25:19.0077 5772 [ 3CBF30F5370FDA40DD3E87DF38EA53B6 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
20:25:19.0124 5772 AmdPPM - ok
20:25:19.0171 5772 [ D320BF87125326F996D4904FE24300FC ] amdsata C:\Windows\system32\drivers\amdsata.sys
20:25:19.0202 5772 amdsata - ok
20:25:19.0233 5772 [ EA43AF0C423FF267355F74E7A53BDABA ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
20:25:19.0249 5772 amdsbs - ok
20:25:19.0264 5772 [ 46387FB17B086D16DEA267D5BE23A2F2 ] amdxata C:\Windows\system32\drivers\amdxata.sys
20:25:19.0296 5772 amdxata - ok
20:25:19.0405 5772 [ D9A92E6DD41C5ADC045AE485026AA40C ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe
20:25:19.0436 5772 AntiVirSchedulerService - ok
20:25:19.0498 5772 [ 66A7A38F7C439153B758548375EB9E5E ] AntiVirService C:\Program Files\Avira\AntiVir Desktop\avguard.exe
20:25:19.0514 5772 AntiVirService - ok
20:25:19.0608 5772 [ 9EDAE2D1CA368E8D01BEE8BFBC9488E4 ] AntiVirWebService C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
20:25:19.0670 5772 AntiVirWebService - ok
20:25:19.0717 5772 [ AEA177F783E20150ACE5383EE368DA19 ] AppID C:\Windows\system32\drivers\appid.sys
20:25:19.0920 5772 AppID - ok
20:25:19.0966 5772 [ 62A9C86CB6085E20DB4823E4E97826F5 ] AppIDSvc C:\Windows\System32\appidsvc.dll
20:25:20.0029 5772 AppIDSvc - ok
20:25:20.0076 5772 [ EACFDF31921F51C097629F1F3C9129B4 ] Appinfo C:\Windows\System32\appinfo.dll
20:25:20.0169 5772 Appinfo - ok
20:25:20.0294 5772 [ 4FE5C6D40664AE07BE5105874357D2ED ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
20:25:20.0325 5772 Apple Mobile Device - ok
20:25:20.0372 5772 [ A45D184DF6A8803DA13A0B329517A64A ] AppMgmt C:\Windows\System32\appmgmts.dll
20:25:20.0450 5772 AppMgmt - ok
20:25:20.0497 5772 [ 2932004F49677BD84DBC72EDB754FFB3 ] arc C:\Windows\system32\DRIVERS\arc.sys
20:25:20.0528 5772 arc - ok
20:25:20.0544 5772 [ 5D6F36C46FD283AE1B57BD2E9FEB0BC7 ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
20:25:20.0559 5772 arcsas - ok
20:25:20.0606 5772 [ ADD2ADE1C2B285AB8378D2DAAF991481 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
20:25:20.0793 5772 AsyncMac - ok
20:25:20.0856 5772 [ 338C86357871C167A96AB976519BF59E ] atapi C:\Windows\system32\drivers\atapi.sys
20:25:20.0887 5772 atapi - ok
20:25:20.0949 5772 [ CE3B4E731638D2EF62FCB419BE0D39F0 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
20:25:21.0043 5772 AudioEndpointBuilder - ok
20:25:21.0074 5772 [ CE3B4E731638D2EF62FCB419BE0D39F0 ] Audiosrv C:\Windows\System32\Audiosrv.dll
20:25:21.0121 5772 Audiosrv - ok
20:25:21.0168 5772 [ 87425709A251386064C99B684BF96F72 ] avgntflt C:\Windows\system32\DRIVERS\avgntflt.sys
20:25:21.0199 5772 avgntflt - ok
20:25:21.0246 5772 [ D50FBA68163BC498F2C136E0E5BA8E2F ] avipbb C:\Windows\system32\DRIVERS\avipbb.sys
20:25:21.0261 5772 avipbb - ok
20:25:21.0308 5772 [ CB8741CD7B126499FED40C9B197F6AC5 ] avkmgr C:\Windows\system32\DRIVERS\avkmgr.sys
20:25:21.0324 5772 avkmgr - ok
20:25:21.0370 5772 [ 6E30D02AAC9CAC84F421622E3A2F6178 ] AxInstSV C:\Windows\System32\AxInstSV.dll
20:25:21.0495 5772 AxInstSV - ok
20:25:21.0542 5772 [ 1A231ABEC60FD316EC54C66715543CEC ] b06bdrv C:\Windows\system32\DRIVERS\bxvbdx.sys
20:25:21.0604 5772 b06bdrv - ok
20:25:21.0636 5772 [ BD8869EB9CDE6BBE4508D869929869EE ] b57nd60x C:\Windows\system32\DRIVERS\b57nd60x.sys
20:25:21.0682 5772 b57nd60x - ok
20:25:21.0745 5772 [ EE1E9C3BB8228AE423DD38DB69128E71 ] BDESVC C:\Windows\System32\bdesvc.dll
20:25:21.0838 5772 BDESVC - ok
20:25:21.0854 5772 [ 505506526A9D467307B3C393DEDAF858 ] Beep C:\Windows\system32\drivers\Beep.sys
20:25:21.0901 5772 Beep - ok
20:25:21.0948 5772 [ 1E2BAC209D184BB851E1A187D8A29136 ] BFE C:\Windows\System32\bfe.dll
20:25:22.0010 5772 BFE - ok
20:25:22.0072 5772 [ E585445D5021971FAE10393F0F1C3961 ] BITS C:\Windows\System32\qmgr.dll
20:25:22.0182 5772 BITS - ok
20:25:22.0197 5772 [ 2287078ED48FCFC477B05B20CF38F36F ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
20:25:22.0244 5772 blbdrive - ok
20:25:22.0322 5772 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
20:25:22.0353 5772 Bonjour Service - ok
20:25:22.0384 5772 [ 8F2DA3028D5FCBD1A060A3DE64CD6506 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
20:25:22.0431 5772 bowser - ok
20:25:22.0462 5772 [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
20:25:22.0603 5772 BrFiltLo - ok
20:25:22.0618 5772 [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
20:25:22.0650 5772 BrFiltUp - ok
20:25:22.0712 5772 [ 3DAA727B5B0A45039B0E1C9A211B8400 ] Browser C:\Windows\System32\browser.dll
20:25:22.0790 5772 Browser - ok
20:25:22.0821 5772 [ 845B8CE732E67F3B4133164868C666EA ] Brserid C:\Windows\System32\Drivers\Brserid.sys
20:25:22.0884 5772 Brserid - ok
20:25:22.0899 5772 [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
20:25:22.0946 5772 BrSerWdm - ok
20:25:22.0962 5772 [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
20:25:22.0993 5772 BrUsbMdm - ok
20:25:23.0024 5772 [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
20:25:23.0055 5772 BrUsbSer - ok
20:25:23.0102 5772 [ 2865A5C8E98C70C605F417908CEBB3A4 ] BthEnum C:\Windows\system32\drivers\BthEnum.sys
20:25:23.0258 5772 BthEnum - ok
20:25:23.0274 5772 [ ED3DF7C56CE0084EB2034432FC56565A ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
20:25:23.0320 5772 BTHMODEM - ok
20:25:23.0352 5772 [ AD1872E5829E8A2C3B5B4B641C3EAB0E ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys
20:25:23.0383 5772 BthPan - ok
20:25:23.0430 5772 [ 1153DE2E4F5941E10C399CB5592F78A1 ] BTHPORT C:\Windows\System32\Drivers\BTHport.sys
20:25:23.0523 5772 BTHPORT - ok
20:25:23.0570 5772 [ 1DF19C96EEF6C29D1C3E1A8678E07190 ] bthserv C:\Windows\system32\bthserv.dll
20:25:23.0601 5772 bthserv - ok
20:25:23.0648 5772 [ C81E9413A25A439F436B1D4B6A0CF9E9 ] BTHUSB C:\Windows\System32\Drivers\BTHUSB.sys
20:25:23.0679 5772 BTHUSB - ok
20:25:23.0726 5772 [ 77EA11B065E0A8AB902D78145CA51E10 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
20:25:23.0773 5772 cdfs - ok
20:25:23.0835 5772 [ BE167ED0FDB9C1FA1133953C18D5A6C9 ] cdrom C:\Windows\system32\drivers\cdrom.sys
20:25:23.0882 5772 cdrom - ok
20:25:23.0944 5772 [ 319C6B309773D063541D01DF8AC6F55F ] CertPropSvc C:\Windows\System32\certprop.dll
20:25:24.0038 5772 CertPropSvc - ok
20:25:24.0069 5772 [ 3FE3FE94A34DF6FB06E6418D0F6A0060 ] circlass C:\Windows\system32\DRIVERS\circlass.sys
20:25:24.0100 5772 circlass - ok
20:25:24.0132 5772 [ 635181E0E9BBF16871BF5380D71DB02D ] CLFS C:\Windows\system32\CLFS.sys
20:25:24.0147 5772 CLFS - ok
20:25:24.0225 5772 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:25:24.0303 5772 clr_optimization_v2.0.50727_32 - ok
20:25:24.0397 5772 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:25:24.0506 5772 clr_optimization_v4.0.30319_32 - ok
20:25:24.0553 5772 [ DEA805815E587DAD1DD2C502220B5616 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
20:25:24.0600 5772 CmBatt - ok
20:25:24.0646 5772 [ C537B1DB64D495B9B4717B4D6D9EDBF2 ] cmdide C:\Windows\system32\drivers\cmdide.sys
20:25:24.0662 5772 cmdide - ok
20:25:24.0709 5772 [ 42F158036BD4C2FF3122BF142E60E6FD ] CNG C:\Windows\system32\Drivers\cng.sys
20:25:24.0756 5772 CNG - ok
20:25:24.0787 5772 [ A6023D3823C37043986713F118A89BEE ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
20:25:24.0802 5772 Compbatt - ok
20:25:24.0865 5772 [ CBE8C58A8579CFE5FCCF809E6F114E89 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
20:25:24.0958 5772 CompositeBus - ok
20:25:24.0974 5772 COMSysApp - ok
20:25:25.0005 5772 [ 2C4EBCFC84A9B44F209DFF6C6E6C61D1 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
20:25:25.0021 5772 crcdisk - ok
20:25:25.0068 5772 [ 96C0E38905CFD788313BE8E11DAE3F2F ] CryptSvc C:\Windows\system32\cryptsvc.dll
20:25:25.0146 5772 CryptSvc - ok
20:25:25.0208 5772 [ 3C2177A897B4CA2788C6FB0C3FD81D4B ] CSC C:\Windows\system32\drivers\csc.sys
20:25:25.0270 5772 CSC - ok
20:25:25.0333 5772 [ 15F93B37F6801943360D9EB42485D5D3 ] CscService C:\Windows\System32\cscsvc.dll
20:25:25.0442 5772 CscService - ok
20:25:25.0473 5772 [ 7660F01D3B38ACA1747E397D21D790AF ] DcomLaunch C:\Windows\system32\rpcss.dll
20:25:25.0536 5772 DcomLaunch - ok
20:25:25.0567 5772 [ 8D6E10A2D9A5EED59562D9B82CF804E1 ] defragsvc C:\Windows\System32\defragsvc.dll
20:25:25.0629 5772 defragsvc - ok
20:25:25.0676 5772 [ F024449C97EC1E464AAFFDA18593DB88 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
20:25:25.0723 5772 DfsC - ok
20:25:25.0770 5772 [ F9F31A9F2A8C0DD0CEB6E380BF0985D4 ] dg_ssudbus C:\Windows\system32\DRIVERS\ssudbus.sys
20:25:25.0801 5772 dg_ssudbus - ok
20:25:25.0863 5772 [ E9E01EB683C132F7FA27CD607B8A2B63 ] Dhcp C:\Windows\system32\dhcpcore.dll
20:25:25.0910 5772 Dhcp - ok
20:25:25.0941 5772 [ 1A050B0274BFB3890703D490F330C0DA ] discache C:\Windows\system32\drivers\discache.sys
20:25:25.0988 5772 discache - ok
20:25:26.0019 5772 [ 565003F326F99802E68CA78F2A68E9FF ] Disk C:\Windows\system32\DRIVERS\disk.sys
20:25:26.0035 5772 Disk - ok
20:25:26.0082 5772 [ 33EF4861F19A0736B11314AAD9AE28D0 ] Dnscache C:\Windows\System32\dnsrslvr.dll
20:25:26.0113 5772 Dnscache - ok
20:25:26.0160 5772 [ 366BA8FB4B7BB7435E3B9EACB3843F67 ] dot3svc C:\Windows\System32\dot3svc.dll
20:25:26.0269 5772 dot3svc - ok
20:25:26.0316 5772 [ 8EC04CA86F1D68DA9E11952EB85973D6 ] DPS C:\Windows\system32\dps.dll
20:25:26.0378 5772 DPS - ok
20:25:26.0409 5772 [ B918E7C5F9BF77202F89E1A9539F2EB4 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
20:25:26.0472 5772 drmkaud - ok
20:25:26.0518 5772 [ 16498EBC04AE9DD07049A8884B205C05 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
20:25:26.0581 5772 DXGKrnl - ok
20:25:26.0628 5772 [ 8600142FA91C1B96367D3300AD0F3F3A ] EapHost C:\Windows\System32\eapsvc.dll
20:25:26.0674 5772 EapHost - ok
20:25:26.0815 5772 [ 024E1B5CAC09731E4D868E64DBFB4AB0 ] ebdrv C:\Windows\system32\DRIVERS\evbdx.sys
20:25:26.0986 5772 ebdrv - ok
20:25:27.0033 5772 [ 81951F51E318AECC2D68559E47485CC4 ] EFS C:\Windows\System32\lsass.exe
20:25:27.0111 5772 EFS - ok
20:25:27.0174 5772 [ A8C362018EFC87BEB013EE28F29C0863 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
20:25:27.0283 5772 ehRecvr - ok
20:25:27.0298 5772 [ D389BFF34F80CAEDE417BF9D1507996A ] ehSched C:\Windows\ehome\ehsched.exe
20:25:27.0408 5772 ehSched - ok
20:25:27.0454 5772 [ 0ED67910C8C326796FAA00B2BF6D9D3C ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
20:25:27.0501 5772 elxstor - ok
20:25:27.0579 5772 [ 8FE6AB59CAB8F2C038FEA9522A5EEBA7 ] EPSON_PM_RPCV4_01 C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
20:25:27.0642 5772 EPSON_PM_RPCV4_01 - ok
20:25:27.0673 5772 [ 8FC3208352DD3912C94367A206AB3F11 ] ErrDev C:\Windows\system32\drivers\errdev.sys
20:25:27.0720 5772 ErrDev - ok
20:25:27.0782 5772 [ F6916EFC29D9953D5D0DF06882AE8E16 ] EventSystem C:\Windows\system32\es.dll
20:25:27.0844 5772 EventSystem - ok
20:25:27.0860 5772 [ 2DC9108D74081149CC8B651D3A26207F ] exfat C:\Windows\system32\drivers\exfat.sys
20:25:27.0922 5772 exfat - ok
20:25:27.0938 5772 [ 7E0AB74553476622FB6AE36F73D97D35 ] fastfat C:\Windows\system32\drivers\fastfat.sys
20:25:27.0985 5772 fastfat - ok
20:25:28.0047 5772 [ 967EA5B213E9984CBE270205DF37755B ] Fax C:\Windows\system32\fxssvc.exe
20:25:28.0125 5772 Fax - ok
20:25:28.0156 5772 [ E817A017F82DF2A1F8CFDBDA29388B29 ] fdc C:\Windows\system32\DRIVERS\fdc.sys
20:25:28.0203 5772 fdc - ok
20:25:28.0234 5772 [ F3222C893BD2F5821A0179E5C71E88FB ] fdPHost C:\Windows\system32\fdPHost.dll
20:25:28.0281 5772 fdPHost - ok
20:25:28.0312 5772 [ 7DBE8CBFE79EFBDEB98C9FB08D3A9A5B ] FDResPub C:\Windows\system32\fdrespub.dll
20:25:28.0390 5772 FDResPub - ok
20:25:28.0406 5772 [ 6CF00369C97F3CF563BE99BE983D13D8 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
20:25:28.0437 5772 FileInfo - ok
20:25:28.0453 5772 [ 42C51DC94C91DA21CB9196EB64C45DB9 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
20:25:28.0515 5772 Filetrace - ok
20:25:28.0531 5772 [ 87907AA70CB3C56600F1C2FB8841579B ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
20:25:28.0578 5772 flpydisk - ok
20:25:28.0624 5772 [ 7520EC808E0C35E0EE6F841294316653 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
20:25:28.0656 5772 FltMgr - ok
20:25:28.0734 5772 [ E12C4928B32ACE04610259647F072635 ] FontCache C:\Windows\system32\FntCache.dll
20:25:28.0843 5772 FontCache - ok
20:25:28.0905 5772 [ E56F39F6B7FDA0AC77A79B0FD3DE1A2F ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
20:25:29.0014 5772 FontCache3.0.0.0 - ok
20:25:29.0046 5772 [ 1A16B57943853E598CFF37FE2B8CBF1D ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
20:25:29.0061 5772 FsDepends - ok
20:25:29.0108 5772 [ 7DAE5EBCC80E45D3253F4923DC424D05 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
20:25:29.0124 5772 Fs_Rec - ok
20:25:29.0186 5772 [ E306A24D9694C724FA2491278BF50FDB ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
20:25:29.0217 5772 fvevol - ok
20:25:29.0233 5772 [ 65EE0C7A58B65E74AE05637418153938 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
20:25:29.0264 5772 gagp30kx - ok
20:25:29.0295 5772 [ 185ADA973B5020655CEE342059A86CBB ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
20:25:29.0326 5772 GEARAspiWDM - ok
20:25:29.0404 5772 [ E897EAF5ED6BA41E081060C9B447A673 ] gpsvc C:\Windows\System32\gpsvc.dll
20:25:29.0529 5772 gpsvc - ok
20:25:29.0545 5772 [ C44E3C2BAB6837DB337DDEE7544736DB ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
20:25:29.0592 5772 hcw85cir - ok
20:25:29.0654 5772 [ A5EF29D5315111C80A5C1ABAD14C8972 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
20:25:29.0732 5772 HdAudAddService - ok
20:25:29.0763 5772 [ 9036377B8A6C15DC2EEC53E489D159B5 ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
20:25:29.0794 5772 HDAudBus - ok
20:25:29.0810 5772 [ 1D58A7F3E11A9731D0EAAAA8405ACC36 ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
20:25:29.0857 5772 HidBatt - ok
20:25:29.0888 5772 [ 89448F40E6DF260C206A193A4683BA78 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
20:25:29.0919 5772 HidBth - ok
20:25:29.0950 5772 [ CF50B4CF4A4F229B9F3C08351F99CA5E ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
20:25:30.0013 5772 HidIr - ok
20:25:30.0060 5772 [ 2BC6F6A1992B3A77F5F41432CA6B3B6B ] hidserv C:\Windows\system32\hidserv.dll
20:25:30.0106 5772 hidserv - ok
20:25:30.0153 5772 [ 10C19F8290891AF023EAEC0832E1EB4D ] HidUsb C:\Windows\system32\drivers\hidusb.sys
20:25:30.0184 5772 HidUsb - ok
20:25:30.0216 5772 [ 196B4E3F4CCCC24AF836CE58FACBB699 ] hkmsvc C:\Windows\system32\kmsvc.dll
20:25:30.0278 5772 hkmsvc - ok
20:25:30.0325 5772 [ 6658F4404DE03D75FE3BA09F7ABA6A30 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
20:25:30.0387 5772 HomeGroupListener - ok
20:25:30.0434 5772 [ DBC02D918FFF1CAD628ACBE0C0EAA8E8 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
20:25:30.0512 5772 HomeGroupProvider - ok
20:25:30.0543 5772 [ 295FDC419039090EB8B49FFDBB374549 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
20:25:30.0574 5772 HpSAMD - ok
20:25:30.0637 5772 [ 871917B07A141BFF43D76D8844D48106 ] HTTP C:\Windows\system32\drivers\HTTP.sys
20:25:30.0730 5772 HTTP - ok
20:25:30.0777 5772 [ 0C4E035C7F105F1299258C90886C64C5 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
20:25:30.0793 5772 hwpolicy - ok
20:25:30.0840 5772 [ F151F0BDC47F4A28B1B20A0818EA36D6 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys
20:25:30.0871 5772 i8042prt - ok
20:25:30.0918 5772 [ 5CD5F9A5444E6CDCB0AC89BD62D8B76E ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
20:25:30.0949 5772 iaStorV - ok
20:25:31.0042 5772 [ C521D7EB6497BB1AF6AFA89E322FB43C ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
20:25:31.0261 5772 idsvc - ok
20:25:31.0292 5772 [ 4173FF5708F3236CF25195FECD742915 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
20:25:31.0308 5772 iirsp - ok
20:25:31.0370 5772 [ F95622F161474511B8D80D6B093AA610 ] IKEEXT C:\Windows\System32\ikeext.dll
20:25:31.0448 5772 IKEEXT - ok
20:25:31.0479 5772 [ A0F12F2C9BA6C72F3987CE780E77C130 ] intelide C:\Windows\system32\drivers\intelide.sys
20:25:31.0510 5772 intelide - ok
20:25:31.0542 5772 [ 3B514D27BFC4ACCB4037BC6685F766E0 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
20:25:31.0588 5772 intelppm - ok
20:25:31.0620 5772 [ ACB364B9075A45C0736E5C47BE5CAE19 ] IPBusEnum C:\Windows\system32\ipbusenum.dll
20:25:31.0744 5772 IPBusEnum - ok
20:25:31.0760 5772 [ 709D1761D3B19A932FF0238EA6D50200 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:25:31.0807 5772 IpFilterDriver - ok
20:25:31.0869 5772 [ 58F67245D041FBE7AF88F4EAF79DF0FA ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
20:25:31.0963 5772 iphlpsvc - ok
20:25:32.0010 5772 [ 4BD7134618C1D2A27466A099062547BF ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
20:25:32.0025 5772 IPMIDRV - ok
20:25:32.0056 5772 [ A5FA468D67ABCDAA36264E463A7BB0CD ] IPNAT C:\Windows\system32\drivers\ipnat.sys
20:25:32.0103 5772 IPNAT - ok
20:25:32.0197 5772 [ E3E71649A926CB34FA4D7AB75DCE126C ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
20:25:32.0259 5772 iPod Service - ok
20:25:32.0306 5772 [ 42996CFF20A3084A56017B7902307E9F ] IRENUM C:\Windows\system32\drivers\irenum.sys
20:25:32.0368 5772 IRENUM - ok
20:25:32.0415 5772 [ 1F32BB6B38F62F7DF1A7AB7292638A35 ] isapnp C:\Windows\system32\drivers\isapnp.sys
20:25:32.0431 5772 isapnp - ok
20:25:32.0478 5772 [ CB7A9ABB12B8415BCE5D74994C7BA3AE ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
20:25:32.0524 5772 iScsiPrt - ok
20:25:32.0556 5772 [ ADEF52CA1AEAE82B50DF86B56413107E ] kbdclass C:\Windows\system32\drivers\kbdclass.sys
20:25:32.0587 5772 kbdclass - ok
20:25:32.0634 5772 [ 9E3CED91863E6EE98C24794D05E27A71 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys
20:25:32.0665 5772 kbdhid - ok
20:25:32.0680 5772 [ 81951F51E318AECC2D68559E47485CC4 ] KeyIso C:\Windows\system32\lsass.exe
20:25:32.0712 5772 KeyIso - ok
20:25:32.0743 5772 [ 186B54479D98E48AEE0E9ADA4B3C4D31 ] KL1 C:\Windows\system32\DRIVERS\kl1.sys
20:25:32.0758 5772 KL1 - ok
20:25:32.0774 5772 [ BF485BFBA13C0AB116701FD9C55324D0 ] kl2 C:\Windows\system32\DRIVERS\kl2.sys
20:25:32.0790 5772 kl2 - ok
20:25:32.0883 5772 [ 46FA00BEF951762919B66269371C22AF ] KLIF C:\Windows\system32\DRIVERS\klif.sys
20:25:32.0946 5772 KLIF - ok
20:25:32.0977 5772 [ B7895B4182C0D16F6EFADEB8081E8D36 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
20:25:33.0008 5772 KSecDD - ok
20:25:33.0055 5772 [ 5FE1ABF1AF591A3458C9CF24ED9A4D35 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
20:25:33.0070 5772 KSecPkg - ok
20:25:33.0102 5772 [ 89A7B9CC98D0D80C6F31B91C0A310FCD ] KtmRm C:\Windows\system32\msdtckrm.dll
20:25:33.0195 5772 KtmRm - ok
20:25:33.0258 5772 [ D64AF876D53ECA3668BB97B51B4E70AB ] LanmanServer C:\Windows\system32\srvsvc.dll
20:25:33.0336 5772 LanmanServer - ok
20:25:33.0351 5772 [ 58405E4F68BA8E4057C6E914F326ABA2 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
20:25:33.0414 5772 LanmanWorkstation - ok
20:25:33.0476 5772 [ F7611EC07349979DA9B0AE1F18CCC7A6 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
20:25:33.0523 5772 lltdio - ok
20:25:33.0554 5772 [ 5700673E13A2117FA3B9020C852C01E2 ] lltdsvc C:\Windows\System32\lltdsvc.dll
20:25:33.0648 5772 lltdsvc - ok
20:25:33.0663 5772 [ 55CA01BA19D0006C8F2639B6C045E08B ] lmhosts C:\Windows\System32\lmhsvc.dll
20:25:33.0726 5772 lmhosts - ok
20:25:33.0772 5772 [ EB119A53CCF2ACC000AC71B065B78FEF ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
20:25:33.0788 5772 LSI_FC - ok
20:25:33.0804 5772 [ 8ADE1C877256A22E49B75D1CC9161F9C ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
20:25:33.0835 5772 LSI_SAS - ok
20:25:33.0850 5772 [ DC9DC3D3DAA0E276FD2EC262E38B11E9 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
20:25:33.0866 5772 LSI_SAS2 - ok
20:25:33.0882 5772 [ 0A036C7D7CAB643A7F07135AC47E0524 ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
20:25:33.0897 5772 LSI_SCSI - ok
20:25:33.0928 5772 [ 6703E366CC18D3B6E534F5CF7DF39CEE ] luafv C:\Windows\system32\drivers\luafv.sys
20:25:33.0975 5772 luafv - ok
20:25:34.0022 5772 [ ED643E777BA3F7151EF3F0FB6BE4F7F0 ] LVRS C:\Windows\system32\DRIVERS\lvrs.sys
20:25:34.0053 5772 LVRS - ok
20:25:34.0240 5772 [ 5BC80451109A8DD7F2DDD35BCE2929A3 ] LVUVC C:\Windows\system32\DRIVERS\lvuvc.sys
20:25:34.0459 5772 LVUVC - ok
20:25:34.0599 5772 [ BFB9EE8EE977EFE85D1A3105ABEF6DD1 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
20:25:34.0677 5772 Mcx2Svc - ok
20:25:34.0708 5772 [ 0FFF5B045293002AB38EB1FD1FC2FB74 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
20:25:34.0755 5772 megasas - ok
20:25:34.0771 5772 [ DCBAB2920C75F390CAF1D29F675D03D6 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
20:25:34.0802 5772 MegaSR - ok
20:25:34.0833 5772 [ 146B6F43A673379A3C670E86D89BE5EA ] MMCSS C:\Windows\system32\mmcss.dll
20:25:34.0880 5772 MMCSS - ok
20:25:34.0911 5772 [ F001861E5700EE84E2D4E52C712F4964 ] Modem C:\Windows\system32\drivers\modem.sys
20:25:34.0958 5772 Modem - ok
20:25:34.0989 5772 [ 79D10964DE86B292320E9DFE02282A23 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
20:25:35.0036 5772 monitor - ok
20:25:35.0098 5772 [ FB18CC1D4C2E716B6B903B0AC0CC0609 ] mouclass C:\Windows\system32\drivers\mouclass.sys
20:25:35.0114 5772 mouclass - ok
20:25:35.0176 5772 [ 2C388D2CD01C9042596CF3C8F3C7B24D ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
20:25:35.0223 5772 mouhid - ok
20:25:35.0254 5772 [ FC8771F45ECCCFD89684E38842539B9B ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
20:25:35.0270 5772 mountmgr - ok
20:25:35.0317 5772 [ 825BF0E46B4470A463AEB641480C5FCA ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
20:25:35.0332 5772 MozillaMaintenance - ok
20:25:35.0364 5772 [ 2D699FB6E89CE0D8DA14ECC03B3EDFE0 ] mpio C:\Windows\system32\drivers\mpio.sys
20:25:35.0410 5772 mpio - ok
20:25:35.0426 5772 [ AD2723A7B53DD1AACAE6AD8C0BFBF4D0 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
20:25:35.0488 5772 mpsdrv - ok
20:25:35.0551 5772 [ 9835584E999D25004E1EE8E5F3E3B881 ] MpsSvc C:\Windows\system32\mpssvc.dll
20:25:35.0691 5772 MpsSvc - ok
20:25:35.0722 5772 [ CEB46AB7C01C9F825F8CC6BABC18166A ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
20:25:35.0769 5772 MRxDAV - ok
20:25:35.0832 5772 [ 5D16C921E3671636C0EBA3BBAAC5FD25 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
20:25:35.0878 5772 mrxsmb - ok
20:25:35.0894 5772 [ 6D17A4791ACA19328C685D256349FEFC ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:25:35.0941 5772 mrxsmb10 - ok
20:25:35.0956 5772 [ B81F204D146000BE76651A50670A5E9E ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:25:35.0988 5772 mrxsmb20 - ok
20:25:36.0034 5772 [ 012C5F4E9349E711E11E0F19A8589F0A ] msahci C:\Windows\system32\drivers\msahci.sys
20:25:36.0050 5772 msahci - ok
20:25:36.0081 5772 [ 55055F8AD8BE27A64C831322A780A228 ] msdsm C:\Windows\system32\drivers\msdsm.sys
20:25:36.0097 5772 msdsm - ok
20:25:36.0128 5772 [ E1BCE74A3BD9902B72599C0192A07E27 ] MSDTC C:\Windows\System32\msdtc.exe
20:25:36.0222 5772 MSDTC - ok
20:25:36.0253 5772 [ DAEFB28E3AF5A76ABCC2C3078C07327F ] Msfs C:\Windows\system32\drivers\Msfs.sys
20:25:36.0300 5772 Msfs - ok
20:25:36.0315 5772 [ 3E1E5767043C5AF9367F0056295E9F84 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
20:25:36.0362 5772 mshidkmdf - ok
20:25:36.0409 5772 [ 0A4E5757AE09FA9622E3158CC1AEF114 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
20:25:36.0456 5772 msisadrv - ok
20:25:36.0487 5772 [ 90F7D9E6B6F27E1A707D4A297F077828 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
20:25:36.0596 5772 MSiSCSI - ok
20:25:36.0596 5772 msiserver - ok
20:25:36.0627 5772 [ 8C0860D6366AAFFB6C5BB9DF9448E631 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
20:25:36.0674 5772 MSKSSRV - ok
20:25:36.0690 5772 [ 3EA8B949F963562CEDBB549EAC0C11CE ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
20:25:36.0768 5772 MSPCLOCK - ok
20:25:36.0768 5772 [ F456E973590D663B1073E9C463B40932 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
20:25:36.0814 5772 MSPQM - ok
20:25:36.0846 5772 [ 0E008FC4819D238C51D7C93E7B41E560 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
20:25:36.0877 5772 MsRPC - ok
20:25:36.0892 5772 [ FC6B9FF600CC585EA38B12589BD4E246 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
20:25:36.0908 5772 mssmbios - ok
20:25:36.0924 5772 [ B42C6B921F61A6E55159B8BE6CD54A36 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
20:25:36.0970 5772 MSTEE - ok
20:25:36.0986 5772 [ 33599130F44E1F34631CEA241DE8AC84 ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
20:25:37.0002 5772 MTConfig - ok
20:25:37.0033 5772 [ 159FAD02F64E6381758C990F753BCC80 ] Mup C:\Windows\system32\Drivers\mup.sys
20:25:37.0048 5772 Mup - ok
20:25:37.0095 5772 [ 61D57A5D7C6D9AFE10E77DAE6E1B445E ] napagent C:\Windows\system32\qagentRT.dll
20:25:37.0142 5772 napagent - ok
20:25:37.0189 5772 [ 26384429FCD85D83746F63E798AB1480 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
20:25:37.0236 5772 NativeWifiP - ok
20:25:37.0298 5772 [ 8C9C922D71F1CD4DEF73F186416B7896 ] NDIS C:\Windows\system32\drivers\ndis.sys
20:25:37.0360 5772 NDIS - ok
20:25:37.0392 5772 [ 0E1787AA6C9191D3D319E8BAFE86F80C ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
20:25:37.0454 5772 NdisCap - ok
20:25:37.0485 5772 [ E4A8AEC125A2E43A9E32AFEEA7C9C888 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
20:25:37.0548 5772 NdisTapi - ok
20:25:37.0594 5772 [ D8A65DAFB3EB41CBB622745676FCD072 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
20:25:37.0672 5772 Ndisuio - ok
20:25:37.0704 5772 [ 38FBE267E7E6983311179230FACB1017 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
20:25:37.0766 5772 NdisWan - ok
20:25:37.0797 5772 [ A4BDC541E69674FBFF1A8FF00BE913F2 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
20:25:37.0828 5772 NDProxy - ok
20:25:37.0875 5772 [ 80B275B1CE3B0E79909DB7B39AF74D51 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
20:25:37.0922 5772 NetBIOS - ok
20:25:38.0016 5772 [ 280122DDCF04B378EDD1AD54D71C1E54 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
20:25:38.0094 5772 NetBT - ok
20:25:38.0109 5772 [ 81951F51E318AECC2D68559E47485CC4 ] Netlogon C:\Windows\system32\lsass.exe
20:25:38.0125 5772 Netlogon - ok
20:25:38.0172 5772 [ 7CCCFCA7510684768DA22092D1FA4DB2 ] Netman C:\Windows\System32\netman.dll
20:25:38.0250 5772 Netman - ok
20:25:38.0281 5772 [ 8C338238C16777A802D6A9211EB2BA50 ] netprofm C:\Windows\System32\netprofm.dll
20:25:38.0359 5772 netprofm - ok
20:25:38.0390 5772 [ F476EC40033CDB91EFBE73EB99B8362D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:25:38.0452 5772 NetTcpPortSharing - ok
20:25:38.0640 5772 [ 58218EC6B61B1169CF54AAB0D00F5FE2 ] netw5v32 C:\Windows\system32\DRIVERS\netw5v32.sys
20:25:38.0858 5772 netw5v32 - ok
20:25:38.0889 5772 [ 1D85C4B390B0EE09C7A46B91EFB2C097 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
20:25:38.0920 5772 nfrd960 - ok
20:25:39.0154 5772 [ 873EFDAD84E52FACC986ACA66B3F18B3 ] NIHardwareService C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
20:25:39.0342 5772 NIHardwareService ( UnsignedFile.Multi.Generic ) - warning
20:25:39.0342 5772 NIHardwareService - detected UnsignedFile.Multi.Generic (1)
20:25:39.0388 5772 [ 374071043F9E4231EE43BE2BB48DD36D ] NlaSvc C:\Windows\System32\nlasvc.dll
20:25:39.0466 5772 NlaSvc - ok
20:25:39.0498 5772 [ 1DB262A9F8C087E8153D89BEF3D2235F ] Npfs C:\Windows\system32\drivers\Npfs.sys
20:25:39.0529 5772 Npfs - ok
20:25:39.0560 5772 [ BA387E955E890C8A88306D9B8D06BF17 ] nsi C:\Windows\system32\nsisvc.dll
20:25:39.0654 5772 nsi - ok
20:25:39.0685 5772 [ E9A0A4D07E53D8FEA2BB8387A3293C58 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
20:25:39.0716 5772 nsiproxy - ok
20:25:39.0794 5772 [ 5E43D2B0EE64123D4880DFA6626DEFDE ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
20:25:39.0888 5772 Ntfs - ok
20:25:39.0919 5772 [ F9756A98D69098DCA8945D62858A812C ] Null C:\Windows\system32\drivers\Null.sys
20:25:39.0966 5772 Null - ok
20:25:40.0231 5772 [ 850240F6D899B2AE6F8ACFE68235718B ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
20:25:40.0480 5772 nvlddmkm - ok
20:25:40.0496 5772 [ B3E25EE28883877076E0E1FF877D02E0 ] nvraid C:\Windows\system32\drivers\nvraid.sys
20:25:40.0527 5772 nvraid - ok
20:25:40.0558 5772 [ 4380E59A170D88C4F1022EFF6719A8A4 ] nvstor C:\Windows\system32\drivers\nvstor.sys
20:25:40.0590 5772 nvstor - ok
20:25:40.0621 5772 [ 5A0983915F02BAE73267CC2A041F717D ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
20:25:40.0652 5772 nv_agp - ok
20:25:40.0746 5772 [ 84DE1DD996B48B05ACE31AD015FA108A ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
20:25:40.0808 5772 odserv - ok
20:25:40.0839 5772 [ 08A70A1F2CDDE9BB49B885CB817A66EB ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
20:25:40.0886 5772 ohci1394 - ok
20:25:40.0964 5772 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:25:40.0995 5772 ose - ok
20:25:41.0042 5772 [ 82A8521DDC60710C3D3D3E7325209BEC ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
20:25:41.0104 5772 p2pimsvc - ok
20:25:41.0136 5772 [ 59C3DDD501E39E006DAC31BF55150D91 ] p2psvc C:\Windows\system32\p2psvc.dll
20:25:41.0167 5772 p2psvc - ok
20:25:41.0214 5772 [ 2EA877ED5DD9713C5AC74E8EA7348D14 ] Parport C:\Windows\system32\DRIVERS\parport.sys
20:25:41.0260 5772 Parport - ok
20:25:41.0276 5772 [ 3F34A1B4C5F6475F320C275E63AFCE9B ] partmgr C:\Windows\system32\drivers\partmgr.sys
20:25:41.0307 5772 partmgr - ok
20:25:41.0323 5772 [ EB0A59F29C19B86479D36B35983DAADC ] Parvdm C:\Windows\system32\DRIVERS\parvdm.sys
20:25:41.0354 5772 Parvdm - ok
20:25:41.0385 5772 [ 358AB7956D3160000726574083DFC8A6 ] PcaSvc C:\Windows\System32\pcasvc.dll
20:25:41.0416 5772 PcaSvc - ok
20:25:41.0463 5772 [ 673E55C3498EB970088E812EA820AA8F ] pci C:\Windows\system32\drivers\pci.sys
20:25:41.0510 5772 pci - ok
20:25:41.0526 5772 [ AFE86F419014DB4E5593F69FFE26CE0A ] pciide C:\Windows\system32\drivers\pciide.sys
20:25:41.0541 5772 pciide - ok
20:25:41.0557 5772 [ F396431B31693E71E8A80687EF523506 ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
20:25:41.0588 5772 pcmcia - ok
20:25:41.0604 5772 [ 250F6B43D2B613172035C6747AEEB19F ] pcw C:\Windows\system32\drivers\pcw.sys
20:25:41.0635 5772 pcw - ok
20:25:41.0682 5772 [ 9E0104BA49F4E6973749A02BF41344ED ] PEAUTH C:\Windows\system32\drivers\peauth.sys
20:25:41.0775 5772 PEAUTH - ok
20:25:41.0838 5772 [ AF4D64D2A57B9772CF3801950B8058A6 ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll
20:25:42.0025 5772 PeerDistSvc - ok
20:25:42.0134 5772 [ 414BBA67A3DED1D28437EB66AEB8A720 ] pla C:\Windows\system32\pla.dll
20:25:42.0337 5772 pla - ok
20:25:42.0384 5772 [ EC7BC28D207DA09E79B3E9FAF8B232CA ] PlugPlay C:\Windows\system32\umpnpmgr.dll
20:25:42.0446 5772 PlugPlay - ok
20:25:42.0462 5772 [ 63FF8572611249931EB16BB8EED6AFC8 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
20:25:42.0555 5772 PNRPAutoReg - ok
20:25:42.0571 5772 [ 82A8521DDC60710C3D3D3E7325209BEC ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
20:25:42.0602 5772 PNRPsvc - ok
20:25:42.0633 5772 [ 53946B69BA0836BD95B03759530C81EC ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
20:25:42.0696 5772 PolicyAgent - ok
20:25:42.0742 5772 [ F87D30E72E03D579A5199CCB3831D6EA ] Power C:\Windows\system32\umpo.dll
20:25:42.0805 5772 Power - ok
20:25:42.0836 5772 [ 631E3E205AD6D86F2AED6A4A8E69F2DB ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
20:25:42.0898 5772 PptpMiniport - ok
20:25:42.0914 5772 [ 85B1E3A0C7585BC4AAE6899EC6FCF011 ] Processor C:\Windows\system32\DRIVERS\processr.sys
20:25:42.0945 5772 Processor - ok
20:25:42.0992 5772 [ CADEFAC453040E370A1BDFF3973BE00D ] ProfSvc C:\Windows\system32\profsvc.dll
20:25:43.0039 5772 ProfSvc - ok
20:25:43.0054 5772 [ 81951F51E318AECC2D68559E47485CC4 ] ProtectedStorage C:\Windows\system32\lsass.exe
20:25:43.0086 5772 ProtectedStorage - ok
20:25:43.0117 5772 [ 6270CCAE2A86DE6D146529FE55B3246A ] Psched C:\Windows\system32\DRIVERS\pacer.sys
20:25:43.0148 5772 Psched - ok
20:25:43.0226 5772 [ AB95ECF1F6659A60DDC166D8315B0751 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
20:25:43.0351 5772 ql2300 - ok
20:25:43.0366 5772 [ B4DD51DD25182244B86737DC51AF2270 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
20:25:43.0398 5772 ql40xx - ok
20:25:43.0429 5772 [ 31AC809E7707EB580B2BDB760390765A ] QWAVE C:\Windows\system32\qwave.dll
20:25:43.0507 5772 QWAVE - ok
20:25:43.0522 5772 [ 584078CA1B95CA72DF2A27C336F9719D ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
20:25:43.0538 5772 QWAVEdrv - ok
20:25:43.0569 5772 [ 30A81B53C766D0133BB86D234E5556AB ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
20:25:43.0616 5772 RasAcd - ok
20:25:43.0663 5772 [ 57EC4AEF73660166074D8F7F31C0D4FD ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
20:25:43.0725 5772 RasAgileVpn - ok
20:25:43.0756 5772 [ A60F1839849C0C00739787FD5EC03F13 ] RasAuto C:\Windows\System32\rasauto.dll
20:25:43.0834 5772 RasAuto - ok
20:25:43.0866 5772 [ D9F91EAFEC2815365CBE6D167E4E332A ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
20:25:43.0912 5772 Rasl2tp - ok
20:25:43.0959 5772 [ CB9E04DC05EACF5B9A36CA276D475006 ] RasMan C:\Windows\System32\rasmans.dll
20:25:44.0115 5772 RasMan - ok
20:25:44.0131 5772 [ 0FE8B15916307A6AC12BFB6A63E45507 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
20:25:44.0178 5772 RasPppoe - ok
20:25:44.0193 5772 [ 44101F495A83EA6401D886E7FD70096B ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
20:25:44.0240 5772 RasSstp - ok
20:25:44.0287 5772 [ D528BC58A489409BA40334EBF96A311B ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
20:25:44.0349 5772 rdbss - ok
20:25:44.0380 5772 [ 0D8F05481CB76E70E1DA06EE9F0DA9DF ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
20:25:44.0396 5772 rdpbus - ok
20:25:44.0443 5772 [ 23DAE03F29D253AE74C44F99E515F9A1 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
20:25:44.0505 5772 RDPCDD - ok
20:25:44.0552 5772 [ B973FCFC50DC1434E1970A146F7E3885 ] RDPDR C:\Windows\system32\drivers\rdpdr.sys
20:25:44.0599 5772 RDPDR - ok
20:25:44.0630 5772 [ 5A53CA1598DD4156D44196D200C94B8A ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
20:25:44.0692 5772 RDPENCDD - ok
20:25:44.0708 5772 [ 44B0A53CD4F27D50ED461DAE0C0B4E1F ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
20:25:44.0786 5772 RDPREFMP - ok
20:25:44.0833 5772 [ 65375DF758CA1872AB7EBBBA457FD5E6 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
20:25:44.0895 5772 RdpVideoMiniport - ok
20:25:44.0926 5772 [ F031683E6D1FEA157ABB2FF260B51E61 ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
20:25:45.0004 5772 RDPWD - ok
20:25:45.0051 5772 [ 518395321DC96FE2C9F0E96AC743B656 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
20:25:45.0098 5772 rdyboost - ok
20:25:45.0129 5772 [ 7B5E1419717FAC363A31CC302895217A ] RemoteAccess C:\Windows\System32\mprdim.dll
20:25:45.0238 5772 RemoteAccess - ok
20:25:45.0270 5772 [ CB9A8683F4EF2BF99E123D79950D7935 ] RemoteRegistry C:\Windows\system32\regsvc.dll
20:25:45.0394 5772 RemoteRegistry - ok
20:25:45.0457 5772 [ CB928D9E6DAF51879DD6BA8D02F01321 ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys
20:25:45.0488 5772 RFCOMM - ok
20:25:45.0535 5772 [ 07BD0C08D52F33CA1256EF64749AF687 ] RL_DJIFIE2_MIDI C:\Windows\system32\drivers\rldjif2m.sys
20:25:45.0550 5772 RL_DJIFIE2_MIDI - ok
20:25:45.0613 5772 [ 742FD945D6865547C4EDEF89714A68BB ] RL_DJIFIE2_USB C:\Windows\system32\Drivers\rldjif2u.sys
20:25:45.0675 5772 RL_DJIFIE2_USB - ok
20:25:45.0706 5772 [ CCBC204CB8BDA595449C28E3D6F04C32 ] RL_DJIFIE2_WDM C:\Windows\system32\drivers\rldjif2a.sys
20:25:45.0722 5772 RL_DJIFIE2_WDM - ok
20:25:45.0753 5772 [ 78D072F35BC45D9E4E1B61895C152234 ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
20:25:45.0800 5772 RpcEptMapper - ok
20:25:45.0847 5772 [ 94D36C0E44677DD26981D2BFEEF2A29D ] RpcLocator C:\Windows\system32\locator.exe
20:25:45.0925 5772 RpcLocator - ok
20:25:45.0956 5772 [ 7660F01D3B38ACA1747E397D21D790AF ] RpcSs C:\Windows\system32\rpcss.dll
20:25:46.0018 5772 RpcSs - ok
20:25:46.0050 5772 [ 032B0D36AD92B582D869879F5AF5B928 ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
20:25:46.0143 5772 rspndr - ok
20:25:46.0190 5772 [ 5283B9A27FF230F2FF70D92451FF409A ] RTL8167 C:\Windows\system32\DRIVERS\Rt86win7.sys
20:25:46.0237 5772 RTL8167 - ok
20:25:46.0268 5772 [ 7FA7F2E249A5DCBB7970630E15E1F482 ] s3cap C:\Windows\system32\drivers\vms3cap.sys
20:25:46.0346 5772 s3cap - ok
20:25:46.0362 5772 [ 81951F51E318AECC2D68559E47485CC4 ] SamSs C:\Windows\system32\lsass.exe
20:25:46.0377 5772 SamSs - ok
20:25:46.0408 5772 [ 05D860DA1040F111503AC416CCEF2BCA ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
20:25:46.0424 5772 sbp2port - ok
20:25:46.0455 5772 [ 8FC518FFE9519C2631D37515A68009C4 ] SCardSvr C:\Windows\System32\SCardSvr.dll
20:25:46.0533 5772 SCardSvr - ok
20:25:46.0580 5772 [ 0693B5EC673E34DC147E195779A4DCF6 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
20:25:46.0642 5772 scfilter - ok
20:25:46.0705 5772 [ A04BB13F8A72F8B6E8B4071723E4E336 ] Schedule C:\Windows\system32\schedsvc.dll
20:25:46.0814 5772 Schedule - ok
20:25:46.0845 5772 [ 319C6B309773D063541D01DF8AC6F55F ] SCPolicySvc C:\Windows\System32\certprop.dll
20:25:46.0876 5772 SCPolicySvc - ok
20:25:46.0908 5772 [ 08236C4BCE5EDD0A0318A438AF28E0F7 ] SDRSVC C:\Windows\System32\SDRSVC.dll
20:25:46.0986 5772 SDRSVC - ok
20:25:47.0095 5772 [ 0F4A80438E7286A0E623582F5F2395BD ] SearchAnonymizer C:\Users\Mothership\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe
20:25:47.0126 5772 SearchAnonymizer ( UnsignedFile.Multi.Generic ) - warning
20:25:47.0126 5772 SearchAnonymizer - detected UnsignedFile.Multi.Generic (1)
20:25:47.0173 5772 [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv C:\Windows\system32\drivers\secdrv.sys
20:25:47.0204 5772 secdrv - ok
20:25:47.0251 5772 [ A59B3A4442C52060CC7A85293AA3546F ] seclogon C:\Windows\system32\seclogon.dll
20:25:47.0360 5772 seclogon - ok
20:25:47.0376 5772 [ DCB7FCDCC97F87360F75D77425B81737 ] SENS C:\Windows\System32\sens.dll
20:25:47.0438 5772 SENS - ok
20:25:47.0485 5772 [ 50087FE1EE447009C9CC2997B90DE53F ] SensrSvc C:\Windows\system32\sensrsvc.dll
20:25:47.0547 5772 SensrSvc - ok
20:25:47.0563 5772 [ 9AD8B8B515E3DF6ACD4212EF465DE2D1 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
20:25:47.0594 5772 Serenum - ok
20:25:47.0610 5772 [ 5FB7FCEA0490D821F26F39CC5EA3D1E2 ] Serial C:\Windows\system32\DRIVERS\serial.sys
20:25:47.0641 5772 Serial - ok
20:25:47.0672 5772 [ 79BFFB520327FF916A582DFEA17AA813 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
20:25:47.0688 5772 sermouse - ok
20:25:47.0750 5772 [ 4AE380F39A0032EAB7DD953030B26D28 ] SessionEnv C:\Windows\system32\sessenv.dll
20:25:47.0797 5772 SessionEnv - ok
20:25:47.0844 5772 [ 9F976E1EB233DF46FCE808D9DEA3EB9C ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
20:25:47.0875 5772 sffdisk - ok
20:25:47.0890 5772 [ 932A68EE27833CFD57C1639D375F2731 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
20:25:47.0937 5772 sffp_mmc - ok
20:25:47.0953 5772 [ 6D4CCAEDC018F1CF52866BBBAA235982 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
20:25:47.0968 5772 sffp_sd - ok
20:25:48.0000 5772 [ DB96666CC8312EBC45032F30B007A547 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
20:25:48.0015 5772 sfloppy - ok
20:25:48.0046 5772 [ D1A079A0DE2EA524513B6930C24527A2 ] SharedAccess C:\Windows\System32\ipnathlp.dll
20:25:48.0171 5772 SharedAccess - ok
20:25:48.0218 5772 [ 414DA952A35BF5D50192E28263B40577 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
20:25:48.0296 5772 ShellHWDetection - ok
20:25:48.0312 5772 [ 2565CAC0DC9FE0371BDCE60832582B2E ] sisagp C:\Windows\system32\drivers\sisagp.sys
20:25:48.0343 5772 sisagp - ok
20:25:48.0358 5772 [ A9F0486851BECB6DDA1D89D381E71055 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
20:25:48.0390 5772 SiSRaid2 - ok
20:25:48.0405 5772 [ 3727097B55738E2F554972C3BE5BC1AA ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
20:25:48.0421 5772 SiSRaid4 - ok
20:25:48.0483 5772 [ 7C15061CD0372487903B07B9BB03AFAD ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe
20:25:48.0514 5772 SkypeUpdate - ok
20:25:48.0546 5772 [ 3E21C083B8A01CB70BA1F09303010FCE ] Smb C:\Windows\system32\DRIVERS\smb.sys
20:25:48.0592 5772 Smb - ok
20:25:48.0655 5772 [ 19301C27F3425DC39F6C599F527E507D ] smserial C:\Windows\system32\DRIVERS\smserial.sys
20:25:48.0764 5772 smserial - ok
20:25:48.0795 5772 [ 6A984831644ECA1A33FFEAE4126F4F37 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
20:25:48.0858 5772 SNMPTRAP - ok
20:25:48.0889 5772 [ 95CF1AE7527FB70F7816563CBC09D942 ] spldr C:\Windows\system32\drivers\spldr.sys
20:25:48.0904 5772 spldr - ok
20:25:48.0967 5772 [ 9AEA093B8F9C37CF45538382CABA2475 ] Spooler C:\Windows\System32\spoolsv.exe
20:25:49.0045 5772 Spooler - ok
20:25:49.0201 5772 [ CF87A1DE791347E75B98885214CED2B8 ] sppsvc C:\Windows\system32\sppsvc.exe
20:25:49.0404 5772 sppsvc - ok
20:25:49.0450 5772 [ B0180B20B065D89232A78A40FE56EAA6 ] sppuinotify C:\Windows\system32\sppuinotify.dll
20:25:49.0528 5772 sppuinotify - ok
20:25:49.0575 5772 [ E4C2764065D66EA1D2D3EBC28FE99C46 ] srv C:\Windows\system32\DRIVERS\srv.sys
20:25:49.0638 5772 srv - ok
20:25:49.0669 5772 [ 03F0545BD8D4C77FA0AE1CEEDFCC71AB ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
20:25:49.0700 5772 srv2 - ok
20:25:49.0747 5772 [ BE6BD660CAA6F291AE06A718A4FA8ABC ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
20:25:49.0778 5772 srvnet - ok
20:25:49.0809 5772 [ D887C9FD02AC9FA880F6E5027A43E118 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
20:25:49.0872 5772 SSDPSRV - ok
20:25:49.0934 5772 [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv C:\Windows\system32\DRIVERS\ssmdrv.sys
20:25:49.0965 5772 ssmdrv - ok
20:25:49.0996 5772 [ D318F23BE45D5E3A107469EB64815B50 ] SstpSvc C:\Windows\system32\sstpsvc.dll
20:25:50.0059 5772 SstpSvc - ok
20:25:50.0137 5772 [ 07318149E102FD9197AB444C27774372 ] ssudmdm C:\Windows\system32\DRIVERS\ssudmdm.sys
20:25:50.0152 5772 ssudmdm - ok
20:25:50.0215 5772 [ DB32D325C192B801DF274BFD12A7E72B ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
20:25:50.0230 5772 stexstor - ok
20:25:50.0324 5772 [ E1FB3706030FB4578A0D72C2FC3689E4 ] StiSvc C:\Windows\System32\wiaservc.dll
20:25:50.0449 5772 StiSvc - ok
20:25:50.0480 5772 [ 472AF0311073DCECEAA8FA18BA2BDF89 ] storflt C:\Windows\system32\drivers\vmstorfl.sys
20:25:50.0496 5772 storflt - ok
20:25:50.0527 5772 [ 0BF669F0A910BEDA4A32258D363AF2A5 ] StorSvc C:\Windows\system32\storsvc.dll
20:25:50.0620 5772 StorSvc - ok
20:25:50.0667 5772 [ DCAFFD62259E0BDB433DD67B5BB37619 ] storvsc C:\Windows\system32\drivers\storvsc.sys
20:25:50.0683 5772 storvsc - ok
20:25:50.0730 5772 [ E58C78A848ADD9610A4DB6D214AF5224 ] swenum C:\Windows\system32\drivers\swenum.sys
20:25:50.0745 5772 swenum - ok
20:25:50.0792 5772 [ A28BD92DF340E57B024BA433165D34D7 ] swprv C:\Windows\System32\swprv.dll
20:25:50.0839 5772 swprv - ok
20:25:50.0886 5772 [ 2D2C815364A878C7E358D5F549711197 ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys
20:25:50.0901 5772 SynTP - ok
20:25:50.0979 5772 [ 36650D618CA34C9D357DFD3D89B2C56F ] SysMain C:\Windows\system32\sysmain.dll
20:25:51.0073 5772 SysMain - ok
20:25:51.0260 5772 [ 763FECDC3D30C815FE72DD57936C6CD1 ] TabletInputService C:\Windows\System32\TabSvc.dll
20:25:51.0322 5772 TabletInputService - ok
20:25:51.0369 5772 [ 613BF4820361543956909043A265C6AC ] TapiSrv C:\Windows\System32\tapisrv.dll
20:25:51.0510 5772 TapiSrv - ok
20:25:51.0541 5772 [ B799D9FDB26111737F58288D8DC172D9 ] TBS C:\Windows\System32\tbssvc.dll
20:25:51.0650 5772 TBS - ok
20:25:51.0759 5772 [ 7C0507D2391AF5933600CBCED799F277 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
20:25:51.0837 5772 Tcpip - ok
20:25:51.0931 5772 [ 7C0507D2391AF5933600CBCED799F277 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
20:25:51.0978 5772 TCPIP6 - ok
20:25:52.0024 5772 [ 3EEBD3BD93DA46A26E89893C7AB2FF3B ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
20:25:52.0071 5772 tcpipreg - ok
20:25:52.0118 5772 [ 1CB91B2BD8F6DD367DFC2EF26FD751B2 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
20:25:52.0180 5772 TDPIPE - ok
20:25:52.0196 5772 [ 2C2C5AFE7EE4F620D69C23C0617651A8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
20:25:52.0243 5772 TDTCP - ok
20:25:52.0274 5772 [ B459575348C20E8121D6039DA063C704 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
20:25:52.0305 5772 tdx - ok
20:25:52.0352 5772 [ 04DBF4B01EA4BF25A9A3E84AFFAC9B20 ] TermDD C:\Windows\system32\drivers\termdd.sys
20:25:52.0368 5772 TermDD - ok
20:25:52.0430 5772 [ 382C804C92811BE57829D8E550A900E2 ] TermService C:\Windows\System32\termsrv.dll
20:25:52.0492 5772 TermService - ok
20:25:52.0524 5772 [ 42FB6AFD6B79D9FE07381609172E7CA4 ] Themes C:\Windows\system32\themeservice.dll
20:25:52.0570 5772 Themes - ok
20:25:52.0586 5772 [ 146B6F43A673379A3C670E86D89BE5EA ] THREADORDER C:\Windows\system32\mmcss.dll
20:25:52.0633 5772 THREADORDER - ok
20:25:52.0664 5772 [ 4792C0378DB99A9BC2AE2DE6CFFF0C3A ] TrkWks C:\Windows\System32\trkwks.dll
20:25:52.0726 5772 TrkWks - ok
20:25:52.0789 5772 [ 2C49B175AEE1D4364B91B531417FE583 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
20:25:52.0851 5772 TrustedInstaller - ok
20:25:52.0898 5772 [ 254BB140EEE3C59D6114C1A86B636877 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
20:25:52.0945 5772 tssecsrv - ok
20:25:52.0992 5772 [ 9CE253214ACAA5A7D323327D2055EFAA ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
20:25:53.0023 5772 TsUsbFlt - ok
20:25:53.0070 5772 [ B2FA25D9B17A68BB93D58B0556E8C90D ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
20:25:53.0132 5772 tunnel - ok
20:25:53.0148 5772 [ 750FBCB269F4D7DD2E420C56B795DB6D ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
20:25:53.0179 5772 uagp35 - ok
20:25:53.0210 5772 [ EE43346C7E4B5E63E54F927BABBB32FF ] udfs C:\Windows\system32\DRIVERS\udfs.sys
20:25:53.0319 5772 udfs - ok
20:25:53.0350 5772 [ 8344FD4FCE927880AA1AA7681D4927E5 ] UI0Detect C:\Windows\system32\UI0Detect.exe
20:25:53.0444 5772 UI0Detect - ok
20:25:53.0506 5772 [ 44E8048ACE47BEFBFDC2E9BE4CBC8880 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
20:25:53.0553 5772 uliagpkx - ok
20:25:53.0553 5772 [ D295BED4B898F0FD999FCFA9B32B071B ] umbus C:\Windows\system32\drivers\umbus.sys
20:25:53.0584 5772 umbus - ok
20:25:53.0616 5772 [ 7550AD0C6998BA1CB4843E920EE0FEAC ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
20:25:53.0662 5772 UmPass - ok
20:25:53.0709 5772 [ 409994A8EACEEE4E328749C0353527A0 ] UmRdpService C:\Windows\System32\umrdp.dll
20:25:53.0756 5772 UmRdpService - ok
20:25:53.0787 5772 [ 833FBB672460EFCE8011D262175FAD33 ] upnphost C:\Windows\System32\upnphost.dll
20:25:53.0850 5772 upnphost - ok
20:25:53.0896 5772 [ 6E421CCC57059B0186C6259CA3B6DFC9 ] USBAAPL C:\Windows\system32\Drivers\usbaapl.sys
20:25:53.0943 5772 USBAAPL - ok
20:25:53.0990 5772 [ 1D9F2BD026E8E2D45033A4DF3F16B78C ] usbaudio C:\Windows\system32\drivers\usbaudio.sys
20:25:54.0021 5772 usbaudio - ok
20:25:54.0068 5772 [ BD9C55D7023C5DE374507ACC7A14E2AC ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
20:25:54.0099 5772 usbccgp - ok
20:25:54.0162 5772 [ 04EC7CEC62EC3B6D9354EEE93327FC82 ] usbcir C:\Windows\system32\drivers\usbcir.sys
20:25:54.0224 5772 usbcir - ok
20:25:54.0271 5772 [ F92DE757E4B7CE9C07C5E65423F3AE3B ] usbehci C:\Windows\system32\drivers\usbehci.sys
20:25:54.0302 5772 usbehci - ok
20:25:54.0349 5772 [ 8DC94AEC6A7E644A06135AE7506DC2E9 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
20:25:54.0411 5772 usbhub - ok
20:25:54.0458 5772 [ E185D44FAC515A18D9DEDDC23C2CDF44 ] usbohci C:\Windows\system32\drivers\usbohci.sys
20:25:54.0489 5772 usbohci - ok
20:25:54.0505 5772 [ 797D862FE0875E75C7CC4C1AD7B30252 ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
20:25:54.0536 5772 usbprint - ok
20:25:54.0583 5772 [ 576096CCBC07E7C4EA4F5E6686D6888F ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
20:25:54.0630 5772 usbscan - ok
20:25:54.0645 5772 [ F991AB9CC6B908DB552166768176896A ] USBSTOR C:\Windows\system32\drivers\USBSTOR.SYS
20:25:54.0692 5772 USBSTOR - ok
20:25:54.0739 5772 [ 68DF884CF41CDADA664BEB01DAF67E3D ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
20:25:54.0754 5772 usbuhci - ok
20:25:54.0786 5772 [ 081E6E1C91AEC36758902A9F727CD23C ] UxSms C:\Windows\System32\uxsms.dll
20:25:54.0817 5772 UxSms - ok
20:25:54.0848 5772 [ 81951F51E318AECC2D68559E47485CC4 ] VaultSvc C:\Windows\system32\lsass.exe
20:25:54.0864 5772 VaultSvc - ok
20:25:54.0879 5772 [ A059C4C3EDB09E07D21A8E5C0AABD3CB ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
20:25:54.0910 5772 vdrvroot - ok
20:25:54.0957 5772 [ C3CD30495687C2A2F66A65CA6FD89BE9 ] vds C:\Windows\System32\vds.exe
20:25:55.0113 5772 vds - ok
20:25:55.0160 5772 [ 17C408214EA61696CEC9C66E388B14F3 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
20:25:55.0176 5772 vga - ok
20:25:55.0207 5772 [ 8E38096AD5C8570A6F1570A61E251561 ] VgaSave C:\Windows\System32\drivers\vga.sys
20:25:55.0285 5772 VgaSave - ok
20:25:55.0316 5772 [ 5461686CCA2FDA57B024547733AB42E3 ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
20:25:55.0363 5772 vhdmp - ok
20:25:55.0378 5772 [ C829317A37B4BEA8F39735D4B076E923 ] viaagp C:\Windows\system32\drivers\viaagp.sys
20:25:55.0394 5772 viaagp - ok
20:25:55.0425 5772 [ E02F079A6AA107F06B16549C6E5C7B74 ] ViaC7 C:\Windows\system32\DRIVERS\viac7.sys
20:25:55.0456 5772 ViaC7 - ok
20:25:55.0488 5772 [ E43574F6A56A0EE11809B48C09E4FD3C ] viaide C:\Windows\system32\drivers\viaide.sys
20:25:55.0534 5772 viaide - ok
20:25:55.0581 5772 [ C2F2911156FDC7817C52829C86DA494E ] vmbus C:\Windows\system32\drivers\vmbus.sys
20:25:55.0612 5772 vmbus - ok
20:25:55.0628 5772 [ D4D77455211E204F370D08F4963063CE ] VMBusHID C:\Windows\system32\drivers\VMBusHID.sys
20:25:55.0659 5772 VMBusHID - ok
20:25:55.0690 5772 [ 4C63E00F2F4B5F86AB48A58CD990F212 ] volmgr C:\Windows\system32\drivers\volmgr.sys
20:25:55.0722 5772 volmgr - ok
20:25:55.0753 5772 [ B5BB72067DDDDBBFB04B2F89FF8C3C87 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
20:25:55.0784 5772 volmgrx - ok
20:25:55.0800 5772 [ F497F67932C6FA693D7DE2780631CFE7 ] volsnap C:\Windows\system32\drivers\volsnap.sys
20:25:55.0831 5772 volsnap - ok
20:25:55.0846 5772 [ 9DFA0CC2F8855A04816729651175B631 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
20:25:55.0878 5772 vsmraid - ok
20:25:55.0956 5772 [ 209A3B1901B83AEB8527ED211CCE9E4C ] VSS C:\Windows\system32\vssvc.exe
20:25:56.0080 5772 VSS - ok
20:25:56.0096 5772 [ 90567B1E658001E79D7C8BBD3DDE5AA6 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys
20:25:56.0127 5772 vwifibus - ok
20:25:56.0174 5772 [ 55187FD710E27D5095D10A472C8BAF1C ] W32Time C:\Windows\system32\w32time.dll
20:25:56.0314 5772 W32Time - ok
20:25:56.0408 5772 [ DE3721E89C653AA281428C8A69745D90 ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
20:25:56.0455 5772 WacomPen - ok
20:25:56.0502 5772 [ 3C3C78515F5AB448B022BDF5B8FFDD2E ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
20:25:56.0564 5772 WANARP - ok
20:25:56.0580 5772 [ 3C3C78515F5AB448B022BDF5B8FFDD2E ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
20:25:56.0611 5772 Wanarpv6 - ok
20:25:56.0751 5772 [ 691E3285E53DCA558E1A84667F13E15A ] wbengine C:\Windows\system32\wbengine.exe
20:25:56.0907 5772 wbengine - ok
20:25:56.0938 5772 [ 9614B5D29DC76AC3C29F6D2D3AA70E67 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
20:25:57.0032 5772 WbioSrvc - ok
20:25:57.0079 5772 [ 34EEE0DFAADB4F691D6D5308A51315DC ] wcncsvc C:\Windows\System32\wcncsvc.dll
20:25:57.0157 5772 wcncsvc - ok
20:25:57.0172 5772 [ 5D930B6357A6D2AF4D7653BDABBF352F ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
20:25:57.0250 5772 WcsPlugInService - ok
20:25:57.0282 5772 [ 1112A9BADACB47B7C0BB0392E3158DFF ] Wd C:\Windows\system32\DRIVERS\wd.sys
20:25:57.0297 5772 Wd - ok
20:25:57.0344 5772 [ A840213F1ACDCC175B4D1D5AAEAC0D7A ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
20:25:57.0391 5772 Wdf01000 - ok
20:25:57.0406 5772 [ 46EF9DC96265FD0B423DB72E7C38C2A5 ] WdiServiceHost C:\Windows\system32\wdi.dll
20:25:57.0484 5772 WdiServiceHost - ok
20:25:57.0484 5772 [ 46EF9DC96265FD0B423DB72E7C38C2A5 ] WdiSystemHost C:\Windows\system32\wdi.dll
20:25:57.0516 5772 WdiSystemHost - ok
20:25:57.0562 5772 [ A9D880F97530D5B8FEE278923349929D ] WebClient C:\Windows\System32\webclnt.dll
20:25:57.0656 5772 WebClient - ok
20:25:57.0687 5772 [ 760F0AFE937A77CFF27153206534F275 ] Wecsvc C:\Windows\system32\wecsvc.dll
20:25:57.0812 5772 Wecsvc - ok
20:25:57.0828 5772 [ AC804569BB2364FB6017370258A4091B ] wercplsupport C:\Windows\System32\wercplsupport.dll
20:25:57.0890 5772 wercplsupport - ok
20:25:57.0906 5772 [ 08E420D873E4FD85241EE2421B02C4A4 ] WerSvc C:\Windows\System32\WerSvc.dll
20:25:57.0952 5772 WerSvc - ok
20:25:57.0984 5772 [ 8B9A943F3B53861F2BFAF6C186168F79 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
20:25:58.0030 5772 WfpLwf - ok
20:25:58.0046 5772 [ 5CF95B35E59E2A38023836FFF31BE64C ] WIMMount C:\Windows\system32\drivers\wimmount.sys
20:25:58.0062 5772 WIMMount - ok
20:25:58.0140 5772 [ 3FAE8F94296001C32EAB62CD7D82E0FD ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll
20:25:58.0249 5772 WinDefend - ok
20:25:58.0280 5772 WinHttpAutoProxySvc - ok
20:25:58.0342 5772 [ F62E510B6AD4C21EB9FE8668ED251826 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
20:25:58.0405 5772 Winmgmt - ok
20:25:58.0483 5772 [ 1B91CD34EA3A90AB6A4EF0550174F4CC ] WinRM C:\Windows\system32\WsmSvc.dll
20:25:58.0654 5772 WinRM - ok
20:25:58.0717 5772 [ A67E5F9A400F3BD1BE3D80613B45F708 ] WinUsb C:\Windows\system32\drivers\WinUsb.sys
20:25:58.0764 5772 WinUsb - ok
20:25:58.0826 5772 [ 16935C98FF639D185086A3529B1F2067 ] Wlansvc C:\Windows\System32\wlansvc.dll
20:25:58.0904 5772 Wlansvc - ok
20:25:58.0951 5772 [ 0217679B8FCA58714C3BF2726D2CA84E ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
20:25:59.0013 5772 WmiAcpi - ok
20:25:59.0044 5772 [ 6EB6B66517B048D87DC1856DDF1F4C3F ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
20:25:59.0076 5772 wmiApSrv - ok
20:25:59.0185 5772 [ 3B40D3A61AA8C21B88AE57C58AB3122E ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
20:25:59.0310 5772 WMPNetworkSvc - ok
20:25:59.0341 5772 [ A2F0EC770A92F2B3F9DE6D518E11409C ] WPCSvc C:\Windows\System32\wpcsvc.dll
20:25:59.0434 5772 WPCSvc - ok
20:25:59.0481 5772 [ AA53356D60AF47EACC85BC617A4F3F66 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
20:25:59.0559 5772 WPDBusEnum - ok
20:25:59.0590 5772 [ 6DB3276587B853BF886B69528FDB048C ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
20:25:59.0637 5772 ws2ifsl - ok
20:25:59.0668 5772 [ 6F5D49EFE0E7164E03AE773A3FE25340 ] wscsvc C:\Windows\System32\wscsvc.dll
20:25:59.0700 5772 wscsvc - ok
20:25:59.0715 5772 WSearch - ok
20:25:59.0824 5772 [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv C:\Windows\system32\wuaueng.dll
20:25:59.0965 5772 wuauserv - ok
20:25:59.0996 5772 [ 06E6F32C8D0A3F66D956F57B43A2E070 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
20:26:00.0043 5772 WudfPf - ok
20:26:00.0074 5772 [ 867C301E8B790040AE9CF6486E8041DF ] WUDFRd C:\Windows\system32\drivers\WUDFRd.sys
20:26:00.0121 5772 WUDFRd - ok
20:26:00.0152 5772 [ FE47B7BC8EA320C2D9B5E5BF6E303765 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
20:26:00.0183 5772 wudfsvc - ok
20:26:00.0230 5772 [ 3C5E51C05BE9B56EAFF4E388C3AB25E4 ] WwanSvc C:\Windows\System32\wwansvc.dll
20:26:00.0355 5772 WwanSvc - ok
20:26:00.0386 5772 ================ Scan global ===============================
20:26:00.0417 5772 [ DAB748AE0439955ED2FA22357533DDDB ] C:\Windows\system32\basesrv.dll
20:26:00.0448 5772 [ 1F5F07091D50244F17DD8D5147A628CC ] C:\Windows\system32\winsrv.dll
20:26:00.0480 5772 [ 1F5F07091D50244F17DD8D5147A628CC ] C:\Windows\system32\winsrv.dll
20:26:00.0511 5772 [ 364455805E64882844EE9ACB72522830 ] C:\Windows\system32\sxssrv.dll
20:26:00.0558 5772 [ 5F1B6A9C35D3D5CA72D6D6FDEF9747D6 ] C:\Windows\system32\services.exe
20:26:00.0558 5772 [Global] - ok
20:26:00.0558 5772 ================ Scan MBR ==================================
20:26:00.0573 5772 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
20:26:00.0979 5772 \Device\Harddisk0\DR0 - ok
20:26:00.0979 5772 ================ Scan VBR ==================================
20:26:00.0994 5772 [ 9E83311CB8E3C771164AD7CAEA102098 ] \Device\Harddisk0\DR0\Partition1
20:26:00.0994 5772 \Device\Harddisk0\DR0\Partition1 - ok
20:26:01.0026 5772 [ EE18E0F21EC5708C007DA35E1F018F30 ] \Device\Harddisk0\DR0\Partition2
20:26:01.0026 5772 \Device\Harddisk0\DR0\Partition2 - ok
20:26:01.0026 5772 ============================================================
20:26:01.0026 5772 Scan finished
20:26:01.0026 5772 ============================================================
20:26:01.0041 4800 Detected object count: 2
20:26:01.0041 4800 Actual detected object count: 2
20:26:30.0947 4800 NIHardwareService ( UnsignedFile.Multi.Generic ) - skipped by user
20:26:30.0947 4800 NIHardwareService ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:26:30.0947 4800 SearchAnonymizer ( UnsignedFile.Multi.Generic ) - skipped by user
20:26:30.0947 4800 SearchAnonymizer ( UnsignedFile.Multi.Generic ) - User select action: Skip

Hi,
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Ok, wurde erledigt. Hier das Ergebniss:

hi, poste alle bisher erstellten Malwarebytes Logs mit Funden.
http://www.trojaner-board.de/125889-...en-posten.html

Einen hab ich....

Hi,

lade den CCleaner standard:
CCleaner - Download - Filepony
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

deinstaliere:
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden, instalieren.
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen
bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
Sicherheit (erweitert)
Erweiterte Sicherheit anhaken
und alle Dateien auswählen.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
Avira SearchFree : beide bitte weg
AviSynth
Desktop Icon
K-Lite
PartyPoker
Preispilot
SearchAnonymizer

Öffne CCleaner, analysieren, starten, PC neustarten.
Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).