Hallo, nachdem ich das Forum durchforstet und einige Beiträge zu ähnlichen Problemen gefunden habe, hoffe ich, dass Ihr es auch in diesem Fall schafft, den Schädling zu besiegen.

Problem:
Links aus Google oder Bing führen unabhängig vom verwendeten Browser (IE, Chrome) auf falsche Seiten. Links auf anderen Seiten funktionieren fehlerfrei.

Als ich die Anleitung "Was muß ich vor meinem ersten Thema beachten?" durchgearbeitet habe, habe ich auch festgestellt, dass sich das Windows Sicherheitscenter nicht aktivieren lässt.

Bei der Abarbeitung der Anleitung hat es dann auch Probleme gegeben:
- defogger: ok
- OTL: ok -> files siehe unten
- GMER: Absturz -> siehe Screenshot, vielleicht kann man trotzdem was erkennen

Danach habe ich Malewarebytes installiert und die zwei Funde nach Anleitung entfernt -> Report siehe unten.

Danach habe ich nochmal GMER gestartet, aber auch dieses mal wieder mit Absturz -> siehe Screenshot.

Ein bereits vorher (19.12.) durchgeführter AVIRA-Komplettscan zeigte keinen Befund.

Hier die Dateien:

OTL.txt

OTL logfile created on: 26.12.2012 22:38:28 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Martin\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19393)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 1,70 Gb Available Physical Memory | 56,82% Memory free
6,19 Gb Paging File | 4,77 Gb Available in Paging File | 77,16% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 288,09 Gb Total Space | 204,44 Gb Free Space | 70,97% Space Free | Partition Type: NTFS
Drive D: | 9,00 Gb Total Space | 1,65 Gb Free Space | 18,30% Space Free | Partition Type: NTFS
Drive F: | 1021,00 Mb Total Space | 1018,74 Mb Free Space | 99,78% Space Free | Partition Type: FAT32
 
Computer Name: MARTIN_LAPTOP | User Name: Martin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.12.26 22:14:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Martin\Desktop\OTL.exe
PRC - [2012.12.05 02:15:17 | 001,242,728 | ---- | M] (Google Inc.) -- C:\Programme\Google\Chrome\Application\chrome.exe
PRC - [2012.11.22 23:51:02 | 000,058,288 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\rpcnet.exe
PRC - [2012.11.22 09:45:42 | 001,461,896 | ---- | M] (1und1 Mail und Media GmbH) -- C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe
PRC - [2012.08.08 22:06:20 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.08 21:37:01 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 21:36:59 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 21:36:59 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.04.04 06:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.11.07 09:52:55 | 000,060,688 | ---- | M] (ZTE) -- C:\Programme\congstar\Internet-Manager\Bin\mcserver.exe
PRC - [2011.11.07 09:52:29 | 000,220,944 | ---- | M] () -- C:\Programme\congstar\Internet-Manager\Bin\dbus-daemon.exe
PRC - [2011.11.07 09:52:00 | 000,036,624 | ---- | M] () -- C:\Programme\congstar\Internet-Manager\Bin\db_daemon.exe
PRC - [2011.08.06 02:14:36 | 000,207,360 | ---- | M] (Iomega Corp) -- C:\Programme\Iomega Storage Manager\pCloudd.exe
PRC - [2011.08.06 02:12:34 | 002,158,160 | ---- | M] (EMC) -- C:\Programme\Iomega Storage Manager\IomegaStorageManager.exe
PRC - [2011.01.17 17:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.exe
PRC - [2011.01.17 17:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.bin
PRC - [2009.08.03 17:53:23 | 000,249,856 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Programme\Huawei Modems\DataCardMonitor.exe
PRC - [2009.04.11 07:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.04.11 07:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2009.02.19 23:13:39 | 002,641,920 | ---- | M] (pdfforge  hxxp://www.pdfforge.org/) -- C:\Programme\PDFCreator\PDFCreator.exe
PRC - [2008.05.21 01:47:18 | 000,065,296 | ---- | M] (Bioscrypt Inc.) -- c:\Programme\Hewlett-Packard\IAM\Bin\asghost.exe
PRC - [2008.05.14 21:41:38 | 000,034,184 | ---- | M] (Hewlett-Packard Development Company, L.P) -- c:\Programme\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe
PRC - [2008.05.14 01:35:40 | 000,256,512 | ---- | M] (SafeBoot International) -- c:\Programme\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
PRC - [2008.05.12 14:28:12 | 000,576,024 | ---- | M] (PDF Complete Inc) -- C:\Programme\PDF Complete\pdfsvc.exe
PRC - [2008.05.08 01:34:10 | 000,238,984 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Programme\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
PRC - [2008.05.02 21:17:44 | 000,077,824 | ---- | M] (Hewlett-Packard) -- C:\Programme\Hewlett-Packard\File Sanitizer\HPFSService.exe
PRC - [2008.05.02 21:17:02 | 010,244,096 | ---- | M] (Hewlett-Packard) -- C:\Programme\Hewlett-Packard\File Sanitizer\CoreShredder.exe
PRC - [2008.04.22 16:42:24 | 001,470,464 | ---- | M] (UASSOFT.COM) -- C:\Programme\Multimedia Mouse Driver\V5\KMConfig.exe
PRC - [2008.04.18 14:54:02 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2008.04.18 14:53:58 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2008.03.31 22:41:22 | 000,091,440 | ---- | M] ( Hewlett-Packard Development Company, L.P.) -- C:\Programme\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
PRC - [2008.01.21 03:35:20 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.21 03:35:20 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2008.01.21 03:33:22 | 000,318,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cmd.exe
PRC - [2008.01.21 03:32:50 | 000,215,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\WindowsMobile\wmdSync.exe
PRC - [2007.12.11 13:15:04 | 000,012,800 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe
PRC - [2007.10.19 08:28:24 | 000,086,016 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AEADISRV.EXE
PRC - [2007.09.25 22:18:54 | 000,561,152 | ---- | M] (UASSOFT.COM) -- C:\Programme\Multimedia Mouse Driver\V5\KMProcess.exe
PRC - [2007.07.16 10:04:44 | 001,616,424 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\BTStackServer.exe
PRC - [2007.07.16 10:04:40 | 000,727,592 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2007.05.16 00:08:40 | 000,182,576 | ---- | M] (ActivIdentity) -- c:\Programme\ActivIdentity\ActivClient\accoca.exe
PRC - [2007.05.16 00:08:38 | 000,095,024 | ---- | M] (ActivIdentity) -- c:\Programme\ActivIdentity\ActivClient\acevents.exe
PRC - [2007.05.16 00:08:08 | 000,293,168 | ---- | M] (ActivIdentity) -- C:\Programme\ActivIdentity\ActivClient\accrdsub.exe
PRC - [2007.03.06 13:51:14 | 000,212,992 | ---- | M] (UASSOFT.COM) -- C:\Programme\Multimedia Mouse Driver\V5\StartAutorun.exe
PRC - [2007.01.05 03:48:52 | 000,112,152 | R--- | M] (InterVideo) -- C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe
PRC - [2006.03.02 15:48:42 | 000,217,088 | ---- | M] (CASIO COMPUTER CO.,LTD.) -- C:\Programme\CASIO\Photo Loader\Plauto.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.12.05 02:15:15 | 000,460,904 | ---- | M] () -- C:\Programme\Google\Chrome\Application\23.0.1271.97\ppgooglenaclpluginchrome.dll
MOD - [2012.12.05 02:15:14 | 004,008,040 | ---- | M] () -- C:\Programme\Google\Chrome\Application\23.0.1271.97\pdf.dll
MOD - [2012.12.05 02:14:29 | 000,587,880 | ---- | M] () -- C:\Programme\Google\Chrome\Application\23.0.1271.97\libglesv2.dll
MOD - [2012.12.05 02:14:28 | 000,124,520 | ---- | M] () -- C:\Programme\Google\Chrome\Application\23.0.1271.97\libegl.dll
MOD - [2012.12.05 02:14:21 | 000,157,304 | ---- | M] () -- C:\Programme\Google\Chrome\Application\23.0.1271.97\avutil-51.dll
MOD - [2012.12.05 02:14:20 | 000,275,576 | ---- | M] () -- C:\Programme\Google\Chrome\Application\23.0.1271.97\avformat-54.dll
MOD - [2012.12.05 02:14:19 | 002,168,952 | ---- | M] () -- C:\Programme\Google\Chrome\Application\23.0.1271.97\avcodec-54.dll
MOD - [2012.11.16 20:20:50 | 011,820,032 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\ac05afefb5b28893d44ec451da0e6d4e\System.Web.ni.dll
MOD - [2012.11.16 20:20:42 | 000,771,584 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\2633dbf77be293b3a8693b6b062fd787\System.Runtime.Remoting.ni.dll
MOD - [2012.11.16 20:20:23 | 000,025,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\79f3661da2402c72b0bba0de1e55f4d1\Accessibility.ni.dll
MOD - [2012.11.16 20:18:58 | 005,450,752 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\741164a3e36f879b9f9e3ff176465127\System.Xml.ni.dll
MOD - [2012.11.16 20:18:41 | 012,433,920 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\22e554f2c4da53c07e4815a24e2d50e2\System.Windows.Forms.ni.dll
MOD - [2012.11.16 20:18:31 | 001,592,320 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2c6cd37f29fc76d6c2ed6bbed202d82c\System.Drawing.ni.dll
MOD - [2012.11.16 20:17:32 | 007,976,960 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\b2052acbbbba4f98585196872195e009\System.ni.dll
MOD - [2012.11.16 20:17:21 | 011,492,352 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7ad9c44df3b85848590e63f13fc59804\mscorlib.ni.dll
MOD - [2011.11.07 09:52:29 | 000,220,944 | ---- | M] () -- C:\Programme\congstar\Internet-Manager\Bin\dbus-daemon.exe
MOD - [2011.11.07 09:52:00 | 000,036,624 | ---- | M] () -- C:\Programme\congstar\Internet-Manager\Bin\db_daemon.exe
MOD - [2011.11.07 09:43:33 | 000,020,992 | ---- | M] () -- C:\Programme\congstar\Internet-Manager\Bin\libctlsvr.dll
MOD - [2011.11.07 09:39:08 | 000,099,328 | ---- | M] () -- C:\Programme\congstar\Internet-Manager\Bin\itapi.dll
MOD - [2011.11.07 09:39:01 | 000,043,008 | ---- | M] () -- C:\Programme\congstar\Internet-Manager\Bin\audio.dll
MOD - [2011.11.07 09:38:53 | 000,035,840 | ---- | M] () -- C:\Programme\congstar\Internet-Manager\Bin\libConfig.dll
MOD - [2011.11.07 09:38:51 | 000,055,296 | ---- | M] () -- C:\Programme\congstar\Internet-Manager\Bin\coder.dll
MOD - [2011.11.07 09:38:49 | 000,027,136 | ---- | M] () -- C:\Programme\congstar\Internet-Manager\Bin\log.dll
MOD - [2011.10.25 18:07:24 | 000,985,088 | ---- | M] () -- C:\Programme\OpenOffice.org 3\program\libxml2.dll
MOD - [2011.08.06 02:14:40 | 006,302,208 | ---- | M] () -- C:\Programme\Iomega Storage Manager\wxmsw28u_vc_custom.dll
MOD - [2011.05.06 04:03:32 | 000,594,944 | ---- | M] () -- C:\Programme\congstar\Internet-Manager\Bin\dbus-1.dll
MOD - [2011.05.06 04:02:40 | 000,341,504 | ---- | M] () -- C:\Programme\congstar\Internet-Manager\Bin\sqlite3.dll
MOD - [2010.10.14 10:37:52 | 000,971,776 | ---- | M] () -- C:\Programme\congstar\Internet-Manager\Bin\libxml2.dll
MOD - [2010.10.14 10:37:52 | 000,080,688 | ---- | M] () -- C:\Programme\congstar\Internet-Manager\Bin\zlib1.dll
MOD - [2009.03.30 05:42:12 | 000,434,176 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2009.03.30 05:42:12 | 000,212,992 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
MOD - [2009.03.30 05:42:12 | 000,167,936 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Xml.resources\2.0.0.0_de_b77a5c561934e089\System.Xml.resources.dll
MOD - [2009.03.30 05:42:11 | 000,315,392 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.01.15 17:20:11 | 001,679,360 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.3050.37261__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll
MOD - [2009.01.15 17:20:11 | 000,253,952 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3050.37221__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2009.01.15 17:20:11 | 000,196,608 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3050.37274__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2009.01.15 17:20:11 | 000,077,824 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3050.37446__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
MOD - [2009.01.15 17:20:11 | 000,065,536 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3050.37411__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
MOD - [2009.01.15 17:20:11 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3050.37253__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2009.01.15 17:20:11 | 000,036,864 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3050.37370__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
MOD - [2009.01.15 17:20:11 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3050.37240__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2009.01.15 17:20:10 | 000,483,328 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3050.37475__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
MOD - [2009.01.15 17:19:50 | 000,352,256 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3050.37419__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll
MOD - [2009.01.15 17:19:50 | 000,135,168 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3050.37482__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
MOD - [2009.01.15 17:19:50 | 000,090,112 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3050.37425__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
MOD - [2009.01.15 17:19:50 | 000,073,728 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3050.37234__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
MOD - [2009.01.15 17:19:49 | 000,147,456 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard\2.0.3050.37474__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard.dll
MOD - [2009.01.15 17:19:49 | 000,061,440 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3050.37418__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll
MOD - [2009.01.15 17:19:49 | 000,045,056 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.3050.37474__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.dll
MOD - [2009.01.15 17:19:48 | 000,802,816 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3050.37378__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll
MOD - [2009.01.15 17:19:48 | 000,585,728 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3050.37287__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll
MOD - [2009.01.15 17:19:48 | 000,438,272 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.3050.37241__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll
MOD - [2009.01.15 17:19:48 | 000,401,408 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3050.37438__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll
MOD - [2009.01.15 17:19:48 | 000,307,200 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Wizard\2.0.3050.37293__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Wizard.dll
MOD - [2009.01.15 17:19:48 | 000,217,088 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3050.37281__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
MOD - [2009.01.15 17:19:48 | 000,118,784 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3050.37393__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll
MOD - [2009.01.15 17:19:48 | 000,073,728 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3050.37378__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll
MOD - [2009.01.15 17:19:48 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3050.37292__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll
MOD - [2009.01.15 17:19:48 | 000,036,864 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3050.37392__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll
MOD - [2009.01.15 17:19:47 | 000,479,232 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3050.37372__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
MOD - [2009.01.15 17:19:47 | 000,401,408 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Dashboard\2.0.3050.37405__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Dashboard.dll
MOD - [2009.01.15 17:19:47 | 000,061,440 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3050.37371__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
MOD - [2009.01.15 17:19:47 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3050.37377__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
MOD - [2009.01.15 17:19:47 | 000,032,768 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3050.37404__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
MOD - [2009.01.15 17:19:47 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.2939.23687__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2009.01.15 17:19:47 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.2939.23679__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2009.01.15 17:19:47 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.2939.23767__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2009.01.15 17:19:47 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.2939.23710__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll
MOD - [2009.01.15 17:19:47 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.2939.23768__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2009.01.15 17:19:47 | 000,006,656 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll
MOD - [2009.01.15 17:19:46 | 000,065,536 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.2965.22300__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
MOD - [2009.01.15 17:19:46 | 000,053,248 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Foundation\2.0.2939.23668__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2009.01.15 17:19:46 | 000,053,248 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.2939.23689__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2009.01.15 17:19:46 | 000,053,248 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.2939.23743__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
MOD - [2009.01.15 17:19:46 | 000,049,152 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.2939.23740__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll
MOD - [2009.01.15 17:19:46 | 000,045,056 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2009.01.15 17:19:46 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.2939.23764__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
MOD - [2009.01.15 17:19:46 | 000,032,768 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\LOG.Foundation\2.0.2939.23662__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2009.01.15 17:19:46 | 000,032,768 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.2939.23708__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
MOD - [2009.01.15 17:19:46 | 000,028,672 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.2939.23802__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2009.01.15 17:19:46 | 000,028,672 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.2939.23763__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.dll
MOD - [2009.01.15 17:19:46 | 000,028,672 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.2939.23735__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll
MOD - [2009.01.15 17:19:46 | 000,028,672 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.2939.23719__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
MOD - [2009.01.15 17:19:46 | 000,024,576 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.2939.23667__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2009.01.15 17:19:46 | 000,024,576 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.2939.23741__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll
MOD - [2009.01.15 17:19:46 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.2939.23717__90ba9c70f846762e\DEM.OS.I0602.dll
MOD - [2009.01.15 17:19:46 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.2939.23693__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2009.01.15 17:19:46 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.2939.23687__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2009.01.15 17:19:46 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.2939.23679__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2009.01.15 17:19:46 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.2939.23719__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2009.01.15 17:19:46 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\MOM.Foundation\2.0.2939.23707__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2009.01.15 17:19:46 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\DEM.OS\2.0.2939.23717__90ba9c70f846762e\DEM.OS.dll
MOD - [2009.01.15 17:19:46 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll
MOD - [2009.01.15 17:19:46 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\DEM.Graphics\2.0.2939.23718__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2009.01.15 17:19:46 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2009.01.15 17:19:46 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.2939.23688__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2009.01.15 17:19:46 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.2939.23734__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2009.01.15 17:19:46 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.2939.23718__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
MOD - [2009.01.15 17:19:45 | 000,053,248 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.2939.23739__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll
MOD - [2009.01.15 17:19:45 | 000,045,056 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.2939.23738__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
MOD - [2009.01.15 17:19:45 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.2939.23742__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
MOD - [2009.01.15 17:19:45 | 000,024,576 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.2939.23711__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
MOD - [2009.01.15 17:19:45 | 000,024,576 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Foundation\2.0.2939.23665__90ba9c70f846762e\AEM.Foundation.dll
MOD - [2009.01.15 17:19:45 | 000,024,576 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll
MOD - [2009.01.15 17:19:45 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\APM.Foundation\2.0.2939.23709__90ba9c70f846762e\APM.Foundation.dll
MOD - [2009.01.15 17:19:45 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.2939.23687__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2009.01.15 17:19:35 | 000,102,400 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3050.37467__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2009.01.15 17:19:35 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3050.37493__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2009.01.15 17:19:35 | 000,032,768 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.2939.23679__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2009.01.15 17:19:35 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.2939.23677__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll
MOD - [2009.01.15 17:19:35 | 000,006,656 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3050.37214__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll
MOD - [2009.01.15 17:19:34 | 001,511,424 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3050.37228__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2009.01.15 17:19:34 | 000,491,520 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3050.37248__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2009.01.15 17:19:34 | 000,073,728 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3050.37214__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2009.01.15 17:19:34 | 000,061,440 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3050.37466__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2009.01.15 17:19:34 | 000,045,056 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.2939.23713__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2009.01.15 17:19:34 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.2939.23678__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2009.01.15 17:19:34 | 000,024,576 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.2939.23694__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2009.01.15 17:19:34 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.2939.23712__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2009.01.15 17:19:34 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.2939.23711__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2009.01.15 17:19:33 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.2939.23689__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2009.01.15 17:19:33 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.2939.23746__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
MOD - [2009.01.15 17:19:32 | 000,065,536 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\ATIDEMOS\2.0.3050.37215__90ba9c70f846762e\ATIDEMOS.dll
MOD - [2009.01.15 17:19:32 | 000,053,248 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\APM.Server\2.0.3050.37213__90ba9c70f846762e\APM.Server.dll
MOD - [2009.01.15 17:19:32 | 000,045,056 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Server\2.0.3050.37213__90ba9c70f846762e\AEM.Server.dll
MOD - [2009.01.15 17:19:32 | 000,032,768 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3050.37467__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2009.01.15 17:19:32 | 000,032,768 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2008.05.08 10:14:24 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll
MOD - [2007.11.28 18:59:42 | 003,702,784 | ---- | M] () -- C:\Programme\PDFCreator\GS8.61\gs8.61\Bin\gsdll32.dll
MOD - [2007.09.09 16:07:00 | 000,151,552 | ---- | M] () -- C:\Programme\congstar\Internet-Manager\Bin\libexpat.dll
MOD - [2007.08.14 21:59:54 | 006,365,184 | ---- | M] () -- C:\Programme\Common Files\LightScribe\QtGui4.dll
MOD - [2007.08.05 21:53:32 | 000,053,248 | ---- | M] () -- C:\Programme\Multimedia Mouse Driver\V5\MouseHook.dll
MOD - [2007.08.05 20:31:02 | 000,114,688 | ---- | M] () -- C:\Programme\Multimedia Mouse Driver\V5\keydll.dll
MOD - [2007.07.12 21:55:52 | 000,131,072 | ---- | M] () -- C:\Programme\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
MOD - [2007.07.12 21:55:28 | 001,581,056 | ---- | M] () -- C:\Programme\Common Files\LightScribe\QtCore4.dll
MOD - [2007.07.12 15:53:32 | 000,126,976 | ---- | M] () -- C:\Programme\WIDCOMM\Bluetooth Software\BTKeyInd.dll
MOD - [2007.07.12 15:41:36 | 000,389,120 | ---- | M] () -- C:\Windows\System32\btwhidcs.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2012.12.12 20:21:10 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.11.22 23:51:02 | 000,058,288 | ---- | M] (Absolute Software Corp.) [Auto | Running] -- C:\Windows\System32\rpcnet.exe -- (rpcnet)
SRV - [2012.05.08 21:37:01 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 21:36:59 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.04 06:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.08.06 02:14:36 | 000,207,360 | ---- | M] (Iomega Corp) [Auto | Running] -- C:\Programme\Iomega Storage Manager\pCloudd.exe -- (PCloudd)
SRV - [2008.05.21 01:42:40 | 000,111,888 | ---- | M] (Bioscrypt Inc.) [Auto | Running] -- c:\Programme\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll -- (ASBroker)
SRV - [2008.05.21 01:42:34 | 000,137,488 | ---- | M] (Bioscrypt Inc.) [Auto | Running] -- c:\Programme\Hewlett-Packard\IAM\Bin\ASChnl.dll -- (ASChannel)
SRV - [2008.05.14 21:41:38 | 000,034,184 | ---- | M] (Hewlett-Packard Development Company, L.P) [Auto | Running] -- c:\Programme\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe -- (HP ProtectTools Service)
SRV - [2008.05.14 01:35:40 | 000,256,512 | ---- | M] (SafeBoot International) [Auto | Running] -- c:\Programme\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe -- (HpFkCryptService)
SRV - [2008.05.12 14:28:12 | 000,576,024 | ---- | M] (PDF Complete Inc) [Auto | Running] -- C:\Program Files\PDF Complete\pdfsvc.exe -- (pdfcDispatcher)
SRV - [2008.05.02 21:17:44 | 000,077,824 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Programme\Hewlett-Packard\File Sanitizer\HPFSService.exe -- (HPFSService)
SRV - [2008.04.18 14:54:02 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON)
SRV - [2008.04.08 13:12:50 | 001,112,560 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- c:\Programme\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe -- (RoxMediaDB10)
SRV - [2008.01.21 03:35:20 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.21 03:33:00 | 000,272,952 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.21 03:32:50 | 000,365,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2008.01.21 03:32:50 | 000,167,936 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2007.12.11 13:15:04 | 000,012,800 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2007.10.19 08:28:24 | 000,086,016 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AEADISRV.EXE -- (AEADIFilters)
SRV - [2007.05.16 00:08:40 | 000,182,576 | ---- | M] (ActivIdentity) [Auto | Running] -- c:\Programme\ActivIdentity\ActivClient\accoca.exe -- (accoca)
SRV - [2007.01.05 03:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto | Running] -- C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\PCASp50.sys -- (PCASp50)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - [2012.05.08 21:37:01 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 21:37:01 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.12.15 15:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.08.19 11:25:25 | 000,106,880 | ---- | M] (HSPADataCard Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\HSPADataCardusbser.sys -- (HSPADataCardusbser)
DRV - [2011.08.19 11:25:25 | 000,106,880 | ---- | M] (HSPADataCard Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\HSPADataCardusbnmea.sys -- (HSPADataCardusbnmea)
DRV - [2011.08.19 11:25:25 | 000,106,880 | ---- | M] (HSPADataCard Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\HSPADataCardusbmdm.sys -- (HSPADataCardusbmdm)
DRV - [2011.08.19 11:25:25 | 000,010,240 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\massfilter.sys -- (massfilter)
DRV - [2011.08.06 02:14:36 | 000,017,488 | ---- | M] (Iomega Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vNICdrv.sys -- (vNICdrv)
DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.12.15 03:46:26 | 000,024,192 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\tcpipBM.sys -- (tcpipBM)
DRV - [2009.12.15 03:46:18 | 000,013,184 | ---- | M] (Bytemobile, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\BMLoad.sys -- (BMLoad)
DRV - [2009.04.11 05:45:24 | 000,113,664 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rmcast.sys -- (RMCAST)
DRV - [2009.04.09 12:38:30 | 000,110,592 | ---- | M] (ZTE Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnet.sys -- (ZTEusbnet)
DRV - [2009.04.09 12:38:30 | 000,105,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\zteusbvoice.sys -- (ZTEusbvoice)
DRV - [2009.04.09 12:38:30 | 000,105,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV - [2009.04.09 12:38:30 | 000,104,960 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV - [2009.04.09 12:38:30 | 000,104,960 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV - [2008.05.14 01:36:26 | 000,051,376 | ---- | M] (SafeBoot N.V.) [Kernel | Boot | Running] -- C:\windows\System32\drivers\SbAlg.sys -- (SbAlg)
DRV - [2008.05.14 01:36:22 | 000,012,928 | ---- | M] (SafeBoot International) [File_System | Boot | Running] -- C:\windows\System32\drivers\SbFsLock.sys -- (SbFsLock)
DRV - [2008.05.14 01:36:20 | 000,012,496 | ---- | M] (SafeBoot International) [Kernel | System | Running] -- C:\windows\System32\drivers\rsvlock.sys -- (RsvLock)
DRV - [2008.05.14 01:36:18 | 000,108,752 | ---- | M] () [Kernel | Boot | Running] -- C:\windows\System32\drivers\SafeBoot.sys -- (SafeBoot)
DRV - [2008.05.08 13:01:44 | 003,552,256 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008.04.28 07:29:26 | 003,658,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32)
DRV - [2008.04.14 22:39:06 | 000,009,344 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CPQBttn.sys -- (HBtnKey)
DRV - [2008.04.10 17:27:34 | 001,804,160 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC)
DRV - [2008.04.07 19:13:46 | 000,025,448 | ---- | M] (Hewlett-Packard Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\hpdskflt.sys -- (hpdskflt)
DRV - [2008.04.07 19:13:42 | 000,034,664 | ---- | M] (Hewlett-Packard Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Accelerometer.sys -- (Accelerometer)
DRV - [2008.02.29 17:13:38 | 001,202,560 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2008.01.21 03:32:52 | 000,045,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tpm.sys -- (TPM)
DRV - [2007.06.19 01:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2007.02.01 15:25:30 | 000,158,720 | ---- | M] (Novatel Wireless Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NWADIenum.sys -- (NWADI)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=83&bd=all&pf=cmnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=83&bd=all&pf=cmnb
IE - HKLM\..\URLSearchHook: {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - C:\Programme\Mininova-Vuze\tbMini.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{7BEB5BB0-9006-4C60-AFE6-513BF461728E}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcmnbie7-de-de
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1978305
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=83&bd=all&pf=cmnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - C:\Programme\Mininova-Vuze\tbMini.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{2570EC7A-A142-421E-9058-5BB29E22FFBC}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{31CF9EBE-5755-4a1d-AC25-2834D952D9B4}: "URL" = hxxp://search.pdfcreator-toolbar.org/search?p=Q&ts=ne&w={searchTerms}&csrc=search-field
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ADRA_deDE492
IE - HKCU\..\SearchScopes\{7BEB5BB0-9006-4C60-AFE6-513BF461728E}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcmnbie7-de-de
IE - HKCU\..\SearchScopes\{9C170E9A-1655-4637-94A9-5621333E68D1}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1978305
IE - HKCU\..\SearchScopes\{B066BBC1-5F4C-44D9-A4DA-D7DF0905A37B}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{F6A0A927-9E02-473E-98E3-B52D97CD2EFC}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 192.168.100.1:800
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37: C:\windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files\congstar\Internet-Manager\Bin\addon [2010.04.01 13:29:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.01.11 23:23:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.07.15 21:39:35 | 000,000,000 | ---D | M]
 
[2010.01.11 23:24:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Martin\AppData\Roaming\mozilla\Extensions
[2009.06.24 19:35:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Martin\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2011.10.10 23:55:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Martin\AppData\Roaming\mozilla\Firefox\Profiles\bz1fnq20.default\extensions
[2010.01.12 00:09:20 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Martin\AppData\Roaming\mozilla\Firefox\Profiles\bz1fnq20.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.06.29 06:43:32 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Martin\AppData\Roaming\mozilla\Firefox\Profiles\bz1fnq20.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.11.01 19:20:21 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.10.25 18:01:31 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2012.06.18 21:06:05 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012.09.04 21:10:54 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2012.11.01 19:20:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2009.12.22 04:57:54 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2009.12.22 04:57:54 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2009.12.22 04:57:54 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2009.12.22 04:57:54 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2009.12.22 04:57:54 | 000,000,801 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - homepage: hxxp://www.google.com
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Updater (Enabled) = C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 6 U33 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.330.3 (Enabled) = C:\windows\system32\npdeployJava1.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: DvdVideoSoft Free Youtube Download = C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.0.0_0\
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (BHO_Startup Class) - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Programme\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.7529.1424\swg.dll (Google Inc.)
O2 - BHO: (WEB.DE MailCheck BHO) - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O2 - BHO: (Mininova-Vuze Toolbar) - {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - C:\Programme\Mininova-Vuze\tbMini.dll (Conduit Ltd.)
O2 - BHO: (Credential Manager for HP ProtectTools) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Programme\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll (Bioscrypt Inc.)
O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.
O3 - HKLM\..\Toolbar: (WEB.DE MailCheck) - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O3 - HKLM\..\Toolbar: (Mininova-Vuze Toolbar) - {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - C:\Programme\Mininova-Vuze\tbMini.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (WEB.DE MailCheck) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O3 - HKCU\..\Toolbar\WebBrowser: (Mininova-Vuze Toolbar) - {D51D388B-F5DC-471A-A1CE-5E2D671091C0} - C:\Programme\Mininova-Vuze\tbMini.dll (Conduit Ltd.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [accrdsub] c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe (ActivIdentity)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CognizanceTS] c:\Programme\Hewlett-Packard\IAM\Bin\ASTSVCC.dll (Bioscrypt Inc.)
O4 - HKLM..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 11\Register\registration.exe (Corel Corporation)
O4 - HKLM..\Run: [DataCardMonitor] C:\Programme\Huawei Modems\DataCardMonitor.exe (Huawei Technologies Co., Ltd.)
O4 - HKLM..\Run: [File Sanitizer] C:\Programme\Hewlett-Packard\File Sanitizer\CoreShredder.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Programme\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [KMConfig] "C:\Program Files\Multimedia Mouse Driver\V5\StartAutorun.exe" KMConfig.exe File not found
O4 - HKLM..\Run: [MailCheck IE Broker] C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe (1und1 Mail und Media GmbH)
O4 - HKLM..\Run: [PDF Complete] C:\Programme\PDF Complete\pdfsty.exe (PDF Complete Inc)
O4 - HKLM..\Run: [PTHOSTTR] c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\soundmax.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe File not found
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKCU..\Run: [dqgvdyg] "c:\users\martin\appdata\local\dqgvdyg.exe" dqgvdyg File not found
O4 - HKCU..\Run: [GoogleChromeAutoLaunch_B3FBEF5462B7ECF3CF8933E4FE9764B6] C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
O4 - HKCU..\Run: [msnmsgr] "C:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background File not found
O4 - HKCU..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe" File not found
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spc.lnk =  File not found
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\Martin\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Martin\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AD65EA02-71B4-449D-A2E5-6FE2D5588943}: NameServer = 192.168.100.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B3A1AFFE-DB71-4D80-B71C-623E305249EC}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\webde {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Programme\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
O20 - AppInit_DLLs: (APSHook.dll) - C:\windows\System32\APSHook.dll (Bioscrypt Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\First.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\First.jpg
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{051770fc-c975-11de-bb7a-00226464ed65}\Shell - "" = AutoRun
O33 - MountPoints2\{051770fc-c975-11de-bb7a-00226464ed65}\Shell\AutoRun\command - "" = H:\TotalLock.exe
O33 - MountPoints2\{b58434e5-8134-11de-aa0e-00226464ed65}\Shell - "" = AutoRun
O33 - MountPoints2\{b58434e5-8134-11de-aa0e-00226464ed65}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.12.26 22:14:24 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Martin\Desktop\OTL.exe
[2012.12.25 21:04:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SopCast
[2012.12.25 21:04:52 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SopCast
[2012.12.25 21:04:52 | 000,000,000 | ---D | C] -- C:\Program Files\SopCast
[2012.12.25 20:52:13 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Local\TVU Networks
[2012.12.25 20:52:13 | 000,000,000 | ---D | C] -- C:\ProgramData\TVU Networks
[2012.12.02 13:02:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WEB.DE MailCheck
[2012.12.02 13:02:52 | 000,000,000 | ---D | C] -- C:\ProgramData\1&1 Mail & Media GmbH
[2012.12.02 13:02:50 | 000,000,000 | ---D | C] -- C:\Program Files\WEB.DE MailCheck
[2012.12.02 13:02:11 | 000,000,000 | ---D | C] -- C:\ProgramData\UUdb
 
========== Files - Modified Within 30 Days ==========
 
[2012.12.26 22:35:54 | 000,000,000 | ---- | M] () -- C:\Users\Martin\defogger_reenable
[2012.12.26 22:35:02 | 000,001,098 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.12.26 22:33:58 | 000,001,094 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.12.26 22:31:57 | 000,017,408 | ---- | M] () -- C:\windows\System32\rpcnetp.exe
[2012.12.26 22:31:54 | 000,058,288 | ---- | M] (Absolute Software Corp.) -- C:\windows\System32\rpcnet.dll
[2012.12.26 22:31:51 | 000,000,308 | ---- | M] () -- C:\windows\tasks\IENI.job
[2012.12.26 22:31:49 | 000,003,216 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.12.26 22:31:49 | 000,003,216 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.12.26 22:31:46 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012.12.26 22:31:40 | 3216,261,120 | -HS- | M] () -- C:\hiberfil.sys
[2012.12.26 22:30:05 | 000,001,158 | ---- | M] () -- C:\windows\bthservsdp.dat
[2012.12.26 22:20:15 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012.12.26 22:15:53 | 000,302,592 | ---- | M] () -- C:\Users\Martin\Desktop\mbvld26q.exe
[2012.12.26 22:14:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Martin\Desktop\OTL.exe
[2012.12.26 22:13:18 | 000,050,477 | ---- | M] () -- C:\Users\Martin\Desktop\Defogger.exe
[2012.12.26 21:46:52 | 000,000,420 | -H-- | M] () -- C:\windows\tasks\User_Feed_Synchronization-{CFB1C48B-06E9-45CC-91C8-2B749C42D204}.job
[2012.12.25 21:04:53 | 000,000,788 | ---- | M] () -- C:\Users\Martin\Desktop\SopCast.lnk
[2012.12.23 16:58:28 | 000,674,832 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2012.12.23 16:58:28 | 000,634,650 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012.12.23 16:58:28 | 000,146,484 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2012.12.23 16:58:28 | 000,120,214 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012.12.22 20:57:30 | 000,498,288 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2012.12.18 20:52:23 | 000,118,784 | RHS- | M] () -- C:\windows\System32\fdPHosta.dll
[2012.12.16 12:48:31 | 000,001,022 | ---- | M] () -- C:\windows\tasks\Google Software Updater.job
[2012.12.13 18:38:43 | 000,001,971 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.12.13 17:53:35 | 000,001,204 | ---- | M] () -- C:\Users\Public\Desktop\HP Solution Center.lnk
[2012.12.02 13:02:55 | 000,002,023 | ---- | M] () -- C:\Users\Martin\Desktop\Amazon.lnk
[2012.12.02 13:02:55 | 000,002,021 | ---- | M] () -- C:\Users\Martin\Desktop\WEB.DE.lnk
[2012.12.02 13:02:55 | 000,002,015 | ---- | M] () -- C:\Users\Martin\Desktop\eBay.lnk
 
========== Files Created - No Company Name ==========
 
[2012.12.26 22:35:54 | 000,000,000 | ---- | C] () -- C:\Users\Martin\defogger_reenable
[2012.12.26 22:15:50 | 000,302,592 | ---- | C] () -- C:\Users\Martin\Desktop\mbvld26q.exe
[2012.12.26 22:13:16 | 000,050,477 | ---- | C] () -- C:\Users\Martin\Desktop\Defogger.exe
[2012.12.25 21:04:53 | 000,000,788 | ---- | C] () -- C:\Users\Martin\Desktop\SopCast.lnk
[2012.12.18 20:52:23 | 000,118,784 | RHS- | C] () -- C:\windows\System32\fdPHosta.dll
[2012.12.18 20:52:23 | 000,000,308 | ---- | C] () -- C:\windows\tasks\IENI.job
[2012.12.14 17:32:43 | 000,000,003 | ---- | C] () -- C:\windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012.12.14 17:32:43 | 000,000,003 | ---- | C] () -- C:\windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012.12.02 13:02:55 | 000,002,023 | ---- | C] () -- C:\Users\Martin\Desktop\Amazon.lnk
[2012.12.02 13:02:55 | 000,002,021 | ---- | C] () -- C:\Users\Martin\Desktop\WEB.DE.lnk
[2011.10.30 20:00:19 | 000,012,194 | ---- | C] () -- C:\windows\hpwscr20.dat
[2011.10.30 19:59:20 | 000,203,136 | ---- | C] () -- C:\windows\hpwins20.dat
[2011.10.30 19:59:20 | 000,002,428 | ---- | C] () -- C:\windows\hpwmdl20.dat
[2011.02.09 01:21:49 | 000,758,018 | ---- | C] () -- C:\windows\System32\xvidcore.dll
[2011.02.09 01:21:49 | 000,180,224 | ---- | C] () -- C:\windows\System32\xvidvfw.dll
[2009.03.16 00:26:04 | 000,000,000 | ---- | C] () -- C:\Users\Martin\AppData\Local\rx_image32.Cache
[2009.02.26 20:58:27 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.02.19 23:13:42 | 000,000,094 | ---- | C] () -- C:\Users\Martin\AppData\Local\fusioncache.dat
[2009.02.13 00:27:04 | 000,001,973 | ---- | C] () -- C:\Users\Martin\AppData\Local\dqgvdyg.dat
[2009.02.13 00:27:04 | 000,000,319 | ---- | C] () -- C:\Users\Martin\AppData\Local\dqgvdyg_navps.dat
[2009.02.13 00:27:04 | 000,000,091 | ---- | C] () -- C:\Users\Martin\AppData\Local\dqgvdyg.bat
[2009.02.05 23:25:47 | 000,000,680 | ---- | C] () -- C:\Users\Martin\AppData\Local\d3d9caps.dat
[2009.01.17 22:42:09 | 000,193,536 | ---- | C] () -- C:\Users\Martin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:51:16 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.12.02 13:02:53 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\1&1 Mail & Media GmbH
[2010.05.04 22:35:11 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\AIMP
[2012.09.01 12:04:06 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Azureus
[2009.08.31 21:02:20 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\ClipMagic
[2012.10.04 21:22:58 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\DVDVideoSoft
[2012.10.04 21:21:30 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.02.09 01:21:31 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\GetRightToGo
[2009.11.06 01:09:33 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\GrabPro
[2009.02.17 21:28:04 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\gtk-2.0
[2012.08.05 17:34:10 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Internet-Manager
[2009.01.17 23:37:07 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\InterVideo
[2009.02.18 20:45:41 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\OpenOffice.org
[2009.12.02 00:14:56 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Orbit
[2012.01.08 12:10:27 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Sync App Settings
[2009.06.24 19:35:12 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\TomTom
[2011.03.16 00:13:35 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\uTorrent
[2009.08.04 21:36:45 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Vodafone
[2012.03.07 17:57:27 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\www.rene-zeidler.de
 
========== Purity Check ==========
 
 

< End of report >
         

Extra.txt

OTL Extras logfile created on: 26.12.2012 22:38:28 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Martin\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19393)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 1,70 Gb Available Physical Memory | 56,82% Memory free
6,19 Gb Paging File | 4,77 Gb Available in Paging File | 77,16% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 288,09 Gb Total Space | 204,44 Gb Free Space | 70,97% Space Free | Partition Type: NTFS
Drive D: | 9,00 Gb Total Space | 1,65 Gb Free Space | 18,30% Space Free | Partition Type: NTFS
Drive F: | 1021,00 Mb Total Space | 1018,74 Mb Free Space | 99,78% Space Free | Partition Type: FAT32
 
Computer Name: MARTIN_LAPTOP | User Name: Martin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0020B008-A49E-4145-AB73-8586FED6F06F}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{0A6650B8-6962-421D-8B74-B2210AD3A50A}" = lport=137 | protocol=17 | dir=in | app=system | 
"{0E2C8EE5-443D-45A0-BCCD-29A4247FFA03}" = lport=445 | protocol=6 | dir=in | app=system | 
"{1C760815-4E0A-47C2-90AA-A2AE2384A5CB}" = rport=139 | protocol=6 | dir=out | app=system | 
"{2BA388D9-1C23-4C6C-8D56-00D3AA3A6B50}" = rport=138 | protocol=17 | dir=out | app=system | 
"{35A322CF-1B1A-4675-99BF-7E165579378A}" = lport=139 | protocol=6 | dir=in | app=system | 
"{39587C2A-8253-4726-BF8C-F07724260929}" = lport=138 | protocol=17 | dir=in | app=system | 
"{58199518-708A-46D0-9B50-FB9B502111D6}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{58602744-7AEC-4527-AC9F-9B38419C8D59}" = rport=445 | protocol=6 | dir=out | app=system | 
"{65BB9E6D-3B79-45EF-95D6-DCEECA64EDEF}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{7BD4A254-F01D-4745-83C6-E9A524CD356D}" = lport=2869 | protocol=6 | dir=in | name=tcp 2869 | 
"{8F649E0C-C661-4130-B25C-6D23DBA73DD7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{B2842191-B4B5-4AB2-B9FA-5CC940600620}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{B294F02F-DDFC-4BF0-ADA9-D3BB27266840}" = rport=137 | protocol=17 | dir=out | app=system | 
"{CBBF6355-AE8D-48A4-B613-1A7B4E5CA472}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{CF97E488-143A-4250-B566-C320AD2242D0}" = lport=1900 | protocol=17 | dir=in | name=udp 1900 | 
"{D4C2355E-D101-48D2-AD4A-C7E145B1CE79}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{FD786BA7-71E6-4EC4-82B2-CAAA49D09F71}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{132A37D0-7E54-4DAE-838F-C3EF14D70AD7}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"{24013B47-CAC2-4598-A006-710191C0AC39}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{390FE55A-8592-4D47-A68D-5C8D0C0492FF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{7F4B65E8-5B86-4A28-AE62-529AC999E14A}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{8651AF78-9688-4FDB-B6FA-4D2813665034}" = dir=in | app=c:\program files\msn messenger\msnmsgr.exe | 
"{AAEEE1DD-7794-4EE8-96D3-538D5DE39432}" = dir=in | app=c:\program files\msn messenger\livecall.exe | 
"{CC32C2CE-D99F-47FE-B1D6-D5821602998D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{DC693F76-FE24-4168-B70F-F1BEF7AF7421}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"TCP Query User{1B046871-E829-465C-9173-6F52D479B1A0}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"TCP Query User{27B854C5-C2F9-4FC4-994D-EAA4E350309F}C:\program files\emule\emule.exe" = protocol=6 | dir=in | app=c:\program files\emule\emule.exe | 
"TCP Query User{2CC01D4C-C633-47FC-A33D-1DD22CBBE2D6}C:\program files\vuze\azureus.exe" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe | 
"TCP Query User{44EA5C30-512E-4FEB-BEDC-1716CB2D11D1}C:\program files\orbitdownloader\orbitnet.exe" = protocol=6 | dir=in | app=c:\program files\orbitdownloader\orbitnet.exe | 
"TCP Query User{9A414E43-FF86-4EDE-919A-4FBDE4DC7E8D}\\iconnect\daten\daten\gemeinsame daten\software\tvuplayer_green.v2.5.3.1\tvuplayer.exe" = protocol=6 | dir=in | app=\\iconnect\daten\daten\gemeinsame daten\software\tvuplayer_green.v2.5.3.1\tvuplayer.exe | 
"TCP Query User{A800A942-C09E-4A36-A5CB-6D3FB460FA53}C:\program files\iomega storage manager\iomegastoragemanager.exe" = protocol=6 | dir=in | app=c:\program files\iomega storage manager\iomegastoragemanager.exe | 
"TCP Query User{B3BB22C8-EAC8-493E-A952-346A9F36941F}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"TCP Query User{F1621C85-CC33-4A7B-B264-5D96B6C2EBDB}C:\program files\iomega storage manager\iomegastoragemanager.exe" = protocol=6 | dir=in | app=c:\program files\iomega storage manager\iomegastoragemanager.exe | 
"UDP Query User{30ED2A80-D8FB-4C81-87ED-A8FA58EAEAAC}C:\program files\emule\emule.exe" = protocol=17 | dir=in | app=c:\program files\emule\emule.exe | 
"UDP Query User{323068BE-6FBD-4358-A3BB-443E3BD9A1EE}C:\program files\iomega storage manager\iomegastoragemanager.exe" = protocol=17 | dir=in | app=c:\program files\iomega storage manager\iomegastoragemanager.exe | 
"UDP Query User{9F68D9A7-8F32-4107-9D45-BECF122543C2}C:\program files\orbitdownloader\orbitnet.exe" = protocol=17 | dir=in | app=c:\program files\orbitdownloader\orbitnet.exe | 
"UDP Query User{A6417135-47ED-41C9-8300-54261BD58BED}C:\program files\iomega storage manager\iomegastoragemanager.exe" = protocol=17 | dir=in | app=c:\program files\iomega storage manager\iomegastoragemanager.exe | 
"UDP Query User{B70F1DAE-0109-4CE2-A322-C2934CD9908B}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"UDP Query User{C4F4A600-129B-4A64-85BD-BB05363B2F85}\\iconnect\daten\daten\gemeinsame daten\software\tvuplayer_green.v2.5.3.1\tvuplayer.exe" = protocol=17 | dir=in | app=\\iconnect\daten\daten\gemeinsame daten\software\tvuplayer_green.v2.5.3.1\tvuplayer.exe | 
"UDP Query User{C8ADE03B-6A92-4638-AB96-9BDD5B877BEB}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{E1786252-20E1-4D68-ABE0-85E39BA2E1D6}C:\program files\vuze\azureus.exe" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{004C5DA2-2051-4D25-94BA-51CF810C91EB}" = LightScribe System Software  1.12.37.1
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.0.1.5300
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{06CB77AB-CDE1-EF6B-175D-85FA59C7F0EE}" = Catalyst Control Center Core Implementation
"{07D78C7B-2AA8-5C02-4238-EE3F39279221}" = Catalyst Control Center Localization Thai
"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{0AF9C2B7-2E98-8D77-3892-F8512305C6CE}" = CCC Help Turkish
"{0E549A13-2B3D-4633-BA41-DC88C2D6F9A3}" = ProductContext
"{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox
"{0F98662A-EA83-414F-8766-3FCE46A32641}" = Credential Manager for HP ProtectTools
"{1147FF9A-D576-4cb5-B5E7-FCA21D1E7D26}" = J4680
"{154E4F71-DFC0-4B31-8D99-F97615031B02}" = HP Webcam Application
"{164280AB-98C2-FD02-EC0B-5DFBB98E89C1}" = Catalyst Control Center Localization Chinese Standard
"{173317B8-D99E-F58E-CAAE-924D8F26C435}" = CCC Help Czech
"{1779522E-BFC6-738C-E97E-39405E196FA6}" = Catalyst Control Center Localization Spanish
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18669FF9-C8FE-407a-9F70-E674896B1DB4}" = GPBaseService
"{188C0E25-3D65-4DAC-9C00-7483FBA4C7EB}" = Status
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1C63DD23-6554-4A1F-8D0D-B5A6B49D8015}" = Corel Graphics Suite 11
"{1DB44CB7-D68E-9F09-D656-0FBC7D4D9C00}" = Catalyst Control Center Localization Norwegian
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{1FD3DF19-EF58-2A29-222B-A4B6E237D3DD}" = Catalyst Control Center Graphics Previews Vista
"{207A8D54-51C9-48B6-80E6-CBA5403B3ED4}" = Vista Default Settings
"{2086797F-A4BA-4CD3-8104-09B8D39DA5D8}" = HP JavaCard for HP ProtectTools
"{228C6B46-64E2-404E-898A-EF0830603EF4}" = HPNetworkAssistant
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check for Health Check
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 37
"{27D28586-BEF1-4E06-8787-3B1FC3A41489}" = congstar Internet-Manager
"{2EC294E6-2E8C-23A7-C174-4E59532B0E06}" = Catalyst Control Center Localization Korean
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{30A2A953-DEB1-466A-B660-F4399C7C6B9D}" = Roxio MyDVD
"{30BF4E6C-D866-46F7-A4F6-81A45E97706E}" = Catalyst Control Center - Branding
"{311BF3BF-6AAB-7859-1E5A-EB46644A6011}" = CCC Help French
"{32063923-8066-18D5-BF07-2B692547AEF5}" = CCC Help Korean
"{323C15C3-6DE1-05E6-B202-6F1D90BB1B06}" = Catalyst Control Center Localization Turkish
"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java(TM) 6 Update 6
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.40 E1
"{36FDBE6E-6684-462b-AE98-9A39A1B200CC}" = HPProductAssistant
"{3825B383-7880-48C8-AADD-49B0D764B151}" = 4660_4680_Help
"{3848DCD1-E356-ACB9-93AF-FB93485E1598}" = CCC Help Thai
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = HP Webcam
"{3A76F96A-637B-9A0E-F65B-AE595A49DEDA}" = ccc-core-static
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{3FCFB6B6-B5DE-C5B8-825F-5998C220C24E}" = Catalyst Control Center Localization Russian
"{420BBA1D-B275-4891-838C-EA88FE87A632}" = HP Customer Experience Enhancements
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{44AFDB86-1509-4CDC-9B2E-1C73B2DEE5F0}" = Mobile Broadband Drivers
"{45BA0F82-FC61-828B-A188-49A24B7B39F4}" = Catalyst Control Center Localization Swedish
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A3D0CF8-60FF-4CEF-91A4-A1F001424602}" = DocProc
"{4ADB08ED-A385-21BA-3511-00EB170C9CCA}" = Catalyst Control Center Localization Greek
"{4C203E35-B5C7-4E35-9834-619668C0FFEE}" = HP 3D DriveGuard
"{500CAC18-1509-AC6C-3E91-A437F9457D5E}" = CCC Help Japanese
"{50802F8E-03B4-479D-A643-16DE5A3586CB}" = BPDSoftware_Ini
"{5109C064-813E-4e87-B0DE-C8AF7B5BC02B}" = SmartWebPrintingOC
"{52A69E11-7CEB-4a7d-9607-68BA4F39A89B}" = DeviceDiscovery
"{537BF16E-7412-448C-95D8-846E85A1D817}" = Roxio Creator Business
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5ACE69F0-A3E8-44eb-88C1-0A841E700180}" = TrayApp
"{5B5494F7-FD30-AFAB-ACD5-345F26B6AAF4}" = Catalyst Control Center Graphics Full Existing
"{5BB4D7C1-52F2-4BFD-9E40-0D419E2E3021}" = bpd_scan
"{5BF2EC0B-2A01-DDEA-5645-E700BCE9CDA6}" = CCC Help Spanish
"{5EF644FA-3703-3253-7372-AE46FD862588}" = ccc-utility
"{63BABF5E-B142-02F9-85E1-F0A1DBEC6D5D}" = Catalyst Control Center Localization Chinese Traditional
"{647ED1EC-1D53-9886-B5A1-234CE9D7BE3F}" = Catalyst Control Center Localization Danish
"{64F561F5-17B7-0721-8D08-78777BB91382}" = CCC Help Italian
"{65E63D8F-F763-940E-38FA-1A6B2C30ADB2}" = Catalyst Control Center Graphics Light
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67335AB1-6341-4f87-A5B4-7FA92CEB77A4}" = HP Officejet All-In-One Series
"{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm
"{69333A04-5134-40A5-A055-9166A7AA1EC8}" = 
"{6B4591DF-C531-255E-BDE6-25226A5AE115}" = Skins
"{6C4592F5-A803-1740-A708-84F3578DC083}" = Catalyst Control Center Localization German
"{6DF8EB4D-F5E5-369C-38B2-4F7CD0F02AC3}" = Catalyst Control Center Localization Italian
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{70B45586-B51E-4947-A258-A895596C5CED}" = Photo Loader 3.0G
"{70CEFEBA-F757-4DBE-8A21-027C326137CE}" = HP Software Setup 5.00.A.7
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{75D7BB3A-9AB7-4ad1-AD5E-0059B90C624B}" = HP ProtectTools Security Manager Suite
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{789C97CE-9E17-4126-BDF4-11FF458BF705}" = File Sanitizer For HP ProtectTools
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{80533B67-C407-485D-8B5D-63BB8ED9D878}" = Scan
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8BB128BE-2670-485D-A221-B00715BCEBCF}" = HP Easy Setup - Frontend
"{8BEA3254-8719-4815-9312-69AF21B8D779}" = CCC Help Chinese Traditional
"{8BF85A3B-C2EE-2A32-DF54-B565062FBEC9}" = Catalyst Control Center Localization Japanese
"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack
"{8DD39028-8B90-88D8-781A-AB82A9AE6662}" = CCC Help English
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{91B26C13-34A4-36FA-E1F0-22664915EED1}" = Catalyst Control Center Localization Dutch
"{926F4D5F-C8FC-4FB7-8E09-BCB8A997D1C7}" = HP ProtectTools Security Manager
"{968933D6-A9FC-891C-6292-F7E68DB2C7EA}" = CCC Help Finnish
"{96DB55D1-E21F-126C-1ADD-35EAAC852C7C}" = Catalyst Control Center Localization Finnish
"{988B865E-CC06-7B3D-FBC0-52093DB75C9A}" = CCC Help Dutch
"{997F39AA-6CDC-2E23-F9C3-D59AACABAB8F}" = Catalyst Control Center Localization French
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9ADABDDE-9644-461B-9E73-83FA3EFCAB50}" = HP Wireless Assistant
"{9DBD8BEE-B3EC-4D82-A81C-0F6250176DCC}" = Drive Encryption for HP ProtectTools
"{9E2CCD5E-1990-4EF2-9B61-32F0BBACC29B}" = HP Active Support Library
"{A1410161-F615-4B91-A019-FA33833EF00D}" = BIOS Configuration for HP ProtectTools
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A5AB9D5E-52E2-440e-A3ED-9512E253C81A}" = SolutionCenter
"{A80FA752-C491-4ED9-ABF0-4278563160B2}" = 32 Bit HP CIO Components Installer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9495514-098A-4869-A464-C455857BC464}" = Multimedia Mouse Driver
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{ABA00898-9467-4689-9F40-DE7F58C8429C}" = Fax
"{AC194855-F7AC-4D04-B4C9-07BA46FCB697}" = ActivClient 6.1 x86
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{ACDE260A-602B-4cfb-A650-D0DBA6FFAD85}" = NetDeviceManager
"{B0704448-6681-607E-D97F-A148C2E2F763}" = CCC Help Danish
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{B79DB290-9F72-4B20-9776-848D7832705B}" = HP User Guides 0108
"{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply
"{BABEDC2E-5718-1D6D-9E76-93C7EC76BBC4}" = CCC Help Greek
"{BC1DC565-8B34-4B29-9DB2-BF281C2FB56E}" = ESU for Microsoft Vista SP1
"{BD5DE09E-3C1C-1DCE-E98D-7B7BBDBE15AD}" = CCC Help Portuguese
"{BFCBCC48-9027-17B7-BD08-5214898494CC}" = CCC Help German
"{C3036710-8564-ECEA-0E19-1B7880111167}" = CCC Help Swedish
"{C7D03B2F-5B3A-A6D8-1C6C-AFCA02DDD3EC}" = Catalyst Control Center Localization Czech
"{C8A33E2B-5DDB-BF2E-24A9-95DFA1CDF56D}" = Catalyst Control Center Localization Polish
"{CA144572-CEAD-5A14-A338-D28B35D9C7FF}" = Catalyst Control Center Localization Hungarian
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg
"{CDC7F188-3A08-45C3-8C3C-99BE32911949}" = Photo Transport
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE3020D2-1742-19F4-EFB4-4D76097C81D0}" = Catalyst Control Center Localization Portuguese
"{CF755AAE-7801-359C-E9D3-FE8572F8C760}" = Catalyst Control Center Graphics Full New
"{D142FE39-3386-4d82-9AD3-36D4A92AC3C2}" = DocMgr
"{D2E0F0CC-6BE0-490b-B08B-9267083E34C9}" = MarketResearch
"{D3737952-FF6E-4E72-BDEE-B0DC1C69F80B}" = BPD_HPSU
"{D99A8E3A-AE5A-4692-8B19-6F16D454E240}" = Destination Component
"{DC04644B-C7B3-AF77-610C-7F0AF59AC44D}" = ATI Catalyst Install Manager
"{DE80F89F-6132-42A9-1A47-542F6C60E1A2}" = CCC Help Russian
"{E333CA5F-00ED-4EEF-90E5-6A33A8FE969F}" = HP Help and Support
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E979B690-80A7-8E8B-1281-C68DBEDDB491}" = CCC Help Norwegian
"{EC877639-07AB-495C-BFD1-D63AF9140810}" = Roxio Activation Module
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator Business v10
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F173C2B3-296F-458C-98FF-1676A42EBA02}" = HP Wallpaper
"{F18DB86D-BC16-4E01-BCCE-63F62B931D82}" = InterVideo Register Manager
"{F23DFEB2-A5D1-3B97-FBF3-30DC859411C0}" = CCC Help Hungarian
"{F4EAEBEA-3E46-43b8-A63C-AD180AE86918}" = BPDSoftware
"{F5BF6D6E-C8F1-4FE1-943A-C484696B30C2}" = Guitar Chords
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FBE38124-B7F0-3EEE-98C5-D8C3AE353FF5}" = CCC Help Chinese Standard
"{FD9FAE60-2BF1-C877-9843-AABA9DA06A2B}" = CCC Help Polish
"1&1 Mail & Media GmbH 1und1Softwareaktualisierung" = WEB.DE Softwareaktualisierung
"1&1 Mail & Media GmbH Toolbar IE8" = WEB.DE MailCheck für Internet Explorer
"7-Zip" = 7-Zip 4.65
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"AIMP2" = AIMP2
"Allway Sync_is1" = Allway Sync version 12.0.0
"AP Tuner 3.08" = AP Tuner 3.08
"Avira AntiVir Desktop" = Avira Free Antivirus
"CDex" = CDex extraction audio
"dqgvdyg" = Favorit
"DVD Audio Extractor_is1" = DVD Audio Extractor 4.5.3
"eMule" = eMule
"FastStone Capture" = FastStone Capture 5.3
"Free DVD MP3 Ripper_is1" = Free DVD MP3 Ripper 1.12
"Free Studio_is1" = Free Studio version 5.7.4.918
"Free Video to Mp3 Converter_is1" = Free Video to Mp3 Converter version 3.1
"Free YouTube Download_is1" = Free YouTube Download 2.2
"Free YouTube to Mp3 Converter_is1" = Free YouTube to Mp3 Converter version 3.1
"Google Chrome" = Google Chrome
"Google Updater" = Google Updater
"Guitar Explorer 1.0" = Guitar Explorer 1.0
"HP Document Manager" = HP Document Manager 1.0
"HP Imaging Device Functions" = HP Imaging Device Functions 10.0
"HP Smart Web Printing" = HP Smart Web Printing
"HP Solution Center & Imaging Support Tools" = HP Solution Center 10.0
"HPExtendedCapabilities" = HP Customer Participation Program 10.0
"HPOCR" = OCR Software by I.R.I.S. 10.0
"Huawei Modems" = Huawei modem
"InstallShield_{1C63DD23-6554-4A1F-8D0D-B5A6B49D8015}" = CorelDRAW Graphics Suite 11
"InstallShield_{A9495514-098A-4869-A464-C455857BC464}" = Multimedia Mouse Driver
"Iomega Storage Manager" = Iomega Storage Manager
"iWisoft Free Video Converter_is1" = iWisoft Free Video Converter 1.2
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mininova-Vuze Toolbar" = Mininova-Vuze Toolbar
"Mozilla Firefox (3.5.7)" = Mozilla Firefox (3.5.7)
"Novatel_V20051Installer" = Novatel driver package V2.00.51
"PDF Complete" = PDF Complete
"Shop for HP Supplies" = Shop for HP Supplies
"SopCast" = SopCast 3.5.0
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Uninstall_is1" = Uninstall 1.0.0.1
"uTorrent" = µTorrent
"VLC media player" = VLC media player 2.0.1
"Vuze" = Vuze
"Winamp" = Winamp
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 06.12.2012 20:33:38 | Computer Name = Martin_Laptop | Source = EventSystem | ID = 4621
Description = 
 
Error - 08.12.2012 16:09:38 | Computer Name = Martin_Laptop | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 8.0.6001.19328 arbeitet nicht mehr 
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen 
über das Problem zu suchen.  Prozess-ID: 10c4  Anfangszeit: 01cdd5705c996a80  Zeitpunkt
 der Beendigung: 47
 
Error - 12.12.2012 16:44:34 | Computer Name = Martin_Laptop | Source = EventSystem | ID = 4621
Description = 
 
Error - 13.12.2012 12:55:23 | Computer Name = Martin_Laptop | Source = MsiInstaller | ID = 11904
Description = 
 
Error - 16.12.2012 13:22:04 | Computer Name = Martin_Laptop | Source = EventSystem | ID = 4621
Description = 
 
Error - 23.12.2012 11:54:25 | Computer Name = Martin_Laptop | Source = EventSystem | ID = 4621
Description = 
 
Error - 23.12.2012 13:33:05 | Computer Name = Martin_Laptop | Source = EventSystem | ID = 4621
Description = 
 
Error - 25.12.2012 16:10:28 | Computer Name = Martin_Laptop | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung SopCast.exe, Version 3.5.0.1221, Zeitstempel
 0x4f503ae3, fehlerhaftes Modul sop.ocx, Version 0.0.0.0, Zeitstempel 0x4f502af7,
 Ausnahmecode 0xc0000005, Fehleroffset 0x0013870b,  Prozess-ID 0x1fb8, Anwendungsstartzeit
 01cde2db334b17e3.
 
Error - 25.12.2012 16:12:13 | Computer Name = Martin_Laptop | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung SopCast.exe, Version 3.5.0.1221, Zeitstempel
 0x4f503ae3, fehlerhaftes Modul sop.ocx, Version 0.0.0.0, Zeitstempel 0x4f502af7,
 Ausnahmecode 0xc0000005, Fehleroffset 0x0013870b,  Prozess-ID 0x1820, Anwendungsstartzeit
 01cde2dbebaf39b3.
 
Error - 25.12.2012 16:14:50 | Computer Name = Martin_Laptop | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung SopCast.exe, Version 3.5.0.1221, Zeitstempel
 0x4f503ae3, fehlerhaftes Modul sop.ocx, Version 0.0.0.0, Zeitstempel 0x4f502af7,
 Ausnahmecode 0xc0000005, Fehleroffset 0x0013870b,  Prozess-ID 0x1314, Anwendungsstartzeit
 01cde2dc25f23be3.
 
[ Credential Manager Events ]
Error - 19.09.2012 12:30:15 | Computer Name = Martin_Laptop | Source = AuthServer | ID = 100811779
Description = The system failed to authenticate the submitted user credentials.   Benutzer:
 Simone@Martin_Laptop   Client-GUID: {Password}   Fehler: 0xC516020B   Client-Host: localhost

Client-Adresse:
 127.0.0.1   Authentifizierungsstelle: HP   Server-Host: localhost   Protokoll: HTTP
 
Error - 19.09.2012 12:30:15 | Computer Name = Martin_Laptop | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: Simone@Martin_Laptop
Anmeldeinformationen:
 Kennwort   Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
Error - 01.11.2012 20:05:49 | Computer Name = Martin_Laptop | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: Martin@Martin_Laptop
Anmeldeinformationen:
 Kennwort   Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
Error - 01.11.2012 20:05:49 | Computer Name = Martin_Laptop | Source = AuthServer | ID = 100811779
Description = The system failed to authenticate the submitted user credentials.   Benutzer:
 Martin@Martin_Laptop   Client-GUID: {Password}   Fehler: 0xC516020B   Client-Host: localhost

Client-Adresse:
 127.0.0.1   Authentifizierungsstelle: HP   Server-Host: localhost   Protokoll: HTTP
 
Error - 01.11.2012 20:06:04 | Computer Name = Martin_Laptop | Source = AuthServer | ID = 100811779
Description = The system failed to authenticate the submitted user credentials.   Benutzer:
 Martin@Martin_Laptop   Client-GUID: {Password}   Fehler: 0xC516020B   Client-Host: localhost

Client-Adresse:
 127.0.0.1   Authentifizierungsstelle: HP   Server-Host: localhost   Protokoll: HTTP
 
Error - 01.11.2012 20:06:04 | Computer Name = Martin_Laptop | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: Martin@Martin_Laptop
Anmeldeinformationen:
 Kennwort   Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
Error - 01.11.2012 20:28:53 | Computer Name = Martin_Laptop | Source = AuthServer | ID = 100811779
Description = The system failed to authenticate the submitted user credentials.   Benutzer:
 Simone@Martin_Laptop   Client-GUID: {Password}   Fehler: 0xC516020B   Client-Host: localhost

Client-Adresse:
 127.0.0.1   Authentifizierungsstelle: HP   Server-Host: localhost   Protokoll: HTTP
 
Error - 01.11.2012 20:28:53 | Computer Name = Martin_Laptop | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: Simone@Martin_Laptop
Anmeldeinformationen:
 Kennwort   Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
Error - 23.11.2012 17:52:19 | Computer Name = Martin_Laptop | Source = AuthServer | ID = 100811779
Description = The system failed to authenticate the submitted user credentials.   Benutzer:
 Ellena@Martin_Laptop   Client-GUID: {Password}   Fehler: 0xC516020B   Client-Host: localhost

Client-Adresse:
 127.0.0.1   Authentifizierungsstelle: HP   Server-Host: localhost   Protokoll: HTTP
 
Error - 23.11.2012 17:52:19 | Computer Name = Martin_Laptop | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: Ellena@Martin_Laptop
Anmeldeinformationen:
 Kennwort   Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
[ System Events ]
Error - 25.12.2012 17:11:09 | Computer Name = Martin_Laptop | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 25.12.2012 17:11:33 | Computer Name = Martin_Laptop | Source = Service Control Manager | ID = 7022
Description = 
 
Error - 25.12.2012 17:13:45 | Computer Name = Martin_Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
Error - 26.12.2012 16:43:11 | Computer Name = Martin_Laptop | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 26.12.2012 16:43:34 | Computer Name = Martin_Laptop | Source = Service Control Manager | ID = 7022
Description = 
 
Error - 26.12.2012 16:46:05 | Computer Name = Martin_Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
Error - 26.12.2012 17:18:50 | Computer Name = Martin_Laptop | Source = Print | ID = 6161
Description = Das Dokument http://www.trojaner-board.de/69886-a...enden-eroeffnu
 im Besitz von Martin konnte nicht auf dem Drucker HP Officejet J4680 Series gedruckt
 werden. Versuchen Sie erneut, das Dokument zu drucken, oder starten Sie den Druckspooler
 erneut.   Datentyp: NT EMF 1.008. Größe der Spooldatei in Bytes: 6094848. Anzahl 
der gedruckten Bytes: 6094848. Gesamtanzahl der Seiten des Dokuments: 5. Anzahl 
der gedruckten Seiten: 15. Clientcomputer: \\MARTIN_LAPTOP. Vom Druckprozessor zurückgegebener
 Win32-Fehlercode: 0. Der Vorgang wurde erfolgreich beendet.  
 
Error - 26.12.2012 17:33:05 | Computer Name = Martin_Laptop | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 26.12.2012 17:33:27 | Computer Name = Martin_Laptop | Source = Service Control Manager | ID = 7022
Description = 
 
Error - 26.12.2012 17:36:16 | Computer Name = Martin_Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
 
< End of report >
         

Screenshot GMER-Absturz:
siehe Anlage GMER_01.jpg


Malewarebytes Report:

 Malwarebytes Anti-Malware  (Test) 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.12.27.07

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19393
Martin :: MARTIN_LAPTOP [Administrator]

Schutz: Aktiviert

27.12.2012 17:58:03
mbam-log-2012-12-27 (17-58-03).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 312641
Laufzeit: 11 Minute(n), 1 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\fcn (Rogue.Residue) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\Martin\AppData\Local\Temp\Temp1_iehv.zip\iehv.exe (PUP.HistoryTool) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

GMER-Absturz:
siehe Anlage GMER_03.jpg

DANKE!

hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
[2012.12.18 20:52:23 | 000,118,784 | RHS- | M] () -- C:\windows\System32\fdPHosta.dll
[2012.12.18 20:52:23 | 000,000,308 | ---- | C] () -- C:\windows\tasks\IENI.job
 :Files
:Commands
[EMPTYFLASH] 
[emptytemp]
         

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die + E Taste.

• Öffne dein Systemlaufwerk ( meistens C: )
• Suche nun
  folgenden Ordner: _OTL und öffne diesen.
• Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
• 
  Dies wird eine Movedfiles.zip Datei in _OTL erstellen
• Lade diese bitte in unseren Uploadchannel
  hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

downloade get info:
http://markusg.trojaner-board.de/GetInfo.exe
doppelklicke die .exe
im selben ordner wird nun eine .txt erstellt:
summary-info.txt
diese doppelklicken und deren inhalt posten.

Frage:
hast du zum infektionszeitpunkt, bzw evtl. einen tag davor, etwas runtergeladen und instaliert bzw ausgeführt?
wurdest du beim besuch einer seite aufgefordert etwas zu instalieren bzw runterzuladen? diese infos hätte ich auch gern als private nachicht.

Hallo Markus,

wow, mit einer so schnellen Antwort habe ich nicht gerechnet.

Erst mal herzlichen Dank dafür.

Habe laut Deiner Anleitung OTL gestartet - ist aber dann abgestürzt, nachdem Antivir einen Fund gemeldet hat. Habe leider keine Screenshot machen können da alles weg war.
In der OTL Textbox war zu diesem Zeitpunkt nur noch die letzte Zeile zu sehen.

Hätte Antivir wahrscheinlich voher abschalten sollen ...

Soll ich nun die beschriebene Prozedur mit deaktiviertem Antivir noch einmal durchführen?

Hallo,

auch wenn OTL abgestürzt ist, habe ich die "Movedfiles" hochgeladen.

Hier auch die "summary-info.txt" (hat sich durch die Ausführung von OTL nicht verändert):

System volume information:	 dwHighDateTime = 0x1c8d02d,dwLowDateTime = 0x47e642c5
System32:			 dwHighDateTime = 0x1c6fe70,dwLowDateTime = 0xa3cd0a16
dwSerialNumber = 0x336d773f
         

Da der betroffene Rechner unser Familienlaptop ist, auf dem die beiden Kids, meine Frau und ich surfen, weiß ich nicht genau, wer wann wo surft. Meiner Frau und mir ist nichts aufgefallen, was eine Infektion verursacht haben könnte.

Ist das Datum, das in Deinem Code für OTL angegeben ist der Infektionszeitpunkt?

Sorry für die späte Antwort, hatte urlaub
genau, der 18.12 ist der zeitpunkt, bzw evtl. 17.12

Hallo, hoffe Du hast Dich gut erholt!

Gutes Neues Jahr erst mal!

Aktueller Status:
- Das mit den falschen links ist jetzt weg.
- Sicherheitscenter lässt sich aber immer noch nicht aktivieren.

... aber lass langsam angehen, damit die ganze Erholung nicht gleich wieder weg ist.

Hi
download tdss killer:
http://www.trojaner-board.de/82358-t...entfernen.html
Klicke auf Change parameters
• Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system
• Klick auf OK und anschließend auf Start scan
- bei funden erst mal immer skip wählen, log posten

Hier der TDSS-Killer Report:

22:16:33.0018 3652  TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
22:16:33.0065 3652  ============================================================
22:16:33.0065 3652  Current date / time: 2013/01/03 22:16:33.0065
22:16:33.0065 3652  SystemInfo:
22:16:33.0065 3652  
22:16:33.0065 3652  OS Version: 6.0.6002 ServicePack: 2.0
22:16:33.0065 3652  Product type: Workstation
22:16:33.0065 3652  ComputerName: MARTIN_LAPTOP
22:16:33.0065 3652  UserName: Martin
22:16:33.0065 3652  Windows directory: C:\windows
22:16:33.0065 3652  System windows directory: C:\windows
22:16:33.0065 3652  Processor architecture: Intel x86
22:16:33.0065 3652  Number of processors: 2
22:16:33.0065 3652  Page size: 0x1000
22:16:33.0065 3652  Boot type: Normal boot
22:16:33.0065 3652  ============================================================
22:16:33.0486 3652  Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
22:16:33.0486 3652  ============================================================
22:16:33.0486 3652  \Device\Harddisk0\DR0:
22:16:33.0486 3652  MBR partitions:
22:16:33.0486 3652  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2402CFC1
22:16:33.0486 3652  \Device\Harddisk0\DR0\Partition2: MBR, Type 0xC, StartLBA 0x2402D000, BlocksNum 0x200800
22:16:33.0486 3652  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x2422DAB0, BlocksNum 0x1201000
22:16:33.0486 3652  ============================================================
22:16:33.0502 3652  C: <-> \Device\Harddisk0\DR0\Partition1
22:16:33.0533 3652  D: <-> \Device\Harddisk0\DR0\Partition3
22:16:33.0548 3652  F: <-> \Device\Harddisk0\DR0\Partition2
22:16:33.0548 3652  ============================================================
22:16:33.0548 3652  Initialize success
22:16:33.0548 3652  ============================================================
22:17:19.0740 7956  ============================================================
22:17:19.0740 7956  Scan started
22:17:19.0740 7956  Mode: Manual; SigCheck; TDLFS; 
22:17:19.0740 7956  ============================================================
22:17:19.0943 7956  ================ Scan system memory ========================
22:17:19.0943 7956  System memory - ok
22:17:19.0943 7956  ================ Scan services =============================
22:17:20.0114 7956  [ A9B917777841B76F299E2EA946E03ADF ] Accelerometer   C:\windows\system32\DRIVERS\Accelerometer.sys
22:17:20.0208 7956  Accelerometer - ok
22:17:20.0286 7956  [ EC4A5D4E36A8E49261CD823450E0BA51 ] accoca          c:\Program Files\ActivIdentity\ActivClient\accoca.exe
22:17:20.0302 7956  accoca - ok
22:17:20.0348 7956  [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI            C:\windows\system32\drivers\acpi.sys
22:17:20.0364 7956  ACPI - ok
22:17:20.0411 7956  [ 364A903711E84EB1386FA04106681B7A ] ADIHdAudAddService C:\windows\system32\drivers\ADIHdAud.sys
22:17:20.0473 7956  ADIHdAudAddService - ok
22:17:20.0536 7956  [ 62B7936F9036DD6ED36E6A7EFA805DC0 ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
22:17:20.0536 7956  AdobeARMservice - ok
22:17:20.0614 7956  [ 95CE557D16A75606CCC2D7F3B0B0BCCB ] AdobeFlashPlayerUpdateSvc C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
22:17:20.0629 7956  AdobeFlashPlayerUpdateSvc - ok
22:17:20.0676 7956  [ 04F0FCAC69C7C71A3AC4EB97FAFC8303 ] adp94xx         C:\windows\system32\drivers\adp94xx.sys
22:17:20.0707 7956  adp94xx - ok
22:17:20.0707 7956  [ 60505E0041F7751BDBB80F88BF45C2CE ] adpahci         C:\windows\system32\drivers\adpahci.sys
22:17:20.0738 7956  adpahci - ok
22:17:20.0754 7956  [ 8A42779B02AEC986EAB64ECFC98F8BD7 ] adpu160m        C:\windows\system32\drivers\adpu160m.sys
22:17:20.0770 7956  adpu160m - ok
22:17:20.0770 7956  [ 241C9E37F8CE45EF51C3DE27515CA4E5 ] adpu320         C:\windows\system32\drivers\adpu320.sys
22:17:20.0785 7956  adpu320 - ok
22:17:20.0832 7956  [ 585F5793BB5D79C8754EE63BCBAF2B3A ] AEADIFilters    C:\windows\system32\AEADISRV.EXE
22:17:20.0848 7956  AEADIFilters - ok
22:17:20.0879 7956  [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc     C:\windows\System32\aelupsvc.dll
22:17:20.0957 7956  AeLookupSvc - ok
22:17:21.0019 7956  [ 3911B972B55FEA0478476B2E777B29FA ] AFD             C:\windows\system32\drivers\afd.sys
22:17:21.0082 7956  AFD - ok
22:17:21.0128 7956  [ 8ED60797908FD394EEE0D6949F493224 ] AgereModemAudio C:\Windows\system32\agrsmsvc.exe
22:17:21.0160 7956  AgereModemAudio - ok
22:17:21.0206 7956  [ 38325C6AA8EAE011897D61CE48EC6435 ] AgereSoftModem  C:\windows\system32\DRIVERS\AGRSM.sys
22:17:21.0331 7956  AgereSoftModem - ok
22:17:21.0362 7956  [ 13F9E33747E6B41A3FF305C37DB0D360 ] agp440          C:\windows\system32\drivers\agp440.sys
22:17:21.0378 7956  agp440 - ok
22:17:21.0394 7956  [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx         C:\windows\system32\drivers\djsvs.sys
22:17:21.0409 7956  aic78xx - ok
22:17:21.0425 7956  [ A1545B731579895D8CC44FC0481C1192 ] ALG             C:\windows\System32\alg.exe
22:17:21.0534 7956  ALG - ok
22:17:21.0565 7956  [ 9EAEF5FC9B8E351AFA7E78A6FAE91F91 ] aliide          C:\windows\system32\drivers\aliide.sys
22:17:21.0581 7956  aliide - ok
22:17:21.0612 7956  [ C47344BC706E5F0B9DCE369516661578 ] amdagp          C:\windows\system32\drivers\amdagp.sys
22:17:21.0612 7956  amdagp - ok
22:17:21.0628 7956  [ 9B78A39A4C173FDBC1321E0DD659B34C ] amdide          C:\windows\system32\drivers\amdide.sys
22:17:21.0643 7956  amdide - ok
22:17:21.0659 7956  [ 18F29B49AD23ECEE3D2A826C725C8D48 ] AmdK7           C:\windows\system32\drivers\amdk7.sys
22:17:21.0706 7956  AmdK7 - ok
22:17:21.0721 7956  [ 93AE7F7DD54AB986A6F1A1B37BE7442D ] AmdK8           C:\windows\system32\DRIVERS\amdk8.sys
22:17:21.0752 7956  AmdK8 - ok
22:17:21.0830 7956  [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe
22:17:21.0846 7956  AntiVirSchedulerService - ok
22:17:21.0877 7956  [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService  C:\Program Files\Avira\AntiVir Desktop\avguard.exe
22:17:21.0893 7956  AntiVirService - ok
22:17:21.0924 7956  [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo         C:\windows\System32\appinfo.dll
22:17:21.0986 7956  Appinfo - ok
22:17:22.0002 7956  [ 5D2888182FB46632511ACEE92FDAD522 ] arc             C:\windows\system32\drivers\arc.sys
22:17:22.0018 7956  arc - ok
22:17:22.0049 7956  [ 5E2A321BD7C8B3624E41FDEC3E244945 ] arcsas          C:\windows\system32\drivers\arcsas.sys
22:17:22.0049 7956  arcsas - ok
22:17:22.0127 7956  [ 46BA50DE5ADD62AA4CE173EDA629245A ] ASBroker        c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
22:17:22.0127 7956  ASBroker - ok
22:17:22.0142 7956  [ 7BEC093B781A2AC8B270EBD4695ADC97 ] ASChannel       c:\Program Files\Hewlett-Packard\IAM\Bin\AsChnl.dll
22:17:22.0158 7956  ASChannel - ok
22:17:22.0236 7956  [ 40C145F12FF461A0220303BDA134F598 ] aspnet_state    C:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
22:17:22.0252 7956  aspnet_state - ok
22:17:22.0283 7956  [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac        C:\windows\system32\DRIVERS\asyncmac.sys
22:17:22.0314 7956  AsyncMac - ok
22:17:22.0345 7956  [ 2D9C903DC76A66813D350A562DE40ED9 ] atapi           C:\windows\system32\drivers\atapi.sys
22:17:22.0361 7956  atapi - ok
22:17:22.0408 7956  [ 098C7CE10A929C9E101468377609882D ] Ati External Event Utility C:\windows\system32\Ati2evxx.exe
22:17:22.0470 7956  Ati External Event Utility - ok
22:17:22.0610 7956  [ 2DC63AFB58A1B166CF1D1B5A9F144135 ] atikmdag        C:\windows\system32\DRIVERS\atikmdag.sys
22:17:22.0782 7956  atikmdag - ok
22:17:22.0844 7956  [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\windows\System32\Audiosrv.dll
22:17:22.0876 7956  AudioEndpointBuilder - ok
22:17:22.0891 7956  [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv        C:\windows\System32\Audiosrv.dll
22:17:22.0907 7956  Audiosrv - ok
22:17:22.0954 7956  [ D5541F0AFB767E85FC412FC609D96A74 ] avgntflt        C:\windows\system32\DRIVERS\avgntflt.sys
22:17:22.0969 7956  avgntflt - ok
22:17:23.0032 7956  [ 7D967A682D4694DF7FA57D63A2DB01FE ] avipbb          C:\windows\system32\DRIVERS\avipbb.sys
22:17:23.0047 7956  avipbb - ok
22:17:23.0063 7956  [ 271CFD1A989209B1964E24D969552BF7 ] avkmgr          C:\windows\system32\DRIVERS\avkmgr.sys
22:17:23.0078 7956  avkmgr - ok
22:17:23.0110 7956  [ 502F1C30BD50B32D00CE4DCAECC3D3C7 ] b57nd60x        C:\windows\system32\DRIVERS\b57nd60x.sys
22:17:23.0141 7956  b57nd60x - ok
22:17:23.0188 7956  [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep            C:\windows\system32\drivers\Beep.sys
22:17:23.0234 7956  Beep - ok
22:17:23.0297 7956  [ C789AF0F724FDA5852FB9A7D3A432381 ] BFE             C:\windows\System32\bfe.dll
22:17:23.0344 7956  BFE - ok
22:17:23.0390 7956  [ 93952506C6D67330367F7E7934B6A02F ] BITS            C:\windows\System32\qmgr.dll
22:17:23.0437 7956  BITS - ok
22:17:23.0468 7956  [ D4DF28447741FD3D953526E33A617397 ] blbdrive        C:\windows\system32\drivers\blbdrive.sys
22:17:23.0515 7956  blbdrive - ok
22:17:23.0578 7956  [ 70CD6D71FC48BBBD1385D7B35AEADECC ] BMLoad          C:\windows\system32\drivers\BMLoad.sys
22:17:23.0609 7956  BMLoad ( UnsignedFile.Multi.Generic ) - warning
22:17:23.0609 7956  BMLoad - detected UnsignedFile.Multi.Generic (1)
22:17:23.0640 7956  [ 35F376253F687BDE63976CCB3F2108CA ] bowser          C:\windows\system32\DRIVERS\bowser.sys
22:17:23.0687 7956  bowser - ok
22:17:23.0718 7956  [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo        C:\windows\system32\drivers\brfiltlo.sys
22:17:23.0749 7956  BrFiltLo - ok
22:17:23.0749 7956  [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp        C:\windows\system32\drivers\brfiltup.sys
22:17:23.0780 7956  BrFiltUp - ok
22:17:23.0812 7956  [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser         C:\windows\System32\browser.dll
22:17:23.0858 7956  Browser - ok
22:17:23.0890 7956  [ B304E75CFF293029EDDF094246747113 ] Brserid         C:\windows\system32\drivers\brserid.sys
22:17:24.0061 7956  Brserid - ok
22:17:24.0092 7956  [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm        C:\windows\system32\drivers\brserwdm.sys
22:17:24.0155 7956  BrSerWdm - ok
22:17:24.0170 7956  [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm        C:\windows\system32\drivers\brusbmdm.sys
22:17:24.0217 7956  BrUsbMdm - ok
22:17:24.0248 7956  [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer        C:\windows\system32\drivers\brusbser.sys
22:17:24.0295 7956  BrUsbSer - ok
22:17:24.0342 7956  [ 6D39C954799B63BA866910234CF7D726 ] BthEnum         C:\windows\system32\DRIVERS\BthEnum.sys
22:17:24.0373 7956  BthEnum - ok
22:17:24.0404 7956  [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM        C:\windows\system32\drivers\bthmodem.sys
22:17:24.0451 7956  BTHMODEM - ok
22:17:24.0467 7956  [ 5904EFA25F829BF84EA6FB045134A1D8 ] BthPan          C:\windows\system32\DRIVERS\bthpan.sys
22:17:24.0514 7956  BthPan - ok
22:17:24.0592 7956  [ 611FF3F2F095C8D4A6D4CFD9DCC09793 ] BTHPORT         C:\windows\system32\Drivers\BTHport.sys
22:17:24.0670 7956  BTHPORT - ok
22:17:24.0701 7956  [ A4C8377FA4A994E07075107DBE2E3DCE ] BthServ         C:\windows\System32\bthserv.dll
22:17:24.0732 7956  BthServ - ok
22:17:24.0779 7956  [ D330803EAB2A15CAEC7F011F1D4CB30E ] BTHUSB          C:\windows\system32\Drivers\BTHUSB.sys
22:17:24.0810 7956  BTHUSB - ok
22:17:24.0857 7956  [ E6F8C2B62B9EB57D41C0B2C5FD3078A0 ] btwaudio        C:\windows\system32\drivers\btwaudio.sys
22:17:24.0872 7956  btwaudio - ok
22:17:24.0904 7956  [ 195872E48A7FB01F8BC9B800F70F4054 ] btwavdt         C:\windows\system32\drivers\btwavdt.sys
22:17:24.0904 7956  btwavdt - ok
22:17:25.0028 7956  [ 43EBEF8F9328FB6F81E51744167315B9 ] btwdins         C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
22:17:25.0060 7956  btwdins - ok
22:17:25.0091 7956  [ 0724E7D6C9B6A289EDDDA33FA8176E80 ] btwrchid        C:\windows\system32\DRIVERS\btwrchid.sys
22:17:25.0106 7956  btwrchid - ok
22:17:25.0138 7956  [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs            C:\windows\system32\DRIVERS\cdfs.sys
22:17:25.0184 7956  cdfs - ok
22:17:25.0231 7956  [ 6B4BFFB9BECD728097024276430DB314 ] cdrom           C:\windows\system32\DRIVERS\cdrom.sys
22:17:25.0262 7956  cdrom - ok
22:17:25.0309 7956  [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc     C:\windows\System32\certprop.dll
22:17:25.0340 7956  CertPropSvc - ok
22:17:25.0372 7956  [ E5D4133F37219DBCFE102BC61072589D ] circlass        C:\windows\system32\drivers\circlass.sys
22:17:25.0387 7956  circlass - ok
22:17:25.0434 7956  [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS            C:\windows\system32\CLFS.sys
22:17:25.0465 7956  CLFS - ok
22:17:25.0481 7956  [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
22:17:25.0496 7956  clr_optimization_v2.0.50727_32 - ok
22:17:25.0559 7956  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
22:17:25.0574 7956  clr_optimization_v4.0.30319_32 - ok
22:17:25.0621 7956  [ 99AFC3795B58CC478FBBBCDC658FCB56 ] CmBatt          C:\windows\system32\DRIVERS\CmBatt.sys
22:17:25.0652 7956  CmBatt - ok
22:17:25.0668 7956  [ 0CA25E686A4928484E9FDABD168AB629 ] cmdide          C:\windows\system32\drivers\cmdide.sys
22:17:25.0668 7956  cmdide - ok
22:17:25.0730 7956  [ 7795F8CEBC284A426B53F541E538695F ] Com4QLBEx       C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
22:17:25.0746 7956  Com4QLBEx - ok
22:17:25.0746 7956  [ 6AFEF0B60FA25DE07C0968983EE4F60A ] Compbatt        C:\windows\system32\DRIVERS\compbatt.sys
22:17:25.0762 7956  Compbatt - ok
22:17:25.0762 7956  COMSysApp - ok
22:17:25.0777 7956  [ 741E9DFF4F42D2D8477D0FC1DC0DF871 ] crcdisk         C:\windows\system32\drivers\crcdisk.sys
22:17:25.0793 7956  crcdisk - ok
22:17:25.0808 7956  [ 1F07BECDCA750766A96CDA811BA86410 ] Crusoe          C:\windows\system32\drivers\crusoe.sys
22:17:25.0855 7956  Crusoe - ok
22:17:25.0902 7956  [ F1E8C34892336D33EDDCDFE44E474F64 ] CryptSvc        C:\windows\system32\cryptsvc.dll
22:17:25.0933 7956  CryptSvc - ok
22:17:25.0996 7956  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch      C:\windows\system32\rpcss.dll
22:17:26.0042 7956  DcomLaunch - ok
22:17:26.0074 7956  [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC            C:\windows\system32\Drivers\dfsc.sys
22:17:26.0105 7956  DfsC - ok
22:17:26.0183 7956  [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR            C:\windows\system32\DFSR.exe
22:17:26.0292 7956  DFSR - ok
22:17:26.0354 7956  [ 9028559C132146FB75EB7ACF384B086A ] Dhcp            C:\windows\System32\dhcpcsvc.dll
22:17:26.0401 7956  Dhcp - ok
22:17:26.0432 7956  [ 5D4AEFC3386920236A548271F8F1AF6A ] disk            C:\windows\system32\drivers\disk.sys
22:17:26.0448 7956  disk - ok
22:17:26.0495 7956  [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache        C:\windows\System32\dnsrslvr.dll
22:17:26.0526 7956  Dnscache - ok
22:17:26.0573 7956  [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc         C:\windows\System32\dot3svc.dll
22:17:26.0604 7956  dot3svc - ok
22:17:26.0635 7956  [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS             C:\windows\system32\dps.dll
22:17:26.0666 7956  DPS - ok
22:17:26.0698 7956  [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud         C:\windows\system32\drivers\drmkaud.sys
22:17:26.0729 7956  drmkaud - ok
22:17:26.0776 7956  [ C68AC676B0EF30CFBB1080ADCE49EB1F ] DXGKrnl         C:\windows\System32\drivers\dxgkrnl.sys
22:17:26.0838 7956  DXGKrnl - ok
22:17:26.0916 7956  [ 5425F74AC0C1DBD96A1E04F17D63F94C ] E1G60           C:\windows\system32\DRIVERS\E1G60I32.sys
22:17:26.0947 7956  E1G60 - ok
22:17:26.0963 7956  [ C0B95E40D85CD807D614E264248A45B9 ] EapHost         C:\windows\System32\eapsvc.dll
22:17:27.0010 7956  EapHost - ok
22:17:27.0041 7956  [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache          C:\windows\system32\drivers\ecache.sys
22:17:27.0056 7956  Ecache - ok
22:17:27.0103 7956  [ 23B62471681A124889978F6295B3F4C6 ] elxstor         C:\windows\system32\drivers\elxstor.sys
22:17:27.0119 7956  elxstor - ok
22:17:27.0166 7956  [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt         C:\windows\system32\emdmgmt.dll
22:17:27.0228 7956  EMDMgmt - ok
22:17:27.0244 7956  [ 3DB974F3935483555D7148663F726C61 ] ErrDev          C:\windows\system32\drivers\errdev.sys
22:17:27.0275 7956  ErrDev - ok
22:17:27.0306 7956  [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem     C:\windows\system32\es.dll
22:17:27.0353 7956  EventSystem - ok
22:17:27.0415 7956  [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat           C:\windows\system32\drivers\exfat.sys
22:17:27.0446 7956  exfat - ok
22:17:27.0478 7956  [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat         C:\windows\system32\drivers\fastfat.sys
22:17:27.0509 7956  fastfat - ok
22:17:27.0556 7956  [ AFE1E8B9782A0DD7FB46BBD88E43F89A ] fdc             C:\windows\system32\DRIVERS\fdc.sys
22:17:27.0587 7956  fdc - ok
22:17:27.0618 7956  [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost         C:\windows\system32\fdPHost.dll
22:17:27.0634 7956  fdPHost - ok
22:17:27.0665 7956  [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub        C:\windows\system32\fdrespub.dll
22:17:27.0696 7956  FDResPub - ok
22:17:27.0712 7956  [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo        C:\windows\system32\drivers\fileinfo.sys
22:17:27.0727 7956  FileInfo - ok
22:17:27.0743 7956  [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace       C:\windows\system32\drivers\filetrace.sys
22:17:27.0774 7956  Filetrace - ok
22:17:27.0790 7956  [ 85B7CF99D532820495D68D747FDA9EBD ] flpydisk        C:\windows\system32\DRIVERS\flpydisk.sys
22:17:27.0821 7956  flpydisk - ok
22:17:27.0868 7956  [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr          C:\windows\system32\drivers\fltmgr.sys
22:17:27.0883 7956  FltMgr - ok
22:17:27.0961 7956  [ 8CE364388C8ECA59B14B539179276D44 ] FontCache       C:\windows\system32\FntCache.dll
22:17:28.0008 7956  FontCache - ok
22:17:28.0086 7956  [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
22:17:28.0102 7956  FontCache3.0.0.0 - ok
22:17:28.0133 7956  [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec          C:\windows\system32\drivers\Fs_Rec.sys
22:17:28.0164 7956  Fs_Rec - ok
22:17:28.0195 7956  [ 34582A6E6573D54A07ECE5FE24A126B5 ] gagp30kx        C:\windows\system32\drivers\gagp30kx.sys
22:17:28.0195 7956  gagp30kx - ok
22:17:28.0242 7956  [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc           C:\windows\System32\gpsvc.dll
22:17:28.0336 7956  gpsvc - ok
22:17:28.0414 7956  [ 626A24ED1228580B9518C01930936DF9 ] gupdate         C:\Program Files\Google\Update\GoogleUpdate.exe
22:17:28.0429 7956  gupdate - ok
22:17:28.0429 7956  [ 626A24ED1228580B9518C01930936DF9 ] gupdatem        C:\Program Files\Google\Update\GoogleUpdate.exe
22:17:28.0445 7956  gupdatem - ok
22:17:28.0507 7956  [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc           C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
22:17:28.0523 7956  gusvc - ok
22:17:28.0538 7956  [ 88A78635B41ED4B261365FADEB28FE81 ] HBtnKey         C:\windows\system32\DRIVERS\cpqbttn.sys
22:17:28.0570 7956  HBtnKey - ok
22:17:28.0616 7956  [ CB04C744BE0A61B1D648FAED182C3B59 ] HdAudAddService C:\windows\system32\drivers\HdAudio.sys
22:17:28.0679 7956  HdAudAddService - ok
22:17:28.0741 7956  [ 062452B7FFD68C8C042A6261FE8DFF4A ] HDAudBus        C:\windows\system32\DRIVERS\HDAudBus.sys
22:17:28.0772 7956  HDAudBus - ok
22:17:28.0804 7956  [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth          C:\windows\system32\drivers\hidbth.sys
22:17:28.0850 7956  HidBth - ok
22:17:28.0897 7956  [ FF3160C3A2445128C5A6D9B076DA519E ] HidIr           C:\windows\system32\drivers\hidir.sys
22:17:28.0944 7956  HidIr - ok
22:17:29.0006 7956  [ 84067081F3318162797385E11A8F0582 ] hidserv         C:\windows\system32\hidserv.dll
22:17:29.0038 7956  hidserv - ok
22:17:29.0084 7956  [ CCA4B519B17E23A00B826C55716809CC ] HidUsb          C:\windows\system32\DRIVERS\hidusb.sys
22:17:29.0116 7956  HidUsb - ok
22:17:29.0162 7956  [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc          C:\windows\system32\kmsvc.dll
22:17:29.0194 7956  hkmsvc - ok
22:17:29.0256 7956  [ D13E6BFD7E9189D26A42E94CB2447044 ] HP Health Check Service c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
22:17:29.0256 7956  HP Health Check Service ( UnsignedFile.Multi.Generic ) - warning
22:17:29.0256 7956  HP Health Check Service - detected UnsignedFile.Multi.Generic (1)
22:17:29.0303 7956  [ 07A85D6C053A0999FF450BBCA9825FB2 ] HP ProtectTools Service c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe
22:17:29.0318 7956  HP ProtectTools Service - ok
22:17:29.0334 7956  [ 16EE7B23A009E00D835CDB79574A91A6 ] HpCISSs         C:\windows\system32\drivers\hpcisss.sys
22:17:29.0350 7956  HpCISSs - ok
22:17:29.0396 7956  [ 3520A74FCA88A5AEFBBE7B937BEA75F7 ] hpdskflt        C:\windows\system32\DRIVERS\hpdskflt.sys
22:17:29.0396 7956  hpdskflt - ok
22:17:29.0443 7956  [ EB734EF9D7C4D02760F2D1342331BA41 ] HpFkCryptService c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
22:17:29.0459 7956  HpFkCryptService - ok
22:17:29.0490 7956  [ EF55CD76A05A0675FE930036B7773943 ] HPFSService     C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
22:17:29.0506 7956  HPFSService ( UnsignedFile.Multi.Generic ) - warning
22:17:29.0506 7956  HPFSService - detected UnsignedFile.Multi.Generic (1)
22:17:29.0615 7956  [ B14328CFEEB6B736BE44C2C9DB3B162C ] hpqcxs08        C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
22:17:29.0646 7956  hpqcxs08 ( UnsignedFile.Multi.Generic ) - warning
22:17:29.0646 7956  hpqcxs08 - detected UnsignedFile.Multi.Generic (1)
22:17:29.0677 7956  [ DF446BA625CC441617843E87798CE048 ] hpqddsvc        C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
22:17:29.0693 7956  hpqddsvc ( UnsignedFile.Multi.Generic ) - warning
22:17:29.0693 7956  hpqddsvc - detected UnsignedFile.Multi.Generic (1)
22:17:29.0724 7956  [ 35956140E686D53BF676CF0C778880FC ] HpqKbFiltr      C:\windows\system32\DRIVERS\HpqKbFiltr.sys
22:17:29.0771 7956  HpqKbFiltr - ok
22:17:29.0802 7956  [ 1665C7121A026DF10C903DB9BC5E9D43 ] hpqwmiex        C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
22:17:29.0818 7956  hpqwmiex - ok
22:17:29.0880 7956  [ 75F122CDCA3C71BD09089F2CA824B796 ] HPSLPSVC        C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL
22:17:29.0927 7956  HPSLPSVC ( UnsignedFile.Multi.Generic ) - warning
22:17:29.0927 7956  HPSLPSVC - detected UnsignedFile.Multi.Generic (1)
22:17:29.0958 7956  [ 3E940775A4970410F094E428BA94BBB7 ] hpsrv           C:\windows\system32\Hpservice.exe
22:17:29.0958 7956  hpsrv - ok
22:17:30.0052 7956  [ 65D37BD167DD35C3663F4F097174E891 ] HSPADataCardusbmdm C:\windows\system32\DRIVERS\HSPADataCardusbmdm.sys
22:17:30.0083 7956  HSPADataCardusbmdm - ok
22:17:30.0130 7956  [ 65D37BD167DD35C3663F4F097174E891 ] HSPADataCardusbnmea C:\windows\system32\DRIVERS\HSPADataCardusbnmea.sys
22:17:30.0145 7956  HSPADataCardusbnmea - ok
22:17:30.0176 7956  [ 65D37BD167DD35C3663F4F097174E891 ] HSPADataCardusbser C:\windows\system32\DRIVERS\HSPADataCardusbser.sys
22:17:30.0192 7956  HSPADataCardusbser - ok
22:17:30.0254 7956  [ 0EEECA26C8D4BDE2A4664DB058A81937 ] HTTP            C:\windows\system32\drivers\HTTP.sys
22:17:30.0286 7956  HTTP - ok
22:17:30.0317 7956  [ C6B032D69650985468160FC9937CF5B4 ] i2omp           C:\windows\system32\drivers\i2omp.sys
22:17:30.0332 7956  i2omp - ok
22:17:30.0379 7956  [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt        C:\windows\system32\DRIVERS\i8042prt.sys
22:17:30.0410 7956  i8042prt - ok
22:17:30.0473 7956  [ 3AD7614C487C948ADD435662265750FB ] IAANTMON        C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
22:17:30.0488 7956  IAANTMON - ok
22:17:30.0520 7956  [ DB0CC620B27A928D968C1A1E9CD9CB87 ] iaStor          C:\windows\system32\drivers\iastor.sys
22:17:30.0535 7956  iaStor - ok
22:17:30.0551 7956  [ 54155EA1B0DF185878E0FC9EC3AC3A14 ] iaStorV         C:\windows\system32\drivers\iastorv.sys
22:17:30.0566 7956  iaStorV - ok
22:17:30.0613 7956  [ 6F95324909B502E2651442C1548AB12F ] IDriverT        C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
22:17:30.0629 7956  IDriverT ( UnsignedFile.Multi.Generic ) - warning
22:17:30.0629 7956  IDriverT - detected UnsignedFile.Multi.Generic (1)
22:17:30.0691 7956  [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc           C:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
22:17:30.0738 7956  idsvc - ok
22:17:30.0754 7956  [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp           C:\windows\system32\drivers\iirsp.sys
22:17:30.0769 7956  iirsp - ok
22:17:30.0832 7956  [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT          C:\windows\System32\ikeext.dll
22:17:30.0878 7956  IKEEXT - ok
22:17:30.0894 7956  [ 83AA759F3189E6370C30DE5DC5590718 ] intelide        C:\windows\system32\drivers\intelide.sys
22:17:30.0910 7956  intelide - ok
22:17:30.0941 7956  [ 224191001E78C89DFA78924C3EA595FF ] intelppm        C:\windows\system32\DRIVERS\intelppm.sys
22:17:30.0972 7956  intelppm - ok
22:17:31.0003 7956  [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum       C:\windows\system32\ipbusenum.dll
22:17:31.0019 7956  IPBusEnum - ok
22:17:31.0034 7956  [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver  C:\windows\system32\DRIVERS\ipfltdrv.sys
22:17:31.0081 7956  IpFilterDriver - ok
22:17:31.0112 7956  [ 1998BD97F950680BB55F55A7244679C2 ] iphlpsvc        C:\windows\System32\iphlpsvc.dll
22:17:31.0144 7956  iphlpsvc - ok
22:17:31.0144 7956  IpInIp - ok
22:17:31.0175 7956  [ B25AAF203552B7B3491139D582B39AD1 ] IPMIDRV         C:\windows\system32\drivers\ipmidrv.sys
22:17:31.0222 7956  IPMIDRV - ok
22:17:31.0237 7956  [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT           C:\windows\system32\DRIVERS\ipnat.sys
22:17:31.0268 7956  IPNAT - ok
22:17:31.0268 7956  [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM          C:\windows\system32\drivers\irenum.sys
22:17:31.0315 7956  IRENUM - ok
22:17:31.0331 7956  [ 6C70698A3E5C4376C6AB5C7C17FB0614 ] isapnp          C:\windows\system32\drivers\isapnp.sys
22:17:31.0331 7956  isapnp - ok
22:17:31.0378 7956  [ 232FA340531D940AAC623B121A595034 ] iScsiPrt        C:\windows\system32\DRIVERS\msiscsi.sys
22:17:31.0393 7956  iScsiPrt - ok
22:17:31.0409 7956  [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi        C:\windows\system32\drivers\iteatapi.sys
22:17:31.0424 7956  iteatapi - ok
22:17:31.0440 7956  [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid         C:\windows\system32\drivers\iteraid.sys
22:17:31.0456 7956  iteraid - ok
22:17:31.0502 7956  [ 213822072085B5BBAD9AF30AB577D817 ] IviRegMgr       C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
22:17:31.0518 7956  IviRegMgr - ok
22:17:31.0534 7956  [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass        C:\windows\system32\DRIVERS\kbdclass.sys
22:17:31.0534 7956  kbdclass - ok
22:17:31.0580 7956  [ EDE59EC70E25C24581ADD1FBEC7325F7 ] kbdhid          C:\windows\system32\DRIVERS\kbdhid.sys
22:17:31.0612 7956  kbdhid - ok
22:17:31.0627 7956  [ A3E186B4B935905B829219502557314E ] KeyIso          C:\windows\system32\lsass.exe
22:17:31.0658 7956  KeyIso - ok
22:17:31.0721 7956  [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD          C:\windows\system32\Drivers\ksecdd.sys
22:17:31.0752 7956  KSecDD - ok
22:17:31.0799 7956  [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm           C:\windows\system32\msdtckrm.dll
22:17:31.0830 7956  KtmRm - ok
22:17:31.0877 7956  [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer    C:\windows\system32\srvsvc.dll
22:17:31.0924 7956  LanmanServer - ok
22:17:32.0002 7956  [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\windows\System32\wkssvc.dll
22:17:32.0048 7956  LanmanWorkstation - ok
22:17:32.0095 7956  [ C215E09622118383B236DD56C2065183 ] LightScribeService C:\Program Files\Common Files\LightScribe\LSSrvc.exe
22:17:32.0111 7956  LightScribeService ( UnsignedFile.Multi.Generic ) - warning
22:17:32.0111 7956  LightScribeService - detected UnsignedFile.Multi.Generic (1)
22:17:32.0126 7956  [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio          C:\windows\system32\DRIVERS\lltdio.sys
22:17:32.0173 7956  lltdio - ok
22:17:32.0204 7956  [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc         C:\windows\System32\lltdsvc.dll
22:17:32.0251 7956  lltdsvc - ok
22:17:32.0282 7956  [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts         C:\windows\System32\lmhsvc.dll
22:17:32.0314 7956  lmhosts - ok
22:17:32.0329 7956  [ C7E15E82879BF3235B559563D4185365 ] LSI_FC          C:\windows\system32\drivers\lsi_fc.sys
22:17:32.0345 7956  LSI_FC - ok
22:17:32.0360 7956  [ EE01EBAE8C9BF0FA072E0FF68718920A ] LSI_SAS         C:\windows\system32\drivers\lsi_sas.sys
22:17:32.0376 7956  LSI_SAS - ok
22:17:32.0376 7956  [ 912A04696E9CA30146A62AFA1463DD5C ] LSI_SCSI        C:\windows\system32\drivers\lsi_scsi.sys
22:17:32.0392 7956  LSI_SCSI - ok
22:17:32.0407 7956  [ 8F5C7426567798E62A3B3614965D62CC ] luafv           C:\windows\system32\drivers\luafv.sys
22:17:32.0438 7956  luafv - ok
22:17:32.0470 7956  [ D5673785903639D186DC345FF86F423F ] massfilter      C:\windows\system32\DRIVERS\massfilter.sys
22:17:32.0485 7956  massfilter - ok
22:17:32.0532 7956  [ 500D089CE760D83DA2B6CBA681AA9949 ] MBAMProtector   C:\windows\system32\drivers\mbam.sys
22:17:32.0548 7956  MBAMProtector - ok
22:17:32.0579 7956  [ 85B16A92B117A5A800032ECD904B86DB ] MBAMScheduler   C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
22:17:32.0594 7956  MBAMScheduler - ok
22:17:32.0626 7956  [ 20E2469DB709FC675E655CEAA11BE312 ] MBAMService     C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
22:17:32.0657 7956  MBAMService - ok
22:17:32.0688 7956  [ 0001CE609D66632FA17B84705F658879 ] megasas         C:\windows\system32\drivers\megasas.sys
22:17:32.0704 7956  megasas - ok
22:17:32.0719 7956  [ C252F32CD9A49DBFC25ECF26EBD51A99 ] MegaSR          C:\windows\system32\drivers\megasr.sys
22:17:32.0797 7956  MegaSR - ok
22:17:32.0813 7956  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS           C:\windows\system32\mmcss.dll
22:17:32.0860 7956  MMCSS - ok
22:17:32.0875 7956  [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem           C:\windows\system32\drivers\modem.sys
22:17:32.0906 7956  Modem - ok
22:17:32.0938 7956  [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor         C:\windows\system32\DRIVERS\monitor.sys
22:17:32.0969 7956  monitor - ok
22:17:32.0984 7956  [ 5BF6A1326A335C5298477754A506D263 ] mouclass        C:\windows\system32\DRIVERS\mouclass.sys
22:17:33.0000 7956  mouclass - ok
22:17:33.0016 7956  [ 93B8D4869E12CFBE663915502900876F ] mouhid          C:\windows\system32\DRIVERS\mouhid.sys
22:17:33.0047 7956  mouhid - ok
22:17:33.0078 7956  [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr        C:\windows\system32\drivers\mountmgr.sys
22:17:33.0094 7956  MountMgr - ok
22:17:33.0109 7956  [ 511D011289755DD9F9A7579FB0B064E6 ] mpio            C:\windows\system32\drivers\mpio.sys
22:17:33.0125 7956  mpio - ok
22:17:33.0125 7956  [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv          C:\windows\system32\drivers\mpsdrv.sys
22:17:33.0172 7956  mpsdrv - ok
22:17:33.0203 7956  [ 5DE62C6E9108F14F6794060A9BDECAEC ] MpsSvc          C:\windows\system32\mpssvc.dll
22:17:33.0234 7956  MpsSvc - ok
22:17:33.0265 7956  [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x        C:\windows\system32\drivers\mraid35x.sys
22:17:33.0265 7956  Mraid35x - ok
22:17:33.0312 7956  [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV          C:\windows\system32\drivers\mrxdav.sys
22:17:33.0328 7956  MRxDAV - ok
22:17:33.0359 7956  [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb          C:\windows\system32\DRIVERS\mrxsmb.sys
22:17:33.0390 7956  mrxsmb - ok
22:17:33.0421 7956  [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10        C:\windows\system32\DRIVERS\mrxsmb10.sys
22:17:33.0452 7956  mrxsmb10 - ok
22:17:33.0468 7956  [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20        C:\windows\system32\DRIVERS\mrxsmb20.sys
22:17:33.0484 7956  mrxsmb20 - ok
22:17:33.0499 7956  [ 28023E86F17001F7CD9B15A5BC9AE07D ] msahci          C:\windows\system32\drivers\msahci.sys
22:17:33.0499 7956  msahci - ok
22:17:33.0530 7956  [ 4468B0F385A86ECDDAF8D3CA662EC0E7 ] msdsm           C:\windows\system32\drivers\msdsm.sys
22:17:33.0546 7956  msdsm - ok
22:17:33.0562 7956  [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC           C:\windows\System32\msdtc.exe
22:17:33.0608 7956  MSDTC - ok
22:17:33.0624 7956  [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs            C:\windows\system32\drivers\Msfs.sys
22:17:33.0671 7956  Msfs - ok
22:17:33.0686 7956  [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv        C:\windows\system32\drivers\msisadrv.sys
22:17:33.0702 7956  msisadrv - ok
22:17:33.0733 7956  [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI         C:\windows\system32\iscsiexe.dll
22:17:33.0780 7956  MSiSCSI - ok
22:17:33.0780 7956  msiserver - ok
22:17:33.0796 7956  [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV         C:\windows\system32\drivers\MSKSSRV.sys
22:17:33.0842 7956  MSKSSRV - ok
22:17:33.0858 7956  [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK        C:\windows\system32\drivers\MSPCLOCK.sys
22:17:33.0905 7956  MSPCLOCK - ok
22:17:33.0920 7956  [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM           C:\windows\system32\drivers\MSPQM.sys
22:17:33.0967 7956  MSPQM - ok
22:17:33.0998 7956  [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC           C:\windows\system32\drivers\MsRPC.sys
22:17:34.0014 7956  MsRPC - ok
22:17:34.0030 7956  [ E384487CB84BE41D09711C30CA79646C ] mssmbios        C:\windows\system32\DRIVERS\mssmbios.sys
22:17:34.0045 7956  mssmbios - ok
22:17:34.0061 7956  [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE           C:\windows\system32\drivers\MSTEE.sys
22:17:34.0092 7956  MSTEE - ok
22:17:34.0108 7956  [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup             C:\windows\system32\Drivers\mup.sys
22:17:34.0108 7956  Mup - ok
22:17:34.0154 7956  [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent        C:\windows\system32\qagentRT.dll
22:17:34.0186 7956  napagent - ok
22:17:34.0217 7956  [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP     C:\windows\system32\DRIVERS\nwifi.sys
22:17:34.0248 7956  NativeWifiP - ok
22:17:34.0279 7956  [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS            C:\windows\system32\drivers\ndis.sys
22:17:34.0310 7956  NDIS - ok
22:17:34.0326 7956  [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi        C:\windows\system32\DRIVERS\ndistapi.sys
22:17:34.0357 7956  NdisTapi - ok
22:17:34.0373 7956  [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio         C:\windows\system32\DRIVERS\ndisuio.sys
22:17:34.0404 7956  Ndisuio - ok
22:17:34.0420 7956  [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan         C:\windows\system32\DRIVERS\ndiswan.sys
22:17:34.0451 7956  NdisWan - ok
22:17:34.0451 7956  [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy         C:\windows\system32\drivers\NDProxy.sys
22:17:34.0482 7956  NDProxy - ok
22:17:34.0529 7956  [ A081CB6FB9A12668F233EB5414BE3A0E ] Net Driver HPZ12 C:\windows\system32\HPZinw12.dll
22:17:34.0544 7956  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
22:17:34.0544 7956  Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
22:17:34.0576 7956  [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS         C:\windows\system32\DRIVERS\netbios.sys
22:17:34.0607 7956  NetBIOS - ok
22:17:34.0638 7956  [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt           C:\windows\system32\DRIVERS\netbt.sys
22:17:34.0669 7956  netbt - ok
22:17:34.0685 7956  [ A3E186B4B935905B829219502557314E ] Netlogon        C:\windows\system32\lsass.exe
22:17:34.0700 7956  Netlogon - ok
22:17:34.0732 7956  [ C8052711DAECC48B982434C5116CA401 ] Netman          C:\windows\System32\netman.dll
22:17:34.0778 7956  Netman - ok
22:17:34.0794 7956  [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm        C:\windows\System32\netprofm.dll
22:17:34.0841 7956  netprofm - ok
22:17:34.0872 7956  [ D6C4E4A39A36029AC0813D476FBD0248 ] NetTcpPortSharing C:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
22:17:34.0888 7956  NetTcpPortSharing - ok
22:17:35.0028 7956  [ E559EA9138C77B5D1FDA8C558764A25F ] NETw5v32        C:\windows\system32\DRIVERS\NETw5v32.sys
22:17:35.0231 7956  NETw5v32 - ok
22:17:35.0246 7956  [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960         C:\windows\system32\drivers\nfrd960.sys
22:17:35.0262 7956  nfrd960 - ok
22:17:35.0293 7956  [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc          C:\windows\System32\nlasvc.dll
22:17:35.0340 7956  NlaSvc - ok
22:17:35.0356 7956  [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs            C:\windows\system32\drivers\Npfs.sys
22:17:35.0371 7956  Npfs - ok
22:17:35.0387 7956  [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi             C:\windows\system32\nsisvc.dll
22:17:35.0418 7956  nsi - ok
22:17:35.0434 7956  [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy        C:\windows\system32\drivers\nsiproxy.sys
22:17:35.0465 7956  nsiproxy - ok
22:17:35.0512 7956  [ 6A4A98CEE84CF9E99564510DDA4BAA47 ] Ntfs            C:\windows\system32\drivers\Ntfs.sys
22:17:35.0558 7956  Ntfs - ok
22:17:35.0636 7956  [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi       C:\windows\system32\drivers\ntrigdigi.sys
22:17:35.0683 7956  ntrigdigi - ok
22:17:35.0699 7956  [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null            C:\windows\system32\drivers\Null.sys
22:17:35.0714 7956  Null - ok
22:17:35.0730 7956  [ 2EDF9E7751554B42CBB60116DE727101 ] nvraid          C:\windows\system32\drivers\nvraid.sys
22:17:35.0746 7956  nvraid - ok
22:17:35.0761 7956  [ ABED0C09758D1D97DB0042DBB2688177 ] nvstor          C:\windows\system32\drivers\nvstor.sys
22:17:35.0777 7956  nvstor - ok
22:17:35.0792 7956  [ 18BBDF913916B71BD54575BDB6EEAC0B ] nv_agp          C:\windows\system32\drivers\nv_agp.sys
22:17:35.0808 7956  nv_agp - ok
22:17:35.0870 7956  [ AA62BA29EF342D805555196F46FCAA4E ] NWADI           C:\windows\system32\DRIVERS\NWADIenum.sys
22:17:35.0902 7956  NWADI - ok
22:17:35.0917 7956  NwlnkFlt - ok
22:17:35.0917 7956  NwlnkFwd - ok
22:17:35.0933 7956  [ 790E27C3DB53410B40FF9EF2FD10A1D9 ] ohci1394        C:\windows\system32\DRIVERS\ohci1394.sys
22:17:35.0980 7956  ohci1394 - ok
22:17:36.0011 7956  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc        C:\windows\system32\p2psvc.dll
22:17:36.0058 7956  p2pimsvc - ok
22:17:36.0073 7956  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc          C:\windows\system32\p2psvc.dll
22:17:36.0104 7956  p2psvc - ok
22:17:36.0167 7956  [ 8A79FDF04A73428597E2CAF9D0D67850 ] Parport         C:\windows\system32\DRIVERS\parport.sys
22:17:36.0198 7956  Parport - ok
22:17:36.0245 7956  [ B9C2B89F08670E159F7181891E449CD9 ] partmgr         C:\windows\system32\drivers\partmgr.sys
22:17:36.0260 7956  partmgr - ok
22:17:36.0276 7956  [ 6C580025C81CAF3AE9E3617C22CAD00E ] Parvdm          C:\windows\system32\DRIVERS\parvdm.sys
22:17:36.0323 7956  Parvdm - ok
22:17:36.0338 7956  PCASp50 - ok
22:17:36.0370 7956  [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc          C:\windows\System32\pcasvc.dll
22:17:36.0401 7956  PcaSvc - ok
22:17:36.0448 7956  [ 941DC1D19E7E8620F40BBC206981EFDB ] pci             C:\windows\system32\drivers\pci.sys
22:17:36.0463 7956  pci - ok
22:17:36.0479 7956  [ FC175F5DDAB666D7F4D17449A547626F ] pciide          C:\windows\system32\drivers\pciide.sys
22:17:36.0494 7956  pciide - ok
22:17:36.0572 7956  [ E3993FD134812E55FC8885D924D46D58 ] PCloudd         C:\Program Files\Iomega Storage Manager\pCloudd.exe
22:17:36.0588 7956  PCloudd ( UnsignedFile.Multi.Generic ) - warning
22:17:36.0588 7956  PCloudd - detected UnsignedFile.Multi.Generic (1)
22:17:36.0619 7956  [ B7C5A8769541900F6DFA6FE0C5E4D513 ] pcmcia          C:\windows\system32\DRIVERS\pcmcia.sys
22:17:36.0635 7956  pcmcia - ok
22:17:36.0666 7956  pdfcDispatcher - ok
22:17:36.0713 7956  [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH          C:\windows\system32\drivers\peauth.sys
22:17:36.0791 7956  PEAUTH - ok
22:17:36.0869 7956  [ B1689DF169143F57053F795390C99DB3 ] pla             C:\windows\system32\pla.dll
22:17:36.0994 7956  pla - ok
22:17:37.0025 7956  [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay        C:\windows\system32\umpnpmgr.dll
22:17:37.0056 7956  PlugPlay - ok
22:17:37.0103 7956  [ 65BC271F337637731D3C71455AE1F476 ] Pml Driver HPZ12 C:\windows\system32\HPZipm12.dll
22:17:37.0118 7956  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
22:17:37.0118 7956  Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
22:17:37.0134 7956  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg     C:\windows\system32\p2psvc.dll
22:17:37.0243 7956  PNRPAutoReg - ok
22:17:37.0259 7956  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc         C:\windows\system32\p2psvc.dll
22:17:37.0274 7956  PNRPsvc - ok
22:17:37.0337 7956  [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent     C:\windows\System32\ipsecsvc.dll
22:17:37.0368 7956  PolicyAgent - ok
22:17:37.0399 7956  [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport    C:\windows\system32\DRIVERS\raspptp.sys
22:17:37.0430 7956  PptpMiniport - ok
22:17:37.0446 7956  [ 2027293619DD0F047C584CF2E7DF4FFD ] Processor       C:\windows\system32\drivers\processr.sys
22:17:37.0462 7956  Processor - ok
22:17:37.0493 7956  [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc         C:\windows\system32\profsvc.dll
22:17:37.0508 7956  ProfSvc - ok
22:17:37.0524 7956  [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\windows\system32\lsass.exe
22:17:37.0540 7956  ProtectedStorage - ok
22:17:37.0571 7956  [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched          C:\windows\system32\DRIVERS\pacer.sys
22:17:37.0602 7956  PSched - ok
22:17:37.0649 7956  [ 153D02480A0A2F45785522E814C634B6 ] PxHelp20        C:\windows\system32\Drivers\PxHelp20.sys
22:17:37.0664 7956  PxHelp20 - ok
22:17:37.0727 7956  [ 0A6DB55AFB7820C99AA1F3A1D270F4F6 ] ql2300          C:\windows\system32\drivers\ql2300.sys
22:17:37.0789 7956  ql2300 - ok
22:17:37.0805 7956  [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx          C:\windows\system32\drivers\ql40xx.sys
22:17:37.0820 7956  ql40xx - ok
22:17:37.0867 7956  [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE           C:\windows\system32\qwave.dll
22:17:37.0898 7956  QWAVE - ok
22:17:37.0930 7956  [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv        C:\windows\system32\drivers\qwavedrv.sys
22:17:37.0945 7956  QWAVEdrv - ok
22:17:38.0008 7956  [ 70DBDAB246C18B78E2200D6401D038BE ] RapiMgr         C:\windows\WindowsMobile\rapimgr.dll
22:17:38.0054 7956  RapiMgr - ok
22:17:38.0070 7956  [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd          C:\windows\system32\DRIVERS\rasacd.sys
22:17:38.0101 7956  RasAcd - ok
22:17:38.0117 7956  [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto         C:\windows\System32\rasauto.dll
22:17:38.0164 7956  RasAuto - ok
22:17:38.0179 7956  [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp         C:\windows\system32\DRIVERS\rasl2tp.sys
22:17:38.0210 7956  Rasl2tp - ok
22:17:38.0242 7956  [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan          C:\windows\System32\rasmans.dll
22:17:38.0273 7956  RasMan - ok
22:17:38.0288 7956  [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe        C:\windows\system32\DRIVERS\raspppoe.sys
22:17:38.0320 7956  RasPppoe - ok
22:17:38.0351 7956  [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp         C:\windows\system32\DRIVERS\rassstp.sys
22:17:38.0366 7956  RasSstp - ok
22:17:38.0398 7956  [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss           C:\windows\system32\DRIVERS\rdbss.sys
22:17:38.0429 7956  rdbss - ok
22:17:38.0460 7956  [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD          C:\windows\system32\DRIVERS\RDPCDD.sys
22:17:38.0491 7956  RDPCDD - ok
22:17:38.0507 7956  [ FBC0BACD9C3D7F6956853F64A66E252D ] rdpdr           C:\windows\system32\drivers\rdpdr.sys
22:17:38.0538 7956  rdpdr - ok
22:17:38.0554 7956  [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD        C:\windows\system32\drivers\rdpencdd.sys
22:17:38.0585 7956  RDPENCDD - ok
22:17:38.0616 7956  [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD           C:\windows\system32\drivers\RDPWD.sys
22:17:38.0647 7956  RDPWD - ok
22:17:38.0678 7956  [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess    C:\windows\System32\mprdim.dll
22:17:38.0694 7956  RemoteAccess - ok
22:17:38.0741 7956  [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry  C:\windows\system32\regsvc.dll
22:17:38.0772 7956  RemoteRegistry - ok
22:17:38.0803 7956  [ 6482707F9F4DA0ECBAB43B2E0398A101 ] RFCOMM          C:\windows\system32\DRIVERS\rfcomm.sys
22:17:38.0850 7956  RFCOMM - ok
22:17:38.0912 7956  [ EEC7EE5675294B03E88AA868540007C1 ] RMCAST          C:\windows\system32\DRIVERS\RMCAST.sys
22:17:38.0944 7956  RMCAST - ok
22:17:39.0068 7956  [ 5C13017FC008F8492D03143634A479CE ] RoxMediaDB10    c:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
22:17:39.0115 7956  RoxMediaDB10 - ok
22:17:39.0146 7956  [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator      C:\windows\system32\locator.exe
22:17:39.0193 7956  RpcLocator - ok
22:17:39.0256 7956  [ 6684437F3628EF237C354F77D33426D1 ] rpcnet          C:\windows\system32\rpcnet.exe
22:17:39.0271 7956  rpcnet - ok
22:17:39.0302 7956  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs           C:\windows\system32\rpcss.dll
22:17:39.0349 7956  RpcSs - ok
22:17:39.0396 7956  [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr          C:\windows\system32\DRIVERS\rspndr.sys
22:17:39.0427 7956  rspndr - ok
22:17:39.0458 7956  [ 3BEEFE509C414F3A6E55E5C7C4024581 ] RsvLock         C:\windows\system32\drivers\RsvLock.sys
22:17:39.0474 7956  RsvLock - ok
22:17:39.0474 7956  [ 2A5EEDCB22A5D6BB0231E38A38E7A7D9 ] SafeBoot        C:\windows\system32\drivers\SafeBoot.sys
22:17:39.0474 7956  Suspicious file (NoAccess): C:\windows\system32\drivers\SafeBoot.sys. md5: 2A5EEDCB22A5D6BB0231E38A38E7A7D9
22:17:39.0474 7956  SafeBoot ( LockedFile.Multi.Generic ) - warning
22:17:39.0474 7956  SafeBoot - detected LockedFile.Multi.Generic (1)
22:17:39.0490 7956  [ A3E186B4B935905B829219502557314E ] SamSs           C:\windows\system32\lsass.exe
22:17:39.0505 7956  SamSs - ok
22:17:39.0505 7956  [ 52DCDE2D1787217E15FFDCA1CBF8CCE9 ] SbAlg           C:\windows\system32\drivers\SbAlg.sys
22:17:39.0521 7956  SbAlg - ok
22:17:39.0536 7956  [ 69A5AF9CE49A0982E7AE7C7D62BDB2B1 ] SbFsLock        C:\windows\system32\drivers\SbFsLock.sys
22:17:39.0552 7956  SbFsLock - ok
22:17:39.0552 7956  [ 3CE8F073A557E172B330109436984E30 ] sbp2port        C:\windows\system32\drivers\sbp2port.sys
22:17:39.0568 7956  sbp2port - ok
22:17:39.0599 7956  [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr        C:\windows\System32\SCardSvr.dll
22:17:39.0614 7956  SCardSvr - ok
22:17:39.0661 7956  [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule        C:\windows\system32\schedsvc.dll
22:17:39.0724 7956  Schedule - ok
22:17:39.0755 7956  [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc     C:\windows\System32\certprop.dll
22:17:39.0770 7956  SCPolicySvc - ok
22:17:39.0817 7956  [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC          C:\windows\System32\SDRSVC.dll
22:17:39.0864 7956  SDRSVC - ok
22:17:39.0895 7956  [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv          C:\windows\system32\drivers\secdrv.sys
22:17:39.0942 7956  secdrv - ok
22:17:39.0958 7956  [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon        C:\windows\system32\seclogon.dll
22:17:40.0004 7956  seclogon - ok
22:17:40.0020 7956  [ A9BBAB5759771E523F55563D6CBE140F ] SENS            C:\windows\System32\sens.dll
22:17:40.0067 7956  SENS - ok
22:17:40.0082 7956  [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum         C:\windows\system32\drivers\serenum.sys
22:17:40.0129 7956  Serenum - ok
22:17:40.0145 7956  [ C70D69A918B178D3C3B06339B40C2E1B ] Serial          C:\windows\system32\drivers\serial.sys
22:17:40.0207 7956  Serial - ok
22:17:40.0254 7956  [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse        C:\windows\system32\drivers\sermouse.sys
22:17:40.0270 7956  sermouse - ok
22:17:40.0316 7956  [ D2193326F729B163125610DBF3E17D57 ] SessionEnv      C:\windows\system32\sessenv.dll
22:17:40.0348 7956  SessionEnv - ok
22:17:40.0363 7956  [ 3EFA810BDCA87F6ECC24F9832243FE86 ] sffdisk         C:\windows\system32\drivers\sffdisk.sys
22:17:40.0379 7956  sffdisk - ok
22:17:40.0394 7956  [ E95D451F7EA3E583AEC75F3B3EE42DC5 ] sffp_mmc        C:\windows\system32\drivers\sffp_mmc.sys
22:17:40.0441 7956  sffp_mmc - ok
22:17:40.0457 7956  [ 3D0EA348784B7AC9EA9BD9F317980979 ] sffp_sd         C:\windows\system32\drivers\sffp_sd.sys
22:17:40.0472 7956  sffp_sd - ok
22:17:40.0488 7956  [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy         C:\windows\system32\drivers\sfloppy.sys
22:17:40.0535 7956  sfloppy - ok
22:17:40.0582 7956  [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess    C:\windows\System32\ipnathlp.dll
22:17:40.0628 7956  SharedAccess - ok
22:17:40.0660 7956  [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\windows\System32\shsvcs.dll
22:17:40.0691 7956  ShellHWDetection - ok
22:17:40.0722 7956  [ 1D76624A09A054F682D746B924E2DBC3 ] sisagp          C:\windows\system32\drivers\sisagp.sys
22:17:40.0722 7956  sisagp - ok
22:17:40.0753 7956  [ 43CB7AA756C7DB280D01DA9B676CFDE2 ] SiSRaid2        C:\windows\system32\drivers\sisraid2.sys
22:17:40.0769 7956  SiSRaid2 - ok
22:17:40.0784 7956  [ A99C6C8B0BAA970D8AA59DDC50B57F94 ] SiSRaid4        C:\windows\system32\drivers\sisraid4.sys
22:17:40.0800 7956  SiSRaid4 - ok
22:17:40.0925 7956  [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc           C:\windows\system32\SLsvc.exe
22:17:41.0143 7956  slsvc - ok
22:17:41.0174 7956  [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify      C:\windows\system32\SLUINotify.dll
22:17:41.0221 7956  SLUINotify - ok
22:17:41.0252 7956  [ 7B75299A4D201D6A6533603D6914AB04 ] Smb             C:\windows\system32\DRIVERS\smb.sys
22:17:41.0268 7956  Smb - ok
22:17:41.0299 7956  [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP        C:\windows\System32\snmptrap.exe
22:17:41.0299 7956  SNMPTRAP - ok
22:17:41.0377 7956  [ CF9CDE12FBC19DBA8DE528B7511A2F4F ] SNP2UVC         C:\windows\system32\DRIVERS\snp2uvc.sys
22:17:41.0533 7956  SNP2UVC - ok
22:17:41.0549 7956  [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr           C:\windows\system32\drivers\spldr.sys
22:17:41.0564 7956  spldr - ok
22:17:41.0580 7956  [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler         C:\windows\System32\spoolsv.exe
22:17:41.0611 7956  Spooler - ok
22:17:41.0658 7956  [ 41987F9FC0E61ADF54F581E15029AD91 ] srv             C:\windows\system32\DRIVERS\srv.sys
22:17:41.0705 7956  srv - ok
22:17:41.0736 7956  [ FF33AFF99564B1AA534F58868CBE41EF ] srv2            C:\windows\system32\DRIVERS\srv2.sys
22:17:41.0767 7956  srv2 - ok
22:17:41.0783 7956  [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet          C:\windows\system32\DRIVERS\srvnet.sys
22:17:41.0814 7956  srvnet - ok
22:17:41.0845 7956  [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV         C:\windows\System32\ssdpsrv.dll
22:17:41.0876 7956  SSDPSRV - ok
22:17:41.0908 7956  [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv          C:\windows\system32\DRIVERS\ssmdrv.sys
22:17:41.0923 7956  ssmdrv - ok
22:17:41.0954 7956  [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc         C:\windows\system32\sstpsvc.dll
22:17:41.0970 7956  SstpSvc - ok
22:17:42.0017 7956  [ EF70B3D22B4BFFDA6EA851ECB063EFAA ] StillCam        C:\windows\system32\DRIVERS\serscan.sys
22:17:42.0048 7956  StillCam - ok
22:17:42.0079 7956  [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc          C:\windows\System32\wiaservc.dll
22:17:42.0095 7956  stisvc - ok
22:17:42.0157 7956  [ 1D0063597C3666404FCF97698ABEB019 ] stllssvr        c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
22:17:42.0157 7956  stllssvr - ok
22:17:42.0188 7956  [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum          C:\windows\system32\DRIVERS\swenum.sys
22:17:42.0188 7956  swenum - ok
22:17:42.0235 7956  [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv           C:\windows\System32\swprv.dll
22:17:42.0266 7956  swprv - ok
22:17:42.0282 7956  [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx         C:\windows\system32\drivers\symc8xx.sys
22:17:42.0298 7956  Symc8xx - ok
22:17:42.0313 7956  [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi          C:\windows\system32\drivers\sym_hi.sys
22:17:42.0313 7956  Sym_hi - ok
22:17:42.0329 7956  [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3          C:\windows\system32\drivers\sym_u3.sys
22:17:42.0344 7956  Sym_u3 - ok
22:17:42.0407 7956  [ F5D926807BD9BC0AF68F9376144DE425 ] SynTP           C:\windows\system32\DRIVERS\SynTP.sys
22:17:42.0422 7956  SynTP - ok
22:17:42.0485 7956  [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain         C:\windows\system32\sysmain.dll
22:17:42.0532 7956  SysMain - ok
22:17:42.0547 7956  [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\windows\System32\TabSvc.dll
22:17:42.0594 7956  TabletInputService - ok
22:17:42.0625 7956  [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv         C:\windows\System32\tapisrv.dll
22:17:42.0656 7956  TapiSrv - ok
22:17:42.0672 7956  [ CB05822CD9CC6C688168E113C603DBE7 ] TBS             C:\windows\System32\tbssvc.dll
22:17:42.0703 7956  TBS - ok
22:17:42.0766 7956  [ 27D470DABC77BC60D0A3B0E4DEB6CB91 ] Tcpip           C:\windows\system32\drivers\tcpip.sys
22:17:42.0812 7956  Tcpip - ok
22:17:42.0828 7956  [ 27D470DABC77BC60D0A3B0E4DEB6CB91 ] Tcpip6          C:\windows\system32\DRIVERS\tcpip.sys
22:17:43.0015 7956  Tcpip6 - ok
22:17:43.0062 7956  [ 74905EBCBB8CBDB1F3C0B1778BBCB4BC ] tcpipBM         C:\windows\system32\drivers\tcpipBM.sys
22:17:43.0078 7956  tcpipBM ( UnsignedFile.Multi.Generic ) - warning
22:17:43.0078 7956  tcpipBM - detected UnsignedFile.Multi.Generic (1)
22:17:43.0093 7956  [ 608C345A255D82A6289C2D468EB41FD7 ] tcpipreg        C:\windows\system32\drivers\tcpipreg.sys
22:17:43.0124 7956  tcpipreg - ok
22:17:43.0156 7956  [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE          C:\windows\system32\drivers\tdpipe.sys
22:17:43.0187 7956  TDPIPE - ok
22:17:43.0202 7956  [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP           C:\windows\system32\drivers\tdtcp.sys
22:17:43.0234 7956  TDTCP - ok
22:17:43.0265 7956  [ 76B06EB8A01FC8624D699E7045303E54 ] tdx             C:\windows\system32\DRIVERS\tdx.sys
22:17:43.0280 7956  tdx - ok
22:17:43.0312 7956  [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD          C:\windows\system32\DRIVERS\termdd.sys
22:17:43.0327 7956  TermDD - ok
22:17:43.0343 7956  [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService     C:\windows\System32\termsrv.dll
22:17:43.0374 7956  TermService - ok
22:17:43.0390 7956  [ C7230FBEE14437716701C15BE02C27B8 ] Themes          C:\windows\system32\shsvcs.dll
22:17:43.0405 7956  Themes - ok
22:17:43.0436 7956  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER     C:\windows\system32\mmcss.dll
22:17:43.0452 7956  THREADORDER - ok
22:17:43.0499 7956  [ CB258C2F726F1BE73C507022BE33EBB3 ] TPM             C:\windows\system32\drivers\tpm.sys
22:17:43.0499 7956  TPM - ok
22:17:43.0530 7956  [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks          C:\windows\System32\trkwks.dll
22:17:43.0546 7956  TrkWks - ok
22:17:43.0608 7956  [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\windows\servicing\TrustedInstaller.exe
22:17:43.0639 7956  TrustedInstaller - ok
22:17:43.0655 7956  [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv        C:\windows\system32\DRIVERS\tssecsrv.sys
22:17:43.0702 7956  tssecsrv - ok
22:17:43.0733 7956  [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp           C:\windows\system32\DRIVERS\tunmp.sys
22:17:43.0764 7956  tunmp - ok
22:17:43.0795 7956  [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel          C:\windows\system32\DRIVERS\tunnel.sys
22:17:43.0811 7956  tunnel - ok
22:17:43.0842 7956  [ 7D33C4DB2CE363C8518D2DFCF533941F ] uagp35          C:\windows\system32\drivers\uagp35.sys
22:17:43.0858 7956  uagp35 - ok
22:17:43.0889 7956  [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs            C:\windows\system32\DRIVERS\udfs.sys
22:17:43.0904 7956  udfs - ok
22:17:43.0982 7956  [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect       C:\windows\system32\UI0Detect.exe
22:17:44.0045 7956  UI0Detect - ok
22:17:44.0060 7956  [ B0ACFDC9E4AF279E9116C03E014B2B27 ] uliagpkx        C:\windows\system32\drivers\uliagpkx.sys
22:17:44.0076 7956  uliagpkx - ok
22:17:44.0092 7956  [ 9224BB254F591DE4CA8D572A5F0D635C ] uliahci         C:\windows\system32\drivers\uliahci.sys
22:17:44.0107 7956  uliahci - ok
22:17:44.0123 7956  [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata          C:\windows\system32\drivers\ulsata.sys
22:17:44.0138 7956  UlSata - ok
22:17:44.0138 7956  [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2         C:\windows\system32\drivers\ulsata2.sys
22:17:44.0154 7956  ulsata2 - ok
22:17:44.0170 7956  [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus           C:\windows\system32\DRIVERS\umbus.sys
22:17:44.0216 7956  umbus - ok
22:17:44.0248 7956  [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost        C:\windows\System32\upnphost.dll
22:17:44.0279 7956  upnphost - ok
22:17:44.0294 7956  [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp         C:\windows\system32\DRIVERS\usbccgp.sys
22:17:44.0310 7956  usbccgp - ok
22:17:44.0326 7956  [ E9476E6C486E76BC4898074768FB7131 ] usbcir          C:\windows\system32\drivers\usbcir.sys
22:17:44.0372 7956  usbcir - ok
22:17:44.0404 7956  [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci         C:\windows\system32\DRIVERS\usbehci.sys
22:17:44.0435 7956  usbehci - ok
22:17:44.0482 7956  [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub          C:\windows\system32\DRIVERS\usbhub.sys
22:17:44.0528 7956  usbhub - ok
22:17:44.0560 7956  [ 7BDB7B0E7D45AC0402D78B90789EF47C ] usbohci         C:\windows\system32\DRIVERS\usbohci.sys
22:17:44.0591 7956  usbohci - ok
22:17:44.0606 7956  [ B51E52ACF758BE00EF3A58EA452FE360 ] usbprint        C:\windows\system32\drivers\usbprint.sys
22:17:44.0653 7956  usbprint - ok
22:17:44.0716 7956  [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR         C:\windows\system32\DRIVERS\USBSTOR.SYS
22:17:44.0762 7956  USBSTOR - ok
22:17:44.0778 7956  [ 814D653EFC4D48BE3B04A307ECEFF56F ] usbuhci         C:\windows\system32\DRIVERS\usbuhci.sys
22:17:44.0794 7956  usbuhci - ok
22:17:44.0840 7956  [ E67998E8F14CB0627A769F6530BCB352 ] usbvideo        C:\windows\system32\Drivers\usbvideo.sys
22:17:44.0887 7956  usbvideo - ok
22:17:44.0918 7956  [ 35C9095FA7076466AFBFC5B9EC4B779E ] usb_rndisx      C:\windows\system32\DRIVERS\usb8023x.sys
22:17:44.0950 7956  usb_rndisx - ok
22:17:44.0996 7956  [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms           C:\windows\System32\uxsms.dll
22:17:45.0028 7956  UxSms - ok
22:17:45.0059 7956  [ CD88D1B7776DC17A119049742EC07EB4 ] vds             C:\windows\System32\vds.exe
22:17:45.0106 7956  vds - ok
22:17:45.0152 7956  [ 87B06E1F30B749A114F74622D013F8D4 ] vga             C:\windows\system32\DRIVERS\vgapnp.sys
22:17:45.0168 7956  vga - ok
22:17:45.0199 7956  [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave         C:\windows\System32\drivers\vga.sys
22:17:45.0230 7956  VgaSave - ok
22:17:45.0246 7956  [ 5D7159DEF58A800D5781BA3A879627BC ] viaagp          C:\windows\system32\drivers\viaagp.sys
22:17:45.0262 7956  viaagp - ok
22:17:45.0277 7956  [ C4F3A691B5BAD343E6249BD8C2D45DEE ] ViaC7           C:\windows\system32\drivers\viac7.sys
22:17:45.0308 7956  ViaC7 - ok
22:17:45.0324 7956  [ AADF5587A4063F52C2C3FED7887426FC ] viaide          C:\windows\system32\drivers\viaide.sys
22:17:45.0324 7956  viaide - ok
22:17:45.0371 7956  [ EEDEF70F54E4BAB9D7A8D79F3418B3F1 ] vNICdrv         C:\windows\system32\DRIVERS\vNICdrv.sys
22:17:45.0418 7956  vNICdrv - ok
22:17:45.0433 7956  [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr          C:\windows\system32\drivers\volmgr.sys
22:17:45.0449 7956  volmgr - ok
22:17:45.0480 7956  [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx         C:\windows\system32\drivers\volmgrx.sys
22:17:45.0496 7956  volmgrx - ok
22:17:45.0589 7956  [ 786DB5771F05EF300390399F626BF30A ] volsnap         C:\windows\system32\drivers\volsnap.sys
22:17:45.0636 7956  volsnap - ok
22:17:45.0652 7956  [ 587253E09325E6BF226B299774B728A9 ] vsmraid         C:\windows\system32\drivers\vsmraid.sys
22:17:45.0667 7956  vsmraid - ok
22:17:45.0714 7956  [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS             C:\windows\system32\vssvc.exe
22:17:45.0776 7956  VSS - ok
22:17:45.0808 7956  [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time         C:\windows\system32\w32time.dll
22:17:45.0839 7956  W32Time - ok
22:17:45.0854 7956  [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen        C:\windows\system32\drivers\wacompen.sys
22:17:45.0886 7956  WacomPen - ok
22:17:45.0948 7956  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp          C:\windows\system32\DRIVERS\wanarp.sys
22:17:45.0979 7956  Wanarp - ok
22:17:45.0995 7956  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6        C:\windows\system32\DRIVERS\wanarp.sys
22:17:46.0010 7956  Wanarpv6 - ok
22:17:46.0073 7956  [ 779F9C90D3FE9C70B6FFD8EF035F3E83 ] WcesComm        C:\windows\WindowsMobile\wcescomm.dll
22:17:46.0104 7956  WcesComm - ok
22:17:46.0229 7956  [ A3CD60FD826381B49F03832590E069AF ] wcncsvc         C:\windows\System32\wcncsvc.dll
22:17:46.0291 7956  wcncsvc - ok
22:17:46.0322 7956  [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\windows\System32\WcsPlugInService.dll
22:17:46.0354 7956  WcsPlugInService - ok
22:17:46.0369 7956  [ 78FE9542363F297B18C027B2D7E7C07F ] Wd              C:\windows\system32\drivers\wd.sys
22:17:46.0385 7956  Wd - ok
22:17:46.0494 7956  [ A840213F1ACDCC175B4D1D5AAEAC0D7A ] Wdf01000        C:\windows\system32\drivers\Wdf01000.sys
22:17:46.0525 7956  Wdf01000 - ok
22:17:46.0541 7956  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost  C:\windows\system32\wdi.dll
22:17:46.0588 7956  WdiServiceHost - ok
22:17:46.0588 7956  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost   C:\windows\system32\wdi.dll
22:17:46.0619 7956  WdiSystemHost - ok
22:17:46.0634 7956  [ 04C37D8107320312FBAE09926103D5E2 ] WebClient       C:\windows\System32\webclnt.dll
22:17:46.0681 7956  WebClient - ok
22:17:46.0712 7956  [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc          C:\windows\system32\wecsvc.dll
22:17:46.0744 7956  Wecsvc - ok
22:17:46.0759 7956  [ 670FF720071ED741206D69BD995EA453 ] wercplsupport   C:\windows\System32\wercplsupport.dll
22:17:46.0790 7956  wercplsupport - ok
22:17:46.0822 7956  [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc          C:\windows\System32\WerSvc.dll
22:17:46.0853 7956  WerSvc - ok
22:17:46.0900 7956  [ 4575AA12561C5648483403541D0D7F2B ] WinDefend       C:\Program Files\Windows Defender\mpsvc.dll
22:17:46.0915 7956  WinDefend - ok
22:17:46.0931 7956  WinHttpAutoProxySvc - ok
22:17:46.0978 7956  [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] Winmgmt         C:\windows\system32\wbem\WMIsvc.dll
22:17:46.0993 7956  Winmgmt - ok
22:17:47.0056 7956  [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM           C:\windows\system32\WsmSvc.dll
22:17:47.0243 7956  WinRM - ok
22:17:47.0274 7956  [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc         C:\windows\System32\wlansvc.dll
22:17:47.0352 7956  Wlansvc - ok
22:17:47.0368 7956  [ 2E7255D172DF0B8283CDFB7B433B864E ] WmiAcpi         C:\windows\system32\DRIVERS\wmiacpi.sys
22:17:47.0399 7956  WmiAcpi - ok
22:17:47.0430 7956  [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv        C:\windows\system32\wbem\WmiApSrv.exe
22:17:47.0446 7956  wmiApSrv - ok
22:17:47.0524 7956  [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc   C:\Program Files\Windows Media Player\wmpnetwk.exe
22:17:47.0555 7956  WMPNetworkSvc - ok
22:17:47.0602 7956  [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc          C:\windows\System32\wpcsvc.dll
22:17:47.0633 7956  WPCSvc - ok
22:17:47.0680 7956  [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum      C:\windows\system32\wpdbusenum.dll
22:17:47.0695 7956  WPDBusEnum - ok
22:17:47.0742 7956  [ DE9D36F91A4DF3D911626643DEBF11EA ] WpdUsb          C:\windows\system32\DRIVERS\wpdusb.sys
22:17:47.0758 7956  WpdUsb - ok
22:17:47.0867 7956  [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
22:17:47.0898 7956  WPFFontCache_v0400 - ok
22:17:47.0945 7956  [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl         C:\windows\system32\drivers\ws2ifsl.sys
22:17:47.0976 7956  ws2ifsl - ok
22:17:48.0023 7956  [ 1CA6C40261DDC0425987980D0CD2AAAB ] wscsvc          C:\windows\System32\wscsvc.dll
22:17:48.0054 7956  wscsvc - ok
22:17:48.0054 7956  WSearch - ok
22:17:48.0148 7956  [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv        C:\windows\system32\wuaueng.dll
22:17:48.0257 7956  wuauserv - ok
22:17:48.0319 7956  [ 06E6F32C8D0A3F66D956F57B43A2E070 ] WudfPf          C:\windows\system32\drivers\WudfPf.sys
22:17:48.0335 7956  WudfPf - ok
22:17:48.0382 7956  [ 867C301E8B790040AE9CF6486E8041DF ] WUDFRd          C:\windows\system32\DRIVERS\WUDFRd.sys
22:17:48.0413 7956  WUDFRd - ok
22:17:48.0460 7956  [ FE47B7BC8EA320C2D9B5E5BF6E303765 ] wudfsvc         C:\windows\System32\WUDFSvc.dll
22:17:48.0475 7956  wudfsvc - ok
22:17:48.0538 7956  [ F72D4BFFA37E857D195048C498AFC61B ] yukonwlh        C:\windows\system32\DRIVERS\yk60x86.sys
22:17:48.0569 7956  yukonwlh - ok
22:17:48.0616 7956  [ C2215C6ADA8B1E9FEB507CEE9B446661 ] ZTEusbmdm6k     C:\windows\system32\DRIVERS\ZTEusbmdm6k.sys
22:17:48.0647 7956  ZTEusbmdm6k - ok
22:17:48.0694 7956  [ 9862F9D2FF50AE748ED42C022E6AAC15 ] ZTEusbnet       C:\windows\system32\DRIVERS\ZTEusbnet.sys
22:17:48.0709 7956  ZTEusbnet - ok
22:17:48.0772 7956  [ F16CE3C7690AB7426DC96520D54A737E ] ZTEusbnmea      C:\windows\system32\DRIVERS\ZTEusbnmea.sys
22:17:48.0803 7956  ZTEusbnmea - ok
22:17:48.0818 7956  [ C2215C6ADA8B1E9FEB507CEE9B446661 ] ZTEusbser6k     C:\windows\system32\DRIVERS\ZTEusbser6k.sys
22:17:48.0818 7956  ZTEusbser6k - ok
22:17:48.0850 7956  [ F16CE3C7690AB7426DC96520D54A737E ] ZTEusbvoice     C:\windows\system32\DRIVERS\ZTEusbvoice.sys
22:17:48.0865 7956  ZTEusbvoice - ok
22:17:48.0896 7956  ================ Scan global ===============================
22:17:48.0912 7956  [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\windows\system32\basesrv.dll
22:17:48.0959 7956  [ D2293B069E4B63DC17B2F08D45E71124 ] C:\windows\system32\winsrv.dll
22:17:48.0974 7956  [ D2293B069E4B63DC17B2F08D45E71124 ] C:\windows\system32\winsrv.dll
22:17:49.0021 7956  [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\windows\system32\services.exe
22:17:49.0021 7956  [Global] - ok
22:17:49.0021 7956  ================ Scan MBR ==================================
22:17:49.0021 7956  [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk0\DR0
22:17:49.0286 7956  \Device\Harddisk0\DR0 - ok
22:17:49.0286 7956  ================ Scan VBR ==================================
22:17:49.0286 7956  [ D862C8573F8B1F08CE5F73EC39D43BF3 ] \Device\Harddisk0\DR0\Partition1
22:17:49.0286 7956  \Device\Harddisk0\DR0\Partition1 - ok
22:17:49.0318 7956  [ E427449B4FB1A776F31B37969FC15A6C ] \Device\Harddisk0\DR0\Partition2
22:17:49.0318 7956  \Device\Harddisk0\DR0\Partition2 - ok
22:17:49.0333 7956  [ CAFF4F8285231C663915BDF7695816A4 ] \Device\Harddisk0\DR0\Partition3
22:17:49.0333 7956  \Device\Harddisk0\DR0\Partition3 - ok
22:17:49.0333 7956  ============================================================
22:17:49.0333 7956  Scan finished
22:17:49.0333 7956  ============================================================
22:17:49.0349 7560  Detected object count: 13
22:17:49.0349 7560  Actual detected object count: 13
22:18:56.0320 7560  BMLoad ( UnsignedFile.Multi.Generic ) - skipped by user
22:18:56.0320 7560  BMLoad ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:18:56.0320 7560  HP Health Check Service ( UnsignedFile.Multi.Generic ) - skipped by user
22:18:56.0320 7560  HP Health Check Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:18:56.0320 7560  HPFSService ( UnsignedFile.Multi.Generic ) - skipped by user
22:18:56.0320 7560  HPFSService ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:18:56.0320 7560  hpqcxs08 ( UnsignedFile.Multi.Generic ) - skipped by user
22:18:56.0320 7560  hpqcxs08 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:18:56.0320 7560  hpqddsvc ( UnsignedFile.Multi.Generic ) - skipped by user
22:18:56.0320 7560  hpqddsvc ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:18:56.0320 7560  HPSLPSVC ( UnsignedFile.Multi.Generic ) - skipped by user
22:18:56.0320 7560  HPSLPSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:18:56.0320 7560  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
22:18:56.0320 7560  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:18:56.0320 7560  LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user
22:18:56.0320 7560  LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:18:56.0320 7560  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
22:18:56.0320 7560  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:18:56.0335 7560  PCloudd ( UnsignedFile.Multi.Generic ) - skipped by user
22:18:56.0335 7560  PCloudd ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:18:56.0335 7560  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
22:18:56.0335 7560  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:18:56.0335 7560  SafeBoot ( LockedFile.Multi.Generic ) - skipped by user
22:18:56.0335 7560  SafeBoot ( LockedFile.Multi.Generic ) - User select action: Skip 
22:18:56.0335 7560  tcpipBM ( UnsignedFile.Multi.Generic ) - skipped by user
22:18:56.0335 7560  tcpipBM ( UnsignedFile.Multi.Generic ) - User select action: Skip
         

Hi,
combofix:

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop

• Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo,

habe Combofix heruntergeladen und nach Deaktivierung von Antivir ausgeführt.

Beim Starten kam dann die Meldung, dass Antivir noch aktiv ist, also habe ich im Antivir Desktop nochmal gecheckt, und dann "ok" gedrückt - worauf aber wieder die gleiche Meldung kam.

Da in dem Combofix Fenster nur ein "ok"-Button war und ich vorher nochmal nachfragen wollte, habe ich das Fenster mit dem "x" geschlossen, worauf Combofix nicht abgerochen wurde, sondern begonnen hat.

Hier der Report von Combofix:

[code]
Combofix Logfile:

ComboFix 13-01-03.05 - Martin 03.01.2013  23:20:55.1.2 - x86
Microsoft® Windows Vista™ Home Basic   6.0.6002.2.1252.49.1031.18.3066.1441 [GMT 1:00]
ausgeführt von:: c:\users\Martin\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Martin\AppData\Local\dqgvdyg.dat
c:\users\Martin\AppData\Local\dqgvdyg_navps.dat
c:\windows\System32\msvcr70.dll
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\regtlib.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-12-03 bis 2013-01-03  ))))))))))))))))))))))))))))))
.
.
2013-01-03 22:29 . 2013-01-03 22:29	--------	d-----w-	c:\users\Simone\AppData\Local\temp
2013-01-03 22:29 . 2013-01-03 22:29	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-01-03 22:29 . 2013-01-03 22:29	--------	d-----w-	c:\users\Jakob\AppData\Local\temp
2013-01-03 22:10 . 2013-01-03 22:10	710504	----a-w-	c:\windows\is-L40GM.exe
2012-12-28 21:38 . 2012-12-29 19:51	--------	d-----w-	C:\_OTL
2012-12-26 23:19 . 2012-12-26 23:19	--------	d-----w-	c:\users\Martin\AppData\Roaming\Malwarebytes
2012-12-26 23:19 . 2012-12-26 23:19	--------	d-----w-	c:\programdata\Malwarebytes
2012-12-26 23:19 . 2013-01-03 22:41	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2012-12-26 23:19 . 2012-12-14 15:49	21104	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-12-25 20:04 . 2012-12-25 20:05	--------	d-----w-	c:\program files\SopCast
2012-12-25 19:52 . 2012-12-25 19:52	--------	d-----w-	c:\users\Martin\AppData\Local\TVU Networks
2012-12-25 19:52 . 2012-12-25 19:52	--------	d-----w-	c:\programdata\TVU Networks
2012-12-22 19:39 . 2012-12-16 13:12	34304	----a-w-	c:\windows\system32\atmlib.dll
2012-12-22 19:39 . 2012-12-16 10:50	293376	----a-w-	c:\windows\system32\atmfd.dll
2012-12-18 16:49 . 2012-11-08 18:00	6812136	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{CDBDCC28-74D9-49EB-B0DB-60E1F137137B}\mpengine.dll
2012-12-14 16:32 . 2012-07-26 02:46	9728	----a-w-	c:\windows\system32\Wdfres.dll
2012-12-14 16:32 . 2012-07-26 02:33	66560	----a-w-	c:\windows\system32\drivers\WUDFPf.sys
2012-12-14 16:32 . 2012-07-26 02:32	155136	----a-w-	c:\windows\system32\drivers\WUDFRd.sys
2012-12-14 16:32 . 2009-07-14 12:12	16896	----a-w-	c:\windows\system32\winusb.dll
2012-12-14 16:32 . 2012-07-26 03:20	73216	----a-w-	c:\windows\system32\WUDFSvc.dll
2012-12-14 16:32 . 2012-07-26 03:20	172032	----a-w-	c:\windows\system32\WUDFPlatform.dll
2012-12-14 16:32 . 2012-07-26 03:39	526952	----a-w-	c:\windows\system32\drivers\Wdf01000.sys
2012-12-14 16:32 . 2012-07-26 03:39	47720	----a-w-	c:\windows\system32\drivers\WdfLdr.sys
2012-12-14 16:32 . 2012-07-26 03:20	38912	----a-w-	c:\windows\system32\WUDFCoinstaller.dll
2012-12-14 16:32 . 2012-07-26 03:21	196608	----a-w-	c:\windows\system32\WUDFHost.exe
2012-12-14 16:32 . 2012-07-26 03:20	613888	----a-w-	c:\windows\system32\WUDFx.dll
2012-12-13 17:02 . 2012-11-13 01:36	2048000	----a-w-	c:\windows\system32\win32k.sys
2012-12-13 17:02 . 2012-11-02 10:18	376320	----a-w-	c:\windows\system32\dpnet.dll
2012-12-13 17:02 . 2012-11-02 08:26	23040	----a-w-	c:\windows\system32\dpnsvr.exe
2012-12-13 17:02 . 2012-08-21 11:47	224640	----a-w-	c:\windows\system32\drivers\volsnap.sys
2012-12-13 17:01 . 2012-11-13 01:29	2048	----a-w-	c:\windows\system32\tzres.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-03 22:44 . 2009-09-29 05:32	17408	----a-w-	c:\windows\system32\rpcnetp.exe
2013-01-03 22:44 . 2009-09-29 05:37	58288	----a-w-	c:\windows\system32\rpcnet.dll
2013-01-03 22:41 . 2009-05-06 18:44	17408	----a-w-	c:\windows\system32\rpcnetp.dll
2013-01-03 22:10 . 2013-01-03 22:10	710504	----a-w-	c:\windows\isRS-000.tmp
2013-01-01 21:46 . 2012-04-30 17:56	697272	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-01-01 21:46 . 2012-01-10 18:18	73656	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-11-22 22:51 . 2009-09-29 05:37	58288	------w-	c:\windows\system32\rpcnet.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{d51d388b-f5dc-471a-a1ce-5e2d671091c0}"= "c:\program files\Mininova-Vuze\tbMini.dll" [2008-09-15 1784856]
.
[HKEY_CLASSES_ROOT\clsid\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]
2008-09-15 05:47	1784856	----a-w-	c:\program files\Mininova-Vuze\tbMini.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{d51d388b-f5dc-471a-a1ce-5e2d671091c0}"= "c:\program files\Mininova-Vuze\tbMini.dll" [2008-09-15 1784856]
.
[HKEY_CLASSES_ROOT\clsid\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D51D388B-F5DC-471A-A1CE-5E2D671091C0}"= "c:\program files\Mininova-Vuze\tbMini.dll" [2008-09-15 1784856]
.
[HKEY_CLASSES_ROOT\clsid\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-18 2289664]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-09 39408]
"GoogleChromeAutoLaunch_B3FBEF5462B7ECF3CF8933E4FE9764B6"="c:\program files\Google\Chrome\Application\chrome.exe" [2012-12-05 1242728]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-18 178712]
"accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2007-05-15 293168]
"PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2008-05-08 238984]
"CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2008-05-21 24848]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-05-12 318488]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-27 1045800]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912]
"File Sanitizer"="c:\program files\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2008-05-02 10244096]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-05-14 177456]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"CorelDRAW Graphics Suite 11b"="c:\program files\Corel\Corel Graphics 11\Register\registration.exe" [2005-02-17 315392]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552]
"DataCardMonitor"="c:\program files\Huawei Modems\DataCardMonitor.exe" [2009-08-03 249856]
"KMConfig"="c:\program files\Multimedia Mouse Driver\V5\StartAutorun.exe" [2007-03-06 212992]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1314816]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]
"MailCheck IE Broker"="c:\program files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe" [2012-11-22 1461896]
.
c:\users\Ellena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\users\Jakob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\users\Simone\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
Spc.lnk - c:\program files\Smart PC Solutions\Smart Parental Control\SPC.exe [N/A]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-7-16 727592]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
Iomega Storage Manager.lnk - c:\program files\Iomega Storage Manager\IomegaStorageManager.exe [2011-8-6 2158160]
MCtlSvc.lnk - c:\program files\congstar\Internet-Manager\Bin\mcserver.exe [2012-8-5 60688]
PDFCreator.lnk - c:\program files\PDFCreator\PDFCreator.exe [2009-2-19 2641920]
Photo Loader resident.lnk - c:\program files\CASIO\Photo Loader\Plauto.exe [2012-4-7 217088]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\APSHook.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
S2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork	REG_MULTI_SZ   	PLA DPS BFE mpssvc
Cognizance	REG_MULTI_SZ   	ASBroker ASChannel
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
bthsvcs	REG_MULTI_SZ   	BthServ
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
HPService	REG_MULTI_SZ   	HPSLPSVC
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-03-18 00:56	451872	----a-w-	c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-01-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-30 21:46]
.
2013-01-01 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-09-09 19:32]
.
2013-01-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-09 20:54]
.
2013-01-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-09 20:54]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=83&bd=all&pf=cmnb
uInternet Settings,ProxyServer = 192.168.100.1:800
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Free YouTube Download - c:\users\Martin\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm
IE: Free YouTube to Mp3 Converter - c:\users\Martin\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{AD65EA02-71B4-449D-A2E5-6FE2D5588943}: NameServer = 192.168.100.1
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - c:\program files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll
FF - ProfilePath - c:\users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1fnq20.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Free YouTube Download (Free Studio) Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-dqgvdyg - c:\users\martin\appdata\local\dqgvdyg.exe
HKCU-Run-TomTomHOME.exe - c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
HKLM-Run-WatchDog - c:\program files\InterVideo\DVD Check\DVDCheck.exe
SafeBoot-WudfPf
SafeBoot-WudfRd
AddRemove-eMule - c:\program files\eMule\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-01-03 23:47
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  DataCardMonitor = c:\program files\Huawei Modems\DataCardMonitor.exe?MD;.VBS;.VBE;.JS;.JSE??\L????(;??p???Platform=BNB?PROCESSOR_Ae??e7???(;??????PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 13, GenuineIntel?PROCESSOR_LEVEL=6?PROCESSOR_REVISION=0f0d?ProgramData=C:\Pr 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(4840)
c:\windows\system32\btncopy.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\Hewlett-Packard\File Sanitizer\HPFSService.exe
c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Hpservice.exe
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\windows\system32\rundll32.exe
c:\windows\System32\lpksetup.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\AEADISRV.EXE
c:\program files\ActivIdentity\ActivClient\acevents.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe
c:\program files\Iomega Storage Manager\pCloudd.exe
c:\program files\PDF Complete\pdfsvc.exe
c:\windows\system32\rpcnet.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\conime.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\System32\rundll32.exe
c:\program files\ActivIdentity\ActivClient\acevents.exe
c:\program files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
c:\program files\Multimedia Mouse Driver\V5\KMConfig.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Multimedia Mouse Driver\V5\KMProcess.exe
c:\program files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\program files\congstar\Internet-Manager\Bin\dbus-daemon.exe
c:\program files\FastStone Capture\FSCapture.exe
c:\program files\avira\antivir desktop\ipmGui.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-01-03  23:52:54 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2013-01-03 22:52
.
Vor Suchlauf: 10 Verzeichnis(se), 218.253.852.672 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 220.269.088.768 Bytes frei
.
- - End Of File - - BEDAEDA8095C7837278E569F8F812719
         

--- --- ---


Also Combofix den Rechner für den Neustart heruntergefahren hat, kam folgende Windows-Meldung:
- LogonUI - Komponente nicht gefunden
Die Anwendung konnte nicht gestartet werden, weil MSVCR70.dll nicht gefunden wurde. Neuinstallation könnte das Problem beheben.

Diese Meldung kommt jetzt auch jedes mal beim Start des Rechners. Nachdem man diese dreimal weggedrückt hat, kommt aber doch der Windows Anmeldescreen mit den Pictogrammen der User (sieht aber anders aus als vorher).

Beim Neustart kam nochmal eine Fehlermeldung, die jetzt ebenfalls nach jedem Start aufpoppt, aber keine für mich spürbare Auswirkung hat.
Siehe Anlage "after_combofix.jpg".

Aktueller Status:
- Umleitung (falsche links) ist weg
- Nach Combofix ist auch das Sicherheitscenter wieder aktiv
- Meldungen wie oben beschrieben nach Combofix

Sieht schon deutlich besser aus, als noch vor ein paar Tagen - Danke!

Hi
was steht auf der Grafik, bitte mal als text posten.
bitte auch mal instalieren (x86 version)
http://www.microsoft.com/de-de/downl....aspx?id=30679
neustarten, testen, ob sich was gebessert hatt

Hallo,

hier der Inhalt der zweiten Meldung:

Fenstername: RunDLL
Fenstertext:
Fehler beim Laden von C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll
Das angegebene Modul wurde nicht gefunden.

UPDATE:

- Keine Änderung nach Installation von Microsoft C++ Kit

- Die MSVCR70.dll wurde von Combofix gelöscht. Eine Datei MSVCR70.dll.vir ist im Verzeichnis C:\Qoobox\Quarantine\C\Windows

- Die ASTSVCC.dll war laut OTL im Verzeichnis
C:\Programme\Hewlett-Packard\IAM\Bin\ASTSVCC.dll
Laut combofix war die ASTSVCC.dll ebenfalls in diesem Verzeichnis
"CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2008-05-21 24848]

Aktuell befindet sich eine ASTSVCC.dll aber nur in
C:\Swsetup\HPTools\PTCRM_4.0.3.1208_APSHook\Program Files\Bin

Hi,
ja hatte ich gesehen, dann müssen wirs mal manuell versuchen.
die Datei aus der combofix quarantäne:
mach mal nen rechtsklick, umbenennen, nimm das .vir weg
so das nur noch .dll da steht.
dann verschiebe die Dll an den original ort.
die von hp aus
C:\Swsetup\HPTools\PTCRM_4.0.3.1208_APSHook\Program Files\Bin
nach
C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll
verschieben, neustarten, testen.

Hallo,

habe jetzt die MSVCR70.dll, die von Combofix gesperrt wurde, in System32 kopiert.

An- und Abmeldung funktionieren jetzt wieder.

Die ASTSVCC.dll war schon im richtigen Verzeichnis - keine Ahnung warum die Fehlermeldung kam - aber die ist jetzt auch weg.

Ist das Problem damit gelöst?

Hi,
lade den CCleaner standard:
CCleaner - Download - Filepony
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Hallo,

hier die Datei, habe in Deutsch installiert und die Datei heißt install.txt (nicht uninstall.txt) - sieht aber so aus, als ob das die ist, die Du gemeint hast.

7-Zip 4.65		26.03.2009	3,13MB	notwendig
Adobe Flash Player 10 Plugin	Adobe Systems Incorporated	15.04.2010		10.0.45.2	unbekannt
Adobe Flash Player 11 ActiveX	Adobe Systems Incorporated	01.01.2013		11.5.502.135	notwendig
Adobe Reader X (10.1.3) - Deutsch	Adobe Systems Incorporated	15.07.2012	121MB	10.1.3	notwendig
Agere Systems HDA Modem	Agere Systems	17.06.2008		notwendig
AIMP2	AIMP DevTeam	17.01.2009	5,90MB	notwendig
Allway Sync version 12.0.0	Botkind Inc	07.01.2012	26,6MB	notwendig
AP Tuner 3.08		05.01.2010	2,72MB	notwendig
ATI Catalyst Install Manager	ATI Technologies, Inc.	15.01.2009	13,8MB	3.0.664.0	unbekannt
Avira Free Antivirus	Avira	14.11.2012	61,1MB	12.1.9.1236	notwendig
BIOS Configuration for HP ProtectTools	Hewlett-Packard	16.06.2008	3,19MB	4.00 A7	unbekannt
CCleaner	Piriform	19.12.2012	5,08MB	3.26	notwendig
CDex extraction audio		16.03.2009	3,29MB	unnötig
congstar Internet-Manager	ZTE CORPORATION	05.08.2012	79,1MB	1.0.0.3	notwendig
CorelDRAW Graphics Suite 11	Corel Corporation	21.01.2009	242MB	11	notwendig
DivX Codec	DivX, Inc.	15.04.2009	1,30MB	6.8.5	unbekannt
DivX Player	DivX, Inc.	15.04.2009	8,41MB	7.1.0	unbekannt
DVD Audio Extractor 4.5.3	Computer Application Studio	16.04.2009	2,15MB	unnötig
ESU for Microsoft Vista SP1	Hewlett-Packard	16.06.2008	10,8MB	1.00.2.1	unbekannt
FastStone Capture 5.3	FastStone Soft	07.03.2012	1,40MB	5.3	notwendig
Favorit		13.02.2009		unbekannt
File Sanitizer For HP ProtectTools	Hewlett-Packard	16.06.2008	28,9MB	1.0.0.18	unbekannt
Free DVD MP3 Ripper 1.12	Jodix Technologies Ltd.	15.04.2009	2,82MB	unnötig
Free Studio version 5.7.4.918	DVDVideoSoft Ltd.	04.10.2012	65,5MB	5.7.4.918	notwendig
Free Video to Mp3 Converter version 3.1	DVD Video Soft Limited.	12.02.2009	2,49MB	unnötig
Free YouTube Download 2.2	DVDVideoSoft Limited.	18.02.2009	2,31MB	unnötig
Free YouTube to Mp3 Converter version 3.1	DVDVideoSoft Limited.	02.07.2009	2,2	unnötig
Google Chrome	Google Inc.	15.07.2012	952MB	23.0.1271.97	notwendig
Google Earth	Google	25.11.2011	92,7MB	6.1.0.5001	unnötig
Google Updater	Google Inc.	07.09.2011	3,90MB	2.4.2432.1652	unnötig
Guitar Chords	Ginsh John	05.01.2010	2,10MB	2.2	notwendig
Guitar Explorer 1.0		05.01.2010	2,71MB	unnötig
HP 3D DriveGuard	Hewlett-Packard	16.06.2008	2,29MB	3.10 A7	unbekannt
HP Customer Experience Enhancements	Hewlett-Packard	16.06.2008	0,98MB	5.4.0.2423	unbekannt
HP Customer Participation Program 10.0	HP	30.10.2011	240MB	10.0	unbekannt
HP Document Manager 1.0	HP	30.10.2011	3,20MB	1.0 notwendig
HP Easy Setup - Frontend	Hewlett-Packard	16.06.2008	1,57MB	5.4.0.2423	unbekannt
HP Help and Support	Hewlett-Packard	16.06.2008	14,2MB	2.0.9.0	unbekannt
HP Imaging Device Functions 10.0	HP	30.10.2011	3,21MB	10.0	unbekannt
HP Officejet All-In-One Series	HP	30.10.2011	24,8MB	1.0	notwendig
HP ProtectTools Security Manager Suite	Hewlett-Packard	16.06.2008	29,2MB	04.00.01.0026	unbekannt
HP Quick Launch Buttons 6.40 E1	Hewlett-Packard	16.06.2008	26,4MB	6.40 E1	unbekannt
HP Smart Web Printing	HP	30.10.2011	8,28MB	3.5	unbekannt
HP Software Setup 5.00.A.7	Hewlett-Packard Company	15.01.2009	3,21MB	5.00.A.7	unbekanntU
HP Solution Center 10.0	HP	30.10.2011	3,20MB	10.0	notwendig
HP Update	Hewlett-Packard	09.01.2012	3,92MB	5.003.001.001	unbekannt
HP Wallpaper	Hewlett-Packard	16.06.2008	72,3MB	1.0.1.4	unnötig
HP Webcam	Sonix	15.01.2009	5,39MB	5.8.39004.0	unbekannt
HP Webcam Application	Chicony Electronics Co.,Ltd.	15.01.2009	15,2MB	1.0.020.0418	unbekannt
HP Wireless Assistant	Hewlett-Packard	16.06.2008	3,85MB	3.00 K1	unbekannt
Huawei modem		03.08.2009	3,51MB	notwendig
Intel® Matrix Storage Manager	Intel Corporation	15.01.2009	37,0MB	unbekannt
Internet Explorer Toolbar 4.7 by SweetPacks	SweetIM Technologies Ltd.	07.01.2013	4,62MB	4.7.0002	unnötig
InterVideo WinDVD	InterVideo Inc.	15.01.2009	46,5MB	5.0-B11.1248	unnötig
Iomega Storage Manager	EMC	25.12.2011	32,1MB	1.2.4.48286	notwendig
iWisoft Free Video Converter 1.2	www.easy-video-converter.com	09.02.2011	21,4MB	1.2	unnötig
Java(TM) 6 Update 37	Oracle	18.06.2012	95,6MB	6.0.370	unbekannt
Java(TM) 6 Update 6	Sun Microsystems, Inc.	16.06.2008	171MB	1.6.0.60	unbekannt
LightScribe System Software  1.12.37.1	LightScribe	16.06.2008	20,8MB	1.12.37.1	unbekannt
Malwarebytes Anti-Malware Version 1.70.0.1100	Malwarebytes Corporation	03.01.2013	12,3MB	1.70.0.1100	notwendig
Microsoft .NET Framework 1.1		20.01.2009		unbekannt
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU	Microsoft Corporation	25.08.2009	36,9MB	unbekannt
Microsoft .NET Framework 3.5 SP1	Microsoft Corporation	09.03.2009	27,8MB	unbekannt
Microsoft .NET Framework 4 Client Profile	Microsoft Corporation	14.01.2011	120MB	4.0.30319	unbekannt
Microsoft .NET Framework 4 Client Profile DEU Language Pack	Microsoft Corporation	14.01.2011	24,5MB	4.0.30319	unbekannt
Microsoft Office Suite Activation Assistant	Microsoft Corporation	16.06.2008	8,36MB	2.7	unbekannt
Microsoft Visual C++ 2005 Redistributable	Microsoft Corporation	15.01.2009	2,37MB	8.0.50727.42	unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17	Microsoft Corporation	24.03.2009	590KB	9.0.30729	unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148	Microsoft Corporation	29.06.2010	590KB	9.0.30729.4148	unbekannt
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219	Microsoft Corporation	07.01.2012	11,1MB	10.0.40219	unbekannt
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106	Microsoft Corporation	05.01.2013	452KB	11.0.51106.1	unbekannt
Mobile Broadband Drivers	Novatel Wireless	03.08.2009	2,05MB	2.00.51.13	unbekannt
Mozilla Firefox (3.5.7)	Mozilla	11.01.2010	25,6MB	3.5.7 (de)	unnötig
MSXML 4.0 SP2 (KB954430)	Microsoft Corporation	20.01.2009	1,27MB	4.20.9870.0	unbekannt
MSXML 4.0 SP2 (KB973688)	Microsoft Corporation	28.04.2010	1,33MB	4.20.9876.0	unbekannt
Multimedia Mouse Driver	Ihr Firmenname	08.09.2009	6,34MB	2.0	unbekannt
Novatel driver package V2.00.51		03.08.2009		unbekannt
OCR Software by I.R.I.S. 10.0	HP	30.10.2011	3,20MB	10.0	unbekannt
OpenOffice.org 3.3	OpenOffice.org	25.10.2011	432MB	3.3.9567	notwendig
PDF Complete	PDF Complete, Inc.	15.01.2009	35,2MB	3.5.30	notwendig
PDFCreator	Frank Heindörfer, Philip Chinery	19.02.2009	34,0MB	0.9.5	notwendig
Photo Loader 3.0G		07.04.2012	840KB		notwendig
Roxio Creator Business	Roxio	15.01.2009	376MB	10.1	unbekannt
Shop for HP Supplies	HP	30.10.2011	240MB	10.0	unnötig
SoundMAX	Analog Devices	15.01.2009	5,73MB	6.10.1.5820	notwendig
Sweetpacks Bundle Uninstaller	SweetPacks LTD	07.01.2013	368KB	1.0.0.0	unnötig
Synaptics Pointing Device Driver	Synaptics	17.06.2008	13,9MB	11.0.7.0	notwendig
Uninstall 1.0.0.1		20.10.2010	17,5MB	unbekannt
Vista Default Settings	Hewlett-Packard	16.06.2008	282KB	1.0.6.1	unbekannt
VLC media player 2.0.1	VideoLAN	07.04.2012	60,4MB	2.0.1	notwendig
WIDCOMM Bluetooth Software 6.0.1.5300	Broadcom Corporation	19.09.2011	40,8MB	6.0.1.5300	notwendig
Winamp	Nullsoft, Inc	22.10.2009	35,2MB	5.56	unnötig
         

P.S. wundere Dich nicht über die Programme von heute - habe beim download von CCleaner versehentlich einen Zipper installiert.