Trojaner-Board - Firefox öffnet google mit /webhp bin mir ziemlich sicher das ein Virus drauf ist

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Firefox öffnet google mit /webhp bin mir ziemlich sicher das ein Virus drauf ist (https://www.trojaner-board.de/129242-firefox-oeffnet-google-webhp-mir-ziemlich-sicher-virus-drauf.html)

Firefox öffnet google mit /webhp bin mir ziemlich sicher das ein Virus drauf ist

Hi
Mein Bruder konnte es mal wieder nicht lassen und wollte sich illegal programme besorgen resultat ist vermutlich ein Virus was ich so gefunden habe bis jetzt hier im forum und bei Google handelt es sich um ein Rootkit. Zur genaueren Beschreibung er wollte sich einen Activator von Ms office downloaden, hat er aber natürlich nicht :schrei:. Er hat sich eines dieser ungewolten downloader programme runtergeladen anstadt den Activator. Das programm war irgendwas mit Privatize pvp oder pvn mit der beschreibung das man was downloaden kann ohne das es andere merken oder so,genau weiß ich ich es nicht mehr.

Ich habe den Computer bereits von G-Data scannen lassen das programm hat 1 Virus gefunden leider weiß ich die genau beschreibung von ihm nicht mehr es war aber eine .exe, aber ich habe ihn entfernen lassen von dem Programm.. danach hat es nix mehr gefunden. Also war ich der Meinung das alles Ok ist, aber den ist mir aufgefallen das firefox google (nur google) am ende mit /webhp öffnet. Wie schon gesagt berichten im Internet mehrere leute von sowas im zusammenhang mit einem "Rootkit". Nachdem ich hier im Forum gesucht habe aber nix genaueres gefunden habe, habe ich mir den Malwarebytes runtergeladen und durchgeführt er hat nix gefunden überall nur 0. Gerade führe ich einen scan durch mit Sophos Anti Rootkit der zeigt mir bis jetzt aber auch nicht mehr an außer einen HKEy_Users von Windows und Datein die er nicht erkennt (clear.fi,skype... Big Bar.usw) bei bedarf kann ich den Log von Malwarebytes posten habe ich gespeichert

Mfg Nick

Hi
poste alle malwarebytes logs mit Funden:
http://www.trojaner-board.de/125889-...en-posten.html
sophos abbrechen.
öffne GDATA und poste die fundmeldungen

Malwarebytes Anti-Malware (Test) 1.70.0.1100
Malwarebytes : Free anti-malware download

Datenbank Version: v2013.01.09.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Sven:: Sven-PC [Administrator]

Schutz: Aktiviert

09.01.2013 18:17:58
mbam-log-2013-01-09 (18-17-58).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 212674
Laufzeit: 2 Minute(n), 48 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

GDATA

Virenprüfung mit G Data AntiVirus 2013
Version 23.0.5.9 (17.09.2012)
Virensignaturen vom 09.01.2013
Startzeit: 09.01.2013 05:27:31
Engine(s): Engine A (AVA 22.7362), Engine B (AVL 22.1452)
Heuristik: Ein
Archive: Ein
Systembereiche: Ein
RootKits prüfen: Ein

Prüfung der Systembereiche...
Prüfung aller im Speicher befindlichen Prozesse und Verweise im Autostart...
Prüfung auf RootKits...
Prüfung aller lokalen Festplatten...
Analyse vollständig durchgeführt: 09.01.2013 06:26:58
157922 Dateien überprüft
1 infizierte Dateien gefunden
0 verdächtige Dateien gefunden

Objekt: addlyrics1030.exe
Pfad: C:\Users\Sven\AppData\Local\Temp
Status: Virus, Datei gelöscht
Virus: MemScan:Trojan.Generic.8550853 (Engine A)

+ Der Zugriff auf die folgenden Dateien wurde verweigert:

+ Die folgenden Dateien sind Passwortgeschützt:

sind das alle Logs von Malwarebytes? interesse habe ich an denen mit Funden

ja das sind alle...
da ist noch ne andere aber da steht nicht viel drine auch keine funde auser
Message starting Protection
Message Protection startet
Message Starting Ip protection
Ip protection startet usw
Ich mach mal einen Kompletten scann mit Malwarebytes vill findet er den mehr

Ok,
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://larusso.trojaner-board.de/Images/otlfix.jpg
Textbox.

Code:

activex

netsvcs

msconfig

%SYSTEMDRIVE%\*.

%PROGRAMFILES%\*.exe

%LOCALAPPDATA%\*.exe

%systemroot%\*. /mp /s

C:\Windows\system32\*.tsp

/md5start

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

explorer.exe

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\*.dll /lockedfiles

%USERPROFILE%\*.*

%USERPROFILE%\Local Settings\Temp\*.exe

%USERPROFILE%\Local Settings\Temp\*.dll

%USERPROFILE%\Application Data\*.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

OTL Logfile:

Code:

OTL logfile created on: 09.01.2013 19:37:29 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Sven\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

7,98 Gb Total Physical Memory | 5,46 Gb Available Physical Memory | 68,44% Memory free

15,96 Gb Paging File | 12,94 Gb Available in Paging File | 81,08% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 95,69 Gb Total Space | 23,15 Gb Free Space | 24,19% Space Free | Partition Type: NTFS

Drive D: | 698,63 Gb Total Space | 483,26 Gb Free Space | 69,17% Space Free | Partition Type: NTFS

 

Computer Name: ********* | User Name: ****** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2013.01.09 19:32:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Bouillon\Desktop\OTL.exe

PRC - [2013.01.06 21:58:28 | 000,246,112 | ---- | M] () -- C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe

PRC - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

PRC - [2012.09.23 20:43:34 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2012.09.17 04:24:09 | 000,995,352 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe

PRC - [2012.08.23 14:46:06 | 001,542,680 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe

PRC - [2012.03.29 03:42:27 | 000,470,008 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe

PRC - [2012.01.27 04:43:34 | 000,468,472 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKService.exe

PRC - [2011.08.24 18:03:42 | 000,169,352 | ---- | M] () -- C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe

PRC - [2011.07.01 03:51:14 | 000,418,896 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMutilps32.exe

PRC - [2011.07.01 03:51:14 | 000,343,632 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe

PRC - [2011.07.01 03:51:12 | 001,103,440 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe

PRC - [2011.07.01 03:51:12 | 000,353,360 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe

PRC - [2011.05.30 03:54:14 | 000,036,456 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe

PRC - [2011.05.12 16:59:00 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

PRC - [2011.04.24 02:29:20 | 000,256,832 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe

PRC - [2011.04.24 02:28:38 | 000,297,280 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe

PRC - [2011.04.22 17:44:14 | 000,244,624 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe

PRC - [2011.03.14 16:27:28 | 000,236,384 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\ProgramData\DatacardService\DCSHelper.exe

PRC - [2011.02.01 22:24:42 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

PRC - [2011.02.01 22:24:40 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

PRC - [2011.01.13 02:00:42 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

PRC - [2010.11.17 02:53:16 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

PRC - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011.08.24 18:03:42 | 000,206,216 | ---- | M] () -- C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\CLNetMediaDMA.dll

MOD - [2011.08.24 18:03:42 | 000,169,352 | ---- | M] () -- C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe

MOD - [2011.04.24 02:29:56 | 000,465,640 | ---- | M] () -- C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - [2011.02.08 15:00:20 | 000,203,776 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV - [2013.01.09 05:19:13 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2013.01.06 21:58:28 | 000,246,112 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe -- (Mobile Partner. RunOuc)

SRV - [2013.01.01 23:58:03 | 000,541,760 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)

SRV - [2012.12.05 22:48:35 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.11.07 16:32:01 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2012.09.23 20:43:34 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2012.08.30 04:06:18 | 002,011,568 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKWCtlX64.exe -- (AVKWCtl)

SRV - [2012.08.23 14:46:06 | 001,542,680 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe -- (AVKProxy)

SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.03.29 03:42:27 | 000,470,008 | ---- | M] (G Data Software AG) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe -- (GDScan)

SRV - [2012.01.27 04:43:34 | 000,468,472 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKService.exe -- (AVKService)

SRV - [2011.08.30 14:21:32 | 001,085,216 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)

SRV - [2011.08.02 11:59:46 | 000,872,552 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)

SRV - [2011.07.01 03:51:12 | 000,353,360 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)

SRV - [2011.06.21 12:55:04 | 000,173,424 | ---- | M] (Egis Technology Inc. ) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe -- (EgisTec Ticket Service)

SRV - [2011.06.07 12:25:12 | 000,191,752 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)

SRV - [2011.05.30 03:54:14 | 000,036,456 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)

SRV - [2011.05.12 16:59:00 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)

SRV - [2011.05.06 10:55:04 | 000,245,744 | ---- | M] (CyberLink) [Auto | Stopped] -- C:\Program Files (x86)\Acer\clear.fi\Movie\NavFilter\kmsvc.exe -- (CLKMSVC10_34E30CCC)

SRV - [2011.04.24 02:29:20 | 000,256,832 | ---- | M] (NTI Corporation) [Auto | Running] -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)

SRV - [2011.04.22 17:44:14 | 000,244,624 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Live Updater Service)

SRV - [2011.03.29 05:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2011.03.14 16:27:34 | 000,346,976 | ---- | M] () [Auto | Running] -- C:\ProgramData\DatacardService\HWDeviceService64.exe -- (HWDeviceService64.exe)

SRV - [2011.02.01 22:24:42 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)

SRV - [2011.02.01 22:24:40 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)

SRV - [2011.01.13 02:00:42 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)

SRV - [2010.11.29 15:00:56 | 000,149,504 | ---- | M] (Intel(R) Corporation) [On_Demand | Running] -- C:\Programme\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)

SRV - [2010.10.12 18:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)

SRV - [2010.09.23 02:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)

SRV - [2010.06.01 23:31:28 | 002,804,568 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe -- (NOBU)

SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)

SRV - [2010.01.09 21:20:56 | 000,174,440 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose64)

SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2013.01.09 05:16:29 | 000,106,648 | ---- | M] (G Data Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\GRD.sys -- (GRD)

DRV:64bit: - [2013.01.06 21:58:33 | 000,421,376 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbwwan.sys -- (ewusbmbb)

DRV:64bit: - [2013.01.06 21:58:33 | 000,222,464 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)

DRV:64bit: - [2013.01.06 21:58:33 | 000,117,248 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)

DRV:64bit: - [2013.01.06 21:58:33 | 000,086,016 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator)

DRV:64bit: - [2013.01.06 17:57:33 | 000,126,880 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\MiniIcpt.sys -- (GDMnIcpt)

DRV:64bit: - [2013.01.06 17:57:33 | 000,064,416 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\gdwfpcd64.sys -- (gdwfpcd)

DRV:64bit: - [2013.01.06 17:57:33 | 000,060,320 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PktIcpt.sys -- (GDPkIcpt)

DRV:64bit: - [2013.01.06 17:57:33 | 000,054,176 | ---- | M] (G Data Software AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\GDBehave.sys -- (GDBehave)

DRV:64bit: - [2013.01.06 17:49:26 | 000,064,376 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\HookCentre.sys -- (HookCentre)

DRV:64bit: - [2012.12.14 16:49:28 | 000,024,176 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2012.11.07 16:31:18 | 000,062,776 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)

DRV:64bit: - [2012.11.07 16:31:18 | 000,022,648 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)

DRV:64bit: - [2012.11.07 16:31:18 | 000,020,520 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)

DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011.09.20 11:02:55 | 000,018,432 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)

DRV:64bit: - [2011.09.20 11:02:55 | 000,017,408 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)

DRV:64bit: - [2011.08.30 08:30:12 | 000,089,640 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwdpan.sys -- (BTWDPAN)

DRV:64bit: - [2011.08.30 08:30:10 | 000,620,072 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (btwampfl)

DRV:64bit: - [2011.08.30 08:30:00 | 000,178,728 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)

DRV:64bit: - [2011.08.30 08:30:00 | 000,167,976 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)

DRV:64bit: - [2011.08.30 08:30:00 | 000,039,976 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)

DRV:64bit: - [2011.08.30 08:30:00 | 000,021,544 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)

DRV:64bit: - [2011.07.14 06:35:47 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.07.14 06:35:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2011.06.08 17:36:14 | 004,729,408 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)

DRV:64bit: - [2011.02.10 07:52:34 | 000,181,760 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)

DRV:64bit: - [2011.02.10 07:52:34 | 000,082,432 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)

DRV:64bit: - [2011.02.08 15:52:26 | 009,078,272 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)

DRV:64bit: - [2011.02.08 14:23:04 | 000,299,520 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2011.01.13 01:51:44 | 000,439,320 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2010.11.29 15:00:04 | 000,016,120 | ---- | M] (Intel(R) Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB)

DRV:64bit: - [2010.11.21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

DRV:64bit: - [2010.11.17 00:04:32 | 000,115,216 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)

DRV:64bit: - [2010.11.12 07:23:40 | 000,138,024 | ---- | M] (ELAN Microelectronics Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)

DRV:64bit: - [2010.10.20 01:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)

DRV:64bit: - [2010.09.27 08:24:44 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)

DRV:64bit: - [2010.07.20 10:43:22 | 000,247,400 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)

DRV:64bit: - [2009.11.18 10:55:50 | 001,308,160 | ---- | M] (C-Media Electronics Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CM10864.sys -- (USBPNPA)

DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.06.18 12:54:10 | 000,006,144 | ---- | M] (Sophos Plc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\5FF0.tmp -- (MEMSWEEP2)

DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{10D54167-EEEF-4D41-8922-9A3607BB9257}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://searchab.com/?aff=7&uid=5ddebcc7-5a13-11e2-a839-dc0ea117d874&q={searchTerms}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..CT3272810.browser.search.defaultthis.engineName: true

FF - prefs.js..browser.search.defaultengine: "Privitize VPN"

FF - prefs.js..browser.search.defaultenginename: "Privitize VPN"

FF - prefs.js..browser.search.order.1: "Privitize VPN"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://searchab.com/?aff=7&uid=5ddebcc7-5a13-11e2-a839-dc0ea117d874"

FF - prefs.js..extensions.enabledAddons: %7Bd49a148e-817e-4025-bee3-5d541376de3b%7D:1.6

FF - prefs.js..extensions.enabledAddons: battlefieldheroespatcher%40ea.com:5.0.196.0

FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.4.2

FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.4.3

FF - prefs.js..extensions.enabledAddons: admin%40proxy-listen.de:1.0.4.5

FF - prefs.js..extensions.enabledAddons: %7B906305f7-aafc-45e9-8bbd-941950a84dad%7D:1.1.11215.1124

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1

FF - prefs.js..keyword.URL: "hxxp://searchab.com/?aff=7&uid=5ddebcc7-5a13-11e2-a839-dc0ea117d874&q="

FF - prefs.js..network.proxy.http: "5.39.119.105"

FF - prefs.js..network.proxy.http_port: 8080

FF - prefs.js..network.proxy.share_proxy_settings: true

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files (x86)\Common Files\McAfee\SystemCore

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.01.09 05:18:59 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\msktbird@mcafee.com: C:\Program Files\McAfee\MSK

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.01.09 05:18:59 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2012.11.07 17:03:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bouillon\AppData\Roaming\mozilla\Extensions

[2013.01.09 18:13:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bouillon\AppData\Roaming\mozilla\Firefox\Profiles\h4cgt85a.default\extensions

[2012.12.21 23:33:01 | 000,000,000 | ---D | M] (Battlefield Heroes Updater) -- C:\Users\Bouillon\AppData\Roaming\mozilla\Firefox\Profiles\h4cgt85a.default\extensions\battlefieldheroespatcher@ea.com

[2013.01.05 01:27:34 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Bouillon\AppData\Roaming\mozilla\Firefox\Profiles\h4cgt85a.default\extensions\ich@maltegoetz.de

[2013.01.05 06:08:22 | 000,013,955 | ---- | M] () (No name found) -- C:\Users\Bouillon\AppData\Roaming\mozilla\firefox\profiles\h4cgt85a.default\extensions\admin@proxy-listen.de.xpi

[2012.12.28 04:40:05 | 000,533,036 | ---- | M] () (No name found) -- C:\Users\Bouillon\AppData\Roaming\mozilla\firefox\profiles\h4cgt85a.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

[2012.11.24 16:39:05 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\Bouillon\AppData\Roaming\mozilla\firefox\profiles\h4cgt85a.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

[2012.11.08 17:04:33 | 000,009,012 | ---- | M] () (No name found) -- C:\Users\Bouillon\AppData\Roaming\mozilla\firefox\profiles\h4cgt85a.default\extensions\{d49a148e-817e-4025-bee3-5d541376de3b}.xpi

[2013.01.09 05:16:59 | 000,002,090 | ---- | M] () -- C:\Users\Bouillon\AppData\Roaming\mozilla\firefox\profiles\h4cgt85a.default\searchplugins\Searchab.xml

[2013.01.04 21:50:43 | 000,001,070 | ---- | M] () -- C:\Users\Bouillon\AppData\Roaming\mozilla\firefox\profiles\h4cgt85a.default\searchplugins\whitesmoke-us-new-e1-customized-web-search.xml

[2013.01.06 17:49:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2013.01.06 17:57:33 | 000,000,000 | ---D | M] (G Data BankGuard) -- C:\Program Files (x86)\mozilla firefox\extensions\{906305f7-aafc-45e9-8bbd-941950a84dad}

[2012.12.05 22:48:35 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.10.24 23:03:12 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.10.24 23:03:11 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.10.24 23:03:12 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.10.24 23:03:12 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.10.24 23:03:12 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.10.24 23:03:11 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20121116055252.dll File not found

O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20121215162350.dll File not found

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (G Data BankGuard) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Program Files (x86)\Common Files\G DATA\AVKProxy\BanksafeBHO.dll (G Data Software AG)

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O4:64bit: - HKLM..\Run: [Cm108Sound] C:\Windows\Syswow64\cm108.dll (C-Media Corporation)

O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Programme\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)

O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found

O4:64bit: - HKLM..\Run: [Power Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)

O4:64bit: - HKLM..\Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [ArcadeMovieService] C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe (CyberLink Corp.)

O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (NTI Corporation)

O4 - HKLM..\Run: [Dolby Advanced Audio v2] C:\Dolby PCEE4\pcee4.exe (Dolby Laboratories Inc.)

O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Program Files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe (G Data Software AG)

O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)

O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)

O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)

O4 - HKCU..\Run: [Spotify] C:\Users\Bouillon\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd)

O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Bouillon\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)

O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)

O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - Startup: C:\Users\Bouillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

O4 - Startup: C:\Users\Bouillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Überwachungstool für die Intel® Turbo-Boost-Technik 2.0.lnk =  File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8:64bit: - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)

O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)

O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)

O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 83.169.186.161 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{30CFDE73-B513-4E80-8C05-70698A5519AF}: NameServer = 193.189.244.225 193.189.244.206

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8B0F37F6-C332-4D6A-922C-0B5A25087487}: DhcpNameServer = 192.168.1.250

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A362AB09-50F3-44DC-B8D6-992A29185EE3}: DhcpNameServer = 83.169.186.161 192.168.0.1

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18 - Protocol\Handler\ms-help - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{914e48c5-5843-11e2-97ba-dc0ea117d874}\Shell - "" = AutoRun

O33 - MountPoints2\{914e48c5-5843-11e2-97ba-dc0ea117d874}\Shell\AutoRun\command - "" = F:\AutoRun.exe

O33 - MountPoints2\{914e48d3-5843-11e2-97ba-dc0ea117d874}\Shell - "" = AutoRun

O33 - MountPoints2\{914e48d3-5843-11e2-97ba-dc0ea117d874}\Shell\AutoRun\command - "" = F:\AutoRun.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

 

 

CREATERESTOREPOINT

System Restore Service not available.

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.01.09 19:32:33 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Bouillon\Desktop\OTL.exe

[2013.01.09 18:26:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sophos

[2013.01.09 18:17:26 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Roaming\Malwarebytes

[2013.01.09 18:17:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2013.01.09 18:17:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2013.01.09 18:17:13 | 000,024,176 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2013.01.09 18:17:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2013.01.09 18:17:06 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Local\Programs

[2013.01.09 17:06:45 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Roaming\TS3Client

[2013.01.09 17:06:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client

[2013.01.09 17:06:22 | 000,000,000 | ---D | C] -- C:\Program Files\TeamSpeak 3 Client

[2013.01.09 16:58:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

[2013.01.09 16:58:39 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight

[2013.01.09 16:58:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight

[2013.01.09 06:33:20 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype

[2013.01.09 06:33:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2013.01.09 06:33:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2013.01.09 05:27:32 | 000,016,504 | ---- | C] (G Data Software) -- C:\Windows\SysNative\drivers\GdPhyMem.sys

[2013.01.09 05:16:29 | 000,106,648 | ---- | C] (G Data Software) -- C:\Windows\SysNative\drivers\GRD.sys

[2013.01.09 05:01:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office

[2013.01.09 05:01:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER

[2013.01.09 04:58:25 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Analysis Services

[2013.01.09 04:58:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services

[2013.01.09 04:58:12 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Local\Microsoft Help

[2013.01.09 04:58:11 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office

[2013.01.09 04:58:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help

[2013.01.09 04:58:05 | 000,000,000 | RH-D | C] -- C:\MSOCache

[2013.01.09 04:33:20 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Local\MicrosoftStore

[2013.01.06 21:58:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mobile Partner

[2013.01.06 21:58:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Mobile Partner

[2013.01.06 21:58:41 | 001,001,472 | ---- | C] (DiBcom SA) -- C:\Windows\SysNative\drivers\mod7700.sys

[2013.01.06 21:58:41 | 000,421,376 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ewusbwwan.sys

[2013.01.06 21:58:41 | 000,222,464 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ewusbmdm.sys

[2013.01.06 21:58:41 | 000,212,992 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ew_juwwanecm.sys

[2013.01.06 21:58:41 | 000,117,248 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys

[2013.01.06 21:58:41 | 000,098,816 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ew_jucdcacm.sys

[2013.01.06 21:58:41 | 000,086,016 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ew_jubusenum.sys

[2013.01.06 21:58:41 | 000,069,632 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ew_jucdcecm.sys

[2013.01.06 21:58:41 | 000,032,768 | ---- | C] (Huawei Tech. Co., Ltd.) -- C:\Windows\SysNative\drivers\ewdcsc.sys

[2013.01.06 21:58:41 | 000,028,672 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ew_juextctrl.sys

[2013.01.06 21:58:41 | 000,022,016 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ew_hwupgrade.sys

[2013.01.06 21:58:41 | 000,013,952 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ew_usbenumfilter.sys

[2013.01.06 21:58:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mobile Partner

[2013.01.06 21:58:13 | 000,000,000 | ---D | C] -- C:\ProgramData\DatacardService

[2013.01.06 17:57:33 | 000,010,792 | ---- | C] (G Data Software AG) -- C:\Windows\SysWow64\GdScrSv.de.dll

[2013.01.06 17:49:52 | 000,060,320 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\PktIcpt.sys

[2013.01.06 17:49:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data AntiVirus 2013

[2013.01.06 17:49:26 | 000,126,880 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\MiniIcpt.sys

[2013.01.06 17:49:26 | 000,064,416 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys

[2013.01.06 17:49:26 | 000,064,376 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\HookCentre.sys

[2013.01.06 17:49:26 | 000,054,176 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\GDBehave.sys

[2013.01.06 17:49:20 | 000,000,000 | ---D | C] -- C:\ProgramData\G DATA

[2013.01.06 17:49:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\G Data

[2013.01.06 17:49:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\G Data

[2013.01.06 17:44:36 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Local\Downloaded Installations

[2013.01.06 00:55:00 | 000,000,000 | R--D | C] -- C:\Users\Bouillon\Desktop\Verschiedenes

[2013.01.05 19:53:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Euro Truck Simulator 2

[2013.01.05 19:52:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Euro Truck Simulator 2

[2013.01.04 21:51:50 | 000,000,000 | ---D | C] -- C:\ProgramData\WoW Worldwide Software LTD

[2013.01.04 21:51:13 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Roaming\SendSpace

[2013.01.04 21:51:06 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Local\SwvUpdater

[2013.01.04 21:49:23 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate

[2013.01.04 06:47:16 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\Documents\My Cheat Tables

[2013.01.04 06:40:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 6.2

[2013.01.04 06:40:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cheat Engine 6.2

[2013.01.03 22:16:29 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\Documents\Euro Truck Simulator 2

[2013.01.02 04:43:30 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\Documents\Games for Windows - LIVE Demos

[2013.01.02 00:52:11 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\xlive

[2013.01.02 00:52:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace

[2013.01.02 00:52:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Games for Windows - LIVE

[2013.01.01 23:51:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam

[2013.01.01 23:51:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Steam

[2012.12.31 18:39:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SystemRequirementsLab

[2012.12.31 18:39:16 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\SystemRequirementsLab

[2012.12.30 19:51:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Steam

[2012.12.24 01:59:14 | 000,000,000 | ---D | C] -- C:\AMD

[2012.12.24 01:49:13 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Roaming\ATI

[2012.12.24 01:49:13 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Local\ATI

[2012.12.24 01:49:13 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI

[2012.12.23 21:46:05 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

[2012.12.21 23:33:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EA Games

[2012.12.21 00:32:02 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Roaming\Windows Live Writer

[2012.12.21 00:32:02 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Local\Windows Live Writer

[2012.12.20 02:52:18 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\.thumbnails

[2012.12.20 02:51:34 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Local\fontconfig

[2012.12.20 02:51:33 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Local\gegl-0.2

[2012.12.20 02:51:33 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\.gimp-2.8

[2012.12.20 02:36:58 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\Documents\FUSSBALL MANAGER 13

[2012.12.18 14:20:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Hewlett-Packard

[2012.12.17 17:16:56 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Common Files\EAInstaller

[2012.12.17 16:57:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin Games

[2012.12.17 16:57:42 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Roaming\Origin

[2012.12.17 16:57:32 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Local\Origin

[2012.12.17 16:56:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin

[2012.12.17 16:56:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Origin

[2012.12.17 16:56:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin

[2012.12.15 19:35:29 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Roaming\OpenOffice.org

[2012.12.15 19:34:30 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4.1

[2012.12.15 19:34:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenOffice.org 3

[2012.12.11 20:44:41 | 000,000,000 | ---D | C] -- C:\Windows\Sun

[2012.12.11 20:41:34 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Roaming\PowerCinema

[2012.12.11 20:39:35 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\AppData\Local\Broadcom

[2012.12.11 20:39:35 | 000,000,000 | ---D | C] -- C:\Users\Bouillon\Documents\Bluetooth-Exchange-Ordner

[2012.12.10 23:21:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts

[2012.12.10 23:21:25 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core

[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.01.09 19:32:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Bouillon\Desktop\OTL.exe

[2013.01.09 19:19:09 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2013.01.09 18:55:41 | 000,022,277 | ---- | M] () -- C:\Users\Bouillon\Desktop\G Data Protokoll ID 29.html

[2013.01.09 18:17:15 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2013.01.09 17:06:25 | 000,000,971 | ---- | M] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

[2013.01.09 16:05:01 | 000,727,226 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2013.01.09 16:05:01 | 000,637,418 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2013.01.09 16:05:01 | 000,152,786 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2013.01.09 16:05:01 | 000,126,838 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2013.01.09 16:05:01 | 000,005,190 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2013.01.09 16:02:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.01.09 13:50:50 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.01.09 13:50:50 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.01.09 13:48:37 | 000,940,409 | ---- | M] () -- C:\Windows\SysWow64\sig.bin

[2013.01.09 13:48:37 | 000,050,871 | ---- | M] () -- C:\Windows\SysWow64\nmp.map

[2013.01.09 13:43:46 | 000,457,368 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2013.01.09 13:43:32 | 2133,217,279 | -HS- | M] () -- C:\hiberfil.sys

[2013.01.09 06:33:20 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2013.01.09 05:27:32 | 000,016,504 | ---- | M] (G Data Software) -- C:\Windows\SysNative\drivers\GdPhyMem.sys

[2013.01.09 05:18:54 | 000,000,000 | ---- | M] () -- C:\END

[2013.01.09 05:16:29 | 000,106,648 | ---- | M] (G Data Software) -- C:\Windows\SysNative\drivers\GRD.sys

[2013.01.09 05:05:03 | 000,003,029 | ---- | M] () -- C:\Users\Bouillon\Desktop\Microsoft Word 2010.lnk

[2013.01.07 14:26:34 | 000,001,070 | ---- | M] () -- C:\Windows\Cm108.ini.imi

[2013.01.06 21:58:44 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_ew_jubusenum_01007.Wdf

[2013.01.06 21:58:33 | 001,001,472 | ---- | M] (DiBcom SA) -- C:\Windows\SysNative\drivers\mod7700.sys

[2013.01.06 21:58:33 | 000,421,376 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ewusbwwan.sys

[2013.01.06 21:58:33 | 000,222,464 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ewusbmdm.sys

[2013.01.06 21:58:33 | 000,212,992 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ew_juwwanecm.sys

[2013.01.06 21:58:33 | 000,117,248 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys

[2013.01.06 21:58:33 | 000,098,816 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ew_jucdcacm.sys

[2013.01.06 21:58:33 | 000,086,016 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ew_jubusenum.sys

[2013.01.06 21:58:33 | 000,069,632 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ew_jucdcecm.sys

[2013.01.06 21:58:33 | 000,032,768 | ---- | M] (Huawei Tech. Co., Ltd.) -- C:\Windows\SysNative\drivers\ewdcsc.sys

[2013.01.06 21:58:33 | 000,028,672 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ew_juextctrl.sys

[2013.01.06 21:58:33 | 000,022,016 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ew_hwupgrade.sys

[2013.01.06 21:58:33 | 000,013,952 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ew_usbenumfilter.sys

[2013.01.06 17:57:33 | 000,126,880 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\MiniIcpt.sys

[2013.01.06 17:57:33 | 000,064,416 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys

[2013.01.06 17:57:33 | 000,060,320 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\PktIcpt.sys

[2013.01.06 17:57:33 | 000,054,176 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\GDBehave.sys

[2013.01.06 17:49:26 | 000,064,376 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\HookCentre.sys

[2013.01.06 17:49:24 | 000,002,089 | ---- | M] () -- C:\Users\Public\Desktop\G Data AntiVirus.lnk

[2013.01.05 19:53:19 | 000,001,336 | ---- | M] () -- C:\Users\Public\Desktop\Euro Truck Simulator 2.lnk

[2013.01.04 06:40:43 | 000,001,089 | ---- | M] () -- C:\Users\Bouillon\Desktop\Cheat Engine.lnk

[2013.01.02 00:34:12 | 000,000,222 | ---- | M] () -- C:\Users\Bouillon\Desktop\Microsoft Flight.url

[2013.01.01 23:51:38 | 000,000,921 | ---- | M] () -- C:\Users\Public\Desktop\Steam.lnk

[2012.12.29 07:43:16 | 000,001,214 | ---- | M] () -- C:\Users\Public\Desktop\Battlefield 1942.lnk

[2012.12.20 02:59:23 | 000,002,111 | ---- | M] () -- C:\Users\Bouillon\AppData\Local\recently-used.xbel

[2012.12.20 02:41:21 | 000,068,311 | ---- | M] () -- C:\Users\Bouillon\Documents\Snapshot_20121220.JPG

[2012.12.20 02:31:18 | 000,001,224 | ---- | M] () -- C:\Users\Public\Desktop\FUSSBALL MANAGER 13.lnk

[2012.12.20 01:49:21 | 000,000,138 | ---- | M] () -- C:\Windows\wininit.ini

[2012.12.17 16:56:47 | 000,000,983 | ---- | M] () -- C:\Users\Public\Desktop\Origin.lnk

[2012.12.15 19:44:01 | 000,011,485 | ---- | M] () -- C:\Users\Bouillon\Documents\Unbenannt 1.odt

[2012.12.15 19:35:34 | 000,001,239 | ---- | M] () -- C:\Users\Bouillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

[2012.12.15 19:34:30 | 000,001,172 | ---- | M] () -- C:\Users\Public\Desktop\OpenOffice.org 3.4.1.lnk

[2012.12.14 16:49:28 | 000,024,176 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2013.01.09 18:55:41 | 000,022,277 | ---- | C] () -- C:\Users\Bouillon\Desktop\G Data Protokoll ID 29.html

[2013.01.09 18:17:15 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2013.01.09 17:06:25 | 000,000,971 | ---- | C] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

[2013.01.09 05:05:03 | 000,003,029 | ---- | C] () -- C:\Users\Bouillon\Desktop\Microsoft Word 2010.lnk

[2013.01.06 21:58:44 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_ew_jubusenum_01007.Wdf

[2013.01.06 20:57:35 | 000,940,409 | ---- | C] () -- C:\Windows\SysWow64\sig.bin

[2013.01.06 20:57:35 | 000,050,871 | ---- | C] () -- C:\Windows\SysWow64\nmp.map

[2013.01.06 17:49:24 | 000,002,089 | ---- | C] () -- C:\Users\Public\Desktop\G Data AntiVirus.lnk

[2013.01.06 17:48:26 | 000,001,067 | ---- | C] () -- C:\Users\Bouillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Überwachungstool für die Intel® Turbo-Boost-Technik 2.0.lnk

[2013.01.05 19:53:19 | 000,001,336 | ---- | C] () -- C:\Users\Public\Desktop\Euro Truck Simulator 2.lnk

[2013.01.04 21:50:31 | 000,000,000 | ---- | C] () -- C:\END

[2013.01.04 06:40:43 | 000,001,089 | ---- | C] () -- C:\Users\Bouillon\Desktop\Cheat Engine.lnk

[2013.01.02 00:34:12 | 000,000,222 | ---- | C] () -- C:\Users\Bouillon\Desktop\Microsoft Flight.url

[2013.01.01 23:51:38 | 000,000,921 | ---- | C] () -- C:\Users\Public\Desktop\Steam.lnk

[2012.12.23 21:45:07 | 000,001,214 | ---- | C] () -- C:\Users\Public\Desktop\Battlefield 1942.lnk

[2012.12.20 02:59:23 | 000,002,111 | ---- | C] () -- C:\Users\Bouillon\AppData\Local\recently-used.xbel

[2012.12.20 02:41:21 | 000,068,311 | ---- | C] () -- C:\Users\Bouillon\Documents\Snapshot_20121220.JPG

[2012.12.20 02:13:02 | 000,001,224 | ---- | C] () -- C:\Users\Public\Desktop\FUSSBALL MANAGER 13.lnk

[2012.12.17 16:56:47 | 000,000,983 | ---- | C] () -- C:\Users\Public\Desktop\Origin.lnk

[2012.12.17 16:56:47 | 000,000,138 | ---- | C] () -- C:\Windows\wininit.ini

[2012.12.15 19:43:59 | 000,011,485 | ---- | C] () -- C:\Users\Bouillon\Documents\Unbenannt 1.odt

[2012.12.15 19:35:34 | 000,001,239 | ---- | C] () -- C:\Users\Bouillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

[2012.12.15 19:34:30 | 000,001,172 | ---- | C] () -- C:\Users\Public\Desktop\OpenOffice.org 3.4.1.lnk

[2012.11.17 01:43:00 | 000,143,360 | ---- | C] () -- C:\Windows\Vmix108.dll

[2012.11.17 01:42:48 | 000,000,327 | ---- | C] () -- C:\Windows\Cm108.ini.cfl

[2012.11.17 01:42:01 | 000,002,029 | ---- | C] () -- C:\Windows\Cm108.ini.cfg

[2012.11.17 01:42:01 | 000,001,070 | ---- | C] () -- C:\Windows\Cm108.ini.imi

[2012.11.08 23:24:32 | 000,007,605 | ---- | C] () -- C:\Users\Bouillon\AppData\Local\Resmon.ResmonCfg

[2012.11.07 16:14:21 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2012.11.07 16:12:04 | 000,003,126 | ---- | C] () -- C:\Windows\SysWow64\atipblup.dat

[2011.10.20 09:59:36 | 000,003,126 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

[2011.09.28 17:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

[2013.01.06 04:45:51 | 000,000,000 | ---D | M] -- C:\Users\Bouillon\AppData\Roaming\.minecraft

[2012.12.15 19:35:29 | 000,000,000 | ---D | M] -- C:\Users\Bouillon\AppData\Roaming\OpenOffice.org

[2012.12.18 16:11:52 | 000,000,000 | ---D | M] -- C:\Users\Bouillon\AppData\Roaming\Origin

[2012.12.11 20:41:45 | 000,000,000 | ---D | M] -- C:\Users\Bouillon\AppData\Roaming\PowerCinema

[2012.11.07 16:57:27 | 000,000,000 | ---D | M] -- C:\Users\Bouillon\AppData\Roaming\Screensaver

[2013.01.04 21:51:13 | 000,000,000 | ---D | M] -- C:\Users\Bouillon\AppData\Roaming\SendSpace

[2013.01.09 18:17:01 | 000,000,000 | ---D | M] -- C:\Users\Bouillon\AppData\Roaming\Spotify

[2013.01.09 17:22:38 | 000,000,000 | ---D | M] -- C:\Users\Bouillon\AppData\Roaming\TS3Client

[2012.12.21 00:32:02 | 000,000,000 | ---D | M] -- C:\Users\Bouillon\AppData\Roaming\Windows Live Writer

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %SYSTEMDRIVE%\*. >

[2012.11.07 16:57:16 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin

[2012.12.24 01:59:14 | 000,000,000 | ---D | M] -- C:\AMD

[2012.11.07 16:14:34 | 000,000,000 | -H-D | M] -- C:\book

[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2012.11.07 16:55:18 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen

[2012.11.07 16:39:42 | 000,000,000 | ---D | M] -- C:\Dolby PCEE4

[2011.10.20 09:18:08 | 000,000,000 | -H-D | M] -- C:\Intel

[2013.01.09 04:58:05 | 000,000,000 | RH-D | M] -- C:\MSOCache

[2012.11.07 16:56:57 | 000,000,000 | -H-D | M] -- C:\OEM

[2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs

[2013.01.09 17:06:22 | 000,000,000 | R--D | M] -- C:\Program Files

[2013.01.09 18:26:09 | 000,000,000 | R--D | M] -- C:\Program Files (x86)

[2013.01.09 18:17:14 | 000,000,000 | -H-D | M] -- C:\ProgramData

[2012.11.07 16:55:18 | 000,000,000 | -HSD | M] -- C:\Programme

[2012.11.07 16:55:18 | 000,000,000 | -HSD | M] -- C:\Recovery

[2013.01.09 06:35:51 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2012.11.07 16:55:22 | 000,000,000 | R--D | M] -- C:\Users

[2013.01.01 23:51:38 | 000,000,000 | ---D | M] -- C:\Windows

 
 < %PROGRAMFILES%\*.exe >

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 
 < C:\Windows\system32\*.tsp >

[2009.07.14 02:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp

[2009.07.14 02:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp

[2009.07.14 02:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp

[2009.07.14 02:14:11 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp

[2010.11.21 04:23:55 | 000,281,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp

[2009.07.14 06:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT

[2009.07.14 06:08:49 | 000,031,878 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2012.11.07 17:07:55 | 000,000,884 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: EXPLORER.EXE  >

[2011.07.14 06:30:29 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe

[2011.07.14 06:30:29 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe

[2011.07.14 06:30:29 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe

[2011.07.14 06:30:29 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe

[2010.11.21 04:24:25 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe

[2011.07.14 06:30:29 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe

[2011.07.14 06:30:29 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe

[2010.11.21 04:24:11 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

 
 < MD5 for: IASTOR.SYS  >

[2011.01.12 10:51:44 | 000,439,320 | ---- | M] (Intel Corporation) MD5=D469B77687E12FE43E344806740B624D -- C:\OEM\Preload\Autorun\DRV\Intel AHCI\f6flpy-x64\iaStor.sys

[2011.01.13 01:51:44 | 000,439,320 | ---- | M] (Intel Corporation) MD5=D469B77687E12FE43E344806740B624D -- C:\Windows\SysNative\drivers\iaStor.sys

[2011.01.13 01:51:44 | 000,439,320 | ---- | M] (Intel Corporation) MD5=D469B77687E12FE43E344806740B624D -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_a36325196df56f7d\iaStor.sys

[2011.01.12 10:44:08 | 000,355,352 | ---- | M] (Intel Corporation) MD5=F989555F1662581032CCE1578A8FF28E -- C:\OEM\Preload\Autorun\DRV\Intel AHCI\f6flpy-x86\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2010.11.21 04:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.21 04:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011.07.14 06:35:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.07.14 06:35:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.07.14 06:35:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.07.14 06:35:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2010.11.21 04:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.21 04:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.21 04:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.21 04:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2011.07.14 06:35:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.07.14 06:35:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.07.14 06:35:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.07.14 06:35:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.21 04:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.21 04:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2010.11.21 04:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.21 04:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.21 04:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.21 04:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.21 04:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll

[2010.11.21 04:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2010.11.21 04:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll

[2010.11.21 04:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2010.11.21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010.11.21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2012.12.14 16:49:28 | 000,216,424 | ---- | M] () MD5=22101A85B3CA2FE2BE05FE9A61A7A83D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 < %USERPROFILE%\*.* >

[2013.01.09 19:53:37 | 002,097,152 | -HS- | M] () -- C:\Users\Bouillon\NTUSER.DAT

[2013.01.09 19:53:37 | 000,262,144 | -HS- | M] () -- C:\Users\Bouillon\ntuser.dat.LOG1

[2012.11.07 16:55:27 | 000,000,000 | -HS- | M] () -- C:\Users\Bouillon\ntuser.dat.LOG2

[2012.11.07 17:00:55 | 000,065,536 | -HS- | M] () -- C:\Users\Bouillon\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf

[2012.11.07 17:00:55 | 000,524,288 | -HS- | M] () -- C:\Users\Bouillon\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms

[2012.11.07 17:00:55 | 000,524,288 | -HS- | M] () -- C:\Users\Bouillon\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms

[2012.11.07 16:55:27 | 000,000,020 | -HS- | M] () -- C:\Users\Bouillon\ntuser.ini

 
 < %USERPROFILE%\Local Settings\Temp\*.exe >

 
 < %USERPROFILE%\Local Settings\Temp\*.dll >

 
 < %USERPROFILE%\Application Data\*.exe >

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

 
 <           >
 

< End of report >

--- --- ---

OTL EXTRAS Logfile:

Code:

OTL Extras logfile created on: 09.01.2013 19:37:29 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Bouillon\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

7,98 Gb Total Physical Memory | 5,46 Gb Available Physical Memory | 68,44% Memory free

15,96 Gb Paging File | 12,94 Gb Available in Paging File | 81,08% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 95,69 Gb Total Space | 23,15 Gb Free Space | 24,19% Space Free | Partition Type: NTFS

Drive D: | 698,63 Gb Total Space | 483,26 Gb Free Space | 69,17% Space Free | Partition Type: NTFS

 

Computer Name: BOUILLON-PC | User Name: Bouillon | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{01C8BC54-7118-44CA-B658-5ABFDE3B0A94}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{186FE5F0-F636-4990-ADF1-7940CEBAB499}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe | 

"{1D348E67-CCA5-4073-8CB2-ADA024598563}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{2371D514-0760-49E0-8235-1F01A41DF30F}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{32A36FA5-01BF-494D-AD35-5B10D85DDD96}" = rport=139 | protocol=6 | dir=out | app=system | 

"{3B2EC18B-060A-4932-A4D6-5675B5AA8FC7}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{4928B131-CBA2-454F-938A-F5A038BE9867}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{5B56CB84-A632-4C28-A24B-74995D4FF39E}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{5BC41E12-C315-4145-83B4-DC918AC74178}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{6090FD8A-0AD2-47A7-BE8A-E209B2BEA55F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{63D59B8B-36A4-45E4-AA55-E5C7560586AD}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{756BBCE8-D01C-4CB2-A9F2-2AB7E4FF2C67}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{8C4B3602-9B29-4AD4-9981-FB18E405E3FB}" = lport=137 | protocol=17 | dir=in | app=system | 

"{A3C747E1-6086-467B-8CEC-B36EC627A0B8}" = lport=445 | protocol=6 | dir=in | app=system | 

"{A8134C33-7C86-4291-9D6F-14B7D2DEB09B}" = rport=445 | protocol=6 | dir=out | app=system | 

"{AE7C9D66-EC07-4826-B541-243F6855146B}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{B5E23F2E-D93E-4033-AFA4-DA1543F5C2EF}" = lport=138 | protocol=17 | dir=in | app=system | 

"{C135BE51-4341-401F-A035-E6B98959639A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{C1E534BF-1735-4364-B0B0-6947A79BD0DA}" = lport=139 | protocol=6 | dir=in | app=system | 

"{D19A3AB2-7F61-4E5B-9B4A-E8DCF499E745}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{DA830D3D-D98E-4EC1-B30F-1EE3826F8A0F}" = rport=138 | protocol=17 | dir=out | app=system | 

"{DE312465-1B28-42EB-A3C2-BC11CA863D1A}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 

"{E6D6197B-123A-4774-AB1A-944B1636EEEE}" = rport=137 | protocol=17 | dir=out | app=system | 

"{EF079E34-A543-4913-B378-55363040AB57}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{F6B33FAD-DE9D-46DA-9878-3D2D9228C87C}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 

"{FC5521DD-E03C-4FB0-AFEA-D52CACF2A1E1}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{1511FC1D-DC02-4FEC-8692-0B2F3C4F6A88}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{28570F55-0FA1-4E9A-86C3-E2412F9EA2B1}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{2A0F5078-85D1-4E80-B48E-1C61D49AC72E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{2DA3697A-4787-49C5-A8BE-C8C2DAE7D726}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 

"{31D5F252-8E82-4CFD-A50B-2022B1EA7240}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{33F5DFC4-ECDC-4533-91C1-07FEB8B2C61B}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe | 

"{3E329DD8-457F-4A7E-B2F3-0A03891EC514}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 1942\bf1942.exe | 

"{3E5E06EA-A197-4068-9DAD-9B72BBF73B2D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{56FD1BD5-F6D0-4AFE-A412-15BEBDCEB113}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{590F93B4-21B4-4B09-863E-DE1C381737C7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{5C7EFCB3-F991-470A-AB08-AE7D3BACC5B7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{6384C89D-06F9-4A64-A8F8-5CA9C23E906A}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe | 

"{6412B5B9-6A3F-4789-AC13-376C5179D045}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{64822811-DE99-410A-B11B-1EE338E42954}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe | 

"{652DFD99-B06B-4FE5-9697-CDABF29A6556}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{66B0C3D7-6A90-416C-AB88-FDB6C51642FE}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 

"{6974861A-3A12-497F-A152-AE80AA712CD0}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{703245E2-F1B0-414D-B2A2-36E6C01C5D97}" = dir=in | app=c:\program files (x86)\acer\clear.fi\mvp\kernel\dmr\dmrengine.exe | 

"{75701888-E032-4575-914A-53E705D189B7}" = dir=in | app=c:\program files (x86)\acer\clear.fi\mvp\clear.fiagent.exe | 

"{7F934F5F-1FAE-4EA6-9AD2-AFCDAF874A1F}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\microsoft flight\flight.exe | 

"{818092F0-B7B9-4C15-BC56-C601ED7080B5}" = dir=in | app=c:\program files (x86)\acer\clear.fi\mvp\kernel\clml\clmlsvc.exe | 

"{8226AB5E-C162-4F53-B9E0-9620649053FC}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{84238056-01C3-4B7A-87B1-F29622607C1E}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\fifa manager 13\manager13.exe | 

"{8427244B-7869-4935-ACA7-1AF13DA20C1D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{87EAC620-C783-423F-BE85-17C26E324CFA}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{88E2B5D8-7990-42B1-B6CE-8E4D5560BFDF}" = protocol=6 | dir=out | app=system | 

"{8AC469C7-FB13-4AF2-9FBD-41373226DD28}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 

"{8F4BC77D-3A60-4BB6-A530-BA88B56A6BC2}" = dir=in | app=c:\program files (x86)\acer\clear.fi\mvp\kernel\dmr\dmrengine.exe | 

"{9C9E595D-24CB-4C51-914D-88697F1D96E6}" = dir=in | app=c:\program files (x86)\acer\clear.fi\mvp\clear.fi.exe | 

"{A285C872-0877-4BA2-93A8-7F02B97C4FEF}" = dir=in | app=c:\program files (x86)\acer\clear.fi\movie\touchmovie.exe | 

"{B0D7035B-F2CC-4709-BDB1-81BB35552C03}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | 

"{B178C250-BB5A-47D0-B800-0D6479DD7158}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 1942\bf1942.exe | 

"{B6C53AA2-A49A-4483-BEEA-26C92E04CF07}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{BB3359BD-675A-42A6-AB62-78A220E0E3D3}" = dir=in | app=c:\program files (x86)\acer\clear.fi\mvp\kernel\dmr\dmrengine.exe | 

"{C5DA0D62-FB5B-4A19-89E3-4B2DCC07BB03}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{CD8C5091-1C7F-4FAE-93C0-D6AE3FDF87C4}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{D23DC473-C5B9-4389-8E24-CE3C76987430}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 

"{D39314EB-C72F-44C8-A68E-4BE57EB2F0B5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{E0D082E9-8B8F-46AD-9301-302600E95886}" = dir=in | app=c:\program files (x86)\acer\clear.fi\movie\touchmovieservice.exe | 

"{E882F2CA-F482-4024-8EF9-C3FC2B194263}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\fifa manager 13\manager13.exe | 

"{EB1AAF10-712E-41B5-97F4-0A6C3240F05E}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{EFC800E9-A90A-4C72-847F-577D457822F5}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\microsoft flight\flight.exe | 

"{F10FB9B7-2E13-4737-8981-5CAEF59B38DD}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | 

"TCP Query User{D9BB19B5-6896-49EA-BD70-604AC8FA6AF0}C:\users\bouillon\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\bouillon\appdata\roaming\spotify\spotify.exe | 

"UDP Query User{7C32523F-1830-47AE-AB50-0CFF014242AD}C:\users\bouillon\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\bouillon\appdata\roaming\spotify\spotify.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0919C44F-F18A-4E3B-A737-03685272CE72}" = Windows Live Remote Service Resources

"{0B78ECB0-1A6B-4E6D-89D7-0E7CE77F0427}" = MyWinLocker

"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{1553D712-B35F-4A82-BC72-D6B11A94BE3E}" = Windows Live Remote Service Resources

"{1685AE50-97ED-485B-80F6-145071EE14B0}" = Windows Live Remote Service Resources

"{17A4FD95-A507-43F1-BC92-D8572AF8340A}" = Windows Live Remote Service Resources

"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector

"{19F09425-3C20-4730-9E2A-FC2E17C9F362}" = Windows Live Remote Service Resources

"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant

"{1D72BF42-E249-4EB7-CC4C-8CC09DAB180B}" = ATI Catalyst Install Manager

"{1EB2CFC3-E1C5-4FC4-B1F8-549DD6242C67}" = Windows Live Remote Service Resources

"{1F557316-CFC0-41BD-AFF7-8BC49CE444D7}" = Shredder

"{22AB5CFD-B3DB-414E-9F99-4D024CCF1DA6}" = Windows Live Remote Client Resources

"{2426E29F-9E8C-4C0B-97FC-0DB690C1ED98}" = Windows Live Remote Client Resources

"{26A24AE4-039D-4CA4-87B4-2F86417009FF}" = Java 7 Update 9 (64-bit)

"{2C1A6191-9804-4FDC-AB01-6F9183C91A13}" = Windows Live Remote Client Resources

"{2F304EF4-0C31-47F4-8557-0641AAE4197C}" = Windows Live Remote Client Resources

"{34384A2A-2CA2-4446-AB0E-1F360BA2AAC5}" = Windows Live Remote Service Resources

"{350FD0E7-175A-4F86-84EF-05B77FCD7161}" = Windows Live Remote Service Resources

"{3921492E-82D2-4180-8124-E347AD2F2DB4}" = Windows Live Remote Client Resources

"{456FB9B5-AFBC-4761-BBDC-BA6BAFBB818F}" = Windows Live Remote Client Resources

"{480F28F0-8BCE-404A-A52E-0DBB7D1CE2EF}" = Windows Live Remote Service Resources

"{4C2E49C0-9276-4324-841D-774CCCE5DB48}" = Windows Live Remote Client Resources

"{5141AA6E-5FAC-4473-BFFB-BEE69DDC7F2B}" = Windows Live Remote Service Resources

"{5151E2DB-0748-4FD1-86A2-72E2F94F8BE7}" = Windows Live Remote Service Resources

"{57F2BD1C-14A3-4785-8E48-2075B96EB2DF}" = Windows Live Remote Service Resources

"{5E2CD4FB-4538-4831-8176-05D653C3E6D4}" = Windows Live Remote Service Resources

"{5F44A3A1-5D24-4708-8776-66B42B174C64}" = Windows Live Remote Client Resources

"{5FCD6EFE-C2E7-4D77-8212-4BA223D8DF8E}" = Windows Live Remote Client Resources

"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

"{5FEAD3E5-A158-4B66-B92B-0C959D7CF838}" = Windows Live Remote Service Resources

"{61407251-7F7D-4303-810D-226A04D5CFF3}" = Windows Live Remote Service Resources

"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources

"{692CCE55-9EAE-4F57-A834-092882E7FE0B}" = Windows Live Remote Client Resources

"{6C9D3F1D-DBBE-46F9-96A0-726CC72935AF}" = Windows Live Remote Service Resources

"{6CBFDC3C-CF21-4C02-A6DC-A5A2707FAF55}" = Windows Live Remote Service Resources

"{6E7F4CA3-B2DE-413C-A7A1-43AA5BE19EA1}" = WIDCOMM Bluetooth Software

"{702A632F-99CE-4E2D-B8F2-BF980E9CF62F}" = Windows Live Remote Client Resources

"{7AEC844D-448A-455E-A34E-E1032196BBCD}" = Windows Live Remote Service Resources

"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

"{825C7D3F-D0B3-49D5-A42B-CBB0FBE85E99}" = Windows Live Remote Client Resources

"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources

"{850B8072-2EA7-4EDC-B930-7FE569495E76}" = Windows Live Remote Client Resources

"{8970AE69-40BE-4058-9916-0ACB1B974A3D}" = Windows Live Remote Client Resources

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8EB588BD-D398-40D0-ADF7-BE1CEEF7C116}" = Windows Live Remote Client Resources

"{90140000-0015-0407-1000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010

"{90140000-0015-0407-1000-0000000FF1CE}_Office14.SingleImage_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0016-0407-1000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010

"{90140000-0016-0407-1000-0000000FF1CE}_Office14.SingleImage_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0018-0407-1000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010

"{90140000-0018-0407-1000-0000000FF1CE}_Office14.SingleImage_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0019-0407-1000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010

"{90140000-0019-0407-1000-0000000FF1CE}_Office14.SingleImage_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001A-0407-1000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010

"{90140000-001A-0407-1000-0000000FF1CE}_Office14.SingleImage_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001B-0407-1000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010

"{90140000-001B-0407-1000-0000000FF1CE}_Office14.SingleImage_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0407-1000-0000000FF1CE}" = Microsoft Office Proof (German) 2010

"{90140000-001F-0407-1000-0000000FF1CE}_Office14.SingleImage_{70A3169E-288F-454F-A08D-20DF66639B50}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proof (English) 2010

"{90140000-001F-0409-1000-0000000FF1CE}_Office14.SingleImage_{0242505C-4E90-407F-9299-B5B275F50D86}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-040C-1000-0000000FF1CE}" = Microsoft Office Proof (French) 2010

"{90140000-001F-040C-1000-0000000FF1CE}_Office14.SingleImage_{B51389C8-2890-4633-81D8-47D2A7402274}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0410-1000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010

"{90140000-001F-0410-1000-0000000FF1CE}_Office14.SingleImage_{3013A793-10A7-4D1F-B8B4-2FAA82F4D259}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-002C-0407-1000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010

"{90140000-002C-0407-1000-0000000FF1CE}_Office14.SingleImage_{98782D5D-A9EE-43C6-88AD-B50AD8530E78}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-003D-0000-1000-0000000FF1CE}" = Microsoft Office Single Image 2010

"{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0043-0000-1000-0000000FF1CE}" = Microsoft Office Office 32-bit Components 2010

"{90140000-0043-0000-1000-0000000FF1CE}_Office14.SingleImage_{E8B6D35B-0B6F-4DCE-9493-859BF3809A7F}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0043-0407-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (German) 2010

"{90140000-0043-0407-1000-0000000FF1CE}_Office14.SingleImage_{8DFD91C7-66AE-4E54-9901-5D5F401AD329}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-006E-0407-1000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010

"{90140000-006E-0407-1000-0000000FF1CE}_Office14.SingleImage_{8299B64F-1537-4081-974C-033EAB8F098E}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-00A1-0407-1000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010

"{90140000-00A1-0407-1000-0000000FF1CE}_Office14.SingleImage_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{97A295A7-8840-4B35-BB61-27A8F4512CA3}" = Windows Live Remote Service Resources

"{9E9C960F-7F47-46D5-A95D-950B354DE2B8}" = Windows Live Remote Service Resources

"{A060182D-CDBE-4AD6-B9B4-860B435D6CBD}" = Windows Live Remote Client Resources

"{A508D5A2-3AC1-4594-A718-A663D6D3CF11}" = Windows Live Remote Service Resources

"{A679FBE4-BA2D-4514-8834-030982C8B31A}" = Windows Live Remote Service Resources

"{B0BF8602-EA52-4B0A-A2BD-EDABB0977030}" = Windows Live Remote Client Resources

"{B680A663-1A15-47A5-A07C-7DF9A97558B7}" = Windows Live Remote Client Resources

"{B750FA38-7AB0-42CB-ACBB-E7DBE9FF603F}" = Windows Live Remote Client Resources

"{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}" = Überwachungstool für die Intel® Turbo-Boost-Technik 2.0

"{C504EC13-E122-4939-BD6E-EE5A3BAA5FEC}" = Windows Live Remote Client Resources

"{C669FE66-A1D7-F9BC-7A96-38E1CA3B4E02}" = ccc-utility64

"{C9F05151-95A9-4B9B-B534-1760E2D014A5}" = Windows Live Remote Client Resources

"{CFF3C688-2198-4BC3-A399-598226949C39}" = Windows Live Remote Client Resources

"{D1C1556C-7FF3-48A3-A5D6-7126F0FAFB66}" = Windows Live Remote Client Resources

"{D3E4F422-7E0F-49C7-8B00-F42490D7A385}" = Windows Live Remote Service Resources

"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources

"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources

"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter

"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319

"{DBEDAF67-C5A3-4C91-951D-31F3FE63AF3F}" = Windows Live Remote Client Resources

"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client

"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service

"{ED421F97-E1C3-4E78-9F54-A53888215D58}" = Windows Live Remote Client Resources

"{EF79C448-6946-4D71-8134-03407888C054}" = Shared C Run-time for x64

"{EFB20CF5-1A6D-41F3-8895-223346CE6291}" = Windows Live Remote Service Resources

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"{F6CB2C5F-B2C1-4DF1-BF44-39D0DC06FE6F}" = Windows Live Remote Service Resources

"{FAA3933C-6F0D-4350-B66B-9D7F7031343E}" = Windows Live Remote Service Resources

"{FAD0EC0B-753B-4A97-AD34-32AC1EC8DB69}" = Windows Live Remote Client Resources

"C-Media CM108 Like Sound Driver" = RAPTOR-GAMING H3 7.1 USB

"Elantech" = ETDWare PS/2-X64 8.0.6.0_WHQL

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Office14.SingleImage" = Microsoft Office Professional 2010

"TeamSpeak 3 Client" = TeamSpeak 3 Client

"WinRAR archiver" = WinRAR 4.20 (64-Bit)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{00884F14-05BD-4D8E-90E5-1ABF78948CA4}" = Windows Live Mesh

"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = Acer Crystal Eye Webcam

"{039480EE-6933-4845-88B8-77FD0C3D059D}" = Windows Live Mesh

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{04C86876-770B-D976-D2C9-E3697BB339A5}" = CCC Help Portuguese

"{0557BBDA-69D3-4FA4-A93C-A5300F7034B4}" = Windows Live Writer

"{055A9B20-9F50-D23B-8294-1F5F6C9E7B3B}" = CCC Help Finnish

"{05E379CC-F626-4E7D-8354-463865B303BF}" = Windows Live UX Platform Language Pack

"{062E4D94-8306-46D5-81B6-45E6AD09C799}" = Windows Live Messenger

"{0654EA5D-308A-4196-882B-5C09744A5D81}" = Windows Live Photo Common

"{06B05153-97E4-427E-B1A8-E098F6C5E52F}" = Windows Live Essentials

"{073F306D-9851-4969-B828-7B6444D07D55}" = Windows Live Photo Common

"{09922FFE-D153-44AE-8B60-EA3CB8088F93}" = Windows Live UX Platform Language Pack

"{0A4C4B29-5A9D-4910-A13C-B920D5758744}" = بريد Windows Live

"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer

"{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}" = Backup Manager V3

"{0C1931EB-8339-4837-8BEC-75029BF42734}" = Windows Live UX Platform Language Pack

"{0C975FCC-A06E-4CB6-8F54-A9B52CF37781}" = Windows Liven sähköposti

"{0D261C88-454B-46FE-B43B-640E621BDA11}" = Windows Live Mail

"{0EC0B576-90F9-43C3-8FAD-A4902DF4B8F4}" = Galeria de Fotografias do Windows Live

"{10186F1A-6A14-43DF-A404-F0105D09BB07}" = Windows Live Mail

"{110668B7-54C6-47C9-BAC4-1CE77F156AF5}" = Windows Live Mesh

"{11417707-1F72-4279-95A3-01E0B898BBF5}" = Windows Live Mesh

"{11778DA1-0495-4ED9-972F-F9E0B0367CD5}" = Windows Live Writer

"{1203DC60-D9BD-44F9-B372-2B8F227E6094}" = Windows Live Temel Parçalar

"{128133D3-037A-4C62-B1B7-55666A10587A}" = Windows Live UX Platform Language Pack

"{133D9D67-D475-4407-AC3C-D558087B2453}" = Windows Live Movie Maker

"{14B441B7-774D-4170-98EA-A13667AE6218}" = Windows Live Writer Resources

"{14C4C3B6-F1F4-401F-8C86-03E8E19AAC8C}" = clear.fi

"{168E7302-890A-4138-9109-A225ACAF7AD1}" = Windows Live Photo Common

"{17835B63-8308-427F-8CF5-D76E0D5FE457}" = Windows Live Essentials

"{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}" = MyWinLocker Suite

"{17F99FCE-8F03-4439-860A-25C5A5434E18}" = Windows Live Essentials

"{198EA334-8A3F-4CB2-9D61-6C10B8168A6F}" = Windows Live Writer

"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker

"{1A72337E-D126-4BAF-AC89-E6122DB71866}" = Windows Liven valokuvavalikoima

"{1A82AE99-84D3-486D-BAD6-675982603E14}" = Windows Live Writer

"{1B6354BF-C942-662E-7E55-24B68A5E81E9}" = CCC Help Danish

"{1B705E8F-9893-4486-B5D7-4F7FEB9C871E}_is1" = Euro Truck Simulator 2

"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger

"{1D6C2068-807F-4B76-A0C2-62ED05656593}" = Windows Live Writer

"{1DA6D447-C54D-4833-84D4-3EA31CAECE9B}" = Windows Live UX Platform Language Pack

"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources

"{1EAD27F9-EB8F-8AB3-A7FF-670500AB174B}" = CCC Help Dutch

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update

"{1FC83EAE-74C8-4C72-8400-2D8E40A017DE}" = Windows Live Writer

"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions

"{220C7F8C-929D-4F71-9DC7-F7A6823B38E4}" = Windows Live UX Platform Language Pack

"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1

"{249EE21B-8EDD-4F36-8A23-E580E9DBE80A}" = Windows Live Mail

"{24DF33E0-F924-4D0D-9B96-11F28F0D602D}" = Windows Live UX Platform Language Pack

"{250A5635-1A7C-9A1A-B50D-41246091B7A0}" = CCC Help Italian

"{2511AAD7-82DF-4B97-B0B3-E1B933317010}" = Windows Live Writer Resources

"{25A381E1-0AB9-4E7A-ACCE-BA49D519CF4E}" = Windows Live Mail

"{25CD4B12-8CC5-433E-B723-C9CB41FA8C5A}" = Windows Live Writer

"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = clear.fi

"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9

"{26E3C07C-7FF7-4362-9E99-9E49E383CF16}" = Windows Live Writer Resources

"{28921580-E4BB-11E0-9FD7-1CC1DEF07CBE}" = Evernote v. 4.5.1

"{28953E84-BA34-DB27-ABA0-30ABA9BDDD18}" = CCC Help Thai

"{28B9D2D8-4304-483F-AD71-51890A063A74}" = Windows Live Photo Common

"{29373E24-AC72-424E-8F2A-FB0F9436F21F}" = Windows Live Photo Common

"{2A07C35B-8384-4DA4-9A95-442B6C89A073}" = Windows Live Essentials

"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger

"{2BA5FD10-653F-4CAF-9CCD-F685082A1DC1}" = Windows Live Writer

"{2C4E06CC-1F04-4C25-8B3C-93A9049EC42C}" = Windows Live UX Platform Language Pack

"{2C865FB0-051E-4D22-AC62-428E035AEAF0}" = Windows Live Mesh

"{2D3E034E-F76B-410A-A169-55755D2637BB}" = Windows Live Mesh

"{2D5F2E8E-8F4B-5DC9-69D7-1D56952CDF73}" = Catalyst Control Center Localization All

"{2E50E321-4747-4EB5-9ECB-BBC6C3AC0F31}" = Windows Live Writer Resources

"{2F54E453-8C93-4B3B-936A-233C909E6CAC}" = Windows Live Messenger

"{2F6B8F9C-A428-4A99-84BF-64C77DDD07BE}" = Catalyst Control Center - Branding

"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App

"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver

"{3125D9DE-8D7A-4987-95F3-8A42389833D8}" = Windows Live Writer Resources

"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery

"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live

"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery

"{370F888E-42A7-4911-9E34-7D74632E17EB}" = Windows Live Photo Common

"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack

"{39F15B50-A977-4CA6-B1C3-6A8724CDA025}" = MyWinLocker 4

"{39F95B0B-A0B7-4FA7-BB6C-197DA2546468}" = Windows Live Mesh

"{3B18E1ED-0128-C493-A06F-9A190DEBFF6D}" = Catalyst Control Center InstallProxy

"{3B72C1E0-26A1-40F6-8516-D50C651DFB3C}" = Windows Live Essentials

"{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer

"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management

"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology

"{3F4143A1-9C21-4011-8679-3BC1014C6886}" = Windows Live Mesh

"{40674D92-C293-C562-40AF-A092041C7131}" = CCC Help Japanese

"{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}" = Norton Online Backup

"{40BFD84C-64CD-42CC-9909-8734C50429C6}" = Windows Live UX Platform Language Pack

"{410DF0AA-882D-450D-9E1B-F5397ACFFA80}" = Windows Live Essentials

"{4264C020-850B-4F08-ACBE-98205D9C336C}" = Windows Live Writer

"{429DF1A0-3610-4E9E-8ACE-3C8AC1BA8FCA}" = Windows Live Photo Gallery

"{43AAE145-83CF-4C96-9A5E-756CEFCE879F}" = clear.fi Client

"{43B43577-2514-4CE0-B14A-7E85C17C0453}" = Windows Live Essentials

"{443B561F-DE1B-4DEF-ADD9-484B684653C7}" = Windows Live Messenger

"{4444F27C-B1A8-464E-9486-4C37BAB39A09}" = Фотогалерия на Windows Live

"{458F399F-62AC-4747-99F5-499BBF073D29}" = Windows Live Writer Resources

"{4664ED39-C80A-48F7-93CD-EBDCAFAB6CC5}" = Windows Live Writer Resources

"{46872828-6453-4138-BE1C-CE35FBF67978}" = Windows Live Mesh

"{4736B0ED-F6A1-48EC-A1B7-C053027648F1}" = Galeria fotogràfica del Windows Live

"{48294D95-EE9A-4377-8213-44FC4265FB27}" = Windows Live Messenger

"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live

"{48C0DC5E-820A-44F2-890E-29B68EDD3C78}" = Windows Live Writer

"{48F597DD-D397-4CFA-91A0-4C033A0113BD}" = Windows Live Mail

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4A04DB63-8F81-4EF4-9D09-61A2057EF419}" = Windows Live Essentials

"{4B28D47A-5FF0-45F8-8745-11DC2A1C9D0F}" = Windows Live Writer

"{4B744C85-DBB1-4038-B989-4721EB22C582}" = Windows Live Messenger

"{4C378B16-46B7-4DA1-A2CE-2EE676F74680}" = Windows Live UX Platform Language Pack

"{4C774C35-E0AF-72E1-136A-2BF666702268}" = Fooz Kids

"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace

"{4D141929-141B-4605-95D6-2B8650C1C6DA}" = Windows Live UX Platform Language Pack

"{4D83F339-5A5C-4B21-8FD3-5D407B981E72}" = Windows Live Photo Common

"{506FC723-8E6C-4417-9CFF-351F99130425}" = Windows Live UX Platform Language Pack

"{5086BF95-2E26-183E-E63D-D25F9963D2B1}" = PX Profile Update

"{523DF2BB-3A85-4047-9898-29DC8AEB7E69}" = Windows Live UX Platform Language Pack

"{5275D81E-83AD-4DE4-BC2B-6E6BA3A33244}" = Windows Live Writer Resources

"{542DA303-FB91-4731-9F37-6E518368D3B9}" = Windows Live Messenger

"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver

"{5495E9A4-501A-4D4C-87C9-E80916CA9478}" = Windows Live UX Platform Language Pack

"{54DE7A11-4E6B-A610-5D09-9EF168AF1E16}" = CCC Help Norwegian

"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack

"{582C68AD-87CB-8746-0D96-1F6149FE3791}" = CCC Help Greek

"{5BE7BD06-512B-43bf-AD78-3BD2A5F5F7B3}" = Battlefield 1942™

"{5C2F5C1B-9732-4F81-8FBF-6711627DC508}" = Windows Live Fotogalleri

"{5CF5B1A5-CBC3-42F0-8533-5A5090665862}" = Windows Live Mesh

"{5D273F60-0525-48BA-A5FB-D0CAA4A952AE}" = Windows Live Movie Maker

"{5D2E7BD7-4B6F-4086-BA8A-E88484750624}" = Windows Live Writer Resources

"{5DA7D148-D2D2-4C67-8444-2F0F9BD88A06}" = Windows Live Writer

"{5E035607-6888-01F5-3C61-242F4D7B906A}" = CCC Help French

"{5E627606-53B9-42D1-97E1-D03F6229E248}" = Windows Live UX Platform Language Pack

"{60C3C026-DB53-4DAB-8B97-7C1241F9A847}" = Windows Live Movie Maker

"{613C0AC5-3A67-4B94-8B13-9176AD83F5BF}" = newsXpresso

"{625D45F0-5DCB-48BF-8770-C240A84DAAEB}" = Windows Live Mesh

"{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources

"{63CF7D0C-B6E7-4EE9-8253-816B613CC437}" = Windows Live Mail

"{640798A0-A4FB-4C52-AC72-755134767F1E}" = Windows Live Movie Maker

"{64376910-1860-4CEF-8B34-AA5D205FC5F1}" = Poczta usługi Windows Live

"{644063FA-ABA3-42AC-A8AC-3EDC0706018B}" = Windows Live Mesh

"{6491AB99-A11E-41FD-A5E7-32DE8A097B8E}" = Windows Live Essentials

"{64B2D6B3-71AC-45A7-A6A1-2E07ABF58341}" = Windows Live Movie Maker

"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components

"{677AAD91-1790-4FC5-B285-0E6A9D65F7DC}" = Windows Live Mail

"{6807427D-8D68-4D30-AF5B-0B38F8F948C8}" = Windows Live Writer Resources

"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE

"{69C9C672-400A-43A0-B2DE-9DB38C371282}" = Windows Live Writer

"{69CAC24D-B1DC-4B97-A1BE-FE21843108FE}" = Windows Live Writer Resources

"{6A4ABCDC-0A49-4132-944E-01FBCCB3465C}" = Windows Live UX Platform Language Pack

"{6A67578E-095B-4661-88F7-0B199CEC3371}" = Windows Live Messenger

"{6ABE832B-A5C7-44C1-B697-3E123B7B4D5B}" = Windows Live Mesh

"{6B556C37-8919-4991-AC34-93D018B9EA49}" = Windows Live Photo Common

"{6CB36609-E3A6-446C-A3C1-C71E311D2B9C}" = Windows Live Movie Maker

"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker

"{6E8AFC13-F7B8-41D8-88AB-F1D0CFC56305}" = Windows Live Messenger

"{6EF2BE2C-3121-48B7-B7A6-C56046B3A588}" = Windows Live Movie Maker

"{6F37D92B-41AA-44B7-80D2-457ABDE11896}" = Windows Live Photo Common

"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-acer" = WildTangent Games App (Acer Games)

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{71527C7C-5289-4CB2-88C9-23344C0FF6C1}" = Windows Live Movie Maker

"{71A81378-79D5-40CC-9BDC-380642D1A87F}" = Windows Live Writer

"{71C95134-F6A9-45E7-B7B3-07CA6012BF2A}" = Windows Live Mesh

"{7272F232-A7E0-4B2B-A5D2-71B7C5E2379C}" = Windows Live Fotótár

"{7327080F-6673-421F-BBD9-B618F357EEB3}" = Windows Live UX Platform Language Pack

"{734104DE-C2BF-412F-BB97-FCCE1EC94229}" = Windows Live Writer Resources

"{7373E17D-18E0-44A7-AC3A-6A3BFB85D3B3}" = Windows Live Movie Maker

"{73FC3510-6421-40F7-9503-EDAE4D0CF70D}" = Windows Live Photo Common

"{741C94E4-740F-9276-9403-418C4920D217}" = CCC Help Spanish

"{7465A996-0FCA-4D2D-A52C-F833B0829B5B}" = Windows Live Movie Maker

"{7496FD31-E5CB-4AE4-82D3-31099558BF6A}" = Windows Live Mesh

"{74E8A7F6-575D-42C7-9178-E87D1B3BEFE8}" = Windows Live UX Platform Language Pack

"{77477AEA-5757-47D8-8B33-939F43D82218}" = Windows Live UX Platform Language Pack

"{77F69CA1-E53D-4D77-8BA3-FA07606CC851}" = Фотоальбом Windows Live

"{78906B56-0E81-42A7-AC25-F54C946E1538}" = Windows Live Photo Common

"{78DAE910-CA72-450E-AD22-772CB1A00678}" = Windows Live Mesh

"{78DBE8CE-61F6-4D6C-806C-A0FFF65F5E1D}" = Windows Live Messenger

"{7A9D47BA-6D50-4087-866F-0800D8B89383}" = Podstawowe programy Windows Live

"{7ADFA72D-2A9F-4DEC-80A5-2FAA27E23F0F}" = Windows Live Photo Common

"{7AF8E500-B349-4A77-8265-9854E9A47925}" = Windows Live Movie Maker

"{7BA19818-F717-4DFB-BC11-FAF17B2B8AEE}" = Pošta Windows Live

"{7C2A3479-A5A0-412B-B0E6-6D64CBB9B251}" = Windows Live Photo Common

"{7CB529B2-6C74-4878-9C3F-C29C3C3BBDC6}" = Windows Live Writer Resources

"{7D0DE76C-874E-4BDE-A204-F4240160693E}" = Windows Live Photo Common

"{7D1C7B9F-2744-4388-B128-5C75B8BCCC84}" = Windows Live Essentials

"{7D926AD2-16D6-42C2-8CA1-AB09E96040BA}" = Windows Live Writer Resources

"{7E017923-16F8-4E32-94EF-0A150BD196FE}" = Windows Live Writer

"{7E90B133-FF47-48BB-91B8-36FC5A548FE9}" = Windows Live Writer Resources

"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management

"{7FF11E53-C002-4F40-8D68-6BE751E5DD62}" = Windows Live Writer Resources

"{804DE397-F82C-4867-9085-E0AA539A3294}" = Windows Live Writer

"{80AF0300-866F-400F-A350-D53E3C3E34E0}" = FUSSBALL MANAGER 13

"{80E8C65A-8F70-4585-88A2-ABC54BABD576}" = Windows Live Mesh

"{820D0BA3-ACD7-4FB9-A3A7-0ADF0C66A4BE}" = Windows Live Messenger

"{827D3E4A-0186-48B7-9801-7D1E9DD40C07}" = Windows Live Essentials

"{82803FF3-563F-414F-A403-8D4C167D4120}" = Windows Live Mail

"{8291D08E-B83A-D12D-46FB-CF8A49BE8494}" = CCC Help English

"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable

"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform

"{841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}" = Windows Live Mesh

"{84267681-BF16-40B6-9564-27BC57D7D71C}" = Windows Live Photo Common

"{84A411F9-40A5-4CDA-BF46-E09FBB2BC313}" = Windows Live Essentials

"{85373DA7-834E-4850-8AF5-1D99F7526857}" = Windows Live Photo Common

"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer

"{861B1145-7762-4794-B40C-3FF0A389DFE6}" = Windows Live Photo Gallery

"{885F1BCD-C344-4758-85BD-09640CF449A5}" = Windows Live Photo Gallery

"{8909CFA8-97BF-4077-AC0F-6925243FFE08}" = Windows Liven asennustyökalu

"{8BD24D6B-5EAB-4D17-D6E5-A2C11B9C78C0}" = CCC Help Korean

"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime

"{8CF5D47D-27B7-49D6-A14F-10550B92749D}" = Windows Live UX Platform Language Pack

"{8D68CE08-9A14-4B7B-9857-3C646A2F34C7}" = Fooz Kids Platform

"{8D84E39D-3BD0-902B-070C-6672E67632A5}" = CCC Help German

"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT

"{8FF3891F-01B5-4A71-BFCD-20761890471C}" = Windows Live Messenger

"{924B4D82-1B97-48EB-8F1E-55C4353C22DB}" = Windows Live Mail

"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker

"{93E464B3-D075-4989-87FD-A828B5C308B1}" = Windows Live Writer Resources

"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010

"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader

"{97F77D62-5110-4FA3-A2D3-410B92D31199}" = Windows Live Fotogaléria

"{99BE7F5D-AB52-4404-9E03-4240FFAA7DE9}" = Windows Live Mesh

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BD262D0-B788-4546-A0A5-F4F56EC3834B}" = Windows Live Photo Common

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail

"{9DA3F03B-2CEE-4344-838E-117861E61FAF}" = Windows Live Mail

"{9DB90178-B5B0-45BD-B0A7-D40A6A1DF1CA}" = Windows Live Movie Maker

"{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail

"{A07DF768-9B01-5713-663F-BC6262CBDE7B}" = CCC Help Turkish

"{A0B91308-6666-4249-8FF6-1E11AFD75FE1}" = Windows Live Mail

"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh

"{A101F637-2E56-42C0-8E08-F1E9086BFAF3}" = Windows Live Movie Maker

"{A199DB88-E22D-4CE7-90AC-B8BE396D7BF4}" = Windows Live Movie Maker

"{A3389C72-1782-4BB4-BBAA-33345DE52E3F}" = Windows Live Messenger

"{A41A708E-3BE6-4561-855D-44027C1CF0F8}" = Windows Live Photo Common

"{A60B3BF0-954B-42AF-B8D8-2C1D34B613AA}" = Windows Live Photo Gallery

"{A7056D45-C63A-4FE4-A69D-FB54EF9B21BB}" = Windows Live Messenger

"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer

"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common

"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer

"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer

"{AB0B2113-5B96-4B95-8AD1-44613384911F}" = Windows Live Mesh

"{AB61A2E9-37D3-485D-9085-19FBDF8CEF4A}" = Windows Live Messenger

"{AB78C965-5C67-409B-8433-D7B5BDB12073}" = Windows Live Writer Resources

"{ABD534B7-E951-470E-92C2-CD5AF1735726}" = Windows Live Essentials

"{ABE2F2AA-7ADC-4717-9573-BF3F83C696AC}" = Windows Live Mail

"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI - Deutsch

"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh

"{AD001A69-88CC-4766-B2DB-3C1DFAB9AC72}" = Windows Live Mesh

"{ADE85655-8D1E-4E4B-BF88-5E312FB2C74F}" = Windows Live Mail

"{ADFE4AED-7F8E-4658-8D6E-742B15B9F120}" = Windows Live Photo Common

"{AF01B90A-D25C-4F60-AECD-6EEDF509DC11}" = Windows Live Mesh

"{B0AD205F-60D0-4084-AFB8-34D9A706D9A8}" = Windows Live Essentials

"{B0F08ACB-6BBA-49A8-8BE9-BBB4C2D8B574}" = G Data AntiVirus 2013

"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie

"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail

"{B2BCA478-EC0F-45EE-A9E9-5EABE87EA72D}" = Windows Live Photo Common

"{B2D6752B-421D-15CA-04CF-C94A8D19701D}" = CCC Help Hungarian

"{B2E90616-C50D-4B89-A40D-92377AC669E5}" = Windows Live Messenger

"{B33B61FE-701F-425F-98AB-2B85725CBF68}" = Windows Live Photo Common

"{B382CDAF-EB10-CACF-C7A4-328C87D1B3FF}" = CCC Help Chinese Traditional

"{B3BE54A4-8DFE-4593-8E66-56AB7133B812}" = Windows Live Writer

"{B515962D-C979-44AC-9912-F7BB499B4B2C}" = VirtualDJ Home FREE

"{B618C3BF-5142-4630-81DD-F96864F97C7E}" = Windows Live Essentials

"{B63F0CE3-CCD0-490A-9A9C-E1A3B3A17137}" = Почта Windows Live

"{B7B67AA5-12DA-4F01-918D-B1BF66779D8A}" = Windows Live Writer Resources

"{B906C11A-D193-4143-9FA7-E2EE8A5A8F21}" = clear.fi

"{B90DDC15-76CC-C901-4AF3-12713CE141CD}" = CCC Help Polish

"{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}" = Dolby Advanced Audio v2

"{BA923287-9673-21B4-BB48-18B531817077}" = CCC Help Russian

"{BAEE89D5-6E87-4F89-9603-A1C100479181}" = Windows Live Messenger

"{BD0C3887-64E6-41D8-9A38-BC6F34369352}" = Windows Live Messenger

"{BD4EBDB5-EB14-4120-BB04-BE0A26C7FB3E}" = Windows Live Photo Common

"{BD695C2F-3EA0-4DA4-92D5-154072468721}" = Windows Live Fotoğraf Galerisi

"{BF022D76-9F72-4203-B8FA-6522DC66DFDA}" = Windows Live Movie Maker

"{BF35168D-F6F9-4202-BA87-86B5E3C9BF7A}" = Windows Live Mesh

"{BFC47A0B-D487-4DF0-889E-D6D392DF31E0}" = Windows Live Messenger

"{C00C2A91-6CB3-483F-80B3-2958E29468F1}" = Συλλογή φωτογραφιών του Windows Live

"{C01FCACE-CC3D-49A2-ADC2-583A49857C58}" = Windows Live Essentials

"{C08D5964-C42F-48EE-A893-2396F9562A7C}" = Windows Live Mesh

"{C1C9D199-B4DD-4895-92DD-9A726A2FE341}" = Windows Live Writer

"{C2695E83-CF1D-43D1-84FE-B3BEC561012A}" = Shredder

"{C28D96C0-6A90-459E-A077-A6706F4EC0FC}" = Bing Bar

"{C29FC15D-E84B-4EEC-8505-4DED94414C59}" = Windows Live Writer Resources

"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common

"{C454280F-3C3E-4929-B60E-9E6CED5717E7}" = Windows Live Mail

"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail

"{C8421D85-CA0E-4E93-A9A9-B826C4FB88EA}" = Windows Live Mail

"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common

"{C8D4A930-197B-8D54-90AC-761F52AA748E}" = CCC Help Chinese Standard

"{C95A5A77-622F-45CA-9540-84468FCB18B1}" = Windows Live Messenger

"{C9E1343D-E21E-4508-A1BE-04A089EC137D}" = Windows Live Messenger

"{CB3F59BB-7858-41A1-A7EA-4B8A6FC7D431}" = Galeria fotografii usługi Windows Live

"{CB66242D-12B1-4494-82D2-6F53A7E024A3}" = Galerie foto Windows Live

"{CB7224D9-6DCA-43F1-8F83-6B1E39A00F92}" = Windows Live Movie Maker

"{CBFD061C-4B27-4A89-ADD8-210316EEFA11}" = Windows Live Messenger

"{CD442136-9115-4236-9C14-278F6A9DCB3F}" = Windows Live Movie Maker

"{CD7CB1E6-267A-408F-877D-B532AD2C882E}" = Windows Live Photo Common

"{CDC39BF2-9697-4959-B893-A2EE05EF6ACB}" = Windows Live Writer

"{CE929F09-3853-4180-BD90-30764BFF7136}" = גלריית התמונות של Windows Live

"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform

"{CF671BFE-6BA3-44E7-98C1-500D9C51D947}" = Windows Live Photo Gallery

"{D07B1FDA-876B-4914-9E9A-309732B6D44F}" = Windows Live Mail

"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64

"{D1798C28-64A6-C7A9-48DF-6D0BA02A9CA3}" = CCC Help Swedish

"{D299197D-CDEA-41A6-A363-F532DE4114FD}" = Windows Live UX Platform Language Pack

"{D31169F2-CD71-4337-B783-3E53F29F4CAD}" = Windows Live Mail

"{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}" = NTI Media Maker 9

"{D3E5A972-9A15-427D-AE78-8181A5FD943C}" = eBay Worldwide

"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common

"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform

"{D588365A-AE39-4F27-BDAE-B4E72C8E900C}" = Windows Live Mail

"{D6CBB3B2-F510-483D-AE0D-1CF3F43CF1EE}" = Windows Live Writer Resources

"{D6F25CF9-4E87-43EB-B324-C12BE9CDD668}" = Windows Live UX Platform Language Pack

"{D84E711E-19BF-DF66-86E3-D991492C065D}" = ccc-core-static

"{DA29F644-2420-4448-8128-1331BE588999}" = Windows Live Writer

"{DAEF48AD-89C8-4A93-B1DD-45B7E4FB6071}" = Windows Live Movie Maker

"{DB1208F4-B2FE-44E9-BFE6-8824DBD7891B}" = Windows Live Movie Maker

"{DBAA2B17-D596-4195-A169-BA2166B0D69B}" = Windows Live Mail

"{DCAB6BA7-6533-44BF-9235-E5BF33B7431C}" = Windows Live Writer

"{DDC1E1BD-7615-4186-89E1-F5F43F9B6491}" = Windows Live Movie Maker

"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources

"{DE7C13A6-E4EA-4296-B0D5-5D7E8AD69501}" = Windows Live Writer

"{DE8F99FD-2FC7-4C98-AA67-2729FDE1F040}" = Windows Live Writer Resources

"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh

"{DEF91E0F-D266-453D-B6F2-1BA002B40CB6}" = Windows Live Essentials

"{DF71ABBB-B834-41C0-BB58-80B0545D754C}" = Windows Live UX Platform Language Pack

"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10

"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker

"{E5377D46-83C5-445A-A1F1-830336B42A10}" = Windows Live Galerija fotografija

"{E55E0C35-AC3C-4683-BA2F-834348577B80}" = Windows Live Writer

"{E59969EA-3B5B-4B24-8B94-43842A7FBFE9}" = Fotogalerija Windows Live

"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger

"{E5DD4723-FE0B-436E-A815-DC23CF902A0B}" = Windows Live UX Platform Language Pack

"{E5F05232-96B6-4552-A480-785A60A94B21}" = System Requirements Lab CYRI

"{E62E0550-C098-43A2-B54B-03FB1E634483}" = Windows Live Writer

"{E727A662-AF9F-4DEE-81C5-F4A1686F3DFC}" = Windows Live Writer Resources

"{E83DC314-C926-4214-AD58-147691D6FE9F}" = Основные компоненты Windows Live

"{E8524B28-3BBB-4763-AC83-0E83FE31C350}" = Windows Live Writer

"{E85A4EFC-82F2-4CEE-8A8E-62FDAD353A66}" = Galería fotográfica de Windows Live

"{E9AD2143-26D5-4201-BED1-19DCC03B407D}" = Windows Live Messenger

"{E9D98402-21AB-4E9F-BF6B-47AF36EF7E97}" = Windows Live Writer Resources

"{EA777812-4905-4C08-8F6E-13BDCC734609}" = Windows Live UX Platform Language Pack

"{ED16B700-D91F-44B0-867C-7EB5253CA38D}" = Raccolta foto di Windows Live

"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater

"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10

"{EEF99142-3357-402C-B298-DEC303E12D92}" = Windows Live 影像中心

"{EF7EAB13-46FC-49DD-8E3C-AAF8A286C5BB}" = Windows Live 程式集

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F0F5D89A-197C-495B-827E-3E98B811CD2E}" = Windows Live Photo Common

"{F0F9505B-3ACF-4158-9311-D0285136AA00}" = Windows Live Essentials

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F2979AAA-FDD7-4CB3-93BC-5C24D965D679}" = Windows Live Messenger

"{F35DC85A-E96B-496B-ABE7-F04192824856}" = Windows Live Messenger

"{F42BC1CA-E6FD-E0C2-9730-3670DAC5A473}" = CCC Help Czech

"{F4BEA6C1-AAC3-4810-AAEA-588E26E0F237}" = Windows Live UX Platform Language Pack

"{F52C5BE7-3F57-464E-8A54-908402E43CE8}" = Windows Live Writer Resources

"{F783464C-C7C6-4E9B-AC40-BC90E5414BAF}" = Windows Live Messenger

"{F7A46527-DF1F-4B0F-9637-98547E189442}" = Windows Live Galeria de Fotos

"{F7E80BA7-A09D-4DD1-828B-C4A0274D4720}" = Windows Live Mesh

"{F80E5450-3EF3-4270-B26C-6AC53BEC5E76}" = Windows Live Movie Maker

"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials

"{FA6CF94F-DACF-4FE7-959D-55C421B91B17}" = Windows Live Mail

"{FB3D07AE-73D0-47A9-AC12-6F50BF8B6202}" = Windows Live Movie Maker

"{FB79FDB7-4DE1-453D-99FE-9A880F57380E}" = Windows Live Fotogalerie

"{FBCA06D2-4642-4F33-B20A-A7AB3F0D2E69}" = معرض صور Windows Live

"{FCDE76CB-989D-4E32-9739-6A272D2B0ED7}" = Windows Live Mesh

"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR

"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials

"{FE62C88B-425B-4BDE-8B70-CD5AE3B83176}" = Windows Live Essentials

"{FEEF7F78-5876-438B-B554-C4CC426A4302}" = Windows Live Essentials

"{FF105207-8423-4E13-B0B1-50753170B245}" = Windows Live Movie Maker

"{FF3DFA01-1E98-46B4-A065-DA8AD47C9598}" = Windows Live Movie Maker

"{FF737490-5A2D-4269-9D82-97DB2F7C0B09}" = Windows Live Movie Maker

"{FFFA0584-8E3D-4195-8283-CCA3AD73C746}" = Windows Live Messenger

"Acer Registration" = Acer Registration

"Acer Screensaver" = Acer ScreenSaver

"Acer Welcome Center" = Welcome Center

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Cheat Engine 6.2_is1" = Cheat Engine 6.2

"FoozKids" = Fooz Kids

"Identity Card" = Identity Card

"IL Shared Libraries" = IL Shared Libraries

"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = Acer Crystal Eye Webcam

"InstallShield_{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}" = Acer Backup Manager

"InstallShield_{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}" = MyWinLocker Suite

"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = clear.fi

"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver

"InstallShield_{613C0AC5-3A67-4B94-8B13-9176AD83F5BF}" = newsXpresso

"InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}" = NTI Media Maker 9

"LManager" = Launch Manager

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100

"Mobile Partner" = Mobile Partner

"Mozilla Firefox 17.0.1 (x86 de)" = Mozilla Firefox 17.0.1 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"Origin" = Origin

"Steam App 203850" = Microsoft Flight

"WildTangent acer Master Uninstall" = Acer Games

"WinLiveSuite" = Windows Live Essentials

"WTA-137d29c0-e268-44dc-ab4d-d5bd3f6e35b4" = Final Drive: Nitro

"WTA-283524b0-0e2d-40d1-bbd8-e7e4754043fe" = Polar Bowler

"WTA-528e7bf8-686d-4b35-9027-0084b44c4e12" = Bejeweled 2 Deluxe

"WTA-57c1d3f8-207d-4703-8b50-1bf02040c783" = Crazy Chicken Kart 2

"WTA-58893ad1-d6e4-494f-80b0-c6009f4cf434" = Plants vs. Zombies - Game of the Year

"WTA-649715d7-5496-4e65-89af-c111918c0422" = Jewel Quest Solitaire

"WTA-86dd2b0d-aa2d-450c-a2bc-37cf545fa745" = Zuma Deluxe

"WTA-abe6e48b-42f8-42dd-a7c6-ccce7954c934" = Chuzzle Deluxe

"WTA-ae11dbe5-9abc-46fd-9d1a-676f4622562a" = Torchlight

"WTA-b210c8ed-486b-47ce-abbe-22a7d6f07b63" = Slingo Deluxe

"WTA-b249c925-327f-4baf-9682-61122f7dce9a" = Penguins!

"WTA-c1bcfc2b-90b4-4b49-a5c7-fe5c226af9a7" = Jewel Match 3

"WTA-c65b2b83-a6da-4301-ac72-9d161be1d6ef" = Virtual Villagers 4 - The Tree of Life

"WTA-c908f6be-f947-4d6b-8eaf-3b4b9c222c12" = Wedding Dash

"WTA-d39d4ca1-3a61-493d-8393-47c8f3752191" = Insaniquarium Deluxe

"WTA-daa7c2a0-9aa1-42c5-a3b9-2301ea8acf26" = Agatha Christie - Death on the Nile

"WTA-f54536c6-1399-4c9e-b638-44ba922d31fa" = John Deere Drive Green

"WTA-f62491cb-9b4a-4d0c-ad27-cf59f5de40da" = FATE

"WTA-ff95eaa3-2abc-434f-8fc6-19c1ba8bb6d9" = Mystery of Mortlake Mansion

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Spotify" = Spotify

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 04.12.2012 02:23:55 | Computer Name = Bouillon-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 04.12.2012 03:31:33 | Computer Name = Bouillon-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 04.12.2012 04:16:17 | Computer Name = Bouillon-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 05.12.2012 05:59:23 | Computer Name = Bouillon-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 06.12.2012 06:28:36 | Computer Name = Bouillon-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 07.12.2012 07:49:38 | Computer Name = Bouillon-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 08.12.2012 06:36:45 | Computer Name = Bouillon-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 09.12.2012 10:25:26 | Computer Name = Bouillon-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 10.12.2012 07:23:01 | Computer Name = Bouillon-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 10.12.2012 21:57:30 | Computer Name = Bouillon-PC | Source = WinMgmt | ID = 10

Description = 

 

[ System Events ]

Error - 09.01.2013 13:27:11 | Computer Name = Bouillon-PC | Source = Application Popup | ID = 1060

Description = Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Windows\system32\35B4.tmp

 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version

 des Treibers zu erhalten.

 

Error - 09.01.2013 13:27:11 | Computer Name = Bouillon-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "MEMSWEEP2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%1275

 

Error - 09.01.2013 13:27:51 | Computer Name = Bouillon-PC | Source = Application Popup | ID = 1060

Description = Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Windows\system32\5FF0.tmp

 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version

 des Treibers zu erhalten.

 

Error - 09.01.2013 13:27:51 | Computer Name = Bouillon-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "MEMSWEEP2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%1275

 

Error - 09.01.2013 13:46:18 | Computer Name = Bouillon-PC | Source = Application Popup | ID = 1060

Description = Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Windows\system32\5FF0.tmp

 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version

 des Treibers zu erhalten.

 

Error - 09.01.2013 13:46:18 | Computer Name = Bouillon-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "MEMSWEEP2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%1275

 

Error - 09.01.2013 13:46:53 | Computer Name = Bouillon-PC | Source = Application Popup | ID = 1060

Description = Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Windows\system32\5FF0.tmp

 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version

 des Treibers zu erhalten.

 

Error - 09.01.2013 13:46:53 | Computer Name = Bouillon-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "MEMSWEEP2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%1275

 

Error - 09.01.2013 13:46:53 | Computer Name = Bouillon-PC | Source = Application Popup | ID = 1060

Description = Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Windows\system32\5FF0.tmp

 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version

 des Treibers zu erhalten.

 

Error - 09.01.2013 13:46:53 | Computer Name = Bouillon-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "MEMSWEEP2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%1275

 

 

< End of report >

--- --- ---

Hi
download tdss killer:
http://www.trojaner-board.de/82358-t...entfernen.html
Klicke auf Change parameters
• Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system
• Klick auf OK und anschließend auf Start scan
- bei funden erst mal immer skip wählen, log posten

20:06:08.0988 11020 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
20:06:09.0199 11020 ============================================================
20:06:09.0199 11020 Current date / time: 2013/01/09 20:06:09.0199
20:06:09.0199 11020 SystemInfo:
20:06:09.0199 11020
20:06:09.0199 11020 OS Version: 6.1.7601 ServicePack: 1.0
20:06:09.0199 11020 Product type: Workstation
20:06:09.0200 11020 ComputerName: BOUILLON-PC
20:06:09.0200 11020 UserName: Bouillon
20:06:09.0200 11020 Windows directory: C:\Windows
20:06:09.0200 11020 System windows directory: C:\Windows
20:06:09.0200 11020 Running under WOW64
20:06:09.0200 11020 Processor architecture: Intel x64
20:06:09.0200 11020 Number of processors: 8
20:06:09.0200 11020 Page size: 0x1000
20:06:09.0200 11020 Boot type: Normal boot
20:06:09.0200 11020 ============================================================
20:06:11.0542 11020 Drive \Device\Harddisk0\DR0 - Size: 0x1BF2976000 (111.79 Gb), SectorSize: 0x200, Cylinders: 0x3901, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
20:06:11.0543 11020 Drive \Device\Harddisk1\DR1 - Size: 0xAEA8CDE000 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
20:06:11.0717 11020 ============================================================
20:06:11.0717 11020 \Device\Harddisk0\DR0:
20:06:11.0718 11020 MBR partitions:
20:06:11.0718 11020 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x2000800, BlocksNum 0x32000
20:06:11.0718 11020 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x2032800, BlocksNum 0xBF61800
20:06:11.0718 11020 \Device\Harddisk1\DR1:
20:06:11.0718 11020 MBR partitions:
20:06:11.0718 11020 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x57545000
20:06:11.0718 11020 ============================================================
20:06:11.0720 11020 C: <-> \Device\Harddisk0\DR0\Partition2
20:06:11.0744 11020 D: <-> \Device\Harddisk1\DR1\Partition1
20:06:11.0744 11020 ============================================================
20:06:11.0744 11020 Initialize success
20:06:11.0744 11020 ============================================================
20:07:22.0619 5304 ============================================================
20:07:22.0619 5304 Scan started
20:07:22.0619 5304 Mode: Manual; SigCheck; TDLFS;
20:07:22.0619 5304 ============================================================
20:07:22.0957 5304 ================ Scan system memory ========================
20:07:22.0957 5304 System memory - ok
20:07:22.0957 5304 ================ Scan services =============================
20:07:22.0993 5304 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
20:07:23.0124 5304 1394ohci - ok
20:07:23.0133 5304 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys
20:07:23.0152 5304 ACPI - ok
20:07:23.0155 5304 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
20:07:23.0187 5304 AcpiPmi - ok
20:07:23.0194 5304 [ B1EA9681502EE57F87DB71D726288A5B ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
20:07:23.0208 5304 AdobeARMservice - ok
20:07:23.0229 5304 [ 424877CB9D5517F980FF7BACA2EB379D ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
20:07:23.0247 5304 AdobeFlashPlayerUpdateSvc - ok
20:07:23.0257 5304 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
20:07:23.0272 5304 adp94xx - ok
20:07:23.0279 5304 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\drivers\adpahci.sys
20:07:23.0292 5304 adpahci - ok
20:07:23.0297 5304 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\drivers\adpu320.sys
20:07:23.0308 5304 adpu320 - ok
20:07:23.0312 5304 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
20:07:23.0383 5304 AeLookupSvc - ok
20:07:23.0393 5304 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys
20:07:23.0414 5304 AFD - ok
20:07:23.0417 5304 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys
20:07:23.0427 5304 agp440 - ok
20:07:23.0430 5304 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe
20:07:23.0443 5304 ALG - ok
20:07:23.0445 5304 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys
20:07:23.0454 5304 aliide - ok
20:07:23.0459 5304 [ E4DA723458A20FBA693FB1F5924483DB ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
20:07:23.0490 5304 AMD External Events Utility - ok
20:07:23.0493 5304 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys
20:07:23.0502 5304 amdide - ok
20:07:23.0505 5304 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
20:07:23.0517 5304 AmdK8 - ok
20:07:23.0629 5304 [ F894BFB5817718D50CE0122B7806B457 ] amdkmdag C:\Windows\system32\DRIVERS\atikmdag.sys
20:07:23.0744 5304 amdkmdag - ok
20:07:23.0753 5304 [ B12E7BE6715F3EE1A913A806F6B0AB94 ] amdkmdap C:\Windows\system32\DRIVERS\atikmpag.sys
20:07:23.0768 5304 amdkmdap - ok
20:07:23.0770 5304 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\drivers\amdppm.sys
20:07:23.0782 5304 AmdPPM - ok
20:07:23.0785 5304 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys
20:07:23.0795 5304 amdsata - ok
20:07:23.0800 5304 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\drivers\amdsbs.sys
20:07:23.0812 5304 amdsbs - ok
20:07:23.0814 5304 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys
20:07:23.0823 5304 amdxata - ok
20:07:23.0827 5304 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys
20:07:23.0854 5304 AppID - ok
20:07:23.0858 5304 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll
20:07:23.0887 5304 AppIDSvc - ok
20:07:23.0890 5304 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll
20:07:23.0919 5304 Appinfo - ok
20:07:23.0923 5304 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\drivers\arc.sys
20:07:23.0933 5304 arc - ok
20:07:23.0935 5304 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\drivers\arcsas.sys
20:07:23.0945 5304 arcsas - ok
20:07:23.0949 5304 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
20:07:23.0977 5304 AsyncMac - ok
20:07:23.0980 5304 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys
20:07:23.0989 5304 atapi - ok
20:07:23.0994 5304 [ 4BF5BCA6E2608CD8A00BC4A6673A9F47 ] AtiHDAudioService C:\Windows\system32\drivers\AtihdW76.sys
20:07:24.0017 5304 AtiHDAudioService - ok
20:07:24.0028 5304 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
20:07:24.0067 5304 AudioEndpointBuilder - ok
20:07:24.0078 5304 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll
20:07:24.0110 5304 AudioSrv - ok
20:07:24.0134 5304 [ C48176DA44D0298A7075D3C5CF8C3D8D ] AVKProxy C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
20:07:24.0170 5304 AVKProxy - ok
20:07:24.0182 5304 [ 29DA2D5958B352022A1BB5CE6FDB427C ] AVKService C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKService.exe
20:07:24.0197 5304 AVKService - ok
20:07:24.0222 5304 [ 22F1444896844B0462359825EF628507 ] AVKWCtl C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKWCtlX64.exe
20:07:24.0268 5304 AVKWCtl - ok
20:07:24.0272 5304 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll
20:07:24.0290 5304 AxInstSV - ok
20:07:24.0299 5304 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\drivers\bxvbda.sys
20:07:24.0315 5304 b06bdrv - ok
20:07:24.0322 5304 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
20:07:24.0335 5304 b57nd60a - ok
20:07:24.0342 5304 [ 87F3BCF82A63E900AF896CD930BF7E05 ] BBSvc C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
20:07:24.0353 5304 BBSvc - ok
20:07:24.0359 5304 [ 78779EE07231C658B483B1F38B5088DF ] BBUpdate C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
20:07:24.0373 5304 BBUpdate - ok
20:07:24.0423 5304 [ 11F844B46B631337395651ABE9C4167B ] BCM43XX C:\Windows\system32\DRIVERS\bcmwl664.sys
20:07:24.0518 5304 BCM43XX - ok
20:07:24.0523 5304 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll
20:07:24.0539 5304 BDESVC - ok
20:07:24.0542 5304 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys
20:07:24.0570 5304 Beep - ok
20:07:24.0584 5304 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll
20:07:24.0622 5304 BFE - ok
20:07:24.0635 5304 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\System32\qmgr.dll
20:07:24.0672 5304 BITS - ok
20:07:24.0674 5304 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\drivers\blbdrive.sys
20:07:24.0685 5304 blbdrive - ok
20:07:24.0689 5304 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
20:07:24.0702 5304 bowser - ok
20:07:24.0704 5304 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\drivers\BrFiltLo.sys
20:07:24.0718 5304 BrFiltLo - ok
20:07:24.0720 5304 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\drivers\BrFiltUp.sys
20:07:24.0733 5304 BrFiltUp - ok
20:07:24.0737 5304 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll
20:07:24.0752 5304 Browser - ok
20:07:24.0758 5304 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys
20:07:24.0773 5304 Brserid - ok
20:07:24.0777 5304 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
20:07:24.0789 5304 BrSerWdm - ok
20:07:24.0793 5304 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
20:07:24.0804 5304 BrUsbMdm - ok
20:07:24.0808 5304 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
20:07:24.0818 5304 BrUsbSer - ok
20:07:24.0822 5304 [ CF98190A94F62E405C8CB255018B2315 ] BthEnum C:\Windows\system32\drivers\BthEnum.sys
20:07:24.0835 5304 BthEnum - ok
20:07:24.0839 5304 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
20:07:24.0853 5304 BTHMODEM - ok
20:07:24.0857 5304 [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys
20:07:24.0872 5304 BthPan - ok
20:07:24.0880 5304 [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT C:\Windows\System32\Drivers\BTHport.sys
20:07:24.0897 5304 BTHPORT - ok
20:07:24.0900 5304 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll
20:07:24.0930 5304 bthserv - ok
20:07:24.0934 5304 [ F188B7394D81010767B6DF3178519A37 ] BTHUSB C:\Windows\System32\Drivers\BTHUSB.sys
20:07:24.0945 5304 BTHUSB - ok
20:07:24.0957 5304 [ 4E4F563F17A6D75D4CBD677470DAFAEE ] btwampfl C:\Windows\system32\drivers\btwampfl.sys
20:07:24.0973 5304 btwampfl - ok
20:07:24.0978 5304 [ 409C4117E6027672EF41E68ACE1468AD ] btwaudio C:\Windows\system32\drivers\btwaudio.sys
20:07:24.0988 5304 btwaudio - ok
20:07:24.0995 5304 [ 8CA7CABD13316ABACE386D9F380B4CF3 ] btwavdt C:\Windows\system32\drivers\btwavdt.sys
20:07:25.0004 5304 btwavdt - ok
20:07:25.0023 5304 [ E17A930E8803F0260300B88AF22F5607 ] btwdins C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
20:07:25.0050 5304 btwdins - ok
20:07:25.0053 5304 [ 41933521A618475644B6E8D8487AF326 ] BTWDPAN C:\Windows\system32\DRIVERS\btwdpan.sys
20:07:25.0062 5304 BTWDPAN - ok
20:07:25.0065 5304 [ B9354F9F111C64F2495B60F1E24CB453 ] btwl2cap C:\Windows\system32\DRIVERS\btwl2cap.sys
20:07:25.0073 5304 btwl2cap - ok
20:07:25.0075 5304 [ 71A04F2D9DEB21B162561EB574D7D629 ] btwrchid C:\Windows\system32\DRIVERS\btwrchid.sys
20:07:25.0083 5304 btwrchid - ok
20:07:25.0087 5304 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
20:07:25.0115 5304 cdfs - ok
20:07:25.0120 5304 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
20:07:25.0138 5304 cdrom - ok
20:07:25.0143 5304 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll
20:07:25.0170 5304 CertPropSvc - ok
20:07:25.0174 5304 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\drivers\circlass.sys
20:07:25.0187 5304 circlass - ok
20:07:25.0194 5304 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys
20:07:25.0208 5304 CLFS - ok
20:07:25.0214 5304 [ D0ECE4EEC80CB58DBCB96145BDC7A456 ] CLKMSVC10_34E30CCC C:\Program Files (x86)\Acer\clear.fi\Movie\NavFilter\kmsvc.exe
20:07:25.0227 5304 CLKMSVC10_34E30CCC - ok
20:07:25.0233 5304 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:07:25.0242 5304 clr_optimization_v2.0.50727_32 - ok
20:07:25.0247 5304 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
20:07:25.0257 5304 clr_optimization_v2.0.50727_64 - ok
20:07:25.0268 5304 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:07:25.0278 5304 clr_optimization_v4.0.30319_32 - ok
20:07:25.0288 5304 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
20:07:25.0297 5304 clr_optimization_v4.0.30319_64 - ok
20:07:25.0299 5304 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\drivers\CmBatt.sys
20:07:25.0310 5304 CmBatt - ok
20:07:25.0314 5304 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys
20:07:25.0323 5304 cmdide - ok
20:07:25.0332 5304 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\Windows\system32\Drivers\cng.sys
20:07:25.0350 5304 CNG - ok
20:07:25.0353 5304 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\drivers\compbatt.sys
20:07:25.0363 5304 Compbatt - ok
20:07:25.0365 5304 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
20:07:25.0378 5304 CompositeBus - ok
20:07:25.0380 5304 COMSysApp - ok
20:07:25.0384 5304 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
20:07:25.0393 5304 crcdisk - ok
20:07:25.0399 5304 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\Windows\system32\cryptsvc.dll
20:07:25.0414 5304 CryptSvc - ok
20:07:25.0424 5304 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll
20:07:25.0459 5304 DcomLaunch - ok
20:07:25.0467 5304 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll
20:07:25.0498 5304 defragsvc - ok
20:07:25.0502 5304 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
20:07:25.0530 5304 DfsC - ok
20:07:25.0538 5304 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll
20:07:25.0555 5304 Dhcp - ok
20:07:25.0559 5304 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys
20:07:25.0587 5304 discache - ok
20:07:25.0592 5304 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\drivers\disk.sys
20:07:25.0600 5304 Disk - ok
20:07:25.0605 5304 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll
20:07:25.0622 5304 Dnscache - ok
20:07:25.0627 5304 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll
20:07:25.0655 5304 dot3svc - ok
20:07:25.0660 5304 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll
20:07:25.0690 5304 DPS - ok
20:07:25.0693 5304 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
20:07:25.0705 5304 drmkaud - ok
20:07:25.0713 5304 [ 9DD3A22F804697606C2B7FF9E912FF6B ] DsiWMIService C:\Program Files (x86)\Launch Manager\dsiwmis.exe
20:07:25.0727 5304 DsiWMIService - ok
20:07:25.0742 5304 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
20:07:25.0763 5304 DXGKrnl - ok
20:07:25.0767 5304 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll
20:07:25.0797 5304 EapHost - ok
20:07:25.0834 5304 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\drivers\evbda.sys
20:07:25.0883 5304 ebdrv - ok
20:07:25.0887 5304 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe
20:07:25.0900 5304 EFS - ok
20:07:25.0905 5304 [ 5332EC2BA1C112BD4BB1F38127848FEF ] EgisTec Ticket Service C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe
20:07:25.0915 5304 EgisTec Ticket Service - ok
20:07:25.0929 5304 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
20:07:25.0950 5304 ehRecvr - ok
20:07:25.0954 5304 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe
20:07:25.0965 5304 ehSched - ok
20:07:25.0978 5304 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\drivers\elxstor.sys
20:07:25.0993 5304 elxstor - ok
20:07:26.0008 5304 [ 48425C93B6F36529707206E4FA680CF3 ] ePowerSvc C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
20:07:26.0032 5304 ePowerSvc - ok
20:07:26.0034 5304 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys
20:07:26.0045 5304 ErrDev - ok
20:07:26.0050 5304 [ 9D8739A2A2173C9D27C499A3FC6EDA3F ] ETD C:\Windows\system32\DRIVERS\ETD.sys
20:07:26.0060 5304 ETD - ok
20:07:26.0069 5304 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll
20:07:26.0103 5304 EventSystem - ok
20:07:26.0112 5304 [ 334C907536E815E56CD13108A6D5FB9D ] ewusbmbb C:\Windows\system32\DRIVERS\ewusbwwan.sys
20:07:26.0127 5304 ewusbmbb - ok
20:07:26.0132 5304 [ 86F7951BBCEE4A86E79A97306BD14318 ] ew_hwusbdev C:\Windows\system32\DRIVERS\ew_hwusbdev.sys
20:07:26.0145 5304 ew_hwusbdev - ok
20:07:26.0150 5304 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys
20:07:26.0179 5304 exfat - ok
20:07:26.0185 5304 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys
20:07:26.0214 5304 fastfat - ok
20:07:26.0227 5304 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe
20:07:26.0247 5304 Fax - ok
20:07:26.0249 5304 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\drivers\fdc.sys
20:07:26.0260 5304 fdc - ok
20:07:26.0263 5304 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll
20:07:26.0293 5304 fdPHost - ok
20:07:26.0297 5304 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll
20:07:26.0325 5304 FDResPub - ok
20:07:26.0329 5304 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
20:07:26.0339 5304 FileInfo - ok
20:07:26.0343 5304 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
20:07:26.0372 5304 Filetrace - ok
20:07:26.0383 5304 [ BB0667B0171B632B97EA759515476F07 ] FLEXnet Licensing Service C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
20:07:26.0398 5304 FLEXnet Licensing Service - ok
20:07:26.0400 5304 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\drivers\flpydisk.sys
20:07:26.0410 5304 flpydisk - ok
20:07:26.0417 5304 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
20:07:26.0429 5304 FltMgr - ok
20:07:26.0444 5304 [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache C:\Windows\system32\FntCache.dll
20:07:26.0474 5304 FontCache - ok
20:07:26.0478 5304 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
20:07:26.0487 5304 FontCache3.0.0.0 - ok
20:07:26.0490 5304 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
20:07:26.0500 5304 FsDepends - ok
20:07:26.0503 5304 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
20:07:26.0512 5304 Fs_Rec - ok
20:07:26.0517 5304 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
20:07:26.0530 5304 fvevol - ok
20:07:26.0534 5304 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
20:07:26.0543 5304 gagp30kx - ok
20:07:26.0548 5304 [ C403C5DB49A0F9AAF4F2128EDC0106D8 ] GamesAppService C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe
20:07:26.0558 5304 GamesAppService - ok
20:07:26.0563 5304 [ D201C1F6B0F5E4F202CBCB75D6352E63 ] GDBehave C:\Windows\system32\drivers\GDBehave.sys
20:07:26.0572 5304 GDBehave - ok
20:07:26.0575 5304 [ E1558301938B6CF92F7677224D3FB6F7 ] GDMnIcpt C:\Windows\system32\drivers\MiniIcpt.sys
20:07:26.0585 5304 GDMnIcpt - ok
20:07:26.0589 5304 [ 5F1E5EAE8F08B6E2FABE8345E0BDFE48 ] GDPkIcpt C:\Windows\system32\drivers\PktIcpt.sys
20:07:26.0597 5304 GDPkIcpt - ok
20:07:26.0607 5304 [ 110C6DC36EA9F5DA664A584756B1B297 ] GDScan C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
20:07:26.0623 5304 GDScan - ok
20:07:26.0627 5304 [ 4ECBCAD43B7FED6F135BF108BB71434D ] gdwfpcd C:\Windows\system32\drivers\gdwfpcd64.sys
20:07:26.0635 5304 gdwfpcd - ok
20:07:26.0647 5304 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll
20:07:26.0685 5304 gpsvc - ok
20:07:26.0689 5304 [ 9580CBF03D2EE08BD1C0D701AAE4092A ] GRD C:\Windows\system32\drivers\GRD.sys
20:07:26.0698 5304 GRD - ok
20:07:26.0700 5304 [ C9B2D1D3F86FD3673EF847DEF73B6F9E ] GREGService C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
20:07:26.0709 5304 GREGService - ok
20:07:26.0712 5304 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
20:07:26.0724 5304 hcw85cir - ok
20:07:26.0732 5304 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
20:07:26.0748 5304 HdAudAddService - ok
20:07:26.0752 5304 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
20:07:26.0765 5304 HDAudBus - ok
20:07:26.0768 5304 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\drivers\HidBatt.sys
20:07:26.0779 5304 HidBatt - ok
20:07:26.0783 5304 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\drivers\hidbth.sys
20:07:26.0795 5304 HidBth - ok
20:07:26.0799 5304 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\drivers\hidir.sys
20:07:26.0812 5304 HidIr - ok
20:07:26.0814 5304 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\system32\hidserv.dll
20:07:26.0843 5304 hidserv - ok
20:07:26.0845 5304 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
20:07:26.0855 5304 HidUsb - ok
20:07:26.0859 5304 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll
20:07:26.0888 5304 hkmsvc - ok
20:07:26.0893 5304 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
20:07:26.0910 5304 HomeGroupListener - ok
20:07:26.0915 5304 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
20:07:26.0928 5304 HomeGroupProvider - ok
20:07:26.0932 5304 [ 3CD18F0B3681FB267E67763CC3152D4E ] HookCentre C:\Windows\system32\drivers\HookCentre.sys
20:07:26.0940 5304 HookCentre - ok
20:07:26.0944 5304 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
20:07:26.0953 5304 HpSAMD - ok
20:07:26.0964 5304 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys
20:07:26.0999 5304 HTTP - ok
20:07:27.0004 5304 [ 1642C62F1FD5E1FF44608283994A7BB8 ] huawei_enumerator C:\Windows\system32\DRIVERS\ew_jubusenum.sys
20:07:27.0017 5304 huawei_enumerator - ok
20:07:27.0023 5304 [ 4B80AF36EE9F31361C1DCB2EE563719A ] hwdatacard C:\Windows\system32\DRIVERS\ewusbmdm.sys
20:07:27.0038 5304 hwdatacard - ok
20:07:27.0047 5304 [ E90DA42B87D684DEBFB73B38A718A006 ] HWDeviceService64.exe C:\ProgramData\DatacardService\HWDeviceService64.exe
20:07:27.0060 5304 HWDeviceService64.exe - ok
20:07:27.0063 5304 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
20:07:27.0072 5304 hwpolicy - ok
20:07:27.0077 5304 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
20:07:27.0088 5304 i8042prt - ok
20:07:27.0097 5304 [ D469B77687E12FE43E344806740B624D ] iaStor C:\Windows\system32\drivers\iaStor.sys
20:07:27.0109 5304 iaStor - ok
20:07:27.0114 5304 [ 983FC69644DDF0486C8DFEA262948D1A ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
20:07:27.0122 5304 IAStorDataMgrSvc - ok
20:07:27.0130 5304 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
20:07:27.0144 5304 iaStorV - ok
20:07:27.0159 5304 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
20:07:27.0177 5304 idsvc - ok
20:07:27.0180 5304 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\drivers\iirsp.sys
20:07:27.0189 5304 iirsp - ok
20:07:27.0202 5304 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll
20:07:27.0243 5304 IKEEXT - ok
20:07:27.0278 5304 [ CB7DADEF3D83FE2C12655A0BDCBA99F2 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
20:07:27.0324 5304 IntcAzAudAddService - ok
20:07:27.0327 5304 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys
20:07:27.0337 5304 intelide - ok
20:07:27.0339 5304 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
20:07:27.0350 5304 intelppm - ok
20:07:27.0354 5304 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll
20:07:27.0383 5304 IPBusEnum - ok
20:07:27.0387 5304 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:07:27.0414 5304 IpFilterDriver - ok
20:07:27.0425 5304 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
20:07:27.0447 5304 iphlpsvc - ok
20:07:27.0450 5304 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
20:07:27.0462 5304 IPMIDRV - ok
20:07:27.0465 5304 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys
20:07:27.0494 5304 IPNAT - ok
20:07:27.0498 5304 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
20:07:27.0510 5304 IRENUM - ok
20:07:27.0514 5304 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys
20:07:27.0523 5304 isapnp - ok
20:07:27.0530 5304 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
20:07:27.0542 5304 iScsiPrt - ok
20:07:27.0545 5304 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
20:07:27.0555 5304 kbdclass - ok
20:07:27.0558 5304 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
20:07:27.0569 5304 kbdhid - ok
20:07:27.0572 5304 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe
20:07:27.0582 5304 KeyIso - ok
20:07:27.0585 5304 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
20:07:27.0595 5304 KSecDD - ok
20:07:27.0600 5304 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
20:07:27.0610 5304 KSecPkg - ok
20:07:27.0613 5304 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
20:07:27.0643 5304 ksthunk - ok
20:07:27.0650 5304 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll
20:07:27.0682 5304 KtmRm - ok
20:07:27.0687 5304 [ 0E154DA6CA9105354A07D0C576804037 ] L1C C:\Windows\system32\DRIVERS\L1C62x64.sys
20:07:27.0695 5304 L1C - ok
20:07:27.0702 5304 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\system32\srvsvc.dll
20:07:27.0733 5304 LanmanServer - ok
20:07:27.0738 5304 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
20:07:27.0768 5304 LanmanWorkstation - ok
20:07:27.0775 5304 [ B705C7097F9A0EC941D02DCE7C7D426C ] Live Updater Service C:\Program Files\Acer\Acer Updater\UpdaterService.exe
20:07:27.0788 5304 Live Updater Service - ok
20:07:27.0792 5304 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
20:07:27.0819 5304 lltdio - ok
20:07:27.0827 5304 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll
20:07:27.0858 5304 lltdsvc - ok
20:07:27.0862 5304 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll
20:07:27.0890 5304 lmhosts - ok
20:07:27.0899 5304 [ 50C7CE53EF461870410355F1F2E7D515 ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
20:07:27.0913 5304 LMS - ok
20:07:27.0918 5304 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
20:07:27.0928 5304 LSI_FC - ok
20:07:27.0932 5304 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
20:07:27.0942 5304 LSI_SAS - ok
20:07:27.0944 5304 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\drivers\lsi_sas2.sys
20:07:27.0954 5304 LSI_SAS2 - ok
20:07:27.0958 5304 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
20:07:27.0968 5304 LSI_SCSI - ok
20:07:27.0972 5304 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys
20:07:28.0000 5304 luafv - ok
20:07:28.0005 5304 [ 92EB844D90615CB266F84C3202B8786E ] MBAMProtector C:\Windows\system32\drivers\mbam.sys
20:07:28.0013 5304 MBAMProtector - ok
20:07:28.0023 5304 [ 1ACAA67676E9E7BDA5E0C41B6E0DECAF ] MBAMScheduler C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
20:07:28.0037 5304 MBAMScheduler - ok
20:07:28.0049 5304 [ 916B8954AC3E06DC9E898AFFB41F3FB6 ] MBAMService C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
20:07:28.0070 5304 MBAMService - ok
20:07:28.0075 5304 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
20:07:28.0088 5304 Mcx2Svc - ok
20:07:28.0092 5304 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\drivers\megasas.sys
20:07:28.0100 5304 megasas - ok
20:07:28.0107 5304 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\drivers\MegaSR.sys
20:07:28.0119 5304 MegaSR - ok
20:07:28.0123 5304 [ A6518DCC42F7A6E999BB3BEA8FD87567 ] MEIx64 C:\Windows\system32\drivers\HECIx64.sys
20:07:28.0130 5304 MEIx64 - ok
20:07:28.0134 5304 [ 1595FECFFBE9EA2417E06D5FD0BFA4C4 ] MEMSWEEP2 C:\Windows\system32\5FF0.tmp
20:07:28.0138 5304 MEMSWEEP2 ( UnsignedFile.Multi.Generic ) - warning
20:07:28.0138 5304 MEMSWEEP2 - detected UnsignedFile.Multi.Generic (1)
20:07:28.0143 5304 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll
20:07:28.0172 5304 MMCSS - ok
20:07:28.0180 5304 [ 1CE0621B591913C12BECAA5B50E88BB2 ] Mobile Partner. RunOuc C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe
20:07:28.0190 5304 Mobile Partner. RunOuc - ok
20:07:28.0194 5304 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys
20:07:28.0223 5304 Modem - ok
20:07:28.0225 5304 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys
20:07:28.0239 5304 monitor - ok
20:07:28.0243 5304 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
20:07:28.0252 5304 mouclass - ok
20:07:28.0254 5304 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
20:07:28.0264 5304 mouhid - ok
20:07:28.0269 5304 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
20:07:28.0278 5304 mountmgr - ok
20:07:28.0282 5304 [ 8C7336950F1E69CDFD811CBBD9CF00A2 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
20:07:28.0292 5304 MozillaMaintenance - ok
20:07:28.0295 5304 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys
20:07:28.0305 5304 mpio - ok
20:07:28.0309 5304 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
20:07:28.0338 5304 mpsdrv - ok
20:07:28.0352 5304 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll
20:07:28.0392 5304 MpsSvc - ok
20:07:28.0397 5304 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
20:07:28.0413 5304 MRxDAV - ok
20:07:28.0417 5304 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
20:07:28.0430 5304 mrxsmb - ok
20:07:28.0438 5304 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:07:28.0449 5304 mrxsmb10 - ok
20:07:28.0453 5304 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:07:28.0464 5304 mrxsmb20 - ok
20:07:28.0467 5304 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys
20:07:28.0475 5304 msahci - ok
20:07:28.0480 5304 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys
20:07:28.0490 5304 msdsm - ok
20:07:28.0495 5304 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe
20:07:28.0508 5304 MSDTC - ok
20:07:28.0513 5304 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys
20:07:28.0539 5304 Msfs - ok
20:07:28.0543 5304 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
20:07:28.0570 5304 mshidkmdf - ok
20:07:28.0574 5304 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
20:07:28.0583 5304 msisadrv - ok
20:07:28.0588 5304 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
20:07:28.0617 5304 MSiSCSI - ok
20:07:28.0619 5304 msiserver - ok
20:07:28.0622 5304 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
20:07:28.0649 5304 MSKSSRV - ok
20:07:28.0653 5304 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
20:07:28.0680 5304 MSPCLOCK - ok
20:07:28.0683 5304 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
20:07:28.0710 5304 MSPQM - ok
20:07:28.0718 5304 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
20:07:28.0732 5304 MsRPC - ok
20:07:28.0735 5304 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
20:07:28.0744 5304 mssmbios - ok
20:07:28.0747 5304 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
20:07:28.0775 5304 MSTEE - ok
20:07:28.0778 5304 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\drivers\MTConfig.sys
20:07:28.0788 5304 MTConfig - ok
20:07:28.0792 5304 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys
20:07:28.0802 5304 Mup - ok
20:07:28.0804 5304 [ C009123B206C56854F4E88596035231D ] mwlPSDFilter C:\Windows\system32\DRIVERS\mwlPSDFilter.sys
20:07:28.0813 5304 mwlPSDFilter - ok
20:07:28.0815 5304 [ BF3739EEB9F008B1DEBAC115089A53F8 ] mwlPSDNServ C:\Windows\system32\DRIVERS\mwlPSDNServ.sys
20:07:28.0823 5304 mwlPSDNServ - ok
20:07:28.0827 5304 [ 38DD143D95E7A01B86F219DDA9C28779 ] mwlPSDVDisk C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys
20:07:28.0834 5304 mwlPSDVDisk - ok
20:07:28.0844 5304 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll
20:07:28.0877 5304 napagent - ok
20:07:28.0884 5304 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
20:07:28.0902 5304 NativeWifiP - ok
20:07:28.0915 5304 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys
20:07:28.0937 5304 NDIS - ok
20:07:28.0940 5304 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
20:07:28.0969 5304 NdisCap - ok
20:07:28.0972 5304 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
20:07:28.0999 5304 NdisTapi - ok
20:07:29.0003 5304 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
20:07:29.0030 5304 Ndisuio - ok
20:07:29.0037 5304 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
20:07:29.0065 5304 NdisWan - ok
20:07:29.0069 5304 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
20:07:29.0097 5304 NDProxy - ok
20:07:29.0100 5304 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
20:07:29.0129 5304 NetBIOS - ok
20:07:29.0135 5304 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
20:07:29.0164 5304 NetBT - ok
20:07:29.0168 5304 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe
20:07:29.0178 5304 Netlogon - ok
20:07:29.0185 5304 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll
20:07:29.0219 5304 Netman - ok
20:07:29.0229 5304 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll
20:07:29.0264 5304 netprofm - ok
20:07:29.0269 5304 [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:07:29.0280 5304 NetTcpPortSharing - ok
20:07:29.0284 5304 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
20:07:29.0293 5304 nfrd960 - ok
20:07:29.0299 5304 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\Windows\System32\nlasvc.dll
20:07:29.0315 5304 NlaSvc - ok
20:07:29.0348 5304 [ 5839A8027D6D324A7CD494051A96628C ] NOBU C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
20:07:29.0403 5304 NOBU - ok
20:07:29.0407 5304 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys
20:07:29.0434 5304 Npfs - ok
20:07:29.0438 5304 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll
20:07:29.0467 5304 nsi - ok
20:07:29.0469 5304 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
20:07:29.0498 5304 nsiproxy - ok
20:07:29.0520 5304 [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
20:07:29.0551 5304 Ntfs - ok
20:07:29.0558 5304 [ 1873214666F6F0A883742DF91FBC48C9 ] NTI IScheduleSvc C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
20:07:29.0571 5304 NTI IScheduleSvc - ok
20:07:29.0573 5304 [ EE3BA1024594D5D09E314F206B94069E ] NTIDrvr C:\Windows\system32\drivers\NTIDrvr.sys
20:07:29.0581 5304 NTIDrvr - ok
20:07:29.0583 5304 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys
20:07:29.0611 5304 Null - ok
20:07:29.0616 5304 [ 0EBC9D13CD96C15B1B18D8678A609E4B ] nusb3hub C:\Windows\system32\DRIVERS\nusb3hub.sys
20:07:29.0626 5304 nusb3hub - ok
20:07:29.0631 5304 [ 7BDEC000D56D485021D9C1E63C2F81CA ] nusb3xhc C:\Windows\system32\DRIVERS\nusb3xhc.sys
20:07:29.0643 5304 nusb3xhc - ok
20:07:29.0647 5304 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys
20:07:29.0658 5304 nvraid - ok
20:07:29.0663 5304 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys
20:07:29.0673 5304 nvstor - ok
20:07:29.0678 5304 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
20:07:29.0688 5304 nv_agp - ok
20:07:29.0691 5304 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
20:07:29.0702 5304 ohci1394 - ok
20:07:29.0708 5304 [ 4965B005492CBA7719E82B71E3245495 ] ose64 C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:07:29.0718 5304 ose64 - ok
20:07:29.0771 5304 [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
20:07:29.0862 5304 osppsvc - ok
20:07:29.0872 5304 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
20:07:29.0889 5304 p2pimsvc - ok
20:07:29.0898 5304 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll
20:07:29.0916 5304 p2psvc - ok
20:07:29.0919 5304 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\drivers\parport.sys
20:07:29.0929 5304 Parport - ok
20:07:29.0933 5304 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys
20:07:29.0943 5304 partmgr - ok
20:07:29.0948 5304 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll
20:07:29.0966 5304 PcaSvc - ok
20:07:29.0971 5304 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys
20:07:29.0982 5304 pci - ok
20:07:29.0984 5304 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys
20:07:29.0993 5304 pciide - ok
20:07:29.0998 5304 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
20:07:30.0009 5304 pcmcia - ok
20:07:30.0012 5304 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys
20:07:30.0022 5304 pcw - ok
20:07:30.0032 5304 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys
20:07:30.0066 5304 PEAUTH - ok
20:07:30.0083 5304 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe
20:07:30.0094 5304 PerfHost - ok
20:07:30.0116 5304 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll
20:07:30.0159 5304 pla - ok
20:07:30.0168 5304 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
20:07:30.0188 5304 PlugPlay - ok
20:07:30.0191 5304 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
20:07:30.0202 5304 PNRPAutoReg - ok
20:07:30.0208 5304 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
20:07:30.0221 5304 PNRPsvc - ok
20:07:30.0231 5304 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
20:07:30.0267 5304 PolicyAgent - ok
20:07:30.0273 5304 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll
20:07:30.0303 5304 Power - ok
20:07:30.0308 5304 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
20:07:30.0337 5304 PptpMiniport - ok
20:07:30.0341 5304 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\drivers\processr.sys
20:07:30.0352 5304 Processor - ok
20:07:30.0357 5304 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll
20:07:30.0373 5304 ProfSvc - ok
20:07:30.0376 5304 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
20:07:30.0386 5304 ProtectedStorage - ok
20:07:30.0391 5304 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys
20:07:30.0418 5304 Psched - ok
20:07:30.0439 5304 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\drivers\ql2300.sys
20:07:30.0468 5304 ql2300 - ok
20:07:30.0473 5304 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
20:07:30.0483 5304 ql40xx - ok
20:07:30.0488 5304 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll
20:07:30.0506 5304 QWAVE - ok
20:07:30.0508 5304 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
20:07:30.0523 5304 QWAVEdrv - ok
20:07:30.0526 5304 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
20:07:30.0553 5304 RasAcd - ok
20:07:30.0557 5304 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
20:07:30.0586 5304 RasAgileVpn - ok
20:07:30.0589 5304 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll
20:07:30.0619 5304 RasAuto - ok
20:07:30.0624 5304 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
20:07:30.0652 5304 Rasl2tp - ok
20:07:30.0659 5304 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll
20:07:30.0689 5304 RasMan - ok
20:07:30.0694 5304 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
20:07:30.0723 5304 RasPppoe - ok
20:07:30.0727 5304 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
20:07:30.0757 5304 RasSstp - ok
20:07:30.0763 5304 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
20:07:30.0793 5304 rdbss - ok
20:07:30.0797 5304 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\drivers\rdpbus.sys
20:07:30.0809 5304 rdpbus - ok
20:07:30.0813 5304 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
20:07:30.0841 5304 RDPCDD - ok
20:07:30.0846 5304 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
20:07:30.0873 5304 RDPENCDD - ok
20:07:30.0878 5304 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
20:07:30.0906 5304 RDPREFMP - ok
20:07:30.0911 5304 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
20:07:30.0926 5304 RDPWD - ok
20:07:30.0931 5304 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
20:07:30.0942 5304 rdyboost - ok
20:07:30.0946 5304 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll
20:07:30.0974 5304 RemoteAccess - ok
20:07:30.0979 5304 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll
20:07:31.0009 5304 RemoteRegistry - ok
20:07:31.0014 5304 [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys
20:07:31.0029 5304 RFCOMM - ok
20:07:31.0032 5304 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
20:07:31.0063 5304 RpcEptMapper - ok
20:07:31.0067 5304 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe
20:07:31.0078 5304 RpcLocator - ok
20:07:31.0088 5304 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll
20:07:31.0121 5304 RpcSs - ok
20:07:31.0123 5304 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
20:07:31.0153 5304 rspndr - ok
20:07:31.0159 5304 [ 9BEB5F18A418FF70659CE2E356829568 ] RSUSBSTOR C:\Windows\System32\Drivers\RtsUStor.sys
20:07:31.0171 5304 RSUSBSTOR - ok
20:07:31.0173 5304 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe
20:07:31.0184 5304 SamSs - ok
20:07:31.0188 5304 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
20:07:31.0198 5304 sbp2port - ok
20:07:31.0203 5304 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll
20:07:31.0233 5304 SCardSvr - ok
20:07:31.0237 5304 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
20:07:31.0264 5304 scfilter - ok
20:07:31.0281 5304 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll
20:07:31.0324 5304 Schedule - ok
20:07:31.0328 5304 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll
20:07:31.0357 5304 SCPolicySvc - ok
20:07:31.0362 5304 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll
20:07:31.0378 5304 SDRSVC - ok
20:07:31.0381 5304 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys
20:07:31.0408 5304 secdrv - ok
20:07:31.0412 5304 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll
20:07:31.0439 5304 seclogon - ok
20:07:31.0444 5304 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\System32\sens.dll
20:07:31.0473 5304 SENS - ok
20:07:31.0477 5304 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll
20:07:31.0489 5304 SensrSvc - ok
20:07:31.0493 5304 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\drivers\serenum.sys
20:07:31.0503 5304 Serenum - ok
20:07:31.0507 5304 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\drivers\serial.sys
20:07:31.0518 5304 Serial - ok
20:07:31.0521 5304 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\drivers\sermouse.sys
20:07:31.0532 5304 sermouse - ok
20:07:31.0538 5304 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll
20:07:31.0568 5304 SessionEnv - ok
20:07:31.0572 5304 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
20:07:31.0584 5304 sffdisk - ok
20:07:31.0587 5304 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
20:07:31.0599 5304 sffp_mmc - ok
20:07:31.0602 5304 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
20:07:31.0614 5304 sffp_sd - ok
20:07:31.0617 5304 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
20:07:31.0628 5304 sfloppy - ok
20:07:31.0634 5304 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll
20:07:31.0666 5304 SharedAccess - ok
20:07:31.0673 5304 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
20:07:31.0707 5304 ShellHWDetection - ok
20:07:31.0709 5304 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\drivers\SiSRaid2.sys
20:07:31.0718 5304 SiSRaid2 - ok
20:07:31.0722 5304 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
20:07:31.0732 5304 SiSRaid4 - ok
20:07:31.0737 5304 [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe
20:07:31.0747 5304 SkypeUpdate - ok
20:07:31.0749 5304 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys
20:07:31.0778 5304 Smb - ok
20:07:31.0783 5304 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe
20:07:31.0796 5304 SNMPTRAP - ok
20:07:31.0798 5304 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys
20:07:31.0807 5304 spldr - ok
20:07:31.0818 5304 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe
20:07:31.0838 5304 Spooler - ok
20:07:31.0876 5304 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe
20:07:31.0958 5304 sppsvc - ok
20:07:31.0962 5304 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll
20:07:31.0991 5304 sppuinotify - ok
20:07:32.0001 5304 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys
20:07:32.0017 5304 srv - ok
20:07:32.0024 5304 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
20:07:32.0038 5304 srv2 - ok
20:07:32.0043 5304 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
20:07:32.0054 5304 srvnet - ok
20:07:32.0059 5304 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
20:07:32.0092 5304 SSDPSRV - ok
20:07:32.0096 5304 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll
20:07:32.0126 5304 SstpSvc - ok
20:07:32.0129 5304 Steam Client Service - ok
20:07:32.0132 5304 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\drivers\stexstor.sys
20:07:32.0141 5304 stexstor - ok
20:07:32.0151 5304 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll
20:07:32.0174 5304 stisvc - ok
20:07:32.0177 5304 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\drivers\swenum.sys
20:07:32.0186 5304 swenum - ok
20:07:32.0194 5304 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll
20:07:32.0231 5304 swprv - ok
20:07:32.0252 5304 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll
20:07:32.0283 5304 SysMain - ok
20:07:32.0287 5304 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
20:07:32.0304 5304 TabletInputService - ok
20:07:32.0311 5304 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll
20:07:32.0342 5304 TapiSrv - ok
20:07:32.0347 5304 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll
20:07:32.0377 5304 TBS - ok
20:07:32.0401 5304 [ 37608401DFDB388CAF66917F6B2D6FB0 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
20:07:32.0443 5304 Tcpip - ok
20:07:32.0468 5304 [ 37608401DFDB388CAF66917F6B2D6FB0 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
20:07:32.0502 5304 TCPIP6 - ok
20:07:32.0507 5304 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
20:07:32.0517 5304 tcpipreg - ok
20:07:32.0521 5304 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
20:07:32.0533 5304 TDPIPE - ok
20:07:32.0536 5304 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
20:07:32.0546 5304 TDTCP - ok
20:07:32.0549 5304 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
20:07:32.0578 5304 tdx - ok
20:07:32.0582 5304 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\drivers\termdd.sys
20:07:32.0592 5304 TermDD - ok
20:07:32.0603 5304 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll
20:07:32.0641 5304 TermService - ok
20:07:32.0643 5304 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll
20:07:32.0659 5304 Themes - ok
20:07:32.0662 5304 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll
20:07:32.0691 5304 THREADORDER - ok
20:07:32.0696 5304 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll
20:07:32.0726 5304 TrkWks - ok
20:07:32.0732 5304 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
20:07:32.0762 5304 TrustedInstaller - ok
20:07:32.0767 5304 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
20:07:32.0796 5304 tssecsrv - ok
20:07:32.0799 5304 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
20:07:32.0812 5304 TsUsbFlt - ok
20:07:32.0814 5304 [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD C:\Windows\system32\drivers\TsUsbGD.sys
20:07:32.0826 5304 TsUsbGD - ok
20:07:32.0829 5304 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
20:07:32.0859 5304 tunnel - ok
20:07:32.0863 5304 [ FD24F98D2898BE093FE926604BE7DB99 ] TurboB C:\Windows\system32\DRIVERS\TurboB.sys
20:07:32.0871 5304 TurboB - ok
20:07:32.0876 5304 [ 600B406A04D90F577FEA8A88D7379F08 ] TurboBoost C:\Program Files\Intel\TurboBoost\TurboBoost.exe
20:07:32.0886 5304 TurboBoost - ok
20:07:32.0889 5304 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\drivers\uagp35.sys
20:07:32.0898 5304 uagp35 - ok
20:07:32.0902 5304 [ A17D5E1A6DF4EAB0A480F2C490DE4C9D ] UBHelper C:\Windows\system32\drivers\UBHelper.sys
20:07:32.0909 5304 UBHelper - ok
20:07:32.0916 5304 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
20:07:32.0947 5304 udfs - ok
20:07:32.0953 5304 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe
20:07:32.0964 5304 UI0Detect - ok
20:07:32.0968 5304 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
20:07:32.0977 5304 uliagpkx - ok
20:07:32.0981 5304 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
20:07:32.0991 5304 umbus - ok
20:07:32.0994 5304 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\drivers\umpass.sys
20:07:33.0006 5304 UmPass - ok
20:07:33.0037 5304 [ 374EBDA379A8F38E0CFC2211611E7167 ] UNS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
20:07:33.0091 5304 UNS - ok
20:07:33.0099 5304 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll
20:07:33.0134 5304 upnphost - ok
20:07:33.0138 5304 [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio C:\Windows\system32\drivers\usbaudio.sys
20:07:33.0153 5304 usbaudio - ok
20:07:33.0156 5304 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
20:07:33.0169 5304 usbccgp - ok
20:07:33.0172 5304 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys
20:07:33.0184 5304 usbcir - ok
20:07:33.0189 5304 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\drivers\usbehci.sys
20:07:33.0199 5304 usbehci - ok
20:07:33.0207 5304 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
20:07:33.0219 5304 usbhub - ok
20:07:33.0223 5304 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\drivers\usbohci.sys
20:07:33.0233 5304 usbohci - ok
20:07:33.0252 5304 [ 813BFE2DE062A28CFE42C4EB8572A7F9 ] USBPNPA C:\Windows\system32\drivers\CM10864.sys
20:07:33.0274 5304 USBPNPA - ok
20:07:33.0278 5304 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
20:07:33.0291 5304 usbprint - ok
20:07:33.0296 5304 [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
20:07:33.0308 5304 usbscan - ok
20:07:33.0312 5304 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:07:33.0324 5304 USBSTOR - ok
20:07:33.0327 5304 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
20:07:33.0338 5304 usbuhci - ok
20:07:33.0342 5304 [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo C:\Windows\system32\Drivers\usbvideo.sys
20:07:33.0356 5304 usbvideo - ok
20:07:33.0359 5304 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll
20:07:33.0389 5304 UxSms - ok
20:07:33.0392 5304 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe
20:07:33.0403 5304 VaultSvc - ok
20:07:33.0407 5304 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
20:07:33.0416 5304 vdrvroot - ok
20:07:33.0424 5304 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe
20:07:33.0461 5304 vds - ok
20:07:33.0464 5304 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
20:07:33.0477 5304 vga - ok
20:07:33.0479 5304 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys
20:07:33.0507 5304 VgaSave - ok
20:07:33.0513 5304 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
20:07:33.0523 5304 vhdmp - ok
20:07:33.0527 5304 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys
20:07:33.0536 5304 viaide - ok
20:07:33.0539 5304 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys
20:07:33.0548 5304 volmgr - ok
20:07:33.0556 5304 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
20:07:33.0568 5304 volmgrx - ok
20:07:33.0574 5304 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys
20:07:33.0588 5304 volsnap - ok
20:07:33.0593 5304 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
20:07:33.0604 5304 vsmraid - ok
20:07:33.0623 5304 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe
20:07:33.0673 5304 VSS - ok
20:07:33.0677 5304 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
20:07:33.0691 5304 vwifibus - ok
20:07:33.0693 5304 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
20:07:33.0708 5304 vwififlt - ok
20:07:33.0716 5304 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll
20:07:33.0751 5304 W32Time - ok
20:07:33.0756 5304 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\drivers\wacompen.sys
20:07:33.0766 5304 WacomPen - ok
20:07:33.0769 5304 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
20:07:33.0798 5304 WANARP - ok
20:07:33.0801 5304 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
20:07:33.0828 5304 Wanarpv6 - ok
20:07:33.0848 5304 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe
20:07:33.0876 5304 wbengine - ok
20:07:33.0881 5304 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
20:07:33.0898 5304 WbioSrvc - ok
20:07:33.0904 5304 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll
20:07:33.0924 5304 wcncsvc - ok
20:07:33.0928 5304 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
20:07:33.0941 5304 WcsPlugInService - ok
20:07:33.0943 5304 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\drivers\wd.sys
20:07:33.0952 5304 Wd - ok
20:07:33.0966 5304 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
20:07:33.0989 5304 Wdf01000 - ok
20:07:33.0993 5304 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll
20:07:34.0033 5304 WdiServiceHost - ok
20:07:34.0037 5304 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll
20:07:34.0052 5304 WdiSystemHost - ok
20:07:34.0057 5304 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll
20:07:34.0077 5304 WebClient - ok
20:07:34.0083 5304 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll
20:07:34.0114 5304 Wecsvc - ok
20:07:34.0118 5304 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll
20:07:34.0148 5304 wercplsupport - ok
20:07:34.0153 5304 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll
20:07:34.0182 5304 WerSvc - ok
20:07:34.0186 5304 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
20:07:34.0213 5304 WfpLwf - ok
20:07:34.0217 5304 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys
20:07:34.0226 5304 WIMMount - ok
20:07:34.0228 5304 WinDefend - ok
20:07:34.0231 5304 WinHttpAutoProxySvc - ok
20:07:34.0243 5304 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
20:07:34.0276 5304 Winmgmt - ok
20:07:34.0301 5304 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll
20:07:34.0357 5304 WinRM - ok
20:07:34.0373 5304 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll
20:07:34.0402 5304 Wlansvc - ok
20:07:34.0406 5304 [ 06C8FA1CF39DE6A735B54D906BA791C6 ] wlcrasvc C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
20:07:34.0414 5304 wlcrasvc - ok
20:07:34.0441 5304 [ 2BACD71123F42CEA603F4E205E1AE337 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
20:07:34.0477 5304 wlidsvc - ok
20:07:34.0481 5304 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
20:07:34.0492 5304 WmiAcpi - ok
20:07:34.0498 5304 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
20:07:34.0512 5304 wmiApSrv - ok
20:07:34.0514 5304 WMPNetworkSvc - ok
20:07:34.0518 5304 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll
20:07:34.0531 5304 WPCSvc - ok
20:07:34.0534 5304 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
20:07:34.0557 5304 WPDBusEnum - ok
20:07:34.0561 5304 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
20:07:34.0587 5304 ws2ifsl - ok
20:07:34.0592 5304 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\System32\wscsvc.dll
20:07:34.0608 5304 wscsvc - ok
20:07:34.0611 5304 WSearch - ok
20:07:34.0641 5304 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll
20:07:34.0691 5304 wuauserv - ok
20:07:34.0696 5304 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
20:07:34.0708 5304 WudfPf - ok
20:07:34.0713 5304 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
20:07:34.0724 5304 WUDFRd - ok
20:07:34.0728 5304 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
20:07:34.0742 5304 wudfsvc - ok
20:07:34.0748 5304 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll
20:07:34.0767 5304 WwanSvc - ok
20:07:34.0773 5304 ================ Scan global ===============================
20:07:34.0776 5304 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
20:07:34.0781 5304 [ 9E479C2B605C25DA4971ABA36250FAEF ] C:\Windows\system32\winsrv.dll
20:07:34.0788 5304 [ 9E479C2B605C25DA4971ABA36250FAEF ] C:\Windows\system32\winsrv.dll
20:07:34.0793 5304 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
20:07:34.0799 5304 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
20:07:34.0804 5304 [Global] - ok
20:07:34.0804 5304 ================ Scan MBR ==================================
20:07:34.0806 5304 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
20:07:34.0919 5304 \Device\Harddisk0\DR0 - ok
20:07:34.0949 5304 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
20:07:35.0072 5304 \Device\Harddisk1\DR1 - ok
20:07:35.0073 5304 ================ Scan VBR ==================================
20:07:35.0078 5304 [ 24F0CDAE0BCC5760DB002194D08F0FCB ] \Device\Harddisk0\DR0\Partition1
20:07:35.0082 5304 \Device\Harddisk0\DR0\Partition1 - ok
20:07:35.0087 5304 [ EF2737CE4DF06E01DEA019A997F488A6 ] \Device\Harddisk0\DR0\Partition2
20:07:35.0091 5304 \Device\Harddisk0\DR0\Partition2 - ok
20:07:35.0096 5304 [ 5DBBB02D0565FF60B0CB9A237B642BC1 ] \Device\Harddisk1\DR1\Partition1
20:07:35.0098 5304 \Device\Harddisk1\DR1\Partition1 - ok
20:07:35.0099 5304 ============================================================
20:07:35.0099 5304 Scan finished
20:07:35.0099 5304 ============================================================
20:07:35.0109 1248 Detected object count: 1
20:07:35.0109 1248 Actual detected object count: 1
20:07:52.0038 1248 MEMSWEEP2 ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:52.0040 1248 MEMSWEEP2 ( UnsignedFile.Multi.Generic ) - User select action: Skip

öffne c:
tdsskiller-datum-version.txt
Inhalt posten, danke

Hi,
combofix:

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

b

Dauert ja lange :D bin gerade bei Fertiggestellt stufe _7

bitte unterlasse solche Zwischenposts, lass die Programme einfach fertig laufen, oder poste bei Problemen, danke.

Combofix Logfile:

Code:

ComboFix 13-01-08.01 - Bouillon 09.01.2013  21:51:18.1.8 - x64

ausgeführt von:: c:\users\Bouillon\Desktop\ComboFix.exe

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\wininit.ini

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-12-09 bis 2013-01-09  ))))))))))))))))))))))))))))))

.

.

2013-01-09 23:39 . 2013-01-09 23:39        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-01-09 19:06 . 2013-01-09 19:06        208216        ----a-w-        c:\windows\system32\drivers\38983325.sys

2013-01-09 17:27 . 2009-06-18 11:54        6144        ------w-        c:\windows\system32\5FF0.tmp

2013-01-09 17:26 . 2009-06-18 11:54        6144        ------w-        c:\windows\system32\35B4.tmp

2013-01-09 17:26 . 2013-01-09 17:57        --------        d-----w-        c:\program files (x86)\Sophos

2013-01-09 17:17 . 2013-01-09 17:17        --------        d-----w-        c:\users\Bouillon\AppData\Roaming\Malwarebytes

2013-01-09 17:17 . 2013-01-09 17:17        --------        d-----w-        c:\programdata\Malwarebytes

2013-01-09 17:17 . 2013-01-09 17:17        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2013-01-09 17:17 . 2012-12-14 15:49        24176        ----a-w-        c:\windows\system32\drivers\mbam.sys

2013-01-09 17:17 . 2013-01-09 17:17        --------        d-----w-        c:\users\Bouillon\AppData\Local\Programs

2013-01-09 16:06 . 2013-01-09 16:22        --------        d-----w-        c:\users\Bouillon\AppData\Roaming\TS3Client

2013-01-09 16:06 . 2013-01-09 16:06        --------        d-----w-        c:\program files\TeamSpeak 3 Client

2013-01-09 15:58 . 2013-01-09 15:58        --------        d-----w-        c:\program files\Microsoft Silverlight

2013-01-09 15:58 . 2013-01-09 15:58        --------        d-----w-        c:\program files (x86)\Microsoft Silverlight

2013-01-09 05:33 . 2013-01-09 05:33        --------        d-----w-        c:\program files (x86)\Common Files\Skype

2013-01-09 05:33 . 2013-01-09 05:33        --------        d-----r-        c:\program files (x86)\Skype

2013-01-09 04:27 . 2013-01-09 04:27        16504        ----a-w-        c:\windows\system32\drivers\GdPhyMem.sys

2013-01-09 04:16 . 2012-11-23 03:13        68608        ----a-w-        c:\windows\system32\taskhost.exe

2013-01-09 04:16 . 2012-11-23 03:26        3149824        ----a-w-        c:\windows\system32\win32k.sys

2013-01-09 04:16 . 2013-01-09 04:16        106648        ----a-w-        c:\windows\system32\drivers\GRD.sys

2013-01-09 04:01 . 2013-01-09 04:01        --------        d-----w-        c:\program files\Common Files\DESIGNER

2013-01-09 03:58 . 2013-01-09 03:58        --------        d-----w-        c:\program files\Microsoft Analysis Services

2013-01-09 03:58 . 2013-01-09 03:58        --------        d-----w-        c:\program files (x86)\Microsoft Analysis Services

2013-01-09 03:58 . 2013-01-09 03:58        --------        d-----w-        c:\users\Bouillon\AppData\Local\Microsoft Help

2013-01-09 03:58 . 2013-01-09 05:37        --------        d-----w-        c:\programdata\Microsoft Help

2013-01-09 03:58 . 2013-01-09 04:01        --------        d-----w-        c:\program files\Microsoft Office

2013-01-09 03:58 . 2013-01-09 03:58        --------        d-----r-        C:\MSOCache

2013-01-09 03:33 . 2013-01-09 03:33        --------        d-----w-        c:\users\Bouillon\AppData\Local\MicrosoftStore

2013-01-08 12:43 . 2012-11-19 00:01        9125352        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{DA8A6CEA-87C5-4DDA-8AA3-1BF7A04CD06D}\mpengine.dll

2013-01-06 19:57 . 2013-01-09 12:48        940409        ----a-w-        c:\windows\SysWow64\sig.bin

2013-01-06 16:57 . 2012-05-29 07:24        10792        ----a-w-        c:\windows\SysWow64\GdScrSv.de.dll

2013-01-06 16:49 . 2013-01-06 16:57        60320        ----a-w-        c:\windows\system32\drivers\PktIcpt.sys

2013-01-06 16:49 . 2012-08-10 04:21        51224        ----a-w-        c:\program files (x86)\Mozilla Firefox\extensions\{906305f7-aafc-45e9-8bbd-941950a84dad}\Components\BanksafeXPCOM.dll

2013-01-06 16:49 . 2013-01-06 16:57        64416        ----a-w-        c:\windows\system32\drivers\gdwfpcd64.sys

2013-01-06 16:49 . 2013-01-06 16:57        54176        ----a-w-        c:\windows\system32\drivers\GDBehave.sys

2013-01-06 16:49 . 2013-01-06 16:57        126880        ----a-w-        c:\windows\system32\drivers\MiniIcpt.sys

2013-01-06 16:49 . 2013-01-06 16:49        64376        ----a-w-        c:\windows\system32\drivers\HookCentre.sys

2013-01-06 16:49 . 2013-01-06 16:57        --------        d-----w-        c:\program files (x86)\Common Files\G Data

2013-01-06 16:49 . 2013-01-06 16:56        --------        d-----w-        c:\programdata\G DATA

2013-01-06 16:49 . 2013-01-06 16:49        --------        d-----w-        c:\program files (x86)\G Data

2013-01-06 16:44 . 2013-01-06 16:44        --------        d-----w-        c:\users\Bouillon\AppData\Local\Downloaded Installations

2013-01-05 18:52 . 2013-01-05 18:53        --------        d-----w-        c:\program files (x86)\Euro Truck Simulator 2

2013-01-04 20:51 . 2013-01-04 20:51        --------        d-----w-        c:\programdata\WoW Worldwide Software LTD

2013-01-04 20:51 . 2013-01-04 20:51        --------        d-----w-        c:\users\Bouillon\AppData\Roaming\SendSpace

2013-01-04 20:51 . 2013-01-09 04:20        --------        d-----w-        c:\users\Bouillon\AppData\Local\SwvUpdater

2013-01-04 20:49 . 2013-01-06 15:01        --------        d-----w-        c:\programdata\InstallMate

2013-01-04 05:40 . 2013-01-04 05:40        --------        d-----w-        c:\program files (x86)\Cheat Engine 6.2

2013-01-01 23:52 . 2013-01-01 23:52        --------        d-----w-        c:\windows\SysWow64\xlive

2013-01-01 23:52 . 2013-01-01 23:52        --------        d-----w-        c:\program files (x86)\Microsoft Games for Windows - LIVE

2013-01-01 22:51 . 2013-01-09 20:46        --------        d-----w-        c:\program files (x86)\Steam

2012-12-31 17:39 . 2012-12-31 17:39        --------        d-----w-        c:\program files (x86)\SystemRequirementsLab

2012-12-31 17:39 . 2012-12-31 17:39        --------        d-----w-        c:\users\Bouillon\SystemRequirementsLab

2012-12-30 18:51 . 2013-01-01 23:11        --------        d-----w-        c:\program files (x86)\Common Files\Steam

2012-12-24 00:59 . 2012-12-24 00:59        --------        d-----w-        C:\AMD

2012-12-24 00:49 . 2012-12-24 00:49        --------        d-----w-        c:\users\Bouillon\AppData\Roaming\ATI

2012-12-24 00:49 . 2012-12-24 00:49        --------        d-----w-        c:\users\Bouillon\AppData\Local\ATI

2012-12-24 00:49 . 2012-12-24 00:49        --------        d-----w-        c:\programdata\ATI

2012-12-22 02:00 . 2012-12-16 17:11        46080        ----a-w-        c:\windows\system32\atmlib.dll

2012-12-22 02:00 . 2012-12-16 14:13        34304        ----a-w-        c:\windows\SysWow64\atmlib.dll

2012-12-22 02:00 . 2012-12-16 14:45        367616        ----a-w-        c:\windows\system32\atmfd.dll

2012-12-22 02:00 . 2012-12-16 14:13        295424        ----a-w-        c:\windows\SysWow64\atmfd.dll

2012-12-21 22:33 . 2012-12-21 22:33        --------        d-----w-        c:\program files (x86)\EA Games

2012-12-20 23:32 . 2012-12-20 23:32        --------        d-----w-        c:\users\Bouillon\AppData\Local\Windows Live Writer

2012-12-20 23:32 . 2012-12-20 23:32        --------        d-----w-        c:\users\Bouillon\AppData\Roaming\Windows Live Writer

2012-12-20 01:52 . 2012-12-20 01:52        --------        d-----w-        c:\users\Bouillon\.thumbnails

2012-12-20 01:51 . 2012-12-20 01:51        --------        d-----w-        c:\users\Bouillon\AppData\Local\fontconfig

2012-12-20 01:51 . 2012-12-20 01:59        --------        d-----w-        c:\users\Bouillon\.gimp-2.8

2012-12-20 01:51 . 2012-12-20 01:51        --------        d-----w-        c:\users\Bouillon\AppData\Local\gegl-0.2

2012-12-18 13:20 . 2012-12-18 13:20        --------        d-----w-        c:\programdata\Hewlett-Packard

2012-12-18 13:20 . 2009-07-14 01:41        230400        ----a-w-        c:\windows\system32\Spool\prtprocs\x64\hpzppw71.dll

2012-12-17 15:57 . 2012-12-23 20:32        --------        d-----w-        c:\program files (x86)\Origin Games

2012-12-17 15:57 . 2012-12-18 15:11        --------        d-----w-        c:\users\Bouillon\AppData\Roaming\Origin

2012-12-17 15:57 . 2012-12-17 15:57        --------        d-----w-        c:\users\Bouillon\AppData\Local\Origin

2012-12-17 15:56 . 2012-12-17 16:38        --------        d-----w-        c:\programdata\Origin

2012-12-17 15:56 . 2012-12-17 15:57        --------        d-----w-        c:\program files (x86)\Origin

2012-12-15 18:35 . 2012-12-15 18:35        --------        d-----w-        c:\users\Bouillon\AppData\Roaming\OpenOffice.org

2012-12-15 18:34 . 2012-12-15 18:34        --------        d-----w-        c:\program files (x86)\OpenOffice.org 3

2012-12-12 14:23 . 2012-11-09 05:45        2048        ----a-w-        c:\windows\system32\tzres.dll

2012-12-12 14:23 . 2012-11-09 04:42        2048        ----a-w-        c:\windows\SysWow64\tzres.dll

2012-12-12 14:22 . 2012-11-02 05:59        478208        ----a-w-        c:\windows\system32\dpnet.dll

2012-12-12 14:22 . 2012-11-02 05:11        376832        ----a-w-        c:\windows\SysWow64\dpnet.dll

2012-12-11 19:44 . 2012-12-11 19:44        --------        d-----w-        c:\windows\Sun

2012-12-11 19:41 . 2012-12-11 19:41        --------        d-----w-        c:\users\Bouillon\AppData\Roaming\PowerCinema

2012-12-11 19:39 . 2012-12-11 19:39        --------        d-----w-        c:\users\Bouillon\AppData\Local\Broadcom

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-01-09 04:19 . 2012-11-07 16:07        697864        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-01-09 04:19 . 2011-10-20 09:22        74248        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-11-30 04:45 . 2013-01-09 04:17        44032        ----a-w-        c:\windows\apppatch\acwow64.dll

2012-11-08 00:07 . 2012-11-08 00:07        2560        ----a-w-        c:\windows\SysWow64\drivers\de-DE\qwavedrv.sys.mui

2012-11-08 00:07 . 2012-11-08 00:07        5632        ----a-w-        c:\windows\SysWow64\drivers\de-DE\ndiscap.sys.mui

2012-11-08 00:07 . 2012-11-08 00:07        2560        ----a-w-        c:\windows\SysWow64\drivers\de-DE\scfilter.sys.mui

2012-11-08 00:07 . 2012-11-08 00:07        51712        ----a-w-        c:\windows\SysWow64\drivers\de-DE\tcpip.sys.mui

2012-11-08 00:07 . 2012-11-08 00:07        29696        ----a-w-        c:\windows\SysWow64\drivers\de-DE\bfe.dll.mui

2012-11-08 00:07 . 2012-11-08 00:07        16896        ----a-w-        c:\windows\SysWow64\drivers\de-DE\pacer.sys.mui

2012-11-07 20:52 . 2012-11-07 20:52        108008        ----a-w-        c:\windows\system32\WindowsAccessBridge-64.dll

2012-11-07 20:52 . 2012-11-07 20:52        916456        ----a-w-        c:\windows\system32\deployJava1.dll

2012-11-07 20:52 . 2012-11-07 20:52        289768        ----a-w-        c:\windows\system32\javaws.exe

2012-11-07 20:52 . 2012-11-07 20:52        1034216        ----a-w-        c:\windows\system32\npDeployJava1.dll

2012-11-07 20:52 . 2012-11-07 20:52        189416        ----a-w-        c:\windows\system32\javaw.exe

2012-11-07 20:52 . 2012-11-07 20:52        188904        ----a-w-        c:\windows\system32\java.exe

2012-11-07 20:49 . 2012-11-07 20:49        95208        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll

2012-11-07 20:49 . 2012-11-07 20:49        821736        ----a-w-        c:\windows\SysWow64\npDeployJava1.dll

2012-11-07 20:49 . 2012-11-07 20:49        746984        ----a-w-        c:\windows\SysWow64\deployJava1.dll

2012-11-07 15:31 . 2012-11-07 15:31        62776        ----a-w-        c:\windows\system32\drivers\mwlPSDVDisk.sys

2012-11-07 15:31 . 2012-11-07 15:31        22648        ----a-w-        c:\windows\system32\drivers\mwlPSDFilter.sys

2012-11-07 15:31 . 2012-11-07 15:31        20520        ----a-w-        c:\windows\system32\drivers\mwlPSDNserv.sys

2012-10-31 14:10 . 2012-10-31 14:10        829264        ----a-w-        c:\windows\system32\msvcr100.dll

2012-10-31 14:10 . 2012-10-31 14:10        773968        ----a-w-        c:\windows\SysWow64\msvcr100.dll

2012-10-31 14:10 . 2012-10-31 14:10        421200        ----a-w-        c:\windows\SysWow64\msvcp100.dll

2012-10-31 14:10 . 2012-10-31 14:10        158536        ----a-w-        c:\windows\system32\atl100.dll

2012-10-31 14:10 . 2012-10-31 14:10        138056        ----a-w-        c:\windows\SysWow64\atl100.dll

2012-10-16 08:38 . 2012-11-28 11:28        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2012-10-16 08:38 . 2012-11-28 11:28        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll

2012-10-16 07:39 . 2012-11-28 11:28        561664        ----a-w-        c:\windows\apppatch\AcLayers.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-07-13 17418928]

"Spotify Web Helper"="c:\users\Bouillon\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-12-19 1104424]

"Spotify"="c:\users\Bouillon\AppData\Roaming\Spotify\Spotify.exe" [2012-12-19 4485160]

"Steam"="c:\program files (x86)\Steam\Steam.exe" [2013-01-01 1354736]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]

"BackupManagerTray"="c:\program files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" [2011-04-24 297280]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-02-08 336384]

"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2011-07-01 1103440]

"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]

"Dolby Advanced Audio v2"="c:\dolby pcee4\pcee4.exe" [2011-06-01 506712]

"SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2011-09-20 341360]

"ArcadeMovieService"="c:\program files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe" [2011-08-26 177448]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-23 926896]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

"G Data AntiVirus Tray Application"="c:\program files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe" [2012-09-17 995352]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"IsMyWinLockerReboot"="msiexec.exe" [2010-11-21 73216]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Notification Packages        REG_MULTI_SZ           scecli c:\program files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

R2 CLKMSVC10_34E30CCC;CyberLink Product - 2012/11/07 16:36;c:\program files (x86)\Acer\clear.fi\Movie\NavFilter\kmsvc.exe [2011-05-06 245744]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 Mobile Partner. RunOuc;Mobile Partner. OUC;c:\program files (x86)\Mobile Partner\UpdateDog\ouc.exe [2013-01-06 246112]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-06-07 191752]

R3 btwampfl;btwampfl Bluetooth filter driver;c:\windows\system32\drivers\btwampfl.sys [2011-08-30 620072]

R3 BTWDPAN;Bluetooth Personal Area Network;c:\windows\system32\DRIVERS\btwdpan.sys [2011-08-30 89640]

R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2011-08-30 39976]

R3 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2011-06-21 173424]

R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [2013-01-06 117248]

R3 ewusbmbb;HUAWEI USB-WWAN miniport;c:\windows\system32\DRIVERS\ewusbwwan.sys [2013-01-06 421376]

R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\5FF0.tmp [2009-06-18 6144]

R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [2010-07-20 247400]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

S0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys [2013-01-06 54176]

S1 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys [2013-01-06 126880]

S1 gdwfpcd;G Data WFP CD;c:\windows\system32\drivers\gdwfpcd64.sys [2013-01-06 64416]

S1 GRD;G Data Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys [2013-01-09 106648]

S1 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys [2013-01-06 64376]

S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2012-11-07 22648]

S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2012-11-07 20520]

S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2012-11-07 62776]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-02-08 203776]

S2 AVKProxy;G Data AntiVirus Proxy;c:\program files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2012-08-23 1542680]

S2 AVKService;G Data Scheduler;c:\program files (x86)\G Data\AntiVirus\AVK\AVKService.exe [2012-01-27 468472]

S2 AVKWCtl;G Data Dateisystem Wächter;c:\program files (x86)\G Data\AntiVirus\AVK\AVKWCtlX64.exe [2012-08-30 2011568]

S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-05-12 249648]

S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2011-07-01 353360]

S2 ePowerSvc;ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2011-08-02 872552]

S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2011-05-30 36456]

S2 HWDeviceService64.exe;HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe [2011-03-14 346976]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-01-13 13336]

S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2011-04-22 244624]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 398184]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344]

S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]

S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [2011-04-24 256832]

S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2010-11-29 16120]

S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-02-01 2656280]

S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2010-11-16 115216]

S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2010-11-12 138024]

S3 GDPkIcpt;GDPkIcpt;c:\windows\system32\drivers\PktIcpt.sys [2013-01-06 60320]

S3 GDScan;G Data Scanner;c:\program files (x86)\Common Files\G Data\GDScan\GDScan.exe [2012-03-29 470008]

S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [2013-01-06 86016]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2010-09-27 76912]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2011-02-10 82432]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2011-02-10 181760]

S3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-11-29 149504]

S3 USBPNPA;USB PnP Sound Device Interface;c:\windows\system32\drivers\CM10864.sys [2009-11-18 1308160]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*Deregistered* - CLKMDRV10_34E30CCC

.

Inhalt des "geplante Tasks" Ordners

.

2013-01-09 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-07 04:19]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-08-16 12673128]

"RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-08-16 2277480]

"Power Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2011-08-02 1831016]

"Cm108Sound"="c:\windows\Syswow64\cm108.dll" [2009-12-08 8146944]

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://searchab.com/?aff=7&uid=5ddebcc7-5a13-11e2-a839-dc0ea117d874

uLocal Page = c:\windows\system32\blank.htm

mDefault_Page_URL = hxxp://acer.msn.com

mStart Page = hxxp://searchab.com/?aff=7&uid=5ddebcc7-5a13-11e2-a839-dc0ea117d874

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105

IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000

TCP: DhcpNameServer = 83.169.186.161 192.168.0.1

TCP: Interfaces\{30CFDE73-B513-4E80-8C05-70698A5519AF}: NameServer = 193.189.244.225 193.189.244.206

FF - ProfilePath - c:\users\Bouillon\AppData\Roaming\Mozilla\Firefox\Profiles\h4cgt85a.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://searchab.com/?aff=7&uid=5ddebcc7-5a13-11e2-a839-dc0ea117d874

FF - prefs.js: keyword.URL - hxxp://searchab.com/?aff=7&uid=5ddebcc7-5a13-11e2-a839-dc0ea117d874&q=

FF - prefs.js: network.proxy.http - 5.39.119.105

FF - prefs.js: network.proxy.http_port - 8080

FF - prefs.js: network.proxy.type - 0

FF - ExtSQL: 2012-12-21 23:33; battlefieldheroespatcher@ea.com; c:\users\Bouillon\AppData\Roaming\Mozilla\Firefox\Profiles\h4cgt85a.default\extensions\battlefieldheroespatcher@ea.com

FF - ExtSQL: 2013-01-05 01:27; ich@maltegoetz.de; c:\users\Bouillon\AppData\Roaming\Mozilla\Firefox\Profiles\h4cgt85a.default\extensions\ich@maltegoetz.de

FF - ExtSQL: 2013-01-05 06:08; admin@proxy-listen.de; c:\users\Bouillon\AppData\Roaming\Mozilla\Firefox\Profiles\h4cgt85a.default\extensions\admin@proxy-listen.de.xpi

FF - ExtSQL: 2013-01-06 17:49; {906305f7-aafc-45e9-8bbd-941950a84dad}; c:\program files (x86)\Mozilla Firefox\extensions\{906305f7-aafc-45e9-8bbd-941950a84dad}

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

Toolbar-Locked - (no file)

HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe

.

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MEMSWEEP2]

"ImagePath"="\??\c:\windows\system32\5FF0.tmp"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-01-10  00:43:49

ComboFix-quarantined-files.txt  2013-01-09 23:43

.

Vor Suchlauf: 8 Verzeichnis(se), 24.075.812.864 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 24.773.459.968 Bytes frei

.

- - End Of File - - 25714A067790270DCD2C0D5E69C4578D

--- --- ---

Hi,
lade den CCleaner standard:
CCleaner - Download - Filepony
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Acer Backup Manager NTI Corporation 20.10.2011 336MB 3.0.0.99 NOTWENGIG
Acer Crystal Eye Webcam CyberLink Corp. 07.11.2012 33,7MB 1.0.1904 NOTWENGIG
Acer ePower Management Acer Incorporated 07.11.2012 6.00.3008 NOTWENGIG
Acer eRecovery Management Acer Incorporated 20.10.2011 5.00.3504 NOTWENGIG
Acer Games WildTangent 20.10.2011 1.0.2.5
Acer Registration Acer Incorporated 07.11.2012 1.04.3504 NOTWENGIG
Acer ScreenSaver Acer Incorporated 07.11.2012 1.1.0913.2011 NOTWENGIG
Acer Updater Acer Incorporated 20.10.2011 1.02.3500 NOTWENGIG
Adobe AIR Adobe Systems Incorporated 20.10.2011 2.7.1.19610 NOTWENGIG
Adobe Flash Player 11 ActiveX Adobe Systems Incorporated 09.01.2013 6,00MB 11.5.502.146 NOTWENGIG
Adobe Flash Player 11 Plugin Adobe Systems Incorporated 09.01.2013 6,00MB 11.5.502.146 NOTWENGIG
Adobe Reader XI - Deutsch Adobe Systems Incorporated 07.11.2012 128MB 11.0.00 NOTWENGIG
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver Atheros Communications Inc. 20.10.2011 1.0.0.36 NOTWENGIG
ATI Catalyst Install Manager ATI Technologies, Inc. 07.11.2012 22,4MB 3.0.812.0 NOTWENGIG
Battlefield 1942™ Electronic Arts 23.12.2012 1,21GB 1.6.20.0 NOTWENGIG
Bing Bar Microsoft Corporation 07.11.2012 27,0MB 7.0.765.0 UNNÖTIG
CCleaner Piriform 19.12.2012 3.26 NOTWENGIG
Cheat Engine 6.2 Dark Byte 04.01.2013 27,0MB NOTWENGIG
clear.fi CyberLink Corp. 07.11.2012 167MB 1.0.2024.00 NOTWENGIG
clear.fi Client Acer Incorporated 07.11.2012 1.00.3500 NOTWENGIG
Dolby Advanced Audio v2 Dolby Laboratories Inc 07.11.2012 12,9MB 7.2.7000.7 NOTWENGIG
eBay Worldwide OEM 07.11.2012 100KB 2.2.0409 UNNÖTIG
ETDWare PS/2-X64 8.0.6.0_WHQL ELAN Microelectronic Corp. 07.11.2012 8.0.6.0 NOTWENGIG
Euro Truck Simulator 2 SCS Software 05.01.2013 1,70GB 1.2.5 NOTWENGIG
Evernote v. 4.5.1 Evernote Corp. 20.10.2011 151MB 4.5.1.5451 UNBEKANNT
Fooz Kids FUHU, Inc. 20.10.2011 3.0.8 UNBEKANNT
Fooz Kids Platform FUHU, Inc. 20.10.2011 2.1 UNBEKANNT
FUSSBALL MANAGER 13 Electronic Arts 20.12.2012 6,41GB 1.0.2.0 NOTWENGIG
G Data AntiVirus 2013 G Data Software AG 06.01.2013 68,1MB 23.0.0.0 NOTWENGIG
Identity Card Acer Incorporated 07.11.2012 1.00.3501 NOTWENGIG
IL Shared Libraries Image-Line 03.12.2012 UNBEKANNT
Intel(R) Management Engine Components Intel Corporation 06.01.2013 7.0.0.1144 NOTWENGIG
Intel(R) Rapid Storage Technology Intel Corporation 06.01.2013 10.1.2.1004 NOTWENGIG
Java 7 Update 9 Oracle 07.11.2012 128MB 7.0.90
Java 7 Update 9 (64-bit) Oracle 07.11.2012 127MB 7.0.90 NOTWENGIG
Launch Manager Acer Inc. 07.11.2012 5.1.7 NOTWENGIG
Malwarebytes Anti-Malware Version 1.70.0.1100 Malwarebytes Corporation 09.01.2013 18,4MB 1.70.0.1100 NOTWENGIG
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 09.11.2012 38,8MB 4.0.30319 UNBEKANNT
Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Corporation 09.11.2012 2,93MB 4.0.30319 UNBEKANNT
Microsoft Flight 02.01.2013 NOTWENGIG
Microsoft Games for Windows - LIVE Redistributable Microsoft Corporation 02.01.2013 31,3MB 3.5.92.0 NOTWENGIG
Microsoft Games for Windows Marketplace Microsoft Corporation 02.01.2013 6,03MB 3.5.50.0 NOTWENGIG
Microsoft Office 2010 Microsoft Corporation 07.11.2012 6,31MB 14.0.4763.1000
Microsoft Office Professional 2010 Microsoft Corporation 09.01.2013 14.0.6029.1000
Microsoft Silverlight Microsoft Corporation 09.01.2013 50,6MB 5.1.10411.0 UNBEKANNT
Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Corporation 20.10.2011 1,69MB 3.1.0000 UNBEKANNT
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 09.01.2013 300KB 8.0.61001 NOTWENGIG
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Corporation 09.01.2013 252KB 9.0.30729 NOTWENGIG
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 15.12.2012 788KB 9.0.30729.6161 NOTWENGIG
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 20.10.2011 240KB 9.0.30729 NOTWENGIG
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 20.10.2011 596KB 9.0.30729.4148 NOTWENGIG
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 15.12.2012 600KB 9.0.30729.6161 NOTWENGIG
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 Microsoft Corporation 07.11.2012 13,6MB 10.0.30319 NOTWENGIG
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 09.01.2013 13,7MB 10.0.40219 NOTWENGIG
Mobile Partner Huawei Technologies Co.,Ltd 06.01.2013 21.005.15.00.705 NOTWENGIG
Mozilla Firefox 17.0.1 (x86 de) Mozilla 06.12.2012 41,1MB 17.0.1 NOTWENGIG
Mozilla Maintenance Service Mozilla 06.12.2012 329KB 17.0.1 UNBEKANNT
MyWinLocker Suite Egis Technology Inc. 07.11.2012 2,63MB 4.0.14.19 UNBEKANNT
newsXpresso esobi Inc. 20.10.2011 7,34MB 1.0.0.40 UNBEKANNT
Norton Online Backup Symantec Corporation 20.10.2011 6,19MB 2.1.17869 NOTWENGIG
NTI Media Maker 9 NTI Corporation 07.11.2012 0,96GB 9.0.2.9002 NOTWENGIG
OpenOffice.org 3.4.1 Apache Software Foundation 15.12.2012 331MB 3.41.9593 NOTWENGIG
Origin Electronic Arts, Inc. 17.12.2012 9.0.11.77 NOTWENGIG
RAPTOR-GAMING H3 7.1 USB 17.11.2012 NOTWENGIG
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 07.11.2012 6.0.1.6438 NOTWENGIG
Realtek USB 2.0 Card Reader Realtek Semiconductor Corp. 20.10.2011 6.1.7600.30123 NOTWENGIG
Renesas Electronics USB 3.0 Host Controller Driver Renesas Electronics Corporation 07.11.2012 1,01MB 2.0.34.0 NOTWENGIG
Shared C Run-time for x64 McAfee 16.11.2012 2,78MB 10.0.0 UNNÖTIG
Skype™ 5.10 Skype Technologies S.A. 09.01.2013 19,4MB 5.10.116 NOTWENGIG
Spotify Spotify AB 19.12.2012 0.8.8.295.g628348ad NOTWENGIG
Steam Valve Corporation 01.01.2013 35,4MB 1.0.0.0 NOTWENGIG
System Requirements Lab CYRI Husdawg, LLC 31.12.2012 579KB 5.0.6.0 UNBEKANNT
TeamSpeak 3 Client TeamSpeak Systems GmbH 09.01.2013 3.0.6 NOTWENGIG
VirtualDJ Home FREE Atomix Productions 17.11.2012 53,5MB 7.3 NOTWENGIG
Welcome Center Acer Incorporated 07.11.2012 1.02.3504 NOTWENGIG
WIDCOMM Bluetooth Software Broadcom Corporation 07.11.2012 234MB 6.5.0.2200 NOTWENGIG
Windows Live Essentials Microsoft Corporation 20.10.2011 15.4.3538.0513 NOTWENGIG
WinRAR 4.20 (64-Bit) win.rar GmbH 09.11.2012 4.20.0 NOTWENGIG
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 Intel 07.11.2012 13,2MB 2.1.23.0 NOTWENGIG

deinstaliere:
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden, instalieren.
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen

bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
Bing
eBay
Evernote
Java : alle
downloade Java jre:
Java-Downloads für alle Betriebssysteme
klicke:
Download der Java-Software für Windows Offline
laden, und instalieren
deinstaliere:
newsXpresso
Shared

Öffne CCleaner, analysieren, starten, PC neustarten.
Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Suche.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste
mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

# AdwCleaner v2.105 - Datei am 10/01/2013 um 17:43:43 erstellt
# Aktualisiert am 08/01/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Bouillon - BOUILLON-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Bouillon\Desktop\adwcleaner.exe
# Option [Suche]

**** [Dienste] ****

***** [Dateien / Ordner] *****

Datei Gefunden : C:\END
Datei Gefunden : C:\Users\Bouillon\AppData\Roaming\Mozilla\Firefox\Profiles\h4cgt85a.default\searchplugins\Searchab.xml
Ordner Gefunden : C:\ProgramData\InstallMate
Ordner Gefunden : C:\Users\Bouillon\AppData\Local\Software
Ordner Gefunden : C:\Users\Bouillon\AppData\Local\SwvUpdater
Ordner Gefunden : C:\Users\Bouillon\AppData\Roaming\Mozilla\Firefox\Profiles\h4cgt85a.default\Smartbar

***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gefunden : HKCU\Software\StartSearch

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v17.0.1 (de)

Datei : C:\Users\Bouillon\AppData\Roaming\Mozilla\Firefox\Profiles\h4cgt85a.default\prefs.js

Gefunden : user_pref("CT3272810.1000082.isDisplayHidden", "true");
Gefunden : user_pref("CT3272810.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description[...]
Gefunden : user_pref("CT3272810.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Gefunden : user_pref("CT3272810.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]
Gefunden : user_pref("CT3272810.FirstTime", "true");
Gefunden : user_pref("CT3272810.FirstTimeFF3", "true");
Gefunden : user_pref("CT3272810.InstallDate", "4/1/2013 21:50:39");
Gefunden : user_pref("CT3272810.LoginRevertSettingsEnabled", true);
Gefunden : user_pref("CT3272810.RevertSettingsEnabled", true);
Gefunden : user_pref("CT3272810.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT327[...]
Gefunden : user_pref("CT3272810.UserID", "UN51068977830165037");
Gefunden : user_pref("CT3272810.addressBarTakeOverEnabledInHidden", "true");
Gefunden : user_pref("CT3272810.autoDisableScopes", -1);
Gefunden : user_pref("CT3272810.browser.search.defaultthis.engineName", true);
Gefunden : user_pref("CT3272810.cb_user_id_000.enc", "Q0I2MjIxNDk3MjYyNTFfMTM1NzMzMjY1MzI4MV9GaXJlZm94");
Gefunden : user_pref("CT3272810.cbfirsttime.enc", "RnJpIEphbiAwNCAyMDEzIDIxOjUwOjUxIEdNVCswMTAw");
Gefunden : user_pref("CT3272810.defaultSearch", "true");
Gefunden : user_pref("CT3272810.embeddedsData", "[{\"appId\":\"130004960265293823\",\"apiPermissions\":{\"cross[...]
Gefunden : user_pref("CT3272810.enableAlerts", "always");
Gefunden : user_pref("CT3272810.enableSearchFromAddressBar", "true");
Gefunden : user_pref("CT3272810.firstTimeDialogOpened", "true");
Gefunden : user_pref("CT3272810.fixPageNotFoundError", "true");
Gefunden : user_pref("CT3272810.fixPageNotFoundErrorInHidden", "true");
Gefunden : user_pref("CT3272810.fixUrls", true);
Gefunden : user_pref("CT3272810.hxxp___api21_starwebnet_com.pid2.enc", "MWYzNGExM2JmYTlmOGYwZg==");
Gefunden : user_pref("CT3272810.hxxp___api32_starwebnet_com.pid2.enc", "MWYzNGExM2JmYTlmOGYwZg==");
Gefunden : user_pref("CT3272810.installId", "9818");
Gefunden : user_pref("CT3272810.installType", "conduitnsisintegration");
Gefunden : user_pref("CT3272810.isCheckedStartAsHidden", true);
Gefunden : user_pref("CT3272810.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Gefunden : user_pref("CT3272810.isFirstTimeToolbarLoading", "false");
Gefunden : user_pref("CT3272810.isNewTabEnabled", true);
Gefunden : user_pref("CT3272810.isPerformedSmartBarTransition", "true");
Gefunden : user_pref("CT3272810.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Gefunden : user_pref("CT3272810.keyword", true);
Gefunden : user_pref("CT3272810.mam_CouponBuddy_appState.enc", "b24=");
Gefunden : user_pref("CT3272810.mam_PriceGong_appState.enc", "b24=");
Gefunden : user_pref("CT3272810.mam_gk_appsData.enc", "eyJhcHBzIjpbeyJpZCI6IlByaWNlR29uZyIsInVybCI6Imh0dHA6Ly9z[...]
Gefunden : user_pref("CT3272810.mam_gk_configuration.enc", "eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6IlByaWNlR29uZyIsImN[...]
Gefunden : user_pref("CT3272810.mam_gk_first_time.enc", "MQ==");
Gefunden : user_pref("CT3272810.mam_gk_lastLoginTime.enc", "MTM1NzMzMjY0NzUxMg==");
Gefunden : user_pref("CT3272810.mam_gk_settings.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoy[...]
Gefunden : user_pref("CT3272810.mam_gk_userId.enc", "MTBjYWZhMjItYzA2Ni00ZmE1LWFmYjQtYTFmZDcyMDAyZDli");
Gefunden : user_pref("CT3272810.mam_gk_user_apps_selection.enc", "eyJQcmljZUdvbmciOnRydWUsIkNvdXBvbkJ1ZGR5Ijp0c[...]
Gefunden : user_pref("CT3272810.migrateAppsAndComponents", true);
Gefunden : user_pref("CT3272810.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"about[...]
Gefunden : user_pref("CT3272810.newSettings", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Gefunden : user_pref("CT3272810.openThankYouPage", "false");
Gefunden : user_pref("CT3272810.openUninstallPage", "false");
Gefunden : user_pref("CT3272810.price-gong.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\[...]
Gefunden : user_pref("CT3272810.revertSettingsEnabled", "false");
Gefunden : user_pref("CT3272810.search.searchAppId", "130004960265293823");
Gefunden : user_pref("CT3272810.search.searchCount", "0");
Gefunden : user_pref("CT3272810.searchInNewTabEnabledInHidden", "true");
Gefunden : user_pref("CT3272810.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Gefunden : user_pref("CT3272810.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]
Gefunden : user_pref("CT3272810.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]
Gefunden : user_pref("CT3272810.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]
Gefunden : user_pref("CT3272810.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]
Gefunden : user_pref("CT3272810.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]
Gefunden : user_pref("CT3272810.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]
Gefunden : user_pref("CT3272810.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1357332643274");
Gefunden : user_pref("CT3272810.serviceLayer_services_appsMetadata_lastUpdate", "1357332643032");
Gefunden : user_pref("CT3272810.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1357332643576");
Gefunden : user_pref("CT3272810.serviceLayer_services_login_10.13.40.15_lastUpdate", "1357332760967");
Gefunden : user_pref("CT3272810.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1357332643896");
Gefunden : user_pref("CT3272810.serviceLayer_services_searchAPI_lastUpdate", "1357332642769");
Gefunden : user_pref("CT3272810.serviceLayer_services_serviceMap_lastUpdate", "1357332642514");
Gefunden : user_pref("CT3272810.serviceLayer_services_toolbarContextMenu_lastUpdate", "1357332643869");
Gefunden : user_pref("CT3272810.serviceLayer_services_toolbarSettings_lastUpdate", "1357341725986");
Gefunden : user_pref("CT3272810.serviceLayer_services_translation_lastUpdate", "1357332643096");
Gefunden : user_pref("CT3272810.serviceLayer_services_userApps_lastUpdate", "1357332749643");
Gefunden : user_pref("CT3272810.settingsINI", true);
Gefunden : user_pref("CT3272810.shouldFirstTimeDialog", "false");
Gefunden : user_pref("CT3272810.smartbar.CTID", "CT3272810");
Gefunden : user_pref("CT3272810.smartbar.Uninstall", "0");
Gefunden : user_pref("CT3272810.smartbar.homepage", true);
Gefunden : user_pref("CT3272810.smartbar.isHidden", true);
Gefunden : user_pref("CT3272810.smartbar.toolbarName", "WhiteSmoke US New E1 ");
Gefunden : user_pref("CT3272810.startPage", "userChanged");
Gefunden : user_pref("CT3272810.toolbarBornServerTime", "4-1-2013");
Gefunden : user_pref("CT3272810.toolbarCurrentServerTime", "4-1-2013");
Gefunden : user_pref("CT3272810.toolbarDisabled", "true");
Gefunden : user_pref("CT3272810_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]
Gefunden : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3272810&octid=CT327281[...]
Gefunden : user_pref("Smartbar.ConduitSearchEngineList", "WhiteSmoke US New E1 Customized Web Search");
Gefunden : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3272810[...]
Gefunden : user_pref("Smartbar.keywordURLSelectedCTID", "CT3272810");
Gefunden : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3272810&SearchSource=13[...]
Gefunden : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[...]
Gefunden : user_pref("smartbar.originalHomepage", "chrome://branding/locale/browserconfig.properties");
Gefunden : user_pref("smartbar.originalSearchAddressUrl", "");
Gefunden : user_pref("smartbar.originalSearchEngine", false);

*************************

AdwCleaner[R1].txt - [9290 octets] - [10/01/2013 17:43:43]

########## EOF - C:\AdwCleaner[R1].txt - [9350 octets] ##########

Hi,

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Schließe
alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Löschen.
Bestätige jeweils mit Ok.
Dein
Rechner wird neu gestartet, je nach Schwere der Infektion auch mehrmals - das ist normal. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den
Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[Sx].txt. (x = fortlaufende Nummer)

Neustarten, teste bitte, wie der PC läuft + Programme, wie Browser, auch den internet Explorer bitte

# AdwCleaner v2.105 - Datei am 10/01/2013 um 18:30:26 erstellt
# Aktualisiert am 08/01/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Bouillon - BOUILLON-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Bouillon\Desktop\adwcleaner.exe
# Option [Löschen]

**** [Dienste] ****

***** [Dateien / Ordner] *****

Datei Gelöscht : C:\END
Datei Gelöscht : C:\Users\Bouillon\AppData\Roaming\Mozilla\Firefox\Profiles\h4cgt85a.default\searchplugins\Searchab.xml
Ordner Gelöscht : C:\ProgramData\InstallMate
Ordner Gelöscht : C:\Users\Bouillon\AppData\Local\Software
Ordner Gelöscht : C:\Users\Bouillon\AppData\Local\SwvUpdater
Ordner Gelöscht : C:\Users\Bouillon\AppData\Roaming\Mozilla\Firefox\Profiles\h4cgt85a.default\Smartbar

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\StartSearch

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v17.0.1 (de)

Datei : C:\Users\Bouillon\AppData\Roaming\Mozilla\Firefox\Profiles\h4cgt85a.default\prefs.js

Gelöscht : user_pref("CT3272810.1000082.isDisplayHidden", "true");
Gelöscht : user_pref("CT3272810.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description[...]
Gelöscht : user_pref("CT3272810.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Gelöscht : user_pref("CT3272810.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]
Gelöscht : user_pref("CT3272810.FirstTime", "true");
Gelöscht : user_pref("CT3272810.FirstTimeFF3", "true");
Gelöscht : user_pref("CT3272810.InstallDate", "4/1/2013 21:50:39");
Gelöscht : user_pref("CT3272810.LoginRevertSettingsEnabled", true);
Gelöscht : user_pref("CT3272810.RevertSettingsEnabled", true);
Gelöscht : user_pref("CT3272810.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT327[...]
Gelöscht : user_pref("CT3272810.UserID", "UN51068977830165037");
Gelöscht : user_pref("CT3272810.addressBarTakeOverEnabledInHidden", "true");
Gelöscht : user_pref("CT3272810.autoDisableScopes", -1);
Gelöscht : user_pref("CT3272810.browser.search.defaultthis.engineName", true);
Gelöscht : user_pref("CT3272810.cb_user_id_000.enc", "Q0I2MjIxNDk3MjYyNTFfMTM1NzMzMjY1MzI4MV9GaXJlZm94");
Gelöscht : user_pref("CT3272810.cbfirsttime.enc", "RnJpIEphbiAwNCAyMDEzIDIxOjUwOjUxIEdNVCswMTAw");
Gelöscht : user_pref("CT3272810.defaultSearch", "true");
Gelöscht : user_pref("CT3272810.embeddedsData", "[{\"appId\":\"130004960265293823\",\"apiPermissions\":{\"cross[...]
Gelöscht : user_pref("CT3272810.enableAlerts", "always");
Gelöscht : user_pref("CT3272810.enableSearchFromAddressBar", "true");
Gelöscht : user_pref("CT3272810.firstTimeDialogOpened", "true");
Gelöscht : user_pref("CT3272810.fixPageNotFoundError", "true");
Gelöscht : user_pref("CT3272810.fixPageNotFoundErrorInHidden", "true");
Gelöscht : user_pref("CT3272810.fixUrls", true);
Gelöscht : user_pref("CT3272810.hxxp___api21_starwebnet_com.pid2.enc", "MWYzNGExM2JmYTlmOGYwZg==");
Gelöscht : user_pref("CT3272810.hxxp___api32_starwebnet_com.pid2.enc", "MWYzNGExM2JmYTlmOGYwZg==");
Gelöscht : user_pref("CT3272810.installId", "9818");
Gelöscht : user_pref("CT3272810.installType", "conduitnsisintegration");
Gelöscht : user_pref("CT3272810.isCheckedStartAsHidden", true);
Gelöscht : user_pref("CT3272810.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Gelöscht : user_pref("CT3272810.isFirstTimeToolbarLoading", "false");
Gelöscht : user_pref("CT3272810.isNewTabEnabled", true);
Gelöscht : user_pref("CT3272810.isPerformedSmartBarTransition", "true");
Gelöscht : user_pref("CT3272810.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Gelöscht : user_pref("CT3272810.keyword", true);
Gelöscht : user_pref("CT3272810.mam_CouponBuddy_appState.enc", "b24=");
Gelöscht : user_pref("CT3272810.mam_PriceGong_appState.enc", "b24=");
Gelöscht : user_pref("CT3272810.mam_gk_appsData.enc", "eyJhcHBzIjpbeyJpZCI6IlByaWNlR29uZyIsInVybCI6Imh0dHA6Ly9z[...]
Gelöscht : user_pref("CT3272810.mam_gk_configuration.enc", "eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6IlByaWNlR29uZyIsImN[...]
Gelöscht : user_pref("CT3272810.mam_gk_first_time.enc", "MQ==");
Gelöscht : user_pref("CT3272810.mam_gk_lastLoginTime.enc", "MTM1NzMzMjY0NzUxMg==");
Gelöscht : user_pref("CT3272810.mam_gk_settings.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoy[...]
Gelöscht : user_pref("CT3272810.mam_gk_userId.enc", "MTBjYWZhMjItYzA2Ni00ZmE1LWFmYjQtYTFmZDcyMDAyZDli");
Gelöscht : user_pref("CT3272810.mam_gk_user_apps_selection.enc", "eyJQcmljZUdvbmciOnRydWUsIkNvdXBvbkJ1ZGR5Ijp0c[...]
Gelöscht : user_pref("CT3272810.migrateAppsAndComponents", true);
Gelöscht : user_pref("CT3272810.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"about[...]
Gelöscht : user_pref("CT3272810.newSettings", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Gelöscht : user_pref("CT3272810.openThankYouPage", "false");
Gelöscht : user_pref("CT3272810.openUninstallPage", "false");
Gelöscht : user_pref("CT3272810.price-gong.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\[...]
Gelöscht : user_pref("CT3272810.revertSettingsEnabled", "false");
Gelöscht : user_pref("CT3272810.search.searchAppId", "130004960265293823");
Gelöscht : user_pref("CT3272810.search.searchCount", "0");
Gelöscht : user_pref("CT3272810.searchInNewTabEnabledInHidden", "true");
Gelöscht : user_pref("CT3272810.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Gelöscht : user_pref("CT3272810.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]
Gelöscht : user_pref("CT3272810.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]
Gelöscht : user_pref("CT3272810.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]
Gelöscht : user_pref("CT3272810.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]
Gelöscht : user_pref("CT3272810.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]
Gelöscht : user_pref("CT3272810.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]
Gelöscht : user_pref("CT3272810.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1357332643274");
Gelöscht : user_pref("CT3272810.serviceLayer_services_appsMetadata_lastUpdate", "1357332643032");
Gelöscht : user_pref("CT3272810.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1357332643576");
Gelöscht : user_pref("CT3272810.serviceLayer_services_login_10.13.40.15_lastUpdate", "1357332760967");
Gelöscht : user_pref("CT3272810.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1357332643896");
Gelöscht : user_pref("CT3272810.serviceLayer_services_searchAPI_lastUpdate", "1357332642769");
Gelöscht : user_pref("CT3272810.serviceLayer_services_serviceMap_lastUpdate", "1357332642514");
Gelöscht : user_pref("CT3272810.serviceLayer_services_toolbarContextMenu_lastUpdate", "1357332643869");
Gelöscht : user_pref("CT3272810.serviceLayer_services_toolbarSettings_lastUpdate", "1357341725986");
Gelöscht : user_pref("CT3272810.serviceLayer_services_translation_lastUpdate", "1357332643096");
Gelöscht : user_pref("CT3272810.serviceLayer_services_userApps_lastUpdate", "1357332749643");
Gelöscht : user_pref("CT3272810.settingsINI", true);
Gelöscht : user_pref("CT3272810.shouldFirstTimeDialog", "false");
Gelöscht : user_pref("CT3272810.smartbar.CTID", "CT3272810");
Gelöscht : user_pref("CT3272810.smartbar.Uninstall", "0");
Gelöscht : user_pref("CT3272810.smartbar.homepage", true);
Gelöscht : user_pref("CT3272810.smartbar.isHidden", true);
Gelöscht : user_pref("CT3272810.smartbar.toolbarName", "WhiteSmoke US New E1 ");
Gelöscht : user_pref("CT3272810.startPage", "userChanged");
Gelöscht : user_pref("CT3272810.toolbarBornServerTime", "4-1-2013");
Gelöscht : user_pref("CT3272810.toolbarCurrentServerTime", "4-1-2013");
Gelöscht : user_pref("CT3272810.toolbarDisabled", "true");
Gelöscht : user_pref("CT3272810_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]
Gelöscht : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3272810&octid=CT327281[...]
Gelöscht : user_pref("Smartbar.ConduitSearchEngineList", "WhiteSmoke US New E1 Customized Web Search");
Gelöscht : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3272810[...]
Gelöscht : user_pref("Smartbar.keywordURLSelectedCTID", "CT3272810");
Gelöscht : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3272810&SearchSource=13[...]
Gelöscht : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[...]
Gelöscht : user_pref("smartbar.originalHomepage", "chrome://branding/locale/browserconfig.properties");
Gelöscht : user_pref("smartbar.originalSearchAddressUrl", "");
Gelöscht : user_pref("smartbar.originalSearchEngine", false);

*************************

AdwCleaner[R1].txt - [9419 octets] - [10/01/2013 17:43:43]
AdwCleaner[S1].txt - [9352 octets] - [10/01/2013 18:30:26]

########## EOF - C:\AdwCleaner[S1].txt - [9412 octets] ##########

Läuft alles normal und stabil...
aber wen ich einen neuen tab öffne und z.b hhjjhkhkj eingebe was keinen sinn macht krieg ich diese anzeige wie im bild ist das was normales ?
hxxp://s14.directupload.net/file/d/3131/l44llnav_png.htm

poste mir noch mal ein neues otl log bitte.

hi
hast du den Proxy im ff selbst eingestellt?

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

Code:

:OTL

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://searchab.com/?aff=7&uid=5ddebcc7-5a13-11e2-a839-dc0ea117d874

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://searchab.com/?aff=7&uid=5ddebcc7-5a13-11e2-a839-dc0ea117d874

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://searchab.com/?aff=7&uid=5ddebcc7-5a13-11e2-a839-dc0ea117d874&q={searchTerms}

FF - prefs.js..browser.search.defaultengine: "Privitize VPN"

FF - prefs.js..browser.search.defaultenginename: "Privitize VPN"

FF - prefs.js..browser.search.order.1: "Privitize VPN"

FF - prefs.js..keyword.URL: "http://searchab.com/?aff=7&uid=5ddebcc7-5a13-11e2-a839-dc0ea117d874&q="

 :Files

:Commands

[EMPTYFLASH] 

[emptytemp]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

All processes killed
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Prefs.js: "Privitize VPN" removed from browser.search.defaultengine
Prefs.js: "Privitize VPN" removed from browser.search.defaultenginename
Prefs.js: "Privitize VPN" removed from browser.search.order.1
Prefs.js: "hxxp://searchab.com/?aff=7&uid=5ddebcc7-5a13-11e2-a839-dc0ea117d874&q=" removed from keyword.URL
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Bouillon
->Flash cache emptied: 1454 bytes

User: Default

User: Default User

User: Public

Total Flash Files Cleaned = 0,00 mb

[EMPTYTEMP]

User: All Users

User: Bouillon
->Temp folder emptied: 930974 bytes
->Temporary Internet Files folder emptied: 2792314 bytes
->Java cache emptied: 3887183 bytes
->FireFox cache emptied: 144428197 bytes
->Flash cache emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 12288 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 783302 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 146,00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 01102013_193817

Files\Folders moved on Reboot...
C:\Users\Bouillon\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Bouillon\AppData\Local\Temp\MMDUtl.log moved successfully.
File move failed. C:\Windows\temp\dsiwmis.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\LMutilps32.log scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

ja ich habe mir son proxy add onn raufgemacht weil ich viel auf youtube unterwegs bin und die meisten videos ja durch die gema usw in deutschland nicht verfügbar sind

Hi
firefox öffnen, Adresszeile
Tippe:
about:config
enter
ich werde vorsichtig sein anhaken
dann kommst du auf ein Suchfeld
dort reinkopieren:
searchab
enter
wenn ein Wert angezeigt wird, rechtsklick, kopieren, und bei der nächsten Antwort reinkopieren.
Dann noch mal suchen, drauf achten, das warscheinlich wieder der erste Wert angesprungen wird, also weiter suchen, wieder kopieren, einfügen, bis nichts mehr gefunden wird.

er findet nix mehr unter searchab, und wen ich jetzt was sinnlosen eingebe kommt auch wieder die normale firefox anzeige das es die nicht gibt

So soll das auch sein :-)
Wenn es jetzt keine Probleme mehr gibt, öffne OTL, bereinigen, PC startet neu.
Remover werden gelöscht.
Lösche:
übrig gebliebene Remover, Setups, Logs, leere den Papierkorb.
Gerät absichern:
als antimalware programm würde ich emsisoft empfehlen.
diese haben für mich den besten schutz kostet aber etwas.
Computeractive Software Store - Emsisoft Anti-Malware 7 [1-PC] - 63% off RRP
testversion:
Meine Antivirus-Empfehlung: Emsisoft Anti-Malware
insbesondere wenn du onlinebanking, einkäufe, sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches machst, also sensible daten zu schützen sind, solltest du in sicherheitssoftware investieren.
vor dem aktivieren der lizenz die 30 tage testzeitraum ausnutzen.

kostenlos, aber eben nicht ganz so gut währe avast zu empfehlen.
http://www.trojaner-board.de/110895-...antivirus.html

sag mir welches du nutzt, dann gebe ich konfigurationshinweise.
bitte dein bisheriges av deinstalieren
die folgende anleitung ist umfangreich, dass ist mir klar, sie sollte aber umgesetzt werden, da nur dann dein pc sicher ist. stelle so viele fragen wie nötig, ich arbeite gern alles mit dir durch!

http://www.trojaner-board.de/96344-a...-rechners.html
Starte bitte mit der Passage, Windows Vista und Windows 7
Bitte beginne damit, Windows Updates zu instalieren.
Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst.
Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist:
- Updates automatisch Instalieren,
- Täglich
- Uhrzeit wählen
- Bitte den gesammten rest anhaken, außer:
- detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist.
Klicke jetzt die Schaltfläche "OK"
Klicke jetzt "nach Updates suchen".
Bitte instaliere zunächst wichtige Updates.
Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren.
Mache das selbe bitte mit den optionalen Updates.
Bitte übernimm den rest so, wie es im Abschnitt windows 7 / Vista zu lesen ist.
aus dem Abschnitt xp, bitte den punkt "datenausführungsverhinderung, dep" übernehmen.
als browser rate ich dir zu chrome:
Installation von Google Chrome für mehrere Nutzerkonten - Google Chrome-Hilfe
anleitung lesen bitte
falls du nen andern nutzen willst, sags mir dann muss ich teile der nun folgenden anleitung anpassen.

Sandboxie
Die devinition einer Sandbox ist hier nachzulesen:
Sandbox
Kurz gesagt, man kann Programme fast 100 %ig isuliert vom System ausführen.

Der Vorteil liegt klar auf der Hand, wenn über den Browser Schadcode eingeschläust wird, kann dieser nicht nach außen dringen.
Download Link:
Sandboxie - Download - Filepony

anleitung:
http://www.trojaner-board.de/71542-a...sandboxie.html
ausführliche anleitung als pdf, auch abarbeiten:
Sandbox Einstellungen |

bitte folgende zusatz konfiguration machen:
sandboxie control öffnen, menü sandbox anklicken, defauldbox wählen.
dort klicke auf sandbox einstellungen.
beschrenkungen, bei programm start und internet zugriff schreibe:
chrome.exe
dann gehe auf anwendungen, webbrowser, chrome.
dort aktiviere alles außer gesammten profil ordner freigeben.
Wie du evtl. schon gesehen hast, kannst du einige Funktionen nicht nutzen.
Dies ist nur in der Vollversion nötig, zu deren Kauf ich dir rate.
Du kannst zb unter "Erzwungene Programmstarts" festlegen, dass alle Browser in der Sandbox starten.
Ansonsten musst du immer auf "Sandboxed webbrowser" klicken bzw Rechtsklick, in Sandboxie starten.
Eine lebenslange Lizenz kostet 30 €, und ist auf allen deinen PC's nutzbar.

Weiter mit:
Maßnahmen für ALLE Windows-Versionen
alles komplett durcharbeiten
anmerkung zu file hippo.
in den settings zusätzlich auswählen:
hide beta updates.
Run updateChecker when Windows starts

Backup Programm:
in meiner Anleitung ist bereits ein Backup Programm verlinkt, als Alternative bietet sich auch das Windows eigene Backup Programm an:
http://www.trojaner-board.de/82962-w...en-backup.html
Dies ist aber leider nur für Windows 7 Nutzer vernünftig nutzbar.
Alle Anderen sollten sich aber auf jeden fall auch ein Backup Programm instalieren, denn dies kann unter Umständen sehr wichtig sein, zum Beispiel, wenn die Festplatte einmal kaputt ist.

Zum Schluss, die allgemeinen sicherheitstipps beachten, wenn es dich betrifft, den Tipp zum Onlinebanking beachten und alle Passwörter ändern
bitte auch lesen, wie mache ich programme für alle sichtbar:
Programme für alle Konten nutzbar machen - PCtipp.ch - Praxis & Hilfe
surfe jetzt also nur noch im standard nutzer konto und dort in der sandbox.
wenn du die kostenlose version nutzt, dann mit klick auf sandboxed web browser, wenn du die bezahlversion hast, kannst du erzwungene programm starts festlegen, dann wird sandboxie immer gestartet wenn du nen browser aufrufst.
wenn du mit der maus über den browser fährst sollte der eingerahmt sein, dann bist du im sandboxed web browser

passwort sicherheit:
jeder dienst benötigt ein eigenes, mindestens 12-stelliges passwort
bei der passwort verwaltung und erstellung hilft roboform
Passwort Manager, Formular Ausfueller, Passwort Management | RoboForm Passwort Manager
anleitung:
RoboForm-Bedienungsanleitung: Passwort-Manager, Verwalten von Passwörtern und persönlichen Daten

hab alles gemacht bis zum punkt Sanboixe würde gerne weiterhin ff nutzen

Schon chrome angesehen? er bietet einige Sicherheitsfeatures, die der FF nicht hatt, und sollte schneller sein.
ansehen kann ja nicht scahden denke ich, meckern kann man später ja immernoch.
hier mal eine Grundkonfiguration
adblock für chrome:
http://filepony.de/download-adblock_chrome/
damit sollte das leben werbefreier von statten gehen.
ghostery um tracking zu verhindern:
http://filepony.de/download-ghostery_chrome/
sicher surfen mit chrome:
Sicher surfen mit Google Chrome | Verbraucher sicher online

FF weg, wenn der Chrome ok sein sollte

so hab alles gemacht chrome scheint ganz ordentlich sein ist der virus den jetzt weg ?, und was war das für einer

Hi
Adware, um dir Werbung etc einzublenden.
wie gesagt, wenn du mit dem Chrome zurande kommst, ff deinstalieren.
ich möchte erst mal anhand einer checkliste prüfen ob du alles hast.
- instalieren von optionalen und wichtigen updates.
- konfigurieren von windows updates.
- dep für alle prozesse aktivieren.
- sehop aktivieren.
- chrome instalieren.
- sandboxie instalieren.
- autorun deaktivieren.
- panda vaccine instalieren.
- secunia instalieren.
- file hippo instalieren.
beachte:
secunia und file hippo bieten englische updates, überall wo du auf die nutzeroberfläche zugreifst, wie zb reader, browser, etc benötigst du deutsche updates, also hier die hersteller seiten in den favoriten deines browsers speichern und wenn ein update gezeigt wird, von dort hohlen, bei java, flash quicktime, ist es egal ob deutsch oder englisch.
- backup software instalieren, backup und rettungsdvd erstellen.
hier ne kurze anleitung:
Anleitung: Systemabbild mit Paragon Drive Backup - NETZWELT

- wenn du onlinebanking machst, kann ich noch kurz was über die vorteile von card reader und banking software sagen.
- passwort manager instaliert.

Hi
Mir ist vorhin aufgefallen das sich 2 mir unbekannte programme im task-manager befinden

unescapp.exe
Beschreibung: Sink to receive asynchronous callbacks for WMI client application
Dateipfad: Computer- Acer (C:)- Windows- System 32 - webem

da sind viele Mof-Datein, Xsl- Stylesheet datein, und und Anwendungsverweiterung.

und das andere

MMDx64Fx.exe
Beschreibung: MMDx64Fx Application
Dateipfad: Computer -Acer -(C:) Programme (x86)- Launch Manager
einfach nur eine exe. allerdings sind über der exe 2 weitere datein eine MMDUtl.cfg (CFG) Datei, und eine MMDUtl.dll (Anwendugswerweiterung), und darunter eine weitere MMKEYBD.CFG (CFG-Datei)

und irgendwie benutzt der immer soviel arbeitsspeicher 2,5 Gb Ram bei nur im internet sein finde ich recht viel

hi
sind legitime Prozesse.
öffne mal CCleaner, extras, autostart liste und poste deren Inhalt.

Ok

Ja HKCU:Run Skype Skype Technologies S.A. "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
Ja HKCU:Run Spotify Spotify Ltd "C:\Users\Bouillon\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart
Ja HKCU:Run Spotify Web Helper Spotify Ltd "C:\Users\Bouillon\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
Ja HKCU:Run Steam Valve Corporation "C:\Program Files (x86)\Steam\Steam.exe" -silent
Ja HKLM:Run Adobe ARM Adobe Systems Incorporated "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
Ja HKLM:Run ArcadeMovieService CyberLink Corp. "C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe"
Ja HKLM:Run avast AVAST Software "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
Ja HKLM:Run BackupManagerTray NTI Corporation "C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k
Ja HKLM:Run Cm108Sound Microsoft Corporation C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cm108.dll,CMICtrlWnd
Ja HKLM:Run Dolby Advanced Audio v2 Dolby Laboratories Inc. "C:\Dolby PCEE4\pcee4.exe" -autostart
Ja HKLM:Run ETDCtrl ELAN Microelectronics Corp. %ProgramFiles%\Elantech\ETDCtrl.exe
Ja HKLM:Run IntelTBRunOnce Microsoft Corporation wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
Ja HKLM:Run LManager Dritek System Inc. C:\Program Files (x86)\Launch Manager\LManager.exe
Ja HKLM:Run NUSB3MON Renesas Electronics Corporation "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
Ja HKLM:Run Power Management Acer Incorporated C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
Ja HKLM:Run RtHDVBg_Dolby Realtek Semiconductor C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4
Ja HKLM:Run RtHDVCpl Realtek Semiconductor C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
Ja HKLM:Run StartCCC Advanced Micro Devices, Inc. "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
Ja HKLM:Run SuiteTray Egis Technology Inc. "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
Ja Startup Common Bluetooth.lnk Broadcom Corporation. C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
Ja Startup User Überwachungstool für die Intel® Turbo-Boost-Technik 2.0.lnk Intel® Corporation C:\Program Files\Intel\TurboBoost\SignalIslandUi.exe

deaktiviere mal alles außer:
avast
auch bei startup.
sollte was wichtiges fehlen, kann mans wieder anhaken.
neustarten, testen, obs ne Verbesserung gibt.