Programm Reste von GPX Konverter und Editor von der Seite Winload werden von Win Patrol gemeldet

Unterwegs43 · 15.07.2011, 13:45

Hallo,
erst mal danke für euer Engagement, dieses Angebot!
Ich habe von der Seite WWW.winload.de einen gpx Konverter und einen gpx Editor heruntergeladen und installiert. In der Installation war eine Toolbar inbegriffen, die ich nicht wollte. Sie wurde trotzdem installiert. In deinstallierte die Programme, die Toolbar, löschte aus der Partition C:\ das Verzeichnis "Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll". Trotz dieser Aktivitäten meldete Win Patrol zuletzt noch das oben genannte Verzeichnis "Mein Gutscheincode". Im IE konnte ich den Gutscheincode als Addon nur deaktivieren, eine Möglichkeit der Deinstallation wie bei Firefox konnte ich nicht entdecken.
Ich habe dann bei Google "\ConversionOneIE.dll" eingegeben und landete auf eurer Seite "Kazy Virus wieder einmal".
Mein PC funktioniert nach wie vor einwandfrei - nur die Meldung von Win Patrol sagt mir, dass noch Programm Reste aktiv sind.
Jetzt hoffe ich dass ich euch nicht mit einer Lapalie beschäftige - das Auftauchen eurer HP bei dem Stichwort "\ConversionOneIE.dll" hat mich dazu bewogen um Hilfe zu bitten.
Unterwegs43

cosinus · 15.07.2011, 15:23

Hallo und

Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Unterwegs43 · 16.07.2011, 10:41

Hallo Arne,
ich hatte erst einen Quick Scan gemacht, dann sah ich noch mal nach und dann einen Vollscan.
Ein schönes WE
Willi

cosinus · 16.07.2011, 16:17

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

ATTFilter

:OTL
PRC - [2011.06.24 18:22:40 | 000,534,880 | ---- | M] (Spigot, Inc.) -- C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe
PRC - [2011.06.24 17:30:48 | 000,393,112 | ---- | M] (Spigot, Inc.) -- C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe
SRV - [2011.06.24 17:30:48 | 000,393,112 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe -- (Application Updater)
FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}"
[2011.07.10 00:54:47 | 000,000,000 | ---D | M] (pdfforge Toolbar) -- C:\PROGRAM FILES (X86)\PDFFORGE TOOLBAR\FF
O2:64bit: - BHO: (Mein Gutscheincode Finder zeigt automatisch Shopping-Gutscheine an mit denen Sie beim Online-Einkauf sparen können.) - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} -  File not found
O2 - BHO: (Mein Gutscheincode Finder zeigt automatisch Shopping-Gutscheine an mit denen Sie beim Online-Einkauf sparen können.) - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} -  File not found
O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\4.5\pdfforgeToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\4.5\pdfforgeToolbarIE.dll (Spigot, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\Run: [RESTART_STICKY_NOTES]  File not found
O4 - HKLM..\Run: []  File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.03.17 15:16:40 | 000,000,053 | R--- | M] () - N:\Autorun.inf -- [ FAT32 ]
[2011.07.10 00:54:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\pdfforge Toolbar
[2011.07.10 00:54:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Application Updater
:Files
C:\Program Files (x86)\Common Files\Spigot
[2011.06.05 05:04:00 | 000,000,000 | ---D | M] -- C:\Users\Robinson Crusoe\AppData\Roaming\00D61832-67EA-4025-A2E1-40C2537DA915
[2011.05.11 21:04:14 | 000,000,000 | ---D | M] -- C:\Users\Robinson Crusoe\AppData\Roaming\04B1F191-5E39-4CD6-856D-21B1265666F3
[2011.04.24 01:07:09 | 000,000,000 | ---D | M] -- C:\Users\Robinson Crusoe\AppData\Roaming\16A81A1D-A364-4410-8834-EB97813A1201
[2011.04.24 00:43:08 | 000,000,000 | ---D | M] -- C:\Users\Robinson Crusoe\AppData\Roaming\201653DE-B3D6-4D63-8F3F-AC19AE29EE3A
[2011.04.21 18:06:47 | 000,000,000 | ---D | M] -- C:\Users\Robinson Crusoe\AppData\Roaming\282ADD96-90C2-4723-9FA7-1158717BD17E
[2011.07.10 00:10:38 | 000,000,000 | ---D | M] -- C:\Users\Robinson Crusoe\AppData\Roaming\3AA8AC40-9402-4DEA-99B8-ECF764E9A424
[2011.04.21 18:06:47 | 000,000,000 | ---D | M] -- C:\Users\Robinson Crusoe\AppData\Roaming\41FBD609-4380-414B-ADCE-889421B7C1E5
[2011.06.05 05:03:59 | 000,000,000 | ---D | M] -- C:\Users\Robinson Crusoe\AppData\Roaming\94F9833A-1985-4A20-B126-B8B5B5972078
[2011.05.11 21:31:07 | 000,000,000 | ---D | M] -- C:\Users\Robinson Crusoe\AppData\Roaming\D3605394-EBC9-4A8A-BED3-9143837B1D5B
:Commands
[purity]
[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Unterwegs43 · 18.07.2011, 09:08

Hallo Arne,
ich habe eventuell einen Fehler / eine Störung der Bearbeitung verusacht ...

Ich Win Patrol auf Win Patrol plus upg. und mit diesem Programm zwei Win Helpers Dateien gelöscht, die mir die Programmreste zu sein schienen.
Hier der OTL-Fix:
Jetzt kam die Meldung "ungültige Datei" ??? Kann nicht erkennen warum? Es ist die Datei "07182011_095015.log".
Schöne Grüße
Willi

PS: Win Patrol zeigt keine Programmreste mehr an ...

cosinus · 18.07.2011, 10:18

Win Patrol ist irrelevant, was hast du immer mit diesem Tool?

Zitat:

Jetzt kam die Meldung "ungültige Datei" ??? Kann nicht erkennen warum? Es ist die Datei "07182011_095015.log".

Mit Editor notepad öffnen und INhalt hier posten

Unterwegs43 · 18.07.2011, 12:58

Hallo Arne,
ich rede immer von Win Patrol, weil dieses Programm mich auf die verbliebenen Dateien aufmerksam gemacht hatte. Ohne Win Patrol hätte ich nichts gemerkt.
Gruß
Willi

========== OTL ==========
Process SearchSettings.exe killed successfully!
Process ApplicationUpdater.exe killed successfully!
Service Application Updater stopped successfully!
Service Application Updater deleted successfully!
C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe moved successfully.
Prefs.js: "Winload Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
C:\PROGRAM FILES (X86)\PDFFORGE TOOLBAR\FF\chrome\skin folder moved successfully.
C:\PROGRAM FILES (X86)\PDFFORGE TOOLBAR\FF\chrome\locale\EN-US folder moved successfully.
C:\PROGRAM FILES (X86)\PDFFORGE TOOLBAR\FF\chrome\locale folder moved successfully.
C:\PROGRAM FILES (X86)\PDFFORGE TOOLBAR\FF\chrome\content folder moved successfully.
C:\PROGRAM FILES (X86)\PDFFORGE TOOLBAR\FF\chrome folder moved successfully.
C:\PROGRAM FILES (X86)\PDFFORGE TOOLBAR\FF folder moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ deleted successfully.
C:\Program Files (x86)\pdfforge Toolbar\IE\4.5\pdfforgeToolbarIE.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{B922D405-6D13-4A2B-AE89-08A030DA4402} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ not found.
File C:\Program Files (x86)\pdfforge Toolbar\IE\4.5\pdfforgeToolbarIE.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer deleted successfully.
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\RESTART_STICKY_NOTES deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File N:\Autorun.inf not found.
C:\Program Files (x86)\pdfforge Toolbar\Res folder moved successfully.
C:\Program Files (x86)\pdfforge Toolbar\IE\4.5 folder moved successfully.
C:\Program Files (x86)\pdfforge Toolbar\IE folder moved successfully.
C:\Program Files (x86)\pdfforge Toolbar folder moved successfully.
C:\Program Files (x86)\Application Updater folder moved successfully.
========== FILES ==========
C:\Program Files (x86)\Common Files\Spigot\wtxpcom\components folder moved successfully.
C:\Program Files (x86)\Common Files\Spigot\wtxpcom folder moved successfully.
C:\Program Files (x86)\Common Files\Spigot\Search Settings\Res folder moved successfully.
C:\Program Files (x86)\Common Files\Spigot\Search Settings folder moved successfully.
C:\Program Files (x86)\Common Files\Spigot folder moved successfully.
File\Folder [2011.06.05 05:04:00 | 000,000,000 | ---D | M] -- C:\Users\Robinson Crusoe\AppData\Roaming\00D61832-67EA-4025-A2E1-40C2537DA915 not found.
File\Folder [2011.05.11 21:04:14 | 000,000,000 | ---D | M] -- C:\Users\Robinson Crusoe\AppData\Roaming\04B1F191-5E39-4CD6-856D-21B1265666F3 not found.
File\Folder [2011.04.24 01:07:09 | 000,000,000 | ---D | M] -- C:\Users\Robinson Crusoe\AppData\Roaming\16A81A1D-A364-4410-8834-EB97813A1201 not found.
File\Folder [2011.04.24 00:43:08 | 000,000,000 | ---D | M] -- C:\Users\Robinson Crusoe\AppData\Roaming\201653DE-B3D6-4D63-8F3F-AC19AE29EE3A not found.
File\Folder [2011.04.21 18:06:47 | 000,000,000 | ---D | M] -- C:\Users\Robinson Crusoe\AppData\Roaming\282ADD96-90C2-4723-9FA7-1158717BD17E not found.
File\Folder [2011.07.10 00:10:38 | 000,000,000 | ---D | M] -- C:\Users\Robinson Crusoe\AppData\Roaming\3AA8AC40-9402-4DEA-99B8-ECF764E9A424 not found.
File\Folder [2011.04.21 18:06:47 | 000,000,000 | ---D | M] -- C:\Users\Robinson Crusoe\AppData\Roaming\41FBD609-4380-414B-ADCE-889421B7C1E5 not found.
File\Folder [2011.06.05 05:03:59 | 000,000,000 | ---D | M] -- C:\Users\Robinson Crusoe\AppData\Roaming\94F9833A-1985-4A20-B126-B8B5B5972078 not found.
File\Folder [2011.05.11 21:31:07 | 000,000,000 | ---D | M] -- C:\Users\Robinson Crusoe\AppData\Roaming\D3605394-EBC9-4A8A-BED3-9143837B1D5B not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.26.1 log created on 07182011_095015

cosinus · 18.07.2011, 13:33

Zitat:

Ohne Win Patrol hätte ich nichts gemerkt.

Naja, etwas zuviel Dramatisierung ist schon dabei so mein Eindruck...

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )

Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen!

Unterwegs43 · 19.07.2011, 13:33

Hallo Arne,
die Kaspersky Log Datei:
2011/07/19 12:26:14.0920 5244 TDSS rootkit removing tool 2.5.11.0 Jul 11 2011 16:56:56
2011/07/19 12:26:16.0922 5244 ================================================================================
2011/07/19 12:26:16.0922 5244 SystemInfo:
2011/07/19 12:26:16.0922 5244
2011/07/19 12:26:16.0922 5244 OS Version: 6.1.7601 ServicePack: 1.0
2011/07/19 12:26:16.0922 5244 Product type: Workstation
2011/07/19 12:26:16.0922 5244 ComputerName: ROBIN2
2011/07/19 12:26:16.0922 5244 UserName: Robinson Crusoe
2011/07/19 12:26:16.0922 5244 Windows directory: C:\Windows
2011/07/19 12:26:16.0922 5244 System windows directory: C:\Windows
2011/07/19 12:26:16.0922 5244 Running under WOW64
2011/07/19 12:26:16.0922 5244 Processor architecture: Intel x64
2011/07/19 12:26:16.0922 5244 Number of processors: 4
2011/07/19 12:26:16.0922 5244 Page size: 0x1000
2011/07/19 12:26:16.0922 5244 Boot type: Normal boot
2011/07/19 12:26:16.0922 5244 ================================================================================
2011/07/19 12:26:18.0420 5244 Initialize success

Gruß
Willi

cosinus · 19.07.2011, 14:11

Log ist unvollständig - hast du dich genau an die Anleitung gehalten? Das Log ist normalerweise wesentlich länger

Unterwegs43 · 19.07.2011, 18:17

Hallo Arne,
sorry, ich habe mich wohl von der aufgeklappten Log so beeindrucken lassen, dass ich nicht auf "Report" gedrückt habe.

2011/07/19 19:10:30.0038 5888 TDSS rootkit removing tool 2.5.11.0 Jul 11 2011 16:56:56
2011/07/19 19:10:30.0293 5888 ================================================================================
2011/07/19 19:10:30.0293 5888 SystemInfo:
2011/07/19 19:10:30.0293 5888
2011/07/19 19:10:30.0293 5888 OS Version: 6.1.7601 ServicePack: 1.0
2011/07/19 19:10:30.0293 5888 Product type: Workstation
2011/07/19 19:10:30.0293 5888 ComputerName: ROBIN2
2011/07/19 19:10:30.0294 5888 UserName: Robinson Crusoe
2011/07/19 19:10:30.0294 5888 Windows directory: C:\Windows
2011/07/19 19:10:30.0294 5888 System windows directory: C:\Windows
2011/07/19 19:10:30.0294 5888 Running under WOW64
2011/07/19 19:10:30.0294 5888 Processor architecture: Intel x64
2011/07/19 19:10:30.0294 5888 Number of processors: 4
2011/07/19 19:10:30.0294 5888 Page size: 0x1000
2011/07/19 19:10:30.0294 5888 Boot type: Normal boot
2011/07/19 19:10:30.0294 5888 ================================================================================
2011/07/19 19:10:31.0742 5888 Initialize success
2011/07/19 19:10:37.0749 2124 ================================================================================
2011/07/19 19:10:37.0749 2124 Scan started
2011/07/19 19:10:37.0749 2124 Mode: Manual;
2011/07/19 19:10:37.0749 2124 ================================================================================
2011/07/19 19:10:39.0799 2124 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
2011/07/19 19:10:39.0888 2124 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
2011/07/19 19:10:39.0941 2124 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
2011/07/19 19:10:40.0019 2124 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
2011/07/19 19:10:40.0068 2124 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
2011/07/19 19:10:40.0109 2124 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
2011/07/19 19:10:40.0194 2124 afcdp (ae1fce2cd1e99bea89183ba8cd320872) C:\Windows\system32\DRIVERS\afcdp.sys
2011/07/19 19:10:40.0273 2124 AFD (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys
2011/07/19 19:10:40.0326 2124 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
2011/07/19 19:10:40.0378 2124 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
2011/07/19 19:10:40.0400 2124 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
2011/07/19 19:10:40.0454 2124 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
2011/07/19 19:10:40.0471 2124 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
2011/07/19 19:10:40.0521 2124 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
2011/07/19 19:10:40.0560 2124 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
2011/07/19 19:10:40.0594 2124 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
2011/07/19 19:10:40.0647 2124 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
2011/07/19 19:10:40.0688 2124 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
2011/07/19 19:10:40.0708 2124 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
2011/07/19 19:10:40.0741 2124 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/07/19 19:10:40.0785 2124 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
2011/07/19 19:10:40.0852 2124 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
2011/07/19 19:10:40.0881 2124 Scan interrupted by user!
2011/07/19 19:10:40.0881 2124 Scan interrupted by user!
2011/07/19 19:10:40.0881 2124 Scan interrupted by user!
2011/07/19 19:10:40.0882 2124 ================================================================================
2011/07/19 19:10:40.0882 2124 Scan finished
2011/07/19 19:10:40.0882 2124 ================================================================================
2011/07/19 19:10:40.0892 5232 Detected object count: 0
2011/07/19 19:10:40.0892 5232 Actual detected object count: 0
2011/07/19 19:11:01.0384 1180 ================================================================================
2011/07/19 19:11:01.0384 1180 Scan started
2011/07/19 19:11:01.0384 1180 Mode: Manual;
2011/07/19 19:11:01.0384 1180 ================================================================================
2011/07/19 19:11:01.0849 1180 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
2011/07/19 19:11:01.0921 1180 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
2011/07/19 19:11:01.0958 1180 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
2011/07/19 19:11:02.0011 1180 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
2011/07/19 19:11:02.0030 1180 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
2011/07/19 19:11:02.0051 1180 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
2011/07/19 19:11:02.0119 1180 afcdp (ae1fce2cd1e99bea89183ba8cd320872) C:\Windows\system32\DRIVERS\afcdp.sys
2011/07/19 19:11:02.0173 1180 AFD (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys
2011/07/19 19:11:02.0209 1180 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
2011/07/19 19:11:02.0237 1180 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
2011/07/19 19:11:02.0258 1180 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
2011/07/19 19:11:02.0296 1180 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
2011/07/19 19:11:02.0310 1180 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
2011/07/19 19:11:02.0346 1180 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
2011/07/19 19:11:02.0377 1180 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
2011/07/19 19:11:02.0402 1180 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
2011/07/19 19:11:02.0447 1180 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
2011/07/19 19:11:02.0472 1180 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
2011/07/19 19:11:02.0490 1180 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
2011/07/19 19:11:02.0516 1180 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/07/19 19:11:02.0552 1180 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
2011/07/19 19:11:02.0602 1180 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
2011/07/19 19:11:02.0624 1180 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
2011/07/19 19:11:02.0669 1180 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
2011/07/19 19:11:02.0726 1180 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
2011/07/19 19:11:02.0781 1180 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
2011/07/19 19:11:02.0825 1180 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2011/07/19 19:11:02.0841 1180 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2011/07/19 19:11:02.0874 1180 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
2011/07/19 19:11:02.0899 1180 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
2011/07/19 19:11:02.0918 1180 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
2011/07/19 19:11:02.0937 1180 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
2011/07/19 19:11:02.0956 1180 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
2011/07/19 19:11:03.0016 1180 cbfs3 (37fb7efe76a6b84f356eb95286d600e3) C:\Windows\system32\drivers\cbfs3.sys
2011/07/19 19:11:03.0071 1180 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/07/19 19:11:03.0123 1180 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
2011/07/19 19:11:03.0163 1180 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
2011/07/19 19:11:03.0204 1180 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
2011/07/19 19:11:03.0267 1180 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/07/19 19:11:03.0311 1180 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
2011/07/19 19:11:03.0355 1180 CNG (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys
2011/07/19 19:11:03.0432 1180 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
2011/07/19 19:11:03.0473 1180 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
2011/07/19 19:11:03.0504 1180 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
2011/07/19 19:11:03.0576 1180 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
2011/07/19 19:11:03.0617 1180 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
2011/07/19 19:11:03.0661 1180 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
2011/07/19 19:11:03.0719 1180 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
2011/07/19 19:11:03.0768 1180 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
2011/07/19 19:11:03.0882 1180 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
2011/07/19 19:11:03.0995 1180 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
2011/07/19 19:11:04.0063 1180 epmntdrv (9eafb3b3b60b8ad958985152a9309aca) C:\Windows\system32\epmntdrv.sys
2011/07/19 19:11:04.0214 1180 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
2011/07/19 19:11:04.0249 1180 EuGdiDrv (fb949ed2c93c878a189039f3d7730942) C:\Windows\system32\EuGdiDrv.sys
2011/07/19 19:11:04.0367 1180 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
2011/07/19 19:11:04.0466 1180 F-Secure Filter (872a4de096f1b4b5d0cdfa369abf9388) C:\Program Files (x86)\F-Secure\Anti-Virus\Win2K\FSfilter.sys
2011/07/19 19:11:04.0512 1180 F-Secure Gatekeeper (1087294c75fba6940f554cdcafc1cca3) C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsgk.sys
2011/07/19 19:11:04.0578 1180 F-Secure HIPS (1c8ab0d7d5451c58962940539f913473) C:\Program Files (x86)\F-Secure\HIPS\drivers\fshs.sys
2011/07/19 19:11:04.0601 1180 F-Secure Recognizer (504f83be6d94346e5288fc5881a38a9b) C:\Program Files (x86)\F-Secure\Anti-Virus\Win2K\FSrec.sys
2011/07/19 19:11:04.0672 1180 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
2011/07/19 19:11:04.0729 1180 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
2011/07/19 19:11:04.0761 1180 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
2011/07/19 19:11:04.0786 1180 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
2011/07/19 19:11:04.0848 1180 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/07/19 19:11:04.0896 1180 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
2011/07/19 19:11:04.0960 1180 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
2011/07/19 19:11:05.0013 1180 FSES (81491719ad2f5bb3563334f87c82f734) C:\Windows\system32\drivers\fses.sys
2011/07/19 19:11:05.0050 1180 FSFW (b5b3d6eb4f40abfc4f28be0e5b5538e5) C:\Windows\system32\drivers\fsdfw.sys
2011/07/19 19:11:05.0161 1180 fsvista (8a920e6cff3163c843c06e14cf787bd8) C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsvista.sys
2011/07/19 19:11:05.0237 1180 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
2011/07/19 19:11:05.0302 1180 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
2011/07/19 19:11:05.0345 1180 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
2011/07/19 19:11:05.0411 1180 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
2011/07/19 19:11:05.0471 1180 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
2011/07/19 19:11:05.0532 1180 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
2011/07/19 19:11:05.0565 1180 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
2011/07/19 19:11:05.0583 1180 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
2011/07/19 19:11:05.0601 1180 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
2011/07/19 19:11:05.0639 1180 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
2011/07/19 19:11:05.0683 1180 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
2011/07/19 19:11:05.0738 1180 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
2011/07/19 19:11:05.0797 1180 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
2011/07/19 19:11:05.0836 1180 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
2011/07/19 19:11:05.0881 1180 iaStor (1d004cb1da6323b1f55caef7f94b61d9) C:\Windows\system32\DRIVERS\iaStor.sys
2011/07/19 19:11:05.0946 1180 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
2011/07/19 19:11:06.0030 1180 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
2011/07/19 19:11:06.0117 1180 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
2011/07/19 19:11:06.0157 1180 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
2011/07/19 19:11:06.0197 1180 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/07/19 19:11:06.0245 1180 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
2011/07/19 19:11:06.0278 1180 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
2011/07/19 19:11:06.0317 1180 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
2011/07/19 19:11:06.0343 1180 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
2011/07/19 19:11:06.0370 1180 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
2011/07/19 19:11:06.0420 1180 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
2011/07/19 19:11:06.0472 1180 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
2011/07/19 19:11:06.0519 1180 KSecDD (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys
2011/07/19 19:11:06.0559 1180 KSecPkg (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys
2011/07/19 19:11:06.0606 1180 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
2011/07/19 19:11:06.0732 1180 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
2011/07/19 19:11:06.0785 1180 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
2011/07/19 19:11:06.0805 1180 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
2011/07/19 19:11:06.0825 1180 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2011/07/19 19:11:06.0848 1180 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2011/07/19 19:11:06.0886 1180 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
2011/07/19 19:11:06.0949 1180 MBAMProtector (9c4fb231b6e02f84580de2f00f3c5293) C:\Windows\system32\drivers\mbam.sys
2011/07/19 19:11:07.0017 1180 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
2011/07/19 19:11:07.0040 1180 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
2011/07/19 19:11:07.0083 1180 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
2011/07/19 19:11:07.0129 1180 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
2011/07/19 19:11:07.0174 1180 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
2011/07/19 19:11:07.0218 1180 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
2011/07/19 19:11:07.0263 1180 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
2011/07/19 19:11:07.0301 1180 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
2011/07/19 19:11:07.0332 1180 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
2011/07/19 19:11:07.0395 1180 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
2011/07/19 19:11:07.0439 1180 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/07/19 19:11:07.0489 1180 mrxsmb10 (2086d463bd371d8a37d153897430916d) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/07/19 19:11:07.0524 1180 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/07/19 19:11:07.0575 1180 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
2011/07/19 19:11:07.0617 1180 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
2011/07/19 19:11:07.0671 1180 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
2011/07/19 19:11:07.0702 1180 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
2011/07/19 19:11:07.0727 1180 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
2011/07/19 19:11:07.0781 1180 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
2011/07/19 19:11:07.0819 1180 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/07/19 19:11:07.0836 1180 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
2011/07/19 19:11:07.0887 1180 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
2011/07/19 19:11:07.0934 1180 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
2011/07/19 19:11:07.0974 1180 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
2011/07/19 19:11:07.0997 1180 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
2011/07/19 19:11:08.0032 1180 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
2011/07/19 19:11:08.0076 1180 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
2011/07/19 19:11:08.0141 1180 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
2011/07/19 19:11:08.0199 1180 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
2011/07/19 19:11:08.0239 1180 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/07/19 19:11:08.0295 1180 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/07/19 19:11:08.0335 1180 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/07/19 19:11:08.0380 1180 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
2011/07/19 19:11:08.0431 1180 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
2011/07/19 19:11:08.0482 1180 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
2011/07/19 19:11:08.0542 1180 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
2011/07/19 19:11:08.0589 1180 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
2011/07/19 19:11:08.0633 1180 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
2011/07/19 19:11:08.0707 1180 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
2011/07/19 19:11:08.0828 1180 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
2011/07/19 19:11:08.0878 1180 NVENETFD (a85b4f2ef3a7304a5399ef0526423040) C:\Windows\system32\DRIVERS\nvm62x64.sys
2011/07/19 19:11:08.0937 1180 NVHDA (857fb74754ebff94ee3ad40788740916) C:\Windows\system32\drivers\nvhda64v.sys
2011/07/19 19:11:09.0273 1180 nvlddmkm (aa0828f3223e1a2952f80a8d2047dd40) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/07/19 19:11:09.0560 1180 NVNET (909eedcbd365bb81027d8e742e6b3416) C:\Windows\system32\DRIVERS\nvmf6264.sys
2011/07/19 19:11:09.0642 1180 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
2011/07/19 19:11:09.0698 1180 nvrd64 (694f5e9d9d624d47f432f5b2e66a0528) C:\Windows\system32\DRIVERS\nvrd64.sys
2011/07/19 19:11:09.0735 1180 nvsmu (e58d81fb8616d0cb55c1e36aa0b213c9) C:\Windows\system32\DRIVERS\nvsmu.sys
2011/07/19 19:11:09.0774 1180 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
2011/07/19 19:11:09.0797 1180 nvstor64 (05de5dc43afe6cab78f9c7ca044cbcbe) C:\Windows\system32\DRIVERS\nvstor64.sys
2011/07/19 19:11:09.0977 1180 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
2011/07/19 19:11:10.0038 1180 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
2011/07/19 19:11:10.0106 1180 OV550I (5f79934084df6dc0635578864376ce54) C:\Windows\system32\Drivers\ov550ivx.sys
2011/07/19 19:11:10.0156 1180 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
2011/07/19 19:11:10.0195 1180 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
2011/07/19 19:11:10.0249 1180 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
2011/07/19 19:11:10.0282 1180 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
2011/07/19 19:11:10.0316 1180 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/07/19 19:11:10.0348 1180 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
2011/07/19 19:11:10.0391 1180 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
2011/07/19 19:11:10.0515 1180 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
2011/07/19 19:11:10.0533 1180 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
2011/07/19 19:11:10.0603 1180 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
2011/07/19 19:11:10.0648 1180 PxHlpa64 (87b04878a6d59d6c79251dc960c674c1) C:\Windows\system32\Drivers\PxHlpa64.sys
2011/07/19 19:11:10.0707 1180 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
2011/07/19 19:11:10.0768 1180 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
2011/07/19 19:11:10.0804 1180 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
2011/07/19 19:11:10.0826 1180 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
2011/07/19 19:11:10.0871 1180 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
2011/07/19 19:11:10.0916 1180 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/07/19 19:11:10.0942 1180 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/07/19 19:11:10.0976 1180 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
2011/07/19 19:11:11.0014 1180 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
2011/07/19 19:11:11.0057 1180 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
2011/07/19 19:11:11.0079 1180 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/07/19 19:11:11.0109 1180 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
2011/07/19 19:11:11.0133 1180 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
2011/07/19 19:11:11.0174 1180 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
2011/07/19 19:11:11.0244 1180 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
2011/07/19 19:11:11.0327 1180 RRNetCap (2abd2b3ba2ef0c3ba82284c2a5e28675) C:\Windows\system32\DRIVERS\rrnetcap.sys
2011/07/19 19:11:11.0345 1180 RRNetCapMP (2abd2b3ba2ef0c3ba82284c2a5e28675) C:\Windows\system32\DRIVERS\rrnetcap.sys
2011/07/19 19:11:11.0381 1180 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
2011/07/19 19:11:11.0428 1180 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
2011/07/19 19:11:11.0502 1180 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
2011/07/19 19:11:11.0563 1180 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
2011/07/19 19:11:11.0616 1180 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
2011/07/19 19:11:11.0648 1180 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
2011/07/19 19:11:11.0690 1180 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
2011/07/19 19:11:11.0759 1180 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
2011/07/19 19:11:11.0783 1180 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
2011/07/19 19:11:11.0805 1180 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
2011/07/19 19:11:11.0833 1180 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
2011/07/19 19:11:11.0870 1180 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2011/07/19 19:11:11.0889 1180 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
2011/07/19 19:11:11.0916 1180 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
2011/07/19 19:11:11.0978 1180 snapman (10450f432811d7fda60a97fcc674d7b2) C:\Windows\system32\DRIVERS\snapman.sys
2011/07/19 19:11:12.0011 1180 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
2011/07/19 19:11:12.0079 1180 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
2011/07/19 19:11:12.0138 1180 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
2011/07/19 19:11:12.0187 1180 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
2011/07/19 19:11:12.0254 1180 StarOpen (e57b778208c783d8debab320c16a1b82) C:\Windows\system32\drivers\StarOpen.sys
2011/07/19 19:11:12.0347 1180 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
2011/07/19 19:11:12.0391 1180 StillCam (decacb6921ded1a38642642685d77dac) C:\Windows\system32\DRIVERS\serscan.sys
2011/07/19 19:11:12.0446 1180 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
2011/07/19 19:11:12.0523 1180 tbhsd (93f0f5ef8a4ca261372df98b31b2bd05) C:\Windows\system32\drivers\tbhsd.sys
2011/07/19 19:11:12.0598 1180 Tcpip (92ce29d95ac9dd2d0ee9061d551ba250) C:\Windows\system32\drivers\tcpip.sys
2011/07/19 19:11:12.0698 1180 TCPIP6 (92ce29d95ac9dd2d0ee9061d551ba250) C:\Windows\system32\DRIVERS\tcpip.sys
2011/07/19 19:11:12.0778 1180 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
2011/07/19 19:11:12.0844 1180 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
2011/07/19 19:11:12.0913 1180 tdrpman273 (99527d49ee0a96fc25537c61b270a372) C:\Windows\system32\DRIVERS\tdrpm273.sys
2011/07/19 19:11:12.0986 1180 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
2011/07/19 19:11:13.0039 1180 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
2011/07/19 19:11:13.0083 1180 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
2011/07/19 19:11:13.0178 1180 timounter (ebbaea02f0095a798000c7e06b16d41b) C:\Windows\system32\DRIVERS\timntr.sys
2011/07/19 19:11:13.0270 1180 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/07/19 19:11:13.0339 1180 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
2011/07/19 19:11:13.0422 1180 TuneUpUtilitiesDrv (dcc94c51d27c7ec0dadeca8f64c94fcf) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys
2011/07/19 19:11:13.0520 1180 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
2011/07/19 19:11:13.0593 1180 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
2011/07/19 19:11:13.0639 1180 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
2011/07/19 19:11:13.0719 1180 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
2011/07/19 19:11:13.0773 1180 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
2011/07/19 19:11:13.0809 1180 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
2011/07/19 19:11:13.0869 1180 usbaudio (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys
2011/07/19 19:11:13.0897 1180 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/07/19 19:11:13.0955 1180 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
2011/07/19 19:11:13.0987 1180 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
2011/07/19 19:11:14.0024 1180 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
2011/07/19 19:11:14.0060 1180 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys
2011/07/19 19:11:14.0097 1180 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
2011/07/19 19:11:14.0130 1180 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
2011/07/19 19:11:14.0160 1180 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/07/19 19:11:14.0192 1180 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
2011/07/19 19:11:14.0262 1180 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
2011/07/19 19:11:14.0306 1180 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/07/19 19:11:14.0328 1180 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
2011/07/19 19:11:14.0372 1180 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
2011/07/19 19:11:14.0416 1180 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
2011/07/19 19:11:14.0446 1180 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
2011/07/19 19:11:14.0667 1180 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
2011/07/19 19:11:14.0928 1180 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
2011/07/19 19:11:15.0382 1180 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
2011/07/19 19:11:15.0654 1180 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
2011/07/19 19:11:16.0297 1180 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
2011/07/19 19:11:16.0908 1180 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
2011/07/19 19:11:17.0216 1180 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
2011/07/19 19:11:17.0525 1180 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
2011/07/19 19:11:17.0790 1180 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
2011/07/19 19:11:18.0355 1180 wDokan (dcca6588651e970ff20bd3a38bbbd078) C:\Windows\system32\drivers\wdokan.sys
2011/07/19 19:11:18.0763 1180 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
2011/07/19 19:11:18.0982 1180 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
2011/07/19 19:11:19.0860 1180 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
2011/07/19 19:11:20.0292 1180 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
2011/07/19 19:11:20.0568 1180 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
2011/07/19 19:11:20.0783 1180 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
2011/07/19 19:11:21.0292 1180 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/07/19 19:11:21.0361 1180 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
2011/07/19 19:11:21.0390 1180 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk1\DR1
2011/07/19 19:11:21.0408 1180 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk6\DR6
2011/07/19 19:11:21.0427 1180 Boot (0x1200) (70c89853d535560987f2ea470fd32034) \Device\Harddisk0\DR0\Partition0
2011/07/19 19:11:21.0466 1180 Boot (0x1200) (3f155fa6bb94d39521aa27afcafc50d1) \Device\Harddisk0\DR0\Partition1
2011/07/19 19:11:21.0488 1180 Boot (0x1200) (66db39c96667114d1fa3cb42b1734c9a) \Device\Harddisk1\DR1\Partition0
2011/07/19 19:11:21.0504 1180 Boot (0x1200) (52197340e609a0b3138951b91c8ca8a4) \Device\Harddisk1\DR1\Partition1
2011/07/19 19:11:21.0521 1180 Boot (0x1200) (bd1b6a8357d726de5989676ff1853bdb) \Device\Harddisk6\DR6\Partition0
2011/07/19 19:11:21.0539 1180 Boot (0x1200) (50e
c5724af6248ea040168d2b4f5abae) \Device\Harddisk6\DR6\Partition1
2011/07/19 19:11:21.0555 1180 Boot (0x1200) (5063e5e08c0439a2b7d32b44637b8e04) \Device\Harddisk6\DR6\Partition2
2011/07/19 19:11:21.0572 1180 Boot (0x1200) (93261981fdf6175c57cc0cbb94f245f5) \Device\Harddisk6\DR6\Partition3
2011/07/19 19:11:21.0583 1180 ================================================================================
2011/07/19 19:11:21.0583 1180 Scan finished
2011/07/19 19:11:21.0583 1180 ================================================================================
2011/07/19 19:11:21.0598 1552 Detected object count: 0
2011/07/19 19:11:21.0598 1552 Actual detected object count: 0
Gruß
Willi

cosinus · 19.07.2011, 21:19

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Unterwegs43 · 20.07.2011, 13:21

Hallo Arne,
Combofix Logfile:

Code:

ATTFilter

ComboFix 11-07-20.02 - Robinson Crusoe 20.07.2011  13:29:25.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4095.3298 [GMT 2:00]
ausgeführt von:: c:\users\Robinson Crusoe\Desktop\ComboFix.exe
AV: F-Secure Internet Security 2011 10.51 *Disabled/Updated* {15414183-282E-D62C-CA37-EF24860A2F17}
FW: F-Secure Internet Security 2011 10.51 *Disabled* {2D7AC0A6-6241-D774-E168-461178D9686C}
SP: F-Secure Internet Security 2011 10.51 *Disabled/Updated* {AE20A067-0E14-D9A2-F087-D456FD8D65AA}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\security\Database\tmp.edb
c:\windows\SysWow64\winsys
c:\windows\SysWow64\winsys\msvcrt40.dll
c:\windows\winhelp.ini
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-06-20 bis 2011-07-20  ))))))))))))))))))))))))))))))
.
.
2011-07-20 11:35 . 2011-07-20 11:35	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-07-20 11:27 . 2011-07-20 11:27	--------	d-----w-	C:\32788R22FWJFW
2011-07-19 10:01 . 2011-06-07 17:10	8873296	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{66458F70-A123-481C-BF20-84EB5CA72E67}\mpengine.dll
2011-07-18 07:50 . 2011-07-18 07:50	--------	d-----w-	C:\_OTL
2011-07-17 17:02 . 1998-06-23 23:00	137000	----a-w-	c:\windows\SysWow64\MSMAPI32.OCX
2011-07-17 17:02 . 1998-07-06 16:55	158208	----a-w-	c:\windows\SysWow64\MSCMCDE.DLL
2011-07-17 17:02 . 1998-07-06 16:55	64512	----a-w-	c:\windows\SysWow64\MSCC2DE.DLL
2011-07-17 17:02 . 1998-07-05 23:00	23552	----a-w-	c:\windows\SysWow64\MSMPIDE.DLL
2011-07-17 16:44 . 2011-07-17 16:44	--------	d-----w-	c:\users\Robinson Crusoe\AppData\Roaming\DL
2011-07-17 16:44 . 2011-07-19 20:04	--------	d-----w-	c:\users\Robinson Crusoe\.Zettelkasten
2011-07-17 16:44 . 2011-02-06 17:00	4119497	----a-w-	c:\program files\Zettelkasten.exe
2011-07-17 16:36 . 2011-07-17 16:36	--------	d-----w-	c:\users\Robinson Crusoe\AppData\Roaming\ThePluginSite
2011-07-17 16:36 . 2011-07-17 16:36	--------	d-----w-	c:\program files\ThePluginSite
2011-07-15 21:10 . 2011-07-15 21:10	--------	d-----w-	c:\users\Robinson Crusoe\AppData\Roaming\de.txptr.googleplus
2011-07-15 21:10 . 2011-07-15 21:10	--------	d-----w-	c:\program files (x86)\Google+ RegHelper
2011-07-15 20:48 . 2011-07-15 20:48	--------	d-----w-	c:\users\Robinson Crusoe\AppData\Roaming\Malwarebytes
2011-07-15 20:48 . 2011-07-06 17:52	41272	----a-w-	c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-07-15 20:48 . 2011-07-15 20:48	--------	d-----w-	c:\programdata\Malwarebytes
2011-07-15 20:48 . 2011-07-06 17:52	25912	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-07-15 20:48 . 2011-07-15 20:50	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2011-07-15 12:30 . 2011-07-15 12:30	--------	d-----w-	c:\program files\7-Zip
2011-07-14 17:29 . 2011-07-14 17:44	--------	d-----w-	c:\users\Robinson Crusoe\AppData\Local\Conduit
2011-07-14 17:23 . 2011-07-14 17:23	--------	d-----w-	c:\users\Robinson Crusoe\.hgt
2011-07-13 23:31 . 2011-07-13 23:31	--------	d-----w-	c:\users\Robinson Crusoe\AppData\Roaming\MusicIP
2011-07-13 23:31 . 2011-07-13 23:31	--------	d-----w-	c:\program files (x86)\MusicIP
2011-07-13 10:38 . 2011-07-13 10:38	--------	d-----w-	c:\program files\Common Files\Adobe
2011-07-13 10:10 . 2011-06-11 03:07	3137536	----a-w-	c:\windows\system32\win32k.sys
2011-07-11 21:48 . 2011-07-11 21:48	12800	----a-w-	c:\program files (x86)\Mozilla Firefox\plugins\npwachk.dll
2011-07-10 09:11 . 2011-07-10 09:11	--------	d-----w-	c:\program files (x86)\Free Video Player
2011-07-10 09:11 . 2011-07-10 09:11	--------	d-----w-	c:\users\Robinson Crusoe\AppData\Local\TempImg
2011-07-09 22:10 . 2011-07-09 22:10	285280	----a-w-	c:\windows\system32\drivers\afcdp.sys
2011-07-09 22:10 . 2011-07-09 22:10	--------	d-----w-	c:\users\Robinson Crusoe\AppData\Roaming\3AA8AC40-9402-4DEA-99B8-ECF764E9A424
2011-07-09 22:10 . 2011-07-09 22:10	970336	----a-w-	c:\windows\system32\drivers\timntr.sys
2011-07-08 15:03 . 2011-07-08 15:03	--------	d-----w-	c:\users\Robinson Crusoe\AppData\Roaming\Ashampoo
2011-07-08 15:02 . 2011-07-08 15:03	--------	d-----w-	c:\users\Robinson Crusoe\AppData\Local\ashampoo
2011-07-08 15:02 . 2011-07-08 15:02	--------	d-----w-	c:\programdata\ashampoo
2011-06-26 09:03 . 2011-06-26 09:03	--------	d-----w-	c:\windows\system32\SPReview
2011-06-25 20:00 . 2011-06-25 20:00	--------	d-----w-	c:\windows\system32\EventProviders
2011-06-23 21:21 . 2010-11-20 13:26	4120064	----a-w-	c:\windows\system32\mf.dll
2011-06-23 21:20 . 2010-11-20 13:27	1727488	----a-w-	c:\program files\Windows Photo Viewer\PhotoViewer.dll
2011-06-23 21:19 . 2010-11-20 13:32	2217856	----a-w-	c:\windows\system32\bootres.dll
2011-06-23 21:18 . 2010-11-20 13:26	121344	----a-w-	c:\windows\system32\fphc.dll
2011-06-23 21:17 . 2010-11-20 13:00	2560	----a-w-	c:\windows\system32\drivers\de-DE\rdpwd.sys.mui
2011-06-23 21:17 . 2010-11-20 13:07	2560	----a-w-	c:\windows\system32\drivers\de-DE\disk.sys.mui
2011-06-23 21:17 . 2010-11-20 13:12	7168	----a-w-	c:\windows\system32\drivers\de-DE\msdsm.sys.mui
2011-06-23 21:17 . 2010-11-20 13:00	4608	----a-w-	c:\windows\system32\drivers\de-DE\vdrvroot.sys.mui
2011-06-23 21:17 . 2010-11-20 12:21	189952	----a-w-	c:\windows\SysWow64\wdscore.dll
2011-06-23 21:17 . 2010-11-20 12:17	209920	----a-w-	c:\windows\SysWow64\PkgMgr.exe
2011-06-23 21:17 . 2010-11-20 12:18	323072	----a-w-	c:\windows\SysWow64\drvstore.dll
2011-06-23 21:17 . 2010-11-20 12:18	257024	----a-w-	c:\windows\SysWow64\dpx.dll
2011-06-23 21:17 . 2010-11-20 12:21	363008	----a-w-	c:\windows\SysWow64\wbemcomn.dll
2011-06-23 21:17 . 2010-11-20 12:19	606208	----a-w-	c:\windows\SysWow64\wbem\fastprox.dll
2011-06-23 21:14 . 2010-11-20 13:27	524288	----a-w-	c:\windows\system32\wmicmiplugin.dll
2011-06-23 21:14 . 2010-11-20 13:27	529408	----a-w-	c:\windows\system32\wbemcomn.dll
2011-06-23 21:14 . 2010-11-20 13:27	1225216	----a-w-	c:\windows\system32\wbem\wbemcore.dll
2011-06-23 21:14 . 2010-11-20 13:27	933376	----a-w-	c:\windows\system32\SmiEngine.dll
2011-06-23 21:14 . 2010-11-20 13:25	199168	----a-w-	c:\windows\system32\PkgMgr.exe
2011-06-23 21:13 . 2010-11-20 13:26	422912	----a-w-	c:\windows\system32\drvstore.dll
2011-06-23 21:13 . 2010-11-20 13:26	399872	----a-w-	c:\windows\system32\dpx.dll
2011-06-23 14:00 . 2011-06-23 14:00	2106216	----a-w-	c:\program files (x86)\Mozilla Firefox\D3DCompiler_43.dll
2011-06-23 14:00 . 2011-06-23 14:00	1998168	----a-w-	c:\program files (x86)\Mozilla Firefox\d3dx9_43.dll
2011-06-23 07:00 . 2011-07-10 08:57	--------	d-----w-	c:\users\Robinson Crusoe\AppData\Roaming\vlc
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-09 22:10 . 2011-03-16 23:53	1263200	----a-w-	c:\windows\system32\drivers\tdrpm273.sys
2011-06-26 09:08 . 2009-07-14 02:36	175616	----a-w-	c:\windows\system32\msclmd.dll
2011-06-26 09:08 . 2009-07-14 02:36	152576	----a-w-	c:\windows\SysWow64\msclmd.dll
2011-06-16 21:15 . 2011-05-16 01:17	404640	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-06-05 16:44 . 2011-06-05 16:44	48	----a-w-	c:\users\Robinson Crusoe\AppData\Roaming\tigersetting.dll
2011-06-03 05:57 . 2011-07-13 10:10	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2011-05-28 22:21 . 2011-03-17 00:04	42664	----a-w-	c:\windows\SysWow64\drivers\fsbts.sys
2011-05-28 22:15 . 2011-03-17 00:04	46664	----a-w-	c:\windows\system32\drivers\fses.sys
2011-05-28 22:14 . 2011-03-17 00:04	95784	----a-w-	c:\windows\system32\drivers\fsdfw.sys
2011-05-28 03:30 . 2011-06-16 21:23	1638912	----a-w-	c:\windows\system32\mshtml.tlb
2011-05-28 02:53 . 2011-06-16 21:23	1638912	----a-w-	c:\windows\SysWow64\mshtml.tlb
2011-05-24 17:14 . 2011-03-16 23:41	270720	------w-	c:\windows\system32\MpSigStub.exe
2011-05-11 19:30 . 2011-03-16 23:53	277088	----a-w-	c:\windows\system32\drivers\snapman.sys
2011-05-04 02:52 . 2011-03-17 00:58	472808	----a-w-	c:\windows\SysWow64\deployJava1.dll
2011-05-03 05:29 . 2011-06-16 21:23	976896	----a-w-	c:\windows\system32\inetcomm.dll
2011-05-03 04:30 . 2011-06-16 21:23	741376	----a-w-	c:\windows\SysWow64\inetcomm.dll
2011-04-29 03:06 . 2011-06-16 21:23	467456	----a-w-	c:\windows\system32\drivers\srv.sys
2011-04-29 03:05 . 2011-06-16 21:23	410112	----a-w-	c:\windows\system32\drivers\srv2.sys
2011-04-29 03:05 . 2011-06-16 21:23	168448	----a-w-	c:\windows\system32\drivers\srvnet.sys
2011-04-27 02:40 . 2011-06-16 21:24	158208	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2011-04-27 02:39 . 2011-06-16 21:24	289280	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2011-04-27 02:39 . 2011-06-16 21:24	128000	----a-w-	c:\windows\system32\drivers\mrxsmb20.sys
2011-04-25 05:33 . 2011-06-16 21:24	1923968	----a-w-	c:\windows\system32\drivers\tcpip.sys
2011-04-25 02:34 . 2011-06-16 21:24	499200	----a-w-	c:\windows\system32\drivers\afd.sys
2011-04-22 22:15 . 2011-05-25 14:39	27520	----a-w-	c:\windows\system32\drivers\Diskdump.sys
2011-04-22 22:08 . 2011-06-16 21:23	1188864	----a-w-	c:\windows\system32\wininet.dll
2011-04-22 19:10 . 2011-06-16 21:23	981504	----a-w-	c:\windows\SysWow64\wininet.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1EldosIconOverlay]
@="{37748DAC-9B45-45B8-BAE1-1AC58495E02B}"
[HKEY_CLASSES_ROOT\CLSID\{37748DAC-9B45-45B8-BAE1-1AC58495E02B}]
2010-12-23 10:48	155416	----a-w-	c:\windows\SysWOW64\CbFsMntNtf3.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay]
@="{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}"
[HKEY_CLASSES_ROOT\CLSID\{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}]
2010-12-23 10:48	155416	----a-w-	c:\windows\SysWOW64\CbFsMntNtf3.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Free Download Manager"="c:\program files (x86)\Free Download Manager\fdm.exe" [2010-04-28 3727411]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"F-Secure Manager"="c:\program files (x86)\F-Secure\Common\FSM32.EXE" [2011-05-28 201384]
"F-Secure TNB"="c:\program files (x86)\F-Secure\FSGUI\TNBUtil.exe" [2011-05-28 1655464]
"TrayServer"="c:\progra~2\MAGIX\VIDEO_~1\TrayServer.exe" [2008-08-07 90112]
"TrueImageMonitor.exe"="c:\program files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe" [2011-06-27 5587672]
"SAOB Monitor"="c:\program files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe" [2011-05-10 2570688]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
.
c:\users\Robinson Crusoe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Wuala.lnk - c:\users\Robinson Crusoe\AppData\Roaming\Wuala\Wuala_old.exe [2010-12-15 428736]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AbAlarm.lnk - c:\program files (x86)\AbAlarm\AbAlarm.exe [2011-3-19 1133056]
AcronisÿTrueÿImageÿHome.lnk - c:\program files (x86)\Acronis\TrueImageHome\TrueImageLauncher.exe [2011-6-28 4298080]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"WinPatrol"=c:\program files (x86)\BillP Studios\WinPatrol\winpatrol.exe -expressboot
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"ArcSoft Connection Service"=c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-19 136176]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-03-24 16776]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-03-24 9096]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 1527900]
R3 FSORSPClient;F-Secure ORSP Client;c:\program files (x86)\F-Secure\ORSP Client\fsorsp.exe [2011-05-23 61088]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-19 136176]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 OV550I;OVT Scanner;c:\windows\system32\Drivers\ov550ivx.sys [x]
R3 RRNetCap;RRNetCap Service;c:\windows\system32\DRIVERS\rrnetcap.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 UPnPService;UPnPService;c:\program files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2006-12-14 544768]
R4 F-Secure Filter;F-Secure File System Filter;c:\program files (x86)\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2011-05-28 41896]
R4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files (x86)\F-Secure\Anti-Virus\Win2K\FSrec.sys [2011-05-28 27304]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);c:\windows\system32\DRIVERS\tdrpm273.sys [x]
S1 cbfs3;cbfs3;c:\windows\system32\drivers\cbfs3.sys [x]
S1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files (x86)\F-Secure\HIPS\drivers\fshs.sys [2011-05-28 61960]
S1 FSES;F-Secure Email Scanning Driver;c:\windows\system32\drivers\fses.sys [x]
S1 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [x]
S1 fsvista;F-Secure Vista Support Driver;c:\program files (x86)\F-Secure\Anti-Virus\minifilter\fsvista.sys [2011-05-28 15016]
S2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [2010-09-30 169408]
S2 afcdpsrv;Acronis Nonstop Backup-Dienst;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2011-07-09 3246040]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2009-07-14 239648]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [2011-01-12 1403200]
S2 wDokan;wDokan;c:\windows\system32\drivers\wdokan.sys [x]
S2 wDokanMounter;wDokanMounter;c:\program files (x86)\Wuala Dokan\mounter.exe [2010-08-11 11776]
S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [x]
S3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files (x86)\F-Secure\Anti-Virus\minifilter\fsgk.sys [2011-06-09 198824]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 RRNetCapMP;RRNetCapMP;c:\windows\system32\DRIVERS\rrnetcap.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [2010-02-24 11856]
.
.
Inhalt des "geplante Tasks" Ordners
.
2011-07-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-19 02:12]
.
2011-07-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-19 02:12]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\0WualaOverlayIcon1]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2011-05-04 08:12	592384	----a-w-	c:\program files (x86)\Wuala OverlayIcons\OverlayIcon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\0WualaOverlayIcon2]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2011-05-04 08:12	592384	----a-w-	c:\program files (x86)\Wuala OverlayIcons\OverlayIcon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\0WualaOverlayIcon3]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2011-05-04 08:12	592384	----a-w-	c:\program files (x86)\Wuala OverlayIcons\OverlayIcon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\0WualaOverlayIcon4]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2011-05-04 08:12	592384	----a-w-	c:\program files (x86)\Wuala OverlayIcons\OverlayIcon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1EldosIconOverlay]
@="{37748DAC-9B45-45B8-BAE1-1AC58495E02B}"
[HKEY_CLASSES_ROOT\CLSID\{37748DAC-9B45-45B8-BAE1-1AC58495E02B}]
2010-12-23 10:48	188696	----a-w-	c:\windows\System32\CbFsMntNtf3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay]
@="{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}"
[HKEY_CLASSES_ROOT\CLSID\{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}]
2010-12-23 10:48	188696	----a-w-	c:\windows\System32\CbFsMntNtf3.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="c:\program files (x86)\BillP Studios\WinPatrol\WinPatrol.exe" [2011-05-15 325512]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-07-29 497648]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1840720]
"CanonSolutionMenu"="c:\program files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
"Acronis Scheduler2 Service"="c:\program files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [2011-02-01 391232]
"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2009-06-30 291872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mStart Page = hxxp://www.bigseekpro.com/audiograbber/{0961DA6A-7365-4361-BB03-1421E19F3156}
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Alles mit FDM herunterladen - file://c:\program files (x86)\Free Download Manager\dlall.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Auswahl mit FDM herunterladen - file://c:\program files (x86)\Free Download Manager\dlselected.htm
IE: Datei mit FDM herunterladen - file://c:\program files (x86)\Free Download Manager\dllink.htm
IE: Free YouTube Download - c:\users\Robinson Crusoe\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Robinson Crusoe\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Videos mit FDM herunterladen - file://c:\program files (x86)\Free Download Manager\dlfvideo.htm
LSP: c:\program files (x86)\F-Secure\FSPS\program\FSLSP.DLL
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Robinson Crusoe\AppData\Roaming\Mozilla\Firefox\Profiles\hdqpx08v.default\
FF - prefs.js: browser.search.defaulturl - 
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.sueddeutsche.de/|hxxp://www.fr-online.de/home/-/1472778/1472778/-/index.html|hxxp://www.taz.de/|hxxp://www.chip.de/|hxxp://www.spektrum.de/
FF - prefs.js: keyword.URL - hxxp://plasmoo.com/index.htm?SearchMashine=true&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - (no file)
URLSearchHooks-{40c3cc16-7269-4b32-9531-17f2950fb06f} - (no file)
BHO-{1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-07-20  13:37:58
ComboFix-quarantined-files.txt  2011-07-20 11:37
.
Vor Suchlauf: 14 Verzeichnis(se), 17.404.313.600 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 17.099.771.904 Bytes frei
.
- - End Of File - - 50C9B1380811770B9D5BEDEC70EFD85B

--- --- ---
Gruß
Willi

cosinus · 20.07.2011, 14:11

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung) Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Unterwegs43 · 21.07.2011, 14:57

Hallo Arne,

aswMBR version 0.9.7.777 Copyright(c) 2011 AVAST Software
Run date: 2011-07-21 13:27:07
-----------------------------
13:27:07.494 OS Version: Windows x64 6.1.7601 Service Pack 1
13:27:07.494 Number of processors: 4 586 0x1707
13:27:07.495 ComputerName: ROBIN2 UserName:
13:27:17.503 Initialize success
13:30:41.489 AVAST engine defs: 11072100
13:33:25.787 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000069
13:33:25.790 Disk 0 Vendor: WDC_WD32 01.0 Size: 305245MB BusType: 8
13:33:25.794 Disk 1 \Device\Harddisk1\DR1 -> \Device\0000006a
13:33:25.798 Disk 1 Vendor: ST310005 CC37 Size: 953869MB BusType: 8
13:33:25.810 Disk 0 MBR read successfully
13:33:25.814 Disk 0 MBR scan
13:33:25.822 Disk 0 Windows 7 default MBR code
13:33:25.826 Service scanning
13:33:26.953 Disk 0 trace - called modules:
13:33:26.960 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll nvstor64.sys
13:33:26.965 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004a3e060]
13:33:26.970 3 CLASSPNP.SYS[fffff88000dac43f] -> nt!IofCallDriver -> [0xfffffa80047b4710]
13:33:26.975 5 ACPI.sys[fffff88000e1a7a1] -> nt!IofCallDriver -> \Device\00000069[0xfffffa80039ef9c0]
13:33:27.335 AVAST engine scan C:\Windows
13:33:32.725 AVAST engine scan C:\Windows\system32
13:36:02.723 AVAST engine scan C:\Windows\system32\drivers
13:36:18.510 AVAST engine scan C:\Users\Robinson Crusoe
13:39:46.432 AVAST engine scan C:\ProgramData
13:46:56.744 Scan finished successfully
15:51:39.642 Disk 0 MBR has been saved successfully to "C:\Users\Robinson Crusoe\Desktop\MBR.dat"
15:51:39.657 The log file has been saved successfully to "C:\Users\Robinson Crusoe\Desktop\aswMBR.txt"

Alles paletti?

19.07.2011, 14:11	#10
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Programm Reste von GPX Konverter und Editor von der Seite Winload werden von Win Patrol gemeldet Log ist unvollständig - hast du dich genau an die Anleitung gehalten? Das Log ist normalerweise wesentlich länger __________________ Logfiles bitte immer in CODE-Tags posten

Programm Reste von GPX Konverter und Editor von der Seite Winload werden von Win Patrol gemeldet

Log-Analyse und Auswertung: Programm Reste von GPX Konverter und Editor von der Seite Winload werden von Win Patrol gemeldet