Fehlermeldung beim Starten: "Bitte warten Sie während die Verbindung hergestellt wird".

Allmendweg · 15.04.2012, 20:29

Ich habe die obige Fehlermeldung beim booten. Ich kann den Computer von einer (original windows) cd (welche ich beim kauf des laptops erhalten habe) starten und dort z.b. in den dos commander kommen.
Ich habe auch schon OTLPENet start cd gebrannt, aber das klappt nicht (es kommt beim booten ein blauer bildschirm mit dem hinweis, dass der computer ein problem hat).
Ich habe das Farbar Recovery Scan Tool ausgeführt und den scan laufen lassen. Das erlaubt wohl auch ein fix.txt laufen zu lassen, doch ich weiss nicht, was genau fixed werden muss. Nun bin ich also ratlos.
Meine Einstellungen sind Englisch, 64bit

Psychotic · 16.04.2012, 07:41

Mein Name ist Marius und ich werde dir bei deinem Problem helfen.

Eines vorneweg:

Hinweis: Wir können hier nie dafür garantieren, dass wir sämtliche Reste von Schadsoftware gefunden haben. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.

Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass du clean bist.

Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden.

Bitte arbeite alle Schritte der Reihe nach ab.
Lese die Anleitungen sorgfältig. Solltest du irgendwo nicht weiterkommen, stoppe an diesem Punkt und beschreibe dein Problem hier!
Nur Scans durchführen, zu denen du von einem Helfer aufgefordert wirst.
Bitte kein Crossposting ( posten in mehreren Foren) - wenn du die anweisungen mehrere Helfer ausführst, kann das schwere Probleme nach sich ziehen!.
Installiere oder Deinstalliere während der Bereinigung keine Software (ausser, du wurdest dazu aufgefordert).
Wenn etwas unklar ist: Frage, bevor du etwas "blind" machst!
Poste die Logfiles direkt in deinen Thread. Nicht anhängen, außer, ich fordere dich dazu auf. Erschwert mir nämlich das Auswerten.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

FRST

Downloade dir bitte Farbar's Recovery Scan Tool und speichere diese auf einen USB Stick. Schließe den USB Stick an das infizierte System an Du musst das System nun in die System Reparatur Option booten. Über den Boot Manager

Starte den Rechner neu auf.
Während dem Hochfahren drücke mehrmals die F8 Taste
Wähle nun Computer reparieren.
Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD

Lege die Windows CD in dein Laufwerk.
Starte den Rechner neu auf und starte von der CD
Wähle die Spracheinstellungen und klicke "Weiter".
Klicke auf Computerreparaturoptionen !!
Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.
Im öffnenden Textdokument --> Datei --> Speichern unter und wähle Computer Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt.
Schließe Notepad wieder
Gib nun bitte folgenden Befehl ein. e:\frst.exe Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Gegebenfalls anpassen.
Akzeptiere den Disclaimer mit Yes und klicke Scan

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Allmendweg · 16.04.2012, 07:49

Marius
Danke für die Nachricht. Ich nehme an, "posten" heisst, in dieses Feld zu pasten. Hier das file FRST.txt von frst64.exe:

Scan result of Farbar Recovery Scan Tool Version: 15-03-2012
Ran by SYSTEM at 16-04-2012 00:13:22
Running from H:\
Windows 7 Home Premium (X64) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe [357376 2009-09-16] (Alps Electric Co., Ltd.)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [8158240 2009-10-09] (Realtek Semiconductor)
HKLM\...\Run: [QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe [3189016 2009-10-01] (Dell Inc.)
HKLM\...\Run: [Broadcom Wireless Manager UI] C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe [4968960 2009-07-17] (Dell Inc.)
HKLM\...\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden" [1123320 2010-06-15] (Check Point Software Technologies)
HKLM\...\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2327952 2010-07-21] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2009-09-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [140520 2009-12-29] (CyberLink Corp.)
HKLM-x32\...\Run: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [498160 2009-10-15] ()
HKLM-x32\...\Run: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2 [409744 2009-06-24] (Creative Technology Ltd)
HKLM-x32\...\Run: [ZoneAlarm Client] "C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe" [1043968 2010-06-28] (Check Point Software Technologies LTD)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35760 2010-09-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [932288 2010-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [249064 2010-10-29] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-01] (Apple Inc.)
HKLM-x32\...\Run: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot [296056 2011-12-03] (RealNetworks, Inc.)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-11-01] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2011-10-24] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2011-12-07] (Apple Inc.)
HKU\Catherine\...\Run: [Facebook Update] "C:\Users\Catherine\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [137536 2011-12-22] (Facebook Inc.)
HKU\Catherine\...\Run: [lmfvMDBr3jNvGGM] C:\Users\Catherine\AppData\Roaming\bstr55uhjzd.exe [306688 2012-04-11] (cambi taceva)
HKU\Catherine\...\Policies\system: [DisableTaskMgr] 1
HKU\Catherine\...\Policies\system: [DisableRegistryTools] 1
HKU\Catherine\...\Winlogon: [Userinit] C:\Users\Catherine\AppData\Roaming\bstr55uhjzd.exe,C:\WINDOWS\System32\userinit.exe, [30720 2010-11-20] (Microsoft Corporation)
HKU\Catherine\...\Winlogon: [Shell] C:\Users\Catherine\AppData\Roaming\bstr55uhjzd.exe [306688 2012-04-11] (cambi taceva)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

==================== Services ====================

3 AeLookupSvc; C:\Windows\System32\aelupsvc.dll [72192 2009-07-13] (Microsoft Corporation)
2 AERTFilters; C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [92160 2009-10-09] (Andrea Electronics Corporation)
3 ALG; C:\Windows\System32\alg.exe [79360 2009-07-13] (Microsoft Corporation)
2 AMD External Events Utility; C:\Windows\System32\atiesrxx.exe [202752 2009-09-08] (AMD)
3 AppIDSvc; C:\Windows\System32\appidsvc.dll [32256 2009-07-13] (Microsoft Corporation)
3 Appinfo; C:\Windows\System32\appinfo.dll [70656 2010-11-20] (Microsoft Corporation)
2 Apple Mobile Device; "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe" [55144 2011-10-24] (Apple Inc.)
2 AudioEndpointBuilder; C:\Windows\System32\Audiosrv.dll [679424 2010-11-20] (Microsoft Corporation)
2 AudioSrv; C:\Windows\System32\Audiosrv.dll [679424 2010-11-20] (Microsoft Corporation)
3 AxInstSV; C:\Windows\System32\AxInstSV.dll [114688 2010-11-20] (Microsoft Corporation)
2 BBSvc; "C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE" [196176 2011-10-21] (Microsoft Corporation.)
2 BBUpdate; "C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE" [249648 2011-10-13] (Microsoft Corporation)
3 BDESVC; C:\Windows\System32\bdesvc.dll [100864 2009-07-13] (Microsoft Corporation)
2 BFE; C:\Windows\System32\bfe.dll [705024 2010-11-20] (Microsoft Corporation)
2 BITS; C:\Windows\System32\qmgr.dll [849920 2010-11-20] (Microsoft Corporation)
2 Bonjour Service; "C:\Program Files\Bonjour\mDNSResponder.exe" [462184 2011-08-30] (Apple Inc.)
3 Browser; C:\Windows\System32\browser.dll [136192 2010-11-20] (Microsoft Corporation)
3 bthserv; C:\Windows\System32\bthserv.dll [83968 2009-07-13] (Microsoft Corporation)
3 CertPropSvc; C:\Windows\System32\certprop.dll [80384 2010-11-20] (Microsoft Corporation)
3 clr_optimization_v2.0.50727_32; C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [66384 2009-06-10] (Microsoft Corporation)
3 clr_optimization_v2.0.50727_64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [89920 2009-06-10] (Microsoft Corporation)
3 COMSysApp; C:\Windows\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} [9728 2009-07-13] (Microsoft Corporation)
3 COMSysApp; C:\Windows\SysWow64\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} [7168 2009-07-13] (Microsoft Corporation)
2 CryptSvc; C:\Windows\System32\cryptsvc.dll [177152 2010-11-20] (Microsoft Corporation)
2 CryptSvc; C:\Windows\SysWow64\cryptsvc.dll [136192 2010-11-20] (Microsoft Corporation)
2 DcomLaunch; C:\Windows\System32\rpcss.dll [512000 2010-11-20] (Microsoft Corporation)
3 defragsvc; C:\Windows\System32\defragsvc.dll [291328 2009-07-13] (Microsoft Corporation)
2 Dhcp; C:\Windows\System32\dhcpcore.dll [317952 2010-11-20] (Microsoft Corporation)
2 Dhcp; C:\Windows\SysWow64\dhcpcore.dll [254464 2010-11-20] (Microsoft Corporation)
2 Dnscache; C:\Windows\System32\dnsrslvr.dll [183296 2011-03-02] (Microsoft Corporation)
3 dot3svc; C:\Windows\System32\dot3svc.dll [252416 2010-11-20] (Microsoft Corporation)
2 DPS; C:\Windows\System32\dps.dll [162816 2010-11-20] (Microsoft Corporation)
3 EapHost; C:\Windows\System32\eapsvc.dll [111104 2009-07-13] (Microsoft Corporation)
3 EFS; C:\Windows\System32\lsass.exe [31232 2011-11-16] (Microsoft Corporation)
3 ehRecvr; C:\Windows\ehome\ehRecvr.exe [696832 2010-11-20] (Microsoft Corporation)
3 ehSched; C:\Windows\ehome\ehsched.exe [127488 2009-07-13] (Microsoft Corporation)
2 eventlog; C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted [27136 2009-07-13] (Microsoft Corporation)
2 eventlog; C:\Windows\SysWow64\svchost.exe -k LocalServiceNetworkRestricted [20992 2009-07-13] (Microsoft Corporation)
2 EventSystem; C:\Windows\System32\es.dll [402944 2009-07-13] (Microsoft Corporation)
2 EventSystem; C:\Windows\SysWow64\es.dll [271360 2009-07-13] (Microsoft Corporation)
3 Fax; C:\Windows\System32\fxssvc.exe [689152 2010-11-20] (Microsoft Corporation)
3 fdPHost; C:\Windows\System32\fdPHost.dll [16384 2009-07-13] (Microsoft Corporation)
2 FDResPub; C:\Windows\System32\fdrespub.dll [34816 2009-07-13] (Microsoft Corporation)
2 FontCache; C:\Windows\System32\FntCache.dll [1137664 2010-11-20] (Microsoft Corporation)
3 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42856 2010-11-04] (Microsoft Corporation)
2 gpsvc; C:\Windows\System32\gpsvc.dll [777728 2010-11-20] (Microsoft Corporation)
2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [136176 2011-08-10] (Google Inc.)
3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [136176 2011-08-10] (Google Inc.)
3 gusvc; "C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe" [136120 2010-06-10] (Google)
3 hidserv; C:\Windows\System32\hidserv.dll [38912 2009-07-13] (Microsoft Corporation)
3 hidserv; C:\Windows\SysWow64\hidserv.dll [49152 2009-07-13] (Microsoft Corporation)
3 hkmsvc; C:\Windows\System32\kmsvc.dll [90624 2010-11-20] (Microsoft Corporation)
3 HomeGroupListener; C:\Windows\System32\ListSvc.dll [232448 2010-11-20] (Microsoft Corporation)
3 HomeGroupProvider; C:\Windows\System32\provsvc.dll [187904 2010-11-20] (Microsoft Corporation)
3 HomeGroupProvider; C:\Windows\SysWow64\provsvc.dll [165376 2010-11-20] (Microsoft Corporation)
2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1043584 2010-01-29] (Hewlett-Packard Co.)
3 idsvc; "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe" [856400 2010-11-04] (Microsoft Corporation)
2 IKEEXT; C:\Windows\System32\ikeext.dll [853504 2010-11-20] (Microsoft Corporation)
2 IPBusEnum; C:\Windows\System32\ipbusenum.dll [101888 2009-07-13] (Microsoft Corporation)
2 iphlpsvc; C:\Windows\System32\iphlpsvc.dll [569344 2010-11-20] (Microsoft Corporation)
3 iPod Service; "C:\Program Files\iPod\bin\iPodService.exe" [934760 2011-12-07] (Apple Inc.)
2 IswSvc; "C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe" [823288 2010-06-15] (Check Point Software Technologies)
3 KeyIso; C:\Windows\System32\lsass.exe [31232 2011-11-16] (Microsoft Corporation)
3 KtmRm; C:\Windows\System32\msdtckrm.dll [368640 2009-07-13] (Microsoft Corporation)
2 LanmanServer; C:\Windows\System32\srvsvc.dll [236032 2010-11-20] (Microsoft Corporation)
2 LanmanWorkstation; C:\Windows\System32\wkssvc.dll [118784 2010-11-20] (Microsoft Corporation)
3 lltdsvc; C:\Windows\System32\lltdsvc.dll [300032 2009-07-13] (Microsoft Corporation)
2 lmhosts; C:\Windows\System32\lmhsvc.dll [23552 2009-07-13] (Microsoft Corporation)
2 LMS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [268824 2009-09-30] (Intel Corporation)
4 Mcx2Svc; C:\Windows\System32\Mcx2Svc.dll [84992 2010-11-20] (Microsoft Corporation)
2 MMCSS; C:\Windows\System32\mmcss.dll [67584 2009-07-13] (Microsoft Corporation)
2 MpsSvc; C:\Windows\System32\mpssvc.dll [828416 2010-11-20] (Microsoft Corporation)
3 MSDTC; C:\Windows\System32\msdtc.exe [141824 2009-07-13] (Microsoft Corporation)
3 MSiSCSI; C:\Windows\System32\iscsiexe.dll [156672 2009-07-13] (Microsoft Corporation)
3 msiserver; C:\Windows\System32\msiexec.exe /V [128000 2010-11-20] (Microsoft Corporation)
3 msiserver; C:\Windows\SysWow64\msiexec.exe /V [73216 2010-11-20] (Microsoft Corporation)
3 napagent; C:\Windows\System32\qagentRT.dll [476160 2010-11-20] (Microsoft Corporation)
2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2009-05-14] (Hewlett-Packard)
3 Netlogon; C:\Windows\System32\lsass.exe [31232 2011-11-16] (Microsoft Corporation)
3 Netman; C:\Windows\System32\netman.dll [360448 2009-07-13] (Microsoft Corporation)
3 netprofm; C:\Windows\System32\netprofm.dll [459776 2009-07-13] (Microsoft Corporation)
3 netprofm; C:\Windows\SysWow64\netprofm.dll [360448 2009-07-13] (Microsoft Corporation)
4 NetTcpPortSharing; "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe" [116560 2009-06-10] (Microsoft Corporation)
2 NlaSvc; C:\Windows\System32\nlasvc.dll [303616 2010-11-20] (Microsoft Corporation)
2 nsi; C:\Windows\System32\nsisvc.dll [25600 2009-07-13] (Microsoft Corporation)
3 odserv; "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE" [440696 2011-07-19] (Microsoft Corporation)
3 ose; "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE" [145184 2006-10-26] (Microsoft Corporation)
3 p2pimsvc; C:\Windows\System32\pnrpsvc.dll [327168 2009-07-13] (Microsoft Corporation)
3 p2psvc; C:\Windows\System32\p2psvc.dll [438784 2009-07-13] (Microsoft Corporation)
2 PcaSvc; C:\Windows\System32\pcasvc.dll [186368 2009-07-13] (Microsoft Corporation)
3 PerfHost; C:\Windows\SysWow64\perfhost.exe [20992 2009-07-13] (Microsoft Corporation)
3 pla; C:\Windows\System32\pla.dll [1389056 2010-11-20] (Microsoft Corporation)
3 pla; C:\Windows\SysWow64\pla.dll [1508864 2010-11-20] (Microsoft Corporation)
2 PlugPlay; C:\Windows\System32\umpnpmgr.dll [404480 2011-05-24] (Microsoft Corporation)
2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2009-05-14] (Hewlett-Packard)
3 PNRPAutoReg; C:\Windows\System32\pnrpauto.dll [25088 2009-07-13] (Microsoft Corporation)
3 PNRPsvc; C:\Windows\System32\pnrpsvc.dll [327168 2009-07-13] (Microsoft Corporation)
3 PolicyAgent; C:\Windows\System32\ipsecsvc.dll [501248 2010-11-20] (Microsoft Corporation)
2 Power; C:\Windows\System32\umpo.dll [163840 2009-07-13] (Microsoft Corporation)
2 ProfSvc; C:\Windows\System32\profsvc.dll [209920 2010-11-20] (Microsoft Corporation)
3 ProtectedStorage; C:\Windows\System32\lsass.exe [31232 2011-11-16] (Microsoft Corporation)
3 QWAVE; C:\Windows\system32\qwave.dll [242688 2009-07-13] (Microsoft Corporation)
3 QWAVE; C:\Windows\SysWow64\qwave.dll [210944 2009-07-13] (Microsoft Corporation)
3 RasAuto; C:\Windows\System32\rasauto.dll [99328 2009-07-13] (Microsoft Corporation)
3 RasMan; C:\Windows\System32\rasmans.dll [344064 2010-11-20] (Microsoft Corporation)
4 RemoteAccess; C:\Windows\System32\mprdim.dll [97792 2009-07-13] (Microsoft Corporation)
4 RemoteAccess; C:\Windows\SysWow64\mprdim.dll [75264 2009-07-13] (Microsoft Corporation)
3 RemoteRegistry; C:\Windows\System32\regsvc.dll [159232 2009-07-13] (Microsoft Corporation)
2 RpcEptMapper; C:\Windows\System32\RpcEpMap.dll [67072 2009-07-13] (Microsoft Corporation)
3 RpcLocator; C:\Windows\System32\locator.exe [10240 2009-07-13] (Microsoft Corporation)
2 RpcSs; C:\Windows\System32\rpcss.dll [512000 2010-11-20] (Microsoft Corporation)
2 SamSs; C:\Windows\System32\lsass.exe [31232 2011-11-16] (Microsoft Corporation)
3 SCardSvr; C:\Windows\System32\SCardSvr.dll [190976 2009-07-13] (Microsoft Corporation)
2 Schedule; C:\Windows\System32\schedsvc.dll [1110016 2010-11-20] (Microsoft Corporation)
3 SCPolicySvc; C:\Windows\System32\certprop.dll [80384 2010-11-20] (Microsoft Corporation)
3 SDRSVC; C:\Windows\System32\SDRSVC.dll [170496 2010-11-20] (Microsoft Corporation)
3 seclogon; C:\Windows\system32\seclogon.dll [30720 2010-11-20] (Microsoft Corporation)
2 SENS; C:\Windows\System32\sens.dll [64512 2009-07-13] (Microsoft Corporation)
2 SENS; C:\Windows\SysWow64\sens.dll [49664 2009-07-13] (Microsoft Corporation)
3 SensrSvc; C:\Windows\System32\sensrsvc.dll [29184 2009-07-13] (Microsoft Corporation)
3 SessionEnv; C:\Windows\System32\sessenv.dll [121856 2010-11-20] (Microsoft Corporation)
3 SessionEnv; C:\Windows\SysWow64\sessenv.dll [113664 2010-11-20] (Microsoft Corporation)
4 SharedAccess; C:\Windows\System32\ipnathlp.dll [359424 2009-07-13] (Microsoft Corporation)
2 ShellHWDetection; C:\Windows\System32\shsvcs.dll [370688 2010-11-20] (Microsoft Corporation)
2 ShellHWDetection; C:\Windows\SysWow64\shsvcs.dll [328192 2010-11-20] (Microsoft Corporation)
3 SNMPTRAP; C:\Windows\System32\snmptrap.exe [14336 2009-07-13] (Microsoft Corporation)
2 Spooler; C:\Windows\System32\spoolsv.exe [559104 2010-11-20] (Microsoft Corporation)
2 sppsvc; C:\Windows\System32\sppsvc.exe [3524608 2010-11-20] (Microsoft Corporation)
3 sppuinotify; C:\Windows\System32\sppuinotify.dll [65536 2009-07-13] (Microsoft Corporation)
3 SSDPSRV; C:\Windows\System32\ssdpsrv.dll [193024 2009-07-13] (Microsoft Corporation)
3 SstpSvc; C:\Windows\System32\sstpsvc.dll [75264 2009-07-13] (Microsoft Corporation)
2 stisvc; C:\Windows\System32\wiaservc.dll [580096 2010-11-20] (Microsoft Corporation)
3 swprv; C:\Windows\System32\swprv.dll [524288 2009-07-13] (Microsoft Corporation)
2 SysMain; C:\Windows\System32\sysmain.dll [1743360 2010-11-20] (Microsoft Corporation)
3 TabletInputService; C:\Windows\System32\TabSvc.dll [92672 2010-11-20] (Microsoft Corporation)
3 TapiSrv; C:\Windows\System32\tapisrv.dll [316928 2010-11-20] (Microsoft Corporation)
3 TapiSrv; C:\Windows\SysWow64\tapisrv.dll [242176 2010-11-20] (Microsoft Corporation)
3 TBS; C:\Windows\System32\tbssvc.dll [65536 2009-07-13] (Microsoft Corporation)
2 TermService; C:\Windows\System32\termsrv.dll [680960 2010-11-20] (Microsoft Corporation)
2 Themes; C:\Windows\System32\themeservice.dll [44544 2009-07-13] (Microsoft Corporation)
3 THREADORDER; C:\Windows\System32\mmcss.dll [67584 2009-07-13] (Microsoft Corporation)
2 TrkWks; C:\Windows\System32\trkwks.dll [119808 2009-07-13] (Microsoft Corporation)
3 TrustedInstaller; C:\Windows\servicing\TrustedInstaller.exe [194048 2010-11-20] (Microsoft Corporation)
3 UI0Detect; C:\Windows\System32\UI0Detect.exe [40960 2009-07-13] (Microsoft Corporation)
2 UNS; "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe" [2320920 2009-09-30] (Intel Corporation)
3 upnphost; C:\Windows\System32\upnphost.dll [353792 2009-07-13] (Microsoft Corporation)
3 upnphost; C:\Windows\SysWow64\upnphost.dll [266752 2009-07-13] (Microsoft Corporation)
2 UxSms; C:\Windows\System32\uxsms.dll [38912 2009-07-13] (Microsoft Corporation)
3 VaultSvc; C:\Windows\System32\lsass.exe [31232 2011-11-16] (Microsoft Corporation)
3 vds; C:\Windows\System32\vds.exe [533504 2010-11-20] (Microsoft Corporation)
2 vsmon; C:\Windows\SysWOW64\ZoneLabs\vsmon.exe -service [2435592 2010-06-28] (Check Point Software Technologies LTD)
3 VSS; C:\Windows\System32\vssvc.exe [1600512 2010-11-20] (Microsoft Corporation)
3 W32Time; C:\Windows\System32\w32time.dll [381952 2009-07-13] (Microsoft Corporation)
3 WatAdminSvc; C:\Windows\System32\Wat\WatAdminSvc.exe [1255736 2010-06-21] (Microsoft Corporation)
3 wbengine; "C:\Windows\system32\wbengine.exe" [1504256 2010-11-20] (Microsoft Corporation)
3 WbioSrvc; C:\Windows\System32\wbiosrvc.dll [202240 2009-07-13] (Microsoft Corporation)
3 wcncsvc; C:\Windows\System32\wcncsvc.dll [367104 2010-11-20] (Microsoft Corporation)
3 wcncsvc; C:\Windows\SysWow64\wcncsvc.dll [276992 2010-11-20] (Microsoft Corporation)
3 WcsPlugInService; C:\Windows\System32\WcsPlugInService.dll [40960 2009-07-13] (Microsoft Corporation)
3 WcsPlugInService; C:\Windows\SysWow64\WcsPlugInService.dll [32768 2009-07-13] (Microsoft Corporation)
3 WdiServiceHost; C:\Windows\System32\wdi.dll [90624 2009-07-13] (Microsoft Corporation)
3 WdiServiceHost; C:\Windows\SysWow64\wdi.dll [76288 2009-07-13] (Microsoft Corporation)
3 WdiSystemHost; C:\Windows\System32\wdi.dll [90624 2009-07-13] (Microsoft Corporation)
3 WdiSystemHost; C:\Windows\SysWow64\wdi.dll [76288 2009-07-13] (Microsoft Corporation)
3 WebClient; C:\Windows\System32\webclnt.dll [258560 2010-11-20] (Microsoft Corporation)
3 WebClient; C:\Windows\SysWow64\webclnt.dll [204800 2010-11-20] (Microsoft Corporation)
3 Wecsvc; C:\Windows\System32\wecsvc.dll [237568 2009-07-13] (Microsoft Corporation)
3 wercplsupport; C:\Windows\System32\wercplsupport.dll [84480 2009-07-13] (Microsoft Corporation)
3 WerSvc; C:\Windows\System32\WerSvc.dll [76800 2009-07-13] (Microsoft Corporation)
2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)
3 WinHttpAutoProxySvc; winhttp.dll [444416 2010-11-20] (Microsoft Corporation)
3 WinHttpAutoProxySvc; winhttp.dll [351232 2010-11-20] (Microsoft Corporation)
2 Winmgmt; C:\Windows\System32\wbem\WMIsvc.dll [242688 2009-07-13] (Microsoft Corporation)
3 WinRM; C:\Windows\System32\WsmSvc.dll [2018304 2010-11-20] (Microsoft Corporation)
3 WinRM; C:\Windows\SysWow64\WsmSvc.dll [1175040 2010-11-20] (Microsoft Corporation)
2 Wlansvc; C:\Windows\System32\wlansvc.dll [886784 2009-07-13] (Microsoft Corporation)
2 wltrysvc; "C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE" "C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe" [3417088 2009-07-17] (Dell Inc.)
3 wmiApSrv; C:\Windows\System32\wbem\WmiApSrv.exe [203264 2009-07-13] (Microsoft Corporation)
2 WMPNetworkSvc; "C:\Program Files\Windows Media Player\wmpnetwk.exe" [1525248 2010-11-20] (Microsoft Corporation)
3 WPCSvc; C:\Windows\System32\wpcsvc.dll [12288 2009-07-13] (Microsoft Corporation)
3 WPCSvc; C:\Windows\SysWow64\wpcsvc.dll [10752 2009-07-13] (Microsoft Corporation)
3 WPDBusEnum; C:\Windows\System32\wpdbusenum.dll [117248 2010-11-20] (Microsoft Corporation)
2 wscsvc; C:\Windows\System32\wscsvc.dll [97280 2009-07-13] (Microsoft Corporation)
2 WSearch; C:\Windows\System32\SearchIndexer.exe /Embedding [593408 2009-07-13] (Microsoft Corporation)
2 WSearch; C:\Windows\SysWow64\SearchIndexer.exe /Embedding [428032 2009-07-13] (Microsoft Corporation)
2 wuauserv; C:\Windows\System32\wuaueng.dll [2420736 2010-11-20] (Microsoft Corporation)
2 wudfsvc; C:\Windows\System32\WUDFSvc.dll [78848 2010-11-20] (Microsoft Corporation)
3 WwanSvc; C:\Windows\System32\wwansvc.dll [229888 2009-07-13] (Microsoft Corporation)

========================== Drivers ===========================

3 1394ohci; C:\Windows\System32\Drivers\1394ohci.sys [229888 2010-11-20] (Microsoft Corporation)
0 ACPI; C:\Windows\System32\Drivers\ACPI.sys [334208 2010-11-20] (Microsoft Corporation)
3 AcpiPmi; C:\Windows\System32\Drivers\AcpiPmi.sys [12800 2010-11-20] (Microsoft Corporation)
3 adp94xx; C:\Windows\System32\Drivers\adp94xx.sys [491088 2009-07-13] (Adaptec, Inc.)
3 adpahci; C:\Windows\System32\Drivers\adpahci.sys [339536 2009-07-13] (Adaptec, Inc.)
3 adpu320; C:\Windows\System32\Drivers\adpu320.sys [182864 2009-07-13] (Adaptec, Inc.)
1 AFD; C:\Windows\System32\Drivers\AFD.sys [498688 2011-12-27] (Microsoft Corporation)
3 agp440; C:\Windows\System32\Drivers\agp440.sys [61008 2009-07-13] (Microsoft Corporation)
3 aliide; C:\Windows\System32\Drivers\aliide.sys [15440 2009-07-13] (Acer Laboratories Inc.)
3 amdide; C:\Windows\System32\Drivers\amdide.sys [15440 2009-07-13] (Microsoft Corporation)
3 AmdK8; C:\Windows\System32\Drivers\AmdK8.sys [64512 2009-07-13] (Microsoft Corporation)
3 AmdPPM; C:\Windows\System32\Drivers\AmdPPM.sys [60928 2009-07-13] (Microsoft Corporation)
3 amdsata; C:\Windows\System32\Drivers\amdsata.sys [107904 2010-11-20] (Advanced Micro Devices)
3 amdsbs; C:\Windows\System32\Drivers\amdsbs.sys [194128 2009-07-13] (AMD Technologies Inc.)
0 amdxata; C:\Windows\System32\Drivers\amdxata.sys [27008 2010-11-20] (Advanced Micro Devices)
3 ApfiltrService; C:\Windows\System32\DRIVERS\Apfiltr.sys [267312 2009-09-16] (Alps Electric Co., Ltd.)
3 AppID; C:\Windows\System32\Drivers\AppID.sys [61440 2010-11-20] (Microsoft Corporation)
3 arc; C:\Windows\System32\Drivers\arc.sys [87632 2009-07-13] (Adaptec, Inc.)
3 arcsas; C:\Windows\System32\Drivers\arcsas.sys [97856 2009-07-13] (Adaptec, Inc.)
3 AsyncMac; C:\Windows\System32\Drivers\AsyncMac.sys [23040 2009-07-13] (Microsoft Corporation)
0 atapi; C:\Windows\System32\Drivers\atapi.sys [24128 2009-07-13] (Microsoft Corporation)
3 AtiHdmiService; C:\Windows\System32\drivers\AtiHdmi.sys [120336 2009-08-22] (ATI Technologies, Inc.)
3 atikmdag; C:\Windows\System32\Drivers\atikmdag.sys [6204928 2009-09-08] (ATI Technologies Inc.)
2 atksgt; C:\Windows\System32\Drivers\atksgt.sys [310728 2011-05-29] ()
3 b06bdrv; C:\Windows\System32\DRIVERS\bxvbda.sys [468480 2009-06-10] (Broadcom Corporation)
3 b57nd60a; C:\Windows\System32\Drivers\b57nd60a.sys [270848 2009-06-10] (Broadcom Corporation)
3 BCM42RLY; C:\Windows\System32\Drivers\BCM42RLY.sys [22520 2009-07-17] (Broadcom Corporation)
3 BCM43XX; C:\Windows\System32\DRIVERS\bcmwl664.sys [2769400 2009-07-17] (Broadcom Corporation)
1 Beep; C:\Windows\System32\Drivers\Beep.sys [6656 2009-07-13] (Microsoft Corporation)
1 blbdrive; C:\Windows\System32\Drivers\blbdrive.sys [45056 2009-07-13] (Microsoft Corporation)
3 bowser; C:\Windows\System32\Drivers\bowser.sys [90624 2011-02-22] (Microsoft Corporation)
3 BrFiltLo; C:\Windows\System32\Drivers\BrFiltLo.sys [18432 2009-06-10] (Brother Industries, Ltd.)
3 BrFiltUp; C:\Windows\System32\Drivers\BrFiltUp.sys [8704 2009-06-10] (Brother Industries, Ltd.)
3 Brserid; C:\Windows\System32\Drivers\Brserid.sys [286720 2009-07-13] (Brother Industries Ltd.)
3 BrSerWdm; C:\Windows\System32\Drivers\BrSerWdm.sys [47104 2009-06-10] (Brother Industries Ltd.)
3 BrUsbMdm; C:\Windows\System32\Drivers\BrUsbMdm.sys [14976 2009-06-10] (Brother Industries Ltd.)
3 BrUsbSer; C:\Windows\System32\Drivers\BrUsbSer.sys [14720 2009-06-10] (Brother Industries Ltd.)
3 BTHMODEM; C:\Windows\System32\Drivers\BTHMODEM.sys [72192 2009-07-13] (Microsoft Corporation)
4 cdfs; C:\Windows\System32\Drivers\cdfs.sys [92160 2009-07-13] (Microsoft Corporation)
1 cdrom; C:\Windows\System32\Drivers\cdrom.sys [147456 2010-11-20] (Microsoft Corporation)
3 circlass; C:\Windows\System32\Drivers\circlass.sys [45568 2009-07-13] (Microsoft Corporation)
0 CLFS; C:\Windows\System32\CLFS.sys [367696 2009-07-13] (Microsoft Corporation)
3 CmBatt; C:\Windows\System32\Drivers\CmBatt.sys [17664 2009-07-13] (Microsoft Corporation)
3 cmdide; C:\Windows\System32\Drivers\cmdide.sys [17488 2009-07-13] (CMD Technology, Inc.)
0 CNG; C:\Windows\System32\Drivers\CNG.sys [459232 2011-11-16] (Microsoft Corporation)
0 Compbatt; C:\Windows\System32\Drivers\Compbatt.sys [21584 2009-07-13] (Microsoft Corporation)
3 CompositeBus; C:\Windows\System32\Drivers\CompositeBus.sys [38912 2010-11-20] (Microsoft Corporation)
4 crcdisk; C:\Windows\System32\Drivers\crcdisk.sys [24144 2009-07-13] (Microsoft Corporation)
3 CtClsFlt; C:\Windows\System32\Drivers\CtClsFlt.sys [172704 2009-06-15] (Creative Technology Ltd.)
3 dc3d; C:\Windows\System32\Drivers\dc3d.sys [51600 2010-07-01] (Microsoft Corporation)
1 DfsC; C:\Windows\System32\Drivers\DfsC.sys [102400 2010-11-20] (Microsoft Corporation)
1 discache; C:\Windows\System32\Drivers\discache.sys [40448 2009-07-13] (Microsoft Corporation)
0 Disk; C:\Windows\System32\Drivers\Disk.sys [73280 2009-07-13] (Microsoft Corporation)
3 drmkaud; C:\Windows\System32\Drivers\drmkaud.sys [5632 2009-07-13] (Microsoft Corporation)
3 DXGKrnl; C:\Windows\System32\Drivers\DXGKrnl.sys [982912 2010-11-20] (Microsoft Corporation)
3 ebdrv; C:\Windows\System32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
3 elxstor; C:\Windows\System32\Drivers\elxstor.sys [530496 2009-07-13] (Emulex)
3 ErrDev; C:\Windows\System32\Drivers\ErrDev.sys [9728 2009-07-13] (Microsoft Corporation)
3 exfat; C:\Windows\System32\Drivers\exfat.sys [195072 2009-07-13] (Microsoft Corporation)
3 fastfat; C:\Windows\System32\Drivers\fastfat.sys [204800 2009-07-13] (Microsoft Corporation)
3 fdc; C:\Windows\System32\Drivers\fdc.sys [29696 2009-07-13] (Microsoft Corporation)
0 FileInfo; C:\Windows\System32\Drivers\FileInfo.sys [70224 2009-07-13] (Microsoft Corporation)
3 Filetrace; C:\Windows\System32\Drivers\Filetrace.sys [34304 2009-07-13] (Microsoft Corporation)
3 flpydisk; C:\Windows\System32\Drivers\flpydisk.sys [24576 2009-07-13] (Microsoft Corporation)
0 FltMgr; C:\Windows\System32\Drivers\FltMgr.sys [289664 2010-11-20] (Microsoft Corporation)
3 FsDepends; C:\Windows\System32\Drivers\FsDepends.sys [55376 2009-07-13] (Microsoft Corporation)
0 Fs_Rec; C:\Windows\System32\Drivers\Fs_Rec.sys [23408 2012-02-29] (Microsoft Corporation)
0 fvevol; C:\Windows\System32\Drivers\fvevol.sys [223248 2010-11-20] (Microsoft Corporation)
3 gagp30kx; C:\Windows\System32\Drivers\gagp30kx.sys [65088 2009-07-13] (Microsoft Corporation)
3 GEARAspiWDM; C:\Windows\System32\Drivers\GEARAspiWDM.sys [34152 2009-05-18] (GEAR Software Inc.)
3 hcw85cir; C:\Windows\System32\Drivers\hcw85cir.sys [31232 2009-06-10] (Hauppauge Computer Works, Inc.)
3 HDAudBus; C:\Windows\System32\Drivers\HDAudBus.sys [122368 2010-11-20] (Microsoft Corporation)
3 HECIx64; C:\Windows\System32\Drivers\HECIx64.sys [56344 2009-09-17] (Intel Corporation)
3 HidBatt; C:\Windows\System32\Drivers\HidBatt.sys [26624 2009-07-13] (Microsoft Corporation)
3 HidBth; C:\Windows\System32\Drivers\HidBth.sys [100864 2009-07-13] (Microsoft Corporation)
3 HidIr; C:\Windows\System32\Drivers\HidIr.sys [46592 2009-07-13] (Microsoft Corporation)
3 HidUsb; C:\Windows\System32\Drivers\HidUsb.sys [30208 2010-11-20] (Microsoft Corporation)
3 HpSAMD; C:\Windows\System32\Drivers\HpSAMD.sys [78720 2010-11-20] (Hewlett-Packard Company)
3 HTTP; C:\Windows\System32\Drivers\HTTP.sys [753664 2010-11-20] (Microsoft Corporation)
0 hwpolicy; C:\Windows\System32\Drivers\hwpolicy.sys [14720 2010-11-20] (Microsoft Corporation)
3 i8042prt; C:\Windows\System32\Drivers\i8042prt.sys [105472 2009-07-13] (Microsoft Corporation)
3 iaStorV; C:\Windows\System32\Drivers\iaStorV.sys [410496 2010-11-20] (Intel Corporation)
3 iirsp; C:\Windows\System32\Drivers\iirsp.sys [44112 2009-07-13] (Intel Corp./ICP vortex GmbH)
3 IntcAzAudAddService; C:\Windows\System32\drivers\RTKVHD64.sys [2007968 2009-10-09] (Realtek Semiconductor Corp.)
3 intelide; C:\Windows\System32\Drivers\intelide.sys [16960 2009-07-13] (Microsoft Corporation)
3 intelppm; C:\Windows\System32\Drivers\intelppm.sys [62464 2009-07-13] (Microsoft Corporation)
3 IpFilterDriver; C:\Windows\System32\DRIVERS\ipfltdrv.sys [82944 2010-11-20] (Microsoft Corporation)
3 IPMIDRV; C:\Windows\System32\Drivers\IPMIDRV.sys [78848 2010-11-20] (Microsoft Corporation)
3 IPNAT; C:\Windows\System32\Drivers\IPNAT.sys [116224 2009-07-13] (Microsoft Corporation)
3 IRENUM; C:\Windows\System32\Drivers\IRENUM.sys [17920 2009-07-13] (Microsoft Corporation)
3 isapnp; C:\Windows\System32\Drivers\isapnp.sys [20544 2009-07-13] (Microsoft Corporation)
3 iScsiPrt; C:\Windows\System32\drivers\msiscsi.sys [273792 2010-11-20] (Microsoft Corporation)
2 ISWKL; \??\C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33528 2010-06-15] (Check Point Software Technologies)
3 kbdclass; C:\Windows\System32\Drivers\kbdclass.sys [50768 2009-07-13] (Microsoft Corporation)
3 kbdhid; C:\Windows\System32\Drivers\kbdhid.sys [33280 2010-11-20] (Microsoft Corporation)
0 KSecDD; C:\Windows\System32\Drivers\KSecDD.sys [95600 2011-11-16] (Microsoft Corporation)
0 KSecPkg; C:\Windows\System32\Drivers\KSecPkg.sys [152432 2011-11-16] (Microsoft Corporation)
3 ksthunk; C:\Windows\System32\Drivers\ksthunk.sys [20992 2009-07-13] (Microsoft Corporation)
2 lirsgt; C:\Windows\System32\Drivers\lirsgt.sys [42696 2011-05-29] ()
2 lltdio; C:\Windows\System32\Drivers\lltdio.sys [60928 2009-07-13] (Microsoft Corporation)
3 LSI_FC; C:\Windows\System32\Drivers\LSI_FC.sys [114752 2009-07-13] (LSI Corporation)
3 LSI_SAS; C:\Windows\System32\Drivers\LSI_SAS.sys [106560 2009-07-13] (LSI Corporation)
3 LSI_SAS2; C:\Windows\System32\Drivers\LSI_SAS2.sys [65600 2009-07-13] (LSI Corporation)
3 LSI_SCSI; C:\Windows\System32\Drivers\LSI_SCSI.sys [115776 2009-07-13] (LSI Corporation)
2 luafv; C:\Windows\System32\Drivers\luafv.sys [113152 2009-07-13] (Microsoft Corporation)
3 lvpopf64; C:\Windows\System32\Drivers\lvpopf64.sys [271640 2009-10-06] (Logitech Inc.)
3 LVRS64; C:\Windows\System32\Drivers\LVRS64.sys [327704 2009-10-06] (Logitech Inc.)
3 LVUVC64; C:\Windows\System32\Drivers\LVUVC64.sys [6379288 2009-10-06] (Logitech Inc.)
3 megasas; C:\Windows\System32\Drivers\megasas.sys [35392 2009-07-13] (LSI Corporation)
3 MegaSR; C:\Windows\System32\Drivers\MegaSR.sys [284736 2009-07-13] (LSI Corporation, Inc.)
3 Modem; C:\Windows\System32\Drivers\Modem.sys [40448 2009-07-13] (Microsoft Corporation)
3 monitor; C:\Windows\System32\Drivers\monitor.sys [30208 2009-07-13] (Microsoft Corporation)
3 mouclass; C:\Windows\System32\Drivers\mouclass.sys [49216 2009-07-13] (Microsoft Corporation)
3 mouhid; C:\Windows\System32\Drivers\mouhid.sys [31232 2009-07-13] (Microsoft Corporation)
0 mountmgr; C:\Windows\System32\Drivers\mountmgr.sys [94592 2010-11-20] (Microsoft Corporation)
3 mpio; C:\Windows\System32\Drivers\mpio.sys [155008 2010-11-20] (Microsoft Corporation)
3 mpsdrv; C:\Windows\System32\Drivers\mpsdrv.sys [77312 2009-07-13] (Microsoft Corporation)
3 MRxDAV; C:\Windows\System32\Drivers\MRxDAV.sys [140800 2010-11-20] (Microsoft Corporation)
3 mrxsmb; C:\Windows\System32\Drivers\mrxsmb.sys [158208 2011-04-26] (Microsoft Corporation)
3 mrxsmb10; C:\Windows\System32\Drivers\mrxsmb10.sys [288768 2011-07-08] (Microsoft Corporation)
3 mrxsmb20; C:\Windows\System32\Drivers\mrxsmb20.sys [128000 2011-04-26] (Microsoft Corporation)
0 msahci; C:\Windows\System32\Drivers\msahci.sys [31104 2010-11-20] (Microsoft Corporation)
3 msdsm; C:\Windows\System32\Drivers\msdsm.sys [140672 2010-11-20] (Microsoft Corporation)
1 Msfs; C:\Windows\System32\Drivers\Msfs.sys [26112 2009-07-13] (Microsoft Corporation)
3 mshidkmdf; C:\Windows\System32\Drivers\mshidkmdf.sys [8192 2009-07-13] (Microsoft Corporation)
0 msisadrv; C:\Windows\System32\Drivers\msisadrv.sys [15424 2009-07-13] (Microsoft Corporation)
3 MSKSSRV; C:\Windows\System32\Drivers\MSKSSRV.sys [11136 2009-07-13] (Microsoft Corporation)
3 MSPCLOCK; C:\Windows\System32\Drivers\MSPCLOCK.sys [7168 2009-07-13] (Microsoft Corporation)
3 MSPQM; C:\Windows\System32\Drivers\MSPQM.sys [6784 2009-07-13] (Microsoft Corporation)
3 MsRPC; C:\Windows\System32\Drivers\MsRPC.sys [366976 2010-11-20] (Microsoft Corporation)
1 mssmbios; C:\Windows\System32\Drivers\mssmbios.sys [32320 2009-07-13] (Microsoft Corporation)
3 MSTEE; C:\Windows\System32\Drivers\MSTEE.sys [8064 2009-07-13] (Microsoft Corporation)
3 MTConfig; C:\Windows\System32\Drivers\MTConfig.sys [15360 2009-07-13] (Microsoft Corporation)
0 Mup; C:\Windows\System32\Drivers\Mup.sys [60496 2009-07-13] (Microsoft Corporation)
3 NativeWifiP; C:\Windows\System32\DRIVERS\nwifi.sys [318976 2009-07-13] (Microsoft Corporation)
0 NDIS; C:\Windows\System32\Drivers\NDIS.sys [951680 2010-11-20] (Microsoft Corporation)
3 NdisCap; C:\Windows\System32\Drivers\NdisCap.sys [35328 2009-07-13] (Microsoft Corporation)
3 NdisTapi; C:\Windows\System32\Drivers\NdisTapi.sys [24064 2009-07-13] (Microsoft Corporation)
3 Ndisuio; C:\Windows\System32\Drivers\Ndisuio.sys [56832 2010-11-20] (Microsoft Corporation)
3 NdisWan; C:\Windows\System32\Drivers\NdisWan.sys [164352 2010-11-20] (Microsoft Corporation)
3 NDProxy; C:\Windows\System32\Drivers\NDProxy.sys [57856 2010-11-20] (Microsoft Corporation)
1 NetBIOS; C:\Windows\System32\Drivers\NetBIOS.sys [44544 2009-07-13] (Microsoft Corporation)
1 NetBT; C:\Windows\System32\Drivers\NetBT.sys [261632 2010-11-20] (Microsoft Corporation)
3 nfrd960; C:\Windows\System32\Drivers\nfrd960.sys [51264 2009-07-13] (IBM Corporation)
1 Npfs; C:\Windows\System32\Drivers\Npfs.sys [44032 2009-07-13] (Microsoft Corporation)
1 nsiproxy; C:\Windows\System32\Drivers\nsiproxy.sys [24576 2009-07-13] (Microsoft Corporation)
3 Ntfs; C:\Windows\System32\Drivers\Ntfs.sys [1659776 2010-11-20] (Microsoft Corporation)
3 NuidFltr; C:\Windows\System32\Drivers\NuidFltr.sys [23952 2010-07-21] (Microsoft Corporation)
1 Null; C:\Windows\System32\Drivers\Null.sys [6144 2009-07-13] (Microsoft Corporation)
3 nvraid; C:\Windows\System32\Drivers\nvraid.sys [148352 2010-11-20] (NVIDIA Corporation)
3 nvstor; C:\Windows\System32\Drivers\nvstor.sys [166272 2010-11-20] (NVIDIA Corporation)
3 nv_agp; C:\Windows\System32\Drivers\nv_agp.sys [122960 2009-07-13] (Microsoft Corporation)
3 ohci1394; C:\Windows\System32\Drivers\ohci1394.sys [72832 2009-07-13] (Microsoft Corporation)
3 Parport; C:\Windows\System32\Drivers\Parport.sys [97280 2009-07-13] (Microsoft Corporation)
0 partmgr; C:\Windows\System32\Drivers\partmgr.sys [75136 2010-11-20] (Microsoft Corporation)
0 pci; C:\Windows\System32\Drivers\pci.sys [184704 2010-11-20] (Microsoft Corporation)
3 pciide; C:\Windows\System32\Drivers\pciide.sys [12352 2009-07-13] (Microsoft Corporation)
3 pcmcia; C:\Windows\System32\Drivers\pcmcia.sys [220752 2009-07-13] (Microsoft Corporation)
0 pcw; C:\Windows\System32\Drivers\pcw.sys [50768 2009-07-13] (Microsoft Corporation)
2 PEAUTH; C:\Windows\System32\Drivers\PEAUTH.sys [651264 2009-07-13] (Microsoft Corporation)
3 Point64; C:\Windows\System32\Drivers\Point64.sys [45456 2010-07-21] (Microsoft Corporation)
3 PptpMiniport; C:\Windows\System32\DRIVERS\raspptp.sys [111104 2010-11-20] (Microsoft Corporation)
3 Processor; C:\Windows\System32\DRIVERS\processr.sys [60416 2009-07-13] (Microsoft Corporation)
1 Psched; C:\Windows\System32\DRIVERS\pacer.sys [131584 2010-11-20] (Microsoft Corporation)
0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [55280 2009-07-09] (Sonic Solutions)
3 ql2300; C:\Windows\System32\Drivers\ql2300.sys [1524816 2009-07-13] (QLogic Corporation)
3 ql40xx; C:\Windows\System32\Drivers\ql40xx.sys [128592 2009-07-13] (QLogic Corporation)
3 QWAVEdrv; C:\Windows\System32\Drivers\QWAVEdrv.sys [46592 2009-07-13] (Microsoft Corporation)
3 RasAcd; C:\Windows\System32\Drivers\RasAcd.sys [14848 2009-07-13] (Microsoft Corporation)
3 RasAgileVpn; C:\Windows\System32\DRIVERS\AgileVpn.sys [60416 2009-07-13] (Microsoft Corporation)
3 Rasl2tp; C:\Windows\System32\Drivers\Rasl2tp.sys [129536 2010-11-20] (Microsoft Corporation)
3 RasPppoe; C:\Windows\System32\Drivers\RasPppoe.sys [92672 2009-07-13] (Microsoft Corporation)
3 RasSstp; C:\Windows\System32\Drivers\RasSstp.sys [83968 2009-07-13] (Microsoft Corporation)
1 rdbss; C:\Windows\System32\Drivers\rdbss.sys [309248 2010-11-20] (Microsoft Corporation)
3 rdpbus; C:\Windows\System32\Drivers\rdpbus.sys [24064 2009-07-13] (Microsoft Corporation)
1 RDPCDD; C:\Windows\System32\Drivers\RDPCDD.sys [7680 2009-07-13] (Microsoft Corporation)
1 RDPENCDD; C:\Windows\System32\Drivers\RDPENCDD.sys [7680 2009-07-13] (Microsoft Corporation)
1 RDPREFMP; C:\Windows\System32\Drivers\RDPREFMP.sys [8192 2009-07-13] (Microsoft Corporation)
3 RDPWD; C:\Windows\System32\Drivers\RDPWD.sys [210944 2012-02-16] (Microsoft Corporation)
0 rdyboost; C:\Windows\System32\Drivers\rdyboost.sys [213888 2010-11-20] (Microsoft Corporation)
3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
2 rspndr; C:\Windows\System32\Drivers\rspndr.sys [76800 2009-07-13] (Microsoft Corporation)
3 RSUSBSTOR; C:\Windows\System32\Drivers\RtsUStor.sys [220672 2009-07-16] (Realtek Semiconductor Corp.)
3 RTL8167; C:\Windows\System32\DRIVERS\Rt64win7.sys [239616 2009-08-20] (Realtek )
3 sbp2port; C:\Windows\System32\Drivers\sbp2port.sys [103808 2010-11-20] (Microsoft Corporation)
3 scfilter; C:\Windows\System32\Drivers\scfilter.sys [29696 2010-11-20] (Microsoft Corporation)
2 secdrv; C:\Windows\System32\Drivers\secdrv.sys [23040 2009-06-10] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
3 Serenum; C:\Windows\System32\Drivers\Serenum.sys [23552 2009-07-13] (Microsoft Corporation)
3 Serial; C:\Windows\System32\Drivers\Serial.sys [94208 2009-07-13] (Microsoft Corporation)
3 sermouse; C:\Windows\System32\Drivers\sermouse.sys [26624 2009-07-13] (Microsoft Corporation)
3 sffdisk; C:\Windows\System32\Drivers\sffdisk.sys [14336 2009-07-13] (Microsoft Corporation)
3 sffp_mmc; C:\Windows\System32\Drivers\sffp_mmc.sys [13824 2009-07-13] (Microsoft Corporation)
3 sffp_sd; C:\Windows\System32\Drivers\sffp_sd.sys [14336 2010-11-20] (Microsoft Corporation)
3 sfloppy; C:\Windows\System32\Drivers\sfloppy.sys [16896 2009-07-13] (Microsoft Corporation)
3 SiSRaid2; C:\Windows\System32\Drivers\SiSRaid2.sys [43584 2009-07-13] (Silicon Integrated Systems Corp.)
3 SiSRaid4; C:\Windows\System32\Drivers\SiSRaid4.sys [80464 2009-07-13] (Silicon Integrated Systems)
3 Smb; C:\Windows\System32\Drivers\Smb.sys [93184 2009-07-13] (Microsoft Corporation)
0 spldr; C:\Windows\System32\Drivers\spldr.sys [19008 2009-07-13] (Microsoft Corporation)
3 srv; C:\Windows\System32\Drivers\srv.sys [467456 2011-04-28] (Microsoft Corporation)
3 srv2; C:\Windows\System32\Drivers\srv2.sys [410112 2011-04-28] (Microsoft Corporation)
3 srvnet; C:\Windows\System32\Drivers\srvnet.sys [168448 2011-04-28] (Microsoft Corporation)
3 stexstor; C:\Windows\System32\Drivers\stexstor.sys [24656 2009-07-13] (Promise Technology)
3 StillCam; C:\Windows\System32\DRIVERS\serscan.sys [12288 2009-07-13] (Microsoft Corporation)
3 swenum; C:\Windows\System32\Drivers\swenum.sys [12496 2009-07-13] (Microsoft Corporation)
0 Tcpip; C:\Windows\System32\Drivers\Tcpip.sys [1923952 2011-09-29] (Microsoft Corporation)
3 TCPIP6; C:\Windows\System32\DRIVERS\tcpip.sys [1923952 2011-09-29] (Microsoft Corporation)
2 tcpipreg; C:\Windows\System32\Drivers\tcpipreg.sys [45056 2010-11-20] (Microsoft Corporation)
3 TDPIPE; C:\Windows\System32\Drivers\TDPIPE.sys [15872 2009-07-13] (Microsoft Corporation)
3 TDTCP; C:\Windows\System32\Drivers\TDTCP.sys [23552 2012-02-16] (Microsoft Corporation)
1 tdx; C:\Windows\System32\Drivers\tdx.sys [119296 2010-11-20] (Microsoft Corporation)
1 TermDD; C:\Windows\System32\Drivers\TermDD.sys [63360 2010-11-20] (Microsoft Corporation)
3 tssecsrv; C:\Windows\System32\Drivers\tssecsrv.sys [39424 2010-11-20] (Microsoft Corporation)
3 TsUsbFlt; C:\Windows\System32\Drivers\TsUsbFlt.sys [59392 2010-11-20] (Microsoft Corporation)
3 tunnel; C:\Windows\System32\Drivers\tunnel.sys [125440 2010-11-20] (Microsoft Corporation)
3 uagp35; C:\Windows\System32\Drivers\uagp35.sys [64080 2009-07-13] (Microsoft Corporation)
4 udfs; C:\Windows\System32\Drivers\udfs.sys [328192 2010-11-20] (Microsoft Corporation)
3 uliagpkx; C:\Windows\System32\Drivers\uliagpkx.sys [64592 2009-07-13] (Microsoft Corporation)
3 umbus; C:\Windows\System32\Drivers\umbus.sys [48640 2010-11-20] (Microsoft Corporation)
3 UmPass; C:\Windows\System32\Drivers\UmPass.sys [9728 2009-07-13] (Microsoft Corporation)
3 USBAAPL64; C:\Windows\System32\Drivers\USBAAPL64.sys [51712 2011-05-09] (Apple, Inc.)
3 usbaudio; C:\Windows\System32\Drivers\usbaudio.sys [109696 2010-11-20] (Microsoft Corporation)
3 usbccgp; C:\Windows\System32\Drivers\usbccgp.sys [98816 2010-11-20] (Microsoft Corporation)
3 usbcir; C:\Windows\System32\Drivers\usbcir.sys [100352 2009-07-13] (Microsoft Corporation)
3 usbehci; C:\Windows\System32\Drivers\usbehci.sys [52224 2010-11-20] (Microsoft Corporation)
3 usbhub; C:\Windows\System32\Drivers\usbhub.sys [343040 2010-11-20] (Microsoft Corporation)
3 usbohci; C:\Windows\System32\Drivers\usbohci.sys [25600 2009-07-13] (Microsoft Corporation)
3 usbprint; C:\Windows\System32\Drivers\usbprint.sys [25088 2009-07-13] (Microsoft Corporation)
3 USBSTOR; C:\Windows\System32\Drivers\USBSTOR.sys [91648 2010-11-20] (Microsoft Corporation)
3 usbuhci; C:\Windows\System32\Drivers\usbuhci.sys [30720 2009-07-13] (Microsoft Corporation)
3 usbvideo; C:\Windows\System32\Drivers\usbvideo.sys [184960 2010-11-20] (Microsoft Corporation)
0 vdrvroot; C:\Windows\System32\Drivers\vdrvroot.sys [36432 2009-07-13] (Microsoft Corporation)
3 vga; C:\Windows\System32\Drivers\vga.sys [29184 2009-07-13] (Microsoft Corporation)
1 VgaSave; C:\Windows\System32\drivers\vga.sys [29184 2009-07-13] (Microsoft Corporation)
3 vhdmp; C:\Windows\System32\Drivers\vhdmp.sys [215936 2010-11-20] (Microsoft Corporation)
3 viaide; C:\Windows\System32\Drivers\viaide.sys [17488 2009-07-13] (VIA Technologies, Inc.)
0 volmgr; C:\Windows\System32\Drivers\volmgr.sys [71552 2010-11-20] (Microsoft Corporation)
0 volmgrx; C:\Windows\System32\Drivers\volmgrx.sys [363392 2010-11-20] (Microsoft Corporation)
0 volsnap; C:\Windows\System32\Drivers\volsnap.sys [295808 2010-11-20] (Microsoft Corporation)
1 Vsdatant; C:\Windows\System32\Drivers\Vsdatant.sys [458840 2010-05-15] (Check Point Software Technologies LTD)
3 vsmraid; C:\Windows\System32\Drivers\vsmraid.sys [161872 2009-07-13] (VIA Technologies Inc.,Ltd)
3 vwifibus; C:\Windows\System32\Drivers\vwifibus.sys [24576 2009-07-13] (Microsoft Corporation)
1 vwififlt; C:\Windows\System32\Drivers\vwififlt.sys [59904 2009-07-13] (Microsoft Corporation)
3 vwifimp; C:\Windows\System32\Drivers\vwifimp.sys [17920 2009-07-13] (Microsoft Corporation)
3 WacomPen; C:\Windows\System32\Drivers\WacomPen.sys [27776 2009-07-13] (Microsoft Corporation)
3 WANARP; C:\Windows\System32\Drivers\WANARP.sys [88576 2010-11-20] (Microsoft Corporation)
1 Wanarpv6; C:\Windows\System32\DRIVERS\wanarp.sys [88576 2010-11-20] (Microsoft Corporation)
3 Wd; C:\Windows\System32\Drivers\Wd.sys [21056 2009-07-13] (Microsoft Corporation)
0 Wdf01000; C:\Windows\System32\Drivers\Wdf01000.sys [654928 2009-07-13] (Microsoft Corporation)
1 WfpLwf; C:\Windows\System32\Drivers\WfpLwf.sys [12800 2009-07-13] (Microsoft Corporation)
3 WIMMount; C:\Windows\System32\Drivers\WIMMount.sys [22096 2009-07-13] (Microsoft Corporation)
3 WIMMount; C:\Windows\SysWow64\Drivers\WIMMount.sys [19008 2009-07-13] (Microsoft Corporation)
3 WinUsb; C:\Windows\System32\Drivers\WinUsb.sys [41984 2010-11-20] (Microsoft Corporation)
3 WmiAcpi; C:\Windows\System32\Drivers\WmiAcpi.sys [14336 2009-07-13] (Microsoft Corporation)
4 ws2ifsl; C:\Windows\System32\Drivers\ws2ifsl.sys [21504 2009-07-13] (Microsoft Corporation)
3 WSDPrintDevice; C:\Windows\System32\DRIVERS\WSDPrint.sys [23040 2009-07-13] (Microsoft Corporation)
3 WudfPf; C:\Windows\System32\Drivers\WudfPf.sys [112128 2010-11-20] (Microsoft Corporation)
3 WUDFRd; C:\Windows\System32\Drivers\WUDFRd.sys [172544 2010-11-20] (Microsoft Corporation)

========================== Drivers MD5 =======================

C:\Windows\System32\Drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ACPI.sys ==> MD5 is legit
C:\Windows\System32\Drivers\AcpiPmi.sys ==> MD5 is legit
C:\Windows\System32\Drivers\adp94xx.sys ==> MD5 is legit
C:\Windows\System32\Drivers\adpahci.sys ==> MD5 is legit
C:\Windows\System32\Drivers\adpu320.sys ==> MD5 is legit
C:\Windows\System32\Drivers\AFD.sys 1C7857B62DE5994A75B054A9FD4C3825
C:\Windows\System32\Drivers\agp440.sys ==> MD5 is legit
C:\Windows\System32\Drivers\aliide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\amdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\AmdK8.sys ==> MD5 is legit
C:\Windows\System32\Drivers\AmdPPM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\amdsata.sys ==> MD5 is legit
C:\Windows\System32\Drivers\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\Drivers\amdxata.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Apfiltr.sys 8B522286C8D6A20133D12225B7759596
C:\Windows\System32\Drivers\AppID.sys ==> MD5 is legit
C:\Windows\System32\Drivers\arc.sys ==> MD5 is legit
C:\Windows\System32\Drivers\arcsas.sys ==> MD5 is legit
C:\Windows\System32\Drivers\AsyncMac.sys ==> MD5 is legit
C:\Windows\System32\Drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\drivers\AtiHdmi.sys 506934DF94E3197F4A1BBE8FBEAB0CCD
C:\Windows\System32\Drivers\atikmdag.sys C9F90FEE4FDC829382B9130A92FB744C
C:\Windows\System32\Drivers\atksgt.sys 54494B93BB5AD74C807100144EC30D64
C:\Windows\System32\DRIVERS\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\Drivers\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BCM42RLY.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bcmwl664.sys F4CD5F52850BF2C978DE178F256BA372
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\Drivers\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\Drivers\bowser.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrFiltLo.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BTHMODEM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cdfs.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cdrom.sys ==> MD5 is legit
C:\Windows\System32\Drivers\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\System32\Drivers\CmBatt.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\CNG.sys C4943B6C962E4B82197542447AD599F4
C:\Windows\System32\Drivers\Compbatt.sys ==> MD5 is legit
C:\Windows\System32\Drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\System32\Drivers\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\CtClsFlt.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dc3d.sys 76E02DB615A03801D698199A2BC4A06A
C:\Windows\System32\Drivers\DfsC.sys ==> MD5 is legit
C:\Windows\System32\Drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Disk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\Drivers\DXGKrnl.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\evbda.sys ==> MD5 is legit
C:\Windows\System32\Drivers\elxstor.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ErrDev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fdc.sys ==> MD5 is legit
C:\Windows\System32\Drivers\FileInfo.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Filetrace.sys ==> MD5 is legit
C:\Windows\System32\Drivers\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\FltMgr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\Drivers\fvevol.sys ==> MD5 is legit
C:\Windows\System32\Drivers\gagp30kx.sys ==> MD5 is legit
C:\Windows\System32\Drivers\GEARAspiWDM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\System32\Drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\System32\Drivers\HECIx64.sys B6AC71AAA2B10848F57FC49D55A651AF
C:\Windows\System32\Drivers\HidBatt.sys ==> MD5 is legit
C:\Windows\System32\Drivers\HidBth.sys ==> MD5 is legit
C:\Windows\System32\Drivers\HidIr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\HidUsb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\Drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\Drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\System32\Drivers\iaStorV.sys ==> MD5 is legit
C:\Windows\System32\Drivers\iirsp.sys ==> MD5 is legit
C:\Windows\System32\drivers\RTKVHD64.sys 2A7CF87BE453241FE0BAA1C8651E7AA4
C:\Windows\System32\Drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\System32\Drivers\IPMIDRV.sys ==> MD5 is legit
C:\Windows\System32\Drivers\IPNAT.sys ==> MD5 is legit
C:\Windows\System32\Drivers\IRENUM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\isapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\msiscsi.sys ==> MD5 is legit
C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys 01F2AB91DE44A98834C27D265E8EBECB
C:\Windows\System32\Drivers\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\Drivers\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\KSecDD.sys DA1E991A61CFDD755A589E206B97644B
C:\Windows\System32\Drivers\KSecPkg.sys 7E33198D956943A4F11A5474C1E9106F
C:\Windows\System32\Drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\lirsgt.sys 8E4CA9AFD55EF6B509C80A8715ABF8C6
C:\Windows\System32\Drivers\lltdio.sys ==> MD5 is legit
C:\Windows\System32\Drivers\LSI_FC.sys ==> MD5 is legit
C:\Windows\System32\Drivers\LSI_SAS.sys ==> MD5 is legit
C:\Windows\System32\Drivers\LSI_SAS2.sys ==> MD5 is legit
C:\Windows\System32\Drivers\LSI_SCSI.sys ==> MD5 is legit
C:\Windows\System32\Drivers\luafv.sys ==> MD5 is legit
C:\Windows\System32\Drivers\lvpopf64.sys B2085E335F2B57077B0CBADB6F1245CD
C:\Windows\System32\Drivers\LVRS64.sys 986C1CB787A007BAA5F74E7D316D7246
C:\Windows\System32\Drivers\LVUVC64.sys 5747BC465ABEA2858C5D037252AED84E
C:\Windows\System32\Drivers\megasas.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Modem.sys ==> MD5 is legit
C:\Windows\System32\Drivers\monitor.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mouclass.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mouhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MRxDAV.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\Drivers\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\Drivers\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\System32\Drivers\msahci.sys ==> MD5 is legit
C:\Windows\System32\Drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\Drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDIS.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NdisCap.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NdisTapi.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ndisuio.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NdisWan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NetBIOS.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NetBT.sys ==> MD5 is legit
C:\Windows\System32\Drivers\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\Drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NuidFltr.sys 4C08A14D04E62963E96E0BB57BBC953B
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\System32\Drivers\nvraid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\nvstor.sys ==> MD5 is legit
C:\Windows\System32\Drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Parport.sys ==> MD5 is legit
C:\Windows\System32\Drivers\partmgr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\pci.sys ==> MD5 is legit
C:\Windows\System32\Drivers\pciide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\Drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\Drivers\PEAUTH.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Point64.sys B8D8EC78B0F9ED8E220506181274F3D3
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\System32\Drivers\PxHlpa64.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ql2300.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ql40xx.sys ==> MD5 is legit
C:\Windows\System32\Drivers\QWAVEdrv.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RasAcd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RasPppoe.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RasSstp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\rdbss.sys ==> MD5 is legit
C:\Windows\System32\Drivers\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPENCDD.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPREFMP.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys 6D76E6433574B058ADCB0C50DF834492
C:\Windows\System32\Drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RimUsb_AMD64.sys 7B04C9843921AB1F695FB395422C5360
C:\Windows\System32\Drivers\rspndr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RtsUStor.sys 502B316947EA887CDDD325D4745EB7D0
C:\Windows\System32\DRIVERS\Rt64win7.sys 3B01789EE4EAEE97F5EB46B711387D5E
C:\Windows\System32\Drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\Drivers\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Serenum.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Serial.sys ==> MD5 is legit
C:\Windows\System32\Drivers\sermouse.sys ==> MD5 is legit
C:\Windows\System32\Drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\System32\Drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\System32\Drivers\sfloppy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\SiSRaid2.sys ==> MD5 is legit
C:\Windows\System32\Drivers\SiSRaid4.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\Drivers\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\Drivers\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\System32\Drivers\stexstor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serscan.sys DECACB6921DED1A38642642685D77DAC
C:\Windows\System32\Drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Tcpip.sys FC62769E7BFF2896035AEED399108162
C:\Windows\System32\DRIVERS\tcpip.sys FC62769E7BFF2896035AEED399108162
C:\Windows\System32\Drivers\tcpipreg.sys ==> MD5 is legit
C:\Windows\System32\Drivers\TDPIPE.sys ==> MD5 is legit
C:\Windows\System32\Drivers\TDTCP.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\Drivers\tdx.sys ==> MD5 is legit
C:\Windows\System32\Drivers\TermDD.sys ==> MD5 is legit
C:\Windows\System32\Drivers\tssecsrv.sys ==> MD5 is legit
C:\Windows\System32\Drivers\TsUsbFlt.sys ==> MD5 is legit
C:\Windows\System32\Drivers\tunnel.sys ==> MD5 is legit
C:\Windows\System32\Drivers\uagp35.sys ==> MD5 is legit
C:\Windows\System32\Drivers\udfs.sys ==> MD5 is legit
C:\Windows\System32\Drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\Drivers\umbus.sys ==> MD5 is legit
C:\Windows\System32\Drivers\UmPass.sys ==> MD5 is legit
C:\Windows\System32\Drivers\USBAAPL64.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbaudio.sys 82E8F44688E6FAC57B5B7C6FC7ADBC2A
C:\Windows\System32\Drivers\usbccgp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbcir.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbehci.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbhub.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbohci.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbprint.sys ==> MD5 is legit
C:\Windows\System32\Drivers\USBSTOR.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbuhci.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbvideo.sys 454800C2BC7F3927CE030141EE4F4C50
C:\Windows\System32\Drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\Drivers\vga.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\System32\Drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Vsdatant.sys 48BFA6276BCC0535F5F8898107ED489A
C:\Windows\System32\Drivers\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\Drivers\vwififlt.sys ==> MD5 is legit
C:\Windows\System32\Drivers\vwifimp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\WacomPen.sys ==> MD5 is legit
C:\Windows\System32\Drivers\WANARP.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Wd.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Wdf01000.sys ==> MD5 is legit
C:\Windows\System32\Drivers\WfpLwf.sys ==> MD5 is legit
C:\Windows\System32\Drivers\WIMMount.sys ==> MD5 is legit
C:\Windows\SysWow64\Drivers\WIMMount.sys ==> MD5 is legit
C:\Windows\System32\Drivers\WinUsb.sys FE88B288356E7B47B74B13372ADD906D
C:\Windows\System32\Drivers\WmiAcpi.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WSDPrint.sys 8D918B1DB190A4D9B1753A66FA8C96E8
C:\Windows\System32\Drivers\WudfPf.sys ==> MD5 is legit
C:\Windows\System32\Drivers\WUDFRd.sys ==> MD5 is legit

========================== NetSvcs (Whitelisted) ===========

========================= Known DLLs =========================

[2009-07-13 16:00] - [2009-07-13 17:40] - 0607744 ____A (Microsoft Corporation) C:\Windows\System32\clbcatq.dll
[2009-07-13 15:44] - [2009-07-13 17:15] - 0522240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\clbcatq.dll
[2011-06-02 03:59] - [2010-11-20 05:27] - 2086912 ____A (Microsoft Corporation) C:\Windows\System32\ole32.dll
[2011-06-02 03:58] - [2010-11-20 04:20] - 1414144 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
[2009-07-13 16:41] - [2009-07-13 17:40] - 0877056 ____A (Microsoft Corporation) C:\Windows\System32\advapi32.dll
[2011-06-02 03:58] - [2010-11-20 04:18] - 0640512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
[2011-06-02 03:58] - [2010-11-20 05:25] - 0594432 ____A (Microsoft Corporation) C:\Windows\System32\COMDLG32.dll
[2011-06-02 03:58] - [2010-11-20 04:18] - 0485888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\COMDLG32.dll
[2011-06-02 03:58] - [2010-11-20 05:26] - 0403968 ____A (Microsoft Corporation) C:\Windows\System32\gdi32.dll
[2011-06-02 03:58] - [2010-11-20 04:08] - 0311296 ____A (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
[2012-03-08 18:03] - [2012-03-08 18:03] - 2144256 ____A (Microsoft Corporation) C:\Windows\System32\IERTUTIL.dll
[2012-03-08 18:03] - [2012-03-08 18:03] - 1792000 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IERTUTIL.dll
[2012-04-12 10:37] - [2012-02-29 22:33] - 0081408 ____A (Microsoft Corporation) C:\Windows\System32\IMAGEHLP.dll
[2012-04-12 10:37] - [2012-02-29 21:33] - 0159232 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IMAGEHLP.dll
[2009-07-13 15:38] - [2009-07-13 17:41] - 0167424 ____A (Microsoft Corporation) C:\Windows\System32\IMM32.dll
[2011-06-02 03:57] - [2010-11-20 04:08] - 0119808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IMM32.dll
[2011-08-10 12:22] - [2011-07-15 21:37] - 1162752 ____A (Microsoft Corporation) C:\Windows\System32\kernel32.dll
[2011-08-10 12:22] - [2011-07-15 20:24] - 1114112 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
[2009-07-13 15:38] - [2009-07-13 17:41] - 0041984 ____A (Microsoft Corporation) C:\Windows\System32\LPK.dll
[2009-07-13 15:25] - [2009-07-13 17:11] - 0025600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\LPK.dll
[2009-07-13 15:40] - [2009-07-13 17:41] - 1067008 ____A (Microsoft Corporation) C:\Windows\System32\MSCTF.dll
[2009-07-13 15:28] - [2009-07-13 17:15] - 0828928 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MSCTF.dll
[2012-02-15 23:27] - [2011-12-16 00:46] - 0634880 ____A (Microsoft Corporation) C:\Windows\System32\MSVCRT.dll
[2012-02-15 23:27] - [2011-12-15 23:52] - 0690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MSVCRT.dll
[2009-07-13 15:26] - [2009-07-13 17:31] - 0002560 ____A (Microsoft Corporation) C:\Windows\System32\NORMALIZ.dll
[2009-07-13 15:15] - [2009-07-13 17:09] - 0002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\NORMALIZ.dll
[2009-07-13 15:21] - [2009-07-13 17:41] - 0013824 ____A (Microsoft Corporation) C:\Windows\System32\NSI.dll
[2009-07-13 15:12] - [2009-07-13 17:16] - 0008704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\NSI.dll
[2011-10-13 10:21] - [2011-08-26 21:37] - 0861696 ____A (Microsoft Corporation) C:\Windows\System32\OLEAUT32.dll
[2011-10-13 10:21] - [2011-08-26 20:26] - 0571904 ____A (Microsoft Corporation) C:\Windows\SysWOW64\OLEAUT32.dll
[2009-07-13 15:26] - [2009-07-13 17:41] - 0009216 ____A (Microsoft Corporation) C:\Windows\System32\PSAPI.dll
[2009-07-13 15:15] - [2009-07-13 17:16] - 0006144 ____A (Microsoft Corporation) C:\Windows\SysWOW64\PSAPI.dll
[2011-06-02 03:59] - [2010-11-20 05:27] - 1219584 ____A (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
[2011-06-02 03:57] - [2010-11-20 04:08] - 0663040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
[2009-07-13 15:20] - [2009-07-13 17:41] - 0113664 ____A (Microsoft Corporation) C:\Windows\System32\sechost.dll
[2009-07-13 15:11] - [2009-07-13 17:16] - 0092160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
[2011-06-02 03:58] - [2010-11-20 05:27] - 1900544 ____A (Microsoft Corporation) C:\Windows\System32\Setupapi.dll
[2011-06-02 03:58] - [2010-11-20 04:21] - 1667584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\Setupapi.dll
[2011-06-02 03:59] - [2010-11-20 05:27] - 14174208 ____A (Microsoft Corporation) C:\Windows\System32\SHELL32.dll
[2011-06-02 03:59] - [2010-11-20 04:21] - 12872192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SHELL32.dll
[2011-06-02 03:58] - [2010-11-20 05:27] - 0448512 ____A (Microsoft Corporation) C:\Windows\System32\SHLWAPI.dll
[2011-06-02 03:58] - [2010-11-20 04:21] - 0350208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SHLWAPI.dll
[2012-03-08 18:03] - [2012-03-08 18:03] - 1345536 ____A (Microsoft Corporation) C:\Windows\System32\URLMON.dll
[2012-03-08 18:03] - [2012-03-08 18:03] - 1103360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\URLMON.dll
[2011-06-02 03:58] - [2010-11-20 05:27] - 1008128 ____A (Microsoft Corporation) C:\Windows\System32\user32.dll
[2011-06-02 03:58] - [2010-11-20 04:08] - 0833024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
[2011-06-02 03:58] - [2010-11-20 05:27] - 0800256 ____A (Microsoft Corporation) C:\Windows\System32\USP10.dll
[2011-06-02 03:58] - [2010-11-20 04:21] - 0626176 ____A (Microsoft Corporation) C:\Windows\SysWOW64\USP10.dll
[2012-03-08 18:03] - [2012-03-08 18:03] - 1390080 ____A (Microsoft Corporation) C:\Windows\System32\WININET.dll
[2012-03-08 18:03] - [2012-03-08 18:03] - 1127424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WININET.dll
[2011-06-02 03:58] - [2010-11-20 05:27] - 0312832 ____A (Microsoft Corporation) C:\Windows\System32\WLDAP32.dll
[2011-06-02 03:58] - [2010-11-20 04:21] - 0269824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WLDAP32.dll
[2011-06-02 03:58] - [2010-11-20 05:27] - 0297984 ____A (Microsoft Corporation) C:\Windows\System32\WS2_32.dll
[2011-06-02 03:58] - [2010-11-20 04:21] - 0206848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WS2_32.dll
[2009-07-13 15:27] - [2009-07-13 17:40] - 0504320 ____A (Microsoft Corporation) C:\Windows\System32\DifxApi.dll
[2009-07-13 15:16] - [2009-07-13 17:15] - 0315904 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DifxApi.dll

========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

========================= Memory info ======================

Percentage of memory in use: 22%
Total physical RAM: 3956.54 MB
Available physical RAM: 3057.32 MB
Total Pagefile: 3954.69 MB
Available Pagefile: 3145.5 MB
Total Virtual: 8192 MB
Available Virtual: 8191.91 MB

======================= Partitions =========================

1 Drive c: (OS) (Fixed) (Total:58.59 GB) (Free:8.12 GB) NTFS
2 Drive d: () (Fixed) (Total:397.3 GB) (Free:312.73 GB) NTFS
3 Drive f: (WIN_7_HOMEPREMIUM) (CDROM) (Total:5.75 GB) (Free:0 GB) UDF
5 Drive h: (Transcend) (Removable) (Total:1.87 GB) (Free:1.06 GB) FAT32
6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
7 Drive y: (RECOVERY) (Fixed) (Total:9.77 GB) (Free:4.01 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 465 GB 1024 KB
Disk 1 No Media 0 B 0 B
Disk 2 Online 1926 MB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 OEM 100 MB 1024 KB
Partition 2 Primary 9 GB 101 MB
Partition 3 Primary 58 GB 9 GB
Partition 0 Extended 397 GB 68 GB
Partition 4 Logical 397 GB 68 GB

======================================================================================================

Disk: 0
Partition 1
Type : DE
Hidden: Yes
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 6 FAT Partition 100 MB Healthy Hidden

======================================================================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y RECOVERY NTFS Partition 9 GB Healthy

======================================================================================================

Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C OS NTFS Partition 58 GB Healthy

======================================================================================================

Disk: 0
Partition 4
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 D NTFS Partition 397 GB Healthy

======================================================================================================

Partitions of Disk 2:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 1922 MB 4096 KB

======================================================================================================

Disk: 2
Partition 1
Type : 0B
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 5 H Transcend FAT32 Removable 1922 MB Healthy

======================================================================================================

==========================================================

Last Boot: 2012-04-10 02:15

======================= End Of Log ==========================

Psychotic · 16.04.2012, 08:09

Schritt 1: Fix mit FRST

Lösche die FRST.exe, lade dir FRST64.exe von hier herunter und speichere es auf deinem USB-Stick.

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKU\Catherine\...\Run: [lmfvMDBr3jNvGGM] C:\Users\Catherine\AppData\Roaming\bstr55uhjzd.exe [306688 2012-04-11] (cambi taceva)
HKU\Catherine\...\Policies\system: [DisableTaskMgr] 1
HKU\Catherine\...\Policies\system: [DisableRegistryTools] 1
HKU\Catherine\...\Winlogon: [Userinit] C:\Users\Catherine\AppData\Roaming\bstr55uhjzd.exe
HKU\Catherine\...\Winlogon: [Shell] C:\Users\Catherine\AppData\Roaming\bstr55uhjzd.exe
C:\Users\Catherine\AppData\Roaming\bstr55uhjzd.exe

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST64.exe erneut und klicke den Fix Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Windows sollte nun wieder normal starten

Schritt 2: defogger

Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.

Starte das Tool mit Doppelklick.
Vista und Win7 User mit Rechtsklick "als Administrator starten".
Klicke nun auf den Disable Button um die Treiber gewisser Emulatoren zu deaktivieren.
Wenn der Scan beendet wurde ( Finished ), klicke auf OK.
Defogger fordert gegebenfalls zum Neustart auf. Bestätige dies mit OK.

Sollte Defogger eine Fehlermeldung ausgeben, poste bitte die defogger_disable Log von deinem Desktop.
Klicke den Re-enable Button nicht ohne Anweisung.

Schritt 3: aswMBR

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung) Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. ( Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen ) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Schritt 4: DDS

Downloade dir bitte dds ( von sUBs ) von einem der folgenden Downloadspiegel und speichere die Datei auf deinem Desktop. dds.com dds.scr dds.pif

Schließe alle laufenden Programme.
Starte DDS mit Doppelklick.
Es wird 2 Logfiles erstellen.
- dds.txt
- attach.txt
Speichere beide Logfiles auf deinem Desktop
Poste beide Logfiles hier.

Psychotic · 18.04.2012, 12:27

Hallo, benötigst Du noch weiterhin Hilfe ? Sollte ich innerhalb der nächsten 24 Stunden keine Antwort von dir erhalten, werde ich dein Thema aus meinen Abos nehmen und bekomme dadurch keine Nachricht über neue Antworten. Das Verschwinden der Symptome bedeutet nicht, dass dein System schon sauber ist

Allmendweg · 19.04.2012, 16:10

marius - ich bin etwas verwirrt, sorry. ich glaubte, ich hätte eine emailbenachrichtigung eingestellt, aber das habe ich wohl falsch gemacht - deswegen habe ich dann mal 3 tage gewartet.
Ich habe eben erst die weiter Anleitung gesehen, danke, und werde das versuchen.

Ich habe den fix im frst64 mit dem fixlist.txt ausgeführt und der laptop startet wieder.
Hier ist das fixlog.txt:

Fix result of Farbar Recovery Scan Tool (FRST written by farbar) Version: 15-03-2012
Ran by SYSTEM at 2012-04-19 19:46:56 R:4
Running from H:\

==============================================

HKEY_USERS\Catherine\Software\Microsoft\Windows\CurrentVersion\Run\\lmfvMDBr3jNvGGM Value deleted successfully.
HKEY_USERS\Catherine\Software\Microsoft\Windows\CurrentVersion\Policies\system\\DisableTaskMgr Value deleted successfully.
HKEY_USERS\Catherine\Software\Microsoft\Windows\CurrentVersion\Policies\system\\DisableRegistryTools Value deleted successfully.
HKEY_USERS\Catherine\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit Value deleted successfully.
HKEY_USERS\Catherine\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell Value deleted successfully.
C:\Users\Catherine\AppData\Roaming\bstr55uhjzd.exe moved successfully.

==== End of Fixlog ====

Psychotic · 19.04.2012, 19:40

Führe bitte auch die anderen Schritte aus!

Allmendweg · 19.04.2012, 20:20

hier ist das aswMBR.txt vom Schritt 3 - ich werde nun alle programme schliessen und Schritt 4 in Angriff nehmen. Frage dazu: soll ich den 'Defogger' mit dem x oben rechts schliessen und aswMBR mit 'Exit' verlassen?

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-04-19 20:47:52
-----------------------------
20:47:52.592 OS Version: Windows x64 6.1.7601 Service Pack 1
20:47:52.592 Number of processors: 4 586 0x2502
20:47:52.592 ComputerName: CATHERINE-PC UserName: Catherine
20:47:53.513 Initialize success
20:51:13.069 AVAST engine defs: 12041900
20:51:49.168 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
20:51:49.183 Disk 0 Vendor: ST9500325AS D003DEM1 Size: 476940MB BusType: 11
20:51:49.199 Disk 0 MBR read successfully
20:51:49.199 Disk 0 MBR scan
20:51:49.199 Disk 0 Windows 7 default MBR code
20:51:49.230 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 100 MB offset 2048
20:51:49.230 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 10000 MB offset 206848
20:51:49.246 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 60000 MB offset 20686848
20:51:49.261 Disk 0 Partition - 00 0F Extended LBA 406838 MB offset 143566848
20:51:49.292 Disk 0 Partition 4 00 07 HPFS/NTFS NTFS 406837 MB offset 143568896
20:51:49.355 Disk 0 scanning C:\Windows\system32\drivers
20:52:02.365 Service scanning
20:52:26.764 Modules scanning
20:52:26.779 Disk 0 trace - called modules:
20:52:26.795 ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
20:52:26.810 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004ba8060]
20:52:26.810 3 CLASSPNP.SYS[fffff8800195e43f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8004912060]
20:52:27.590 AVAST engine scan C:\Windows
20:52:29.197 AVAST engine scan C:\Windows\system32
20:55:28.677 AVAST engine scan C:\Windows\system32\drivers
20:55:44.339 AVAST engine scan C:\Users\Catherine
20:57:42.417 Disk 0 MBR has been saved successfully to "C:\Users\Catherine\Desktop\MBR.dat"
20:57:42.432 The log file has been saved successfully to "C:\Users\Catherine\Desktop\aswMBR.txt"
21:00:01.736 File: C:\Users\Catherine\AppData\Local\Temp\coymnonigzwtyac.exe **INFECTED** Win32:Malware-gen
21:00:01.861 File: C:\Users\Catherine\AppData\Local\Temp\cwnkwjgiupdkyuvhmizo.exe **INFECTED** Win32:Malware-gen
21:00:02.048 File: C:\Users\Catherine\AppData\Local\Temp\ecssxxpfoeubn.exe **INFECTED** Win32:Malware-gen
21:00:03.406 File: C:\Users\Catherine\AppData\Local\Temp\jar_cache4998532429735221379.tmp **INFECTED** Win32

ropper-gen [Drp]
21:00:03.577 File: C:\Users\Catherine\AppData\Local\Temp\jar_cache8192126317001889701.tmp **INFECTED** Win32

ropper-gen [Drp]
21:00:03.749 File: C:\Users\Catherine\AppData\Local\Temp\kfbthyjlirzpflxi.exe **INFECTED** Win32:Malware-gen
21:00:12.719 File: C:\Users\Catherine\AppData\Local\Temp\lwrtftgonuxqnlacat.exe **INFECTED** Win32:Malware-gen
21:00:12.844 File: C:\Users\Catherine\AppData\Local\Temp\mjhpcwujngclswtnpqh.exe **INFECTED** Win32

ropper-KPI [Trj]
21:00:13.031 File: C:\Users\Catherine\AppData\Local\Temp\ooswupwcmconmqy.exe **INFECTED** Win32:Malware-gen
21:00:15.355 File: C:\Users\Catherine\AppData\Local\Temp\vivyvxmijdhxodphijoxwivnw.exe **INFECTED** Win32

ropper-KPI [Trj]
21:00:15.465 File: C:\Users\Catherine\AppData\Local\Temp\vswurnumovfwiqo.exe **INFECTED** Win32:Malware-gen
21:00:15.605 File: C:\Users\Catherine\AppData\Local\Temp\vvmkjuqjrkirnsbsuvzselbwl.exe **INFECTED** Win32

ropper-KPI [Trj]
21:00:15.777 File: C:\Users\Catherine\AppData\Local\Temp\wusctpegqmtylt.exe **INFECTED** Win32:Malware-gen
21:08:16.289 AVAST engine scan C:\ProgramData
21:09:31.574 Scan finished successfully
21:11:26.718 Disk 0 MBR has been saved successfully to "C:\Users\Catherine\Desktop\MBR.dat"
21:11:26.718 The log file has been saved successfully to "C:\Users\Catherine\Desktop\aswMBR.txt"

Und hier nun die beiden dds.txt und attach.txt vom dds:

.DDS Logfile:
DDS Logfile:

Code:

ATTFilter

DDS (Ver_2011-08-26.01) - NTFSAMD64 
Internet Explorer: 9.0.8112.16421
Run by Catherine at 21:30:19 on 2012-04-19
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.41.1033.18.3957.2379 [GMT 2:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ZoneAlarm Firewall *Enabled* {D17DF357-CFF5-F001-D1C1-FCD21DFE3D5E}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\SysWOW64\ZoneLabs\vsmon.exe
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\Windows\system32\taskhost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Users\Catherine\AppData\Local\Facebook\Update\FacebookUpdate.exe
C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\Roxio\Roxio Burn\Roxio Burn.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\system32\conhost.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://tagesanzeiger.ch/
uDefault_Page_URL = hxxp://www1.euro.dell.com/content/default.aspx?c=eu&l=en&s=gen
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: ZoneAlarm-Sicherheit Toolbar: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll
mURLSearchHooks: ZoneAlarm-Sicherheit Toolbar: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll
mWinlogon: Userinit=userinit.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: ZoneAlarm Security Engine Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: ZoneAlarm-Sicherheit Toolbar: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll
TB: ZoneAlarm-Sicherheit Toolbar: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll
TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
uRun: [Facebook Update] "C:\Users\Catherine\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
mRun: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"
mRun: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
mRun: [ZoneAlarm Client] "C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe"
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
mRun: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe"  -osboot
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
uPolicies-explorer: NoDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MIF5BA~1\Office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{7A6FFBFD-622D-4A8A-8869-03A176579B23} : DhcpNameServer = 192.168.0.1
TCP: Interfaces\{7EFECC9A-E8CA-4FE1-966B-C2934F1AD41D} : DhcpNameServer = 192.168.0.1
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64:     AcroIEHelperStub - No File
BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-X64: ZoneAlarm Security Engine Registrar: {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll
BHO-X64:     ZoneAlarm Security Engine Registrar - No File
BHO-X64: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64:     SkypeIEPluginBHO - No File
BHO-X64: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO-X64: ZoneAlarm-Sicherheit Toolbar: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll
TB-X64: ZoneAlarm-Sicherheit Toolbar: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll
TB-X64: ZoneAlarm Security Engine: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll
TB-X64: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
mRun-x64: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun-x64: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
mRun-x64: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"
mRun-x64: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
mRun-x64: [ZoneAlarm Client] "C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe"
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
mRun-x64: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe"  -osboot
mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
Hosts: 66.197.194.231 Google Analytics Official Website - Web Analytics & Reporting ? Google Analytics.
Hosts: 66.197.194.231 ad-emea.doubleclick.net.
Hosts: 66.197.194.231 StatCounter - Free Invisible Web Tracker, Hit Counter and Web Stats.
Hosts: 69.72.252.254 Google Analytics Official Website - Web Analytics & Reporting ? Google Analytics.
Hosts: 69.72.252.254 ad-emea.doubleclick.net.
.
Note: multiple HOSTS entries found. Please refer to Attach.txt
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2009-10-9 92160]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
R2 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [2010-6-15 33528]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe [2010-6-15 823288]
R2 UNS;Intel(R) Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-3-31 2320920]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\system32\DRIVERS\CtClsFlt.sys --> C:\Windows\system32\DRIVERS\CtClsFlt.sys [?]
R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
S2 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176]
S2 gupdate;Google Update-Dienst (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-8-10 136176]
S3 gupdatem;Google Update-Dienst (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-8-10 136176]
S3 lvpopf64;Logitech POP Suppression Filter;C:\Windows\system32\DRIVERS\lvpopf64.sys --> C:\Windows\system32\DRIVERS\lvpopf64.sys [?]
S3 LVRS64;Logitech RightSound Filter Driver;C:\Windows\system32\DRIVERS\lvrs64.sys --> C:\Windows\system32\DRIVERS\lvrs64.sys [?]
S3 LVUVC64;QuickCam for Notebooks Deluxe(UVC);C:\Windows\system32\DRIVERS\lvuvc64.sys --> C:\Windows\system32\DRIVERS\lvuvc64.sys [?]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys --> C:\Windows\system32\DRIVERS\WSDPrint.sys [?]
.
=============== Created Last 30 ================
.
2012-04-19 18:16:28	--------	d-----w-	C:\ProgramData\B7E8586B006A51DD033B2F1DB4EB2367
2012-04-19 18:15:14	8669240	----a-w-	C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FEC34572-170A-48C5-B03E-D85EDB03B001}\mpengine.dll
2012-04-16 07:01:02	--------	d-----w-	C:\FRST
2012-04-12 18:37:43	81408	----a-w-	C:\Windows\System32\imagehlp.dll
2012-04-12 18:37:43	23408	----a-w-	C:\Windows\System32\drivers\fs_rec.sys
2012-04-12 18:37:43	159232	----a-w-	C:\Windows\SysWow64\imagehlp.dll
2012-04-12 18:37:42	5120	----a-w-	C:\Windows\SysWow64\wmi.dll
2012-04-12 18:37:42	5120	----a-w-	C:\Windows\System32\wmi.dll
2012-04-12 18:37:42	220672	----a-w-	C:\Windows\System32\wintrust.dll
2012-04-12 18:37:42	172544	----a-w-	C:\Windows\SysWow64\wintrust.dll
2012-04-02 16:13:24	--------	d-----w-	C:\Users\Catherine\AppData\Roaming\Information Factory
2012-04-02 16:13:24	--------	d-----w-	C:\Users\Catherine\AppData\Local\Information Factory
2012-04-02 16:13:14	--------	d-----w-	C:\Program Files (x86)\eTax.zug2011nP
2012-03-22 19:12:12	4435968	----a-w-	C:\Windows\SysWow64\GPhotos.scr
.
==================== Find3M  ====================
.
2012-03-19 19:41:14	414368	----a-w-	C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-28 06:56:48	2311168	----a-w-	C:\Windows\System32\jscript9.dll
2012-02-28 06:49:56	1390080	----a-w-	C:\Windows\System32\wininet.dll
2012-02-28 06:48:57	1493504	----a-w-	C:\Windows\System32\inetcpl.cpl
2012-02-28 06:42:55	2382848	----a-w-	C:\Windows\System32\mshtml.tlb
2012-02-28 01:18:55	1799168	----a-w-	C:\Windows\SysWow64\jscript9.dll
2012-02-28 01:11:21	1427456	----a-w-	C:\Windows\SysWow64\inetcpl.cpl
2012-02-28 01:11:07	1127424	----a-w-	C:\Windows\SysWow64\wininet.dll
2012-02-28 01:03:16	2382848	----a-w-	C:\Windows\SysWow64\mshtml.tlb
2012-02-23 08:18:36	279656	------w-	C:\Windows\System32\MpSigStub.exe
2012-02-17 06:38:26	1031680	----a-w-	C:\Windows\System32\rdpcore.dll
2012-02-17 05:34:22	826880	----a-w-	C:\Windows\SysWow64\rdpcore.dll
2012-02-17 04:58:24	210944	----a-w-	C:\Windows\System32\drivers\rdpwd.sys
2012-02-17 04:57:32	23552	----a-w-	C:\Windows\System32\drivers\tdtcp.sys
2012-02-10 06:36:07	1544192	----a-w-	C:\Windows\System32\DWrite.dll
2012-02-10 05:38:43	1077248	----a-w-	C:\Windows\SysWow64\DWrite.dll
2012-02-07 09:02:40	1070352	----a-w-	C:\Windows\SysWow64\MSCOMCTL.OCX
2012-02-03 04:34:34	3145728	----a-w-	C:\Windows\System32\win32k.sys
2012-01-25 06:38:39	77312	----a-w-	C:\Windows\System32\rdpwsx.dll
2012-01-25 06:38:38	149504	----a-w-	C:\Windows\System32\rdpcorekmts.dll
2012-01-25 06:33:30	9216	----a-w-	C:\Windows\System32\rdrmemptylst.exe
.
============= FINISH: 21:30:54.22 ===============

[/CODE]
--- --- ---
--- --- ---

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 17.05.2010 21:08:38
System Uptime: 19.04.2012 20:35:35 (1 hours ago)
.
Motherboard: Dell Inc. | | 0M9XW4
Processor: Intel(R) Core(TM) i3 CPU M 330 @ 2.13GHz | U2E1 | 917/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 59 GiB total, 8.104 GiB free.
D: is FIXED (NTFS) - 397 GiB total, 312.726 GiB free.
E: is CDROM (UDF)
F: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}
Description: Photosmart Wireless B109n-z
Device ID: ROOT\MULTIFUNCTION\0000
Manufacturer: HP
Name: Photosmart Wireless B109n-z
PNP Device ID: ROOT\MULTIFUNCTION\0000
Service:
.
Class GUID: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Description: Photosmart Wireless B109n-z
Device ID: ROOT\IMAGE\0000
Manufacturer: HP
Name: Photosmart Wireless B109n-z
PNP Device ID: ROOT\IMAGE\0000
Service: StillCam
.
==== System Restore Points ===================
.
RP321: 16.04.2012 18:25:33 - Windows Update
RP323: 19.04.2012 19:54:12 - Windows Update
.
==== Hosts File Hijack ======================
.
Hosts: 66.197.194.231 Google Analytics Official Website - Web Analytics & Reporting ? Google Analytics.
Hosts: 66.197.194.231 ad-emea.doubleclick.net.
Hosts: 66.197.194.231 StatCounter - Free Invisible Web Tracker, Hit Counter and Web Stats.
Hosts: 69.72.252.254 Google Analytics Official Website - Web Analytics & Reporting ? Google Analytics.
Hosts: 69.72.252.254 ad-emea.doubleclick.net.
Hosts: 69.72.252.254 StatCounter - Free Invisible Web Tracker, Hit Counter and Web Stats.
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
Adobe Flash Player 10 Plugin
Adobe Reader 9.4.0
Advanced Audio FX Engine
Apple Application Support
Apple Software Update
ATI Catalyst Control Center
Bing Bar
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-core-static
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
Click to Call with Skype
Compatibility Pack for the 2007 Office system
Dell Webcam Central
eTax.zug 2011 nP 11.0.4
Facebook Video Calling 1.2.0.159
Google Chrome
Google Update Helper
Intel(R) Management Engine Components
Java Auto Updater
Java(TM) 6 Update 24
Junk Mail filter update
Live! Cam Avatar Creator
Manor Service Foto
Microsoft Choice Guard
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Suite Activation Assistant
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Picasa 3
PowerDVD DX
PS_AIO_06_B109n-z_SW_Min
QuickTime
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
Realtek High Definition Audio Driver
RealUpgrade 1.1
Roxio Burn
Scan
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Skins
Skype™ 5.5
Sonic Riders
Toolbox
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition
Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Zattoo4 4.0.5
ZoneAlarm
.
==== Event Viewer Messages From Past Week ========
.
19.04.2012 20:39:16, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
19.04.2012 20:36:38, Error: Service Control Manager [7000] - The atksgt service failed to start due to the following error: This driver has been blocked from loading
19.04.2012 20:36:38, Error: Application Popup [875] - Driver atksgt.sys has been blocked from loading.
16.04.2012 15:31:02, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x8024002d: Security Update for Microsoft Works 9 (KB2680317).
15.04.2012 19:35:34, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
15.04.2012 19:35:34, Error: Service Control Manager [7001] - The TrueVector Internet Monitor service depends on the Zone Alarm Firewall Driver service which failed to start because of the following error: A device attached to the system is not functioning.
15.04.2012 19:35:34, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
15.04.2012 19:35:34, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
15.04.2012 19:35:34, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
15.04.2012 19:35:34, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
15.04.2012 19:35:34, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
.
==== End Of File ===========================

Psychotic · 20.04.2012, 07:40

Combofix

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Allmendweg · 20.04.2012, 19:46

Hier das ComboFix.txt (ich habe den zonealarm erst kurz nach dem start disabled (ca 30sec)

Combofix Logfile:

Code:

ATTFilter

ComboFix 12-04-20.02 - Catherine 20.04.2012  20:25:47.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.41.1033.18.3957.2395 [GMT 2:00]
ausgeführt von:: c:\users\Catherine\Desktop\ComboFix.exe
FW: ZoneAlarm Firewall *Enabled* {D17DF357-CFF5-F001-D1C1-FCD21DFE3D5E}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\security\Database\tmp.edb
c:\windows\system32\jucheck.exe
c:\windows\system32\jusched.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-03-20 bis 2012-04-20  ))))))))))))))))))))))))))))))
.
.
2012-04-20 18:31 . 2012-04-20 18:31	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-04-19 18:16 . 2012-04-19 18:34	--------	d-----w-	c:\programdata\B7E8586B006A51DD033B2F1DB4EB2367
2012-04-19 18:15 . 2012-03-14 03:27	8669240	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{FEC34572-170A-48C5-B03E-D85EDB03B001}\mpengine.dll
2012-04-16 07:01 . 2012-04-16 08:13	--------	d-----w-	C:\FRST
2012-04-12 18:37 . 2012-03-01 06:46	23408	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-04-12 18:37 . 2012-03-01 06:33	81408	----a-w-	c:\windows\system32\imagehlp.dll
2012-04-12 18:37 . 2012-03-01 05:33	159232	----a-w-	c:\windows\SysWow64\imagehlp.dll
2012-04-12 18:37 . 2012-03-01 06:38	220672	----a-w-	c:\windows\system32\wintrust.dll
2012-04-12 18:37 . 2012-03-01 06:28	5120	----a-w-	c:\windows\system32\wmi.dll
2012-04-12 18:37 . 2012-03-01 05:37	172544	----a-w-	c:\windows\SysWow64\wintrust.dll
2012-04-12 18:37 . 2012-03-01 05:29	5120	----a-w-	c:\windows\SysWow64\wmi.dll
2012-04-02 16:13 . 2012-04-02 16:13	--------	d-----w-	c:\users\Catherine\AppData\Roaming\Information Factory
2012-04-02 16:13 . 2012-04-02 16:13	--------	d-----w-	c:\users\Catherine\AppData\Local\Information Factory
2012-04-02 16:13 . 2012-04-02 16:13	--------	d-----w-	c:\program files (x86)\eTax.zug2011nP
2012-03-22 19:12 . 2012-03-22 19:12	4435968	----a-w-	c:\windows\SysWow64\GPhotos.scr
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-19 19:41 . 2011-12-08 18:58	414368	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-03-09 02:03 . 2012-03-09 02:03	91648	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2012-03-09 02:03 . 2012-03-09 02:03	89088	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2012-03-09 02:03 . 2012-03-09 02:03	86528	----a-w-	c:\windows\SysWow64\iesysprep.dll
2012-03-09 02:03 . 2012-03-09 02:03	85504	----a-w-	c:\windows\system32\iesetup.dll
2012-03-09 02:03 . 2012-03-09 02:03	76800	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2012-03-09 02:03 . 2012-03-09 02:03	76800	----a-w-	c:\windows\system32\tdc.ocx
2012-03-09 02:03 . 2012-03-09 02:03	74752	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-03-09 02:03 . 2012-03-09 02:03	74752	----a-w-	c:\windows\SysWow64\iesetup.dll
2012-03-09 02:03 . 2012-03-09 02:03	63488	----a-w-	c:\windows\SysWow64\tdc.ocx
2012-03-09 02:03 . 2012-03-09 02:03	49664	----a-w-	c:\windows\system32\imgutil.dll
2012-03-09 02:03 . 2012-03-09 02:03	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2012-03-09 02:03 . 2012-03-09 02:03	48640	----a-w-	c:\windows\system32\mshtmler.dll
2012-03-09 02:03 . 2012-03-09 02:03	448512	----a-w-	c:\windows\system32\html.iec
2012-03-09 02:03 . 2012-03-09 02:03	420864	----a-w-	c:\windows\SysWow64\vbscript.dll
2012-03-09 02:03 . 2012-03-09 02:03	367104	----a-w-	c:\windows\SysWow64\html.iec
2012-03-09 02:03 . 2012-03-09 02:03	35840	----a-w-	c:\windows\SysWow64\imgutil.dll
2012-03-09 02:03 . 2012-03-09 02:03	30720	----a-w-	c:\windows\system32\licmgr10.dll
2012-03-09 02:03 . 2012-03-09 02:03	23552	----a-w-	c:\windows\SysWow64\licmgr10.dll
2012-03-09 02:03 . 2012-03-09 02:03	222208	----a-w-	c:\windows\system32\msls31.dll
2012-03-09 02:03 . 2012-03-09 02:03	173056	----a-w-	c:\windows\system32\ieUnatt.exe
2012-03-09 02:03 . 2012-03-09 02:03	161792	----a-w-	c:\windows\SysWow64\msls31.dll
2012-03-09 02:03 . 2012-03-09 02:03	152064	----a-w-	c:\windows\SysWow64\wextract.exe
2012-03-09 02:03 . 2012-03-09 02:03	150528	----a-w-	c:\windows\SysWow64\iexpress.exe
2012-03-09 02:03 . 2012-03-09 02:03	142848	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2012-03-09 02:03 . 2012-03-09 02:03	135168	----a-w-	c:\windows\system32\IEAdvpack.dll
2012-03-09 02:03 . 2012-03-09 02:03	12288	----a-w-	c:\windows\system32\mshta.exe
2012-03-09 02:03 . 2012-03-09 02:03	11776	----a-w-	c:\windows\SysWow64\mshta.exe
2012-03-09 02:03 . 2012-03-09 02:03	114176	----a-w-	c:\windows\system32\admparse.dll
2012-03-09 02:03 . 2012-03-09 02:03	111616	----a-w-	c:\windows\system32\iesysprep.dll
2012-03-09 02:03 . 2012-03-09 02:03	110592	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2012-03-09 02:03 . 2012-03-09 02:03	101888	----a-w-	c:\windows\SysWow64\admparse.dll
2012-03-09 02:03 . 2012-03-09 02:03	603648	----a-w-	c:\windows\system32\vbscript.dll
2012-03-09 02:03 . 2012-03-09 02:03	165888	----a-w-	c:\windows\system32\iexpress.exe
2012-03-09 02:03 . 2012-03-09 02:03	160256	----a-w-	c:\windows\system32\wextract.exe
2012-02-23 08:18 . 2010-06-19 07:25	279656	------w-	c:\windows\system32\MpSigStub.exe
2012-02-17 06:38 . 2012-03-14 08:34	1031680	----a-w-	c:\windows\system32\rdpcore.dll
2012-02-17 05:34 . 2012-03-14 08:34	826880	----a-w-	c:\windows\SysWow64\rdpcore.dll
2012-02-17 04:58 . 2012-03-14 08:34	210944	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-02-17 04:57 . 2012-03-14 08:34	23552	----a-w-	c:\windows\system32\drivers\tdtcp.sys
2012-02-10 06:36 . 2012-03-14 08:35	1544192	----a-w-	c:\windows\system32\DWrite.dll
2012-02-10 05:38 . 2012-03-14 08:35	1077248	----a-w-	c:\windows\SysWow64\DWrite.dll
2012-02-07 09:02 . 2012-02-07 09:02	1070352	----a-w-	c:\windows\SysWow64\MSCOMCTL.OCX
2012-02-03 04:34 . 2012-03-14 08:35	3145728	----a-w-	c:\windows\system32\win32k.sys
2012-01-25 06:38 . 2012-03-14 08:34	77312	----a-w-	c:\windows\system32\rdpwsx.dll
2012-01-25 06:38 . 2012-03-14 08:34	149504	----a-w-	c:\windows\system32\rdpcorekmts.dll
2012-01-25 06:33 . 2012-03-14 08:34	9216	----a-w-	c:\windows\system32\rdrmemptylst.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}"= "c:\program files (x86)\ZoneAlarm-Sicherheit\tbZone.dll" [2010-05-09 2517088]
.
[HKEY_CLASSES_ROOT\clsid\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}]
2010-05-09 09:50	2517088	----a-w-	c:\program files (x86)\ZoneAlarm-Sicherheit\tbZone.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}"= "c:\program files (x86)\ZoneAlarm-Sicherheit\tbZone.dll" [2010-05-09 2517088]
.
[HKEY_CLASSES_ROOT\clsid\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"="c:\users\Catherine\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2011-12-22 137536]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-09 98304]
"PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-12-29 140520]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]
"ZoneAlarm Client"="c:\program files (x86)\Zone Labs\ZoneAlarm\zlclient.exe" [2010-06-28 1043968]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-11-02 59240]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2011-12-03 296056]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-12-08 421736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R2 gupdate;Google Update-Dienst (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-10 136176]
R3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-10 136176]
R3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\DRIVERS\lvpopf64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]
R3 LVUVC64;QuickCam for Notebooks Deluxe(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-10-09 92160]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176]
S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648]
S2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2010-06-15 33528]
S2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [2010-06-15 823288]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2320920]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2012-04-20 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2322101068-2709546269-100987538-1001Core.job
- c:\users\Catherine\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-22 10:18]
.
2012-04-20 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2322101068-2709546269-100987538-1001UA.job
- c:\users\Catherine\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-22 10:18]
.
2012-04-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-10 14:16]
.
2012-04-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-10 14:16]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-09-16 357376]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-09 8158240]
"QuickSet"="c:\program files\Dell\QuickSet\QuickSet.exe" [2009-10-01 3189016]
"Broadcom Wireless Manager UI"="c:\program files\Dell\Dell Wireless WLAN Card\WLTRAY.exe" [2009-07-17 4968960]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2010-06-15 1123320]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 2327952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://tagesanzeiger.ch/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
Toolbar-Locked - (no file)
WebBrowser-{FC2B76FC-2132-4D80-A9A3-1F5C6E49066B} - (no file)
AddRemove-Manor Service Foto - c:\program files (x86)\Manor\Manor Service Foto\uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11g_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11g_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-04-20  20:37:36 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-04-20 18:37
.
Vor Suchlauf: 8'984'694'784 bytes free
Nach Suchlauf: 10'008'682'496 bytes free
.
- - End Of File - - 99107F6B09A3B0AA838C851492B347CB

--- --- ---

Psychotic · 21.04.2012, 18:23

Schritt 1: MBAM

Downloade Dir bitte Malwarebytes

Installiere das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
Wenn das Update beendet wurde, aktiviere Quick-Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Schritt 2: ESET

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Allmendweg · 21.04.2012, 19:45

Schritt1 ausgeführt, unten das log file.
Ich habe wohl immer noch 'Emulatoren' via defogger deaktiviert, richtig? Und ich gehe auf einem anderen computer in den Internet Explerer, da ich annehme, dies ist immer noch notwendig. Auch habe ich keinen Fix butten gedrückt (z.b. beim aswMBR)
Die Desktopikons sind noch nicht zurück.

Malwarebytes Anti-Malware 1.61.0.1400
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Database version: v2012.04.21.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Catherine :: CATHERINE-PC [administrator]

21.04.2012 20:30:53
mbam-log-2012-04-21 (20-30-53).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 203996
Time elapsed: 2 minute(s), 20 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\Catherine\Desktop\DownloadSetup_(26).exe (Affiliate.Downloader) -> Quarantined and deleted successfully.

(end)

Frage zu Schritt 2: wie öffne ich den IE als Administrator?

Psychotic · 22.04.2012, 10:13

per Rechtsklick-->als Administrator ausführen!

Allmendweg · 22.04.2012, 12:26

Schritt 2 auch ausgeführt, hier das ESET.txt

C:\FRST\Quarantine\bstr55uhjzd.exe Win32/LockScreen.AKG trojan
C:\Users\Catherine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\FLDNS5FI\promorewardcenter_com[1].htm HTML/Fraud.BG trojan
C:\Users\Catherine\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\465c2a43-179266ea multiple threats
C:\Users\Catherine\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\2b4e3cbb-267931fb Java/Exploit.Agent.NBB trojan

Psychotic · 23.04.2012, 08:13

Schritt 1: unhide

Downloade bitte Grinler's unhide.exe auf deinem Desktop Starte das Tool mit Doppelklick. Wenn es seine Arbeit getan hat, wir eine Nachricht mit Done aufpoppen. Es wird auch eine Logfile, Unhide.txt erstellen. Poste diese bitte hier.

Schritt 2: CF-Script

Hinweis für Mitleser:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von einem der folgenden Download-Spiegel neu herunter:

BleepingComputer.com - ForoSpyware.com

und speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!

Drücke die Windows + R Taste --> Notepad (hinein schreiben) --> OK

Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.

Code:

ATTFilter

CLEARJAVACACHE::
FILE::
C:\Users\Catherine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\FLDNS5FI\promorewardcenter_com[1].htm

Speichere dies als CFScript.txt auf Deinem Desktop.

Wichtig:

Stelle deine Anti Viren Software temprär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
Danach wieder anstellen nicht vergessen!
Bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein.
Dies kann dazu führen, dass ComboFix sich aufhängt.
Schließe alle laufenden Programme. Gehe sicher das ComboFix ungehindert arbeiten kann.
Mache nichts am PC solange ComboFix läuft.

In Bezug auf obiges Bild, ziehe CFScript.txt in die ComboFix.exe
Wenn ComboFix fertig ist, wird es ein Log erstellen, C:\ComboFix.txt. Bitte füge es hier als Antwort ein.

Falls im Skript die Anweisung Suspect:: oder Collect:: enthalten ist, wird eine Message-Box erscheinen, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen.

Macht der Rechner noch Probleme?

19.04.2012, 19:40	#7
Psychotic /// Malwareteam	Fehlermeldung beim Starten: "Bitte warten Sie während die Verbindung hergestellt wird". Führe bitte auch die anderen Schritte aus! __________________ Kein Asylrecht für Trojaner! Proud Member of UNITE Hinweis: Ich bin nur werktags erreichbar! Anfragen über PM werden ignoriert! Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board!

22.04.2012, 10:13	#13
Psychotic /// Malwareteam	Fehlermeldung beim Starten: "Bitte warten Sie während die Verbindung hergestellt wird". per Rechtsklick-->als Administrator ausführen! __________________ Kein Asylrecht für Trojaner! Proud Member of UNITE Hinweis: Ich bin nur werktags erreichbar! Anfragen über PM werden ignoriert! Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board!

Fehlermeldung beim Starten: "Bitte warten Sie während die Verbindung hergestellt wird".

Log-Analyse und Auswertung: Fehlermeldung beim Starten: "Bitte warten Sie während die Verbindung hergestellt wird".