Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   GVU Trojaner? oder echt? (https://www.trojaner-board.de/111969-gvu-trojaner-echt.html)

adik4all 20.03.2012 18:15
GVU Trojaner? oder echt?
 
Hallo zusammen,

ich habe sämtliche Seiten durchsucht doch leider zu meinem Fall nichts gefunden. Ich habe zwar ähnliche Trojanerbeschriebungen gelesen aber bin mir nicht sicher, ob es in meinem Fall doch eine echte Mahnung ist.

Folgendes Problem:

Sobald mein Windowssystem geladen wird erhalte ich ein Bildschirm mit der Meldung:

Please wait while the connection is beeing established.
Bitte warten Sie während die Verbindung hergestellt wird

Anschließend erfolgt eine bereits bekannte Darstellung und nahezu in gleichem Wortlaut wie bei dem GEMA-Trojaner, allerdings mit der GVU als Ursachenträger.

Ihr Computer wurde von der GVU gesperrt.

Auf Ihrem Computer wurden illegal heruntergeladene Medien ("Raubkopien") gefunden.

....bestrafung mit Freiheitsstrafe...Mahngebühr von 50 € bezahlbar durch paysafecard....

Das Logo der GVU und Bundesamt für Sicherheit in der Informationstechnik schmücken das Ganze.

Ich vermute (hoffe), dass es sich um ein Trojaner handelt. Kann mir das jemand bestätigen?

Wenn ja, wäre es echt super wenn mir jemand über mein weiteres Vorgehen berichten könnte.

Bzw. würde folgende Anleitung zielführend sein?

http://www.trojaner-board.de/111836-...-trojaner.html
Post 2.

Mein Betriebssystem: Windows 7

Vielen Dank im Vorraus, ihr seid super.

Adik

cosinus 20.03.2012 18:46
Funktioniert noch der abgesicherte Modus mit Netzwerktreibern? Mit Internetverbindung?



Abgesicherter Modus zur Bereinigung
  • Windows mit F8-Taste beim Start in den abgesicherten Modus bringen.
  • Starte den Rechner in den abgesicherten Modus mit Netzwerktreibern:

    Windows im abgesicherten Modusstarten

adik4all 20.03.2012 20:02
Hallo Arne,

danke für die schnelle Antwort, leider hilft dein Tipp nicht.
Immernoch der gleiche Screen.

Kann man den schon sagen, ob es ein Virus ist, oder ob es doch "echt" ist?

Anbei ein "Screenshot"

Gruß,

Adik
http://home.arcor.de/Undertaker4all/screenshot.JPG

cosinus 21.03.2012 14:46
Liegt doch auf der Hand, dass das NICHT von der GVU ist!

Hast du einen zweiten PC zur Verfügung? Dieser sollte sauber sein. Es geht auch ein nicht-Windows-Rechner mit Brenner. Wenn nicht evtl. mal Nachbar oder Kumpel fragen.

adik4all 21.03.2012 16:39
Hi, dann bin ich ja beruhigt.

Ja ich habe hier ein zweitrechner mit Windows XP als Betriebssystem.

Was rätst du mir als nächstes zu tun?

Gruß,

Adik

cosinus 21.03.2012 17:09
Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.
  • Lade OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
  • Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
  • Lege eine leere CD in Deinen Brenner.
  • ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
  • Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
  • Du kannst nun die Fenster des Brennprogramms schließen.
Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD
  • Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
  • Mache einen Doppelklick auf das OTLPE Icon.
  • Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
  • Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
  • Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
  • Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
  • OTLpe sollte nun starten.
  • Drücke Run Scan, um den Scan zu starten.
  • Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
  • Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
  • Bitte poste den Inhalt von C:\OTL.Txt und Extras.Txt.

adik4all 21.03.2012 19:55
OK danke für die Anleitung, ich habe diese befolgt


Der Inhalt lautet wir folgt:
OTL Logfile:
Code:
OTL logfile created on: 3/21/2012 7:24:12 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium  (Version = 6.1.7600) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 89.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 232.88 Gb Total Space | 144.47 Gb Free Space | 62.04% Space Free | Partition Type: NTFS
Drive D: | 218.23 Gb Total Space | 124.13 Gb Free Space | 56.88% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009/09/17 15:36:34 | 000,359,552 | ---- | M] (ASUSTeK Computer Inc.) [Auto] -- C:\Windows\System32\FBAgent.exe -- (AFBAgent)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2012/01/04 08:32:36 | 000,718,888 | ---- | M] (Nokia) [On_Demand] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2011/10/13 11:25:32 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011/10/11 08:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/10/11 08:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/03/31 11:08:14 | 000,080,896 | ---- | M] () [Auto] -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
SRV - [2010/04/05 06:55:01 | 000,116,104 | ---- | M] () [Auto] -- C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/18 05:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/06/15 12:30:42 | 000,084,536 | ---- | M] (ASUS) [Auto] -- C:\Program Files (x86)\ASUS\ATK Hotkey\AsLdrSrv.exe -- (ASLDRService)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/02/15 14:02:19 | 000,132,320 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011/11/01 05:07:26 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt)
DRV:64bit: - [2011/11/01 05:07:26 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usbser_lowerfltx64.sys -- (upperdev)
DRV:64bit: - [2011/11/01 05:07:24 | 000,171,008 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nmwcdnsux64.sys -- (nmwcdnsux64)
DRV:64bit: - [2011/11/01 05:07:24 | 000,027,136 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ccdcmbox64.sys -- (nmwcdc)
DRV:64bit: - [2011/11/01 05:07:24 | 000,019,968 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ccdcmbx64.sys -- (nmwcd)
DRV:64bit: - [2011/11/01 05:07:24 | 000,012,800 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nmwcdnsucx64.sys -- (nmwcdnsucx64)
DRV:64bit: - [2011/10/11 09:00:01 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011/10/11 09:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2010/06/25 11:08:10 | 000,036,928 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand] -- C:\Windows\System32\drivers\htcnprot.sys -- (htcnprot)
DRV:64bit: - [2009/11/01 14:16:50 | 000,033,736 | ---- | M] (HTC, Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ANDROIDUSB.sys -- (HTCAND64)
DRV:64bit: - [2009/10/04 21:34:00 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009/09/04 01:39:08 | 000,062,464 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\L1C62x64.sys -- (L1C) NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20)
DRV:64bit: - [2009/08/21 02:48:18 | 000,044,032 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\AmUStor.sys -- (AmUStor)
DRV:64bit: - [2009/07/20 05:29:40 | 000,015,416 | ---- | M] ( ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)
DRV:64bit: - [2009/07/13 20:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009/07/13 20:35:37 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\WSDScan.sys -- (WSDScan)
DRV:64bit: - [2009/07/13 20:06:32 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usbser.sys -- (usbser)
DRV:64bit: - [2009/06/26 16:25:10 | 000,083,488 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- C:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:35:57 | 000,056,832 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\SiSG664.sys -- (SiSGbeLH)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/05/20 04:11:06 | 001,799,680 | ---- | M] () [Kernel | On_Demand] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV:64bit: - [2009/05/12 21:07:20 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ATK64AMD.sys -- (MTsensor)
DRV:64bit: - [2008/08/28 06:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV:64bit: - [2008/05/23 21:27:28 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand] -- C:\Windows\System32\drivers\WimFltr.sys -- (WimFltr)
DRV:64bit: - [2007/07/03 10:05:18 | 000,114,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\sscdserd.sys -- (sscdserd) SAMSUNG Mobile Modem Diagnostic Serial Port (WDM)
DRV:64bit: - [2007/07/03 10:04:44 | 000,142,504 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm)
DRV:64bit: - [2007/07/03 10:04:16 | 000,016,040 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl)
DRV:64bit: - [2007/07/03 10:02:12 | 000,105,128 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus) SAMSUNG USB Composite Device driver (WDM)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Adik_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?babsrc=HP_ss&mntrId=be8fa71e000000000000e0cb4e10c948&tlver=1.4.19.19&ss=1&affID=17395
IE - HKU\Adik_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Adik_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Adik_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 30 52 B2 05 81 F1 CB 01  [binary data]
IE - HKU\Adik_ON_C\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\Adik_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "YouTube-Videosuche"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "google.de"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?babsrc=SP_ss&mntrId=be8fa71e000000000000e0cb4e10c948&tlver=1.4.19.19&instlRef=sst&ss=1&affID=17395&q="
FF - prefs.js..network.proxy.type: 0
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF64_11_1_102.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Adik\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Adik\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\RAWThumbnailViewer@arcsoft.com.cn: C:\Program Files (x86)\ArcSoft\RAW Thumbnail Viewer\FireFox Extension [2011/05/24 13:27:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/01/10 15:04:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\fe_9.0@nokia.com: C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Bookmarks Connector\FirefoxExtension_9.0 [2012/01/30 12:21:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/03/20 05:09:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/08/18 05:10:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Thunderbird\Extensions\\te_9.0@nokia.com: C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_9.0 [2012/01/30 12:21:51 | 000,000,000 | ---D | M]
 
[2011/02/20 13:16:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Adik\AppData\Roaming\Mozilla\Extensions
[2011/08/04 14:56:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Adik\AppData\Roaming\Mozilla\Firefox\Profiles\gynvhsc1.default\extensions
[2012/03/18 19:05:57 | 000,001,056 | ---- | M] () -- C:\Users\Adik\AppData\Roaming\Mozilla\Firefox\Profiles\gynvhsc1.default\searchplugins\icqplugin.xml
[2011/02/20 15:34:57 | 000,002,057 | ---- | M] () -- C:\Users\Adik\AppData\Roaming\Mozilla\Firefox\Profiles\gynvhsc1.default\searchplugins\youtube-videosuche.xml
[2011/11/14 17:02:51 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
File not found (No name found) --
[2012/03/20 05:09:43 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/05/03 22:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012/02/14 14:16:17 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/05/24 13:19:02 | 000,002,428 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2012/02/14 14:16:17 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/02/14 14:16:17 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012/02/14 14:16:17 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/02/14 14:16:17 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/02/14 14:16:17 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\Adik_ON_C\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (AlcorMicro Co., Ltd.)
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [IJNetworkScanUtility] C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
O4 - HKU\Adik_ON_C..\Run: []  File not found
O4 - HKU\Adik_ON_C..\Run: [4rJHeEXlxs54kFa] C:\Users\Adik\AppData\Roaming\gw45u45111.exe (lpsjJ)
O4 - HKU\LocalService_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_C..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_C..\RunOnce: [mctadmin]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\Adik_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Adik_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Adik_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O8:64bit: - Extra context menu item: EXIF lesen - C:\Program Files (x86)\ArcSoft\RAW Thumbnail Viewer\ArcEXIFM.htm ()
O8 - Extra context menu item: EXIF lesen - C:\Program Files (x86)\ArcSoft\RAW Thumbnail Viewer\ArcEXIFM.htm ()
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 10.0.0)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 1.7.0)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\Adik_ON_C Winlogon: Shell - (C:\Users\Adik\AppData\Roaming\gw45u45111.exe) - C:\Users\Adik\AppData\Roaming\gw45u45111.exe (lpsjJ)
O20 - HKU\Adik_ON_C Winlogon: UserInit - (C:\Users\Adik\AppData\Roaming\gw45u45111.exe) - C:\Users\Adik\AppData\Roaming\gw45u45111.exe (lpsjJ)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{2e063918-5e24-11e0-a25e-e0cb4e10c948}\Shell - "" = AutoRun
O33 - MountPoints2\{2e063918-5e24-11e0-a25e-e0cb4e10c948}\Shell\AutoRun\command - "" = "F:\WD SmartWare.exe" autoplay=true
O33 - MountPoints2\{a04e5898-48dd-11e0-9657-e0cb4e10c948}\Shell - "" = AutoRun
O33 - MountPoints2\{a04e5898-48dd-11e0-9657-e0cb4e10c948}\Shell\AutoRun\command - "" = I:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/03/20 05:40:25 | 000,323,584 | ---- | C] (lpsjJ) -- C:\Users\Adik\AppData\Roaming\gw45u45111.exe
[2012/03/18 19:09:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HTC
[2012/03/18 19:09:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spirent Communications
[2012/03/18 19:08:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HTC
[2012/03/18 19:02:23 | 000,000,000 | ---D | C] -- C:\ruu_log
[2012/03/18 18:59:26 | 000,000,000 | ---D | C] -- C:\Users\Adik\Desktop\htc
[2012/03/14 18:23:42 | 005,504,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2012/03/14 18:23:41 | 003,957,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012/03/14 18:23:40 | 003,902,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012/03/14 09:41:42 | 001,541,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2012/03/14 09:41:42 | 001,074,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\DWrite.dll
[2012/03/14 09:41:41 | 001,837,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2012/03/14 09:41:41 | 001,170,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d10warp.dll
[2012/03/14 09:41:41 | 000,902,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2012/03/14 09:41:41 | 000,739,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d2d1.dll
[2012/03/14 09:41:41 | 000,320,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2012/03/14 09:41:41 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d10_1core.dll
[2012/03/14 09:41:41 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2012/03/14 09:41:41 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d10_1.dll
[2012/03/13 17:41:04 | 001,031,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcore.dll
[2012/03/13 17:41:04 | 000,826,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpcore.dll
[2012/03/13 17:41:02 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll
[2012/03/13 17:41:02 | 000,076,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll
[2012/03/13 17:41:02 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe
[2012/03/11 07:25:31 | 000,000,000 | ---D | C] -- C:\Users\Adik\AppData\Local\ElevatedDiagnostics
[2012/03/01 10:00:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltraStar Deluxe
[2012/03/01 10:00:19 | 000,000,000 | ---D | C] -- C:\Users\Adik\AppData\Roaming\ultrastardx
[2012/03/01 10:00:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\UltraStar Deluxe
[2012/03/01 09:00:32 | 000,000,000 | ---D | C] -- C:\Users\Adik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UltraStar
[2012/03/01 09:00:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltraStar
[2012/03/01 09:00:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\UltraStar
[1 C:\Users\Adik\Desktop\*.tmp files -> C:\Users\Adik\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/03/21 13:03:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/03/21 13:03:22 | 3220,623,360 | -HS- | M] () -- C:\hiberfil.sys
[2012/03/20 15:10:52 | 000,010,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/03/20 15:10:52 | 000,010,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/03/20 12:50:00 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2616729836-2362613055-2871255851-1001UA.job
[2012/03/20 05:42:51 | 000,001,950 | ---- | M] () -- C:\Windows\System32\AutoRunFilter.ini
[2012/03/20 05:40:24 | 000,323,584 | ---- | M] (lpsjJ) -- C:\Users\Adik\AppData\Roaming\gw45u45111.exe
[2012/03/19 13:33:51 | 000,697,082 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012/03/19 13:33:51 | 000,652,360 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/03/19 13:33:51 | 000,148,346 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012/03/19 13:33:51 | 000,121,292 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/03/19 09:57:14 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2616729836-2362613055-2871255851-1001Core.job
[2012/03/19 08:42:23 | 000,001,349 | ---- | M] () -- C:\Windows\System32\ServiceFilter.ini
[2012/03/18 19:09:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HTC
[2012/03/15 12:53:24 | 000,434,032 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/03/14 18:09:49 | 000,226,231 | ---- | M] () -- C:\Users\Adik\Desktop\Fehlerhafte Bauteile.png
[2012/03/14 18:07:37 | 007,193,250 | ---- | M] () -- C:\Users\Adik\Desktop\Fehlerhafte Bauteile.pdf
[2012/03/14 17:51:19 | 000,007,771 | ---- | M] () -- C:\Users\Adik\Desktop\Rechnung_358281.pdf
[2012/03/14 14:51:33 | 000,002,399 | ---- | M] () -- C:\Users\Adik\Desktop\Google Chrome.lnk
[2012/03/01 15:52:41 | 000,000,996 | ---- | M] () -- C:\Users\Adik\Desktop\WBFS Manager 3.0.lnk
[2012/03/01 10:44:13 | 000,001,084 | ---- | M] () -- C:\Users\Public\Desktop\UltraStar Deluxe spielen.lnk
[2012/03/01 10:00:31 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltraStar Deluxe
[2012/03/01 09:00:32 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltraStar
[1 C:\Users\Adik\Desktop\*.tmp files -> C:\Users\Adik\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/03/14 18:09:49 | 000,226,231 | ---- | C] () -- C:\Users\Adik\Desktop\Fehlerhafte Bauteile.png
[2012/03/14 17:51:18 | 000,007,771 | ---- | C] () -- C:\Users\Adik\Desktop\Rechnung_358281.pdf
[2012/03/11 15:47:19 | 007,193,250 | ---- | C] () -- C:\Users\Adik\Desktop\Fehlerhafte Bauteile.pdf
[2012/03/01 16:53:28 | 000,000,919 | ---- | C] () -- C:\Users\Adik\Desktop\Steam.lnk
[2012/03/01 10:44:13 | 000,001,084 | ---- | C] () -- C:\Users\Public\Desktop\UltraStar Deluxe spielen.lnk
[2011/05/01 15:59:28 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011/04/09 12:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011/04/02 20:06:22 | 000,003,584 | ---- | C] () -- C:\Users\Adik\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/02 17:10:26 | 001,591,234 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/02/19 19:02:29 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini
[2011/02/19 11:47:43 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini
[2009/07/29 01:21:06 | 000,024,576 | ---- | C] () -- C:\ProgramData\SetWallpaper.exe
[2009/07/29 01:21:06 | 000,000,223 | ---- | C] () -- C:\ProgramData\setwallpaper.cmd
[2009/07/29 01:20:40 | 000,000,010 | ---- | C] () -- C:\Windows\SysWow64\ABLKSR.ini
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 20:02:54 | 000,245,248 | ---- | C] () -- C:\Windows\SysWow64\DShowRdpFilter.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- C:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2011/08/30 16:44:17 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\.minecraft
[2011/04/02 16:34:24 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\Audacity
[2011/04/02 17:59:43 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\Banamalon
[2012/02/15 13:49:36 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\calibre
[2012/02/12 11:31:39 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\Canon
[2011/12/06 10:51:33 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\CD-LabelPrint
[2011/02/27 15:44:53 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\DAEMON Tools Lite
[2011/10/12 13:01:11 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\Dropbox
[2011/03/19 17:41:08 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\GrabPro
[2011/03/24 13:35:10 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\ImgBurn
[2012/01/30 12:23:24 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\Nokia
[2011/11/29 09:16:14 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\Notepad++
[2011/03/28 14:02:44 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\OpenOffice.org
[2011/03/19 17:46:27 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\Orbit
[2011/04/02 14:49:13 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\PACE Anti-Piracy
[2012/01/30 12:24:34 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\PC Suite
[2011/03/19 17:33:56 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\ProgSense
[2011/02/19 20:09:58 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\TS3Client
[2012/03/10 15:29:53 | 000,000,000 | ---D | M] -- C:\Users\Adik\AppData\Roaming\ultrastardx
[2011/02/19 18:25:37 | 000,000,000 | ---D | M] -- C:\ProgramData\AmUStor
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2011/08/04 07:27:44 | 000,000,000 | ---D | M] -- C:\ProgramData\Banamalon
[2011/12/06 10:49:31 | 000,000,000 | ---D | M] -- C:\ProgramData\Canon IJ Network Tool
[2011/12/06 10:42:49 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonBJ
[2011/12/06 10:51:14 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonEPP
[2012/02/12 11:32:11 | 000,000,000 | ---D | M] -- C:\ProgramData\CanonIJ
[2011/12/06 10:51:14 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonIJEPPEX2
[2011/12/06 10:48:52 | 000,000,000 | ---D | M] -- C:\ProgramData\CanonIJMSetup
[2011/12/06 12:00:51 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonIJMyPrinter
[2012/03/07 07:02:09 | 000,000,000 | ---D | M] -- C:\ProgramData\CanonIJPLM
[2012/02/12 11:31:39 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonIJScan
[2011/12/06 12:00:53 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonIJSolutionMenuEX
[2011/12/06 10:48:11 | 000,000,000 | ---D | M] -- C:\ProgramData\CanonIJWSpt
[2011/02/27 15:41:16 | 000,000,000 | ---D | M] -- C:\ProgramData\DAEMON Tools Lite
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2011/04/05 16:02:14 | 000,000,000 | ---D | M] -- C:\ProgramData\ICQ
[2011/04/03 15:49:51 | 000,000,000 | ---D | M] -- C:\ProgramData\KONAMI
[2011/02/19 20:08:54 | 000,000,000 | ---D | M] -- C:\ProgramData\LightScribe
[2011/11/19 19:19:13 | 000,000,000 | ---D | M] -- C:\ProgramData\Nokia
[2011/11/19 19:17:31 | 000,000,000 | ---D | M] -- C:\ProgramData\NokiaInstallerCache
[2011/02/19 18:26:04 | 000,000,000 | ---D | M] -- C:\ProgramData\P4G
[2011/04/02 14:49:13 | 000,000,000 | ---D | M] -- C:\ProgramData\PACE Anti-Piracy
[2011/11/19 19:21:09 | 000,000,000 | ---D | M] -- C:\ProgramData\PC Suite
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2011/02/19 13:14:28 | 000,000,000 | ---D | M] -- C:\ProgramData\Temp
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2011/12/14 08:22:52 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 1133 bytes -> C:\Users\Adik\AppData\Local\Anwendungsdaten:RuTpLbKOMDrSwp1WkPpu
@Alternate Data Stream - 1133 bytes -> C:\Users\Adik\AppData\Local:RuTpLbKOMDrSwp1WkPpu
@Alternate Data Stream - 1112 bytes -> C:\Users\Adik\AppData\Local\V9L4g7qjRByoI:l3xN3eeoTwxtmFtrIn6xu6
@Alternate Data Stream - 1080 bytes -> C:\Users\Adik\AppData\Local\Temp:rYv3Jet8zmyRh6bYz44tJd
< End of report >
--- --- ---


OTL Logfile:
Code:
OTL Extras logfile created on: 3/21/2012 9:08:39 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium  (Version = 6.1.7600) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 87.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 95.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 232.88 Gb Total Space | 144.47 Gb Free Space | 62.04% Space Free | Partition Type: NTFS
Drive D: | 218.23 Gb Total Space | 124.13 Gb Free Space | 56.88% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\System32\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5200_series" = Canon MG5200 series MP Drivers
"{13F4A7F3-EABC-4261-AF6B-1317777F0755}" = Fast Boot
"{26A24AE4-039D-4CA4-87B4-2F86417000FF}" = Java(TM) 7 (64-bit)
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}" = Paint.NET v3.5.10
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{64A3A4F4-B792-11D6-A78A-00B0D0170000}" = Java(TM) SE Development Kit 7 (64-bit)
"{680EDA59-9266-44B4-949E-0C24F65DFF82}" = Microsoft_VC100_CRT_SP1_x64
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{91EFE3A1-585E-4F66-B5F6-F118F56C4C47}" = ASUS Power4Gear Hybrid
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64
"{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}" = SRS Premium Sound Control Panel
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"Elantech" = ETDWare PS/2-x64 7.0.5.7_WHQL
"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"NVIDIA Drivers" = NVIDIA Drivers
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver Drive" = Samsung Mobile phone USB driver Drive Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5200_series" = Canon MG5200 series MP Drivers
"{13F4A7F3-EABC-4261-AF6B-1317777F0755}" = Fast Boot
"{26A24AE4-039D-4CA4-87B4-2F86417000FF}" = Java(TM) 7 (64-bit)
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}" = Paint.NET v3.5.10
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{64A3A4F4-B792-11D6-A78A-00B0D0170000}" = Java(TM) SE Development Kit 7 (64-bit)
"{680EDA59-9266-44B4-949E-0C24F65DFF82}" = Microsoft_VC100_CRT_SP1_x64
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{91EFE3A1-585E-4F66-B5F6-F118F56C4C47}" = ASUS Power4Gear Hybrid
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64
"{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}" = SRS Premium Sound Control Panel
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"Elantech" = ETDWare PS/2-x64 7.0.5.7_WHQL
"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"NVIDIA Drivers" = NVIDIA Drivers
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver Drive" = Samsung Mobile phone USB driver Drive Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"WinRAR archiver" = WinRAR
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\Adik_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
 
< End of report >
--- --- ---

[/QUOTE]

cosinus 22.03.2012 11:38
Mach einen OTL-Fix über OTLPE, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE - HKU\Adik_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_ss&mntrId=be8fa71e000000000000e0cb4e10c948&tlver=1.4.19.19&ss=1&affID=17395
IE - HKU\Adik_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
IE - HKU\Adik_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Adik_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 30 52 B2 05 81 F1 CB 01  [binary data]
IE - HKU\Adik_ON_C\..\URLSearchHook:  - Reg Error: Key error. File not found
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "YouTube-Videosuche"
FF - prefs.js..keyword.URL: "http://search.babylon.com/?babsrc=SP_ss&mntrId=be8fa71e000000000000e0cb4e10c948&tlver=1.4.19.19&instlRef=sst&ss=1&affID=17395&q="
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
[2011/05/24 13:19:02 | 000,002,428 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\Adik_ON_C\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O4 - HKU\Adik_ON_C..\Run: []  File not found
O4 - HKU\Adik_ON_C..\Run: [4rJHeEXlxs54kFa] C:\Users\Adik\AppData\Roaming\gw45u45111.exe (lpsjJ)
O4 - HKU\LocalService_ON_C..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_C..\RunOnce: [mctadmin]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\Adik_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Adik_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Adik_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O20 - HKU\Adik_ON_C Winlogon: Shell - (C:\Users\Adik\AppData\Roaming\gw45u45111.exe) - C:\Users\Adik\AppData\Roaming\gw45u45111.exe (lpsjJ)
O20 - HKU\Adik_ON_C Winlogon: UserInit - (C:\Users\Adik\AppData\Roaming\gw45u45111.exe) - C:\Users\Adik\AppData\Roaming\gw45u45111.exe (lpsjJ)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{2e063918-5e24-11e0-a25e-e0cb4e10c948}\Shell - "" = AutoRun
O33 - MountPoints2\{2e063918-5e24-11e0-a25e-e0cb4e10c948}\Shell\AutoRun\command - "" = "F:\WD SmartWare.exe" autoplay=true
O33 - MountPoints2\{a04e5898-48dd-11e0-9657-e0cb4e10c948}\Shell - "" = AutoRun
O33 - MountPoints2\{a04e5898-48dd-11e0-9657-e0cb4e10c948}\Shell\AutoRun\command - "" = I:\autorun.exe
@Alternate Data Stream - 1133 bytes -> C:\Users\Adik\AppData\Local\Anwendungsdaten:RuTpLbKOMDrSwp1WkPpu
@Alternate Data Stream - 1133 bytes -> C:\Users\Adik\AppData\Local:RuTpLbKOMDrSwp1WkPpu
@Alternate Data Stream - 1112 bytes -> C:\Users\Adik\AppData\Local\V9L4g7qjRByoI:l3xN3eeoTwxtmFtrIn6xu6
@Alternate Data Stream - 1080 bytes -> C:\Users\Adik\AppData\Local\Temp:rYv3Jet8zmyRh6bYz44tJd
:Files
C:\Users\Adik\AppData\Roaming\gw45u45111.exe
:Commands
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Danach sollte Windows wieder normal starten - stell uns bitte den Quarantäneordner von OTL zur Verfügung. Dabei bitte so vorgehen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinträchtigen!
2.) Ordner movedfiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html
4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

adik4all 23.03.2012 15:16
Hallo Arne vielen vielen Dank für deine Hilfe,

ich habe deine Anweisung befolgt und das Zip hochgeladen.

Ist mein Rechner jetzt wieder "sauber" oder gibt es noch etwas zu tun?

Soll ich den Rechner sicherheitshalber formatieren?

Zuletzt stelle ich mir die Frage, mein Antiviren-Programm zu wechseln, da ich zuvor Antivir benutzt habe und dieses den Virus ja nicht entdeckt hat. Kennst du eine gute Preiswerte Alternative?

Riesen Dank!!!


Hier noch die FIX-Log:

Code:
:OTL
IE - HKU\Adik_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?babsrc=HP_ss&mntrId=be8fa71e000000000000e0cb4e10c948&tlver=1.4.19.19&ss=1&affID=17395
IE - HKU\Adik_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Adik_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Adik_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 30 52 B2 05 81 F1 CB 01  [binary data]
IE - HKU\Adik_ON_C\..\URLSearchHook:  - Reg Error: Key error. File not found
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "YouTube-Videosuche"
FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?babsrc=SP_ss&mntrId=be8fa71e000000000000e0cb4e10c948&tlver=1.4.19.19&instlRef=sst&ss=1&affID=17395&q="
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
[2011/05/24 13:19:02 | 000,002,428 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\Adik_ON_C\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O4 - HKU\Adik_ON_C..\Run: []  File not found
O4 - HKU\Adik_ON_C..\Run: [4rJHeEXlxs54kFa] C:\Users\Adik\AppData\Roaming\gw45u45111.exe (lpsjJ)
O4 - HKU\LocalService_ON_C..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_C..\RunOnce: [mctadmin]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\Adik_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Adik_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Adik_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O20 - HKU\Adik_ON_C Winlogon: Shell - (C:\Users\Adik\AppData\Roaming\gw45u45111.exe) - C:\Users\Adik\AppData\Roaming\gw45u45111.exe (lpsjJ)
O20 - HKU\Adik_ON_C Winlogon: UserInit - (C:\Users\Adik\AppData\Roaming\gw45u45111.exe) - C:\Users\Adik\AppData\Roaming\gw45u45111.exe (lpsjJ)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{2e063918-5e24-11e0-a25e-e0cb4e10c948}\Shell - "" = AutoRun
O33 - MountPoints2\{2e063918-5e24-11e0-a25e-e0cb4e10c948}\Shell\AutoRun\command - "" = "F:\WD SmartWare.exe" autoplay=true
O33 - MountPoints2\{a04e5898-48dd-11e0-9657-e0cb4e10c948}\Shell - "" = AutoRun
O33 - MountPoints2\{a04e5898-48dd-11e0-9657-e0cb4e10c948}\Shell\AutoRun\command - "" = I:\autorun.exe
@Alternate Data Stream - 1133 bytes -> C:\Users\Adik\AppData\Local\Anwendungsdaten:RuTpLbKOMDrSwp1WkPpu
@Alternate Data Stream - 1133 bytes -> C:\Users\Adik\AppData\Local:RuTpLbKOMDrSwp1WkPpu
@Alternate Data Stream - 1112 bytes -> C:\Users\Adik\AppData\Local\V9L4g7qjRByoI:l3xN3eeoTwxtmFtrIn6xu6
@Alternate Data Stream - 1080 bytes -> C:\Users\Adik\AppData\Local\Temp:rYv3Jet8zmyRh6bYz44tJd
:Files
C:\Users\Adik\AppData\Roaming\gw45u45111.exe
:Commands
[resethosts]

cosinus 23.03.2012 21:40
Zitat:
Soll ich den Rechner sicherheitshalber formatieren?
Entweder oder! Entscheide dich für eine Berenigung oder eine Neuinstalaltion, aber man macht keine sinnfreie aufwändige Analyse wenn du eh alles plätten willst.
Und du hast kein Fixlog gepostet, sondern mein Fixscript!

adik4all 24.03.2012 12:22
Hi Arne,

klingt logisch. Es ist in meinem Interesse, den PC nicht zu formatieren. Ich kenne mich in diesem Bereich nicht aus, deshalb frage ich hier ja um Hilfe.

Sorry für das falsche File, hatte wohl einen Kopierfehler. Anbei das fix-log.

Wie geht's jetzt weiter?

Code:
========== OTL ==========
HKU\Adik_ON_C\Software\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\Adik_ON_C\Software\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
HKU\Adik_ON_C\Software\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!
HKU\Adik_ON_C\Software\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!
Registry value HKEY_USERS\Adik_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: "YouTube-Videosuche" removed from browser.search.selectedEngine
Prefs.js: "hxxp://search.babylon.com/?babsrc=SP_ss&mntrId=be8fa71e000000000000e0cb4e10c948&tlver=1.4.19.19&instlRef=sst&ss=1&affID=17395&q=" removed from keyword.URL
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0\ deleted successfully.
File C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) not found.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0\ deleted successfully.
File C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) not found.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0\ deleted successfully.
File C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) not found.
C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{326E768D-4182-46FD-9C16-1449A49795F4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{326E768D-4182-46FD-9C16-1449A49795F4}\ deleted successfully.
C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3785D0AD-BFFF-47F6-BF5B-A587C162FED9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3785D0AD-BFFF-47F6-BF5B-A587C162FED9}\ deleted successfully.
C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll moved successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{759D9886-0C6F-4498-BAB6-4A5F47C6C72F}\ deleted successfully.
File WebPrint EX\ewpexhlp.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_USERS\Adik_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{759D9886-0C6F-4498-BAB6-4A5F47C6C72F}\ not found.
File WebPrint EX\ewpexhlp.dll not found.
Registry key HKEY_USERS\Adik_ON_C\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_USERS\Adik_ON_C\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run not found.
C:\Users\Adik\AppData\Roaming\gw45u45111.exe moved successfully.
Registry key HKEY_USERS\LocalService_ON_C\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce not found.
Registry key HKEY_USERS\NetworkService_ON_C\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_USERS\Adik_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDesktop deleted successfully.
Registry value HKEY_USERS\Adik_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr deleted successfully.
Registry value HKEY_USERS\Adik_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully.
Registry value HKEY_USERS\Adik_ON_C\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\Adik\AppData\Roaming\gw45u45111.exe deleted successfully.
File C:\Users\Adik\AppData\Roaming\gw45u45111.exe not found.
Registry value HKEY_USERS\Adik_ON_C\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:\Users\Adik\AppData\Roaming\gw45u45111.exe deleted successfully.
File C:\Users\Adik\AppData\Roaming\gw45u45111.exe not found.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2e063918-5e24-11e0-a25e-e0cb4e10c948}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2e063918-5e24-11e0-a25e-e0cb4e10c948}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2e063918-5e24-11e0-a25e-e0cb4e10c948}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2e063918-5e24-11e0-a25e-e0cb4e10c948}\ not found.
File "F:\WD SmartWare.exe" autoplay=true not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a04e5898-48dd-11e0-9657-e0cb4e10c948}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a04e5898-48dd-11e0-9657-e0cb4e10c948}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a04e5898-48dd-11e0-9657-e0cb4e10c948}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a04e5898-48dd-11e0-9657-e0cb4e10c948}\ not found.
File I:\autorun.exe not found.
Unable to delete ADS C:\Users\Adik\AppData\Local\Anwendungsdaten:RuTpLbKOMDrSwp1WkPpu .
ADS C:\Users\Adik\AppData\Local:RuTpLbKOMDrSwp1WkPpu deleted successfully.
ADS C:\Users\Adik\AppData\Local\V9L4g7qjRByoI:l3xN3eeoTwxtmFtrIn6xu6 deleted successfully.
ADS C:\Users\Adik\AppData\Local\Temp:rYv3Jet8zmyRh6bYz44tJd deleted successfully.
========== FILES ==========
File\Folder C:\Users\Adik\AppData\Roaming\gw45u45111.exe not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTLPE by OldTimer - Version 3.1.48.0 log created on 03232012_164717
Gruß Adik

cosinus 24.03.2012 18:44
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

adik4all 25.03.2012 12:25
Hallo Arne, anbei der Report von Kaspersky
Code:
13:21:00.0710 2944        TDSS rootkit removing tool 2.7.22.0 Mar 21 2012 17:40:00
13:21:00.0813 2944        ============================================================
13:21:00.0813 2944        Current date / time: 2012/03/25 13:21:00.0813
13:21:00.0813 2944        SystemInfo:
13:21:00.0813 2944       
13:21:00.0813 2944        OS Version: 6.1.7600 ServicePack: 0.0
13:21:00.0813 2944        Product type: Workstation
13:21:00.0814 2944        ComputerName: ADIK-PC
13:21:00.0814 2944        UserName: Adik
13:21:00.0814 2944        Windows directory: C:\Windows
13:21:00.0814 2944        System windows directory: C:\Windows
13:21:00.0814 2944        Running under WOW64
13:21:00.0814 2944        Processor architecture: Intel x64
13:21:00.0814 2944        Number of processors: 2
13:21:00.0814 2944        Page size: 0x1000
13:21:00.0814 2944        Boot type: Normal boot
13:21:00.0814 2944        ============================================================
13:21:01.0392 2944        Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
13:21:01.0396 2944        \Device\Harddisk0\DR0:
13:21:01.0397 2944        MBR used
13:21:01.0397 2944        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1D4B800, BlocksNum 0x1D1C3000
13:21:01.0412 2944        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1EF0F000, BlocksNum 0x1B476800
13:21:01.0496 2944        Initialize success
13:21:01.0496 2944        ============================================================
13:21:49.0883 3924        ============================================================
13:21:49.0883 3924        Scan started
13:21:49.0883 3924        Mode: Manual;
13:21:49.0883 3924        ============================================================
13:21:50.0282 3924        1394ohci        (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys
13:21:50.0287 3924        1394ohci - ok
13:21:50.0419 3924        ACDaemon        (adc420616c501b45d26c0fd3ef1e54e4) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
13:21:50.0420 3924        ACDaemon - ok
13:21:50.0513 3924        ACPI            (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys
13:21:50.0517 3924        ACPI - ok
13:21:50.0544 3924        AcpiPmi        (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys
13:21:50.0546 3924        AcpiPmi - ok
13:21:50.0581 3924        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
13:21:50.0588 3924        adp94xx - ok
13:21:50.0623 3924        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
13:21:50.0628 3924        adpahci - ok
13:21:50.0649 3924        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
13:21:50.0653 3924        adpu320 - ok
13:21:50.0689 3924        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
13:21:50.0690 3924        AeLookupSvc - ok
13:21:50.0732 3924        AFBAgent        (fb2be0bae9b3f248080cdbf91ef16c7f) C:\Windows\system32\FBAgent.exe
13:21:50.0735 3924        AFBAgent - ok
13:21:50.0790 3924        AFD            (db9d6c6b2cd95a9ca414d045b627422e) C:\Windows\system32\drivers\afd.sys
13:21:50.0795 3924        AFD - ok
13:21:50.0839 3924        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys
13:21:50.0842 3924        agp440 - ok
13:21:50.0914 3924        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
13:21:50.0915 3924        ALG - ok
13:21:50.0960 3924        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys
13:21:50.0963 3924        aliide - ok
13:21:50.0995 3924        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys
13:21:50.0997 3924        amdide - ok
13:21:51.0030 3924        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
13:21:51.0032 3924        AmdK8 - ok
13:21:51.0053 3924        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
13:21:51.0056 3924        AmdPPM - ok
13:21:51.0100 3924        amdsata        (ec7ebab00a4d8448bab68d1e49b4beb9) C:\Windows\system32\drivers\amdsata.sys
13:21:51.0103 3924        amdsata - ok
13:21:51.0139 3924        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
13:21:51.0143 3924        amdsbs - ok
13:21:51.0172 3924        amdxata        (db27766102c7bf7e95140a2aa81d042e) C:\Windows\system32\drivers\amdxata.sys
13:21:51.0172 3924        amdxata - ok
13:21:51.0226 3924        AmUStor        (9c7f164b49cadc658d1b3c575782f346) C:\Windows\system32\drivers\AmUStor.SYS
13:21:51.0228 3924        AmUStor - ok
13:21:51.0318 3924        AntiVirSchedulerService (a122d68ea2541453f787f341877cb40b) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
13:21:51.0319 3924        AntiVirSchedulerService - ok
13:21:51.0357 3924        AntiVirService  (2fe359edeb34efcf42574752f8aebd3f) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
13:21:51.0358 3924        AntiVirService - ok
13:21:51.0460 3924        AppID          (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys
13:21:51.0462 3924        AppID - ok
13:21:51.0463 3924        Scan interrupted by user!
13:21:51.0463 3924        Scan interrupted by user!
13:21:51.0463 3924        Scan interrupted by user!
13:21:51.0463 3924        ============================================================
13:21:51.0464 3924        Scan finished
13:21:51.0464 3924        ============================================================
13:21:51.0472 2268        Detected object count: 0
13:21:51.0472 2268        Actual detected object count: 0
13:22:36.0267 2684        ============================================================
13:22:36.0267 2684        Scan started
13:22:36.0267 2684        Mode: Manual; SigCheck; TDLFS;
13:22:36.0267 2684        ============================================================
13:22:36.0540 2684        1394ohci        (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys
13:22:36.0612 2684        1394ohci - ok
13:22:36.0721 2684        ACDaemon        (adc420616c501b45d26c0fd3ef1e54e4) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
13:22:37.0376 2684        ACDaemon - ok
13:22:37.0465 2684        ACPI            (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys
13:22:37.0480 2684        ACPI - ok
13:22:37.0496 2684        AcpiPmi        (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys
13:22:37.0531 2684        AcpiPmi - ok
13:22:37.0588 2684        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
13:22:37.0606 2684        adp94xx - ok
13:22:37.0636 2684        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
13:22:37.0651 2684        adpahci - ok
13:22:37.0733 2684        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
13:22:37.0746 2684        adpu320 - ok
13:22:37.0795 2684        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
13:22:37.0844 2684        AeLookupSvc - ok
13:22:37.0915 2684        AFBAgent        (fb2be0bae9b3f248080cdbf91ef16c7f) C:\Windows\system32\FBAgent.exe
13:22:37.0929 2684        AFBAgent - ok
13:22:37.0984 2684        AFD            (db9d6c6b2cd95a9ca414d045b627422e) C:\Windows\system32\drivers\afd.sys
13:22:38.0016 2684        AFD - ok
13:22:38.0099 2684        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys
13:22:38.0110 2684        agp440 - ok
13:22:38.0163 2684        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
13:22:38.0190 2684        ALG - ok
13:22:38.0253 2684        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys
13:22:38.0264 2684        aliide - ok
13:22:38.0275 2684        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys
13:22:38.0285 2684        amdide - ok
13:22:38.0297 2684        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
13:22:38.0339 2684        AmdK8 - ok
13:22:38.0380 2684        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
13:22:38.0414 2684        AmdPPM - ok
13:22:38.0470 2684        amdsata        (ec7ebab00a4d8448bab68d1e49b4beb9) C:\Windows\system32\drivers\amdsata.sys
13:22:38.0481 2684        amdsata - ok
13:22:38.0520 2684        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
13:22:38.0533 2684        amdsbs - ok
13:22:38.0564 2684        amdxata        (db27766102c7bf7e95140a2aa81d042e) C:\Windows\system32\drivers\amdxata.sys
13:22:38.0574 2684        amdxata - ok
13:22:38.0640 2684        AmUStor        (9c7f164b49cadc658d1b3c575782f346) C:\Windows\system32\drivers\AmUStor.SYS
13:22:38.0683 2684        AmUStor - ok
13:22:38.0754 2684        AntiVirSchedulerService (a122d68ea2541453f787f341877cb40b) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
13:22:38.0777 2684        AntiVirSchedulerService - ok
13:22:38.0793 2684        AntiVirService  (2fe359edeb34efcf42574752f8aebd3f) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
13:22:38.0802 2684        AntiVirService - ok
13:22:38.0874 2684        AppID          (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys
13:22:38.0919 2684        AppID - ok
13:22:38.0962 2684        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
13:22:39.0006 2684        AppIDSvc - ok
13:22:39.0081 2684        Appinfo        (d065be66822847b7f127d1f90158376e) C:\Windows\System32\appinfo.dll
13:22:39.0122 2684        Appinfo - ok
13:22:39.0185 2684        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
13:22:39.0198 2684        arc - ok
13:22:39.0231 2684        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
13:22:39.0244 2684        arcsas - ok
13:22:39.0357 2684        ASLDRService    (18e5c2f937f9deb8c282df66a3761925) C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe
13:22:39.0366 2684        ASLDRService - ok
13:22:39.0477 2684        aspnet_state    (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
13:22:39.0486 2684        aspnet_state - ok
13:22:39.0540 2684        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
13:22:39.0588 2684        AsyncMac - ok
13:22:39.0613 2684        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys
13:22:39.0623 2684        atapi - ok
13:22:39.0678 2684        athr            (0acc06fcf46f64ed4f11e57ee461c1f4) C:\Windows\system32\DRIVERS\athrx.sys
13:22:39.0752 2684        athr - ok
13:22:39.0859 2684        AudioEndpointBuilder (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll
13:22:39.0904 2684        AudioEndpointBuilder - ok
13:22:39.0916 2684        AudioSrv        (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll
13:22:39.0960 2684        AudioSrv - ok
13:22:40.0092 2684        avgntflt        (aa8f79a1bdfc03b3bc70c44ab00589b4) C:\Windows\system32\DRIVERS\avgntflt.sys
13:22:40.0101 2684        avgntflt - ok
13:22:40.0175 2684        avipbb          (852e3c0a60d368c487949e55ad52a47f) C:\Windows\system32\DRIVERS\avipbb.sys
13:22:40.0184 2684        avipbb - ok
13:22:40.0265 2684        avkmgr          (248db59fc86de44d2779f4c7fb1a567d) C:\Windows\system32\DRIVERS\avkmgr.sys
13:22:40.0273 2684        avkmgr - ok
13:22:40.0355 2684        AxInstSV        (b20b5fa5ca050e9926e4d1db81501b32) C:\Windows\System32\AxInstSV.dll
13:22:40.0388 2684        AxInstSV - ok
13:22:40.0448 2684        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
13:22:40.0486 2684        b06bdrv - ok
13:22:40.0580 2684        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
13:22:40.0614 2684        b57nd60a - ok
13:22:40.0669 2684        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
13:22:40.0701 2684        BDESVC - ok
13:22:40.0797 2684        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
13:22:40.0852 2684        Beep - ok
13:22:40.0949 2684        BFE            (4992c609a6315671463e30f6512bc022) C:\Windows\System32\bfe.dll
13:22:41.0015 2684        BFE - ok
13:22:41.0073 2684        BITS            (7f0c323fe3da28aa4aa1bda3f575707f) C:\Windows\System32\qmgr.dll
13:22:41.0145 2684        BITS - ok
13:22:41.0237 2684        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
13:22:41.0289 2684        blbdrive - ok
13:22:41.0370 2684        bowser          (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys
13:22:41.0399 2684        bowser - ok
13:22:41.0452 2684        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
13:22:41.0480 2684        BrFiltLo - ok
13:22:41.0505 2684        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
13:22:41.0521 2684        BrFiltUp - ok
13:22:41.0560 2684        Browser        (94fbc06f294d58d02361918418f996e3) C:\Windows\System32\browser.dll
13:22:41.0612 2684        Browser - ok
13:22:41.0662 2684        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
13:22:41.0687 2684        Brserid - ok
13:22:41.0697 2684        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
13:22:41.0722 2684        BrSerWdm - ok
13:22:41.0816 2684        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
13:22:41.0853 2684        BrUsbMdm - ok
13:22:41.0863 2684        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
13:22:41.0890 2684        BrUsbSer - ok
13:22:42.0150 2684        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
13:22:42.0199 2684        BTHMODEM - ok
13:22:42.0311 2684        bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
13:22:42.0412 2684        bthserv - ok
13:22:42.0543 2684        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
13:22:42.0595 2684        cdfs - ok
13:22:42.0708 2684        cdrom          (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys
13:22:42.0741 2684        cdrom - ok
13:22:42.0810 2684        CertPropSvc    (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll
13:22:42.0864 2684        CertPropSvc - ok
13:22:42.0951 2684        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
13:22:42.0967 2684        circlass - ok
13:22:43.0024 2684        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
13:22:43.0043 2684        CLFS - ok
13:22:43.0111 2684        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
13:22:43.0121 2684        clr_optimization_v2.0.50727_32 - ok
13:22:43.0173 2684        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
13:22:43.0182 2684        clr_optimization_v2.0.50727_64 - ok
13:22:43.0305 2684        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
13:22:43.0315 2684        clr_optimization_v4.0.30319_32 - ok
13:22:43.0362 2684        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
13:22:43.0372 2684        clr_optimization_v4.0.30319_64 - ok
13:22:43.0470 2684        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
13:22:43.0496 2684        CmBatt - ok
13:22:43.0515 2684        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys
13:22:43.0527 2684        cmdide - ok
13:22:43.0574 2684        CNG            (937beb186a735aca91d717044a49d17e) C:\Windows\system32\Drivers\cng.sys
13:22:43.0612 2684        CNG - ok
13:22:43.0681 2684        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
13:22:43.0692 2684        Compbatt - ok
13:22:43.0740 2684        CompositeBus    (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys
13:22:43.0771 2684        CompositeBus - ok
13:22:43.0819 2684        COMSysApp - ok
13:22:43.0861 2684        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
13:22:43.0873 2684        crcdisk - ok
13:22:43.0920 2684        CryptSvc        (8c57411b66282c01533cb776f98ad384) C:\Windows\system32\cryptsvc.dll
13:22:43.0970 2684        CryptSvc - ok
13:22:44.0071 2684        DcomLaunch      (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll
13:22:44.0123 2684        DcomLaunch - ok
13:22:44.0238 2684        defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
13:22:44.0293 2684        defragsvc - ok
13:22:44.0331 2684        DfsC            (9c253ce7311ca60fc11c774692a13208) C:\Windows\system32\Drivers\dfsc.sys
13:22:44.0356 2684        DfsC - ok
13:22:44.0408 2684        Dhcp            (ce3b9562d997f69b330d181a8875960f) C:\Windows\system32\dhcpcore.dll
13:22:44.0442 2684        Dhcp - ok
13:22:44.0483 2684        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
13:22:44.0531 2684        discache - ok
13:22:44.0620 2684        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
13:22:44.0632 2684        Disk - ok
13:22:44.0682 2684        Dnscache        (85cf424c74a1d5ec33533e1dbff9920a) C:\Windows\System32\dnsrslvr.dll
13:22:44.0717 2684        Dnscache - ok
13:22:44.0749 2684        dot3svc        (14452acdb09b70964c8c21bf80a13acb) C:\Windows\System32\dot3svc.dll
13:22:44.0807 2684        dot3svc - ok
13:22:44.0859 2684        DPS            (8c2ba6bea949ee6e68385f5692bafb94) C:\Windows\system32\dps.dll
13:22:44.0909 2684        DPS - ok
13:22:44.0992 2684        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
13:22:45.0015 2684        drmkaud - ok
13:22:45.0081 2684        DXGKrnl        (1633b9abf52784a1331476397a48cbef) C:\Windows\System32\drivers\dxgkrnl.sys
13:22:45.0105 2684        DXGKrnl - ok
13:22:45.0132 2684        EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
13:22:45.0183 2684        EapHost - ok
13:22:45.0298 2684        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
13:22:45.0416 2684        ebdrv - ok
13:22:45.0505 2684        EFS            (156f6159457d0aa7e59b62681b56eb90) C:\Windows\System32\lsass.exe
13:22:45.0527 2684        EFS - ok
13:22:45.0584 2684        ehRecvr        (47c071994c3f649f23d9cd075ac9304a) C:\Windows\ehome\ehRecvr.exe
13:22:45.0619 2684        ehRecvr - ok
13:22:45.0644 2684        ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
13:22:45.0675 2684        ehSched - ok
13:22:45.0792 2684        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
13:22:45.0814 2684        elxstor - ok
13:22:45.0825 2684        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys
13:22:45.0858 2684        ErrDev - ok
13:22:45.0981 2684        ETD            (1299d1ea00b7a4bf69c5869dca31e0f6) C:\Windows\system32\DRIVERS\ETD.sys
13:22:45.0994 2684        ETD - ok
13:22:46.0037 2684        EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
13:22:46.0091 2684        EventSystem - ok
13:22:46.0190 2684        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
13:22:46.0245 2684        exfat - ok
13:22:46.0276 2684        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
13:22:46.0332 2684        fastfat - ok
13:22:46.0432 2684        Fax            (d607b2f1bee3992aa6c2c92c0a2f0855) C:\Windows\system32\fxssvc.exe
13:22:46.0475 2684        Fax - ok
13:22:46.0557 2684        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
13:22:46.0586 2684        fdc - ok
13:22:46.0624 2684        fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
13:22:46.0661 2684        fdPHost - ok
13:22:46.0678 2684        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
13:22:46.0731 2684        FDResPub - ok
13:22:46.0802 2684        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
13:22:46.0814 2684        FileInfo - ok
13:22:46.0831 2684        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
13:22:46.0878 2684        Filetrace - ok
13:22:46.0912 2684        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
13:22:46.0938 2684        flpydisk - ok
13:22:46.0969 2684        FltMgr          (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys
13:22:46.0985 2684        FltMgr - ok
13:22:47.0032 2684        FontCache      (cb5e4b9c319e3c6bb363eb7e58a4a051) C:\Windows\system32\FntCache.dll
13:22:47.0096 2684        FontCache - ok
13:22:47.0157 2684        FontCache3.0.0.0 (8d89e3131c27fdd6932189cb785e1b7a) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
13:22:47.0165 2684        FontCache3.0.0.0 - ok
13:22:47.0212 2684        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
13:22:47.0224 2684        FsDepends - ok
13:22:47.0236 2684        Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
13:22:47.0247 2684        Fs_Rec - ok
13:22:47.0305 2684        fvevol          (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys
13:22:47.0322 2684        fvevol - ok
13:22:47.0352 2684        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
13:22:47.0364 2684        gagp30kx - ok
13:22:47.0406 2684        gpsvc          (fe5ab4525bc2ec68b9119a6e5d40128b) C:\Windows\System32\gpsvc.dll
13:22:47.0453 2684        gpsvc - ok
13:22:47.0495 2684        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
13:22:47.0517 2684        hcw85cir - ok
13:22:47.0619 2684        HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys
13:22:47.0650 2684        HdAudAddService - ok
13:22:47.0752 2684        HDAudBus        (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys
13:22:47.0783 2684        HDAudBus - ok
13:22:47.0805 2684        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
13:22:47.0825 2684        HidBatt - ok
13:22:47.0853 2684        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
13:22:47.0884 2684        HidBth - ok
13:22:47.0911 2684        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
13:22:47.0937 2684        HidIr - ok
13:22:47.0967 2684        hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
13:22:48.0020 2684        hidserv - ok
13:22:48.0119 2684        HidUsb          (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys
13:22:48.0157 2684        HidUsb - ok
13:22:48.0184 2684        hkmsvc          (efa58ede58dd74388ffd04cb32681518) C:\Windows\system32\kmsvc.dll
13:22:48.0233 2684        hkmsvc - ok
13:22:48.0317 2684        HomeGroupListener (046b2673767ca626e2cfb7fdf735e9e8) C:\Windows\system32\ListSvc.dll
13:22:48.0333 2684        HomeGroupListener - ok
13:22:48.0366 2684        HomeGroupProvider (06a7422224d9865a5613710a089987df) C:\Windows\system32\provsvc.dll
13:22:48.0399 2684        HomeGroupProvider - ok
13:22:48.0498 2684        HpSAMD          (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys
13:22:48.0511 2684        HpSAMD - ok
13:22:48.0544 2684        HTCAND64        (f47cec45fb85791d4ab237563ad0fa8f) C:\Windows\system32\Drivers\ANDROIDUSB.sys
13:22:48.0568 2684        HTCAND64 - ok
13:22:48.0673 2684        htcnprot        (b8b1b284362e1d8135112573395d5da5) C:\Windows\system32\DRIVERS\htcnprot.sys
13:22:48.0684 2684        htcnprot - ok
13:22:48.0728 2684        HTTP            (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys
13:22:48.0786 2684        HTTP - ok
13:22:48.0885 2684        hwpolicy        (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys
13:22:48.0895 2684        hwpolicy - ok
13:22:48.0934 2684        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys
13:22:48.0949 2684        i8042prt - ok
13:22:48.0997 2684        iaStor          (bbb3b6df1abb0fe35802ede85cc1c011) C:\Windows\system32\DRIVERS\iaStor.sys
13:22:49.0009 2684        iaStor - ok
13:22:49.0060 2684        iaStorV        (b75e45c564e944a2657167d197ab29da) C:\Windows\system32\drivers\iaStorV.sys
13:22:49.0080 2684        iaStorV - ok
13:22:49.0181 2684        idsvc          (2f2be70d3e02b6fa877921ab9516d43c) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
13:22:49.0217 2684        idsvc - ok
13:22:49.0304 2684        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
13:22:49.0315 2684        iirsp - ok
13:22:49.0392 2684        IJPLMSVC        (ad5df6f4fbbc798636edc66bfec7d0de) C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
13:22:49.0400 2684        IJPLMSVC - ok
13:22:49.0501 2684        IKEEXT          (c5b4683680df085b57bc53e5ef34861f) C:\Windows\System32\ikeext.dll
13:22:49.0585 2684        IKEEXT - ok
13:22:49.0719 2684        IntcAzAudAddService (9c1d5314d42b7f1bd6ad6fb1ba8870a8) C:\Windows\system32\drivers\RTKVHD64.sys
13:22:49.0765 2684        IntcAzAudAddService - ok
13:22:49.0799 2684        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys
13:22:49.0811 2684        intelide - ok
13:22:49.0840 2684        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
13:22:49.0868 2684        intelppm - ok
13:22:49.0958 2684        IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
13:22:50.0007 2684        IPBusEnum - ok
13:22:50.0044 2684        IpFilterDriver  (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys
13:22:50.0098 2684        IpFilterDriver - ok
13:22:50.0166 2684        iphlpsvc        (f8e058d17363ec580e4b7232778b6cb5) C:\Windows\System32\iphlpsvc.dll
13:22:50.0219 2684        iphlpsvc - ok
13:22:50.0256 2684        IPMIDRV        (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys
13:22:50.0280 2684        IPMIDRV - ok
13:22:50.0302 2684        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
13:22:50.0354 2684        IPNAT - ok
13:22:50.0454 2684        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
13:22:50.0484 2684        IRENUM - ok
13:22:50.0502 2684        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys
13:22:50.0513 2684        isapnp - ok
13:22:50.0543 2684        iScsiPrt        (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys
13:22:50.0559 2684        iScsiPrt - ok
13:22:50.0581 2684        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
13:22:50.0592 2684        kbdclass - ok
13:22:50.0625 2684        kbdhid          (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys
13:22:50.0646 2684        kbdhid - ok
13:22:50.0742 2684        kbfiltr        (e63ef8c3271d014f14e2469ce75fecb4) C:\Windows\system32\DRIVERS\kbfiltr.sys
13:22:50.0749 2684        kbfiltr - ok
13:22:50.0787 2684        KeyIso          (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe
13:22:50.0800 2684        KeyIso - ok
13:22:50.0850 2684        KSecDD          (16c1b906fc5ead84769f90b736b6bf0e) C:\Windows\system32\Drivers\ksecdd.sys
13:22:50.0863 2684        KSecDD - ok
13:22:50.0891 2684        KSecPkg        (0b711550c56444879d71c7daabda6c83) C:\Windows\system32\Drivers\ksecpkg.sys
13:22:50.0905 2684        KSecPkg - ok
13:22:50.0941 2684        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
13:22:50.0987 2684        ksthunk - ok
13:22:51.0026 2684        KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
13:22:51.0079 2684        KtmRm - ok
13:22:51.0170 2684        L1C            (b4a3a05b0f9c81d098b96ab6aa915042) C:\Windows\system32\DRIVERS\L1C62x64.sys
13:22:51.0181 2684        L1C - ok
13:22:51.0222 2684        LanmanServer    (81f1d04d4d0e433099365127375fd501) C:\Windows\system32\srvsvc.dll
13:22:51.0246 2684        LanmanServer - ok
13:22:51.0312 2684        LanmanWorkstation (27026eac8818e8a6c00a1cad2f11d29a) C:\Windows\System32\wkssvc.dll
13:22:51.0362 2684        LanmanWorkstation - ok
13:22:51.0429 2684        LightScribeService (abf90fc5a127f481219b873c1b8dfc1c) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
13:22:51.0461 2684        LightScribeService ( UnsignedFile.Multi.Generic ) - warning
13:22:51.0461 2684        LightScribeService - detected UnsignedFile.Multi.Generic (1)
13:22:51.0563 2684        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
13:22:51.0614 2684        lltdio - ok
13:22:51.0650 2684        lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
13:22:51.0707 2684        lltdsvc - ok
13:22:51.0768 2684        lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
13:22:51.0815 2684        lmhosts - ok
13:22:51.0896 2684        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
13:22:51.0910 2684        LSI_FC - ok
13:22:51.0955 2684        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
13:22:51.0968 2684        LSI_SAS - ok
13:22:51.0990 2684        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
13:22:52.0002 2684        LSI_SAS2 - ok
13:22:52.0025 2684        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
13:22:52.0039 2684        LSI_SCSI - ok
13:22:52.0081 2684        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
13:22:52.0133 2684        luafv - ok
13:22:52.0232 2684        Mcx2Svc        (f84c8f1000bc11e3b7b23cbd3baff111) C:\Windows\system32\Mcx2Svc.dll
13:22:52.0247 2684        Mcx2Svc - ok
13:22:52.0293 2684        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
13:22:52.0305 2684        megasas - ok
13:22:52.0324 2684        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
13:22:52.0341 2684        MegaSR - ok
13:22:52.0424 2684        Microsoft SharePoint Workspace Audit Service - ok
13:22:52.0498 2684        MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
13:22:52.0545 2684        MMCSS - ok
13:22:52.0586 2684        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
13:22:52.0634 2684        Modem - ok
13:22:52.0717 2684        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
13:22:52.0739 2684        monitor - ok
13:22:52.0821 2684        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
13:22:52.0832 2684        mouclass - ok
13:22:52.0917 2684        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
13:22:52.0947 2684        mouhid - ok
13:22:53.0001 2684        mountmgr        (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys
13:22:53.0013 2684        mountmgr - ok
13:22:53.0050 2684        mpio            (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys
13:22:53.0064 2684        mpio - ok
13:22:53.0083 2684        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
13:22:53.0121 2684        mpsdrv - ok
13:22:53.0167 2684        MpsSvc          (aecab449567d1846dad63ece49e893e3) C:\Windows\system32\mpssvc.dll
13:22:53.0245 2684        MpsSvc - ok
13:22:53.0295 2684        MRxDAV          (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys
13:22:53.0330 2684        MRxDAV - ok
13:22:53.0410 2684        mrxsmb          (040d62a9d8ad28922632137acdd984f2) C:\Windows\system32\DRIVERS\mrxsmb.sys
13:22:53.0437 2684        mrxsmb - ok
13:22:53.0471 2684        mrxsmb10        (f0067552f8f9b33d7c59403ab808a3cb) C:\Windows\system32\DRIVERS\mrxsmb10.sys
13:22:53.0501 2684        mrxsmb10 - ok
13:22:53.0580 2684        mrxsmb20        (3c142d31de9f2f193218a53fe2632051) C:\Windows\system32\DRIVERS\mrxsmb20.sys
13:22:53.0607 2684        mrxsmb20 - ok
13:22:53.0633 2684        msahci          (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys
13:22:53.0644 2684        msahci - ok
13:22:53.0672 2684        msdsm          (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys
13:22:53.0686 2684        msdsm - ok
13:22:53.0722 2684        MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
13:22:53.0762 2684        MSDTC - ok
13:22:53.0808 2684        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
13:22:53.0853 2684        Msfs - ok
13:22:53.0873 2684        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
13:22:53.0922 2684        mshidkmdf - ok
13:22:53.0943 2684        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys
13:22:53.0954 2684        msisadrv - ok
13:22:54.0058 2684        MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
13:22:54.0113 2684        MSiSCSI - ok
13:22:54.0122 2684        msiserver - ok
13:22:54.0174 2684        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
13:22:54.0211 2684        MSKSSRV - ok
13:22:54.0221 2684        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
13:22:54.0266 2684        MSPCLOCK - ok
13:22:54.0290 2684        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
13:22:54.0337 2684        MSPQM - ok
13:22:54.0369 2684        MsRPC          (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys
13:22:54.0387 2684        MsRPC - ok
13:22:54.0410 2684        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys
13:22:54.0421 2684        mssmbios - ok
13:22:54.0462 2684        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
13:22:54.0509 2684        MSTEE - ok
13:22:54.0519 2684        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
13:22:54.0544 2684        MTConfig - ok
13:22:54.0641 2684        MTsensor        (032d35c996f21d19a205a7c8f0b76f3c) C:\Windows\system32\DRIVERS\ATK64AMD.sys
13:22:54.0648 2684        MTsensor - ok
13:22:54.0679 2684        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
13:22:54.0691 2684        Mup - ok
13:22:54.0729 2684        napagent        (4987e079a4530fa737a128be54b63b12) C:\Windows\system32\qagentRT.dll
13:22:54.0781 2684        napagent - ok
13:22:54.0896 2684        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
13:22:54.0934 2684        NativeWifiP - ok
13:22:54.0979 2684        NDIS            (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys
13:22:55.0016 2684        NDIS - ok
13:22:55.0115 2684        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
13:22:55.0159 2684        NdisCap - ok
13:22:55.0189 2684        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
13:22:55.0236 2684        NdisTapi - ok
13:22:55.0256 2684        Ndisuio        (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys
13:22:55.0300 2684        Ndisuio - ok
13:22:55.0330 2684        NdisWan        (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys
13:22:55.0369 2684        NdisWan - ok
13:22:55.0386 2684        NDProxy        (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys
13:22:55.0431 2684        NDProxy - ok
13:22:55.0456 2684        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
13:22:55.0500 2684        NetBIOS - ok
13:22:55.0528 2684        NetBT          (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys
13:22:55.0576 2684        NetBT - ok
13:22:55.0674 2684        Netlogon        (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe
13:22:55.0688 2684        Netlogon - ok
13:22:55.0732 2684        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
13:22:55.0784 2684        Netman - ok
13:22:55.0883 2684        NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:22:55.0892 2684        NetMsmqActivator - ok
13:22:55.0905 2684        NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:22:55.0914 2684        NetPipeActivator - ok
13:22:55.0981 2684        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
13:22:56.0034 2684        netprofm - ok
13:22:56.0147 2684        NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:22:56.0156 2684        NetTcpActivator - ok
13:22:56.0169 2684        NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:22:56.0178 2684        NetTcpPortSharing - ok
13:22:56.0252 2684        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
13:22:56.0265 2684        nfrd960 - ok
13:22:56.0306 2684        NlaSvc          (d9a0ce66046d6efa0c61baa885cba0a8) C:\Windows\System32\nlasvc.dll
13:22:56.0354 2684        NlaSvc - ok
13:22:56.0448 2684        nmwcd          (5fe6f8c05f0769bbb74afac11453b182) C:\Windows\system32\drivers\ccdcmbx64.sys
13:22:56.0475 2684        nmwcd - ok
13:22:56.0527 2684        nmwcdc          (73c929945c0850b8d1fe2fea05fdf05d) C:\Windows\system32\drivers\ccdcmbox64.sys
13:22:56.0561 2684        nmwcdc - ok
13:22:56.0622 2684        nmwcdnsucx64    (697ca586209e022d15dd0c838b235d6a) C:\Windows\system32\drivers\nmwcdnsucx64.sys
13:22:56.0658 2684        nmwcdnsucx64 - ok
13:22:56.0696 2684        nmwcdnsux64    (292ddf13f91f2cb2482b57aacd6aeb9b) C:\Windows\system32\drivers\nmwcdnsux64.sys
13:22:56.0726 2684        nmwcdnsux64 - ok
13:22:56.0763 2684        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
13:22:56.0807 2684        Npfs - ok
13:22:56.0832 2684        nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
13:22:56.0881 2684        nsi - ok
13:22:56.0931 2684        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
13:22:56.0984 2684        nsiproxy - ok
13:22:57.0088 2684        Ntfs            (378e0e0dfea67d98ae6ea53adbbd76bc) C:\Windows\system32\drivers\Ntfs.sys
13:22:57.0145 2684        Ntfs - ok
13:22:57.0186 2684        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
13:22:57.0234 2684        Null - ok
13:22:57.0319 2684        NVHDA          (cb599955ce2ce9694721562f9481cd84) C:\Windows\system32\drivers\nvhda64v.sys
13:22:57.0328 2684        NVHDA - ok
13:22:57.0579 2684        nvlddmkm        (0d3f6e25c658530a2ad4b648849f1483) C:\Windows\system32\DRIVERS\nvlddmkm.sys
13:22:57.0755 2684        nvlddmkm - ok
13:22:57.0852 2684        nvraid          (a4d9c9a608a97f59307c2f2600edc6a4) C:\Windows\system32\drivers\nvraid.sys
13:22:57.0867 2684        nvraid - ok
13:22:57.0899 2684        nvstor          (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\Windows\system32\drivers\nvstor.sys
13:22:57.0913 2684        nvstor - ok
13:22:57.0970 2684        nvsvc          (7dd5a1a53bb2d1b1b85c9c543d05e222) C:\Windows\system32\nvvsvc.exe
13:22:57.0983 2684        nvsvc - ok
13:22:58.0035 2684        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys
13:22:58.0049 2684        nv_agp - ok
13:22:58.0064 2684        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys
13:22:58.0089 2684        ohci1394 - ok
13:22:58.0152 2684        ose            (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
13:22:58.0162 2684        ose - ok
13:22:58.0308 2684        osppsvc        (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
13:22:58.0477 2684        osppsvc - ok
13:22:58.0570 2684        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
13:22:58.0588 2684        p2pimsvc - ok
13:22:58.0618 2684        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
13:22:58.0652 2684        p2psvc - ok
13:22:58.0697 2684        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
13:22:58.0721 2684        Parport - ok
13:22:58.0773 2684        partmgr        (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys
13:22:58.0785 2684        partmgr - ok
13:22:58.0851 2684        PassThru Service (a1e779a0cf7a21b42e8fd3e8856d8481) C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
13:22:58.0871 2684        PassThru Service ( UnsignedFile.Multi.Generic ) - warning
13:22:58.0871 2684        PassThru Service - detected UnsignedFile.Multi.Generic (1)
13:22:58.0949 2684        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
13:22:58.0979 2684        PcaSvc - ok
13:22:59.0086 2684        pccsmcfd        (bc0018c2d29f655188a0ed3fa94fdb24) C:\Windows\system32\DRIVERS\pccsmcfdx64.sys
13:22:59.0105 2684        pccsmcfd - ok
13:22:59.0138 2684        pci            (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys
13:22:59.0152 2684        pci - ok
13:22:59.0177 2684        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys
13:22:59.0189 2684        pciide - ok
13:22:59.0234 2684        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
13:22:59.0250 2684        pcmcia - ok
13:22:59.0274 2684        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
13:22:59.0284 2684        pcw - ok
13:22:59.0314 2684        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
13:22:59.0374 2684        PEAUTH - ok
13:22:59.0420 2684        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
13:22:59.0446 2684        PerfHost - ok
13:22:59.0530 2684        pla            (557e9a86f65f0de18c9b6751dfe9d3f1) C:\Windows\system32\pla.dll
13:22:59.0606 2684        pla - ok
13:22:59.0678 2684        PlugPlay        (98b1721b8718164293b9701b98c52d77) C:\Windows\system32\umpnpmgr.dll
13:22:59.0717 2684        PlugPlay - ok
13:22:59.0743 2684        PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
13:22:59.0768 2684        PNRPAutoReg - ok
13:22:59.0792 2684        PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
13:22:59.0808 2684        PNRPsvc - ok
13:22:59.0847 2684        PolicyAgent    (166eb40d1f5b47e615de3d0fffe5f243) C:\Windows\System32\ipsecsvc.dll
13:22:59.0904 2684        PolicyAgent - ok
13:22:59.0986 2684        Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
13:23:00.0033 2684        Power - ok
13:23:00.0123 2684        PptpMiniport    (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys
13:23:00.0176 2684        PptpMiniport - ok
13:23:00.0203 2684        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
13:23:00.0229 2684        Processor - ok
13:23:00.0268 2684        ProfSvc        (f381975e1f4346de875cb07339ce8d3a) C:\Windows\system32\profsvc.dll
13:23:00.0323 2684        ProfSvc - ok
13:23:00.0406 2684        ProtectedStorage (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe
13:23:00.0419 2684        ProtectedStorage - ok
13:23:00.0473 2684        Psched          (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys
13:23:00.0524 2684        Psched - ok
13:23:00.0589 2684        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
13:23:00.0656 2684        ql2300 - ok
13:23:00.0688 2684        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
13:23:00.0701 2684        ql40xx - ok
13:23:00.0744 2684        QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
13:23:00.0767 2684        QWAVE - ok
13:23:00.0812 2684        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
13:23:00.0839 2684        QWAVEdrv - ok
13:23:00.0861 2684        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
13:23:00.0909 2684        RasAcd - ok
13:23:00.0995 2684        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
13:23:01.0031 2684        RasAgileVpn - ok
13:23:01.0061 2684        RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
13:23:01.0113 2684        RasAuto - ok
13:23:01.0212 2684        Rasl2tp        (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys
13:23:01.0250 2684        Rasl2tp - ok
13:23:01.0289 2684        RasMan          (47394ed3d16d053f5906efe5ab51cc83) C:\Windows\System32\rasmans.dll
13:23:01.0343 2684        RasMan - ok
13:23:01.0444 2684        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
13:23:01.0496 2684        RasPppoe - ok
13:23:01.0592 2684        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
13:23:01.0638 2684        RasSstp - ok
13:23:01.0670 2684        rdbss          (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys
13:23:01.0720 2684        rdbss - ok
13:23:01.0805 2684        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
13:23:01.0830 2684        rdpbus - ok
13:23:01.0853 2684        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
13:23:01.0901 2684        RDPCDD - ok
13:23:01.0996 2684        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
13:23:02.0046 2684        RDPENCDD - ok
13:23:02.0071 2684        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
13:23:02.0121 2684        RDPREFMP - ok
13:23:02.0221 2684        RDPWD          (074ac702d8b8b660b0e1371555995386) C:\Windows\system32\drivers\RDPWD.sys
13:23:02.0247 2684        RDPWD - ok
13:23:02.0346 2684        rdyboost        (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys
13:23:02.0361 2684        rdyboost - ok
13:23:02.0383 2684        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
13:23:02.0438 2684        RemoteAccess - ok
13:23:02.0479 2684        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
13:23:02.0520 2684        RemoteRegistry - ok
13:23:02.0545 2684        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
13:23:02.0597 2684        RpcEptMapper - ok
13:23:02.0628 2684        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
13:23:02.0654 2684        RpcLocator - ok
13:23:02.0735 2684        RpcSs          (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll
13:23:02.0777 2684        RpcSs - ok
13:23:02.0840 2684        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
13:23:02.0891 2684        rspndr - ok
13:23:02.0981 2684        SamSs          (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe
13:23:02.0994 2684        SamSs - ok
13:23:03.0041 2684        sbp2port        (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys
13:23:03.0054 2684        sbp2port - ok
13:23:03.0099 2684        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
13:23:03.0154 2684        SCardSvr - ok
13:23:03.0194 2684        scfilter        (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys
13:23:03.0240 2684        scfilter - ok
13:23:03.0291 2684        Schedule        (624d0f5ff99428bb90a5b8a4123e918e) C:\Windows\system32\schedsvc.dll
13:23:03.0351 2684        Schedule - ok
13:23:03.0389 2684        SCPolicySvc    (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll
13:23:03.0425 2684        SCPolicySvc - ok
13:23:03.0452 2684        SDRSVC          (765a27c3279ce11d14cb9e4f5869fca5) C:\Windows\System32\SDRSVC.dll
13:23:03.0478 2684        SDRSVC - ok
13:23:03.0570 2684        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
13:23:03.0616 2684        secdrv - ok
13:23:03.0653 2684        seclogon        (463b386ebc70f98da5dff85f7e654346) C:\Windows\system32\seclogon.dll
13:23:03.0700 2684        seclogon - ok
13:23:03.0762 2684        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
13:23:03.0799 2684        SENS - ok
13:23:03.0820 2684        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
13:23:03.0855 2684        SensrSvc - ok
13:23:03.0950 2684        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
13:23:03.0970 2684        Serenum - ok
13:23:03.0996 2684        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
13:23:04.0020 2684        Serial - ok
13:23:04.0031 2684        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
13:23:04.0058 2684        sermouse - ok
13:23:04.0167 2684        ServiceLayer    (f31e9531af225ca25350d5e87e999b31) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
13:23:04.0188 2684        ServiceLayer - ok
13:23:04.0271 2684        SessionEnv      (c3bc61ce47ff6f4e88ab8a3b429a36af) C:\Windows\system32\sessenv.dll
13:23:04.0309 2684        SessionEnv - ok
13:23:04.0342 2684        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
13:23:04.0369 2684        sffdisk - ok
13:23:04.0399 2684        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
13:23:04.0432 2684        sffp_mmc - ok
13:23:04.0486 2684        sffp_sd        (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\drivers\sffp_sd.sys
13:23:04.0511 2684        sffp_sd - ok
13:23:04.0549 2684        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
13:23:04.0576 2684        sfloppy - ok
13:23:04.0621 2684        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
13:23:04.0679 2684        SharedAccess - ok
13:23:04.0720 2684        ShellHWDetection (0298ac45d0efffb2db4baa7dd186e7bf) C:\Windows\System32\shsvcs.dll
13:23:04.0751 2684        ShellHWDetection - ok
13:23:04.0847 2684        SiSGbeLH        (1bc348cf6baa90ec8e533ef6e6a69933) C:\Windows\system32\DRIVERS\SiSG664.sys
13:23:04.0868 2684        SiSGbeLH - ok
13:23:04.0903 2684        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
13:23:04.0915 2684        SiSRaid2 - ok
13:23:04.0938 2684        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
13:23:04.0951 2684        SiSRaid4 - ok
13:23:04.0975 2684        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
13:23:05.0033 2684        Smb - ok
13:23:05.0123 2684        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
13:23:05.0156 2684        SNMPTRAP - ok
13:23:05.0233 2684        SNP2UVC        (2d280b5799f9c143fa7d49e032fbce46) C:\Windows\system32\DRIVERS\snp2uvc.sys
13:23:05.0305 2684        SNP2UVC - ok
13:23:05.0383 2684        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
13:23:05.0393 2684        spldr - ok
13:23:05.0435 2684        Spooler        (f8e1fa03cb70d54a9892ac88b91d1e7b) C:\Windows\System32\spoolsv.exe
13:23:05.0464 2684        Spooler - ok
13:23:05.0614 2684        sppsvc          (913d843498553a1bc8f8dbad6358e49f) C:\Windows\system32\sppsvc.exe
13:23:05.0722 2684        sppsvc - ok
13:23:05.0751 2684        sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
13:23:05.0805 2684        sppuinotify - ok
13:23:05.0856 2684        srv            (2408c0366d96bcdf63e8f1c78e4a29c5) C:\Windows\system32\DRIVERS\srv.sys
13:23:05.0892 2684        srv - ok
13:23:05.0942 2684        srv2            (76548f7b818881b47d8d1ae1be9c11f8) C:\Windows\system32\DRIVERS\srv2.sys
13:23:05.0975 2684        srv2 - ok
13:23:06.0025 2684        srvnet          (0af6e19d39c70844c5caa8fb0183c36e) C:\Windows\system32\DRIVERS\srvnet.sys
13:23:06.0048 2684        srvnet - ok
13:23:06.0137 2684        sscdbus        (1612881760c9df7fbb09b6cf1d3ba0df) C:\Windows\system32\DRIVERS\sscdbus.sys
13:23:06.0157 2684        sscdbus - ok
13:23:06.0196 2684        sscdmdfl        (d7803a687e85189ea2b525cc22093521) C:\Windows\system32\DRIVERS\sscdmdfl.sys
13:23:06.0223 2684        sscdmdfl - ok
13:23:06.0247 2684        sscdmdm        (06db3d5eb2444083c7f5af7874765505) C:\Windows\system32\DRIVERS\sscdmdm.sys
13:23:06.0261 2684        sscdmdm - ok
13:23:06.0284 2684        sscdserd        (23ebb395609d9cdb8b1074a12254119b) C:\Windows\system32\DRIVERS\sscdserd.sys
13:23:06.0313 2684        sscdserd - ok
13:23:06.0349 2684        SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
13:23:06.0402 2684        SSDPSRV - ok
13:23:06.0424 2684        SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
13:23:06.0475 2684        SstpSvc - ok
13:23:06.0508 2684        Steam Client Service - ok
13:23:06.0585 2684        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
13:23:06.0596 2684        stexstor - ok
13:23:06.0635 2684        stisvc          (52d0e33b681bd0f33fdc08812fee4f7d) C:\Windows\System32\wiaservc.dll
13:23:06.0672 2684        stisvc - ok
13:23:06.0715 2684        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys
13:23:06.0725 2684        swenum - ok
13:23:06.0760 2684        swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
13:23:06.0805 2684        swprv - ok
13:23:06.0852 2684        SysMain        (3c1284516a62078fb68f768de4f1a7be) C:\Windows\system32\sysmain.dll
13:23:06.0932 2684        SysMain - ok
13:23:06.0983 2684        TabletInputService (238935c3cf2854886dc7cbb2a0e2cc66) C:\Windows\System32\TabSvc.dll
13:23:07.0004 2684        TabletInputService - ok
13:23:07.0024 2684        TapiSrv        (884264ac597b690c5707c89723bb8e7b) C:\Windows\System32\tapisrv.dll
13:23:07.0067 2684        TapiSrv - ok
13:23:07.0082 2684        TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
13:23:07.0121 2684        TBS - ok
13:23:07.0195 2684        Tcpip          (f18f56efc0bfb9c87ba01c37b27f4da5) C:\Windows\system32\drivers\tcpip.sys
13:23:07.0265 2684        Tcpip - ok
13:23:07.0339 2684        TCPIP6          (f18f56efc0bfb9c87ba01c37b27f4da5) C:\Windows\system32\DRIVERS\tcpip.sys
13:23:07.0376 2684        TCPIP6 - ok
13:23:07.0414 2684        tcpipreg        (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys
13:23:07.0451 2684        tcpipreg - ok
13:23:07.0486 2684        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
13:23:07.0506 2684        TDPIPE - ok
13:23:07.0542 2684        TDTCP          (7518f7bcfd4b308abc9192bacaf6c970) C:\Windows\system32\drivers\tdtcp.sys
13:23:07.0567 2684        TDTCP - ok
13:23:07.0604 2684        tdx            (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys
13:23:07.0649 2684        tdx - ok
13:23:07.0677 2684        TermDD          (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys
13:23:07.0688 2684        TermDD - ok
13:23:07.0725 2684        TermService    (0f05ec2887bfe197ad82a13287d2f404) C:\Windows\System32\termsrv.dll
13:23:07.0785 2684        TermService - ok
13:23:07.0813 2684        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
13:23:07.0844 2684        Themes - ok
13:23:07.0883 2684        THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
13:23:07.0921 2684        THREADORDER - ok
13:23:07.0972 2684        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
13:23:08.0027 2684        TrkWks - ok
13:23:08.0074 2684        TrustedInstaller (840f7fb849f5887a49ba18c13b2da920) C:\Windows\servicing\TrustedInstaller.exe
13:23:08.0096 2684        TrustedInstaller - ok
13:23:08.0156 2684        tssecsrv        (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys
13:23:08.0202 2684        tssecsrv - ok
13:23:08.0271 2684        tunnel          (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys
13:23:08.0309 2684        tunnel - ok
13:23:08.0333 2684        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
13:23:08.0346 2684        uagp35 - ok
13:23:08.0398 2684        udfs            (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys
13:23:08.0448 2684        udfs - ok
13:23:08.0502 2684        UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
13:23:08.0527 2684        UI0Detect - ok
13:23:08.0585 2684        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys
13:23:08.0598 2684        uliagpkx - ok
13:23:08.0632 2684        umbus          (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys
13:23:08.0655 2684        umbus - ok
13:23:08.0675 2684        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
13:23:08.0688 2684        UmPass - ok
13:23:08.0720 2684        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
13:23:08.0770 2684        upnphost - ok
13:23:08.0879 2684        upperdev        (34afb83c7bba370e404e52cc2290350c) C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys
13:23:08.0905 2684        upperdev - ok
13:23:08.0963 2684        usbaudio        (77b01bc848298223a95d4ec23e1785a1) C:\Windows\system32\drivers\usbaudio.sys
13:23:08.0998 2684        usbaudio - ok
13:23:09.0088 2684        usbccgp        (7b6a127c93ee590e4d79a5f2a76fe46f) C:\Windows\system32\DRIVERS\usbccgp.sys
13:23:09.0112 2684        usbccgp - ok
13:23:09.0154 2684        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys
13:23:09.0177 2684        usbcir - ok
13:23:09.0206 2684        usbehci        (92969ba5ac44e229c55a332864f79677) C:\Windows\system32\DRIVERS\usbehci.sys
13:23:09.0219 2684        usbehci - ok
13:23:09.0257 2684        usbhub          (e7df1cfd28ca86b35ef5add0735ceef3) C:\Windows\system32\DRIVERS\usbhub.sys
13:23:09.0292 2684        usbhub - ok
13:23:09.0318 2684        usbohci        (f1bb1e55f1e7a65c5839ccc7b36d773e) C:\Windows\system32\drivers\usbohci.sys
13:23:09.0339 2684        usbohci - ok
13:23:09.0372 2684        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
13:23:09.0395 2684        usbprint - ok
13:23:09.0423 2684        usbser          (0f0c72a657c622286013788b886968ad) C:\Windows\system32\drivers\usbser.sys
13:23:09.0438 2684        usbser - ok
13:23:09.0474 2684        UsbserFilt      (aa75e1efbee7186b4cbaaacf1f15e6ca) C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys
13:23:09.0500 2684        UsbserFilt - ok
13:23:09.0531 2684        USBSTOR        (f39983647bc1f3e6100778ddfe9dce29) C:\Windows\system32\DRIVERS\USBSTOR.SYS
13:23:09.0552 2684        USBSTOR - ok
13:23:09.0575 2684        usbuhci        (bc3070350a491d84b518d7cca9abd36f) C:\Windows\system32\DRIVERS\usbuhci.sys
13:23:09.0603 2684        usbuhci - ok
13:23:09.0686 2684        usbvideo        (7cb8c573c6e4a2714402cc0a36eab4fe) C:\Windows\System32\Drivers\usbvideo.sys
13:23:09.0708 2684        usbvideo - ok
13:23:09.0744 2684        UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
13:23:09.0782 2684        UxSms - ok
13:23:09.0815 2684        VaultSvc        (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe
13:23:09.0828 2684        VaultSvc - ok
13:23:09.0883 2684        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys
13:23:09.0894 2684        vdrvroot - ok
13:23:09.0943 2684        vds            (44d73e0bbc1d3c8981304ba15135c2f2) C:\Windows\System32\vds.exe
13:23:09.0965 2684        vds - ok
13:23:10.0022 2684        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
13:23:10.0038 2684        vga - ok
13:23:10.0056 2684        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
13:23:10.0108 2684        VgaSave - ok
13:23:10.0149 2684        vhdmp          (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys
13:23:10.0165 2684        vhdmp - ok
13:23:10.0176 2684        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys
13:23:10.0187 2684        viaide - ok
13:23:10.0207 2684        volmgr          (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys
13:23:10.0219 2684        volmgr - ok
13:23:10.0250 2684        volmgrx        (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys
13:23:10.0267 2684        volmgrx - ok
13:23:10.0296 2684        volsnap        (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys
13:23:10.0313 2684        volsnap - ok
13:23:10.0351 2684        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
13:23:10.0366 2684        vsmraid - ok
13:23:10.0422 2684        VSS            (787898bf9fb6d7bd87a36e2d95c899ba) C:\Windows\system32\vssvc.exe
13:23:10.0481 2684        VSS - ok
13:23:10.0532 2684        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
13:23:10.0560 2684        vwifibus - ok
13:23:10.0587 2684        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
13:23:10.0605 2684        vwififlt - ok
13:23:10.0643 2684        vwifimp        (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys
13:23:10.0661 2684        vwifimp - ok
13:23:10.0697 2684        W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
13:23:10.0740 2684        W32Time - ok
13:23:10.0783 2684        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
13:23:10.0810 2684        WacomPen - ok
13:23:10.0855 2684        WANARP          (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
13:23:10.0904 2684        WANARP - ok
13:23:10.0915 2684        Wanarpv6        (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
13:23:10.0952 2684        Wanarpv6 - ok
13:23:11.0062 2684        wbengine        (5ab1bb85bd8b5089cc5d64200dedae68) C:\Windows\system32\wbengine.exe
13:23:11.0127 2684        wbengine - ok
13:23:11.0168 2684        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
13:23:11.0201 2684        WbioSrvc - ok
13:23:11.0246 2684        wcncsvc        (dd1bae8ebfc653824d29ccf8c9054d68) C:\Windows\System32\wcncsvc.dll
13:23:11.0275 2684        wcncsvc - ok
13:23:11.0305 2684        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
13:23:11.0332 2684        WcsPlugInService - ok
13:23:11.0381 2684        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
13:23:11.0392 2684        Wd - ok
13:23:11.0423 2684        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
13:23:11.0446 2684        Wdf01000 - ok
13:23:11.0477 2684        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
13:23:11.0508 2684        WdiServiceHost - ok
13:23:11.0512 2684        WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
13:23:11.0531 2684        WdiSystemHost - ok
13:23:11.0569 2684        WebClient      (733006127f235be7c35354ebee7b9a7b) C:\Windows\System32\webclnt.dll
13:23:11.0601 2684        WebClient - ok
13:23:11.0639 2684        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
13:23:11.0694 2684        Wecsvc - ok
13:23:11.0768 2684        wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
13:23:11.0816 2684        wercplsupport - ok
13:23:11.0900 2684        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
13:23:11.0956 2684        WerSvc - ok
13:23:12.0035 2684        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
13:23:12.0072 2684        WfpLwf - ok
13:23:12.0117 2684        WimFltr        (52ded146e4797e6ccf94799e8e22bb2a) C:\Windows\system32\DRIVERS\wimfltr.sys
13:23:12.0131 2684        WimFltr - ok
13:23:12.0151 2684        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
13:23:12.0163 2684        WIMMount - ok
13:23:12.0212 2684        WinDefend - ok
13:23:12.0223 2684        WinHttpAutoProxySvc - ok
13:23:12.0290 2684        Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
13:23:12.0329 2684        Winmgmt - ok
13:23:12.0395 2684        WinRM          (41fbb751936b387f9179e7f03a74fe29) C:\Windows\system32\WsmSvc.dll
13:23:12.0517 2684        WinRM - ok
13:23:12.0624 2684        WinUSB          (817eaff5d38674edd7713b9dfb8e9791) C:\Windows\system32\DRIVERS\WinUSB.sys
13:23:12.0641 2684        WinUSB - ok
13:23:12.0692 2684        Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
13:23:12.0733 2684        Wlansvc - ok
13:23:12.0858 2684        wlidsvc        (98f138897ef4246381d197cb81846d62) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
13:23:12.0938 2684        wlidsvc - ok
13:23:13.0031 2684        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys
13:23:13.0055 2684        WmiAcpi - ok
13:23:13.0119 2684        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
13:23:13.0144 2684        wmiApSrv - ok
13:23:13.0205 2684        WMPNetworkSvc - ok
13:23:13.0273 2684        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
13:23:13.0303 2684        WPCSvc - ok
13:23:13.0332 2684        WPDBusEnum      (2e57ddf2880a7e52e76f41c7e96d327b) C:\Windows\system32\wpdbusenum.dll
13:23:13.0362 2684        WPDBusEnum - ok
13:23:13.0401 2684        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
13:23:13.0450 2684        ws2ifsl - ok
13:23:13.0486 2684        wscsvc          (8f9f3969933c02da96eb0f84576db43e) C:\Windows\System32\wscsvc.dll
13:23:13.0513 2684        wscsvc - ok
13:23:13.0609 2684        WSDPrintDevice  (8d918b1db190a4d9b1753a66fa8c96e8) C:\Windows\system32\DRIVERS\WSDPrint.sys
13:23:13.0633 2684        WSDPrintDevice - ok
13:23:13.0649 2684        WSDScan        (4a2a5c50dd1a63577d3aca94269fbc7f) C:\Windows\system32\DRIVERS\WSDScan.sys
13:23:13.0666 2684        WSDScan - ok
13:23:13.0674 2684        WSearch - ok
13:23:13.0760 2684        wuauserv        (38340204a2d0228f1e87740fc5e554a7) C:\Windows\system32\wuaueng.dll
13:23:13.0870 2684        wuauserv - ok
13:23:13.0915 2684        WudfPf          (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys
13:23:13.0955 2684        WudfPf - ok
13:23:14.0032 2684        WUDFRd          (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys
13:23:14.0078 2684        WUDFRd - ok
13:23:14.0115 2684        wudfsvc        (b551d6637aa0e132c18ac6e504f7b79b) C:\Windows\System32\WUDFSvc.dll
13:23:14.0169 2684        wudfsvc - ok
13:23:14.0193 2684        WwanSvc        (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
13:23:14.0227 2684        WwanSvc - ok
13:23:14.0266 2684        MBR (0x1B8)    (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
13:23:14.0503 2684        \Device\Harddisk0\DR0 - ok
13:23:14.0514 2684        Boot (0x1200)  (5e95d734f2ee255cf18cc62115ae5b1d) \Device\Harddisk0\DR0\Partition0
13:23:14.0515 2684        \Device\Harddisk0\DR0\Partition0 - ok
13:23:14.0544 2684        Boot (0x1200)  (5071c243f6804197c01ba5ee2314ea08) \Device\Harddisk0\DR0\Partition1
13:23:14.0546 2684        \Device\Harddisk0\DR0\Partition1 - ok
13:23:14.0546 2684        ============================================================
13:23:14.0546 2684        Scan finished
13:23:14.0546 2684        ============================================================
13:23:14.0613 2972        Detected object count: 2
13:23:14.0613 2972        Actual detected object count: 2
13:23:29.0821 2972        LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user
13:23:29.0821 2972        LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:23:29.0823 2972        PassThru Service ( UnsignedFile.Multi.Generic ) - skipped by user
13:23:29.0823 2972        PassThru Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
Gruß Adik

cosinus 25.03.2012 15:32
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

adik4all 25.03.2012 23:23
ok erledigt, hier das log:

Combofix Logfile:
Code:
ComboFix 12-03-22.01 - Adik 25.03.2012  23:36:37.1.2 - x64
Microsoft Windows 7 Home Premium  6.1.7600.0.1252.49.1031.18.4095.2743 [GMT 2:00]
ausgeführt von:: c:\users\Adik\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\SetWallpaper.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-02-25 bis 2012-03-25  ))))))))))))))))))))))))))))))
.
.
2012-03-25 21:42 . 2012-03-25 21:42        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-03-23 20:47 . 2012-03-23 16:09        --------        d-----w-        C:\_OTL
2012-03-23 16:09 . 2012-03-14 03:27        8669240        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{C9BBDAE6-554E-47F7-803A-E0E0EE856F6A}\mpengine.dll
2012-03-20 09:09 . 2012-03-20 09:09        592824        ----a-w-        c:\program files (x86)\Mozilla Firefox\gkmedias.dll
2012-03-20 09:09 . 2012-03-20 09:09        44472        ----a-w-        c:\program files (x86)\Mozilla Firefox\mozglue.dll
2012-03-18 23:09 . 2012-03-18 23:09        --------        d-----w-        c:\program files (x86)\Spirent Communications
2012-03-18 23:08 . 2012-03-18 23:09        --------        d-----w-        c:\program files (x86)\HTC
2012-03-18 23:02 . 2012-03-18 23:20        --------        d-----w-        C:\ruu_log
2012-03-14 22:23 . 2011-11-19 18:30        5504880        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-03-14 22:23 . 2011-11-19 14:25        3957616        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe
2012-03-14 22:23 . 2011-11-19 14:25        3902320        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe
2012-03-14 13:41 . 2012-02-03 04:16        3143168        ----a-w-        c:\windows\system32\win32k.sys
2012-03-14 13:41 . 2012-02-10 06:18        1541120        ----a-w-        c:\windows\system32\DWrite.dll
2012-03-14 13:41 . 2012-02-10 05:41        1074176        ----a-w-        c:\windows\SysWow64\DWrite.dll
2012-03-14 13:41 . 2012-02-10 06:17        1837568        ----a-w-        c:\windows\system32\d3d10warp.dll
2012-03-14 13:41 . 2012-02-10 06:17        902656        ----a-w-        c:\windows\system32\d2d1.dll
2012-03-14 13:41 . 2012-02-10 06:17        320512        ----a-w-        c:\windows\system32\d3d10_1core.dll
2012-03-14 13:41 . 2012-02-10 06:17        197120        ----a-w-        c:\windows\system32\d3d10_1.dll
2012-03-14 13:41 . 2012-02-10 05:41        218624        ----a-w-        c:\windows\SysWow64\d3d10_1core.dll
2012-03-14 13:41 . 2012-02-10 05:41        161792        ----a-w-        c:\windows\SysWow64\d3d10_1.dll
2012-03-14 13:41 . 2012-02-10 05:41        1170944        ----a-w-        c:\windows\SysWow64\d3d10warp.dll
2012-03-14 13:41 . 2012-02-10 05:41        739840        ----a-w-        c:\windows\SysWow64\d2d1.dll
2012-03-13 21:41 . 2012-02-15 06:27        1031680        ----a-w-        c:\windows\system32\rdpcore.dll
2012-03-13 21:41 . 2012-02-15 05:44        826368        ----a-w-        c:\windows\SysWow64\rdpcore.dll
2012-03-13 21:41 . 2012-02-15 04:47        204800        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-03-13 21:41 . 2012-02-15 04:46        23552        ----a-w-        c:\windows\system32\drivers\tdtcp.sys
2012-03-13 21:41 . 2012-01-25 06:27        76288        ----a-w-        c:\windows\system32\rdpwsx.dll
2012-03-13 21:41 . 2012-01-25 06:27        149504        ----a-w-        c:\windows\system32\rdpcorekmts.dll
2012-03-13 21:41 . 2012-01-25 06:20        9216        ----a-w-        c:\windows\system32\rdrmemptylst.exe
2012-03-11 11:25 . 2012-03-11 11:25        --------        d-----w-        c:\users\Adik\AppData\Local\ElevatedDiagnostics
2012-03-07 11:07 . 2012-03-07 11:07        162664        ----a-w-        c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10140.bin
2012-03-01 14:00 . 2012-03-10 19:29        --------        d-----w-        c:\users\Adik\AppData\Roaming\ultrastardx
2012-03-01 14:00 . 2012-03-02 13:42        --------        d-----w-        c:\program files (x86)\UltraStar Deluxe
2012-03-01 13:00 . 2012-03-01 13:03        --------        d-----w-        c:\program files (x86)\UltraStar
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-23 08:18 . 2011-02-19 15:08        279656        ------w-        c:\windows\system32\MpSigStub.exe
2012-02-15 18:02 . 2011-10-17 16:29        132320        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2012-02-14 23:03 . 2012-02-14 23:03        86528        ----a-w-        c:\windows\SysWow64\iesysprep.dll
2012-02-14 23:03 . 2012-02-14 23:03        76800        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe
2012-02-14 23:03 . 2012-02-14 23:03        74752        ----a-w-        c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-02-14 23:03 . 2012-02-14 23:03        74752        ----a-w-        c:\windows\SysWow64\iesetup.dll
2012-02-14 23:03 . 2012-02-14 23:03        63488        ----a-w-        c:\windows\SysWow64\tdc.ocx
2012-02-14 23:03 . 2012-02-14 23:03        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll
2012-02-14 23:03 . 2012-02-14 23:03        367104        ----a-w-        c:\windows\SysWow64\html.iec
2012-02-14 23:03 . 2012-02-14 23:03        1798656        ----a-w-        c:\windows\SysWow64\jscript9.dll
2012-02-14 23:03 . 2012-02-14 23:03        161792        ----a-w-        c:\windows\SysWow64\msls31.dll
2012-02-14 23:03 . 2012-02-14 23:03        1127424        ----a-w-        c:\windows\SysWow64\wininet.dll
2012-02-14 23:03 . 2012-02-14 23:03        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll
2012-02-14 23:03 . 2012-02-14 23:03        91648        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe
2012-02-14 23:03 . 2012-02-14 23:03        89088        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe
2012-02-14 23:03 . 2012-02-14 23:03        85504        ----a-w-        c:\windows\system32\iesetup.dll
2012-02-14 23:03 . 2012-02-14 23:03        76800        ----a-w-        c:\windows\system32\tdc.ocx
2012-02-14 23:03 . 2012-02-14 23:03        603648        ----a-w-        c:\windows\system32\vbscript.dll
2012-02-14 23:03 . 2012-02-14 23:03        49664        ----a-w-        c:\windows\system32\imgutil.dll
2012-02-14 23:03 . 2012-02-14 23:03        48640        ----a-w-        c:\windows\system32\mshtmler.dll
2012-02-14 23:03 . 2012-02-14 23:03        448512        ----a-w-        c:\windows\system32\html.iec
2012-02-14 23:03 . 2012-02-14 23:03        420864        ----a-w-        c:\windows\SysWow64\vbscript.dll
2012-02-14 23:03 . 2012-02-14 23:03        35840        ----a-w-        c:\windows\SysWow64\imgutil.dll
2012-02-14 23:03 . 2012-02-14 23:03        30720        ----a-w-        c:\windows\system32\licmgr10.dll
2012-02-14 23:03 . 2012-02-14 23:03        2382848        ----a-w-        c:\windows\SysWow64\mshtml.tlb
2012-02-14 23:03 . 2012-02-14 23:03        2382848        ----a-w-        c:\windows\system32\mshtml.tlb
2012-02-14 23:03 . 2012-02-14 23:03        23552        ----a-w-        c:\windows\SysWow64\licmgr10.dll
2012-02-14 23:03 . 2012-02-14 23:03        2308096        ----a-w-        c:\windows\system32\jscript9.dll
2012-02-14 23:03 . 2012-02-14 23:03        222208        ----a-w-        c:\windows\system32\msls31.dll
2012-02-14 23:03 . 2012-02-14 23:03        173056        ----a-w-        c:\windows\system32\ieUnatt.exe
2012-02-14 23:03 . 2012-02-14 23:03        165888        ----a-w-        c:\windows\system32\iexpress.exe
2012-02-14 23:03 . 2012-02-14 23:03        160256        ----a-w-        c:\windows\system32\wextract.exe
2012-02-14 23:03 . 2012-02-14 23:03        152064        ----a-w-        c:\windows\SysWow64\wextract.exe
2012-02-14 23:03 . 2012-02-14 23:03        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe
2012-02-14 23:03 . 2012-02-14 23:03        1493504        ----a-w-        c:\windows\system32\inetcpl.cpl
2012-02-14 23:03 . 2012-02-14 23:03        142848        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2012-02-14 23:03 . 2012-02-14 23:03        1427456        ----a-w-        c:\windows\SysWow64\inetcpl.cpl
2012-02-14 23:03 . 2012-02-14 23:03        1390080        ----a-w-        c:\windows\system32\wininet.dll
2012-02-14 23:03 . 2012-02-14 23:03        135168        ----a-w-        c:\windows\system32\IEAdvpack.dll
2012-02-14 23:03 . 2012-02-14 23:03        12288        ----a-w-        c:\windows\system32\mshta.exe
2012-02-14 23:03 . 2012-02-14 23:03        11776        ----a-w-        c:\windows\SysWow64\mshta.exe
2012-02-14 23:03 . 2012-02-14 23:03        114176        ----a-w-        c:\windows\system32\admparse.dll
2012-02-14 23:03 . 2012-02-14 23:03        111616        ----a-w-        c:\windows\system32\iesysprep.dll
2012-02-14 23:03 . 2012-02-14 23:03        101888        ----a-w-        c:\windows\SysWow64\admparse.dll
2012-01-04 09:58 . 2012-02-15 17:21        509952        ----a-w-        c:\windows\system32\ntshrui.dll
2012-01-04 09:03 . 2012-02-15 17:21        442880        ----a-w-        c:\windows\SysWow64\ntshrui.dll
2012-01-03 06:24 . 2012-02-15 17:20        515584        ----a-w-        c:\windows\system32\timedate.cpl
2012-01-03 05:44 . 2012-02-15 17:20        478208        ----a-w-        c:\windows\SysWow64\timedate.cpl
2011-12-28 03:59 . 2012-02-15 17:20        499200        ----a-w-        c:\windows\system32\drivers\afd.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HControlUser"="c:\program files (x86)\ASUS\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]
"CanonSolutionMenuEx"="c:\program files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE" [2010-04-02 1185112]
"IJNetworkScanUtility"="c:\program files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2010-03-02 140640]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
SRS Premium Sound.lnk - c:\windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe [2011-2-20 156952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys [x]
R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x]
R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDScan.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-10-11 86224]
S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2011-03-31 80896]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 09:14        451872        ----a-w-        c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2616729836-2362613055-2871255851-1001Core.job
- c:\users\Adik\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-14 22:38]
.
2012-03-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2616729836-2362613055-2871255851-1001UA.job
- c:\users\Adik\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-14 22:38]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-02 16330272]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-07-30 617856]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-09-01 323584]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-03-24 2726728]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.babylon.com/?babsrc=HP_ss&mntrId=be8fa71e000000000000e0cb4e10c948&tlver=1.4.19.19&ss=1&affID=17395
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: EXIF lesen - c:\program files (x86)\ArcSoft\RAW Thumbnail Viewer\ArcEXIFM.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Adik\AppData\Roaming\Mozilla\Firefox\Profiles\gynvhsc1.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - google.de
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-4rJHeEXlxs54kFa - c:\users\Adik\AppData\Roaming\gw45u45111.exe
Toolbar-Locked - (no file)
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2616729836-2362613055-2871255851-1001\Software\SecuROM\License information*]
@Allowed: (Read) (RestrictedCode)
"datasecu"=hex:2b,7e,9e,be,04,ae,ee,dd,c6,c5,df,65,82,5a,45,20,ab,94,e1,98,55,
  1a,aa,8c,73,32,19,d4,7c,b5,84,7b,79,d3,ee,9d,db,2d,7a,4c,04,0f,fa,63,62,a4,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe
c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Canon\IJPLM\IJPLMSVC.EXE
c:\program files (x86)\ASUS\ATK Hotkey\HControl.exe
c:\program files (x86)\ASUS\ATK Hotkey\ATKOSD.exe
c:\program files (x86)\ASUS\ATK Hotkey\KBFiltr.exe
c:\program files (x86)\ASUS\ATK Hotkey\WDC.exe
c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\windows\AsScrPro.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-03-25  23:50:16 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-03-25 21:50
.
Vor Suchlauf: 12 Verzeichnis(se), 162.411.061.248 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 163.363.983.360 Bytes frei
.
- - End Of File - - C0274C59BF976AB53EF94B8178795C39
--- --- ---

[/QUOTE]


Alle Zeitangaben in WEZ +1. Es ist jetzt 03:16 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131