Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Der angegebene Dienst ist kein installierter Dienst. (https://www.trojaner-board.de/131439-angegebene-dienst-kein-installierter-dienst.html)

Guadeno 23.02.2013 23:01
Der angegebene Dienst ist kein installierter Dienst.
 
Hey,

hab gerade ziemliche Probleme mit meinem Windows 7 64 Bit.
Wollte mal Directx neuinstallieren => Beim starten:
http://www.abload.de/img/unbenanntgbqwb.png
Dann hatte ich auch bemerkt, dass meine Firewall, die Windows Updates, etc. alle deaktiviert sind (Irgendein Virus, schätze ich mal). Hab schon mit Avira einen komplett Scan gemacht => Alles gefundene in Quarantäne.
Hab auch schon mit Malwarebytes' Anti-Malware durchscannen lassen und alles gefundene gelöscht. => Keine Besserung.
Hab schon einige Stunden gegoogelt und die verschiedensten Sachen ausprobiert.
Bisher hab ich meine Firewall wieder aktiviert bekommen, sonst aber noch nichts.
Was mich noch sehr stark wundert: Bei mir gibt es beispielsweise den Dienst Windows Update garnicht! Deshalb glaube ich, dass der/die Viren einige meiner Dienste gelöscht haben! Kann man diese irgendwie wiederherstellen?
(Ich hab jetzt keine Lust, mein Windows neuzuinstallieren ...)
Ich hoffe ich hab nichts vergessen und es gibt irgendeine einfach Lösung für das Ganze.

Gruß

Edit:
So, ich glaub ich habs jetzt doch geschafft :)
Musste 3 .dll's neuregistrieren..

Edit2:
http://www.abload.de/img/unbenanntgmr9y.png

-.-"

cosinus 24.02.2013 22:33
Hallo und :hallo:

Zitat:
Hab schon mit Avira einen komplett Scan gemacht => Alles gefundene in Quarantäne.
Schön und wo sind die Logs dazu? :glaskugel:

Solche Angaben reichen nicht, bitte poste die vollständigen Angaben/Logs der Virenscanner siehe http://www.trojaner-board.de/125889-...tml#post941520


Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307



Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
  • Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.

  • Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.

  • Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!

  • Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!

  • Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.


Erstmal eine Kontrolle mit OTL bitte:
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in CODE-Tags in den Thread.

Guadeno 25.02.2013 14:52
Log Files von Avira hab ich leider nicht...
Aber da alles gefundene sowieso weg ist, dürfte das ja kein Problem mehr sein.
Die Logs von OTL:
Code:
OTL logfile created on: 25.02.2013 14:40:08 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Michael\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,17 Gb Available Physical Memory | 77,17% Memory free
16,00 Gb Paging File | 13,90 Gb Available in Paging File | 86,87% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 296,41 Gb Free Space | 63,65% Space Free | Partition Type: NTFS
Drive I: | 931,51 Gb Total Space | 607,76 Gb Free Space | 65,24% Space Free | Partition Type: NTFS
 
Computer Name: MICHAEL-PC | User Name: Michael | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Michael\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_6_602_168.exe (Adobe Systems, Inc.)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_168.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\TechPowerUp OSD Server\TPUOSDVideo.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Hamachi2Svc) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (TeamViewer7) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (UMVPFSrv) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (npggsvc) -- C:\Windows\SysWOW64\GameMon.des (INCA Internet Co., Ltd.)
SRV - (rpcapd) -- C:\Program Files (x86)\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (ACDaemon) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Neo_VPN) -- C:\Windows\SysNative\drivers\Neo_0023.sys (SoftEther Corporation)
DRV:64bit: - (FNETTBOH_305) -- C:\Windows\SysNative\drivers\FNETTBOH_305.SYS (FNet Co., Ltd.)
DRV:64bit: - (FNETURPX) -- C:\Windows\SysNative\drivers\FNETURPX.SYS (FNet Co., Ltd.)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (AODDriver4.2) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys (Advanced Micro Devices)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (LVUVC64) -- C:\Windows\SysNative\drivers\lvuvc64.sys (Logitech Inc.)
DRV:64bit: - (LVRS64) -- C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.)
DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia)
DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia)
DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia)
DRV:64bit: - (WCMVCAM) -- C:\Windows\SysNative\drivers\wcmvcam64.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (AsrAppCharger) -- C:\Windows\SysNative\drivers\AsrAppCharger.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (VClone) -- C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG)
DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (vpcvmm) -- C:\Windows\SysNative\drivers\vpcvmm.sys (Microsoft Corporation)
DRV:64bit: - (vpcbus) -- C:\Windows\SysNative\drivers\vpchbus.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (vpcusb) -- C:\Windows\SysNative\drivers\vpcusb.sys (Microsoft Corporation)
DRV:64bit: - (vpcnfltr) -- C:\Windows\SysNative\drivers\vpcnfltr.sys (Microsoft Corporation)
DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation)
DRV:64bit: - (UnlockerDriver5) -- C:\Program Files\Unlocker\UnlockerDriver5.sys ()
DRV:64bit: - (RTL2832UBDA) -- C:\Windows\SysNative\drivers\RTL2832UBDA.sys (REALTEK SEMICONDUCTOR Corp.)
DRV:64bit: - (RTL2832UUSB) -- C:\Windows\SysNative\drivers\RTL2832UUSB.sys (REALTEK SEMICONDUCTOR Corp.)
DRV:64bit: - (NPF) -- C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.)
DRV:64bit: - (RTL2832U_IRHID) -- C:\Windows\SysNative\drivers\RTL2832U_IRHID.sys (Realtek)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (AtiPcie) -- C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia)
DRV - (RTL2832UUSB) -- C:\Windows\SysWOW64\drivers\RTL2832UUSB.sys (REALTEK SEMICONDUCTOR Corp.)
DRV - (RTL2832UBDA) -- C:\Windows\SysWOW64\drivers\RTL2832UBDA.sys (REALTEK SEMICONDUCTOR Corp.)
DRV - (RTL2832U_IRHID) -- C:\Windows\SysWOW64\drivers\RTL2832U_IRHID.sys (Realtek)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (NPPTNT2) -- C:\Windows\SysWOW64\npptNT2.sys (INCA Internet Co., Ltd.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 9C C8 40 CD 15 34 CD 01  [binary data]
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - No CLSID value found
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=109958&tt=220512_53ctrl&babsrc=SP_ss&mntrId=d29ea71a000000000000bc5ff41e50bd
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..\SearchScopes\{D04F2B30-4034-4EC5-8963-2D93F494FA47}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=NDV&o=15765&src=kw&q={searchTerms}&locale=&apn_ptnrs=NY&apn_dtid=YYYYYYUODE&apn_uid=B73629B3-9CFB-41AB-B7F1-AF6E6763160B&apn_sauid=E98B1F9D-A8CB-477A-9B03-E751AF19D97F&
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "chrome://speeddial/content/speeddial.xul"
FF - prefs.js..extensions.enabledAddons: personas%40christopher.beard:1.6.2
FF - prefs.js..extensions.enabledAddons: %7Bbb6bc1bb-f824-4702-90cd-35e2fb24f25d%7D:1.5.1.1
FF - prefs.js..extensions.enabledAddons: %7BEF522540-89F5-46b9-B6FE-1829E2B572C6%7D:6.1
FF - prefs.js..extensions.enabledAddons: %7BDDC359D1-844A-42a7-9AA1-88A850A938A8%7D:2.0.15
FF - prefs.js..extensions.enabledAddons: %7B64161300-e22b-11db-8314-0800200c9a66%7D:0.9.6.14
FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.4.7
FF - prefs.js..extensions.enabledAddons: %7B19503e42-ca3c-4c27-b1e2-9cdb2170ee34%7D:1.5.4.2
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.2
FF - prefs.js..network.proxy.autoconfig_url: "https://secure.premiumize.me/dcf75e1b0d1f135d265122b7f09b2e6c/proxy.pac"
FF - prefs.js..network.proxy.type: 0
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_168.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.10.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.10.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_168.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1166636.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.122.0: C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.138.0: C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=2.1.2: C:\Program Files (x86)\Battlelog Web Plugins\2.1.2\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@playstation.com/PsndlCheck,version=1.00: C:\Program Files (x86)\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Michael\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Michael\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.02.06 14:33:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\jid1-VZC3jSUSB1KxYw@jetpack: C:\Users\Michael\AppData\Roaming\Vaginallesen\jid1-VZC3jSUSB1KxYw@jetpack\
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.02.06 14:33:20 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012.05.17 11:16:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\Extensions
[2013.02.23 16:35:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\7zicrbwu.default\extensions
[2012.08.31 23:45:32 | 000,000,000 | ---D | M] (Cookies Manager+) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\7zicrbwu.default\extensions\{bb6bc1bb-f824-4702-90cd-35e2fb24f25d}
[2013.02.15 01:46:25 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\7zicrbwu.default\extensions\ich@maltegoetz.de
[2012.05.17 11:19:56 | 000,330,316 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\extensions\personas@christopher.beard.xpi
[2013.02.23 16:35:21 | 000,348,178 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi
[2013.02.12 17:25:14 | 000,281,921 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
[2013.02.14 21:11:12 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.01.26 22:55:48 | 000,698,867 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
[2012.11.05 13:08:44 | 000,045,219 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6}.xpi
[2013.02.06 14:33:19 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.02.06 14:33:20 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
 
========== Chrome  ==========
 
CHR - Extension: No name found = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\
CHR - Extension: No name found = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: No name found = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: No name found = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\14.2.0.1_0\
CHR - Extension: No name found = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2013.02.16 20:52:23 | 000,000,951 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 192.168.2.103    privaterserver.no-ip.org
O1 - Hosts: 192.168.2.103    hxxp://www.privaterserver.no-ip.org
O2:64bit: - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - %SystemRoot%\System32\winrnr.dll File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\.DEFAULT\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-19\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..Trusted Domains: sony.com ([]* in Trusted sites)
O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C459B77A-A33C-4EB7-88A6-A9BCEA2849E3}: DhcpNameServer = 192.168.2.1 192.168.2.1
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18:64bit: - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000 Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.02.25 14:39:22 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe
[2013.02.23 22:18:06 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\Malwarebytes
[2013.02.23 22:18:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.02.23 22:18:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.02.23 22:17:59 | 000,024,176 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.02.23 22:17:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013.02.23 21:32:40 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\ElevatedDiagnostics
[2013.02.22 18:47:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Bohemia Interactive Studio
[2013.02.20 16:38:16 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\AMD
[2013.02.20 16:37:59 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\ATI
[2013.02.20 16:37:59 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\ATI
[2013.02.20 16:37:59 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2013.02.20 16:35:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT
[2013.02.20 16:35:51 | 000,000,000 | ---D | C] -- C:\Program Files\AMD
[2013.02.20 16:35:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD
[2013.02.20 16:35:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2013.02.20 16:35:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies
[2013.02.20 16:35:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies
[2013.02.20 16:35:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2013.02.20 16:35:07 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD
[2013.02.20 16:34:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2013.02.20 16:33:46 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2013.02.20 16:33:05 | 000,000,000 | ---D | C] -- C:\AMD
[2013.02.19 14:33:01 | 000,194,488 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\drivers\nvhda64v.sys
[2013.02.19 14:33:01 | 000,031,672 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhdap64.dll
[2013.02.16 19:25:29 | 000,000,000 | ---D | C] -- C:\Users\Michael\Desktop\Serien
[2013.02.16 16:05:58 | 000,000,000 | ---D | C] -- C:\Users\Michael\Documents\EA Games
[2013.02.16 16:05:40 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\EA Games
[2013.02.16 13:47:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Cleaner Pro
[2013.02.15 16:57:33 | 000,000,000 | ---D | C] -- C:\Users\Michael\.dvdcss
[2013.02.15 16:57:22 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\MPlayer
[2013.02.15 16:56:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDx 4.0
[2013.02.15 16:32:30 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\dvdcss
[2013.02.13 19:28:32 | 026,931,128 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll
[2013.02.13 19:28:32 | 020,450,232 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglv32.dll
[2013.02.13 19:28:32 | 018,054,312 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll
[2013.02.13 19:28:32 | 015,129,064 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvd3dum.dll
[2013.02.13 19:28:32 | 015,052,368 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvwgf2umx.dll
[2013.02.13 19:28:32 | 012,641,120 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvwgf2um.dll
[2013.02.13 19:28:32 | 007,565,240 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvopencl.dll
[2013.02.13 19:28:32 | 006,263,784 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvopencl.dll
[2013.02.13 19:28:32 | 002,720,696 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvid.dll
[2013.02.13 19:28:32 | 001,813,432 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco64.dll
[2013.02.13 19:28:32 | 001,504,696 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispgenco64.dll
[2013.02.13 19:28:31 | 025,256,376 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll
[2013.02.13 19:28:31 | 017,560,504 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcompiler.dll
[2013.02.13 19:28:31 | 009,389,888 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll
[2013.02.13 19:28:31 | 007,931,896 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuda.dll
[2013.02.13 19:28:31 | 002,904,504 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll
[2013.02.13 19:28:31 | 002,824,656 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvapi64.dll
[2013.02.13 19:28:31 | 002,504,248 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvapi.dll
[2013.02.13 19:28:31 | 002,344,888 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvenc.dll
[2013.02.13 19:28:31 | 001,985,976 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvenc.dll
[2013.02.13 19:28:31 | 001,107,592 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvumdshimx.dll
[2013.02.13 19:28:31 | 000,958,272 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvumdshim.dll
[2013.02.13 19:28:31 | 000,246,024 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvinitx.dll
[2013.02.13 19:28:31 | 000,201,728 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvinit.dll
[2013.02.10 17:29:32 | 000,000,000 | ---D | C] -- C:\Users\Michael\Documents\GUILD WARS
[2013.02.09 22:45:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2013.02.09 22:45:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft
[2013.02.09 22:45:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft
[2013.02.09 22:42:26 | 000,000,000 | ---D | C] -- C:\Users\Michael\Documents\ConvertXtoDVD
[2013.02.09 22:25:17 | 000,082,816 | ---- | C] (VSO Software) -- C:\Users\Michael\AppData\Roaming\pcouffin.sys
[2013.02.09 22:25:17 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\Vso
[2013.02.09 22:25:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\vso
[2013.02.09 22:25:13 | 000,000,000 | ---D | C] -- C:\ProgramData\VSO
[2013.02.07 14:40:07 | 001,304,032 | ---- | C] (techPowerUp (www.techpowerup.com)) -- C:\Users\Michael\Desktop\GPU-Z.0.6.7.exe
[2013.02.06 20:14:48 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\AnvSoft
[2013.02.06 20:08:46 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA%
[2013.02.06 20:08:10 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\Media Player Classic
[2013.02.06 20:00:14 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mega Codec Pack
[2013.02.06 14:33:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.02.04 19:47:52 | 000,000,000 | ---D | C] -- C:\Users\Michael\.shsh
[2013.02.04 18:31:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013.02.04 18:31:18 | 000,033,240 | ---- | C] (GEAR Software Inc.) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys
[2013.02.04 18:31:09 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013.02.04 18:31:08 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2013.02.04 18:31:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2013.02.04 18:31:08 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2013.02.04 18:29:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2013.02.04 18:29:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2013.02.03 15:33:26 | 000,000,000 | ---D | C] -- C:\ProgramData\TERA
[2013.02.03 15:33:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA
[2013.02.02 19:56:52 | 000,000,000 | ---D | C] -- C:\Users\Michael\Desktop\DDRace-b15-r6d74d52c-win32
[2013.01.29 14:40:15 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\NVIDIA
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.02.25 14:39:23 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe
[2013.02.25 14:25:56 | 000,024,928 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.25 14:25:56 | 000,024,928 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.25 14:23:46 | 1093,119,007 | ---- | M] () -- C:\Users\Michael\Desktop\Classic-WoW.org_1.12.1_Client.rar.part
[2013.02.25 14:23:46 | 000,000,000 | ---- | M] () -- C:\Users\Michael\Desktop\Classic-WoW.org_1.12.1_Client.rar
[2013.02.25 14:21:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.02.25 14:18:55 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\ROC_JAN2013_TB_rmv.job
[2013.02.25 14:18:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.02.25 14:18:37 | 2146,885,631 | -HS- | M] () -- C:\hiberfil.sys
[2013.02.24 01:55:00 | 000,001,128 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4149896342-1631694950-3810678737-1000UA.job
[2013.02.23 22:24:30 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\drivers\lvuvc.hs
[2013.02.23 21:23:56 | 000,412,992 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.02.23 16:48:35 | 000,291,088 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2013.02.23 16:48:35 | 000,291,088 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2013.02.23 16:48:29 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2013.02.23 14:55:00 | 000,001,076 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4149896342-1631694950-3810678737-1000Core.job
[2013.02.20 16:37:05 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2013.02.16 20:52:23 | 000,000,951 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.02.15 22:41:26 | 000,691,568 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.02.15 22:41:26 | 000,071,024 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.02.15 15:14:59 | 001,613,822 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.02.15 15:14:59 | 000,698,958 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.02.15 15:14:59 | 000,652,940 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.02.15 15:14:59 | 000,148,756 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.02.15 15:14:59 | 000,121,614 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.02.09 22:43:18 | 000,099,384 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\inst.exe
[2013.02.09 22:43:18 | 000,082,816 | ---- | M] (VSO Software) -- C:\Users\Michael\AppData\Roaming\pcouffin.sys
[2013.02.09 22:43:18 | 000,007,859 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\pcouffin.cat
[2013.02.09 22:43:18 | 000,001,167 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\pcouffin.inf
[2013.02.07 14:40:31 | 001,304,032 | ---- | M] (techPowerUp (www.techpowerup.com)) -- C:\Users\Michael\Desktop\GPU-Z.0.6.7.exe
[2013.02.06 13:48:03 | 000,000,600 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\winscp.rnd
[2013.02.04 19:51:24 | 000,000,950 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.umbrella
[2013.02.04 18:31:23 | 000,001,783 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2013.02.02 00:51:50 | 000,002,380 | ---- | M] () -- C:\Users\Michael\Desktop\Google Chrome.lnk
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.02.25 14:23:46 | 000,000,000 | ---- | C] () -- C:\Users\Michael\Desktop\Classic-WoW.org_1.12.1_Client.rar
[2013.02.25 14:23:43 | 869,510,175 | ---- | C] () -- C:\Users\Michael\Desktop\Classic-WoW.org_1.12.1_Client.rar.part
[2013.02.23 21:23:45 | 000,412,992 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.02.20 16:37:05 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2013.02.15 16:24:38 | 356,806,655 | ---- | C] () -- C:\Users\Michael\Desktop\Inception.img
[2013.02.13 19:28:31 | 000,017,266 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb
[2013.02.09 22:25:17 | 000,099,384 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\inst.exe
[2013.02.09 22:25:17 | 000,007,859 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\pcouffin.cat
[2013.02.09 22:25:17 | 000,001,167 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\pcouffin.inf
[2013.01.30 14:21:35 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\ROC_JAN2013_TB_rmv.job
[2012.12.26 19:01:03 | 000,073,832 | ---- | C] () -- C:\Windows\SysWow64\SuperFrameSplitter.dll
[2012.12.26 19:01:03 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\RTKDABMWare.dll
[2012.12.21 21:34:46 | 000,000,623 | ---- | C] () -- C:\Windows\SysWow64\W_DEBUG.DAT
[2012.12.21 21:32:49 | 000,000,094 | ---- | C] () -- C:\Windows\WET.INI
[2012.12.19 20:52:22 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.12.19 20:52:22 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.11.27 14:50:46 | 000,001,037 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\MPQEditor.ini
[2012.11.24 14:51:13 | 001,712,128 | ---- | C] () -- C:\Windows\SysWow64\libmysql_d.dll
[2012.11.10 01:23:20 | 000,000,842 | ---- | C] () -- C:\Users\Michael\AppData\Local\recently-used.xbel
[2012.09.21 19:49:28 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\Access.dat
[2012.08.22 22:27:14 | 000,000,001 | ---- | C] () -- C:\Windows\SysWow64\SI.bin
[2012.08.21 15:05:53 | 000,473,600 | ---- | C] () -- C:\Windows\SysWow64\Harmony.dll
[2012.08.21 15:05:53 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\Unlha32.dll
[2012.08.21 15:05:53 | 000,087,040 | ---- | C] () -- C:\Windows\UnGins.exe
[2012.08.13 15:20:56 | 000,003,072 | ---- | C] () -- C:\Users\Michael\AppData\Local\file__0.localstorage
[2012.07.03 18:12:00 | 003,130,440 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_blr.exe
[2012.06.26 13:08:26 | 000,000,019 | ---- | C] () -- C:\Windows\SoundConverter.INI
[2012.06.26 13:06:44 | 000,004,140 | ---- | C] () -- C:\ProgramData\mtbjfghn.xbe
[2012.06.19 13:02:17 | 003,123,272 | R--- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2012.06.13 18:53:56 | 000,000,600 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\winscp.rnd
[2012.06.01 17:38:55 | 000,291,088 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.06.01 17:38:53 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012.05.28 15:18:41 | 000,007,598 | ---- | C] () -- C:\Users\Michael\AppData\Local\Resmon.ResmonCfg
[2012.05.17 19:18:09 | 001,594,698 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.05.17 11:05:02 | 000,000,003 | ---- | C] () -- C:\Users\Michael\AppData\Local\user_data.ini
[2012.05.02 13:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012.01.18 06:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll
[2012.01.18 06:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2012.01.18 06:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\SysWow64\LogiDPPApp.exe
[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
 
========== ZeroAccess Check ==========
 
[2011.11.17 07:41:18 | 000,002,048 | -HS- | M] () -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\@
[2013.02.06 20:02:53 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\L
[2013.02.23 22:23:42 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\U
[2013.02.23 21:23:59 | 000,000,804 | ---- | M] () -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\L\00000004.@
[2013.02.06 20:01:01 | 000,002,048 | ---- | M] () -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\U\00000004.@
[2013.02.22 15:58:43 | 000,001,024 | ---- | M] () -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\U\00000008.@
[2013.02.23 22:23:42 | 000,001,632 | ---- | M] () -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\U\000000cb.@
[2013.02.06 20:01:01 | 000,015,360 | ---- | M] () -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\U\80000000.@
[2013.02.19 16:25:09 | 000,096,768 | ---- | M] () -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\U\80000032.@
[2013.02.19 16:25:09 | 000,083,968 | ---- | M] () -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\U\80000064.@
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[2013.02.23 21:23:50 | 000,004,608 | -HS- | M] () -- C:\Windows\assembly\GAC_32\Desktop.ini
[2013.02.23 21:23:50 | 000,006,144 | -HS- | M] () -- C:\Windows\assembly\GAC_64\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 03:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >
Code:
OTL Extras logfile created on: 25.02.2013 14:40:08 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Michael\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,17 Gb Available Physical Memory | 77,17% Memory free
16,00 Gb Paging File | 13,90 Gb Available in Paging File | 86,87% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 296,41 Gb Free Space | 63,65% Space Free | Partition Type: NTFS
Drive I: | 931,51 Gb Total Space | 607,76 Gb Free Space | 65,24% Space Free | Partition Type: NTFS
 
Computer Name: MICHAEL-PC | User Name: Michael | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
.js[@ = JSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.jse[@ = JSEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbe[@ = VBEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbs[@ = VBSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.wsf[@ = WSFFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.js [@ = JSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbe [@ = VBEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-4149896342-1631694950-3810678737-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
vbefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
vbsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
wsffile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
jsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
vbefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
vbsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
wsffile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0D047B51-3237-4D2B-AD45-B0CA7EBD3094}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1637\agent.exe |
"{1EBEBA21-0A6C-49D0-B007-DE5D72727767}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1637\agent.exe |
"{4A7DEE94-F889-486A-A15A-B2962B2502F4}" = protocol=6 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{972B283B-07B5-413C-9382-103C70F3C82F}" = protocol=17 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{B96E0666-831B-4BBA-BA51-D44E6BEB6DE4}" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"{D0B92CB3-1ABD-4F9E-8F4F-0D32C73702A6}" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"TCP Query User{36BC93D8-3FE1-40E7-92F5-5A96815098AF}C:\program files (x86)\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"TCP Query User{D57EEFB4-0613-46C9-8F16-3EDAC781C490}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"UDP Query User{137AD99F-45B8-4758-B07A-AC6470EB570E}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"UDP Query User{34189B4E-DB2A-48B9-8A0C-8496B763575B}C:\program files (x86)\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1" = Core Temp 1.0 RC3
"{0E5D76AD-A3FB-48D5-8400-8903B10317D3}" = iTunes
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{26A24AE4-039D-4CA4-87B4-2F86417010FF}" = Java 7 Update 10 (64-bit)
"{3145731D-C578-70ED-899F-7A670D2A6662}" = AMD Fuel
"{44610EE0-C908-D8F1-425D-914A5B745DEA}" = AMD Drag and Drop Transcoding
"{4975DE61-6BF6-B9BC-1FDE-C04C5EC78E4C}" = AMD Media Foundation Decoders
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}" = Paint.NET v3.5.10
"{5E03A267-415E-5383-FA8F-3CE4145663B9}" = AMD Catalyst Install Manager
"{68660049-8D48-427C-9FF7-139D8340CDC0}" = MSVC80_x64
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{833F5E6D-6E01-11D1-978E-6DFBCEF72570}" = AMD Steady Video Plug-In
"{89EE4A30-080F-2C95-6F78-C98D18FBD74D}" = AMD Accelerated Video Transcoding
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{9CF11D16-ECEB-90A5-A028-CA9E068D848B}" = ccc-utility64
"{A7C8BBDE-FE98-11E1-87C9-F04DA23A5C58}" = Vegas Pro 12.0 (64-bit)
"{AB085680-FE98-11E1-A232-F04DA23A5C58}" = MSVCRT Redists
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.1031
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.23.1
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{D70884EA-E2CE-4539-91DB-4766CC1E5F5F}" = Apple Mobile Device Support
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"ASRock App Charger_is1" = ASRock App Charger v1.0.5
"CCleaner" = CCleaner
"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"GIMP-2_is1" = GIMP 2.8.2
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Recuva" = Recuva
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Unlocker" = Unlocker 1.9.1-x64
"VLC media player" = VLC media player 2.0.2
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{01386D1F-ADE7-43B4-A4E9-312FC5BC726F}_is1" = SWF Opener
"{017F8447-2A1D-0DDB-B5D7-CA2BFACE2886}" = CCC Help French
"{054E9A1C-3EA2-C657-E787-FD8DCF5C3D3B}" = CCC Help Czech
"{0C973594-7DDF-4BD0-84ED-3517F7622037}" = PC Connectivity Solution
"{0CE1A6C0-F3F7-49E6-8F9D-2431F9827441}" = Guitar Hero III
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{106B4413-ACBB-4CDE-8707-587DB9BD77EC}" = LogMeIn Hamachi
"{1111706F-666A-4037-7777-210328764D10}" = JavaFX 2.1.0
"{1DE2BD51-0300-772D-5E18-F337D95D5687}" = CCC Help German
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20E23A40-38E5-4DD6-B738-BC8097AE66B6}_is1" = FTL version 1.03.1
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{224E8FEB-5C1F-077F-6FC5-602AC1AE644D}" = CCC Help Danish
"{259C0ABB-A3B2-4D70-008F-BF7EE491B70B}" = Need for Speed™ Carbon
"{26A24AE4-039D-4CA4-87B4-2F83217004FF}" = Java(TM) 7 Update 4
"{275E9C49-C72F-D754-DEB7-77F10A9C00D8}" = CCC Help Japanese
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{30049739-BE95-6591-B504-E6D7057D49CC}" = CCC Help Spanish
"{3F1EB155-F96E-EB7B-2EF2-7375490E0FA9}" = CCC Help English
"{45410935-B52C-468A-A836-0D1000018201}" = BulletStorm
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B023D7B-9E67-795D-FB31-B5E1F6DCA451}" = CCC Help Italian
"{4DE63AC8-5FF0-4D3C-B7F5-60AD9045E9E3}" = BF3 Colour Tweaker
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{52D02A2B-03D2-4E34-A358-DC5D951FD296}" = Nokia Connectivity Cable Driver
"{55F6C486-8C75-2A72-DAFE-CE78A624C9F7}" = CCC Help Russian
"{5AF23993-7152-1620-E43F-1B4542FB4F84}" = CCC Help Thai
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{63326924-3CAF-C858-3A8F-8598C87019D7}" = AMD VISION Engine Control Center
"{63822E89-11AA-F8EC-D433-F72A85799EC0}" = CCC Help Greek
"{64BFBE7A-886C-4CA2-A9B4-0C2B5A5942BC}" = Battlefield 3™
"{66361420-4905-AEB8-17AE-172FDD164A7E}" = CCC Help Polish
"{6D316D67-DA52-4659-9C98-F479963534D6}" = Audiosurf
"{6E19AEFD-7F83-4563-A7B5-F61CABF02400}" = DayZ Commander
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72E80496-C446-4389-B4F2-CC46DF704A7F}" = Terrafirma
"{74292F90-895A-4FC6-A692-9641532B1B63}" = ArcSoft TotalMedia 3.5
"{769F2A4B-84A3-9486-ADD2-9E5AB4B4E1E3}" = Catalyst Control Center InstallProxy
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7FA1DAFD-AF55-E915-FD92-F269443A2ADF}" = Media Go Video Playback Engine 1.88.114.12060
"{835D562C-B72C-461D-A9C3-B8206B66E85A}" = RPG Maker VX Ace
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8773DD1C-5FB2-95B5-5A93-0EFEAC900A4D}" = CCC Help Norwegian
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}" = NVIDIA PhysX
"{8CCBB0BF-9CC1-1A65-BB93-56012A460EE6}" = CCC Help Portuguese
"{8FB1B528-E260-451E-9B55-E9152F94B80B}" = Microsoft Games for Windows - LIVE Redistributable
"{90140011-0062-0407-0000-0000000FF1CE}" = Microsoft Office Home and Business 2010 - Deutsch
"{909F8EBC-EC7F-48FF-0085-475D818F0F31}" = Need for Speed Underground 2
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{95140000-00AF-0407-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D15E813-0C26-41E7-ABC5-3EB06FF1B3CF}" = Assassin's Creed III 1.01
"{9DF0196F-B6B8-4C3A-8790-DE42AA530101}" = SPORE™
"{A0A3CE05-96CB-52E9-434E-074F3BB7807E}" = CCC Help Turkish
"{A2S166A0-F031-4E27-A057-C69733219434}_is1" = TERA
"{A9C64319-932F-D02B-B14C-FFFC3EC49E77}" = CCC Help Chinese Standard
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.3
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C09DB932-7619-7B56-30E3-C0454811D6D7}" = CCC Help Korean
"{C22A4697-BD77-ACB1-744F-1FD0A0BFF798}" = CCC Help Swedish
"{CCE825DB-347A-4004-A186-5F4A6FDD8547}" = Apple Application Support
"{D4B457B2-260F-C561-CA87-703BD3B724CA}" = Catalyst Control Center Graphics Previews Common
"{D6CDB506-297D-AE70-0EF6-DE5185F961BE}" = CCC Help Chinese Traditional
"{DBF1AE39-DA30-4B89-A7EB-3BDA675C5D9E}" = Media Go
"{DDBB7C89-1A09-441E-AA0F-6AA465755C17}" = REALTEK DTV USB DEVICE
"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding
"{E3B9C5A9-BD7A-4B56-B754-FAEA7DD6FA88}" = Far Cry 3
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E5F05232-96B6-4552-A480-785A60A94B21}" = System Requirements Lab CYRI
"{E913F678-7BAC-4C3D-A8ED-C19E13D3BAD0}" = DayZ Commander
"{ECFD508E-68A2-91B2-46DD-1D03D783D94B}" = Catalyst Control Center Localization All
"{EDE361D5-35A5-DA7D-3462-C3DABD24029B}" = CCC Help Hungarian
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F1E7DD6A-AE2D-D706-BEB3-937F76CA6AE9}" = CCC Help Finnish
"{F56F54DD-BCB2-1221-2CB7-E983A5CF9D15}" = CCC Help Dutch
"{F97E3841-CA9D-4964-9D64-26066241D26F}" = Microsoft Games for Windows - LIVE
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"0630-0716-3135-7887" = JDownloader 2
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Avira AntiVir Desktop" = Avira Free Antivirus
"Battlelog Web Plugins" = Battlelog Web Plugins
"BattlEye for OA" = BattlEye for OA Uninstall
"BitTorrent" = BitTorrent
"Borderlands 2_is1" = Borderlands 2
"Call of Duty Modern Warfare 2_is1" = Call of Duty Modern Warfare 2
"Cheat Engine 6.2_is1" = Cheat Engine 6.2
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"ESN Sonar-0.70.4" = ESN Sonar
"Fraps" = Fraps (remove only)
"Free Video to DVD Converter_is1" = Free Video to DVD Converter version 5.0.22.128
"ImgBurn" = ImgBurn
"LogMeIn Hamachi" = LogMeIn Hamachi
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Mozilla Firefox 18.0.2 (x86 de)" = Mozilla Firefox 18.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NCLauncher_GameForge" = NC Launcher (GameForge)
"NoIPDUC" = No-IP DUC
"Notepad++" = Notepad++
"Novo's Easy WoW Server 0.4.3" = Novo's Easy WoW Server 0.4.3
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"SkypePlayer" = Skype Audio Player (remove only)
"ST6UNST #1" = Visual Basic 6.0 Runtime&Steuerelemente
"StarCraft II" = StarCraft II
"Steam App 105600" = Terraria
"Steam App 113200" = The Binding of Isaac
"Steam App 12900" = Audiosurf
"Steam App 212370" = Arctic Combat
"Steam App 219540" = ARMA 2: Operation Arrowhead Beta
"Steam App 226700" = The War Z
"Steam App 33910" = ARMA 2
"Steam App 33930" = ARMA 2: Operation Arrowhead
"Steam App 3590" = Plants vs. Zombies: Game of the Year
"TeamViewer 7" = TeamViewer 7
"TechPowerUp GPU-Z" = TechPowerUp GPU-Z
"TechPowerUp OSD Server" = TechPowerUp OSD Server
"Universal Extractor_is1" = Universal Extractor 1.6.1
"Uplay" = Uplay
"uTorrent" = µTorrent
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 2.0.3
"WinPcapInst" = WinPcap 4.1.2
"World of Warcraft" = World of Warcraft
"World of Warcraft Public Test" = World of Warcraft Public Test
"XFast USB" = XFast USB
"zebNet Windows Keyfinder 2012 R24.0.0" = zebNet Windows Keyfinder 2012 R2
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-4149896342-1631694950-3810678737-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f58f3889281ea80b" = ContainerEx Decrypter
"Google Chrome" = Google Chrome
"Guild Wars" = GUILD WARS
"SOE-C:/Users/Michael/AppData/Local/Sony Online Entertainment/ApplicationUpdater" = applicationupdater
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 20.02.2013 09:43:03 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError.
 
Error - 20.02.2013 11:47:25 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError.
 
Error - 21.02.2013 09:27:48 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError.
 
Error - 22.02.2013 11:08:40 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError.
 
Error - 22.02.2013 11:51:26 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError.
 
Error - 23.02.2013 08:01:19 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError.
 
Error - 23.02.2013 16:34:12 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError.
 
Error - 23.02.2013 17:34:47 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError.
 
Error - 23.02.2013 18:23:14 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError.
 
Error - 25.02.2013 09:28:54 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError.
 
[ System Events ]
Error - 13.11.2012 09:01:13 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7038
Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"
 mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:  %%1330    Vergewissern
 Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
 Management Console (MMC).
 
Error - 13.11.2012 09:01:13 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1069
 
Error - 13.11.2012 09:27:55 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "WebcamMax, WDM Video Capture" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1058
 
Error - 13.11.2012 09:30:09 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7038
Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"
 mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:  %%1330    Vergewissern
 Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
 Management Console (MMC).
 
Error - 13.11.2012 09:30:09 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1069
 
Error - 13.11.2012 09:38:03 | Computer Name = Michael-PC | Source = VDS Basic Provider | ID = 33554433
Description =
 
Error - 13.11.2012 09:41:13 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "WebcamMax, WDM Video Capture" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1058
 
Error - 13.11.2012 09:43:20 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7038
Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"
 mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:  %%1330    Vergewissern
 Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
 Management Console (MMC).
 
Error - 13.11.2012 09:43:20 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1069
 
Error - 14.11.2012 09:16:06 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "WebcamMax, WDM Video Capture" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1058
 
 
< End of report >

cosinus 25.02.2013 15:11
Zitat:
Log Files von Avira hab ich leider nicht...
Wieso bitte hast du die nicht?
Würdest du bitte mal nachsehen?

http://img.trojaner-board.de/alle-lo...-alle-logs.png

Guadeno 25.02.2013 16:08
Die gefundenen Dateien sind alles Dateien aus dem Temp Ordner (Siehe meinen etwas älteren ersten Thread hier), mit ziemlich willkürlichen Namen.
http://www.abload.de/img/unbenanntxsona.png

Ich glaube aber nicht, dass es an denen liegt, da ich die schon "immer" hab Oo
Naja, stören mich aber nicht.

Problem ist halt, dass ich keine Windows Updates mehr laden kann und verschiedene Dienste gelöscht wurden.

cosinus 25.02.2013 16:20
Warum postest du die Ereignisse von Avira nicht so wie es in der Anleitung steht?!

Guadeno 25.02.2013 17:37
Wozu?
Da steht einfach nur: Malware gefunden.
Und mehr nicht! Wo sollen diese Informationen bitte helfen?

cosinus 26.02.2013 00:14
Es geht darum, dass die Logs grundsätzlich in einem vernünftigen Textformat gepostet werden!
Wir verfassen nicht umsonst die Anleitungen so ud nicht deswegen weil sonst jeder meint er kann alles posten wir er gerade lustig ist!

Also poste bitte die Logs so wie es als Format gewünscht wird, du willst Hilfe und nicht wir!

Guadeno 26.02.2013 18:54
Code:
Exportierte Ereignisse:

23.02.2013 17:18 [System Scanner] Malware gefunden
      Die Datei 'C:\Users\Michael\AppData\Local\Temp\T0QKVCFLMq.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.MSIL.Gen' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7818a99a.qua'
      verschoben!

23.02.2013 17:18 [System Scanner] Malware gefunden
      Die Datei 'C:\Users\Michael\AppData\Local\Temp\XMAHn0J3bp.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.MSIL.Gen' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1e1fe7bc.qua'
      verschoben!

23.02.2013 17:18 [System Scanner] Malware gefunden
      Die Datei 'C:\Users\Michael\AppData\Local\Temp\Mb53p9moB8.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.MSIL.Gen' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3db88556.qua'
      verschoben!

23.02.2013 17:18 [System Scanner] Malware gefunden
      Die Datei 'C:\Users\Michael\AppData\Local\Temp\cXTFDWTM0r.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.MSIL.Gen' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4280b73d.qua'
      verschoben!

23.02.2013 17:18 [System Scanner] Malware gefunden
      Die Datei 'C:\Users\Michael\AppData\Local\Temp\yq9Jiq137Z.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.MSIL.Gen' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4c58bd70.qua'
      verschoben!
Zufrieden?
Da steht das selbe drin wie auf den obigen Screenshots...

cosinus 26.02.2013 23:42
Ja, so ist es besser. Und das Exportieren hat gleich nochmal zwei Vorteile: ich kann es wenn nötig copy&pasten und wie du siehst zeigt es zwei mehr Zecken an

Und nein sowas hat man nicht immer, nur weil etwas in TEMP liegt ist das nicht automatisch legitim, sowas hat man auch nicht immer sondern derartige in TEMP nur wenn man seinen Rechner versaut hat

Bitte nun Logs mit GMER (<<< klick für Anleitung) und MBAR (Anleitung etwas weiter unten) erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim zweiten Mal nicht will, lass es einfach weg und führ nur MBAR aus.

Anleitung MBAR:

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Guadeno 28.02.2013 16:32
GMER:
Code:
GMER 2.1.19115 - hxxp://www.gmer.net
Rootkit scan 2013-02-28 15:49:05
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST3500418AS rev.CC38 465,76GB
Running: gmer_2.1.19115.exe; Driver: C:\Users\Michael\AppData\Local\Temp\uwliifow.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                        00000000749e1465 2 bytes [9E, 74]
.text  C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                      00000000749e14bb 2 bytes [9E, 74]
.text  ...                                                                                                                                                                                                                                  * 2
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2024] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                                                                                                              00000000729f1a22 2 bytes [9F, 72]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2024] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                                                                                                              00000000729f1ad0 2 bytes [9F, 72]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2024] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                                                                                                              00000000729f1b08 2 bytes [9F, 72]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2024] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                                                                                                              00000000729f1bba 2 bytes [9F, 72]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2024] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                                                                                                              00000000729f1bda 2 bytes [9F, 72]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2024] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                        00000000749e1465 2 bytes [9E, 74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2024] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                      00000000749e14bb 2 bytes [9E, 74]
.text  ...                                                                                                                                                                                                                                  * 2
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[1840] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                  00000000749e1465 2 bytes [9E, 74]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[1840] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                00000000749e14bb 2 bytes [9E, 74]
.text  ...                                                                                                                                                                                                                                  * 2
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[4084] C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe!?SparseBitMask@DataSourceDescription@FlexUI@@2HB + 960  000000002df25984 4 bytes [34, F4, 56, 56]
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[4084] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                    00000000749e1465 2 bytes [9E, 74]
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[4084] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                    00000000749e14bb 2 bytes [9E, 74]
.text  ...                                                                                                                                                                                                                                  * 2
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtClose                                                                                                000000007719f9c0 5 bytes JMP 000000016d555f49
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtQueryObject                                                                                          000000007719f9d8 5 bytes JMP 000000016d556411
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey                                                                                              000000007719fa08 5 bytes JMP 000000016d55016d
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateValueKey                                                                                    000000007719fa20 5 bytes JMP 000000016d54fbca
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtQueryKey                                                                                            000000007719fa70 5 bytes JMP 000000016d54fa44
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey                                                                                        000000007719fa88 2 bytes JMP 000000016d54fb52
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey + 3                                                                                    000000007719fa8b 2 bytes [3B, F6]
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey                                                                                            000000007719fb20 5 bytes JMP 000000016d550424
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                                  000000007719fc18 5 bytes JMP 000000016d554369
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateKey                                                                                        000000007719fd2c 5 bytes JMP 000000016d54f9cc
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                                            000000007719fd44 5 bytes JMP 000000016d554959
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile                                                                                  000000007719fd78 5 bytes JMP 000000016d5539de
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject                                                                                      000000007719fe24 5 bytes JMP 000000016d555fc4
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile                                                                                  000000007719fe3c 5 bytes JMP 000000016d554adb
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                          00000000771a0094 5 bytes JMP 000000016d554791
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                          00000000771a01a4 5 bytes JMP 000000016d54fc42
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtDeleteFile                                                                                          00000000771a09c4 5 bytes JMP 000000016d554584
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtDeleteKey                                                                                            00000000771a09dc 5 bytes JMP 000000016d54cc5b
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                                      00000000771a0a24 5 bytes JMP 000000016d54cd29
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtFlushKey                                                                                            00000000771a0b60 5 bytes JMP 000000016d54ccc2
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeKey                                                                                      00000000771a0f50 5 bytes JMP 000000016d54fcba
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeMultipleKeys                                                                            00000000771a0f68 5 bytes JMP 000000016d54ff45
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyEx                                                                                            00000000771a0ff8 5 bytes JMP 000000016d5501fd
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile                                                                              00000000771a131c 5 bytes JMP 000000016d554b6b
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtQueryMultipleValueKey                                                                                00000000771a145c 5 bytes JMP 000000016d54fec9
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtQuerySecurityObject                                                                                  00000000771a1508 5 bytes JMP 000000016d556389
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtRenameKey                                                                                            00000000771a16f8 1 byte JMP 000000016d54d138
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtRenameKey + 2                                                                                        00000000771a16fa 3 bytes {JMP 0xfffffffff63aba40}
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationKey                                                                                    00000000771a1a38 5 bytes JMP 000000016d54facc
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtSetSecurityObject                                                                                    00000000771a1b7c 5 bytes JMP 000000016d55616c
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!CreateProcessW                                                                                      0000000075c0103d 5 bytes JMP 000000016d5293a9
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!CreateProcessA                                                                                      0000000075c01072 5 bytes JMP 000000016d5294e7
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!CreateProcessAsUserW                                                                                0000000075c2c9b5 5 bytes JMP 000000016d52971d
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!SetDllDirectoryW                                                                                    0000000075c800c3 5 bytes JMP 000000016d529efe
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!SetDllDirectoryA                                                                                    0000000075c8016b 5 bytes JMP 000000016d52a231
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!WinExec                                                                                            0000000075c82c91 5 bytes JMP 000000016d529aa0
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!AllocConsole                                                                                        0000000075ca6b3e 3 bytes JMP 000000016d557431
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!AllocConsole + 4                                                                                    0000000075ca6b42 1 byte [F7]
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!AttachConsole                                                                                      0000000075ca6c02 3 bytes JMP 000000016d557443
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!AttachConsole + 4                                                                                  0000000075ca6c06 1 byte [F7]
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                    0000000076592aa4 5 bytes JMP 000000016d52a43c
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                                      0000000075d18a29 5 bytes JMP 000000016d557419
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\USER32.dll!CreateWindowExA                                                                                      0000000075d1d22e 5 bytes JMP 000000016d557401
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\GDI32.dll!AddFontResourceW                                                                                      00000000767dd2b2 5 bytes JMP 000000016d537617
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\GDI32.dll!AddFontResourceA                                                                                      00000000767dd7bb 5 bytes JMP 000000016d5375fb
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!EnumDependentServicesW                                                                              00000000762c1e3a 7 bytes JMP 000000016d53a3b9
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!EnumServicesStatusExW                                                                              00000000762cb466 7 bytes JMP 000000016d53b2da
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!GetServiceKeyNameW                                                                                  00000000762e78ff 7 bytes JMP 000000016d53aa60
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!GetServiceDisplayNameW                                                                              00000000762e79bb 7 bytes JMP 000000016d53ac11
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!EnumServicesStatusExA                                                                              00000000762ea3e2 7 bytes JMP 000000016d53b3a0
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserA                                                                                0000000076302538 5 bytes JMP 000000016d52985f
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!GetServiceKeyNameA                                                                                  0000000076321b94 7 bytes JMP 000000016d53ab18
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!GetServiceDisplayNameA                                                                              0000000076321c31 7 bytes JMP 000000016d53acc9
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!EnumServicesStatusA                                                                                0000000076322021 7 bytes JMP 000000016d53b21c
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!EnumDependentServicesA                                                                              0000000076322104 7 bytes JMP 000000016d53a470
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!EnumServicesStatusW                                                                                0000000076322221 5 bytes JMP 000000016d53b15e
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!ControlService                                                                                      0000000075f24d5c 7 bytes JMP 000000016d53a1fe
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!CloseServiceHandle                                                                                  0000000075f24dc3 7 bytes JMP 000000016d53a527
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!QueryServiceStatus                                                                                  0000000075f24e4b 7 bytes JMP 000000016d53a28a
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!QueryServiceStatusEx                                                                                0000000075f24eaf 7 bytes JMP 000000016d53a31d
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!StartServiceW                                                                                        0000000075f24f35 7 bytes JMP 000000016d53a079
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!StartServiceA                                                                                        0000000075f2508d 7 bytes JMP 000000016d53a10f
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!QueryServiceObjectSecurity                                                                          0000000075f250f4 7 bytes JMP 000000016d53b02c
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                                                            0000000075f25181 7 bytes JMP 000000016d53b0c8
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                                                                0000000075f25254 7 bytes JMP 000000016d53a728
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                                                                0000000075f253d5 7 bytes JMP 000000016d53a643
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                                                                0000000075f254c2 7 bytes JMP 000000016d53a9ca
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                                                                0000000075f255e2 7 bytes JMP 000000016d53a934
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                                                                      0000000075f2567c 7 bytes JMP 000000016d539e5b
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                                                                      0000000075f2589f 7 bytes JMP 000000016d539d85
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!DeleteService                                                                                        0000000075f25a22 7 bytes JMP 000000016d53a5b5
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigA                                                                                  0000000075f25a83 7 bytes JMP 000000016d53ae5b
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW                                                                                  0000000075f25b29 7 bytes JMP 000000016d53adc2
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA                                                                                    0000000075f25ca0 7 bytes JMP 000000016d539535
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!ControlServiceExW                                                                                    0000000075f25d8c 7 bytes JMP 000000016d5394bc
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!OpenSCManagerW                                                                                      0000000075f263ad 7 bytes JMP 000000016d539a83
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!OpenSCManagerA                                                                                      0000000075f264f0 7 bytes JMP 000000016d539b0f
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfig2A                                                                                0000000075f26633 7 bytes JMP 000000016d53af90
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfig2W                                                                                0000000075f2680c 7 bytes JMP 000000016d53aef4
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!OpenServiceW                                                                                        0000000075f2714b 7 bytes JMP 000000016d539bf8
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!OpenServiceA                                                                                        0000000075f27245 7 bytes JMP 000000016d539c84
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoRegisterPSClsid                                                                                      00000000759ec56e 5 bytes JMP 000000016d5411c4
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoResumeClassObjects + 7                                                                              00000000759eea09 7 bytes JMP 000000016d541795
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!OleRun                                                                                                00000000759f07de 5 bytes JMP 000000016d541650
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoRegisterClassObject                                                                                  00000000759f21e1 5 bytes JMP 000000016d5422c5
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!OleUninitialize                                                                                        00000000759feba1 6 bytes JMP 000000016d54156f
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!OleInitialize                                                                                          00000000759fefd7 5 bytes JMP 000000016d5414ff
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoGetPSClsid                                                                                          0000000075a026b9 5 bytes JMP 000000016d54133c
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoGetClassObject                                                                                      0000000075a154ad 5 bytes JMP 000000016d542853
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoInitializeEx                                                                                        0000000075a209ad 5 bytes JMP 000000016d5413af
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoUninitialize                                                                                        0000000075a286d3 5 bytes JMP 000000016d541431
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                                      0000000075a29d0b 5 bytes JMP 000000016d543b21
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoCreateInstanceEx                                                                                    0000000075a29d4e 5 bytes JMP 000000016d541c5c
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoSuspendClassObjects + 7                                                                              0000000075a4bb09 7 bytes JMP 000000016d5416c0
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoRevokeClassObject                                                                                    0000000075a6eacf 5 bytes JMP 000000016d540c21
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoGetInstanceFromFile                                                                                  0000000075aa340b 5 bytes JMP 000000016d542d13
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!OleRegEnumFormatEtc                                                                                    0000000075aecfd9 5 bytes JMP 000000016d5415da
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\oleaut32.dll!RegisterActiveObject                                                                                000000007620279e 5 bytes JMP 000000016d540eb4
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\oleaut32.dll!RevokeActiveObject                                                                                  0000000076203294 5 bytes JMP 000000016d540fd5
.text  C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\oleaut32.dll!GetActiveObject                                                                                    0000000076218f40 5 bytes JMP 000000016d541048

---- Devices - GMER 2.1 ----

Device  \Driver\ALSysIO \Device\ALSysIO                                                                                                                                                                                                      fffff88007647170

---- Threads - GMER 2.1 ----

Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [3452:3976]                                                                                                                                                                        000007fefb912a7c
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [3452:3936]                                                                                                                                                                        000007feeb9ad618

---- EOF - GMER 2.1 ----
Mbar hatte 10 Funde, war ca 10-15 Minuten im Herunterfahren... Bildschirm, dann kam ein Blue Screen Oo
Nach einem Neustart dann halt die Frage von Windows ob Abgesichter oder normaler Modus, hab den PC mal normal gestartet und ja, das wars bisher.
Beim zweiten Mbar Scan wurde nichts mehr gefunden.
Die fehlenden Dienste sind immer noch nicht da, bei den Windowsupdates kommt immer noch der selbe Fehler und das Wartungscenter lässt sich immer noch nicht aktivieren.

:(
Tut mir Leid, hab vergessen die Log Datei von Mbar zu posten..
Hab den Ordner schon gelöscht und konnte ihn mit Recuva auch nicht mehr finden :/

cosinus 01.03.2013 09:40
Zitat:
Hab den Ordner schon gelöscht und konnte ihn mit Recuva auch nicht mehr finden :/
Was soll das? :balla:
Wo steht, dass du den Ordner löschen sollst?!
Wie soll ich jetzt analysieren welche Infektionen dieser Rechner hatte??

Guadeno 01.03.2013 14:50
Ich hatte vergessen den Log rauszunehmen!
Und sonst werde ich das Programm ja nie wieder benutzen, deshalb hab ich es gelöscht!

cosinus 01.03.2013 16:01
Woher willst du das wissen? :balla:
Ich hab dich gebeten nur das zu machen was in den Anleitungen steht. So ohne das Log wird keiner mehr wissen können welche Infektionen da beseitigt wurden :stirn:

Guadeno 01.03.2013 16:15
Meine eigentlichen Fragen waren ja:
Wie bekomm ich den Update Fehler weg?
Wie stelle ich wieder die gelöschten Dienste her?

cosinus 01.03.2013 16:23
Darum kümmert man sich wenn man den Rechner wieder bereinigt hat!
Da man aber nicht nicht mehr sehen kann was entfernt wurde mit MBAR wird man schlechtere Möglichkeiten haben deine Kiste vernünftig vernünftig zu putzen!

aswMBR

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).




TDSS-Killer

Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Guadeno 02.03.2013 12:31
aswMBR:
Code:
aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2013-03-02 11:57:31
-----------------------------
11:57:31.724    OS Version: Windows x64 6.1.7601 Service Pack 1
11:57:31.724    Number of processors: 4 586 0x403
11:57:31.724    ComputerName: MICHAEL-PC  UserName: Michael
11:57:34.267    Initialize success
12:10:08.405    AVAST engine defs: 13030100
12:11:18.722    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
12:11:18.722    Disk 0 Vendor: ST3500418AS CC38 Size: 476940MB BusType: 3
12:11:18.742    Disk 0 MBR read successfully
12:11:18.752    Disk 0 MBR scan
12:11:18.752    Disk 0 Windows XP default MBR code
12:11:18.752    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
12:11:18.762    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      476844 MB offset 206848
12:11:18.782    Disk 0 scanning C:\Windows\system32\drivers
12:11:31.344    Service scanning
12:11:55.258    Modules scanning
12:11:55.268    Disk 0 trace - called modules:
12:11:55.288    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
12:11:55.298    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007a02060]
12:11:55.639    3 CLASSPNP.SYS[fffff880019b243f] -> nt!IofCallDriver -> [0xfffffa80075599b0]
12:11:55.649    5 ACPI.sys[fffff88000f4d7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa80079f3060]
12:11:59.290    AVAST engine scan C:\Windows
12:12:01.510    AVAST engine scan C:\Windows\system32
12:15:14.063    AVAST engine scan C:\Windows\system32\drivers
12:15:32.938    AVAST engine scan C:\Users\Michael
12:23:18.140    AVAST engine scan C:\ProgramData
12:28:02.518    Scan finished successfully
12:29:53.394    Disk 0 MBR has been saved successfully to "C:\Users\Michael\Desktop\MBR.dat"
12:29:53.410    The log file has been saved successfully to "C:\Users\Michael\Desktop\aswMBR.txt"
tdsskiller:
Nichts gefunden.

cosinus 02.03.2013 12:42
Die Logs bitte trotzdem immer posten!

Guadeno 02.03.2013 23:49
Code:
12:30:06.0699 0556  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
12:30:06.0902 0556  ============================================================
12:30:06.0902 0556  Current date / time: 2013/03/02 12:30:06.0902
12:30:06.0902 0556  SystemInfo:
12:30:06.0902 0556 
12:30:06.0902 0556  OS Version: 6.1.7601 ServicePack: 1.0
12:30:06.0902 0556  Product type: Workstation
12:30:06.0902 0556  ComputerName: MICHAEL-PC
12:30:06.0917 0556  UserName: Michael
12:30:06.0917 0556  Windows directory: C:\Windows
12:30:06.0917 0556  System windows directory: C:\Windows
12:30:06.0917 0556  Running under WOW64
12:30:06.0917 0556  Processor architecture: Intel x64
12:30:06.0917 0556  Number of processors: 4
12:30:06.0917 0556  Page size: 0x1000
12:30:06.0917 0556  Boot type: Normal boot
12:30:06.0917 0556  ============================================================
12:30:07.0838 0556  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
12:30:07.0838 0556  Drive \Device\Harddisk1\DR1 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
12:30:14.0733 0556  ============================================================
12:30:14.0733 0556  \Device\Harddisk0\DR0:
12:30:14.0733 0556  MBR partitions:
12:30:14.0733 0556  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
12:30:14.0733 0556  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x3A356302
12:30:14.0733 0556  \Device\Harddisk1\DR1:
12:30:14.0733 0556  MBR partitions:
12:30:14.0733 0556  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x74705982
12:30:14.0733 0556  ============================================================
12:30:14.0764 0556  C: <-> \Device\Harddisk0\DR0\Partition2
12:30:14.0780 0556  I: <-> \Device\Harddisk1\DR1\Partition1
12:30:14.0780 0556  ============================================================
12:30:14.0780 0556  Initialize success
12:30:14.0780 0556  ============================================================
12:30:19.0257 2740  ============================================================
12:30:19.0257 2740  Scan started
12:30:19.0257 2740  Mode: Manual;
12:30:19.0257 2740  ============================================================
12:30:20.0255 2740  ================ Scan system memory ========================
12:30:20.0255 2740  System memory - ok
12:30:20.0255 2740  ================ Scan services =============================
12:30:20.0364 2740  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
12:30:20.0380 2740  1394ohci - ok
12:30:20.0458 2740  [ 769DB4F484957CC98153B3C1B5D1162F ] ACDaemon        C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
12:30:20.0458 2740  ACDaemon - ok
12:30:20.0489 2740  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
12:30:20.0505 2740  ACPI - ok
12:30:20.0520 2740  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
12:30:20.0520 2740  AcpiPmi - ok
12:30:20.0598 2740  [ 9942DC4CC265CDA00486504444EF521D ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
12:30:20.0614 2740  AdobeFlashPlayerUpdateSvc - ok
12:30:20.0645 2740  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx        C:\Windows\system32\DRIVERS\adp94xx.sys
12:30:20.0661 2740  adp94xx - ok
12:30:20.0692 2740  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci        C:\Windows\system32\DRIVERS\adpahci.sys
12:30:20.0692 2740  adpahci - ok
12:30:20.0708 2740  [ E109549C90F62FB570B9540C4B148E54 ] adpu320        C:\Windows\system32\DRIVERS\adpu320.sys
12:30:20.0723 2740  adpu320 - ok
12:30:20.0754 2740  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
12:30:20.0754 2740  AeLookupSvc - ok
12:30:20.0817 2740  [ 6CCD1135320109D6B219F1A6E04AD9F6 ] Afc            C:\Windows\syswow64\drivers\Afc.sys
12:30:20.0817 2740  Afc - ok
12:30:20.0879 2740  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD            C:\Windows\system32\drivers\afd.sys
12:30:20.0879 2740  AFD - ok
12:30:20.0910 2740  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys
12:30:20.0926 2740  agp440 - ok
12:30:20.0942 2740  [ 3290D6946B5E30E70414990574883DDB ] ALG            C:\Windows\System32\alg.exe
12:30:20.0942 2740  ALG - ok
12:30:20.0957 2740  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys
12:30:20.0957 2740  aliide - ok
12:30:21.0004 2740  ALSysIO - ok
12:30:21.0035 2740  [ 4EAAAAB8759644D572522FBCDD196A13 ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
12:30:21.0035 2740  AMD External Events Utility - ok
12:30:21.0098 2740  AMD FUEL Service - ok
12:30:21.0129 2740  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys
12:30:21.0129 2740  amdide - ok
12:30:21.0222 2740  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8          C:\Windows\system32\DRIVERS\amdk8.sys
12:30:21.0222 2740  AmdK8 - ok
12:30:21.0425 2740  [ 22A14DF59FB8D0BE918C597988AF4296 ] amdkmdag        C:\Windows\system32\DRIVERS\atikmdag.sys
12:30:21.0581 2740  amdkmdag - ok
12:30:21.0628 2740  [ EE22D3ED6D55A855E709F811CCCA97ED ] amdkmdap        C:\Windows\system32\DRIVERS\atikmpag.sys
12:30:21.0628 2740  amdkmdap - ok
12:30:21.0659 2740  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
12:30:21.0659 2740  AmdPPM - ok
12:30:21.0690 2740  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
12:30:21.0690 2740  amdsata - ok
12:30:21.0706 2740  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
12:30:21.0706 2740  amdsbs - ok
12:30:21.0722 2740  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata        C:\Windows\system32\drivers\amdxata.sys
12:30:21.0722 2740  amdxata - ok
12:30:21.0753 2740  [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
12:30:21.0753 2740  AntiVirSchedulerService - ok
12:30:21.0768 2740  [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
12:30:21.0768 2740  AntiVirService - ok
12:30:21.0800 2740  [ 5A528A540B1AEE8B1C77ED65094E8CDF ] AODDriver4.2    C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys
12:30:21.0800 2740  AODDriver4.2 - ok
12:30:21.0831 2740  [ 89A69C3F2F319B43379399547526D952 ] AppID          C:\Windows\system32\drivers\appid.sys
12:30:21.0831 2740  AppID - ok
12:30:21.0862 2740  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
12:30:21.0862 2740  AppIDSvc - ok
12:30:21.0878 2740  [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo        C:\Windows\System32\appinfo.dll
12:30:21.0878 2740  Appinfo - ok
12:30:21.0924 2740  [ A5299D04ED225D64CF07A568A3E1BF8C ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
12:30:21.0924 2740  Apple Mobile Device - ok
12:30:21.0971 2740  [ 4ABA3E75A76195A3E38ED2766C962899 ] AppMgmt        C:\Windows\System32\appmgmts.dll
12:30:21.0971 2740  AppMgmt - ok
12:30:22.0002 2740  [ C484F8CEB1717C540242531DB7845C4E ] arc            C:\Windows\system32\DRIVERS\arc.sys
12:30:22.0002 2740  arc - ok
12:30:22.0018 2740  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
12:30:22.0018 2740  arcsas - ok
12:30:22.0127 2740  [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
12:30:22.0158 2740  aspnet_state - ok
12:30:22.0174 2740  [ E1AFEE1584C74050DE0DD16DE2A54BF3 ] AsrAppCharger  C:\Windows\system32\DRIVERS\AsrAppCharger.sys
12:30:22.0174 2740  AsrAppCharger - ok
12:30:22.0190 2740  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
12:30:22.0190 2740  AsyncMac - ok
12:30:22.0236 2740  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi          C:\Windows\system32\drivers\atapi.sys
12:30:22.0252 2740  atapi - ok
12:30:22.0314 2740  [ 437F55435623D4D54D36197F5AD8B435 ] AtiHDAudioService C:\Windows\system32\drivers\AtihdW76.sys
12:30:22.0314 2740  AtiHDAudioService - ok
12:30:22.0330 2740  [ 7C5D273E29DCC5505469B299C6F29163 ] AtiPcie        C:\Windows\system32\DRIVERS\AtiPcie.sys
12:30:22.0330 2740  AtiPcie - ok
12:30:22.0392 2740  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
12:30:22.0392 2740  AudioEndpointBuilder - ok
12:30:22.0424 2740  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
12:30:22.0424 2740  AudioSrv - ok
12:30:22.0439 2740  [ 9D1F00BEFF84CBBF46D7F052BC7E0565 ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
12:30:22.0439 2740  avipbb - ok
12:30:22.0455 2740  [ 248DB59FC86DE44D2779F4C7FB1A567D ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
12:30:22.0455 2740  avkmgr - ok
12:30:22.0502 2740  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll
12:30:22.0502 2740  AxInstSV - ok
12:30:22.0533 2740  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv        C:\Windows\system32\DRIVERS\bxvbda.sys
12:30:22.0548 2740  b06bdrv - ok
12:30:22.0580 2740  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
12:30:22.0595 2740  b57nd60a - ok
12:30:22.0626 2740  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll
12:30:22.0642 2740  BDESVC - ok
12:30:22.0642 2740  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
12:30:22.0642 2740  Beep - ok
12:30:22.0720 2740  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE            C:\Windows\System32\bfe.dll
12:30:22.0736 2740  BFE - ok
12:30:22.0767 2740  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
12:30:22.0767 2740  blbdrive - ok
12:30:22.0814 2740  [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
12:30:22.0829 2740  Bonjour Service - ok
12:30:22.0876 2740  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
12:30:22.0876 2740  bowser - ok
12:30:22.0892 2740  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
12:30:22.0892 2740  BrFiltLo - ok
12:30:22.0892 2740  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
12:30:22.0892 2740  BrFiltUp - ok
12:30:22.0938 2740  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser        C:\Windows\System32\browser.dll
12:30:22.0938 2740  Browser - ok
12:30:22.0938 2740  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
12:30:22.0938 2740  Brserid - ok
12:30:22.0938 2740  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
12:30:22.0938 2740  BrSerWdm - ok
12:30:22.0954 2740  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
12:30:22.0954 2740  BrUsbMdm - ok
12:30:22.0954 2740  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
12:30:22.0954 2740  BrUsbSer - ok
12:30:22.0970 2740  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
12:30:22.0970 2740  BTHMODEM - ok
12:30:23.0016 2740  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv        C:\Windows\system32\bthserv.dll
12:30:23.0016 2740  bthserv - ok
12:30:23.0032 2740  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
12:30:23.0032 2740  cdfs - ok
12:30:23.0079 2740  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
12:30:23.0079 2740  cdrom - ok
12:30:23.0126 2740  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc    C:\Windows\System32\certprop.dll
12:30:23.0126 2740  CertPropSvc - ok
12:30:23.0141 2740  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
12:30:23.0141 2740  circlass - ok
12:30:23.0172 2740  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys
12:30:23.0172 2740  CLFS - ok
12:30:23.0219 2740  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
12:30:23.0235 2740  clr_optimization_v2.0.50727_32 - ok
12:30:23.0266 2740  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
12:30:23.0266 2740  clr_optimization_v2.0.50727_64 - ok
12:30:23.0360 2740  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
12:30:23.0375 2740  clr_optimization_v4.0.30319_32 - ok
12:30:23.0391 2740  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
12:30:23.0406 2740  clr_optimization_v4.0.30319_64 - ok
12:30:23.0422 2740  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
12:30:23.0422 2740  CmBatt - ok
12:30:23.0469 2740  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys
12:30:23.0469 2740  cmdide - ok
12:30:23.0531 2740  [ AAFCB52FE0037207FB6FBEA070D25EFE ] CNG            C:\Windows\system32\Drivers\cng.sys
12:30:23.0531 2740  CNG - ok
12:30:23.0562 2740  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
12:30:23.0562 2740  Compbatt - ok
12:30:23.0609 2740  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
12:30:23.0609 2740  CompositeBus - ok
12:30:23.0625 2740  COMSysApp - ok
12:30:23.0640 2740  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk        C:\Windows\system32\DRIVERS\crcdisk.sys
12:30:23.0656 2740  crcdisk - ok
12:30:23.0687 2740  [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc        C:\Windows\system32\cryptsvc.dll
12:30:23.0687 2740  CryptSvc - ok
12:30:23.0718 2740  [ 54DA3DFD29ED9F1619B6F53F3CE55E49 ] CSC            C:\Windows\system32\drivers\csc.sys
12:30:23.0765 2740  CSC - ok
12:30:23.0812 2740  [ 3AB183AB4D2C79DCF459CD2C1266B043 ] CscService      C:\Windows\System32\cscsvc.dll
12:30:23.0843 2740  CscService - ok
12:30:23.0937 2740  [ 72794D112CBAFF3BC0C29BF7350D4741 ] cvhsvc          C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
12:30:23.0952 2740  cvhsvc - ok
12:30:24.0030 2740  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll
12:30:24.0046 2740  DcomLaunch - ok
12:30:24.0077 2740  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc      C:\Windows\System32\defragsvc.dll
12:30:24.0077 2740  defragsvc - ok
12:30:24.0108 2740  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
12:30:24.0108 2740  DfsC - ok
12:30:24.0171 2740  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll
12:30:24.0171 2740  Dhcp - ok
12:30:24.0202 2740  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys
12:30:24.0202 2740  discache - ok
12:30:24.0249 2740  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\DRIVERS\disk.sys
12:30:24.0249 2740  Disk - ok
12:30:24.0280 2740  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
12:30:24.0296 2740  Dnscache - ok
12:30:24.0327 2740  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc        C:\Windows\System32\dot3svc.dll
12:30:24.0342 2740  dot3svc - ok
12:30:24.0374 2740  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS            C:\Windows\system32\dps.dll
12:30:24.0389 2740  DPS - ok
12:30:24.0420 2740  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
12:30:24.0420 2740  drmkaud - ok
12:30:24.0436 2740  dump_wmimmc - ok
12:30:24.0498 2740  [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
12:30:24.0514 2740  DXGKrnl - ok
12:30:24.0545 2740  EagleX64 - ok
12:30:24.0561 2740  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost        C:\Windows\System32\eapsvc.dll
12:30:24.0576 2740  EapHost - ok
12:30:24.0701 2740  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv          C:\Windows\system32\DRIVERS\evbda.sys
12:30:24.0764 2740  ebdrv - ok
12:30:24.0795 2740  [ C118A82CD78818C29AB228366EBF81C3 ] EFS            C:\Windows\System32\lsass.exe
12:30:24.0795 2740  EFS - ok
12:30:24.0857 2740  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
12:30:24.0873 2740  ehRecvr - ok
12:30:24.0904 2740  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched        C:\Windows\ehome\ehsched.exe
12:30:24.0904 2740  ehSched - ok
12:30:24.0951 2740  [ A05FC7ECA0966EBB70E4D17B855A853B ] ElbyCDIO        C:\Windows\system32\Drivers\ElbyCDIO.sys
12:30:24.0951 2740  ElbyCDIO - ok
12:30:24.0998 2740  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor        C:\Windows\system32\DRIVERS\elxstor.sys
12:30:25.0013 2740  elxstor - ok
12:30:25.0029 2740  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys
12:30:25.0029 2740  ErrDev - ok
12:30:25.0060 2740  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem    C:\Windows\system32\es.dll
12:30:25.0076 2740  EventSystem - ok
12:30:25.0107 2740  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat          C:\Windows\system32\drivers\exfat.sys
12:30:25.0107 2740  exfat - ok
12:30:25.0122 2740  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat        C:\Windows\system32\drivers\fastfat.sys
12:30:25.0138 2740  fastfat - ok
12:30:25.0185 2740  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax            C:\Windows\system32\fxssvc.exe
12:30:25.0200 2740  Fax - ok
12:30:25.0216 2740  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
12:30:25.0216 2740  fdc - ok
12:30:25.0232 2740  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost        C:\Windows\system32\fdPHost.dll
12:30:25.0232 2740  fdPHost - ok
12:30:25.0232 2740  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
12:30:25.0247 2740  FDResPub - ok
12:30:25.0247 2740  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
12:30:25.0247 2740  FileInfo - ok
12:30:25.0263 2740  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
12:30:25.0263 2740  Filetrace - ok
12:30:25.0263 2740  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
12:30:25.0263 2740  flpydisk - ok
12:30:25.0294 2740  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
12:30:25.0294 2740  FltMgr - ok
12:30:25.0310 2740  [ 508401A63E6B1CBF0B9C9A011498731F ] FNETTBOH_305    C:\Windows\system32\drivers\FNETTBOH_305.SYS
12:30:25.0325 2740  FNETTBOH_305 - ok
12:30:25.0341 2740  [ 7C3C4B4C951EC1BDFD4F769D05E2CC68 ] FNETURPX        C:\Windows\system32\drivers\FNETURPX.SYS
12:30:25.0341 2740  FNETURPX - ok
12:30:25.0372 2740  [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache      C:\Windows\system32\FntCache.dll
12:30:25.0388 2740  FontCache - ok
12:30:25.0434 2740  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
12:30:25.0434 2740  FontCache3.0.0.0 - ok
12:30:25.0450 2740  [ D43703496149971890703B4B1B723EAC ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
12:30:25.0466 2740  FsDepends - ok
12:30:25.0481 2740  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
12:30:25.0481 2740  Fs_Rec - ok
12:30:25.0528 2740  [ 1F7B25B858FA27015169FE95E54108ED ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
12:30:25.0544 2740  fvevol - ok
12:30:25.0575 2740  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
12:30:25.0575 2740  gagp30kx - ok
12:30:25.0622 2740  [ 8E98D21EE06192492A5671A6144D092F ] GEARAspiWDM    C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
12:30:25.0622 2740  GEARAspiWDM - ok
12:30:25.0684 2740  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc          C:\Windows\System32\gpsvc.dll
12:30:25.0700 2740  gpsvc - ok
12:30:25.0731 2740  [ 1E6438D4EA6E1174A3B3B1EDC4DE660B ] hamachi        C:\Windows\system32\DRIVERS\hamachi.sys
12:30:25.0731 2740  hamachi - ok
12:30:25.0856 2740  [ 785FD63B74B30986A9F2C7D965CA509F ] Hamachi2Svc    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
12:30:25.0887 2740  Hamachi2Svc - ok
12:30:25.0902 2740  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
12:30:25.0902 2740  hcw85cir - ok
12:30:25.0965 2740  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
12:30:25.0965 2740  HdAudAddService - ok
12:30:26.0012 2740  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
12:30:26.0012 2740  HDAudBus - ok
12:30:26.0027 2740  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt        C:\Windows\system32\DRIVERS\HidBatt.sys
12:30:26.0027 2740  HidBatt - ok
12:30:26.0027 2740  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
12:30:26.0027 2740  HidBth - ok
12:30:26.0027 2740  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr          C:\Windows\system32\DRIVERS\hidir.sys
12:30:26.0027 2740  HidIr - ok
12:30:26.0043 2740  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv        C:\Windows\system32\hidserv.dll
12:30:26.0043 2740  hidserv - ok
12:30:26.0090 2740  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
12:30:26.0090 2740  HidUsb - ok
12:30:26.0121 2740  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll
12:30:26.0121 2740  hkmsvc - ok
12:30:26.0168 2740  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
12:30:26.0168 2740  HomeGroupListener - ok
12:30:26.0199 2740  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
12:30:26.0199 2740  HomeGroupProvider - ok
12:30:26.0214 2740  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
12:30:26.0214 2740  HpSAMD - ok
12:30:26.0308 2740  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
12:30:26.0324 2740  HTTP - ok
12:30:26.0355 2740  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
12:30:26.0355 2740  hwpolicy - ok
12:30:26.0402 2740  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
12:30:26.0402 2740  i8042prt - ok
12:30:26.0464 2740  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
12:30:26.0464 2740  iaStorV - ok
12:30:26.0511 2740  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc          C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
12:30:26.0526 2740  idsvc - ok
12:30:26.0542 2740  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp          C:\Windows\system32\DRIVERS\iirsp.sys
12:30:26.0542 2740  iirsp - ok
12:30:26.0604 2740  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll
12:30:26.0620 2740  IKEEXT - ok
12:30:26.0620 2740  IntcAzAudAddService - ok
12:30:26.0651 2740  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys
12:30:26.0651 2740  intelide - ok
12:30:26.0667 2740  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
12:30:26.0667 2740  intelppm - ok
12:30:26.0682 2740  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
12:30:26.0682 2740  IPBusEnum - ok
12:30:26.0698 2740  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
12:30:26.0698 2740  IpFilterDriver - ok
12:30:26.0760 2740  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
12:30:26.0760 2740  IPMIDRV - ok
12:30:26.0776 2740  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
12:30:26.0792 2740  IPNAT - ok
12:30:26.0838 2740  [ 0F261EC4F514926177C70C1832374231 ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe
12:30:26.0838 2740  iPod Service - ok
12:30:26.0870 2740  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
12:30:26.0870 2740  IRENUM - ok
12:30:26.0885 2740  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
12:30:26.0885 2740  isapnp - ok
12:30:26.0916 2740  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
12:30:26.0932 2740  iScsiPrt - ok
12:30:26.0948 2740  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
12:30:26.0948 2740  kbdclass - ok
12:30:26.0994 2740  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
12:30:26.0994 2740  kbdhid - ok
12:30:27.0010 2740  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe
12:30:27.0010 2740  KeyIso - ok
12:30:27.0057 2740  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
12:30:27.0057 2740  KSecDD - ok
12:30:27.0104 2740  [ 7EFB9333E4ECCE6AE4AE9D777D9E553E ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
12:30:27.0104 2740  KSecPkg - ok
12:30:27.0135 2740  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk        C:\Windows\system32\drivers\ksthunk.sys
12:30:27.0135 2740  ksthunk - ok
12:30:27.0166 2740  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm          C:\Windows\system32\msdtckrm.dll
12:30:27.0182 2740  KtmRm - ok
12:30:27.0228 2740  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\system32\srvsvc.dll
12:30:27.0228 2740  LanmanServer - ok
12:30:27.0275 2740  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
12:30:27.0275 2740  LanmanWorkstation - ok
12:30:27.0306 2740  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
12:30:27.0306 2740  lltdio - ok
12:30:27.0338 2740  [ C1185803384AB3FEED115F79F109427F ] lltdsvc        C:\Windows\System32\lltdsvc.dll
12:30:27.0338 2740  lltdsvc - ok
12:30:27.0353 2740  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts        C:\Windows\System32\lmhsvc.dll
12:30:27.0369 2740  lmhosts - ok
12:30:27.0400 2740  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
12:30:27.0400 2740  LSI_FC - ok
12:30:27.0416 2740  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS        C:\Windows\system32\DRIVERS\lsi_sas.sys
12:30:27.0416 2740  LSI_SAS - ok
12:30:27.0416 2740  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
12:30:27.0416 2740  LSI_SAS2 - ok
12:30:27.0431 2740  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
12:30:27.0447 2740  LSI_SCSI - ok
12:30:27.0462 2740  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv          C:\Windows\system32\drivers\luafv.sys
12:30:27.0462 2740  luafv - ok
12:30:27.0494 2740  [ 0C85B2B6FB74B36A251792D45E0EF860 ] LVRS64          C:\Windows\system32\DRIVERS\lvrs64.sys
12:30:27.0509 2740  LVRS64 - ok
12:30:27.0603 2740  [ FF3A488924B0032B1A9CA6948C1FA9E8 ] LVUVC64        C:\Windows\system32\DRIVERS\lvuvc64.sys
12:30:27.0634 2740  LVUVC64 - ok
12:30:27.0650 2740  MBfilt - ok
12:30:27.0681 2740  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
12:30:27.0681 2740  Mcx2Svc - ok
12:30:27.0712 2740  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas        C:\Windows\system32\DRIVERS\megasas.sys
12:30:27.0712 2740  megasas - ok
12:30:27.0728 2740  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
12:30:27.0728 2740  MegaSR - ok
12:30:27.0743 2740  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS          C:\Windows\system32\mmcss.dll
12:30:27.0743 2740  MMCSS - ok
12:30:27.0759 2740  [ 800BA92F7010378B09F9ED9270F07137 ] Modem          C:\Windows\system32\drivers\modem.sys
12:30:27.0759 2740  Modem - ok
12:30:27.0806 2740  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
12:30:27.0806 2740  monitor - ok
12:30:27.0837 2740  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
12:30:27.0837 2740  mouclass - ok
12:30:27.0852 2740  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
12:30:27.0852 2740  mouhid - ok
12:30:27.0868 2740  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
12:30:27.0868 2740  mountmgr - ok
12:30:27.0899 2740  [ 5C5E45DDABEFBC9F564F1D5C83258B8F ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
12:30:27.0899 2740  MozillaMaintenance - ok
12:30:27.0915 2740  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys
12:30:27.0915 2740  mpio - ok
12:30:27.0930 2740  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
12:30:27.0930 2740  mpsdrv - ok
12:30:27.0993 2740  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll
12:30:28.0024 2740  MpsSvc - ok
12:30:28.0040 2740  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
12:30:28.0040 2740  MRxDAV - ok
12:30:28.0071 2740  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
12:30:28.0071 2740  mrxsmb - ok
12:30:28.0086 2740  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
12:30:28.0086 2740  mrxsmb10 - ok
12:30:28.0102 2740  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
12:30:28.0102 2740  mrxsmb20 - ok
12:30:28.0133 2740  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys
12:30:28.0133 2740  msahci - ok
12:30:28.0149 2740  [ DB801A638D011B9633829EB6F663C900 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
12:30:28.0149 2740  msdsm - ok
12:30:28.0180 2740  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC          C:\Windows\System32\msdtc.exe
12:30:28.0180 2740  MSDTC - ok
12:30:28.0211 2740  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
12:30:28.0211 2740  Msfs - ok
12:30:28.0211 2740  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
12:30:28.0211 2740  mshidkmdf - ok
12:30:28.0258 2740  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
12:30:28.0258 2740  msisadrv - ok
12:30:28.0305 2740  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
12:30:28.0305 2740  MSiSCSI - ok
12:30:28.0305 2740  msiserver - ok
12:30:28.0320 2740  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
12:30:28.0320 2740  MSKSSRV - ok
12:30:28.0336 2740  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
12:30:28.0336 2740  MSPCLOCK - ok
12:30:28.0336 2740  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
12:30:28.0336 2740  MSPQM - ok
12:30:28.0367 2740  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
12:30:28.0367 2740  MsRPC - ok
12:30:28.0398 2740  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
12:30:28.0398 2740  mssmbios - ok
12:30:28.0414 2740  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
12:30:28.0414 2740  MSTEE - ok
12:30:28.0414 2740  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
12:30:28.0414 2740  MTConfig - ok
12:30:28.0445 2740  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup            C:\Windows\system32\Drivers\mup.sys
12:30:28.0445 2740  Mup - ok
12:30:28.0476 2740  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll
12:30:28.0476 2740  napagent - ok
12:30:28.0492 2740  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
12:30:28.0492 2740  NativeWifiP - ok
12:30:28.0539 2740  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\Windows\system32\drivers\ndis.sys
12:30:28.0539 2740  NDIS - ok
12:30:28.0554 2740  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
12:30:28.0554 2740  NdisCap - ok
12:30:28.0570 2740  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
12:30:28.0570 2740  NdisTapi - ok
12:30:28.0601 2740  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
12:30:28.0601 2740  Ndisuio - ok
12:30:28.0632 2740  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
12:30:28.0632 2740  NdisWan - ok
12:30:28.0695 2740  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
12:30:28.0695 2740  NDProxy - ok
12:30:28.0742 2740  [ C480AF85B4DD4E87BD6B115692DD7948 ] Neo_VPN        C:\Windows\system32\DRIVERS\Neo_0023.sys
12:30:28.0742 2740  Neo_VPN - ok
12:30:28.0804 2740  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
12:30:28.0804 2740  NetBIOS - ok
12:30:28.0835 2740  [ 09594D1089C523423B32A4229263F068 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
12:30:28.0835 2740  NetBT - ok
12:30:28.0851 2740  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe
12:30:28.0851 2740  Netlogon - ok
12:30:28.0882 2740  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll
12:30:28.0882 2740  Netman - ok
12:30:28.0913 2740  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
12:30:28.0913 2740  NetMsmqActivator - ok
12:30:28.0913 2740  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
12:30:28.0913 2740  NetPipeActivator - ok
12:30:28.0944 2740  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll
12:30:28.0944 2740  netprofm - ok
12:30:28.0944 2740  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
12:30:28.0944 2740  NetTcpActivator - ok
12:30:28.0944 2740  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
12:30:28.0944 2740  NetTcpPortSharing - ok
12:30:28.0960 2740  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960        C:\Windows\system32\DRIVERS\nfrd960.sys
12:30:28.0960 2740  nfrd960 - ok
12:30:28.0991 2740  [ 8AD77806D336673F270DB31645267293 ] NlaSvc          C:\Windows\System32\nlasvc.dll
12:30:28.0991 2740  NlaSvc - ok
12:30:29.0038 2740  [ 907B5E1E4A592E5EDC5E4CCBDE4863C2 ] nmwcd          C:\Windows\system32\drivers\ccdcmbx64.sys
12:30:29.0038 2740  nmwcd - ok
12:30:29.0069 2740  [ 41C1AC1F3613435EB32D67BCB80A5FA5 ] nmwcdc          C:\Windows\system32\drivers\ccdcmbox64.sys
12:30:29.0069 2740  nmwcdc - ok
12:30:29.0116 2740  [ 351533ACC2A069B94E80BBFC177E8FDF ] NPF            C:\Windows\system32\drivers\NPF.sys
12:30:29.0116 2740  NPF - ok
12:30:29.0163 2740  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
12:30:29.0163 2740  Npfs - ok
12:30:29.0163 2740  npggsvc - ok
12:30:29.0163 2740  NPPTNT2 - ok
12:30:29.0178 2740  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi            C:\Windows\system32\nsisvc.dll
12:30:29.0178 2740  nsi - ok
12:30:29.0194 2740  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
12:30:29.0194 2740  nsiproxy - ok
12:30:29.0256 2740  [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
12:30:29.0288 2740  Ntfs - ok
12:30:29.0303 2740  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys
12:30:29.0303 2740  Null - ok
12:30:29.0350 2740  [ B4F53BCA4C688FF47F04FA90098F896E ] NVHDA          C:\Windows\system32\drivers\nvhda64v.sys
12:30:29.0350 2740  NVHDA - ok
12:30:29.0537 2740  [ 26AA3C7E6E1DB7107BF93503F6F57E88 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
12:30:29.0693 2740  nvlddmkm - ok
12:30:29.0724 2740  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys
12:30:29.0724 2740  nvraid - ok
12:30:29.0740 2740  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys
12:30:29.0740 2740  nvstor - ok
12:30:29.0756 2740  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
12:30:29.0771 2740  nv_agp - ok
12:30:29.0787 2740  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
12:30:29.0787 2740  ohci1394 - ok
12:30:29.0834 2740  [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose            C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
12:30:29.0834 2740  ose - ok
12:30:29.0943 2740  [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc        C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
12:30:30.0036 2740  osppsvc - ok
12:30:30.0068 2740  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
12:30:30.0068 2740  p2pimsvc - ok
12:30:30.0099 2740  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll
12:30:30.0114 2740  p2psvc - ok
12:30:30.0146 2740  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport        C:\Windows\system32\DRIVERS\parport.sys
12:30:30.0146 2740  Parport - ok
12:30:30.0177 2740  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr        C:\Windows\system32\drivers\partmgr.sys
12:30:30.0177 2740  partmgr - ok
12:30:30.0192 2740  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
12:30:30.0192 2740  PcaSvc - ok
12:30:30.0270 2740  [ BC0018C2D29F655188A0ED3FA94FDB24 ] pccsmcfd        C:\Windows\system32\DRIVERS\pccsmcfdx64.sys
12:30:30.0270 2740  pccsmcfd - ok
12:30:30.0317 2740  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci            C:\Windows\system32\drivers\pci.sys
12:30:30.0317 2740  pci - ok
12:30:30.0348 2740  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys
12:30:30.0348 2740  pciide - ok
12:30:30.0364 2740  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
12:30:30.0364 2740  pcmcia - ok
12:30:30.0380 2740  PCToolsSSDMonitorSvc - ok
12:30:30.0395 2740  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw            C:\Windows\system32\drivers\pcw.sys
12:30:30.0395 2740  pcw - ok
12:30:30.0411 2740  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
12:30:30.0411 2740  PEAUTH - ok
12:30:30.0442 2740  [ B9B0A4299DD2D76A4243F75FD54DC680 ] PeerDistSvc    C:\Windows\system32\peerdistsvc.dll
12:30:30.0473 2740  PeerDistSvc - ok
12:30:30.0536 2740  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe
12:30:30.0536 2740  PerfHost - ok
12:30:30.0582 2740  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla            C:\Windows\system32\pla.dll
12:30:30.0614 2740  pla - ok
12:30:30.0645 2740  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
12:30:30.0660 2740  PlugPlay - ok
12:30:30.0676 2740  PnkBstrA - ok
12:30:30.0692 2740  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
12:30:30.0692 2740  PNRPAutoReg - ok
12:30:30.0707 2740  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
12:30:30.0723 2740  PNRPsvc - ok
12:30:30.0770 2740  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
12:30:30.0770 2740  PolicyAgent - ok
12:30:30.0801 2740  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power          C:\Windows\system32\umpo.dll
12:30:30.0801 2740  Power - ok
12:30:30.0832 2740  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
12:30:30.0848 2740  PptpMiniport - ok
12:30:30.0863 2740  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor      C:\Windows\system32\DRIVERS\processr.sys
12:30:30.0863 2740  Processor - ok
12:30:30.0894 2740  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc        C:\Windows\system32\profsvc.dll
12:30:30.0894 2740  ProfSvc - ok
12:30:30.0910 2740  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
12:30:30.0910 2740  ProtectedStorage - ok
12:30:30.0910 2740  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
12:30:30.0910 2740  Psched - ok
12:30:30.0957 2740  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
12:30:30.0972 2740  ql2300 - ok
12:30:30.0988 2740  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
12:30:30.0988 2740  ql40xx - ok
12:30:31.0019 2740  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE          C:\Windows\system32\qwave.dll
12:30:31.0019 2740  QWAVE - ok
12:30:31.0035 2740  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
12:30:31.0035 2740  QWAVEdrv - ok
12:30:31.0035 2740  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
12:30:31.0035 2740  RasAcd - ok
12:30:31.0066 2740  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
12:30:31.0066 2740  RasAgileVpn - ok
12:30:31.0082 2740  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto        C:\Windows\System32\rasauto.dll
12:30:31.0082 2740  RasAuto - ok
12:30:31.0113 2740  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
12:30:31.0113 2740  Rasl2tp - ok
12:30:31.0160 2740  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll
12:30:31.0160 2740  RasMan - ok
12:30:31.0175 2740  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
12:30:31.0191 2740  RasPppoe - ok
12:30:31.0191 2740  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
12:30:31.0191 2740  RasSstp - ok
12:30:31.0206 2740  [ 77F665941019A1594D887A74F301FA2F ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
12:30:31.0206 2740  rdbss - ok
12:30:31.0222 2740  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
12:30:31.0222 2740  rdpbus - ok
12:30:31.0222 2740  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
12:30:31.0222 2740  RDPCDD - ok
12:30:31.0253 2740  [ 1B6163C503398B23FF8B939C67747683 ] RDPDR          C:\Windows\system32\drivers\rdpdr.sys
12:30:31.0253 2740  RDPDR - ok
12:30:31.0269 2740  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
12:30:31.0269 2740  RDPENCDD - ok
12:30:31.0269 2740  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
12:30:31.0269 2740  RDPREFMP - ok
12:30:31.0362 2740  [ 313F68E1A3E6345A4F47A36B07062F34 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
12:30:31.0362 2740  RdpVideoMiniport - ok
12:30:31.0425 2740  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
12:30:31.0440 2740  RDPWD - ok
12:30:31.0565 2740  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
12:30:31.0565 2740  rdyboost - ok
12:30:31.0596 2740  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
12:30:31.0596 2740  RemoteAccess - ok
12:30:31.0612 2740  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
12:30:31.0628 2740  RemoteRegistry - ok
12:30:31.0659 2740  [ B60F58F175DE20A6739194E85B035178 ] rpcapd          C:\Program Files (x86)\WinPcap\rpcapd.exe
12:30:31.0674 2740  rpcapd - ok
12:30:31.0690 2740  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
12:30:31.0690 2740  RpcEptMapper - ok
12:30:31.0690 2740  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe
12:30:31.0690 2740  RpcLocator - ok
12:30:31.0737 2740  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs          C:\Windows\system32\rpcss.dll
12:30:31.0737 2740  RpcSs - ok
12:30:31.0752 2740  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
12:30:31.0768 2740  rspndr - ok
12:30:31.0799 2740  [ B88880586ACD3EDEFCD0F9C2A6C1EE27 ] RTL2832UBDA    C:\Windows\system32\drivers\RTL2832UBDA.sys
12:30:31.0799 2740  RTL2832UBDA - ok
12:30:31.0846 2740  [ 4C04300EE6A5E780FD4E2F0806AECA0E ] RTL2832UUSB    C:\Windows\system32\Drivers\RTL2832UUSB.sys
12:30:31.0846 2740  RTL2832UUSB - ok
12:30:31.0877 2740  [ 19FAA5E7CF3D5263F4E79450A03E50CA ] RTL2832U_IRHID  C:\Windows\system32\DRIVERS\RTL2832U_IRHID.sys
12:30:31.0877 2740  RTL2832U_IRHID - ok
12:30:31.0908 2740  [ F4C374B1C46DE294B573BB43723AC3F6 ] RTL8167        C:\Windows\system32\DRIVERS\Rt64win7.sys
12:30:31.0908 2740  RTL8167 - ok
12:30:31.0924 2740  [ E60C0A09F997826C7627B244195AB581 ] s3cap          C:\Windows\system32\drivers\vms3cap.sys
12:30:31.0924 2740  s3cap - ok
12:30:31.0955 2740  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs          C:\Windows\system32\lsass.exe
12:30:31.0955 2740  SamSs - ok
12:30:32.0002 2740  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
12:30:32.0002 2740  sbp2port - ok
12:30:32.0033 2740  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
12:30:32.0033 2740  SCardSvr - ok
12:30:32.0064 2740  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
12:30:32.0064 2740  scfilter - ok
12:30:32.0111 2740  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll
12:30:32.0127 2740  Schedule - ok
12:30:32.0158 2740  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc    C:\Windows\System32\certprop.dll
12:30:32.0158 2740  SCPolicySvc - ok
12:30:32.0189 2740  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
12:30:32.0189 2740  SDRSVC - ok
12:30:32.0220 2740  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
12:30:32.0236 2740  secdrv - ok
12:30:32.0236 2740  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll
12:30:32.0236 2740  seclogon - ok
12:30:32.0267 2740  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll
12:30:32.0267 2740  SENS - ok
12:30:32.0267 2740  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
12:30:32.0267 2740  SensrSvc - ok
12:30:32.0283 2740  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum        C:\Windows\system32\DRIVERS\serenum.sys
12:30:32.0283 2740  Serenum - ok
12:30:32.0298 2740  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys
12:30:32.0298 2740  Serial - ok
12:30:32.0330 2740  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
12:30:32.0330 2740  sermouse - ok
12:30:32.0408 2740  [ 58D5BFDF3ADF49FE9CABD78CC61D92F6 ] ServiceLayer    C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
12:30:32.0423 2740  ServiceLayer - ok
12:30:32.0454 2740  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll
12:30:32.0454 2740  SessionEnv - ok
12:30:32.0486 2740  [ A554811BCD09279536440C964AE35BBF ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
12:30:32.0486 2740  sffdisk - ok
12:30:32.0486 2740  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
12:30:32.0486 2740  sffp_mmc - ok
12:30:32.0501 2740  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
12:30:32.0501 2740  sffp_sd - ok
12:30:32.0579 2740  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy        C:\Windows\system32\DRIVERS\sfloppy.sys
12:30:32.0579 2740  sfloppy - ok
12:30:32.0626 2740  [ C6CC9297BD53E5229653303E556AA539 ] Sftfs          C:\Windows\system32\DRIVERS\Sftfslh.sys
12:30:32.0626 2740  Sftfs - ok
12:30:32.0673 2740  [ 13693B6354DD6E72DC5131DA7D764B90 ] sftlist        C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
12:30:32.0673 2740  sftlist - ok
12:30:32.0688 2740  [ 390AA7BC52CEE43F6790CDEA1E776703 ] Sftplay        C:\Windows\system32\DRIVERS\Sftplaylh.sys
12:30:32.0688 2740  Sftplay - ok
12:30:32.0704 2740  [ 617E29A0B0A2807466560D4C4E338D3E ] Sftredir        C:\Windows\system32\DRIVERS\Sftredirlh.sys
12:30:32.0704 2740  Sftredir - ok
12:30:32.0720 2740  [ 8F571F016FA1976F445147E9E6C8AE9B ] Sftvol          C:\Windows\system32\DRIVERS\Sftvollh.sys
12:30:32.0720 2740  Sftvol - ok
12:30:32.0720 2740  [ C3CDDD18F43D44AB713CF8C4916F7696 ] sftvsa          C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
12:30:32.0720 2740  sftvsa - ok
12:30:32.0766 2740  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
12:30:32.0766 2740  ShellHWDetection - ok
12:30:32.0782 2740  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
12:30:32.0782 2740  SiSRaid2 - ok
12:30:32.0798 2740  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
12:30:32.0798 2740  SiSRaid4 - ok
12:30:32.0844 2740  [ 8C4F0DCC6A5100D48F9B2F950CDD220F ] SkypeUpdate    C:\Program Files (x86)\Skype\Updater\Updater.exe
12:30:32.0844 2740  SkypeUpdate - ok
12:30:32.0860 2740  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
12:30:32.0860 2740  Smb - ok
12:30:32.0891 2740  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
12:30:32.0891 2740  SNMPTRAP - ok
12:30:32.0907 2740  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr          C:\Windows\system32\drivers\spldr.sys
12:30:32.0907 2740  spldr - ok
12:30:32.0938 2740  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler        C:\Windows\System32\spoolsv.exe
12:30:32.0938 2740  Spooler - ok
12:30:33.0016 2740  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe
12:30:33.0047 2740  sppsvc - ok
12:30:33.0047 2740  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
12:30:33.0063 2740  sppuinotify - ok
12:30:33.0078 2740  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv            C:\Windows\system32\DRIVERS\srv.sys
12:30:33.0094 2740  srv - ok
12:30:33.0110 2740  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
12:30:33.0110 2740  srv2 - ok
12:30:33.0110 2740  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
12:30:33.0125 2740  srvnet - ok
12:30:33.0125 2740  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
12:30:33.0141 2740  SSDPSRV - ok
12:30:33.0141 2740  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc        C:\Windows\system32\sstpsvc.dll
12:30:33.0141 2740  SstpSvc - ok
12:30:33.0172 2740  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
12:30:33.0172 2740  stexstor - ok
12:30:33.0203 2740  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll
12:30:33.0219 2740  stisvc - ok
12:30:33.0250 2740  [ 7785DC213270D2FC066538DAF94087E7 ] storflt        C:\Windows\system32\drivers\vmstorfl.sys
12:30:33.0250 2740  storflt - ok
12:30:33.0266 2740  [ C40841817EF57D491F22EB103DA587CC ] StorSvc        C:\Windows\system32\storsvc.dll
12:30:33.0266 2740  StorSvc - ok
12:30:33.0297 2740  [ D34E4943D5AC096C8EDEEBFD80D76E23 ] storvsc        C:\Windows\system32\drivers\storvsc.sys
12:30:33.0297 2740  storvsc - ok
12:30:33.0328 2740  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\drivers\swenum.sys
12:30:33.0328 2740  swenum - ok
12:30:33.0344 2740  [ E08E46FDD841B7184194011CA1955A0B ] swprv          C:\Windows\System32\swprv.dll
12:30:33.0344 2740  swprv - ok
12:30:33.0390 2740  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain        C:\Windows\system32\sysmain.dll
12:30:33.0437 2740  SysMain - ok
12:30:33.0468 2740  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
12:30:33.0468 2740  TabletInputService - ok
12:30:33.0500 2740  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv        C:\Windows\System32\tapisrv.dll
12:30:33.0500 2740  TapiSrv - ok
12:30:33.0531 2740  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS            C:\Windows\System32\tbssvc.dll
12:30:33.0531 2740  TBS - ok
12:30:33.0578 2740  [ 37608401DFDB388CAF66917F6B2D6FB0 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
12:30:33.0609 2740  Tcpip - ok
12:30:33.0656 2740  [ 37608401DFDB388CAF66917F6B2D6FB0 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
12:30:33.0671 2740  TCPIP6 - ok
12:30:33.0702 2740  [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
12:30:33.0702 2740  tcpipreg - ok
12:30:33.0718 2740  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
12:30:33.0718 2740  TDPIPE - ok
12:30:33.0734 2740  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
12:30:33.0734 2740  TDTCP - ok
12:30:33.0765 2740  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
12:30:33.0765 2740  tdx - ok
12:30:33.0999 2740  [ 01CC3B9349B244C752CDD99EFDA080BB ] TeamViewer8    C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
12:30:34.0014 2740  TeamViewer8 - ok
12:30:34.0046 2740  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\drivers\termdd.sys
12:30:34.0046 2740  TermDD - ok
12:30:34.0092 2740  [ 2E648163254233755035B46DD7B89123 ] TermService    C:\Windows\System32\termsrv.dll
12:30:34.0092 2740  TermService - ok
12:30:34.0108 2740  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll
12:30:34.0124 2740  Themes - ok
12:30:34.0139 2740  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER    C:\Windows\system32\mmcss.dll
12:30:34.0139 2740  THREADORDER - ok
12:30:34.0155 2740  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll
12:30:34.0155 2740  TrkWks - ok
12:30:34.0186 2740  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
12:30:34.0186 2740  TrustedInstaller - ok
12:30:34.0217 2740  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
12:30:34.0217 2740  tssecsrv - ok
12:30:34.0264 2740  [ 17C6B51CBCCDED95B3CC14E22791F85E ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
12:30:34.0264 2740  TsUsbFlt - ok
12:30:34.0280 2740  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
12:30:34.0295 2740  tunnel - ok
12:30:34.0311 2740  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
12:30:34.0311 2740  uagp35 - ok
12:30:34.0326 2740  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
12:30:34.0326 2740  udfs - ok
12:30:34.0358 2740  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
12:30:34.0358 2740  UI0Detect - ok
12:30:34.0420 2740  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
12:30:34.0420 2740  uliagpkx - ok
12:30:34.0451 2740  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
12:30:34.0451 2740  umbus - ok
12:30:34.0467 2740  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
12:30:34.0467 2740  UmPass - ok
12:30:34.0498 2740  [ A293DCD756D04D8492A750D03B9A297C ] UmRdpService    C:\Windows\System32\umrdp.dll
12:30:34.0498 2740  UmRdpService - ok
12:30:34.0545 2740  [ 67A95B9D129ED5399E7965CD09CF30E7 ] UMVPFSrv        C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
12:30:34.0545 2740  UMVPFSrv - ok
12:30:34.0623 2740  [ 9DC07E73A4ABB9ACF692113B36A5009F ] UnlockerDriver5 C:\Program Files\Unlocker\UnlockerDriver5.sys
12:30:34.0623 2740  UnlockerDriver5 - ok
12:30:34.0654 2740  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll
12:30:34.0654 2740  upnphost - ok
12:30:34.0701 2740  [ 4E93C8496359E97830C75AC36393654D ] upperdev        C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys
12:30:34.0701 2740  upperdev - ok
12:30:34.0732 2740  [ 43228F8EDD1B0BCDD3145AD246E63D39 ] USBAAPL64      C:\Windows\system32\Drivers\usbaapl64.sys
12:30:34.0732 2740  USBAAPL64 - ok
12:30:34.0748 2740  [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
12:30:34.0748 2740  usbaudio - ok
12:30:34.0779 2740  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
12:30:34.0794 2740  usbccgp - ok
12:30:34.0810 2740  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
12:30:34.0810 2740  usbcir - ok
12:30:34.0826 2740  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
12:30:34.0826 2740  usbehci - ok
12:30:34.0872 2740  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
12:30:34.0888 2740  usbhub - ok
12:30:34.0888 2740  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci        C:\Windows\system32\DRIVERS\usbohci.sys
12:30:34.0888 2740  usbohci - ok
12:30:34.0919 2740  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
12:30:34.0919 2740  usbprint - ok
12:30:34.0950 2740  [ 4ACEE387FA8FD39F83564FCD2FC234F2 ] usbser          C:\Windows\system32\drivers\usbser.sys
12:30:34.0950 2740  usbser - ok
12:30:34.0982 2740  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
12:30:34.0982 2740  USBSTOR - ok
12:30:34.0997 2740  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
12:30:34.0997 2740  usbuhci - ok
12:30:35.0013 2740  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms          C:\Windows\System32\uxsms.dll
12:30:35.0013 2740  UxSms - ok
12:30:35.0028 2740  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe
12:30:35.0028 2740  VaultSvc - ok
12:30:35.0060 2740  [ FD911873C0BB6945FA38C16E9A2B58F9 ] VClone          C:\Windows\system32\DRIVERS\VClone.sys
12:30:35.0060 2740  VClone - ok
12:30:35.0106 2740  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
12:30:35.0106 2740  vdrvroot - ok
12:30:35.0138 2740  [ 8D6B481601D01A456E75C3210F1830BE ] vds            C:\Windows\System32\vds.exe
12:30:35.0153 2740  vds - ok
12:30:35.0169 2740  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
12:30:35.0169 2740  vga - ok
12:30:35.0184 2740  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave        C:\Windows\System32\drivers\vga.sys
12:30:35.0184 2740  VgaSave - ok
12:30:35.0216 2740  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
12:30:35.0231 2740  vhdmp - ok
12:30:35.0231 2740  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys
12:30:35.0231 2740  viaide - ok
12:30:35.0262 2740  [ 86EA3E79AE350FEA5331A1303054005F ] vmbus          C:\Windows\system32\drivers\vmbus.sys
12:30:35.0278 2740  vmbus - ok
12:30:35.0294 2740  [ 7DE90B48F210D29649380545DB45A187 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
12:30:35.0294 2740  VMBusHID - ok
12:30:35.0340 2740  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
12:30:35.0340 2740  volmgr - ok
12:30:35.0372 2740  [ A255814907C89BE58B79EF2F189B843B ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
12:30:35.0372 2740  volmgrx - ok
12:30:35.0418 2740  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
12:30:35.0418 2740  volsnap - ok
12:30:35.0450 2740  [ B4A73CA4EF9A02B9738CEA9AD5FE5917 ] vpcbus          C:\Windows\system32\DRIVERS\vpchbus.sys
12:30:35.0465 2740  vpcbus - ok
12:30:35.0496 2740  [ E675FB2B48C54F09895482E2253B289C ] vpcnfltr        C:\Windows\system32\DRIVERS\vpcnfltr.sys
12:30:35.0496 2740  vpcnfltr - ok
12:30:35.0512 2740  [ 5FB42082B0D19A0268705F1DD343DF20 ] vpcusb          C:\Windows\system32\DRIVERS\vpcusb.sys
12:30:35.0512 2740  vpcusb - ok
12:30:35.0543 2740  [ 207B6539799CC1C112661A9B620DD233 ] vpcvmm          C:\Windows\system32\drivers\vpcvmm.sys
12:30:35.0559 2740  vpcvmm - ok
12:30:35.0574 2740  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid        C:\Windows\system32\DRIVERS\vsmraid.sys
12:30:35.0574 2740  vsmraid - ok
12:30:35.0637 2740  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS            C:\Windows\system32\vssvc.exe
12:30:35.0652 2740  VSS - ok
12:30:35.0668 2740  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
12:30:35.0668 2740  vwifibus - ok
12:30:35.0699 2740  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time        C:\Windows\system32\w32time.dll
12:30:35.0715 2740  W32Time - ok
12:30:35.0715 2740  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
12:30:35.0715 2740  WacomPen - ok
12:30:35.0762 2740  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
12:30:35.0762 2740  WANARP - ok
12:30:35.0762 2740  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
12:30:35.0762 2740  Wanarpv6 - ok
12:30:35.0840 2740  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe
12:30:35.0871 2740  wbengine - ok
12:30:35.0902 2740  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
12:30:35.0902 2740  WbioSrvc - ok
12:30:35.0964 2740  [ 2B8E2232747C170F75D2A4E24A8D6ABD ] WCMVCAM        C:\Windows\system32\DRIVERS\wcmvcam64.sys
12:30:35.0980 2740  WCMVCAM - ok
12:30:36.0011 2740  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc        C:\Windows\System32\wcncsvc.dll
12:30:36.0011 2740  wcncsvc - ok
12:30:36.0027 2740  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
12:30:36.0027 2740  WcsPlugInService - ok
12:30:36.0058 2740  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\DRIVERS\wd.sys
12:30:36.0058 2740  Wd - ok
12:30:36.0120 2740  [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
12:30:36.0136 2740  Wdf01000 - ok
12:30:36.0136 2740  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
12:30:36.0136 2740  WdiServiceHost - ok
12:30:36.0136 2740  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost  C:\Windows\system32\wdi.dll
12:30:36.0152 2740  WdiSystemHost - ok
12:30:36.0152 2740  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient      C:\Windows\System32\webclnt.dll
12:30:36.0167 2740  WebClient - ok
12:30:36.0167 2740  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
12:30:36.0183 2740  Wecsvc - ok
12:30:36.0198 2740  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
12:30:36.0198 2740  wercplsupport - ok
12:30:36.0214 2740  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
12:30:36.0214 2740  WerSvc - ok
12:30:36.0230 2740  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
12:30:36.0230 2740  WfpLwf - ok
12:30:36.0245 2740  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
12:30:36.0245 2740  WIMMount - ok
12:30:36.0261 2740  WinHttpAutoProxySvc - ok
12:30:36.0276 2740  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
12:30:36.0276 2740  Winmgmt - ok
12:30:36.0354 2740  [ BCB1310604AA415C4508708975B3931E ] WinRM          C:\Windows\system32\WsmSvc.dll
12:30:36.0401 2740  WinRM - ok
12:30:36.0448 2740  [ FE88B288356E7B47B74B13372ADD906D ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
12:30:36.0448 2740  WinUsb - ok
12:30:36.0479 2740  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc        C:\Windows\System32\wlansvc.dll
12:30:36.0479 2740  Wlansvc - ok
12:30:36.0510 2740  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
12:30:36.0510 2740  WmiAcpi - ok
12:30:36.0542 2740  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
12:30:36.0557 2740  wmiApSrv - ok
12:30:36.0604 2740  WMPNetworkSvc - ok
12:30:36.0620 2740  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
12:30:36.0620 2740  WPCSvc - ok
12:30:36.0651 2740  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
12:30:36.0651 2740  WPDBusEnum - ok
12:30:36.0666 2740  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
12:30:36.0666 2740  ws2ifsl - ok
12:30:36.0666 2740  WSearch - ok
12:30:36.0744 2740  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll
12:30:36.0776 2740  wuauserv - ok
12:30:36.0807 2740  [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
12:30:36.0807 2740  WudfPf - ok
12:30:36.0869 2740  [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
12:30:36.0885 2740  WUDFRd - ok
12:30:36.0900 2740  [ B20F051B03A966392364C83F009F7D17 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
12:30:36.0916 2740  wudfsvc - ok
12:30:36.0932 2740  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc        C:\Windows\System32\wwansvc.dll
12:30:36.0932 2740  WwanSvc - ok
12:30:36.0994 2740  X6va009 - ok
12:30:37.0010 2740  X6va011 - ok
12:30:37.0025 2740  ================ Scan global ===============================
12:30:37.0041 2740  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
12:30:37.0072 2740  [ 9E479C2B605C25DA4971ABA36250FAEF ] C:\Windows\system32\winsrv.dll
12:30:37.0088 2740  [ 9E479C2B605C25DA4971ABA36250FAEF ] C:\Windows\system32\winsrv.dll
12:30:37.0119 2740  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
12:30:37.0150 2740  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
12:30:37.0166 2740  [Global] - ok
12:30:37.0166 2740  ================ Scan MBR ==================================
12:30:37.0166 2740  [ 72B8CE41AF0DE751C946802B3ED844B4 ] \Device\Harddisk0\DR0
12:30:37.0400 2740  \Device\Harddisk0\DR0 - ok
12:30:37.0400 2740  [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk1\DR1
12:30:37.0400 2740  \Device\Harddisk1\DR1 - ok
12:30:37.0400 2740  ================ Scan VBR ==================================
12:30:37.0400 2740  [ 792A47BA7FE961AF9CB4737833B6C212 ] \Device\Harddisk0\DR0\Partition1
12:30:37.0415 2740  \Device\Harddisk0\DR0\Partition1 - ok
12:30:37.0415 2740  [ F1FF127160FE09BF4AF00E5A1E3FD3FC ] \Device\Harddisk0\DR0\Partition2
12:30:37.0415 2740  \Device\Harddisk0\DR0\Partition2 - ok
12:30:37.0415 2740  [ 2C88A9D7A8192BEE2BCF63F5D824CBA1 ] \Device\Harddisk1\DR1\Partition1
12:30:37.0415 2740  \Device\Harddisk1\DR1\Partition1 - ok
12:30:37.0415 2740  ============================================================
12:30:37.0415 2740  Scan finished
12:30:37.0415 2740  ============================================================
12:30:37.0431 1272  Detected object count: 0
12:30:37.0431 1272  Actual detected object count: 0
12:31:00.0488 3084  Deinitialize success

cosinus 03.03.2013 18:33
Dann bitte jetzt CF ausführen:

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Guadeno 04.03.2013 22:23
Code:
ComboFix 13-03-04.01 - Michael 04.03.2013  19:57:12.1.4 - x64
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.8191.6160 [GMT 1:00]
ausgeführt von:: c:\users\Michael\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ntuser.dat
c:\users\Michael\AppData\Local\._Revolution_
c:\users\Michael\AppData\Local\TempDIR
c:\users\Michael\AppData\Roaming\inst.exe
c:\users\Michael\AppData\Roaming\Microsoft\Windows\.data
c:\windows\XSxS
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-02-04 bis 2013-03-04  ))))))))))))))))))))))))))))))
.
.
2013-03-01 17:36 . 2013-03-01 18:13        --------        d-----w-        c:\users\Michael\jagexcache
2013-03-01 13:33 . 2012-06-09 18:21        206336        ----a-w-        c:\windows\system32\unrar64.dll
2013-03-01 13:33 . 2011-12-07 18:37        148992        ----a-w-        c:\windows\system32\lagarith.dll
2013-03-01 13:33 . 2013-02-06 18:00        127488        ----a-w-        c:\windows\system32\ff_vfw.dll
2013-03-01 13:33 . 2013-03-01 13:33        --------        d-----w-        c:\program files\K-Lite Codec Pack x64
2013-02-26 13:22 . 2012-03-21 12:43        108832        ----a-w-        c:\windows\SysWow64\drivers\PCTDMDefrag.sys
2013-02-26 13:22 . 2011-07-26 16:15        82432        ----a-w-        c:\windows\SysWow64\msxml4r.dll
2013-02-26 13:22 . 2011-07-26 16:15        44544        ----a-w-        c:\windows\SysWow64\msxml4a.dll
2013-02-26 13:22 . 2011-07-26 16:15        1233920        ----a-w-        c:\windows\SysWow64\msxml4.dll
2013-02-26 13:03 . 2013-02-26 13:22        --------        d-----w-        c:\programdata\PC Tools
2013-02-26 13:03 . 2013-02-26 13:03        --------        d-----w-        c:\users\Michael\AppData\Roaming\Product_PT
2013-02-25 15:37 . 2013-02-26 15:52        --------        d-----w-        c:\programdata\Electronic Arts
2013-02-23 21:18 . 2013-02-23 21:18        --------        d-----w-        c:\users\Michael\AppData\Roaming\Malwarebytes
2013-02-23 21:18 . 2013-02-23 21:18        --------        d-----w-        c:\programdata\Malwarebytes
2013-02-23 21:17 . 2013-02-23 21:18        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2013-02-23 21:17 . 2012-12-14 15:49        24176        ----a-w-        c:\windows\system32\drivers\mbam.sys
2013-02-23 20:32 . 2013-02-23 20:32        --------        d-----w-        c:\users\Michael\AppData\Local\ElevatedDiagnostics
2013-02-22 17:47 . 2013-02-22 17:47        --------        d-----w-        c:\programdata\Bohemia Interactive Studio
2013-02-20 15:38 . 2013-02-20 15:38        --------        d-----w-        c:\users\Michael\AppData\Local\AMD
2013-02-20 15:37 . 2013-02-20 15:37        --------        d-----w-        c:\users\Michael\AppData\Roaming\ATI
2013-02-20 15:37 . 2013-02-20 15:37        --------        d-----w-        c:\users\Michael\AppData\Local\ATI
2013-02-20 15:37 . 2013-02-20 15:37        --------        d-----w-        c:\programdata\ATI
2013-02-20 15:37 . 2013-02-20 15:37        0        ----a-w-        c:\windows\ativpsrm.bin
2013-02-20 15:35 . 2013-02-20 15:35        --------        d-----w-        c:\program files (x86)\AMD AVT
2013-02-20 15:35 . 2013-02-20 15:35        --------        d-----w-        c:\program files\AMD
2013-02-20 15:35 . 2013-02-20 15:35        --------        d-----w-        c:\program files (x86)\AMD
2013-02-20 15:35 . 2013-02-20 15:35        --------        d-----w-        c:\program files (x86)\AMD APP
2013-02-20 15:35 . 2013-02-20 15:35        --------        d-----w-        c:\program files\Common Files\ATI Technologies
2013-02-20 15:35 . 2013-02-20 15:35        --------        d-----w-        c:\program files (x86)\Common Files\ATI Technologies
2013-02-20 15:35 . 2013-02-20 15:35        --------        d-----w-        c:\programdata\AMD
2013-02-20 15:34 . 2013-02-20 15:34        --------        d-----w-        c:\program files (x86)\ATI Technologies
2013-02-20 15:33 . 2013-02-20 15:35        --------        d-----w-        c:\program files\ATI Technologies
2013-02-20 15:33 . 2013-02-20 15:33        --------        d-----w-        C:\AMD
2013-02-19 13:33 . 2012-12-19 05:42        31672        ----a-w-        c:\windows\system32\nvhdap64.dll
2013-02-19 13:33 . 2012-12-19 05:41        194488        ----a-w-        c:\windows\system32\drivers\nvhda64v.sys
2013-02-16 15:05 . 2013-02-16 15:05        --------        d-----w-        c:\users\Michael\AppData\Local\EA Games
2013-02-15 15:57 . 2013-02-15 15:57        --------        d-----w-        c:\users\Michael\.dvdcss
2013-02-15 15:57 . 2013-02-15 15:57        --------        d-----w-        c:\users\Michael\AppData\Local\MPlayer
2013-02-15 15:32 . 2013-02-15 15:32        --------        d-----w-        c:\users\Michael\AppData\Roaming\dvdcss
2013-02-09 21:45 . 2013-02-09 21:45        --------        d-----w-        c:\program files (x86)\DVDVideoSoft
2013-02-09 21:45 . 2013-02-09 21:45        --------        d-----w-        c:\program files (x86)\Common Files\DVDVideoSoft
2013-02-09 21:25 . 2013-02-09 21:43        82816        ----a-w-        c:\users\Michael\AppData\Roaming\pcouffin.sys
2013-02-09 21:25 . 2013-02-09 21:43        --------        d-----w-        c:\users\Michael\AppData\Roaming\Vso
2013-02-09 21:25 . 2013-02-09 21:43        --------        d-----w-        c:\program files (x86)\vso
2013-02-09 21:25 . 2013-02-09 21:41        --------        d-----w-        c:\programdata\VSO
2013-02-06 19:14 . 2013-02-06 19:14        --------        d-----w-        c:\users\Michael\AppData\Roaming\AnvSoft
2013-02-06 19:08 . 2013-02-06 19:08        --------        d-sh--w-        c:\windows\SysWow64\%APPDATA%
2013-02-06 19:08 . 2013-02-08 17:14        --------        d-----w-        c:\users\Michael\AppData\Roaming\Media Player Classic
2013-02-06 19:00 . 2013-02-06 19:00        224256        ----a-w-        c:\programdata\Microsoft\Media Tools\MediaIconsOverlays.dll
2013-02-05 14:33 . 2013-01-08 05:32        9161176        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{F9D067B6-ADC6-433E-BD4E-BEE6D0CB3D6B}\mpengine.dll
2013-02-04 18:47 . 2013-02-04 18:49        --------        d-----w-        c:\users\Michael\.shsh
2013-02-04 17:31 . 2012-08-21 12:01        33240        ----a-w-        c:\windows\system32\drivers\GEARAspiWDM.sys
2013-02-04 17:31 . 2013-02-04 17:31        --------        d-----w-        c:\program files\iPod
2013-02-04 17:31 . 2013-02-04 17:31        --------        d-----w-        c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-02-04 17:31 . 2013-02-04 17:31        --------        d-----w-        c:\program files\iTunes
2013-02-04 17:31 . 2013-02-04 17:31        --------        d-----w-        c:\program files (x86)\iTunes
2013-02-04 17:29 . 2013-02-04 17:29        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2013-02-04 17:29 . 2013-02-04 17:29        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2013-02-04 17:29 . 2013-02-04 17:29        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2013-02-04 17:29 . 2013-02-04 17:29        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2013-02-04 17:29 . 2013-02-04 17:29        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2013-02-04 17:29 . 2013-02-04 17:29        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2013-02-04 17:29 . 2013-02-04 17:29        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2013-02-04 17:29 . 2013-02-04 17:29        --------        d-----w-        c:\program files (x86)\QuickTime
2013-02-03 14:33 . 2013-02-03 14:33        --------        d-----w-        c:\programdata\TERA
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-04 16:02 . 2012-06-01 16:45        291088        ----a-w-        c:\windows\SysWow64\PnkBstrB.xtr
2013-03-04 16:02 . 2012-06-01 16:38        291088        ----a-w-        c:\windows\SysWow64\PnkBstrB.exe
2013-03-04 16:02 . 2012-06-01 16:38        280904        ----a-w-        c:\windows\SysWow64\PnkBstrB.ex0
2013-03-01 13:21 . 2012-05-17 10:14        71024        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-03-01 13:21 . 2012-05-17 10:14        691568        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2013-01-17 00:28 . 2012-05-17 10:31        273840        ------w-        c:\windows\system32\MpSigStub.exe
2013-01-09 14:44 . 2012-06-18 13:43        67599240        ----a-w-        c:\windows\system32\MRT.exe
2012-12-22 17:44 . 2012-12-22 17:44        308200        ----a-w-        c:\windows\system32\javaws.exe
2012-12-22 17:44 . 2012-12-22 17:44        188392        ----a-w-        c:\windows\system32\javaw.exe
2012-12-22 17:44 . 2012-12-22 17:44        188392        ----a-w-        c:\windows\system32\java.exe
2012-12-22 17:44 . 2012-12-22 17:44        108008        ----a-w-        c:\windows\system32\WindowsAccessBridge-64.dll
2012-12-22 17:44 . 2012-05-18 15:33        959976        ----a-w-        c:\windows\system32\deployJava1.dll
2012-12-22 17:44 . 2012-05-18 15:33        1081320        ----a-w-        c:\windows\system32\npDeployJava1.dll
2012-12-19 20:50 . 2012-12-19 20:50        5630200        ----a-w-        c:\windows\SysWow64\atiumdag.dll
2012-12-19 20:48 . 2012-12-19 20:48        11278336        ----a-w-        c:\windows\system32\drivers\atikmdag.sys
2012-12-19 20:29 . 2012-12-19 20:29        23461376        ----a-w-        c:\windows\system32\atio6axx.dll
2012-12-19 20:22 . 2012-12-19 20:22        70144        ----a-w-        c:\windows\system32\coinst_9.012.dll
2012-12-19 20:19 . 2012-12-19 20:19        163840        ----a-w-        c:\windows\system32\atiapfxx.exe
2012-12-19 20:18 . 2012-12-19 20:18        51200        ----a-w-        c:\windows\system32\aticalrt64.dll
2012-12-19 20:18 . 2012-12-19 20:18        46080        ----a-w-        c:\windows\SysWow64\aticalrt.dll
2012-12-19 20:17 . 2012-12-19 20:17        44544        ----a-w-        c:\windows\system32\aticalcl64.dll
2012-12-19 20:17 . 2012-12-19 20:17        44032        ----a-w-        c:\windows\SysWow64\aticalcl.dll
2012-12-19 20:17 . 2012-12-19 20:17        16082944        ----a-w-        c:\windows\system32\aticaldd64.dll
2012-12-19 20:13 . 2012-12-19 20:13        13703168        ----a-w-        c:\windows\SysWow64\aticaldd.dll
2012-12-19 20:12 . 2012-12-19 20:12        18982400        ----a-w-        c:\windows\SysWow64\atioglxx.dll
2012-12-19 20:09 . 2012-12-19 20:09        960512        ----a-w-        c:\windows\SysWow64\aticfx32.dll
2012-12-19 20:08 . 2012-12-19 20:08        1151488        ----a-w-        c:\windows\system32\aticfx64.dll
2012-12-19 20:06 . 2012-12-19 20:06        6681088        ----a-w-        c:\windows\SysWow64\atidxx32.dll
2012-12-19 19:59 . 2012-12-19 19:59        5087744        ----a-w-        c:\windows\system32\atiumd6a.dll
2012-12-19 19:57 . 2012-12-19 19:57        442368        ----a-w-        c:\windows\system32\atidemgy.dll
2012-12-19 19:56 . 2012-12-19 19:56        550912        ----a-w-        c:\windows\system32\atieclxx.exe
2012-12-19 19:56 . 2012-12-19 19:56        240640        ----a-w-        c:\windows\system32\atiesrxx.exe
2012-12-19 19:54 . 2012-12-19 19:54        120320        ----a-w-        c:\windows\system32\atitmm64.dll
2012-12-19 19:54 . 2012-12-19 19:54        21504        ----a-w-        c:\windows\system32\atimuixx.dll
2012-12-19 19:54 . 2012-12-19 19:54        59392        ----a-w-        c:\windows\system32\atiedu64.dll
2012-12-19 19:54 . 2012-12-19 19:54        43520        ----a-w-        c:\windows\SysWow64\ati2edxx.dll
2012-12-19 19:49 . 2012-12-19 19:49        7370752        ----a-w-        c:\windows\system32\atidxx64.dll
2012-12-19 19:44 . 2012-12-19 19:44        4162048        ----a-w-        c:\windows\SysWow64\atiumdva.dll
2012-12-19 19:44 . 2012-12-19 19:44        6786560        ----a-w-        c:\windows\system32\atiumd64.dll
2012-12-19 19:34 . 2012-12-19 19:34        79360        ----a-w-        c:\windows\system32\amdave64.dll
2012-12-19 19:34 . 2012-12-19 19:34        78336        ----a-w-        c:\windows\SysWow64\amdave32.dll
2012-12-19 19:34 . 2012-12-19 19:34        74240        ----a-w-        c:\windows\system32\atisamu64.dll
2012-12-19 19:34 . 2012-12-19 19:34        71168        ----a-w-        c:\windows\SysWow64\atisamu32.dll
2012-12-19 19:33 . 2012-12-19 19:33        56320        ----a-w-        c:\windows\system32\atimpc64.dll
2012-12-19 19:33 . 2012-12-19 19:33        56320        ----a-w-        c:\windows\system32\amdpcom64.dll
2012-12-19 19:33 . 2012-12-19 19:33        619008        ----a-w-        c:\windows\system32\atiadlxx.dll
2012-12-19 19:33 . 2012-12-19 19:33        56832        ----a-w-        c:\windows\SysWow64\atimpc32.dll
2012-12-19 19:33 . 2012-12-19 19:33        56832        ----a-w-        c:\windows\SysWow64\amdpcom32.dll
2012-12-19 19:33 . 2012-12-19 19:33        421888        ----a-w-        c:\windows\SysWow64\atiadlxy.dll
2012-12-19 19:33 . 2012-12-19 19:33        17920        ----a-w-        c:\windows\system32\atig6pxx.dll
2012-12-19 19:33 . 2012-12-19 19:33        14848        ----a-w-        c:\windows\SysWow64\atiglpxx.dll
2012-12-19 19:33 . 2012-12-19 19:33        14848        ----a-w-        c:\windows\system32\atiglpxx.dll
2012-12-19 19:33 . 2012-12-19 19:33        41984        ----a-w-        c:\windows\system32\atig6txx.dll
2012-12-19 19:33 . 2012-12-19 19:33        33280        ----a-w-        c:\windows\SysWow64\atigktxx.dll
2012-12-19 19:32 . 2012-12-19 19:32        552960        ----a-w-        c:\windows\system32\drivers\atikmpag.sys
2012-12-19 19:31 . 2012-12-19 19:31        130048        ----a-w-        c:\windows\system32\atiuxp64.dll
2012-12-19 19:31 . 2012-12-19 19:31        109568        ----a-w-        c:\windows\SysWow64\atiuxpag.dll
2012-12-19 19:31 . 2012-12-19 19:31        104448        ----a-w-        c:\windows\system32\atiu9p64.dll
2012-12-19 19:30 . 2012-12-19 19:30        83968        ----a-w-        c:\windows\SysWow64\atiu9pag.dll
2012-12-19 19:30 . 2012-12-19 19:30        53248        ----a-w-        c:\windows\system32\drivers\ati2erec.dll
2012-12-19 14:45 . 2012-12-19 14:45        222720        ----a-w-        c:\windows\system32\clinfo.exe
2012-12-19 14:44 . 2012-12-19 14:44        76288        ----a-w-        c:\windows\system32\OpenVideo64.dll
2012-12-19 14:44 . 2012-12-19 14:44        65536        ----a-w-        c:\windows\SysWow64\OpenVideo.dll
2012-12-19 14:44 . 2012-12-19 14:44        64000        ----a-w-        c:\windows\system32\OVDecode64.dll
2012-12-19 14:44 . 2012-12-19 14:44        56320        ----a-w-        c:\windows\SysWow64\OVDecode.dll
2012-12-19 14:44 . 2012-12-19 14:44        34518016        ----a-w-        c:\windows\system32\amdocl64.dll
2012-12-19 14:38 . 2012-12-19 14:38        28732928        ----a-w-        c:\windows\SysWow64\amdocl.dll
2012-12-19 14:34 . 2012-12-19 14:34        54784        ----a-w-        c:\windows\system32\OpenCL.dll
2012-12-19 14:34 . 2012-12-19 14:34        50176        ----a-w-        c:\windows\SysWow64\OpenCL.dll
2012-12-18 08:31 . 2012-12-26 23:54        1510328        ----a-w-        c:\windows\system32\nvhdagenco6420103.dll
2012-12-16 17:11 . 2012-12-21 11:30        46080        ----a-w-        c:\windows\system32\atmlib.dll
2012-12-16 14:45 . 2012-12-21 11:30        367616        ----a-w-        c:\windows\system32\atmfd.dll
2012-12-16 14:13 . 2012-12-21 11:30        295424        ----a-w-        c:\windows\SysWow64\atmfd.dll
2012-12-16 14:13 . 2012-12-21 11:30        34304        ----a-w-        c:\windows\SysWow64\atmlib.dll
2012-12-07 13:20 . 2013-01-09 14:37        441856        ----a-w-        c:\windows\system32\Wpc.dll
2012-12-07 13:15 . 2013-01-09 14:37        2746368        ----a-w-        c:\windows\system32\gameux.dll
2012-12-07 12:26 . 2013-01-09 14:37        308736        ----a-w-        c:\windows\SysWow64\Wpc.dll
2012-12-07 12:20 . 2013-01-09 14:37        2576384        ----a-w-        c:\windows\SysWow64\gameux.dll
2012-12-07 11:20 . 2013-01-09 14:37        30720        ----a-w-        c:\windows\system32\usk.rs
2012-12-07 11:20 . 2013-01-09 14:37        43520        ----a-w-        c:\windows\system32\csrr.rs
2012-12-07 11:20 . 2013-01-09 14:37        23552        ----a-w-        c:\windows\system32\oflc.rs
2012-12-07 11:20 . 2013-01-09 14:37        45568        ----a-w-        c:\windows\system32\oflc-nz.rs
2012-12-07 11:20 . 2013-01-09 14:37        44544        ----a-w-        c:\windows\system32\pegibbfc.rs
2012-12-07 11:20 . 2013-01-09 14:37        20480        ----a-w-        c:\windows\system32\pegi-fi.rs
2012-12-07 11:20 . 2013-01-09 14:37        20480        ----a-w-        c:\windows\system32\pegi-pt.rs
2012-12-07 11:19 . 2013-01-09 14:37        20480        ----a-w-        c:\windows\system32\pegi.rs
2012-12-07 11:19 . 2013-01-09 14:37        46592        ----a-w-        c:\windows\system32\fpb.rs
2012-12-07 11:19 . 2013-01-09 14:37        40960        ----a-w-        c:\windows\system32\cob-au.rs
2012-12-07 11:19 . 2013-01-09 14:37        21504        ----a-w-        c:\windows\system32\grb.rs
2012-12-07 11:19 . 2013-01-09 14:37        15360        ----a-w-        c:\windows\system32\djctq.rs
2012-12-07 11:19 . 2013-01-09 14:37        55296        ----a-w-        c:\windows\system32\cero.rs
2012-12-07 11:19 . 2013-01-09 14:37        51712        ----a-w-        c:\windows\system32\esrb.rs
2012-12-07 10:46 . 2013-01-09 14:37        43520        ----a-w-        c:\windows\SysWow64\csrr.rs
2012-12-07 10:46 . 2013-01-09 14:37        30720        ----a-w-        c:\windows\SysWow64\usk.rs
2012-12-07 10:46 . 2013-01-09 14:37        45568        ----a-w-        c:\windows\SysWow64\oflc-nz.rs
2012-12-07 10:46 . 2013-01-09 14:37        44544        ----a-w-        c:\windows\SysWow64\pegibbfc.rs
2012-12-07 10:46 . 2013-01-09 14:37        20480        ----a-w-        c:\windows\SysWow64\pegi-pt.rs
2012-12-07 10:46 . 2013-01-09 14:37        23552        ----a-w-        c:\windows\SysWow64\oflc.rs
2012-12-07 10:46 . 2013-01-09 14:37        20480        ----a-w-        c:\windows\SysWow64\pegi-fi.rs
2012-12-07 10:46 . 2013-01-09 14:37        46592        ----a-w-        c:\windows\SysWow64\fpb.rs
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-01-08 161536]
R2 WCMVCAM;WebcamMax, WDM Video Capture;c:\windows\system32\DRIVERS\wcmvcam64.sys [2011-06-13 1069752]
R3 ALSysIO;ALSysIO;c:\users\Michael\AppData\Local\Temp\ALSysIO64.sys [x]
R3 dump_wmimmc;dump_wmimmc;c:\program files (x86)\CAPCOM\Monster Hunter Frontier Online\GameGuard\dump_wmimmc.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys [x]
R3 Neo_VPN;VPN Client Device Driver - VPN;c:\windows\system32\DRIVERS\Neo_0023.sys [2012-07-04 29184]
R3 NPF;WinPcap Packet Driver (NPF);c:\windows\system32\drivers\NPF.sys [2010-06-25 35344]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 RTL2832U_IRHID;HID Infrared Remote Receiver;c:\windows\system32\DRIVERS\RTL2832U_IRHID.sys [2009-10-05 44320]
R3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys [2010-07-01 224488]
R3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\Drivers\RTL2832UUSB.sys [2010-07-01 39016]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-09-28 53760]
R3 X6va009;X6va009;c:\windows\SysWOW64\Drivers\X6va009 [x]
R3 X6va011;X6va011;c:\windows\SysWOW64\Drivers\X6va011 [x]
S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DRIVERS\AsrAppCharger.sys [2011-05-10 17192]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-05-02 27760]
S1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [2012-05-17 15936]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-12-19 240640]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-12-19 361984]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-01 86224]
S2 AODDriver4.2;AODDriver4.2;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-04-09 57472]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-12-10 2465712]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2013-02-26 3560800]
S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2012-01-18 450848]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-11-06 96256]
S3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [2012-05-17 32320]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [2012-01-18 351136]
S3 LVUVC64;Logitech Webcam C160(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [2012-01-18 4865568]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-04-21 471144]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2013-03-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-17 13:21]
.
2013-03-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4149896342-1631694950-3810678737-1000Core.job
- c:\users\Michael\AppData\Local\Google\Update\GoogleUpdate.exe [2012-06-06 20:33]
.
2013-03-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4149896342-1631694950-3810678737-1000UA.job
- c:\users\Michael\AppData\Local\Google\Update\GoogleUpdate.exe [2012-06-06 20:33]
.
.
--------- X64 Entries -----------
.
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.2.1 192.168.2.1
FF - ProfilePath - c:\users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\7zicrbwu.default\
FF - prefs.js: browser.startup.homepage - chrome://speeddial/content/speeddial.xul
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2013-01-26 22:55; {DDC359D1-844A-42a7-9AA1-88A850A938A8}; c:\users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\7zicrbwu.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
FF - ExtSQL: 2013-01-26 22:55; {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}; c:\users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\7zicrbwu.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109958&tt=220512_53ctrl
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - d29ea71a000000000000bc5ff41e50bd
FF - user.js: extensions.BabylonToolbar_i.hardId - d29ea71a000000000000bc5ff41e50bd
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15494
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=d29ea71a00000000000000ffaa9ade88&q=
FF - user.js: extensions.BabylonToolbar.id - d29ea71a00000000000000ffaa9ade88
FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB}
FF - user.js: extensions.BabylonToolbar.instlDay - 15619
FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.0.7
FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.0.7
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.8.0.723:24
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - na
FF - user.js: extensions.BabylonToolbar.dfltLng - de
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extentions.y2layers.installId - 3c4ed99b-1f35-43a5-8abd-25b3284dbf65
FF - user.js: extentions.y2layers.defaultEnableAppsList - twittube,buzzdock,YontooNewOffers
FF - user.js: extensions.autoDisableScopes - 14
.
.
------- Dateityp-Verknüpfung -------
.
JSEFile=%SystemRoot%\SysWow64\CScript.exe "%1" %*
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} - (no file)
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
ShellIconOverlayIdentifiers-{1EC23CFF-4C58-458f-924C-8519AEF61B32} - (no file)
AddRemove-Battlelog Web Plugins - c:\program files (x86)\Battlelog Web Plugins\uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va009]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va009"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va011]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va011"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-4149896342-1631694950-3810678737-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-4149896342-1631694950-3810678737-1000\Software\SecuROM\License information*]
"datasecu"=hex:33,dc,75,d7,ca,8d,8f,5b,a9,de,56,65,37,cf,ed,34,19,72,84,a5,d1,
  15,84,5b,64,7e,ee,84,2e,7a,40,06,aa,40,5d,3a,a5,cf,b6,50,27,d8,84,8c,2e,4b,\
"rkeysecu"=hex:a4,a6,5f,23,7e,27,ec,8c,51,c3,1a,40,bc,2c,21,a7
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_171_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_171_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-03-04  22:19:24 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2013-03-04 21:19
.
Vor Suchlauf: 8 Verzeichnis(se), 327.911.874.560 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 326.649.229.312 Bytes frei
.
- - End Of File - - 3BF713221EF2A85F2B8A90791540E0F2
Bisher scheint wieder alles zu funktionieren :)
Danke!

Nur noch eine Frage:
Die ganzen Ordner die sich in C: erstellt haben kann ich schon löschen, oder?

cosinus 05.03.2013 10:39
JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.




Im Anschluss:

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Danach eine Kontrolle mit OTL bitte:
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles in CODE-Tags hier in den Thread.

Guadeno 05.03.2013 16:36
JRT:
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.6.8 (03.04.2013:1)
OS: Windows 7 Professional x64
Ran by Michael on 05.03.2013 at 16:19:04,79
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\toolbar\\{98889811-442d-49dd-99d7-dc866be87dbc}



~~~ Registry Keys

Successfully deleted: [Registry Key] hkey_classes_root\appid\babylonhelper.exe
Successfully deleted: [Registry Key] hkey_current_user\software\1clickdownload
Successfully deleted: [Registry Key] hkey_current_user\software\conduit
Successfully deleted: [Registry Key] hkey_local_machine\software\freeze.com
Successfully deleted: [Registry Key] hkey_local_machine\software\iminent
Successfully deleted: [Registry Key] hkey_current_user\software\softonic
Successfully deleted: [Registry Key] hkey_current_user\software\startsearch
Successfully deleted: [Registry Key] hkey_current_user\software\sweetim
Successfully deleted: [Registry Key] hkey_local_machine\software\sweetim
Successfully deleted: [Registry Key] hkey_current_user\software\appdatalow\software\pricegong
Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\escort.dll
Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\escortapp.dll
Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\escorteng.dll
Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\escortlbr.dll
Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\esrv.exe
Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\yontooieclient.dll
Successfully deleted: [Registry Key] hkey_local_machine\software\classes\prod.cap
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\tracing\babylon_rasapi32
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\tracing\babylon_rasmancs
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\tracing\mybabylontb_rasapi32
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\tracing\mybabylontb_rasmancs
Successfully deleted: [Registry Key] hkey_local_machine\software\wow6432node\microsoft\tracing\babylontc_rasapi32
Successfully deleted: [Registry Key] hkey_local_machine\software\wow6432node\microsoft\tracing\babylontc_rasmancs
Successfully deleted: [Registry Key] hkey_current_user\software\microsoft\internet explorer\searchscopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\tarma installer"
Successfully deleted: [Folder] "C:\Users\Michael\appdata\locallow\pricegong"



~~~ FireFox

Successfully deleted: [File] C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\user.js
Successfully deleted the following from C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\prefs.js

user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
user_pref("browser.search.defaultengine", "Ask.com");
user_pref("browser.search.defaultenginename", "Ask.com");
user_pref("browser.search.order.1", "Ask.com");
user_pref("extensions.BabylonToolbar.admin", false);
user_pref("extensions.BabylonToolbar.aflt", "babsst");
user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");
user_pref("extensions.BabylonToolbar.babExt", "");
user_pref("extensions.BabylonToolbar.babTrack", "affID=109958&tt=220512_53ctrl");
user_pref("extensions.BabylonToolbar.babext", "babExt");
user_pref("extensions.BabylonToolbar.babtrack", "babTrack");
user_pref("extensions.BabylonToolbar.bbDpng", "6");
user_pref("extensions.BabylonToolbar.cntry", "DE");
user_pref("extensions.BabylonToolbar.dfltLng", "de");
user_pref("extensions.BabylonToolbar.dfltlng", "de");
user_pref("extensions.BabylonToolbar.dfltsrch", "false");
user_pref("extensions.BabylonToolbar.dpkLst", "1169821598,3855095921,302281469,2400444324,3654782829,1334533236,3874294282,3866767559,3224935090,3754950497,1766448872,27406703
user_pref("extensions.BabylonToolbar.envrmnt", "production");
user_pref("extensions.BabylonToolbar.excTlbr", false);
user_pref("extensions.BabylonToolbar.firstrun", false);
user_pref("extensions.BabylonToolbar.hdrMd5", "19F48F375A81A28DEB45861EF2E74FDE");
user_pref("extensions.BabylonToolbar.hmpg", false);
user_pref("extensions.BabylonToolbar.hrdid", "d29ea71a00000000000000ffaa9ade88");
user_pref("extensions.BabylonToolbar.id", "d29ea71a00000000000000ffaa9ade88");
user_pref("extensions.BabylonToolbar.instlDay", "15619");
user_pref("extensions.BabylonToolbar.instlRef", "na");
user_pref("extensions.BabylonToolbar.instlday", "15619");
user_pref("extensions.BabylonToolbar.instlref", "na");
user_pref("extensions.BabylonToolbar.isdcmntcmplt", true);
user_pref("extensions.BabylonToolbar.keywordurl", "");
user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.8.0.723:24:08");
user_pref("extensions.BabylonToolbar.lastdp", 6);
user_pref("extensions.BabylonToolbar.mntrvrsn", "1.3.1");
user_pref("extensions.BabylonToolbar.newTab", true);
user_pref("extensions.BabylonToolbar.newtab", true);
user_pref("extensions.BabylonToolbar.newtaburl", "");
user_pref("extensions.BabylonToolbar.pnu_base", "{\"newVrsn\":\"33\",\"lastVrsn\":\"33\",\"vrsnLoad\":\"\",\"showMsg\":\"false\",\"showSilent\":\"false\",\"msgTs\":0}");
user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
user_pref("extensions.BabylonToolbar.prtnrid", "babylon");
user_pref("extensions.BabylonToolbar.savedVrsnTs", "1");
user_pref("extensions.BabylonToolbar.sg", "azb");
user_pref("extensions.BabylonToolbar.smplGrp", "azb");
user_pref("extensions.BabylonToolbar.smplgrp", "azb");
user_pref("extensions.BabylonToolbar.srcExt", "ss");
user_pref("extensions.BabylonToolbar.srcext", "ss");
user_pref("extensions.BabylonToolbar.srch", "");
user_pref("extensions.BabylonToolbar.srchprvdr", "");
user_pref("extensions.BabylonToolbar.tlbrId", "base");
user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=d29ea71a00000000000000ffaa9ade88&q=");
user_pref("extensions.BabylonToolbar.tlbrid", "base");
user_pref("extensions.BabylonToolbar.tlbrsrchurl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=d29ea71a00000000000000ffaa9ade88&q=");
user_pref("extensions.BabylonToolbar.vrsn", "1.8.0.7");
user_pref("extensions.BabylonToolbar.vrsnTs", "1.8.0.723:24:08");
user_pref("extensions.BabylonToolbar.vrsni", "1.8.0.7");
user_pref("extensions.BabylonToolbar.vrsnts", "1.8.0.723:24:08");
user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
user_pref("extensions.BabylonToolbar_i.babExt", "");
user_pref("extensions.BabylonToolbar_i.babTrack", "affID=109958&tt=220512_53ctrl");
user_pref("extensions.BabylonToolbar_i.hardId", "d29ea71a000000000000bc5ff41e50bd");
user_pref("extensions.BabylonToolbar_i.id", "d29ea71a000000000000bc5ff41e50bd");
user_pref("extensions.BabylonToolbar_i.instlDay", "15494");
user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
user_pref("extensions.BabylonToolbar_i.newTab", true);
user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=109958&tt=220512_53ctrl&babsrc=NT_ss&mntrId=d29ea71a000000000000bc5ff41e50bd");
user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.0.723:24:08");
user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
user_pref("extentions.y2layers.defaultEnableAppsList", "twittube,buzzdock,YontooNewOffers");
user_pref("extentions.y2layers.installId", "3c4ed99b-1f35-43a5-8abd-25b3284dbf65");
Emptied folder: C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\minidumps [1363 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05.03.2013 at 16:23:49,15
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
AdwCleaner[S1]:
Code:
# AdwCleaner v2.114 - Datei am 05/03/2013 um 16:25:13 erstellt
# Aktualisiert am 05/03/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : Michael - MICHAEL-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Michael\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\7zicrbwu.default\foxydeal.sqlite
Ordner Gelöscht : C:\Users\Michael\AppData\Local\APN
Ordner Gelöscht : C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\7zicrbwu.default\jetpack

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{6E8BF012-2C85-4834-B10A-1B31AF173D70}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jbpkiefagocgkmemidfngdkamloieekf
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16464

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v19.0 (de)

Datei : C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\7zicrbwu.default\prefs.js

Gelöscht : user_pref("extensions.BabylonToolbar.pnu_base", "{\"newVrsn\":\"33\",\"lastVrsn\":\"33\",\"vrsnLoad\[...]

Datei : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\cy8yskoh.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Google Chrome v25.0.1364.97

Datei : C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Preferences

Gelöscht [l.1] : icon_url ={"backup":{"_signature":"ChmjzleI3OUlNN1hnCQzM9lRYN9oTL/fFsD8Jt5gMMM=","_version":4,"extensions":{"i[...]

*************************

AdwCleaner[R1].txt - [27713 octets] - [05/03/2013 16:25:02]
AdwCleaner[S1].txt - [8549 octets] - [05/03/2013 16:25:13]

########## EOF - C:\AdwCleaner[S1].txt - [8609 octets] ##########
OTL:
Code:
OTL logfile created on: 05.03.2013 16:29:34 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Michael\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,43 Gb Available Physical Memory | 80,33% Memory free
16,00 Gb Paging File | 14,24 Gb Available in Paging File | 89,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 303,67 Gb Free Space | 65,21% Space Free | Partition Type: NTFS
Drive I: | 931,51 Gb Total Space | 601,53 Gb Free Space | 64,58% Space Free | Partition Type: NTFS
 
Computer Name: MICHAEL-PC | User Name: Michael | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Michael\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (TeamViewer8) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Hamachi2Svc) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (UMVPFSrv) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (npggsvc) -- C:\Windows\SysWOW64\GameMon.des (INCA Internet Co., Ltd.)
SRV - (rpcapd) -- C:\Program Files (x86)\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (ACDaemon) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Neo_VPN) -- C:\Windows\SysNative\drivers\Neo_0023.sys (SoftEther Corporation)
DRV:64bit: - (FNETTBOH_305) -- C:\Windows\SysNative\drivers\FNETTBOH_305.SYS (FNet Co., Ltd.)
DRV:64bit: - (FNETURPX) -- C:\Windows\SysNative\drivers\FNETURPX.SYS (FNet Co., Ltd.)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (AODDriver4.2) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys (Advanced Micro Devices)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (LVUVC64) -- C:\Windows\SysNative\drivers\lvuvc64.sys (Logitech Inc.)
DRV:64bit: - (LVRS64) -- C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.)
DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia)
DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia)
DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia)
DRV:64bit: - (WCMVCAM) -- C:\Windows\SysNative\drivers\wcmvcam64.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (AsrAppCharger) -- C:\Windows\SysNative\drivers\AsrAppCharger.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (VClone) -- C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG)
DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (vpcvmm) -- C:\Windows\SysNative\drivers\vpcvmm.sys (Microsoft Corporation)
DRV:64bit: - (vpcbus) -- C:\Windows\SysNative\drivers\vpchbus.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (vpcusb) -- C:\Windows\SysNative\drivers\vpcusb.sys (Microsoft Corporation)
DRV:64bit: - (vpcnfltr) -- C:\Windows\SysNative\drivers\vpcnfltr.sys (Microsoft Corporation)
DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation)
DRV:64bit: - (RTL2832UBDA) -- C:\Windows\SysNative\drivers\RTL2832UBDA.sys (REALTEK SEMICONDUCTOR Corp.)
DRV:64bit: - (RTL2832UUSB) -- C:\Windows\SysNative\drivers\RTL2832UUSB.sys (REALTEK SEMICONDUCTOR Corp.)
DRV:64bit: - (NPF) -- C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.)
DRV:64bit: - (RTL2832U_IRHID) -- C:\Windows\SysNative\drivers\RTL2832U_IRHID.sys (Realtek)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (AtiPcie) -- C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia)
DRV - (RTL2832UUSB) -- C:\Windows\SysWOW64\drivers\RTL2832UUSB.sys (REALTEK SEMICONDUCTOR Corp.)
DRV - (RTL2832UBDA) -- C:\Windows\SysWOW64\drivers\RTL2832UBDA.sys (REALTEK SEMICONDUCTOR Corp.)
DRV - (RTL2832U_IRHID) -- C:\Windows\SysWOW64\drivers\RTL2832U_IRHID.sys (Realtek)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (NPPTNT2) -- C:\Windows\SysWOW64\npptNT2.sys (INCA Internet Co., Ltd.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 9C C8 40 CD 15 34 CD 01  [binary data]
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..\SearchScopes\{D04F2B30-4034-4EC5-8963-2D93F494FA47}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=NDV&o=15765&src=kw&q={searchTerms}&locale=&apn_ptnrs=NY&apn_dtid=YYYYYYUODE&apn_uid=B73629B3-9CFB-41AB-B7F1-AF6E6763160B&apn_sauid=E98B1F9D-A8CB-477A-9B03-E751AF19D97F&
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "chrome://speeddial/content/speeddial.xul"
FF - prefs.js..extensions.enabledAddons: %7Bbb6bc1bb-f824-4702-90cd-35e2fb24f25d%7D:1.5.1.1
FF - prefs.js..extensions.enabledAddons: %7BEF522540-89F5-46b9-B6FE-1829E2B572C6%7D:6.1
FF - prefs.js..extensions.enabledAddons: %7BDDC359D1-844A-42a7-9AA1-88A850A938A8%7D:2.0.15
FF - prefs.js..extensions.enabledAddons: %7B64161300-e22b-11db-8314-0800200c9a66%7D:0.9.6.14
FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.4.7
FF - prefs.js..extensions.enabledAddons: %7B19503e42-ca3c-4c27-b1e2-9cdb2170ee34%7D:1.5.4.2
FF - prefs.js..extensions.enabledAddons: personas%40christopher.beard:1.6.3
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0
FF - prefs.js..network.proxy.autoconfig_url: "https://secure.premiumize.me/dcf75e1b0d1f135d265122b7f09b2e6c/proxy.pac"
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_171.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.10.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.10.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1166636.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.122.0: C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.138.0: C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=2.1.3: C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@playstation.com/PsndlCheck,version=1.00: C:\Program Files (x86)\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Michael\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Michael\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.02.27 16:22:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\jid1-VZC3jSUSB1KxYw@jetpack: C:\Users\Michael\AppData\Roaming\Vaginallesen\jid1-VZC3jSUSB1KxYw@jetpack\
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 19.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.02.27 16:22:53 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 19.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012.05.17 11:16:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\Extensions
[2013.03.01 17:38:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\7zicrbwu.default\extensions
[2012.08.31 23:45:32 | 000,000,000 | ---D | M] (Cookies Manager+) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\7zicrbwu.default\extensions\{bb6bc1bb-f824-4702-90cd-35e2fb24f25d}
[2013.02.15 01:46:25 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\7zicrbwu.default\extensions\ich@maltegoetz.de
[2013.03.01 17:38:43 | 000,343,105 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\extensions\personas@christopher.beard.xpi
[2013.02.23 16:35:21 | 000,348,178 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi
[2013.02.12 17:25:14 | 000,281,921 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
[2013.02.14 21:11:12 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.01.26 22:55:48 | 000,698,867 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
[2012.11.05 13:08:44 | 000,045,219 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6}.xpi
[2013.02.27 16:22:51 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.02.27 16:22:53 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
 
========== Chrome  ==========
 
CHR - Extension: No name found = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\
CHR - Extension: No name found = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: No name found = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: No name found = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\14.2.0.1_0\
CHR - Extension: No name found = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2013.03.04 22:17:20 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2:64bit: - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\.DEFAULT\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-19\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..Trusted Domains: sony.com ([]* in Trusted sites)
O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C459B77A-A33C-4EB7-88A6-A9BCEA2849E3}: DhcpNameServer = 192.168.2.1 192.168.2.1
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18:64bit: - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.03.05 16:29:15 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe
[2013.03.05 16:19:01 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.03.05 16:18:40 | 000,000,000 | ---D | C] -- C:\JRT
[2013.03.04 22:33:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0
[2013.03.04 22:29:42 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.03.04 22:29:42 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2013.03.04 22:29:42 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.03.04 22:29:42 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2013.03.04 22:29:42 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2013.03.04 22:29:42 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2013.03.04 22:29:42 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2013.03.04 22:29:41 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.03.04 22:29:41 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2013.03.04 22:29:41 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2013.03.04 22:29:41 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.03.04 22:29:41 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2013.03.04 22:29:39 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.03.04 22:29:39 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.03.04 22:29:39 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2013.03.04 22:28:58 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2013.03.04 22:28:58 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2013.03.04 22:28:58 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2013.03.04 22:28:58 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2013.03.04 22:28:58 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2013.03.04 22:28:58 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2013.03.04 22:28:53 | 005,553,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2013.03.04 22:28:52 | 003,967,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2013.03.04 22:28:52 | 003,913,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2013.03.04 22:28:51 | 000,288,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS
[2013.03.04 22:19:25 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013.03.04 22:17:23 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2013.03.04 19:55:25 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.03.04 19:55:25 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.03.04 19:55:25 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.03.04 19:55:23 | 000,000,000 | ---D | C] -- C:\ComboFix
[2013.03.04 19:55:22 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.03.04 19:55:12 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.03.01 18:36:33 | 000,000,000 | ---D | C] -- C:\Users\Michael\jagexcache
[2013.03.01 14:33:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack x64
[2013.03.01 14:33:29 | 000,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack x64
[2013.02.28 16:20:14 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2013.02.27 16:22:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.02.26 14:22:04 | 000,108,832 | ---- | C] (PC Tools) -- C:\Windows\SysWow64\drivers\PCTDMDefrag.sys
[2013.02.26 14:22:04 | 000,082,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml4r.dll
[2013.02.26 14:22:04 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml4a.dll
[2013.02.26 14:03:28 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2013.02.26 14:03:28 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2013.02.26 14:03:27 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\Product_PT
[2013.02.25 16:37:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts
[2013.02.23 22:18:06 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\Malwarebytes
[2013.02.23 22:18:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.02.23 22:18:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.02.23 22:17:59 | 000,024,176 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.02.23 22:17:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013.02.23 21:32:40 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\ElevatedDiagnostics
[2013.02.22 18:47:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Bohemia Interactive Studio
[2013.02.20 16:38:16 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\AMD
[2013.02.20 16:37:59 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\ATI
[2013.02.20 16:37:59 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\ATI
[2013.02.20 16:37:59 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2013.02.20 16:35:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT
[2013.02.20 16:35:51 | 000,000,000 | ---D | C] -- C:\Program Files\AMD
[2013.02.20 16:35:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD
[2013.02.20 16:35:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2013.02.20 16:35:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies
[2013.02.20 16:35:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies
[2013.02.20 16:35:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2013.02.20 16:35:07 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD
[2013.02.20 16:34:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2013.02.20 16:33:46 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2013.02.20 16:33:05 | 000,000,000 | ---D | C] -- C:\AMD
[2013.02.19 14:33:01 | 000,194,488 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\drivers\nvhda64v.sys
[2013.02.19 14:33:01 | 000,031,672 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhdap64.dll
[2013.02.16 19:25:29 | 000,000,000 | ---D | C] -- C:\Users\Michael\Desktop\Serien
[2013.02.16 16:05:58 | 000,000,000 | ---D | C] -- C:\Users\Michael\Documents\EA Games
[2013.02.16 16:05:40 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\EA Games
[2013.02.16 13:47:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Cleaner Pro
[2013.02.15 16:57:33 | 000,000,000 | ---D | C] -- C:\Users\Michael\.dvdcss
[2013.02.15 16:57:22 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\MPlayer
[2013.02.15 16:56:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDx 4.0
[2013.02.15 16:32:30 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\dvdcss
[2013.02.13 19:28:32 | 026,931,128 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll
[2013.02.13 19:28:32 | 020,450,232 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglv32.dll
[2013.02.13 19:28:32 | 018,054,312 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll
[2013.02.13 19:28:32 | 015,129,064 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvd3dum.dll
[2013.02.13 19:28:32 | 015,052,368 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvwgf2umx.dll
[2013.02.13 19:28:32 | 012,641,120 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvwgf2um.dll
[2013.02.13 19:28:32 | 007,565,240 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvopencl.dll
[2013.02.13 19:28:32 | 006,263,784 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvopencl.dll
[2013.02.13 19:28:32 | 002,720,696 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvid.dll
[2013.02.13 19:28:32 | 001,813,432 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco64.dll
[2013.02.13 19:28:32 | 001,504,696 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispgenco64.dll
[2013.02.13 19:28:31 | 025,256,376 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll
[2013.02.13 19:28:31 | 017,560,504 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcompiler.dll
[2013.02.13 19:28:31 | 009,389,888 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll
[2013.02.13 19:28:31 | 007,931,896 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuda.dll
[2013.02.13 19:28:31 | 002,904,504 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll
[2013.02.13 19:28:31 | 002,824,656 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvapi64.dll
[2013.02.13 19:28:31 | 002,504,248 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvapi.dll
[2013.02.13 19:28:31 | 002,344,888 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvenc.dll
[2013.02.13 19:28:31 | 001,985,976 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvenc.dll
[2013.02.13 19:28:31 | 001,107,592 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvumdshimx.dll
[2013.02.13 19:28:31 | 000,958,272 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvumdshim.dll
[2013.02.13 19:28:31 | 000,246,024 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvinitx.dll
[2013.02.13 19:28:31 | 000,201,728 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvinit.dll
[2013.02.10 17:29:32 | 000,000,000 | ---D | C] -- C:\Users\Michael\Documents\GUILD WARS
[2013.02.09 22:45:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2013.02.09 22:45:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft
[2013.02.09 22:45:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft
[2013.02.09 22:42:26 | 000,000,000 | ---D | C] -- C:\Users\Michael\Documents\ConvertXtoDVD
[2013.02.09 22:25:17 | 000,082,816 | ---- | C] (VSO Software) -- C:\Users\Michael\AppData\Roaming\pcouffin.sys
[2013.02.09 22:25:17 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\Vso
[2013.02.09 22:25:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\vso
[2013.02.09 22:25:13 | 000,000,000 | ---D | C] -- C:\ProgramData\VSO
[2013.02.07 14:40:07 | 001,304,032 | ---- | C] (techPowerUp (www.techpowerup.com)) -- C:\Users\Michael\Desktop\GPU-Z.0.6.7.exe
[2013.02.06 20:14:48 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\AnvSoft
[2013.02.06 20:08:46 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA%
[2013.02.06 20:08:10 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\Media Player Classic
[2013.02.06 20:00:14 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mega Codec Pack
[2013.02.04 19:47:52 | 000,000,000 | ---D | C] -- C:\Users\Michael\.shsh
[2013.02.04 18:31:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013.02.04 18:31:18 | 000,033,240 | ---- | C] (GEAR Software Inc.) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys
[2013.02.04 18:31:09 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013.02.04 18:31:08 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2013.02.04 18:31:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2013.02.04 18:31:08 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2013.02.04 18:29:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2013.02.04 18:29:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.03.05 16:29:17 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe
[2013.03.05 16:26:23 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.03.05 16:26:23 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\drivers\lvuvc.hs
[2013.03.05 16:26:16 | 2146,885,631 | -HS- | M] () -- C:\hiberfil.sys
[2013.03.05 16:23:04 | 000,024,928 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.03.05 16:23:04 | 000,024,928 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.03.05 16:21:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.03.05 16:15:31 | 000,413,016 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.03.04 22:32:18 | 001,638,622 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.03.04 22:32:18 | 000,698,958 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.03.04 22:32:18 | 000,652,940 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.03.04 22:32:18 | 000,148,756 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.03.04 22:32:18 | 000,121,614 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.03.04 22:17:20 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.03.04 21:55:00 | 000,001,128 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4149896342-1631694950-3810678737-1000UA.job
[2013.03.04 17:02:59 | 000,291,088 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2013.03.04 17:02:59 | 000,291,088 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2013.03.04 17:02:35 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2013.03.04 14:55:00 | 000,001,076 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4149896342-1631694950-3810678737-1000Core.job
[2013.03.01 20:11:48 | 000,000,024 | ---- | M] () -- C:\Users\Michael\random.dat
[2013.03.01 19:13:39 | 000,000,048 | ---- | M] () -- C:\Users\Michael\jagex_cl_loginapplet_LIVE.dat
[2013.03.01 18:36:33 | 000,000,046 | ---- | M] () -- C:\Users\Michael\jagex_cl_runescape_LIVE.dat
[2013.03.01 14:21:15 | 000,691,568 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.03.01 14:21:15 | 000,071,024 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.02.28 16:20:10 | 604,152,211 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013.02.26 13:56:40 | 000,002,380 | ---- | M] () -- C:\Users\Michael\Desktop\Google Chrome.lnk
[2013.02.20 16:37:05 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2013.02.09 22:43:18 | 000,082,816 | ---- | M] (VSO Software) -- C:\Users\Michael\AppData\Roaming\pcouffin.sys
[2013.02.09 22:43:18 | 000,007,859 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\pcouffin.cat
[2013.02.09 22:43:18 | 000,001,167 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\pcouffin.inf
[2013.02.07 14:40:31 | 001,304,032 | ---- | M] (techPowerUp (www.techpowerup.com)) -- C:\Users\Michael\Desktop\GPU-Z.0.6.7.exe
[2013.02.06 19:00:00 | 000,127,488 | ---- | M] () -- C:\Windows\SysNative\ff_vfw.dll
[2013.02.06 13:48:03 | 000,000,600 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\winscp.rnd
[2013.02.04 19:51:24 | 000,000,950 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.umbrella
[2013.02.04 18:31:23 | 000,001,783 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.03.04 19:55:25 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.03.04 19:55:25 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.03.04 19:55:25 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.03.04 19:55:25 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.03.04 19:55:25 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.03.01 19:13:12 | 000,000,048 | ---- | C] () -- C:\Users\Michael\jagex_cl_loginapplet_LIVE.dat
[2013.03.01 18:36:33 | 000,000,046 | ---- | C] () -- C:\Users\Michael\jagex_cl_runescape_LIVE.dat
[2013.03.01 18:36:33 | 000,000,024 | ---- | C] () -- C:\Users\Michael\random.dat
[2013.03.01 14:33:31 | 000,206,336 | ---- | C] () -- C:\Windows\SysNative\unrar64.dll
[2013.03.01 14:33:31 | 000,148,992 | ---- | C] ( ) -- C:\Windows\SysNative\lagarith.dll
[2013.03.01 14:33:30 | 000,127,488 | ---- | C] () -- C:\Windows\SysNative\ff_vfw.dll
[2013.02.28 17:19:50 | 000,001,102 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk
[2013.02.28 16:20:10 | 604,152,211 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2013.02.23 21:23:45 | 000,413,016 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.02.20 16:37:05 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2013.02.15 16:24:38 | 356,806,655 | ---- | C] () -- C:\Users\Michael\Desktop\Inception.img
[2013.02.13 19:28:31 | 000,017,266 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb
[2013.02.09 22:25:17 | 000,007,859 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\pcouffin.cat
[2013.02.09 22:25:17 | 000,001,167 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\pcouffin.inf
[2012.12.26 19:01:03 | 000,073,832 | ---- | C] () -- C:\Windows\SysWow64\SuperFrameSplitter.dll
[2012.12.26 19:01:03 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\RTKDABMWare.dll
[2012.12.21 21:34:46 | 000,000,623 | ---- | C] () -- C:\Windows\SysWow64\W_DEBUG.DAT
[2012.12.21 21:32:49 | 000,000,094 | ---- | C] () -- C:\Windows\WET.INI
[2012.12.19 20:52:22 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.12.19 20:52:22 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.11.27 14:50:46 | 000,001,037 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\MPQEditor.ini
[2012.11.24 14:51:13 | 001,712,128 | ---- | C] () -- C:\Windows\SysWow64\libmysql_d.dll
[2012.11.10 01:23:20 | 000,000,842 | ---- | C] () -- C:\Users\Michael\AppData\Local\recently-used.xbel
[2012.09.21 19:49:28 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\Access.dat
[2012.08.22 22:27:14 | 000,000,001 | ---- | C] () -- C:\Windows\SysWow64\SI.bin
[2012.08.21 15:05:53 | 000,473,600 | ---- | C] () -- C:\Windows\SysWow64\Harmony.dll
[2012.08.21 15:05:53 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\Unlha32.dll
[2012.08.21 15:05:53 | 000,087,040 | ---- | C] () -- C:\Windows\UnGins.exe
[2012.08.13 15:20:56 | 000,003,072 | ---- | C] () -- C:\Users\Michael\AppData\Local\file__0.localstorage
[2012.07.03 18:12:00 | 003,130,440 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_blr.exe
[2012.06.26 13:08:26 | 000,000,019 | ---- | C] () -- C:\Windows\SoundConverter.INI
[2012.06.26 13:06:44 | 000,004,140 | ---- | C] () -- C:\ProgramData\mtbjfghn.xbe
[2012.06.19 13:02:17 | 003,123,272 | R--- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2012.06.13 18:53:56 | 000,000,600 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\winscp.rnd
[2012.06.01 17:38:55 | 000,291,088 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.06.01 17:38:53 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012.05.28 15:18:41 | 000,007,598 | ---- | C] () -- C:\Users\Michael\AppData\Local\Resmon.ResmonCfg
[2012.05.17 19:18:09 | 001,594,698 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.05.17 11:05:02 | 000,000,003 | ---- | C] () -- C:\Users\Michael\AppData\Local\user_data.ini
[2012.05.02 13:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012.01.18 06:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll
[2012.01.18 06:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2012.01.18 06:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\SysWow64\LogiDPPApp.exe
[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 03:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:0D786AE3

< End of report >
Extra:
Code:
OTL Extras logfile created on: 05.03.2013 16:29:34 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Michael\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,43 Gb Available Physical Memory | 80,33% Memory free
16,00 Gb Paging File | 14,24 Gb Available in Paging File | 89,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 303,67 Gb Free Space | 65,21% Space Free | Partition Type: NTFS
Drive I: | 931,51 Gb Total Space | 601,53 Gb Free Space | 64,58% Space Free | Partition Type: NTFS
 
Computer Name: MICHAEL-PC | User Name: Michael | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
.jse[@ = JSEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.wsf[@ = WSFFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.jse [@ = JSEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-4149896342-1631694950-3810678737-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
wsffile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
wsffile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05EA2353-5447-487B-BA10-2C9E1AE9421A}" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{0D047B51-3237-4D2B-AD45-B0CA7EBD3094}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1637\agent.exe |
"{1068B2B8-D89E-49FF-B1C5-DBE2A51B65A5}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1637\agent.exe |
"{1C86B4A4-67BA-4536-B1F6-E5C0A46A2E2E}" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{1EBEBA21-0A6C-49D0-B007-DE5D72727767}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1637\agent.exe |
"{37F3B635-3B2A-49EA-9EFD-6352052008B6}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe |
"{3DABEA4F-9659-4A43-B39B-36DEE77CD1B4}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe |
"{3F2EA7A5-DB79-449A-B8AA-C949C65B0B16}" = protocol=6 | dir=in | app=c:\windows\system32\java.exe |
"{435341A5-3B35-4B44-89B2-E9CA7F5C0EEF}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1675\agent.exe |
"{44B4A78C-C989-4FDB-BE59-2B157B7E1338}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe |
"{4A7DEE94-F889-486A-A15A-B2962B2502F4}" = protocol=6 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{50977BBA-8A82-4074-A062-D0A8A4F6BE10}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{564619D1-B0CF-4639-9CF7-E6D09A3A2EE6}" = protocol=17 | dir=in | app=i:\spiele\starcraft ii\versions\base24944\sc2.exe |
"{74FCF080-5C34-4ADE-A18F-746C263D8B98}" = protocol=17 | dir=in | app=c:\windows\system32\java.exe |
"{90D925DD-B0C4-4FB0-8FF7-AF8C0A8A9DA0}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 |
"{9681A878-707C-44DD-8E8B-F0F42AB492A1}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe |
"{972B283B-07B5-413C-9382-103C70F3C82F}" = protocol=17 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{99C02A40-5FED-4675-988B-B8DA9D0E76D0}" = dir=in | app=c:\program files (x86)\steam\steamapps\common\the war z\warz.exe |
"{99C53A0D-67F6-4687-9043-91F78B9B989E}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1675\agent.exe |
"{A819A2EE-D99A-44F6-A802-F5D040EEFBCA}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe |
"{B4874B9F-B827-48C7-9698-59F9C7804F4C}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1637\agent.exe |
"{B96E0666-831B-4BBA-BA51-D44E6BEB6DE4}" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"{C13E9380-A549-43B6-864A-EFC525C5D55E}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe |
"{D0B92CB3-1ABD-4F9E-8F4F-0D32C73702A6}" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"{DA0D18A9-C7B7-4486-AFEC-917E80EFE835}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{E124F3AD-7BCC-4D59-A3A0-4FEF46442F4B}" = protocol=6 | dir=in | app=i:\spiele\starcraft ii\versions\base24944\sc2.exe |
"{E7418212-2BCB-4156-B6DC-3CBDD5D2404F}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe |
"{ED3CE818-8E2E-494E-9A22-8693E7EDD911}" = protocol=58 | dir=in | app=system |
"{F0E36C94-F558-49BD-B32A-EE672833ABD1}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe |
"TCP Query User{0C42CEB0-D234-467F-BF3F-D2156D19E239}C:\program files (x86)\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"TCP Query User{281DB9BC-45A7-4851-A2AB-755458258887}C:\windows\system32\java.exe" = protocol=6 | dir=in | app=c:\windows\system32\java.exe |
"TCP Query User{36BC93D8-3FE1-40E7-92F5-5A96815098AF}C:\program files (x86)\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"TCP Query User{9D94EF77-6123-4F25-973C-9C9F79925427}C:\program files (x86)\origin games\battlefield 3\bf3.exe" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe |
"TCP Query User{BD640BBF-EA55-4D76-99F8-C3FC4B0C3262}I:\spiele\starcraft ii\versions\base24944\sc2.exe" = protocol=6 | dir=in | app=i:\spiele\starcraft ii\versions\base24944\sc2.exe |
"TCP Query User{D57EEFB4-0613-46C9-8F16-3EDAC781C490}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"UDP Query User{00484D47-CF8C-4728-BD49-3809503665B0}C:\program files (x86)\origin games\battlefield 3\bf3.exe" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe |
"UDP Query User{137AD99F-45B8-4758-B07A-AC6470EB570E}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"UDP Query User{2141171D-B592-4220-BB84-A69D4FC35C79}C:\windows\system32\java.exe" = protocol=17 | dir=in | app=c:\windows\system32\java.exe |
"UDP Query User{34189B4E-DB2A-48B9-8A0C-8496B763575B}C:\program files (x86)\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"UDP Query User{FD29A491-251D-40CD-A13D-A7DEED3BEE4A}I:\spiele\starcraft ii\versions\base24944\sc2.exe" = protocol=17 | dir=in | app=i:\spiele\starcraft ii\versions\base24944\sc2.exe |
"UDP Query User{FDE78908-6D1E-446D-A3DD-3B55FE1786C2}C:\program files (x86)\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1" = Core Temp 1.0 RC3
"{0E5D76AD-A3FB-48D5-8400-8903B10317D3}" = iTunes
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{26A24AE4-039D-4CA4-87B4-2F86417010FF}" = Java 7 Update 10 (64-bit)
"{3145731D-C578-70ED-899F-7A670D2A6662}" = AMD Fuel
"{44610EE0-C908-D8F1-425D-914A5B745DEA}" = AMD Drag and Drop Transcoding
"{4975DE61-6BF6-B9BC-1FDE-C04C5EC78E4C}" = AMD Media Foundation Decoders
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}" = Paint.NET v3.5.10
"{5E03A267-415E-5383-FA8F-3CE4145663B9}" = AMD Catalyst Install Manager
"{68660049-8D48-427C-9FF7-139D8340CDC0}" = MSVC80_x64
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{833F5E6D-6E01-11D1-978E-6DFBCEF72570}" = AMD Steady Video Plug-In
"{89EE4A30-080F-2C95-6F78-C98D18FBD74D}" = AMD Accelerated Video Transcoding
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{9CF11D16-ECEB-90A5-A028-CA9E068D848B}" = ccc-utility64
"{A7C8BBDE-FE98-11E1-87C9-F04DA23A5C58}" = Vegas Pro 12.0 (64-bit)
"{AB085680-FE98-11E1-A232-F04DA23A5C58}" = MSVCRT Redists
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.1031
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.23.1
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{D70884EA-E2CE-4539-91DB-4766CC1E5F5F}" = Apple Mobile Device Support
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"ASRock App Charger_is1" = ASRock App Charger v1.0.5
"CCleaner" = CCleaner
"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"GIMP-2_is1" = GIMP 2.8.2
"KLiteCodecPack64_is1" = K-Lite Codec Pack 9.7.5 (64-bit)
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Recuva" = Recuva
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Unlocker" = Unlocker 1.9.1-x64
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{01386D1F-ADE7-43B4-A4E9-312FC5BC726F}_is1" = SWF Opener
"{017F8447-2A1D-0DDB-B5D7-CA2BFACE2886}" = CCC Help French
"{054E9A1C-3EA2-C657-E787-FD8DCF5C3D3B}" = CCC Help Czech
"{0C973594-7DDF-4BD0-84ED-3517F7622037}" = PC Connectivity Solution
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{106B4413-ACBB-4CDE-8707-587DB9BD77EC}" = LogMeIn Hamachi
"{1111706F-666A-4037-7777-210328764D10}" = JavaFX 2.1.0
"{1DE2BD51-0300-772D-5E18-F337D95D5687}" = CCC Help German
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20E23A40-38E5-4DD6-B738-BC8097AE66B6}_is1" = FTL version 1.03.1
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{224E8FEB-5C1F-077F-6FC5-602AC1AE644D}" = CCC Help Danish
"{259C0ABB-A3B2-4D70-008F-BF7EE491B70B}" = Need for Speed™ Carbon
"{26A24AE4-039D-4CA4-87B4-2F83217004FF}" = Java(TM) 7 Update 4
"{275E9C49-C72F-D754-DEB7-77F10A9C00D8}" = CCC Help Japanese
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{30049739-BE95-6591-B504-E6D7057D49CC}" = CCC Help Spanish
"{3F1EB155-F96E-EB7B-2EF2-7375490E0FA9}" = CCC Help English
"{45410935-B52C-468A-A836-0D1000018201}" = BulletStorm
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B023D7B-9E67-795D-FB31-B5E1F6DCA451}" = CCC Help Italian
"{4DE63AC8-5FF0-4D3C-B7F5-60AD9045E9E3}" = BF3 Colour Tweaker
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{52D02A2B-03D2-4E34-A358-DC5D951FD296}" = Nokia Connectivity Cable Driver
"{55F6C486-8C75-2A72-DAFE-CE78A624C9F7}" = CCC Help Russian
"{5AF23993-7152-1620-E43F-1B4542FB4F84}" = CCC Help Thai
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{63326924-3CAF-C858-3A8F-8598C87019D7}" = AMD VISION Engine Control Center
"{63822E89-11AA-F8EC-D433-F72A85799EC0}" = CCC Help Greek
"{64BFBE7A-886C-4CA2-A9B4-0C2B5A5942BC}" = Battlefield 3™
"{66361420-4905-AEB8-17AE-172FDD164A7E}" = CCC Help Polish
"{6D316D67-DA52-4659-9C98-F479963534D6}" = Audiosurf
"{6E19AEFD-7F83-4563-A7B5-F61CABF02400}" = DayZ Commander
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72E80496-C446-4389-B4F2-CC46DF704A7F}" = Terrafirma
"{74292F90-895A-4FC6-A692-9641532B1B63}" = ArcSoft TotalMedia 3.5
"{769F2A4B-84A3-9486-ADD2-9E5AB4B4E1E3}" = Catalyst Control Center InstallProxy
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7FA1DAFD-AF55-E915-FD92-F269443A2ADF}" = Media Go Video Playback Engine 1.88.114.12060
"{835D562C-B72C-461D-A9C3-B8206B66E85A}" = RPG Maker VX Ace
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8773DD1C-5FB2-95B5-5A93-0EFEAC900A4D}" = CCC Help Norwegian
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}" = NVIDIA PhysX
"{8CCBB0BF-9CC1-1A65-BB93-56012A460EE6}" = CCC Help Portuguese
"{90140011-0062-0407-0000-0000000FF1CE}" = Microsoft Office Home and Business 2010 - Deutsch
"{909F8EBC-EC7F-48FF-0085-475D818F0F31}" = Need for Speed Underground 2
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{95140000-00AF-0407-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D15E813-0C26-41E7-ABC5-3EB06FF1B3CF}" = Assassin's Creed III 1.01
"{9DF0196F-B6B8-4C3A-8790-DE42AA530101}" = SPORE™
"{A0A3CE05-96CB-52E9-434E-074F3BB7807E}" = CCC Help Turkish
"{A2S166A0-F031-4E27-A057-C69733219434}_is1" = TERA
"{A9C64319-932F-D02B-B14C-FFFC3EC49E77}" = CCC Help Chinese Standard
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.3
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C09DB932-7619-7B56-30E3-C0454811D6D7}" = CCC Help Korean
"{C22A4697-BD77-ACB1-744F-1FD0A0BFF798}" = CCC Help Swedish
"{CCE825DB-347A-4004-A186-5F4A6FDD8547}" = Apple Application Support
"{D4B457B2-260F-C561-CA87-703BD3B724CA}" = Catalyst Control Center Graphics Previews Common
"{D6CDB506-297D-AE70-0EF6-DE5185F961BE}" = CCC Help Chinese Traditional
"{DBF1AE39-DA30-4B89-A7EB-3BDA675C5D9E}" = Media Go
"{DDBB7C89-1A09-441E-AA0F-6AA465755C17}" = REALTEK DTV USB DEVICE
"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding
"{E3B9C5A9-BD7A-4B56-B754-FAEA7DD6FA88}" = Far Cry 3
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E5F05232-96B6-4552-A480-785A60A94B21}" = System Requirements Lab CYRI
"{E913F678-7BAC-4C3D-A8ED-C19E13D3BAD0}" = DayZ Commander
"{ECFD508E-68A2-91B2-46DD-1D03D783D94B}" = Catalyst Control Center Localization All
"{EDE361D5-35A5-DA7D-3462-C3DABD24029B}" = CCC Help Hungarian
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F1E7DD6A-AE2D-D706-BEB3-937F76CA6AE9}" = CCC Help Finnish
"{F56F54DD-BCB2-1221-2CB7-E983A5CF9D15}" = CCC Help Dutch
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"0630-0716-3135-7887" = JDownloader 2
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Avira AntiVir Desktop" = Avira Free Antivirus
"Battlelog Web Plugins" = Battlelog Web Plugins
"BattlEye for OA" = BattlEye for OA Uninstall
"Borderlands 2_is1" = Borderlands 2
"Call of Duty Modern Warfare 2_is1" = Call of Duty Modern Warfare 2
"Cheat Engine 6.2_is1" = Cheat Engine 6.2
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"ESN Sonar-0.70.4" = ESN Sonar
"Fraps" = Fraps (remove only)
"Free Video to DVD Converter_is1" = Free Video to DVD Converter version 5.0.22.128
"ImgBurn" = ImgBurn
"LogMeIn Hamachi" = LogMeIn Hamachi
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Mozilla Firefox 19.0 (x86 de)" = Mozilla Firefox 19.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NCLauncher_GameForge" = NC Launcher (GameForge)
"NoIPDUC" = No-IP DUC
"Notepad++" = Notepad++
"Novo's Easy WoW Server 0.4.3" = Novo's Easy WoW Server 0.4.3
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"SkypePlayer" = Skype Audio Player (remove only)
"ST6UNST #1" = Visual Basic 6.0 Runtime&Steuerelemente
"StarCraft II" = StarCraft II
"Steam App 105600" = Terraria
"Steam App 113200" = The Binding of Isaac
"Steam App 12900" = Audiosurf
"Steam App 212370" = Arctic Combat
"Steam App 219540" = ARMA 2: Operation Arrowhead Beta
"Steam App 226700" = The War Z
"Steam App 33910" = ARMA 2
"Steam App 33930" = ARMA 2: Operation Arrowhead
"Steam App 3590" = Plants vs. Zombies: Game of the Year
"TeamViewer 8" = TeamViewer 8
"TechPowerUp GPU-Z" = TechPowerUp GPU-Z
"TechPowerUp OSD Server" = TechPowerUp OSD Server
"Universal Extractor_is1" = Universal Extractor 1.6.1
"Uplay" = Uplay
"uTorrent" = µTorrent
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 2.0.3
"WinPcapInst" = WinPcap 4.1.2
"World of Warcraft" = World of Warcraft
"World of Warcraft Public Test" = World of Warcraft Public Test
"XFast USB" = XFast USB
"zebNet Windows Keyfinder 2012 R24.0.0" = zebNet Windows Keyfinder 2012 R2
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-4149896342-1631694950-3810678737-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f58f3889281ea80b" = ContainerEx Decrypter
"Google Chrome" = Google Chrome
"Guild Wars" = GUILD WARS
"SOE-C:/Users/Michael/AppData/Local/Sony Online Entertainment/ApplicationUpdater" = applicationupdater
 
========== Last 20 Event Log Errors ==========
 
[ System Events ]
Error - 05.03.2013 11:26:30 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "WebcamMax, WDM Video Capture" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1058
 
 
< End of report >

cosinus 06.03.2013 00:03

Fixen mit OTL

  • Starte bitte die OTL.exe.
  • Kopiere nun den Inhalt aus der Codebox in die Textbox.
Code:
:OTL
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..\SearchScopes\{D04F2B30-4034-4EC5-8963-2D93F494FA47}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=NDV&o=15765&src=kw&q={searchTerms}&locale=&apn_ptnrs=NY&apn_dtid=YYYYYYUODE&apn_uid=B73629B3-9CFB-41AB-B7F1-AF6E6763160B&apn_sauid=E98B1F9D-A8CB-477A-9B03-E751AF19D97F&
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:0D786AE3
:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
  • Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
  • Schließe bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread

Guadeno 06.03.2013 15:36
Code:
All processes killed
========== OTL ==========
Registry key HKEY_USERS\S-1-5-21-4149896342-1631694950-3810678737-1000\Software\Microsoft\Internet Explorer\SearchScopes\{D04F2B30-4034-4EC5-8963-2D93F494FA47}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D04F2B30-4034-4EC5-8963-2D93F494FA47}\ not found.
ADS C:\ProgramData\TEMP:0D786AE3 deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Michael\Desktop\cmd.bat deleted successfully.
C:\Users\Michael\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Gast
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 4971360 bytes
->FireFox cache emptied: 1336779 bytes
->Flash cache emptied: 492 bytes
 
User: Michael
->Temp folder emptied: 84634 bytes
->Temporary Internet Files folder emptied: 7181158 bytes
->Java cache emptied: 38617074 bytes
->FireFox cache emptied: 79939695 bytes
->Google Chrome cache emptied: 99219628 bytes
->Flash cache emptied: 3966 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 401408 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 24721657 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 46356839 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 289,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.69.0 log created on 03062013_153113

Files\Folders moved on Reboot...
C:\Users\Michael\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

cosinus 06.03.2013 16:18
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes - denk bitte vorher daran, Malwarebytes über den Updatebutton zu aktualisieren

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Guadeno 06.03.2013 21:09
Code:
Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.03.06.11

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Michael :: MICHAEL-PC [Administrator]

06.03.2013 18:57:02
mbam-log-2013-03-06 (18-57-02).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 234578
Laufzeit: 2 Minute(n), 57 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=fc673a304742e64fb99f5d65e4ddec8d
# engine=13315
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-03-06 08:08:04
# local_time=2013-03-06 09:08:04 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775166 100 98 20816 228023774 13605 0
# compatibility_mode=5893 16776573 100 94 17582 114230334 0 0
# scanned=349799
# found=0
# cleaned=0
# scan_time=7186

cosinus 06.03.2013 22:54
Sieht soweit ok aus

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Guadeno 07.03.2013 13:38
Soweit funktioniert wieder alles so wie es funktionieren soll :)
Danke dir vielmals!! :D

cosinus 07.03.2013 13:47
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter.

Combofix entfernen (nur relevant wenn es hier benutzt wurde!) : Start/Ausführen (Tastenkombination WIN+R), dort den Befehl combofix /uninstall eintippen und ausführen

Mit Hilfe von OTL kannst du auch viele andere Tools entfernen: Starte dazu einfach OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate
Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.
Windows Vista/7: Start, Systemsteuerung, Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks findest du hier => Browsers and Plugins - FilePony.de

Alle Plugins im Firefox-Browser kannst du auch ganz einfach hier auf Aktualität prüfen => https://www.mozilla.org/de/plugincheck

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 05:26 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131