Liebes Forum!

Problem:
Nachdem meiin Medion Notebook nicht nur langsam ist, sondern ich seit längerem auch mit einem springenden Cursor kämpfe, der beim Schreiben zu Zeilensprüngen führt, gab es seit einigen Tagen Probleme Dateien zu öffnen. Es erschien das Fenster "Speichern unter" anstatt die Datei zu öffnen. Auf anderem Pfad konnte die Datei noch geöffnet werden. Jetzt ist sie unter dem normalen Pfad nicht zu finden und das "speichern unter"-Fenster erscheint auch bei anderen Dateien.

Was hab ich gemacht:
Gestern hab ich recherchiert und bin auf diese Seite gestoßen. Ich habe die Malwarebytes runtergeladen, auf dem einfachen Modus gescannt und es wurden zunächst zwei Dateien entdeckt, beide pup.installbrain.
Ich hab sie vor Schreck gleich gelöscht; aber die Logdatei ist ja noch da, glaub ich.
Vorher ließ ich den CCleaner laufen (mach ich regelmäßig). Und dann hab ich gestern auch noch Daten gesichert, das hab ich aber abgebrochen. Ich hab auch McAfee gelöscht (Ich hab Antivir Premium) und babylon toolbar und weitere unnötige Programme deinstalliert. Ich glaube, alles vor den Malwarebytes.

Was hab ich gestern zuletzt gemacht:
Bei einem kompletten Durchgang von Malwarbytes wurde noch pup.dealio.TB entdeckt. Da das in einer windows.old Datei ist, würde ich die beim Neustart auch wieder bekommen? Ich hab das Log kopiert und den PC heute morgen ausgemacht.

Jetzt versuch ich euren Anleitungen zu folgen...und die Logdateien an die richtige Stelle zu kopieren. Soll ja nicht in den Anhang, oder? Es folgen 5 Logdateien für 2 Durchgänge. Ich schick das mal so ab und hole mir dann den defogger und OTL...
Danke für eure Hilfe im Voraus!


Malwarebytes Anti-Malware (Test) 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.01.20.07

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Kathrin :: KATHRIN-PC [Administrator]

Schutz: Aktiviert

20.01.2013 22:46:38
mbam-log-2013-01-20 (22-46-38).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 191769
Laufzeit: 4 Minute(n), 17 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\ProgramData\IBUpdaterService (PUP.InstallBrain) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 1
C:\ProgramData\IBUpdaterService\repository.xml (PUP.InstallBrain) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
/code

Malwarebytes Anti-Malware (Test) 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.01.20.07

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Kathrin :: KATHRIN-PC [Administrator]

Schutz: Aktiviert

20.01.2013 23:01:30
mbam-log-2013-01-20 (23-01-30).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 435919
Laufzeit: 3 Stunde(n), 21 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Windows.old\Program Files\Application Updater\ApplicationUpdater.exe (PUP.Dealio.TB) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Malwarebytes Anti-Malware (Test) 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.01.20.07

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Kathrin :: KATHRIN-PC [Administrator]

Schutz: Aktiviert

20.01.2013 23:01:30
MBAM-log-2013-01-21 (05-52-19).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 435919
Laufzeit: 3 Stunde(n), 21 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Windows.old\Program Files\Application Updater\ApplicationUpdater.exe (PUP.Dealio.TB) -> Keine Aktion durchgeführt.

(Ende)
2013/01/20 22:45:41 +0100 KATHRIN-PC Kathrin MESSAGE Executing scheduled update: Daily
2013/01/20 22:45:47 +0100 KATHRIN-PC Kathrin MESSAGE Starting protection
2013/01/20 22:45:47 +0100 KATHRIN-PC Kathrin MESSAGE Protection started successfully
2013/01/20 22:45:47 +0100 KATHRIN-PC Kathrin MESSAGE Starting IP protection
2013/01/20 22:45:52 +0100 KATHRIN-PC Kathrin MESSAGE IP Protection started successfully
2013/01/20 22:45:58 +0100 KATHRIN-PC Kathrin MESSAGE Starting database refresh
2013/01/20 22:45:58 +0100 KATHRIN-PC Kathrin MESSAGE Stopping IP protection
2013/01/20 22:45:58 +0100 KATHRIN-PC Kathrin MESSAGE Scheduled update executed successfully: database updated from version v2012.12.14.11 to version v2013.01.20.07
2013/01/20 22:45:58 +0100 KATHRIN-PC Kathrin MESSAGE IP Protection stopped successfully
2013/01/20 22:46:02 +0100 KATHRIN-PC Kathrin MESSAGE Database refreshed successfully
2013/01/20 22:46:02 +0100 KATHRIN-PC Kathrin MESSAGE Starting IP protection
2013/01/20 22:46:05 +0100 KATHRIN-PC Kathrin MESSAGE IP Protection started successfully
2013/01/20 22:46:08 +0100 KATHRIN-PC Kathrin MESSAGE Starting database refresh
2013/01/20 22:46:08 +0100 KATHRIN-PC Kathrin MESSAGE Stopping IP protection
2013/01/20 22:46:08 +0100 KATHRIN-PC Kathrin MESSAGE IP Protection stopped successfully
2013/01/20 22:46:13 +0100 KATHRIN-PC Kathrin MESSAGE Database refreshed successfully
2013/01/20 22:46:13 +0100 KATHRIN-PC Kathrin MESSAGE Starting IP protection
2013/01/20 22:46:18 +0100 KATHRIN-PC Kathrin MESSAGE IP Protection started successfully
2013/01/20 22:54:41 +0100 KATHRIN-PC (null) MESSAGE Starting protection
2013/01/20 22:54:41 +0100 KATHRIN-PC (null) MESSAGE Protection started successfully
2013/01/20 22:54:41 +0100 KATHRIN-PC (null) MESSAGE Starting IP protection
2013/01/20 22:54:46 +0100 KATHRIN-PC (null) MESSAGE IP Protection started successfully


2013/01/21 05:56:05 +0100 KATHRIN-PC (null) MESSAGE Starting protection
2013/01/21 05:56:05 +0100 KATHRIN-PC (null) MESSAGE Protection started successfully
2013/01/21 05:56:05 +0100 KATHRIN-PC (null) MESSAGE Starting IP protection
2013/01/21 05:56:08 +0100 KATHRIN-PC Kathrin MESSAGE IP Protection started successfully
2013/01/21 19:21:44 +0100 KATHRIN-PC (null) MESSAGE Starting protection
2013/01/21 19:21:44 +0100 KATHRIN-PC (null) MESSAGE Protection started successfully
2013/01/21 19:21:44 +0100 KATHRIN-PC (null) MESSAGE Starting IP protection
2013/01/21 19:21:49 +0100 KATHRIN-PC (null) MESSAGE IP Protection started successfully
2013/01/21 19:28:24 +0100 KATHRIN-PC (null) MESSAGE Executing scheduled update: Daily
2013/01/21 19:28:26 +0100 KATHRIN-PC (null) ERROR Scheduled update failed: Host not found failed with error code 0

OTL Logfile:

OTL logfile created on: 21.01.2013 22:47:23 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Kathrin\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,99 Gb Available Physical Memory | 66,46% Memory free
6,23 Gb Paging File | 5,18 Gb Available in Paging File | 83,15% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 268,80 Gb Total Space | 149,47 Gb Free Space | 55,61% Space Free | Partition Type: NTFS
Drive D: | 29,28 Gb Total Space | 9,49 Gb Free Space | 32,42% Space Free | Partition Type: FAT32
 
Computer Name: KATHRIN-PC | User Name: Kathrin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.01.21 22:42:55 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Kathrin\Desktop\OTL.exe
PRC - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.12.14 16:49:28 | 000,512,360 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012.08.14 14:22:14 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.14 22:37:34 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.14 22:37:33 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe
PRC - [2012.05.14 22:37:33 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe
PRC - [2012.05.14 22:37:33 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.14 22:37:33 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.04.11 07:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.04.11 07:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2008.01.19 08:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2007.03.16 01:24:02 | 000,537,520 | ---- | M] ( ) -- C:\Windows\System32\lxbccoms.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV - [2013.01.20 10:34:07 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.01.10 06:10:39 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.11.09 11:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.05.14 22:37:34 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.14 22:37:33 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService)
SRV - [2012.05.14 22:37:33 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)
SRV - [2012.05.14 22:37:33 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2007.03.16 01:24:02 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\System32\lxbccoms.exe -- (lxbc_device)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012.12.14 16:49:28 | 000,021,104 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.05.14 22:37:34 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.14 22:37:34 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.10.19 17:03:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.02.05 18:39:08 | 000,017,064 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SiWinAcc.sys -- (SiFilter)
DRV - [2009.02.05 18:39:00 | 000,012,200 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SiRemFil.sys -- (SiRemFil)
DRV - [2009.02.05 18:38:24 | 000,212,520 | ---- | M] (Silicon Image, Inc) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\Si3531.sys -- (Si3531)
DRV - [2006.11.02 08:41:50 | 000,983,552 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006.11.02 08:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006.11.02 08:30:56 | 000,044,544 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=115935&tt=5212_2&babsrc=HP_ss&mntrId=ca977a3d0000000000000016d38b9fd2
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=115935&tt=5212_2&babsrc=SP_ss&mntrId=ca977a3d0000000000000016d38b9fd2
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ADFA_deDE472
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "Search the web (Babylon)"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://startpage.com/deu/"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1
FF - prefs.js..network.proxy.type: 0
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.20 10:34:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.20 10:34:08 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2012.03.01 22:45:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kathrin\AppData\Roaming\mozilla\Extensions
[2013.01.20 20:52:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kathrin\AppData\Roaming\mozilla\Firefox\Profiles\tg1lbb8p.default\extensions
[2012.12.31 00:07:16 | 000,002,432 | ---- | M] () -- C:\Users\Kathrin\AppData\Roaming\mozilla\firefox\profiles\tg1lbb8p.default\searchplugins\babylon1.xml
[2012.12.31 00:07:16 | 000,002,432 | ---- | M] () -- C:\Users\Kathrin\AppData\Roaming\mozilla\firefox\profiles\tg1lbb8p.default\searchplugins\BrowserProtect.xml
[2012.12.08 19:31:48 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.12.08 19:31:48 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.12.08 19:31:48 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013.01.20 10:34:08 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.06.07 22:21:03 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.12.31 00:07:03 | 000,002,349 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012.09.09 16:55:46 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.07 22:21:03 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.07 22:21:03 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.07 22:21:03 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.07 22:21:03 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://search.babylon.com/?affID=115935&tt=5212_2&babsrc=HP_ss&mntrId=ca977a3d0000000000000016d38b9fd2
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://search.babylon.com/?affID=115935&tt=5212_2&babsrc=HP_ss&mntrId=ca977a3d0000000000000016d38b9fd2
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Kathrin\AppData\Local\Google\Chrome\Application\24.0.1312.52\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Kathrin\AppData\Local\Google\Chrome\Application\24.0.1312.52\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Kathrin\AppData\Local\Google\Chrome\Application\24.0.1312.52\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Google-Suche = C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: Skype Click to Call = C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.3.0.11079_0\
CHR - Extension: BrowserProtect = C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgafcinpmmpklohkojmllohdhomoefph\1.0\
CHR - Extension: Google Mail = C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 10.9.2)
O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 10.9.2)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{96D9F2AC-EEE4-4648-B770-437062DBE0A0}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (c:\progra~2\browse~1\261040~1.25\{c16c1~1\browse~1.dll) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Kathrin\Pictures\2012\2012_12_Sachsenflur\2012_12_06\IMG_8288.JPG
O24 - Desktop BackupWallPaper: C:\Users\Kathrin\Pictures\2012\2012_12_Sachsenflur\2012_12_06\IMG_8288.JPG
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.01.21 22:42:52 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Kathrin\Desktop\OTL.exe
[2013.01.20 22:45:33 | 000,000,000 | ---D | C] -- C:\Users\Kathrin\AppData\Roaming\Malwarebytes
[2013.01.20 22:45:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.01.20 22:45:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.01.20 22:45:23 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013.01.20 22:45:23 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013.01.20 22:15:21 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.12.31 00:13:29 | 000,000,000 | ---D | C] -- C:\Program Files\DomaIQ Uninstaller
[2012.12.31 00:06:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer
[2012.12.31 00:06:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2012.12.31 00:06:49 | 000,000,000 | ---D | C] -- C:\Users\Kathrin\AppData\Roaming\Babylon
 
========== Files - Modified Within 30 Days ==========
 
[2013.01.21 22:44:00 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.01.21 22:42:55 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Kathrin\Desktop\OTL.exe
[2013.01.21 22:40:38 | 000,000,000 | ---- | M] () -- C:\Users\Kathrin\defogger_reenable
[2013.01.21 22:10:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.01.21 21:21:34 | 000,003,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.01.21 21:21:34 | 000,003,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.01.21 19:44:55 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.01.21 19:44:46 | 000,000,680 | ---- | M] () -- C:\Users\Kathrin\AppData\Local\d3d9caps.dat
[2013.01.21 19:21:32 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.01.21 19:21:27 | 3219,578,880 | -HS- | M] () -- C:\hiberfil.sys
[2013.01.20 22:45:25 | 000,000,910 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.01.12 11:15:46 | 000,298,424 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.01.12 10:47:10 | 000,627,994 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.01.12 10:47:10 | 000,595,584 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.01.12 10:47:10 | 000,125,882 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.01.12 10:47:10 | 000,103,658 | ---- | M] () -- C:\Windows\System32\perfc009.dat
 
========== Files Created - No Company Name ==========
 
[2013.01.21 22:40:38 | 000,000,000 | ---- | C] () -- C:\Users\Kathrin\defogger_reenable
[2013.01.20 22:45:25 | 000,000,910 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.11.04 21:03:21 | 000,000,057 | ---- | C] () -- C:\Windows\ARTup.ini
[2012.03.19 18:55:05 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2012.03.18 18:33:39 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2012.03.18 18:33:39 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2012.03.17 22:21:35 | 000,170,654 | ---- | C] () -- C:\Windows\hpwins28.dat
[2012.03.17 22:21:35 | 000,000,418 | ---- | C] () -- C:\Windows\hpwmdl28.dat
[2012.03.03 07:11:20 | 000,005,632 | ---- | C] () -- C:\Users\Kathrin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.03.02 23:12:58 | 000,004,854 | ---- | C] () -- C:\Users\Kathrin\AppData\Roaming\wklnhst.dat
[2012.02.26 20:19:33 | 000,000,142 | ---- | C] () -- C:\Windows\Lexstat.ini
[2012.02.26 20:17:42 | 000,995,328 | ---- | C] ( ) -- C:\Windows\System32\lxbcusb1.dll
[2012.02.26 20:17:42 | 000,413,696 | ---- | C] () -- C:\Windows\System32\lxbcutil.dll
[2012.02.26 20:17:42 | 000,413,696 | ---- | C] ( ) -- C:\Windows\System32\lxbcinpa.dll
[2012.02.26 20:17:42 | 000,397,312 | ---- | C] ( ) -- C:\Windows\System32\lxbciesc.dll
[2012.02.26 20:17:42 | 000,323,584 | ---- | C] ( ) -- C:\Windows\System32\LXBChcp.dll
[2012.02.26 20:17:42 | 000,274,432 | ---- | C] () -- C:\Windows\System32\LXBCinst.dll
[2012.02.26 20:17:41 | 001,224,704 | ---- | C] ( ) -- C:\Windows\System32\lxbcserv.dll
[2012.02.26 20:17:41 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\lxbcpmui.dll
[2012.02.26 20:17:41 | 000,585,728 | ---- | C] ( ) -- C:\Windows\System32\lxbclmpm.dll
[2012.02.26 20:17:41 | 000,163,840 | ---- | C] ( ) -- C:\Windows\System32\lxbcprox.dll
[2012.02.26 20:17:41 | 000,094,208 | ---- | C] ( ) -- C:\Windows\System32\lxbcpplc.dll
[2012.02.26 20:17:40 | 000,696,320 | ---- | C] ( ) -- C:\Windows\System32\lxbchbn3.dll
[2012.02.26 20:17:40 | 000,537,520 | ---- | C] ( ) -- C:\Windows\System32\lxbccoms.exe
[2012.02.26 20:17:40 | 000,421,888 | ---- | C] ( ) -- C:\Windows\System32\lxbccomm.dll
[2012.02.26 20:17:40 | 000,385,968 | ---- | C] ( ) -- C:\Windows\System32\lxbcih.exe
[2012.02.26 20:17:39 | 000,684,032 | ---- | C] ( ) -- C:\Windows\System32\lxbccomc.dll
[2012.02.26 20:17:39 | 000,381,872 | ---- | C] ( ) -- C:\Windows\System32\lxbccfg.exe
[2012.02.26 19:15:13 | 000,000,552 | ---- | C] () -- C:\Users\Kathrin\AppData\Local\d3d8caps.dat
[2012.02.20 10:39:12 | 000,000,680 | ---- | C] () -- C:\Users\Kathrin\AppData\Local\d3d9caps.dat
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.03.09 20:57:07 | 000,000,000 | ---D | M] -- C:\Users\Kathrin\AppData\Roaming\Amazon
[2012.07.18 21:28:13 | 000,000,000 | ---D | M] -- C:\Users\Kathrin\AppData\Roaming\Audacity
[2012.12.31 00:06:49 | 000,000,000 | ---D | M] -- C:\Users\Kathrin\AppData\Roaming\Babylon
[2012.03.02 23:07:34 | 000,000,000 | ---D | M] -- C:\Users\Kathrin\AppData\Roaming\Canon
[2012.03.11 19:44:18 | 000,000,000 | ---D | M] -- C:\Users\Kathrin\AppData\Roaming\eType
[2012.03.10 00:07:34 | 000,000,000 | ---D | M] -- C:\Users\Kathrin\AppData\Roaming\FreeCommander
[2012.03.02 06:40:48 | 000,000,000 | ---D | M] -- C:\Users\Kathrin\AppData\Roaming\OpenOffice.org
[2012.03.03 07:15:24 | 000,000,000 | ---D | M] -- C:\Users\Kathrin\AppData\Roaming\Template
[2013.01.03 11:06:41 | 000,000,000 | ---D | M] -- C:\Users\Kathrin\AppData\Roaming\XnView
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2013.01.20 20:48:58 | 000,000,000 | ---D | M](C:\ProgramData\?s?s????????????????????p?) -- C:\ProgramData\脈ś踠ś楬整灡獰洮慣敦⹥潣⽭灡獰洯獳㌯〮栯汥⹰獡p灳
[2013.01.20 20:48:58 | 000,000,000 | ---D | M](C:\ProgramData\?s?s????????????????????p?) -- C:\ProgramData\脈ś踠ś楬整灡獰洮慣敦⹥潣⽭灡獰洯獳㌯〮栯汥⹰獡p灳
[2013.01.20 20:48:58 | 000,000,000 | ---D | C](C:\ProgramData\?s?s????????????????????p?) -- C:\ProgramData\脈ś踠ś楬整灡獰洮慣敦⹥潣⽭灡獰洯獳㌯〮栯汥⹰獡p灳
[2013.01.20 12:34:35 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\㽐Ȃ㱰Ȃ
[2013.01.20 12:34:35 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\㽐Ȃ㱰Ȃ
[2013.01.20 12:34:35 | 000,000,000 | ---D | C](C:\ProgramData\????) -- C:\ProgramData\㽐Ȃ㱰Ȃ
[2013.01.20 10:16:21 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\㽐‘㱰‘
[2013.01.20 10:16:21 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\㽐‘㱰‘
[2013.01.20 10:16:21 | 000,000,000 | ---D | C](C:\ProgramData\????) -- C:\ProgramData\㽐‘㱰‘
[2013.01.19 14:59:32 | 000,000,000 | ---D | M](C:\ProgramData\?C?C) -- C:\ProgramData\㽐Ć㱰Ć
[2013.01.19 14:59:32 | 000,000,000 | ---D | M](C:\ProgramData\?C?C) -- C:\ProgramData\㽐Ć㱰Ć
[2013.01.19 14:59:32 | 000,000,000 | ---D | C](C:\ProgramData\?C?C) -- C:\ProgramData\㽐Ć㱰Ć
[2013.01.17 18:32:48 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\㽐ǯ㱰ǯ
[2013.01.17 18:32:48 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\㽐ǯ㱰ǯ
[2013.01.17 18:32:48 | 000,000,000 | ---D | C](C:\ProgramData\????) -- C:\ProgramData\㽐ǯ㱰ǯ
[2013.01.16 17:47:20 | 000,000,000 | ---D | M](C:\ProgramData\?g?g) -- C:\ProgramData\㽐ǥ㱰ǥ
[2013.01.16 17:47:20 | 000,000,000 | ---D | M](C:\ProgramData\?g?g) -- C:\ProgramData\㽐ǥ㱰ǥ
[2013.01.16 17:47:20 | 000,000,000 | ---D | C](C:\ProgramData\?g?g) -- C:\ProgramData\㽐ǥ㱰ǥ
[2013.01.12 19:38:27 | 000,000,000 | ---D | M](C:\ProgramData\?²?²) -- C:\ProgramData\㽐²㱰²
[2013.01.12 19:38:27 | 000,000,000 | ---D | M](C:\ProgramData\?²?²) -- C:\ProgramData\㽐²㱰²
[2013.01.12 19:38:27 | 000,000,000 | ---D | C](C:\ProgramData\?²?²) -- C:\ProgramData\㽐²㱰²
[2013.01.12 11:17:54 | 000,000,000 | ---D | M](C:\ProgramData\?¡?¡) -- C:\ProgramData\㽐¡㱰¡
[2013.01.12 11:17:54 | 000,000,000 | ---D | M](C:\ProgramData\?¡?¡) -- C:\ProgramData\㽐¡㱰¡
[2013.01.12 11:17:54 | 000,000,000 | ---D | C](C:\ProgramData\?¡?¡) -- C:\ProgramData\㽐¡㱰¡
[2013.01.12 10:35:53 | 000,000,000 | ---D | M](C:\ProgramData\?A?A) -- C:\ProgramData\㽐Ǟ㱰Ǟ
[2013.01.12 10:35:53 | 000,000,000 | ---D | M](C:\ProgramData\?A?A) -- C:\ProgramData\㽐Ǟ㱰Ǟ
[2013.01.12 10:35:53 | 000,000,000 | ---D | C](C:\ProgramData\?A?A) -- C:\ProgramData\㽐Ǟ㱰Ǟ
[2013.01.10 21:56:58 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\㽐Ƭ㱰Ƭ
[2013.01.10 21:56:58 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\㽐Ƭ㱰Ƭ
[2013.01.10 21:56:58 | 000,000,000 | ---D | C](C:\ProgramData\????) -- C:\ProgramData\㽐Ƭ㱰Ƭ
[2013.01.10 06:06:18 | 000,000,000 | ---D | M](C:\ProgramData\?C?C) -- C:\ProgramData\㽐Ċ㱰Ċ
[2013.01.10 06:06:18 | 000,000,000 | ---D | M](C:\ProgramData\?C?C) -- C:\ProgramData\㽐Ċ㱰Ċ
[2013.01.10 06:06:18 | 000,000,000 | ---D | C](C:\ProgramData\?C?C) -- C:\ProgramData\㽐Ċ㱰Ċ
[2013.01.09 16:46:17 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\㽐ǁ㱰ǁ
[2013.01.09 16:46:17 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\㽐ǁ㱰ǁ
[2013.01.09 16:46:17 | 000,000,000 | ---D | C](C:\ProgramData\????) -- C:\ProgramData\㽐ǁ㱰ǁ
[2013.01.06 10:12:58 | 000,000,000 | ---D | M](C:\ProgramData\?G?G) -- C:\ProgramData\㽐G㱰G
[2013.01.06 10:12:58 | 000,000,000 | ---D | M](C:\ProgramData\?G?G) -- C:\ProgramData\㽐G㱰G
[2013.01.06 10:12:58 | 000,000,000 | ---D | C](C:\ProgramData\?G?G) -- C:\ProgramData\㽐G㱰G
[2013.01.05 21:06:57 | 000,000,000 | ---D | M](C:\ProgramData\?Â?Â) -- C:\ProgramData\㽐Â㱰Â
[2013.01.05 21:06:57 | 000,000,000 | ---D | M](C:\ProgramData\?Â?Â) -- C:\ProgramData\㽐Â㱰Â
[2013.01.05 21:06:57 | 000,000,000 | ---D | C](C:\ProgramData\?Â?Â) -- C:\ProgramData\㽐Â㱰Â
[2013.01.05 13:35:26 | 000,000,000 | ---D | M](C:\ProgramData\?ß?ß) -- C:\ProgramData\㽐ß㱰ß
[2013.01.05 13:35:26 | 000,000,000 | ---D | M](C:\ProgramData\?ß?ß) -- C:\ProgramData\㽐ß㱰ß
[2013.01.05 13:35:26 | 000,000,000 | ---D | C](C:\ProgramData\?ß?ß) -- C:\ProgramData\㽐ß㱰ß
[2013.01.03 17:45:18 | 000,000,000 | ---D | M](C:\ProgramData\?I?I) -- C:\ProgramData\㽐Ǐ㱰Ǐ
[2013.01.03 17:45:18 | 000,000,000 | ---D | M](C:\ProgramData\?I?I) -- C:\ProgramData\㽐Ǐ㱰Ǐ
[2013.01.03 17:45:18 | 000,000,000 | ---D | C](C:\ProgramData\?I?I) -- C:\ProgramData\㽐Ǐ㱰Ǐ
[2013.01.03 07:36:53 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\㽐ſ㱰ſ
[2013.01.03 07:36:53 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\㽐ſ㱰ſ
[2013.01.03 07:36:53 | 000,000,000 | ---D | C](C:\ProgramData\????) -- C:\ProgramData\㽐ſ㱰ſ
[2013.01.02 11:19:53 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\Ꮘʎ縐ʧ
[2013.01.02 11:19:53 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\Ꮘʎ縐ʧ
[2013.01.02 11:19:53 | 000,000,000 | ---D | C](C:\ProgramData\????) -- C:\ProgramData\Ꮘʎ縐ʧ
[2013.01.01 22:36:10 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\㽐Š㱰Š
[2013.01.01 22:36:10 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\㽐Š㱰Š
[2013.01.01 22:36:10 | 000,000,000 | ---D | C](C:\ProgramData\????) -- C:\ProgramData\㽐Š㱰Š
[2013.01.01 15:27:01 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\㽐Ǵ㱰Ǵ
[2013.01.01 15:27:01 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\㽐Ǵ㱰Ǵ
[2013.01.01 15:27:01 | 000,000,000 | ---D | C](C:\ProgramData\????) -- C:\ProgramData\㽐Ǵ㱰Ǵ
[2012.12.31 16:57:00 | 000,000,000 | ---D | M](C:\ProgramData\?O?O) -- C:\ProgramData\㽐Ǫ㱰Ǫ
[2012.12.31 16:57:00 | 000,000,000 | ---D | M](C:\ProgramData\?O?O) -- C:\ProgramData\㽐Ǫ㱰Ǫ
[2012.12.31 16:57:00 | 000,000,000 | ---D | C](C:\ProgramData\?O?O) -- C:\ProgramData\㽐Ǫ㱰Ǫ

< End of report >
         

--- --- ---
OTL Logfile:

OTL Extras logfile created on: 21.01.2013 22:47:23 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Kathrin\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,99 Gb Available Physical Memory | 66,46% Memory free
6,23 Gb Paging File | 5,18 Gb Available in Paging File | 83,15% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 268,80 Gb Total Space | 149,47 Gb Free Space | 55,61% Space Free | Partition Type: NTFS
Drive D: | 29,28 Gb Total Space | 9,49 Gb Free Space | 32,42% Space Free | Partition Type: FAT32
 
Computer Name: KATHRIN-PC | User Name: Kathrin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [Digital Photo Professional] -- C:\Program Files\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{17776693-C9D1-4ECE-8635-B241DF8D4F22}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{5C26153A-575E-4A16-AACC-6B8548490FD7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{77F4A0E9-E3F3-4F47-889F-2BA7E32D405A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{85619743-ADEC-47D1-BC36-61B46CB852FB}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{8E5D6D85-9A3C-4A45-BED8-F96F8C853F46}" = lport=445 | protocol=6 | dir=in | app=system | 
"{9279C376-F582-4119-804C-40318914C9E1}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{A6720EE3-F6B2-442E-9982-49569404305E}" = rport=137 | protocol=17 | dir=out | app=system | 
"{B73DF83C-ED23-4589-8E5B-4DC441853B5D}" = rport=139 | protocol=6 | dir=out | app=system | 
"{BE689D0B-EC8C-4E47-85FE-615B04F01290}" = rport=138 | protocol=17 | dir=out | app=system | 
"{BFCB4B43-CE45-42F0-8C55-F58C3AC57CE3}" = lport=137 | protocol=17 | dir=in | app=system | 
"{C1004B16-0E6F-4106-A38D-513C09D3CA95}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{C51505B1-74D9-42DB-AB22-F99249E1F883}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{C97A52C6-3825-40CE-B2E8-B058A4D3DF52}" = lport=139 | protocol=6 | dir=in | app=system | 
"{D14DBB2C-C9FD-4294-BAFF-29758423DAB6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{D6002B5C-3421-4077-A5D0-6E6F6BDC77E0}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{D6251A0D-9F7F-48F4-8396-0669B8B5F71B}" = rport=445 | protocol=6 | dir=out | app=system | 
"{E60755B6-CB57-4914-B14C-C9EDE8572AA2}" = lport=138 | protocol=17 | dir=in | app=system | 
"{E749C033-3572-4860-83D8-445CC38E2D35}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0EA3CD4A-1CB3-4FD4-87A9-A6F4046FA518}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{0ED9232C-63C0-40D4-9045-192F3F177883}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1B46213D-8305-4CC8-AFA7-976DF8195B99}" = protocol=17 | dir=in | app=c:\windows\system32\lxbccoms.exe | 
"{1D4D8963-3D19-4271-86EA-02FD1EDA2F30}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxbcpswx.exe | 
"{42459598-475D-44F0-A357-41F1C09B2D7D}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe | 
"{4C7D3525-AACA-48BF-B8DE-01E8A7B8035D}" = dir=out | app=c:\users\kathrin\downloads\etype_setup.exe | 
"{510B6182-00D8-4D26-BDA0-0B6944798F79}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{621A7B4A-6CC7-487D-A907-31AC0F59E03B}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{70487D36-5AA1-4840-A9ED-3AAE70A73BBF}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe | 
"{7CADC19D-40DD-43C9-8B21-1D07020918F4}" = dir=in | app=c:\users\kathrin\appdata\local\temp\etype setup403402.exe | 
"{96FDA2F8-6D23-4F38-9161-4F582BF1AF38}" = dir=out | app=c:\users\kathrin\appdata\local\temp\etype setup403402.exe | 
"{A084D3D3-DB68-44A5-8C84-2C6C45E9EE1F}" = protocol=6 | dir=in | app=c:\windows\system32\lxbccoms.exe | 
"{D223F3FD-F898-4040-BF31-AC0038D117E3}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe | 
"{E3C759C8-CFFA-49DF-9FFB-B08CE5BD697C}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{E60F0AE5-0138-4E4B-B330-5369C8E16556}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxbcpswx.exe | 
"{FCA2C1CE-5B6D-4B98-B47E-B2CB02BFCA5C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{FFD3B879-76C7-47A1-836D-425A3C0AAC88}" = dir=in | app=c:\users\kathrin\downloads\etype_setup.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216035FF}" = Java(TM) 6 Update 35
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 9
"{2A8F9255-F4AB-4a37-8F39-7C6E15B5158B}" = 4500G510nz_web
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3A4D5E2D-988D-4ee9-8E7F-3AC200A2B8F5}" = 4500G510nz_Software_Min
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{75247E38-5C9B-45D6-ADF8-E11CB56B4990}" = Network
"{843BD817-4551-451C-AB7A-EF113BF9C036}" = 4500_G510nz_Help_Web
"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.5) - Deutsch
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F27CFD16-939A-4232-98CD-180898D14713}" = HP Officejet 4500 G510n-z
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.15
"Audacity_is1" = Audacity 2.0
"Avira AntiVir Desktop" = Avira Antivirus Premium 2012
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"CCleaner" = CCleaner
"DPP" = Canon Utilities Digital Photo Professional 3.4
"EOS USB WIA Driver" = EOS USB WIA Driver
"EOS Utility" = Canon Utilities EOS Utility
"FreeCommander_is1" = FreeCommander 2009.02b
"iMove ActiveX Control" = iMove ActiveX Control
"Lexmark Z500-Z600 Series" = Lexmark Z500-Z600 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 18.0.1 (x86 de)" = Mozilla Firefox 18.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MyCamera" = Canon Utilities MyCamera
"Original Data Security Tools" = Canon Utilities Original Data Security Tools
"PhotoStitch" = Canon Utilities PhotoStitch
"Picture Style Editor" = Canon Utilities Picture Style Editor
"QuickTime" = QuickTime
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"Updater Service" = Updater Service
"VideoConverter" = VideoConverter
"VLC media player" = VLC media player 2.0.0
"WFTK" = Canon Utilities WFT-E1/E2/E3 Utility
"XnView_is1" = XnView 1.99
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 04.11.2012 16:02:53 | Computer Name = Kathrin-PC | Source = VSS | ID = 8194
Description = 
 
Error - 01.12.2012 15:42:50 | Computer Name = Kathrin-PC | Source = MsiInstaller | ID = 11609
Description = 
 
Error - 09.12.2012 04:35:51 | Computer Name = Kathrin-PC | Source = MsiInstaller | ID = 11609
Description = 
 
Error - 16.12.2012 11:25:09 | Computer Name = Kathrin-PC | Source = MsiInstaller | ID = 11609
Description = 
 
Error - 30.12.2012 17:42:48 | Computer Name = Kathrin-PC | Source = MsiInstaller | ID = 11609
Description = 
 
Error - 02.01.2013 06:08:26 | Computer Name = Kathrin-PC | Source = Application Hang | ID = 1002
Description = Programm logon.scr, Version 6.0.6001.18000 arbeitet nicht mehr mit
 Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen 
über das Problem zu suchen.  Prozess-ID: 156c  Anfangszeit: 01cde8c977436307  Zeitpunkt
 der Beendigung: 17597
 
Error - 09.01.2013 11:43:29 | Computer Name = Kathrin-PC | Source = MsiInstaller | ID = 11609
Description = 
 
Error - 10.01.2013 01:31:09 | Computer Name = Kathrin-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung firefox.exe, Version 17.0.1.4715, Zeitstempel
 0x50b71a4b, fehlerhaftes Modul MSVCR100.dll, Version 10.0.30319.1, Zeitstempel 
0x4ba1dbbe, Ausnahmecode 0x40000015, Fehleroffset 0x0008d635,  Prozess-ID 0x768, Anwendungsstartzeit
 01cdeef33a735006.
 
Error - 16.01.2013 12:47:19 | Computer Name = Kathrin-PC | Source = MsiInstaller | ID = 11609
Description = 
 
Error - 20.01.2013 15:54:13 | Computer Name = Kathrin-PC | Source = VSS | ID = 8194
Description = 
 
[ System Events ]
Error - 17.01.2013 13:36:18 | Computer Name = Kathrin-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = 
 
Error - 19.01.2013 10:00:27 | Computer Name = Kathrin-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 20.01.2013 05:13:42 | Computer Name = Kathrin-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 20.01.2013 07:35:40 | Computer Name = Kathrin-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 20.01.2013 12:21:06 | Computer Name = Kathrin-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 20.01.2013 14:33:11 | Computer Name = Kathrin-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 20.01.2013 16:08:17 | Computer Name = Kathrin-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 20.01.2013 17:55:56 | Computer Name = Kathrin-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 21.01.2013 00:57:29 | Computer Name = Kathrin-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 21.01.2013 14:23:11 | Computer Name = Kathrin-PC | Source = Service Control Manager | ID = 7000
Description = 
 
 
< End of report >
         

--- --- ---

Schritt 3 GMER scan hat nix ergeben, save kann nichts abspeichern - hab ich was falsch gemacht? Es gab keine Warnung, Haken bei IAT/EAT hab ich weggemacht, nur C:\ angehakt, show all ließ sich nicht anhaken.

Danke für weitere Tipps
Gute Nacht

Hallo und

Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.

• Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.
  
  
• Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.
  
  
• Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!
  
  
• Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!
  
  
• Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.


Malwarebytes Anti-Rootkit

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

• Entpacke das Archiv auf deinem Desktop.
• Im neu erstellten Ordner starte bitte die mbar.exe.
• Folge den Anweisungen auf deinem Bildschirm und erlaube dem Tool, dein System zu scannen.
• Klicke auf den CleanUp Button und erlaube den Neustart.
• Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
• Nach dem Neustart starte die mbar.exe erneut.
• Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Danke für die schnelle Antwort!

Ist es ein Problem, wenn ich zwischen den Aktionen, die wir hier besprechen, meine Mail checke? Natürlich nicht beim scan aber danach. Zur Zeit fordert die jucheck.exe von oracle ein update (kommt in letzter Zeit ständig und blinkt) - soll ich es starten oder nicht?

Problem beim download von Anti-Rootkit: Was ist gemeint mit "auf dem Desktop speichern" ? Wenn ich downloade ist es im download-Ordner. Ich habe es auf den Desktop rübergezogen und dort geöffnet...

Sofort hat er was gefunden: AppInit_Dlls, ich klicke yes, denn ich will "remove this value and restart the tool", denn das entspricht doch dem cleanup Button und dem Neustart...nein, es folgt kein Neustart sondern der eigentliche scan folgt; und er möchte kein cleanup, congratulations. Leider kann ich den Text nicht kopieren, den er vorher angezeigt hat.
Aber es scheint alles sauber zu sein.

Wie mache ich einen Screenshot?

Einen schönen Abend und Danke für die Hilfe!

Halt, nochmal geguckt in die Anleitung und im Ordner eine Logdatei gefunden Ich weiß nur nicht, wie man diese code-tags setzt...

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1016

(c) Malwarebytes Corporation 2011-2012

OS version: 6.0.6002 Windows Vista Service Pack 2 x86

Account is Administrative

Internet Explorer version: 9.0.8112.16421

Java version: 1.6.0_35

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 1.828000 GHz
Memory total: 3218800640, free: 2104467456

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1016

(c) Malwarebytes Corporation 2011-2012

OS version: 6.0.6002 Windows Vista Service Pack 2 x86

Account is Administrative

Internet Explorer version: 9.0.8112.16421

Java version: 1.6.0_35

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 1.828000 GHz
Memory total: 3218800640, free: 2120724480

------------ Kernel report ------------
01/22/2013 21:38:04
------------ Loaded modules -----------
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\acpi.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\intelide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\DRIVERS\Si3531.sys
\SystemRoot\system32\DRIVERS\SCSIPORT.SYS
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\SiWinAcc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\msrpc.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\system32\DRIVERS\uagp35.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\system32\DRIVERS\SiRemFil.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\ecache.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\drivers\crcdisk.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\tunmp.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\vgapnp.sys
\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
\SystemRoot\system32\DRIVERS\watchdog.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\Rtlh86.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\msiscsi.sys
\SystemRoot\system32\DRIVERS\storport.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\AGRSM.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\drivers\modem.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\DRIVERS\rasacd.sys
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\smb.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\ws2ifsl.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\ssmdrv.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\avkmgr.sys
\SystemRoot\system32\DRIVERS\avipbb.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_msahci.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\framebuf.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\avgntflt.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\drivers\spsys.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\drivers\mrxdav.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\DRIVERS\WUDFRd.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\system32\DRIVERS\usbscan.sys
\SystemRoot\system32\DRIVERS\usbprint.sys
\SystemRoot\system32\DRIVERS\dot4usb.sys
\SystemRoot\system32\DRIVERS\Dot4.sys
\SystemRoot\system32\DRIVERS\Dot4Prt.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xffffffff8695a210
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\00000065\
Lower Device Object: 0xffffffff869a7030
Lower Device Driver Name: \Driver\USBSTOR\
Driver name found: USBSTOR
Initialization returned 0x0
Load Function returned 0x0
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff85b426e0
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-4\
Lower Device Object: 0xffffffff8511b8a0
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
Initialization returned 0x0
Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0)
Load Function returned 0x0
Downloaded database version: v2013.01.22.08
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 1
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff85b426e0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff85b42278, DeviceName: Unknown, DriverName: \Driver\SiRemFil\
DevicePointer: 0xffffffff85b423c8, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff85b426e0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff8511b8a0, DeviceName: \Device\Ide\IdeDeviceP2T0L0-4\, DriverName: \Driver\atapi\
------------ End ----------
Upper DeviceData: 0xffffffffb1031d50, 0xffffffff85b426e0, 0xffffffff859b2ac8
Lower DeviceData: 0xffffffffb1025528, 0xffffffff8511b8a0, 0xffffffff8599e040
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\Windows\system32\drivers...
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: D7C4D7C4

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 563704722
Partition file system is NTFS
Partition is bootable

Partition 1 type is Extended with LBA (0xf)
Partition is NOT ACTIVE.
Partition starts at LBA: 563704785 Numsec = 61432560

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 320072933376 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-625122448-625142448)...
Physical Sector Size: 0
Drive: 1, DevicePointer: 0xffffffff8695a210, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8695a0b0, DeviceName: Unknown, DriverName: \Driver\SiRemFil\
DevicePointer: 0xffffffff8695ab50, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff8695a210, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff869a7030, DeviceName: \Device\00000065\, DriverName: \Driver\USBSTOR\
------------ End ----------
Done!
Performing system, memory and registry scan...
Done!
Scan finished
=======================================

...jetzt hab ich diese eckigen Klammern aus der Anleitung kopiert...

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1016

(c) Malwarebytes Corporation 2011-2012

OS version: 6.0.6002 Windows Vista Service Pack 2 x86

Account is Administrative

Internet Explorer version: 9.0.8112.16421

Java version: 1.6.0_35

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 1.828000 GHz
Memory total: 3218800640, free: 2104467456

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1016

(c) Malwarebytes Corporation 2011-2012

OS version: 6.0.6002 Windows Vista Service Pack 2 x86

Account is Administrative

Internet Explorer version: 9.0.8112.16421

Java version: 1.6.0_35

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 1.828000 GHz
Memory total: 3218800640, free: 2120724480

------------ Kernel report ------------
     01/22/2013 21:38:04
------------ Loaded modules -----------
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\acpi.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\intelide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\DRIVERS\Si3531.sys
\SystemRoot\system32\DRIVERS\SCSIPORT.SYS
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\SiWinAcc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\msrpc.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\system32\DRIVERS\uagp35.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\system32\DRIVERS\SiRemFil.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\ecache.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\drivers\crcdisk.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\tunmp.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\vgapnp.sys
\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
\SystemRoot\system32\DRIVERS\watchdog.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\Rtlh86.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\msiscsi.sys
\SystemRoot\system32\DRIVERS\storport.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\AGRSM.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\drivers\modem.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\DRIVERS\rasacd.sys
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\smb.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\ws2ifsl.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\ssmdrv.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\avkmgr.sys
\SystemRoot\system32\DRIVERS\avipbb.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_msahci.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\framebuf.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\avgntflt.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\drivers\spsys.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\drivers\mrxdav.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\DRIVERS\WUDFRd.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\system32\DRIVERS\usbscan.sys
\SystemRoot\system32\DRIVERS\usbprint.sys
\SystemRoot\system32\DRIVERS\dot4usb.sys
\SystemRoot\system32\DRIVERS\Dot4.sys
\SystemRoot\system32\DRIVERS\Dot4Prt.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xffffffff8695a210
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\00000065\
Lower Device Object: 0xffffffff869a7030
Lower Device Driver Name: \Driver\USBSTOR\
Driver name found: USBSTOR
Initialization returned 0x0
Load Function returned 0x0
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff85b426e0
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-4\
Lower Device Object: 0xffffffff8511b8a0
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
Initialization returned 0x0
Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0)
Load Function returned 0x0
Downloaded database version: v2013.01.22.08
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 1
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff85b426e0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff85b42278, DeviceName: Unknown, DriverName: \Driver\SiRemFil\
DevicePointer: 0xffffffff85b423c8, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff85b426e0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff8511b8a0, DeviceName: \Device\Ide\IdeDeviceP2T0L0-4\, DriverName: \Driver\atapi\
------------ End ----------
Upper DeviceData: 0xffffffffb1031d50, 0xffffffff85b426e0, 0xffffffff859b2ac8
Lower DeviceData: 0xffffffffb1025528, 0xffffffff8511b8a0, 0xffffffff8599e040
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\Windows\system32\drivers...
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: D7C4D7C4

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 63  Numsec = 563704722
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Extended with LBA (0xf)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 563704785  Numsec = 61432560

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

Disk Size: 320072933376 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-625122448-625142448)...
Physical Sector Size: 0
Drive: 1, DevicePointer: 0xffffffff8695a210, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8695a0b0, DeviceName: Unknown, DriverName: \Driver\SiRemFil\
DevicePointer: 0xffffffff8695ab50, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff8695a210, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff869a7030, DeviceName: \Device\00000065\, DriverName: \Driver\USBSTOR\
------------ End ----------
Done!
Performing system, memory and registry scan...
Done!
Scan finished
=======================================
         

Sorry für die Experimente, aber ich lerne was dazu! Der Text ist jetzt natürlich doppelt drin. Nächstes Mal dirket in codetags!

Gute Nacht!

Nochmal sorry, hab jetzt erkannt, dass ich die system-log eingegeben habe und nicht die mbar log...
Ich hoffe, jetzt hab ichs:

Malwarebytes Anti-Rootkit BETA 1.01.0.1016
www.malwarebytes.org

Database version: v2013.01.22.08

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Kathrin :: KATHRIN-PC [administrator]

22.01.2013 21:51:02
mbar-log-2013-01-22 (21-51-02).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled: 
Objects scanned: 25215
Time elapsed: 7 minute(s), 54 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
         

1. aswMBR

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehlalarm!

• Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
• Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
• Klicke auf Scan.
• Warte bitte bis Scan finished successfully im DOS Fenster steht.
• Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.


2. TDSS-Killer

Download TDSS-Killer auf Desktop siehe => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

Danke, da wird ja aufgeräumt...

aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2013-01-23 21:21:07
-----------------------------
21:21:07.071    OS Version: Windows 6.0.6002 Service Pack 2
21:21:07.071    Number of processors: 2 586 0xF0D
21:21:07.071    ComputerName: KATHRIN-PC  UserName: Kathrin
21:21:42.246    Initialize success
21:35:15.299    AVAST engine defs: 13012300
21:36:00.773    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-4
21:36:00.788    Disk 0 Vendor: WDC_WD3200BEVT-22ZCT0 11.01A11 Size: 305245MB BusType: 3
21:36:00.835    Disk 0 MBR read successfully
21:36:00.835    Disk 0 MBR scan
21:36:00.851    Disk 0 Windows VISTA default MBR code
21:36:00.866    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS       275246 MB offset 63
21:36:00.866    Disk 0 Partition - 00     0F Extended LBA             29996 MB offset 563704785
21:36:00.898    Disk 0 Partition 2 00     0B        FAT32 MSWIN4.1    29996 MB offset 563704848
21:36:00.913    Disk 0 scanning sectors +625137345
21:36:01.007    Disk 0 scanning C:\Windows\system32\drivers
21:36:12.348    Service scanning
21:36:35.077    Modules scanning
21:36:40.241    Disk 0 trace - called modules:
21:36:40.288    ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS hal.dll PCIIDEX.SYS msahci.sys 
21:36:40.288    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85c54ac8]
21:36:40.303    3 CLASSPNP.SYS[8a3b28b3] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-4[0x8511b8a0]
21:36:43.018    AVAST engine scan C:\Windows
21:36:46.840    AVAST engine scan C:\Windows\system32
21:40:30.216    AVAST engine scan C:\Windows\system32\drivers
21:40:51.026    AVAST engine scan C:\Users\Kathrin
21:47:44.114    AVAST engine scan C:\ProgramData
21:48:26.858    Scan finished successfully
21:49:20.834    Disk 0 MBR has been saved successfully to "C:\Users\Kathrin\Desktop\MBR.dat"
21:49:20.834    The log file has been saved successfully to "C:\Users\Kathrin\Desktop\aswMBR.txt"
         

22:10:24.0170 3336  TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
22:10:24.0607 3336  ============================================================
22:10:24.0607 3336  Current date / time: 2013/01/23 22:10:24.0607
22:10:24.0607 3336  SystemInfo:
22:10:24.0607 3336  
22:10:24.0607 3336  OS Version: 6.0.6002 ServicePack: 2.0
22:10:24.0607 3336  Product type: Workstation
22:10:24.0622 3336  ComputerName: KATHRIN-PC
22:10:24.0622 3336  UserName: Kathrin
22:10:24.0622 3336  Windows directory: C:\Windows
22:10:24.0622 3336  System windows directory: C:\Windows
22:10:24.0622 3336  Processor architecture: Intel x86
22:10:24.0622 3336  Number of processors: 2
22:10:24.0622 3336  Page size: 0x1000
22:10:24.0622 3336  Boot type: Normal boot
22:10:24.0622 3336  ============================================================
22:10:25.0886 3336  Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
22:10:25.0917 3336  ============================================================
22:10:25.0917 3336  \Device\Harddisk0\DR0:
22:10:25.0917 3336  MBR partitions:
22:10:25.0917 3336  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x21997392
22:10:25.0948 3336  \Device\Harddisk0\DR0\Partition2: MBR, Type 0xB, StartLBA 0x21997410, BlocksNum 0x3A962B1
22:10:25.0948 3336  ============================================================
22:10:25.0995 3336  C: <-> \Device\Harddisk0\DR0\Partition1
22:10:25.0995 3336  D: <-> \Device\Harddisk0\DR0\Partition2
22:10:25.0995 3336  ============================================================
22:10:25.0995 3336  Initialize success
22:10:25.0995 3336  ============================================================
22:11:30.0593 4008  ============================================================
22:11:30.0593 4008  Scan started
22:11:30.0593 4008  Mode: Manual; SigCheck; TDLFS; 
22:11:30.0593 4008  ============================================================
22:11:31.0123 4008  ================ Scan system memory ========================
22:11:31.0123 4008  System memory - ok
22:11:31.0123 4008  ================ Scan services =============================
22:11:31.0326 4008  [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI            C:\Windows\system32\drivers\acpi.sys
22:11:31.0451 4008  ACPI - ok
22:11:31.0560 4008  [ 3927397AC60D943DAF8808AFFED582B7 ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
22:11:31.0576 4008  AdobeARMservice - ok
22:11:31.0638 4008  [ 424877CB9D5517F980FF7BACA2EB379D ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
22:11:31.0654 4008  AdobeFlashPlayerUpdateSvc - ok
22:11:31.0716 4008  [ 2EDC5BBAC6C651ECE337BDE8ED97C9FB ] adp94xx         C:\Windows\system32\drivers\adp94xx.sys
22:11:31.0732 4008  adp94xx - ok
22:11:31.0779 4008  [ B84088CA3CDCA97DA44A984C6CE1CCAD ] adpahci         C:\Windows\system32\drivers\adpahci.sys
22:11:31.0794 4008  adpahci - ok
22:11:31.0810 4008  [ 7880C67BCCC27C86FD05AA2AFB5EA469 ] adpu160m        C:\Windows\system32\drivers\adpu160m.sys
22:11:31.0825 4008  adpu160m - ok
22:11:31.0857 4008  [ 9AE713F8E30EFC2ABCCD84904333DF4D ] adpu320         C:\Windows\system32\drivers\adpu320.sys
22:11:31.0872 4008  adpu320 - ok
22:11:31.0919 4008  [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
22:11:32.0044 4008  AeLookupSvc - ok
22:11:32.0091 4008  [ 3911B972B55FEA0478476B2E777B29FA ] AFD             C:\Windows\system32\drivers\afd.sys
22:11:32.0137 4008  AFD - ok
22:11:32.0200 4008  [ 5D97943C128ED756D1B0A08302C1B1F8 ] AgereSoftModem  C:\Windows\system32\DRIVERS\AGRSM.sys
22:11:32.0449 4008  AgereSoftModem - ok
22:11:32.0512 4008  [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx         C:\Windows\system32\drivers\djsvs.sys
22:11:32.0527 4008  aic78xx - ok
22:11:32.0559 4008  [ A1545B731579895D8CC44FC0481C1192 ] ALG             C:\Windows\System32\alg.exe
22:11:32.0683 4008  ALG - ok
22:11:32.0730 4008  [ 90395B64600EBB4552E26E178C94B2E4 ] aliide          C:\Windows\system32\drivers\aliide.sys
22:11:32.0730 4008  aliide - ok
22:11:32.0777 4008  [ 2B13E304C9DFDFA5EB582F6A149FA2C7 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
22:11:32.0793 4008  amdagp - ok
22:11:32.0808 4008  [ 0577DF1D323FE75A739C787893D300EA ] amdide          C:\Windows\system32\drivers\amdide.sys
22:11:32.0824 4008  amdide - ok
22:11:32.0855 4008  [ DC487885BCEF9F28EECE6FAC0E5DDFC5 ] AmdK7           C:\Windows\system32\drivers\amdk7.sys
22:11:32.0917 4008  AmdK7 - ok
22:11:32.0933 4008  [ 0CA0071DA4315B00FC1328CA86B425DA ] AmdK8           C:\Windows\system32\drivers\amdk8.sys
22:11:32.0995 4008  AmdK8 - ok
22:11:33.0105 4008  [ B9B5DFAFEA592BD4CA967824EBB42E3D ] AntiVirMailService C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
22:11:33.0120 4008  AntiVirMailService - ok
22:11:33.0167 4008  [ 67B1D78711B4386C26241096326EE14A ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe
22:11:33.0167 4008  AntiVirSchedulerService - ok
22:11:33.0198 4008  [ 845C4E7AE211EDAD5E0B832126F56932 ] AntiVirService  C:\Program Files\Avira\AntiVir Desktop\avguard.exe
22:11:33.0214 4008  AntiVirService - ok
22:11:33.0245 4008  [ 30D71E0C149943A8985D02EA0944F2FE ] AntiVirWebService C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
22:11:33.0261 4008  AntiVirWebService - ok
22:11:33.0339 4008  [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo         C:\Windows\System32\appinfo.dll
22:11:33.0370 4008  Appinfo - ok
22:11:33.0417 4008  [ 5F673180268BB1FDB69C99B6619FE379 ] arc             C:\Windows\system32\drivers\arc.sys
22:11:33.0432 4008  arc - ok
22:11:33.0479 4008  [ 957F7540B5E7F602E44648C7DE5A1C05 ] arcsas          C:\Windows\system32\drivers\arcsas.sys
22:11:33.0495 4008  arcsas - ok
22:11:33.0541 4008  [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
22:11:33.0604 4008  AsyncMac - ok
22:11:33.0651 4008  [ 1F05B78AB91C9075565A9D8A4B880BC4 ] atapi           C:\Windows\system32\drivers\atapi.sys
22:11:33.0666 4008  atapi - ok
22:11:33.0713 4008  [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
22:11:33.0760 4008  AudioEndpointBuilder - ok
22:11:33.0791 4008  [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv        C:\Windows\System32\Audiosrv.dll
22:11:33.0822 4008  Audiosrv - ok
22:11:33.0838 4008  [ D5541F0AFB767E85FC412FC609D96A74 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
22:11:34.0259 4008  avgntflt - ok
22:11:34.0290 4008  [ 7D967A682D4694DF7FA57D63A2DB01FE ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
22:11:34.0321 4008  avipbb - ok
22:11:34.0337 4008  [ 271CFD1A989209B1964E24D969552BF7 ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
22:11:34.0353 4008  avkmgr - ok
22:11:34.0399 4008  [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep            C:\Windows\system32\drivers\Beep.sys
22:11:34.0477 4008  Beep - ok
22:11:34.0540 4008  [ C789AF0F724FDA5852FB9A7D3A432381 ] BFE             C:\Windows\System32\bfe.dll
22:11:34.0602 4008  BFE - ok
22:11:34.0665 4008  [ 93952506C6D67330367F7E7934B6A02F ] BITS            C:\Windows\System32\qmgr.dll
22:11:34.0758 4008  BITS - ok
22:11:34.0774 4008  blbdrive - ok
22:11:34.0805 4008  [ 35F376253F687BDE63976CCB3F2108CA ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
22:11:34.0883 4008  bowser - ok
22:11:34.0914 4008  [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo        C:\Windows\system32\drivers\brfiltlo.sys
22:11:34.0961 4008  BrFiltLo - ok
22:11:34.0977 4008  [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp        C:\Windows\system32\drivers\brfiltup.sys
22:11:35.0008 4008  BrFiltUp - ok
22:11:35.0055 4008  [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser         C:\Windows\System32\browser.dll
22:11:35.0117 4008  Browser - ok
22:11:35.0164 4008  [ B304E75CFF293029EDDF094246747113 ] Brserid         C:\Windows\system32\drivers\brserid.sys
22:11:35.0242 4008  Brserid - ok
22:11:35.0257 4008  [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm        C:\Windows\system32\drivers\brserwdm.sys
22:11:35.0320 4008  BrSerWdm - ok
22:11:35.0351 4008  [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm        C:\Windows\system32\drivers\brusbmdm.sys
22:11:35.0413 4008  BrUsbMdm - ok
22:11:35.0445 4008  [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer        C:\Windows\system32\drivers\brusbser.sys
22:11:35.0491 4008  BrUsbSer - ok
22:11:35.0538 4008  [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
22:11:35.0616 4008  BTHMODEM - ok
22:11:35.0663 4008  [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
22:11:35.0741 4008  cdfs - ok
22:11:35.0788 4008  [ 6B4BFFB9BECD728097024276430DB314 ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
22:11:35.0866 4008  cdrom - ok
22:11:35.0928 4008  [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc     C:\Windows\System32\certprop.dll
22:11:35.0991 4008  CertPropSvc - ok
22:11:36.0022 4008  [ DA8E0AFC7BAA226C538EF53AC2F90897 ] circlass        C:\Windows\system32\drivers\circlass.sys
22:11:36.0084 4008  circlass - ok
22:11:36.0147 4008  [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS            C:\Windows\system32\CLFS.sys
22:11:36.0178 4008  CLFS - ok
22:11:36.0240 4008  [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
22:11:36.0256 4008  clr_optimization_v2.0.50727_32 - ok
22:11:36.0349 4008  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
22:11:36.0365 4008  clr_optimization_v4.0.30319_32 - ok
22:11:36.0396 4008  [ 99AFC3795B58CC478FBBBCDC658FCB56 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
22:11:36.0490 4008  CmBatt - ok
22:11:36.0521 4008  [ 45201046C776FFDAF3FC8A0029C581C8 ] cmdide          C:\Windows\system32\drivers\cmdide.sys
22:11:36.0537 4008  cmdide - ok
22:11:36.0568 4008  [ 6AFEF0B60FA25DE07C0968983EE4F60A ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
22:11:36.0599 4008  Compbatt - ok
22:11:36.0599 4008  COMSysApp - ok
22:11:36.0615 4008  [ 2A213AE086BBEC5E937553C7D9A2B22C ] crcdisk         C:\Windows\system32\drivers\crcdisk.sys
22:11:36.0646 4008  crcdisk - ok
22:11:36.0661 4008  [ 22A7F883508176489F559EE745B5BF5D ] Crusoe          C:\Windows\system32\drivers\crusoe.sys
22:11:36.0771 4008  Crusoe - ok
22:11:36.0817 4008  [ F1E8C34892336D33EDDCDFE44E474F64 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
22:11:36.0880 4008  CryptSvc - ok
22:11:36.0958 4008  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch      C:\Windows\system32\rpcss.dll
22:11:37.0036 4008  DcomLaunch - ok
22:11:37.0098 4008  [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
22:11:37.0129 4008  DfsC - ok
22:11:37.0207 4008  [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR            C:\Windows\system32\DFSR.exe
22:11:37.0363 4008  DFSR - ok
22:11:37.0441 4008  [ 9028559C132146FB75EB7ACF384B086A ] Dhcp            C:\Windows\System32\dhcpcsvc.dll
22:11:37.0488 4008  Dhcp - ok
22:11:37.0519 4008  [ 5D4AEFC3386920236A548271F8F1AF6A ] disk            C:\Windows\system32\drivers\disk.sys
22:11:37.0551 4008  disk - ok
22:11:37.0582 4008  [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache        C:\Windows\System32\dnsrslvr.dll
22:11:37.0660 4008  Dnscache - ok
22:11:37.0707 4008  [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc         C:\Windows\System32\dot3svc.dll
22:11:37.0738 4008  dot3svc - ok
22:11:37.0785 4008  [ 4F59C172C094E1A1D46463A8DC061CBD ] Dot4            C:\Windows\system32\DRIVERS\Dot4.sys
22:11:37.0847 4008  Dot4 - ok
22:11:37.0894 4008  [ 80BF3BA09F6F2523C8F6B7CC6DBF7BD5 ] Dot4Print       C:\Windows\system32\DRIVERS\Dot4Prt.sys
22:11:37.0941 4008  Dot4Print - ok
22:11:37.0987 4008  [ C55004CA6B419B6695970DFE849B122F ] dot4usb         C:\Windows\system32\DRIVERS\dot4usb.sys
22:11:38.0034 4008  dot4usb - ok
22:11:38.0081 4008  [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS             C:\Windows\system32\dps.dll
22:11:38.0128 4008  DPS - ok
22:11:38.0159 4008  [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
22:11:38.0206 4008  drmkaud - ok
22:11:38.0268 4008  [ C68AC676B0EF30CFBB1080ADCE49EB1F ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
22:11:38.0299 4008  DXGKrnl - ok
22:11:38.0346 4008  [ F88FB26547FD2CE6D0A5AF2985892C48 ] E1G60           C:\Windows\system32\DRIVERS\E1G60I32.sys
22:11:38.0409 4008  E1G60 - ok
22:11:38.0455 4008  [ C0B95E40D85CD807D614E264248A45B9 ] EapHost         C:\Windows\System32\eapsvc.dll
22:11:38.0471 4008  EapHost - ok
22:11:38.0518 4008  [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache          C:\Windows\system32\drivers\ecache.sys
22:11:38.0549 4008  Ecache - ok
22:11:38.0611 4008  [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
22:11:38.0643 4008  ehRecvr - ok
22:11:38.0674 4008  [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched         C:\Windows\ehome\ehsched.exe
22:11:38.0721 4008  ehSched - ok
22:11:38.0736 4008  [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart         C:\Windows\ehome\ehstart.dll
22:11:38.0783 4008  ehstart - ok
22:11:38.0830 4008  [ E8F3F21A71720C84BCF423B80028359F ] elxstor         C:\Windows\system32\drivers\elxstor.sys
22:11:38.0861 4008  elxstor - ok
22:11:38.0923 4008  [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt         C:\Windows\system32\emdmgmt.dll
22:11:39.0001 4008  EMDMgmt - ok
22:11:39.0048 4008  [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem     C:\Windows\system32\es.dll
22:11:39.0111 4008  EventSystem - ok
22:11:39.0189 4008  [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat           C:\Windows\system32\drivers\exfat.sys
22:11:39.0251 4008  exfat - ok
22:11:39.0376 4008  [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
22:11:39.0516 4008  fastfat - ok
22:11:39.0547 4008  [ 63BDADA84951B9C03E641800E176898A ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
22:11:39.0610 4008  fdc - ok
22:11:39.0641 4008  [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost         C:\Windows\system32\fdPHost.dll
22:11:39.0688 4008  fdPHost - ok
22:11:39.0750 4008  [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub        C:\Windows\system32\fdrespub.dll
22:11:39.0813 4008  FDResPub - ok
22:11:39.0859 4008  [ B2B2C38E916184FF8523C7439DDD417F ] FETNDIS         C:\Windows\system32\DRIVERS\fetnd5.sys
22:11:39.0906 4008  FETNDIS - ok
22:11:39.0953 4008  [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
22:11:39.0969 4008  FileInfo - ok
22:11:40.0000 4008  [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
22:11:40.0047 4008  Filetrace - ok
22:11:40.0078 4008  [ 6603957EFF5EC62D25075EA8AC27DE68 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
22:11:40.0140 4008  flpydisk - ok
22:11:40.0187 4008  [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
22:11:40.0203 4008  FltMgr - ok
22:11:40.0249 4008  [ 8CE364388C8ECA59B14B539179276D44 ] FontCache       C:\Windows\system32\FntCache.dll
22:11:40.0327 4008  FontCache - ok
22:11:40.0405 4008  [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
22:11:40.0421 4008  FontCache3.0.0.0 - ok
22:11:40.0452 4008  [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
22:11:40.0515 4008  Fs_Rec - ok
22:11:40.0530 4008  [ 4E1CD0A45C50A8882616CAE5BF82F3C5 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
22:11:40.0546 4008  gagp30kx - ok
22:11:40.0624 4008  [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc           C:\Windows\System32\gpsvc.dll
22:11:40.0717 4008  gpsvc - ok
22:11:40.0827 4008  [ F02A533F517EB38333CB12A9E8963773 ] gupdate         C:\Program Files\Google\Update\GoogleUpdate.exe
22:11:40.0842 4008  gupdate - ok
22:11:40.0858 4008  [ F02A533F517EB38333CB12A9E8963773 ] gupdatem        C:\Program Files\Google\Update\GoogleUpdate.exe
22:11:40.0873 4008  gupdatem - ok
22:11:40.0905 4008  [ 3F90E001369A07243763BD5A523D8722 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
22:11:40.0983 4008  HdAudAddService - ok
22:11:41.0029 4008  [ 062452B7FFD68C8C042A6261FE8DFF4A ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
22:11:41.0092 4008  HDAudBus - ok
22:11:41.0139 4008  [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth          C:\Windows\system32\drivers\hidbth.sys
22:11:41.0248 4008  HidBth - ok
22:11:41.0295 4008  [ FF3160C3A2445128C5A6D9B076DA519E ] HidIr           C:\Windows\system32\drivers\hidir.sys
22:11:41.0373 4008  HidIr - ok
22:11:41.0388 4008  [ 84067081F3318162797385E11A8F0582 ] hidserv         C:\Windows\system32\hidserv.dll
22:11:41.0435 4008  hidserv - ok
22:11:41.0482 4008  [ CCA4B519B17E23A00B826C55716809CC ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
22:11:41.0560 4008  HidUsb - ok
22:11:41.0591 4008  [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc          C:\Windows\system32\kmsvc.dll
22:11:41.0653 4008  hkmsvc - ok
22:11:41.0669 4008  [ DF353B401001246853763C4B7AAA6F50 ] HpCISSs         C:\Windows\system32\drivers\hpcisss.sys
22:11:41.0685 4008  HpCISSs - ok
22:11:41.0809 4008  [ 7F437A78C5B0105B67B830D00AD719F8 ] HPSLPSVC        C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL
22:11:41.0872 4008  HPSLPSVC ( UnsignedFile.Multi.Generic ) - warning
22:11:41.0872 4008  HPSLPSVC - detected UnsignedFile.Multi.Generic (1)
22:11:41.0934 4008  [ F870AA3E254628EBEAFE754108D664DE ] HTTP            C:\Windows\system32\drivers\HTTP.sys
22:11:42.0028 4008  HTTP - ok
22:11:42.0059 4008  [ 324C2152FF2C61ABAE92D09F3CCA4D63 ] i2omp           C:\Windows\system32\drivers\i2omp.sys
22:11:42.0075 4008  i2omp - ok
22:11:42.0137 4008  [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
22:11:42.0199 4008  i8042prt - ok
22:11:42.0231 4008  [ C957BF4B5D80B46C5017BF0101E6C906 ] iaStorV         C:\Windows\system32\drivers\iastorv.sys
22:11:42.0262 4008  iaStorV - ok
22:11:42.0340 4008  [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc           C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
22:11:42.0371 4008  idsvc - ok
22:11:42.0402 4008  [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp           C:\Windows\system32\drivers\iirsp.sys
22:11:42.0418 4008  iirsp - ok
22:11:42.0465 4008  [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT          C:\Windows\System32\ikeext.dll
22:11:42.0511 4008  IKEEXT - ok
22:11:42.0558 4008  [ 83AA759F3189E6370C30DE5DC5590718 ] intelide        C:\Windows\system32\drivers\intelide.sys
22:11:42.0574 4008  intelide - ok
22:11:42.0621 4008  [ 224191001E78C89DFA78924C3EA595FF ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
22:11:42.0667 4008  intelppm - ok
22:11:42.0699 4008  [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
22:11:42.0777 4008  IPBusEnum - ok
22:11:42.0808 4008  [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
22:11:42.0855 4008  IpFilterDriver - ok
22:11:42.0886 4008  [ 1998BD97F950680BB55F55A7244679C2 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
22:11:42.0964 4008  iphlpsvc - ok
22:11:42.0964 4008  IpInIp - ok
22:11:43.0011 4008  [ 40F34F8ABA2A015D780E4B09138B6C17 ] IPMIDRV         C:\Windows\system32\drivers\ipmidrv.sys
22:11:43.0089 4008  IPMIDRV - ok
22:11:43.0135 4008  [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT           C:\Windows\system32\DRIVERS\ipnat.sys
22:11:43.0182 4008  IPNAT - ok
22:11:43.0213 4008  [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
22:11:43.0260 4008  IRENUM - ok
22:11:43.0276 4008  [ 350FCA7E73CF65BCEF43FAE1E4E91293 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
22:11:43.0291 4008  isapnp - ok
22:11:43.0323 4008  [ 232FA340531D940AAC623B121A595034 ] iScsiPrt        C:\Windows\system32\DRIVERS\msiscsi.sys
22:11:43.0354 4008  iScsiPrt - ok
22:11:43.0385 4008  [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi        C:\Windows\system32\drivers\iteatapi.sys
22:11:43.0401 4008  iteatapi - ok
22:11:43.0416 4008  [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid         C:\Windows\system32\drivers\iteraid.sys
22:11:43.0447 4008  iteraid - ok
22:11:43.0479 4008  [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
22:11:43.0494 4008  kbdclass - ok
22:11:43.0525 4008  [ D2600CB17B7408B4A83F231DC9A11AC3 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
22:11:43.0603 4008  kbdhid - ok
22:11:43.0650 4008  [ A3E186B4B935905B829219502557314E ] KeyIso          C:\Windows\system32\lsass.exe
22:11:43.0697 4008  KeyIso - ok
22:11:43.0744 4008  [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
22:11:43.0775 4008  KSecDD - ok
22:11:43.0822 4008  [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm           C:\Windows\system32\msdtckrm.dll
22:11:43.0869 4008  KtmRm - ok
22:11:43.0900 4008  [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer    C:\Windows\system32\srvsvc.dll
22:11:43.0947 4008  LanmanServer - ok
22:11:44.0025 4008  [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
22:11:44.0040 4008  LanmanWorkstation - ok
22:11:44.0071 4008  [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
22:11:44.0134 4008  lltdio - ok
22:11:44.0181 4008  [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
22:11:44.0259 4008  lltdsvc - ok
22:11:44.0305 4008  [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts         C:\Windows\System32\lmhsvc.dll
22:11:44.0368 4008  lmhosts - ok
22:11:44.0430 4008  [ A2262FB9F28935E862B4DB46438C80D2 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
22:11:44.0446 4008  LSI_FC - ok
22:11:44.0461 4008  [ 30D73327D390F72A62F32C103DAF1D6D ] LSI_SAS         C:\Windows\system32\drivers\lsi_sas.sys
22:11:44.0477 4008  LSI_SAS - ok
22:11:44.0508 4008  [ E1E36FEFD45849A95F1AB81DE0159FE3 ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
22:11:44.0539 4008  LSI_SCSI - ok
22:11:44.0586 4008  [ 8F5C7426567798E62A3B3614965D62CC ] luafv           C:\Windows\system32\drivers\luafv.sys
22:11:44.0649 4008  luafv - ok
22:11:44.0680 4008  lxbc_device - ok
22:11:44.0711 4008  [ 629CABB0421668C9D3D402A3C3D77E14 ] MBAMProtector   C:\Windows\system32\drivers\mbam.sys
22:11:44.0727 4008  MBAMProtector - ok
22:11:44.0789 4008  [ 1ACAA67676E9E7BDA5E0C41B6E0DECAF ] MBAMScheduler   C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
22:11:44.0820 4008  MBAMScheduler - ok
22:11:44.0883 4008  [ 916B8954AC3E06DC9E898AFFB41F3FB6 ] MBAMService     C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
22:11:44.0929 4008  MBAMService - ok
22:11:44.0961 4008  [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
22:11:45.0007 4008  Mcx2Svc - ok
22:11:45.0039 4008  [ D153B14FC6598EAE8422A2037553ADCE ] megasas         C:\Windows\system32\drivers\megasas.sys
22:11:45.0054 4008  megasas - ok
22:11:45.0085 4008  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS           C:\Windows\system32\mmcss.dll
22:11:45.0148 4008  MMCSS - ok
22:11:45.0179 4008  [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem           C:\Windows\system32\drivers\modem.sys
22:11:45.0257 4008  Modem - ok
22:11:45.0288 4008  [ EC839BA91E45CCE6EADAFC418FFF8206 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
22:11:45.0397 4008  monitor - ok
22:11:45.0444 4008  [ 5BF6A1326A335C5298477754A506D263 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
22:11:45.0460 4008  mouclass - ok
22:11:45.0460 4008  [ 93B8D4869E12CFBE663915502900876F ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
22:11:45.0507 4008  mouhid - ok
22:11:45.0538 4008  [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr        C:\Windows\system32\drivers\mountmgr.sys
22:11:45.0553 4008  MountMgr - ok
22:11:45.0600 4008  [ 9C3758018DED02F4AE53CCA1C5F084A2 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
22:11:45.0616 4008  MozillaMaintenance - ok
22:11:45.0647 4008  [ 583A41F26278D9E0EA548163D6139397 ] mpio            C:\Windows\system32\drivers\mpio.sys
22:11:45.0663 4008  mpio - ok
22:11:45.0694 4008  [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
22:11:45.0725 4008  mpsdrv - ok
22:11:45.0787 4008  [ 5DE62C6E9108F14F6794060A9BDECAEC ] MpsSvc          C:\Windows\system32\mpssvc.dll
22:11:45.0850 4008  MpsSvc - ok
22:11:45.0897 4008  [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x        C:\Windows\system32\drivers\mraid35x.sys
22:11:45.0912 4008  Mraid35x - ok
22:11:45.0943 4008  [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
22:11:45.0990 4008  MRxDAV - ok
22:11:46.0006 4008  [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
22:11:46.0053 4008  mrxsmb - ok
22:11:46.0084 4008  [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
22:11:46.0115 4008  mrxsmb10 - ok
22:11:46.0162 4008  [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
22:11:46.0209 4008  mrxsmb20 - ok
22:11:46.0271 4008  [ 5457DCFA7C0DA43522F4D9D4049C1472 ] msahci          C:\Windows\system32\drivers\msahci.sys
22:11:46.0287 4008  msahci - ok
22:11:46.0318 4008  [ 3FC82A2AE4CC149165A94699183D3028 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
22:11:46.0333 4008  msdsm - ok
22:11:46.0380 4008  [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC           C:\Windows\System32\msdtc.exe
22:11:46.0411 4008  MSDTC - ok
22:11:46.0458 4008  [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
22:11:46.0521 4008  Msfs - ok
22:11:46.0567 4008  [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
22:11:46.0583 4008  msisadrv - ok
22:11:46.0614 4008  [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
22:11:46.0677 4008  MSiSCSI - ok
22:11:46.0677 4008  msiserver - ok
22:11:46.0755 4008  [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
22:11:46.0817 4008  MSKSSRV - ok
22:11:46.0864 4008  [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
22:11:46.0926 4008  MSPCLOCK - ok
22:11:46.0973 4008  [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
22:11:47.0051 4008  MSPQM - ok
22:11:47.0098 4008  [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
22:11:47.0129 4008  MsRPC - ok
22:11:47.0145 4008  [ E384487CB84BE41D09711C30CA79646C ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
22:11:47.0176 4008  mssmbios - ok
22:11:47.0207 4008  [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
22:11:47.0254 4008  MSTEE - ok
22:11:47.0269 4008  [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup             C:\Windows\system32\Drivers\mup.sys
22:11:47.0285 4008  Mup - ok
22:11:47.0316 4008  [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent        C:\Windows\system32\qagentRT.dll
22:11:47.0379 4008  napagent - ok
22:11:47.0441 4008  [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
22:11:47.0472 4008  NativeWifiP - ok
22:11:47.0550 4008  [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS            C:\Windows\system32\drivers\ndis.sys
22:11:47.0581 4008  NDIS - ok
22:11:47.0613 4008  [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
22:11:47.0675 4008  NdisTapi - ok
22:11:47.0706 4008  [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
22:11:47.0753 4008  Ndisuio - ok
22:11:47.0800 4008  [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
22:11:47.0815 4008  NdisWan - ok
22:11:47.0847 4008  [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
22:11:47.0909 4008  NDProxy - ok
22:11:47.0956 4008  [ 510C138564486FF926A3F773205C63D1 ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
22:11:47.0987 4008  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
22:11:47.0987 4008  Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
22:11:48.0018 4008  [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
22:11:48.0081 4008  NetBIOS - ok
22:11:48.0127 4008  [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt           C:\Windows\system32\DRIVERS\netbt.sys
22:11:48.0174 4008  netbt - ok
22:11:48.0205 4008  [ A3E186B4B935905B829219502557314E ] Netlogon        C:\Windows\system32\lsass.exe
22:11:48.0221 4008  Netlogon - ok
22:11:48.0252 4008  [ C8052711DAECC48B982434C5116CA401 ] Netman          C:\Windows\System32\netman.dll
22:11:48.0315 4008  Netman - ok
22:11:48.0361 4008  [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm        C:\Windows\System32\netprofm.dll
22:11:48.0408 4008  netprofm - ok
22:11:48.0455 4008  [ D6C4E4A39A36029AC0813D476FBD0248 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
22:11:48.0471 4008  NetTcpPortSharing - ok
22:11:48.0517 4008  [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960         C:\Windows\system32\drivers\nfrd960.sys
22:11:48.0517 4008  nfrd960 - ok
22:11:48.0564 4008  [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc          C:\Windows\System32\nlasvc.dll
22:11:48.0611 4008  NlaSvc - ok
22:11:48.0658 4008  [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
22:11:48.0705 4008  Npfs - ok
22:11:48.0736 4008  [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi             C:\Windows\system32\nsisvc.dll
22:11:48.0767 4008  nsi - ok
22:11:48.0798 4008  [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
22:11:48.0845 4008  nsiproxy - ok
22:11:48.0923 4008  [ 6A4A98CEE84CF9E99564510DDA4BAA47 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
22:11:49.0017 4008  Ntfs - ok
22:11:49.0032 4008  [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi       C:\Windows\system32\drivers\ntrigdigi.sys
22:11:49.0095 4008  ntrigdigi - ok
22:11:49.0126 4008  [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null            C:\Windows\system32\drivers\Null.sys
22:11:49.0157 4008  Null - ok
22:11:49.0188 4008  [ E69E946F80C1C31C53003BFBF50CBB7C ] nvraid          C:\Windows\system32\drivers\nvraid.sys
22:11:49.0188 4008  nvraid - ok
22:11:49.0219 4008  [ 9E0BA19A28C498A6D323D065DB76DFFC ] nvstor          C:\Windows\system32\drivers\nvstor.sys
22:11:49.0219 4008  nvstor - ok
22:11:49.0251 4008  [ 07C186427EB8FCC3D8D7927187F260F7 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
22:11:49.0266 4008  nv_agp - ok
22:11:49.0266 4008  NwlnkFlt - ok
22:11:49.0282 4008  NwlnkFwd - ok
22:11:49.0313 4008  [ BE32DA025A0BE1878F0EE8D6D9386CD5 ] ohci1394        C:\Windows\system32\DRIVERS\ohci1394.sys
22:11:49.0391 4008  ohci1394 - ok
22:11:49.0438 4008  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc        C:\Windows\system32\p2psvc.dll
22:11:49.0500 4008  p2pimsvc - ok
22:11:49.0547 4008  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc          C:\Windows\system32\p2psvc.dll
22:11:49.0578 4008  p2psvc - ok
22:11:49.0703 4008  [ 0FA9B5055484649D63C303FE404E5F4D ] Parport         C:\Windows\system32\DRIVERS\parport.sys
22:11:49.0797 4008  Parport - ok
22:11:49.0859 4008  [ B9C2B89F08670E159F7181891E449CD9 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
22:11:49.0875 4008  partmgr - ok
22:11:49.0890 4008  [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm          C:\Windows\system32\DRIVERS\parvdm.sys
22:11:49.0968 4008  Parvdm - ok
22:11:50.0015 4008  [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc          C:\Windows\System32\pcasvc.dll
22:11:50.0031 4008  PcaSvc - ok
22:11:50.0062 4008  [ 941DC1D19E7E8620F40BBC206981EFDB ] pci             C:\Windows\system32\drivers\pci.sys
22:11:50.0077 4008  pci - ok
22:11:50.0109 4008  [ 3B1901E401473E03EB8C874271E50C26 ] pciide          C:\Windows\system32\drivers\pciide.sys
22:11:50.0109 4008  pciide - ok
22:11:50.0140 4008  [ E6F3FB1B86AA519E7698AD05E58B04E5 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
22:11:50.0155 4008  pcmcia - ok
22:11:50.0218 4008  [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
22:11:50.0327 4008  PEAUTH - ok
22:11:50.0421 4008  [ B1689DF169143F57053F795390C99DB3 ] pla             C:\Windows\system32\pla.dll
22:11:50.0514 4008  pla - ok
22:11:50.0561 4008  [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
22:11:50.0608 4008  PlugPlay - ok
22:11:50.0670 4008  [ 37E5E8FFBAD35605DAEEC3224EA0E465 ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
22:11:50.0670 4008  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
22:11:50.0670 4008  Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
22:11:50.0733 4008  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg     C:\Windows\system32\p2psvc.dll
22:11:50.0811 4008  PNRPAutoReg - ok
22:11:50.0873 4008  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc         C:\Windows\system32\p2psvc.dll
22:11:50.0935 4008  PNRPsvc - ok
22:11:50.0982 4008  [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
22:11:51.0060 4008  PolicyAgent - ok
22:11:51.0107 4008  [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
22:11:51.0154 4008  PptpMiniport - ok
22:11:51.0185 4008  [ 0E3CEF5D28B40CF273281D620C50700A ] Processor       C:\Windows\system32\drivers\processr.sys
22:11:51.0263 4008  Processor - ok
22:11:51.0294 4008  [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc         C:\Windows\system32\profsvc.dll
22:11:51.0341 4008  ProfSvc - ok
22:11:51.0357 4008  [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\Windows\system32\lsass.exe
22:11:51.0372 4008  ProtectedStorage - ok
22:11:51.0403 4008  [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched          C:\Windows\system32\DRIVERS\pacer.sys
22:11:51.0450 4008  PSched - ok
22:11:51.0528 4008  [ CCDAC889326317792480C0A67156A1EC ] ql2300          C:\Windows\system32\drivers\ql2300.sys
22:11:51.0575 4008  ql2300 - ok
22:11:51.0606 4008  [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
22:11:51.0622 4008  ql40xx - ok
22:11:51.0684 4008  [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE           C:\Windows\system32\qwave.dll
22:11:51.0700 4008  QWAVE - ok
22:11:51.0731 4008  [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
22:11:51.0747 4008  QWAVEdrv - ok
22:11:51.0840 4008  [ E642B131FB74CAF4BB8A014F31113142 ] R300            C:\Windows\system32\DRIVERS\atikmdag.sys
22:11:51.0965 4008  R300 - ok
22:11:52.0012 4008  [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
22:11:52.0059 4008  RasAcd - ok
22:11:52.0105 4008  [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto         C:\Windows\System32\rasauto.dll
22:11:52.0152 4008  RasAuto - ok
22:11:52.0215 4008  [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
22:11:52.0261 4008  Rasl2tp - ok
22:11:52.0308 4008  [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan          C:\Windows\System32\rasmans.dll
22:11:52.0339 4008  RasMan - ok
22:11:52.0355 4008  [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
22:11:52.0417 4008  RasPppoe - ok
22:11:52.0449 4008  [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
22:11:52.0464 4008  RasSstp - ok
22:11:52.0511 4008  [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
22:11:52.0527 4008  rdbss - ok
22:11:52.0558 4008  [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
22:11:52.0589 4008  RDPCDD - ok
22:11:52.0620 4008  [ E8BD98D46F2ED77132BA927FCCB47D8B ] rdpdr           C:\Windows\system32\drivers\rdpdr.sys
22:11:52.0698 4008  rdpdr - ok
22:11:52.0698 4008  [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
22:11:52.0745 4008  RDPENCDD - ok
22:11:52.0792 4008  [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
22:11:52.0839 4008  RDPWD - ok
22:11:52.0870 4008  [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess    C:\Windows\System32\mprdim.dll
22:11:52.0917 4008  RemoteAccess - ok
22:11:52.0979 4008  [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry  C:\Windows\system32\regsvc.dll
22:11:53.0010 4008  RemoteRegistry - ok
22:11:53.0057 4008  [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator      C:\Windows\system32\locator.exe
22:11:53.0088 4008  RpcLocator - ok
22:11:53.0135 4008  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs           C:\Windows\system32\rpcss.dll
22:11:53.0166 4008  RpcSs - ok
22:11:53.0197 4008  [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
22:11:53.0260 4008  rspndr - ok
22:11:53.0322 4008  [ 283392AF1860ECDB5E0F8EBD7F3D72DF ] RTL8169         C:\Windows\system32\DRIVERS\Rtlh86.sys
22:11:53.0385 4008  RTL8169 - ok
22:11:53.0400 4008  [ A3E186B4B935905B829219502557314E ] SamSs           C:\Windows\system32\lsass.exe
22:11:53.0416 4008  SamSs - ok
22:11:53.0494 4008  [ 3CE8F073A557E172B330109436984E30 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
22:11:53.0509 4008  sbp2port - ok
22:11:53.0572 4008  [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
22:11:53.0603 4008  SCardSvr - ok
22:11:53.0650 4008  [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule        C:\Windows\system32\schedsvc.dll
22:11:53.0712 4008  Schedule - ok
22:11:53.0743 4008  [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc     C:\Windows\System32\certprop.dll
22:11:53.0775 4008  SCPolicySvc - ok
22:11:53.0806 4008  [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
22:11:53.0821 4008  SDRSVC - ok
22:11:53.0837 4008  [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
22:11:53.0899 4008  secdrv - ok
22:11:53.0946 4008  [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon        C:\Windows\system32\seclogon.dll
22:11:53.0977 4008  seclogon - ok
22:11:53.0977 4008  [ A9BBAB5759771E523F55563D6CBE140F ] SENS            C:\Windows\System32\sens.dll
22:11:54.0040 4008  SENS - ok
22:11:54.0071 4008  [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
22:11:54.0149 4008  Serenum - ok
22:11:54.0196 4008  [ C70D69A918B178D3C3B06339B40C2E1B ] Serial          C:\Windows\system32\DRIVERS\serial.sys
22:11:54.0274 4008  Serial - ok
22:11:54.0289 4008  [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
22:11:54.0321 4008  sermouse - ok
22:11:54.0383 4008  [ D2193326F729B163125610DBF3E17D57 ] SessionEnv      C:\Windows\system32\sessenv.dll
22:11:54.0430 4008  SessionEnv - ok
22:11:54.0461 4008  [ 103B79418DA647736EE95645F305F68A ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
22:11:54.0523 4008  sffdisk - ok
22:11:54.0539 4008  [ 8FD08A310645FE872EEEC6E08C6BF3EE ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
22:11:54.0586 4008  sffp_mmc - ok
22:11:54.0601 4008  [ 9CFA05FCFCB7124E69CFC812B72F9614 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
22:11:54.0664 4008  sffp_sd - ok
22:11:54.0679 4008  [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy         C:\Windows\system32\drivers\sfloppy.sys
22:11:54.0726 4008  sfloppy - ok
22:11:54.0757 4008  [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
22:11:54.0820 4008  SharedAccess - ok
22:11:54.0851 4008  [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
22:11:54.0929 4008  ShellHWDetection - ok
22:11:54.0960 4008  [ 93BEACC3815A4653A655C8BD7622FF63 ] Si3531          C:\Windows\system32\DRIVERS\Si3531.sys
22:11:54.0976 4008  Si3531 - ok
22:11:55.0007 4008  [ 165448BC832D424B97270C8D1276E24A ] SiFilter        C:\Windows\system32\DRIVERS\SiWinAcc.sys
22:11:55.0007 4008  SiFilter - ok
22:11:55.0023 4008  [ 9BE8EA3A8C7E6D47E710F6FA14B7442B ] SiRemFil        C:\Windows\system32\DRIVERS\SiRemFil.sys
22:11:55.0038 4008  SiRemFil - ok
22:11:55.0069 4008  [ CEDD6F4E7D84E9F98B34B3FE988373AA ] SiSRaid2        C:\Windows\system32\drivers\sisraid2.sys
22:11:55.0085 4008  SiSRaid2 - ok
22:11:55.0101 4008  [ DF843C528C4F69D12CE41CE462E973A7 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
22:11:55.0116 4008  SiSRaid4 - ok
22:11:55.0303 4008  [ 388AE59FE75F1B959DFA0900923C61BB ] Skype C2C Service C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
22:11:55.0459 4008  Skype C2C Service - ok
22:11:55.0506 4008  [ A4FAB5F7818A69DA6E740943CB8F7CA9 ] SkypeUpdate     C:\Program Files\Skype\Updater\Updater.exe
22:11:55.0537 4008  SkypeUpdate - ok
22:11:55.0647 4008  [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc           C:\Windows\system32\SLsvc.exe
22:11:55.0803 4008  slsvc - ok
22:11:55.0849 4008  [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify      C:\Windows\system32\SLUINotify.dll
22:11:55.0912 4008  SLUINotify - ok
22:11:55.0943 4008  [ 7B75299A4D201D6A6533603D6914AB04 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
22:11:55.0974 4008  Smb - ok
22:11:56.0021 4008  [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
22:11:56.0037 4008  SNMPTRAP - ok
22:11:56.0083 4008  [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr           C:\Windows\system32\drivers\spldr.sys
22:11:56.0099 4008  spldr - ok
22:11:56.0146 4008  [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler         C:\Windows\System32\spoolsv.exe
22:11:56.0177 4008  Spooler - ok
22:11:56.0239 4008  [ 41987F9FC0E61ADF54F581E15029AD91 ] srv             C:\Windows\system32\DRIVERS\srv.sys
22:11:56.0286 4008  srv - ok
22:11:56.0317 4008  [ FF33AFF99564B1AA534F58868CBE41EF ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
22:11:56.0349 4008  srv2 - ok
22:11:56.0395 4008  [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
22:11:56.0442 4008  srvnet - ok
22:11:56.0473 4008  [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
22:11:56.0551 4008  SSDPSRV - ok
22:11:56.0598 4008  [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv          C:\Windows\system32\DRIVERS\ssmdrv.sys
22:11:56.0614 4008  ssmdrv - ok
22:11:56.0676 4008  [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc         C:\Windows\system32\sstpsvc.dll
22:11:56.0723 4008  SstpSvc - ok
22:11:56.0785 4008  [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc          C:\Windows\System32\wiaservc.dll
22:11:56.0817 4008  stisvc - ok
22:11:56.0848 4008  [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
22:11:56.0879 4008  swenum - ok
22:11:56.0910 4008  [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv           C:\Windows\System32\swprv.dll
22:11:56.0988 4008  swprv - ok
22:11:57.0035 4008  [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx         C:\Windows\system32\drivers\symc8xx.sys
22:11:57.0066 4008  Symc8xx - ok
22:11:57.0097 4008  [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi          C:\Windows\system32\drivers\sym_hi.sys
22:11:57.0113 4008  Sym_hi - ok
22:11:57.0144 4008  [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3          C:\Windows\system32\drivers\sym_u3.sys
22:11:57.0160 4008  Sym_u3 - ok
22:11:57.0207 4008  [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain         C:\Windows\system32\sysmain.dll
22:11:57.0316 4008  SysMain - ok
22:11:57.0363 4008  [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll
22:11:57.0409 4008  TabletInputService - ok
22:11:57.0425 4008  [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv         C:\Windows\System32\tapisrv.dll
22:11:57.0487 4008  TapiSrv - ok
22:11:57.0519 4008  [ CB05822CD9CC6C688168E113C603DBE7 ] TBS             C:\Windows\System32\tbssvc.dll
22:11:57.0565 4008  TBS - ok
22:11:57.0612 4008  [ 27D470DABC77BC60D0A3B0E4DEB6CB91 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
22:11:57.0675 4008  Tcpip - ok
22:11:57.0706 4008  [ 27D470DABC77BC60D0A3B0E4DEB6CB91 ] Tcpip6          C:\Windows\system32\DRIVERS\tcpip.sys
22:11:57.0753 4008  Tcpip6 - ok
22:11:57.0784 4008  [ 608C345A255D82A6289C2D468EB41FD7 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
22:11:57.0831 4008  tcpipreg - ok
22:11:57.0877 4008  [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
22:11:57.0924 4008  TDPIPE - ok
22:11:57.0971 4008  [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
22:11:58.0033 4008  TDTCP - ok
22:11:58.0065 4008  [ 76B06EB8A01FC8624D699E7045303E54 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
22:11:58.0111 4008  tdx - ok
22:11:58.0158 4008  [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
22:11:58.0174 4008  TermDD - ok
22:11:58.0221 4008  [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService     C:\Windows\System32\termsrv.dll
22:11:58.0252 4008  TermService - ok
22:11:58.0267 4008  [ C7230FBEE14437716701C15BE02C27B8 ] Themes          C:\Windows\system32\shsvcs.dll
22:11:58.0299 4008  Themes - ok
22:11:58.0299 4008  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER     C:\Windows\system32\mmcss.dll
22:11:58.0330 4008  THREADORDER - ok
22:11:58.0361 4008  [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks          C:\Windows\System32\trkwks.dll
22:11:58.0408 4008  TrkWks - ok
22:11:58.0470 4008  [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
22:11:58.0501 4008  TrustedInstaller - ok
22:11:58.0548 4008  [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
22:11:58.0595 4008  tssecsrv - ok
22:11:58.0642 4008  [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp           C:\Windows\system32\DRIVERS\tunmp.sys
22:11:58.0673 4008  tunmp - ok
22:11:58.0704 4008  [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
22:11:58.0720 4008  tunnel - ok
22:11:58.0751 4008  [ C3ADE15414120033A36C0F293D4A4121 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
22:11:58.0767 4008  uagp35 - ok
22:11:58.0813 4008  [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
22:11:58.0845 4008  udfs - ok
22:11:58.0891 4008  [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect       C:\Windows\system32\UI0Detect.exe
22:11:58.0923 4008  UI0Detect - ok
22:11:58.0938 4008  [ 75E6890EBFCE0841D3291B02E7A8BDB0 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
22:11:58.0954 4008  uliagpkx - ok
22:11:58.0985 4008  [ 3CD4EA35A6221B85DCC25DAA46313F8D ] uliahci         C:\Windows\system32\drivers\uliahci.sys
22:11:59.0001 4008  uliahci - ok
22:11:59.0016 4008  [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata          C:\Windows\system32\drivers\ulsata.sys
22:11:59.0032 4008  UlSata - ok
22:11:59.0047 4008  [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2         C:\Windows\system32\drivers\ulsata2.sys
22:11:59.0063 4008  ulsata2 - ok
22:11:59.0125 4008  [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
22:11:59.0141 4008  umbus - ok
22:11:59.0188 4008  [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost        C:\Windows\System32\upnphost.dll
22:11:59.0250 4008  upnphost - ok
22:11:59.0297 4008  [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
22:11:59.0328 4008  usbccgp - ok
22:11:59.0344 4008  [ E9476E6C486E76BC4898074768FB7131 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
22:11:59.0422 4008  usbcir - ok
22:11:59.0484 4008  [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys
22:11:59.0531 4008  usbehci - ok
22:11:59.0578 4008  [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
22:11:59.0593 4008  usbhub - ok
22:11:59.0609 4008  [ 38DBC7DD6CC5A72011F187425384388B ] usbohci         C:\Windows\system32\drivers\usbohci.sys
22:11:59.0687 4008  usbohci - ok
22:11:59.0734 4008  [ E75C4B5269091D15A2E7DC0B6D35F2F5 ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
22:11:59.0781 4008  usbprint - ok
22:11:59.0827 4008  [ A508C9BD8724980512136B039BBA65E9 ] usbscan         C:\Windows\system32\DRIVERS\usbscan.sys
22:11:59.0843 4008  usbscan - ok
22:11:59.0890 4008  [ D575246188F63DE0ACCF6EAC5FB59E6A ] usbser          C:\Windows\system32\drivers\usbser.sys
22:11:59.0905 4008  usbser - ok
22:11:59.0921 4008  [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
22:11:59.0937 4008  USBSTOR - ok
22:11:59.0968 4008  [ 814D653EFC4D48BE3B04A307ECEFF56F ] usbuhci         C:\Windows\system32\DRIVERS\usbuhci.sys
22:11:59.0999 4008  usbuhci - ok
22:12:00.0046 4008  [ E67998E8F14CB0627A769F6530BCB352 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys
22:12:00.0077 4008  usbvideo - ok
22:12:00.0108 4008  [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms           C:\Windows\System32\uxsms.dll
22:12:00.0124 4008  UxSms - ok
22:12:00.0171 4008  [ CD88D1B7776DC17A119049742EC07EB4 ] vds             C:\Windows\System32\vds.exe
22:12:00.0202 4008  vds - ok
22:12:00.0233 4008  [ 87B06E1F30B749A114F74622D013F8D4 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
22:12:00.0264 4008  vga - ok
22:12:00.0280 4008  [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave         C:\Windows\System32\drivers\vga.sys
22:12:00.0327 4008  VgaSave - ok
22:12:00.0373 4008  [ 045D9961E591CF0674A920B6BA3BA5CB ] viaagp          C:\Windows\system32\drivers\viaagp.sys
22:12:00.0389 4008  viaagp - ok
22:12:00.0405 4008  [ 56A4DE5F02F2E88182B0981119B4DD98 ] ViaC7           C:\Windows\system32\drivers\viac7.sys
22:12:00.0467 4008  ViaC7 - ok
22:12:00.0498 4008  [ FD2E3175FCADA350C7AB4521DCA187EC ] viaide          C:\Windows\system32\drivers\viaide.sys
22:12:00.0514 4008  viaide - ok
22:12:00.0561 4008  [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
22:12:00.0561 4008  volmgr - ok
22:12:00.0592 4008  [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
22:12:00.0607 4008  volmgrx - ok
22:12:00.0654 4008  [ 786DB5771F05EF300390399F626BF30A ] volsnap         C:\Windows\system32\drivers\volsnap.sys
22:12:00.0670 4008  volsnap - ok
22:12:00.0717 4008  [ D984439746D42B30FC65A4C3546C6829 ] vsmraid         C:\Windows\system32\drivers\vsmraid.sys
22:12:00.0717 4008  vsmraid - ok
22:12:00.0779 4008  [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS             C:\Windows\system32\vssvc.exe
22:12:00.0857 4008  VSS - ok
22:12:00.0904 4008  [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time         C:\Windows\system32\w32time.dll
22:12:00.0951 4008  W32Time - ok
22:12:00.0982 4008  [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
22:12:01.0060 4008  WacomPen - ok
22:12:01.0091 4008  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp          C:\Windows\system32\DRIVERS\wanarp.sys
22:12:01.0138 4008  Wanarp - ok
22:12:01.0153 4008  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
22:12:01.0169 4008  Wanarpv6 - ok
22:12:01.0216 4008  [ A3CD60FD826381B49F03832590E069AF ] wcncsvc         C:\Windows\System32\wcncsvc.dll
22:12:01.0294 4008  wcncsvc - ok
22:12:01.0341 4008  [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
22:12:01.0372 4008  WcsPlugInService - ok
22:12:01.0387 4008  [ AFC5AD65B991C1E205CF25CFDBF7A6F4 ] Wd              C:\Windows\system32\drivers\wd.sys
22:12:01.0419 4008  Wd - ok
22:12:01.0465 4008  [ A840213F1ACDCC175B4D1D5AAEAC0D7A ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
22:12:01.0497 4008  Wdf01000 - ok
22:12:01.0543 4008  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost  C:\Windows\system32\wdi.dll
22:12:01.0606 4008  WdiServiceHost - ok
22:12:01.0606 4008  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost   C:\Windows\system32\wdi.dll
22:12:01.0637 4008  WdiSystemHost - ok
22:12:01.0684 4008  [ 04C37D8107320312FBAE09926103D5E2 ] WebClient       C:\Windows\System32\webclnt.dll
22:12:01.0699 4008  WebClient - ok
22:12:01.0731 4008  [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc          C:\Windows\system32\wecsvc.dll
22:12:01.0777 4008  Wecsvc - ok
22:12:01.0809 4008  [ 670FF720071ED741206D69BD995EA453 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
22:12:01.0855 4008  wercplsupport - ok
22:12:01.0902 4008  [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc          C:\Windows\System32\WerSvc.dll
22:12:01.0933 4008  WerSvc - ok
22:12:01.0996 4008  [ 4575AA12561C5648483403541D0D7F2B ] WinDefend       C:\Program Files\Windows Defender\mpsvc.dll
22:12:02.0011 4008  WinDefend - ok
22:12:02.0027 4008  WinHttpAutoProxySvc - ok
22:12:02.0074 4008  [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
22:12:02.0105 4008  Winmgmt - ok
22:12:02.0167 4008  [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM           C:\Windows\system32\WsmSvc.dll
22:12:02.0261 4008  WinRM - ok
22:12:02.0308 4008  [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc         C:\Windows\System32\wlansvc.dll
22:12:02.0370 4008  Wlansvc - ok
22:12:02.0401 4008  [ 2E7255D172DF0B8283CDFB7B433B864E ] WmiAcpi         C:\Windows\system32\DRIVERS\wmiacpi.sys
22:12:02.0433 4008  WmiAcpi - ok
22:12:02.0464 4008  [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
22:12:02.0511 4008  wmiApSrv - ok
22:12:02.0604 4008  [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc   C:\Program Files\Windows Media Player\wmpnetwk.exe
22:12:02.0682 4008  WMPNetworkSvc - ok
22:12:02.0760 4008  [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc          C:\Windows\System32\wpcsvc.dll
22:12:02.0791 4008  WPCSvc - ok
22:12:02.0854 4008  [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
22:12:02.0885 4008  WPDBusEnum - ok
22:12:02.0932 4008  [ DE9D36F91A4DF3D911626643DEBF11EA ] WpdUsb          C:\Windows\system32\DRIVERS\wpdusb.sys
22:12:02.0947 4008  WpdUsb - ok
22:12:03.0072 4008  [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
22:12:03.0119 4008  WPFFontCache_v0400 - ok
22:12:03.0150 4008  [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
22:12:03.0213 4008  ws2ifsl - ok
22:12:03.0259 4008  [ 1CA6C40261DDC0425987980D0CD2AAAB ] wscsvc          C:\Windows\System32\wscsvc.dll
22:12:03.0291 4008  wscsvc - ok
22:12:03.0306 4008  WSearch - ok
22:12:03.0400 4008  [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv        C:\Windows\system32\wuaueng.dll
22:12:03.0525 4008  wuauserv - ok
22:12:03.0571 4008  [ 06E6F32C8D0A3F66D956F57B43A2E070 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
22:12:03.0634 4008  WudfPf - ok
22:12:03.0665 4008  [ 867C301E8B790040AE9CF6486E8041DF ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
22:12:03.0727 4008  WUDFRd - ok
22:12:03.0759 4008  [ FE47B7BC8EA320C2D9B5E5BF6E303765 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
22:12:03.0790 4008  wudfsvc - ok
22:12:03.0805 4008  ================ Scan global ===============================
22:12:03.0837 4008  [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll
22:12:03.0868 4008  [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
22:12:03.0915 4008  [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
22:12:03.0946 4008  [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\system32\services.exe
22:12:03.0961 4008  [Global] - ok
22:12:03.0961 4008  ================ Scan MBR ==================================
22:12:03.0977 4008  [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk0\DR0
22:12:04.0523 4008  \Device\Harddisk0\DR0 - ok
22:12:04.0523 4008  ================ Scan VBR ==================================
22:12:04.0523 4008  [ 04C67A5EBF0526B15EF098438009AB88 ] \Device\Harddisk0\DR0\Partition1
22:12:04.0523 4008  \Device\Harddisk0\DR0\Partition1 - ok
22:12:04.0539 4008  [ DF0631B79024CA6574261BD1382B1426 ] \Device\Harddisk0\DR0\Partition2
22:12:04.0539 4008  \Device\Harddisk0\DR0\Partition2 - ok
22:12:04.0539 4008  ============================================================
22:12:04.0539 4008  Scan finished
22:12:04.0539 4008  ============================================================
22:12:04.0554 2476  Detected object count: 3
22:12:04.0554 2476  Actual detected object count: 3
22:13:03.0538 2476  HPSLPSVC ( UnsignedFile.Multi.Generic ) - skipped by user
22:13:03.0538 2476  HPSLPSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:13:03.0538 2476  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
22:13:03.0538 2476  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:13:03.0538 2476  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
22:13:03.0538 2476  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:16:58.0583 1144  Deinitialize success
         

Danke für den Tipp mit Laufwerk C: und da ich nun den Screenshot gefunden habe, vielleicht ist da noch was Interessantes?
Man sieht wahrscheinlich, dass ich Februar/März alles neu geladen hatte, denn da war der Bildschirm mal plötzlich schwarz. Ich dachte es liegt daran, dass mir öfter der Strom ausgeht, denn der Akku funktioniert nicht mehr. Habe dann alles neu geladen, ich glaube ich musste das 2mal machen.
Die 0000-Datei kommt mir komisch vor. ich mach sie jetzt nicht auf.

Problem: Wie verschicke ich den Bildschirmdruck?? Als Grafik lässt es sich nicht einfügen... Als Anhang rtf ... vielleicht ist es ja nicht so wichtig.

Gute Nacht!

Die Datei heißt <$$DeleteMepoqexec.01ccef963d7265f6.0000> vom 19.2.2012 und hat 98 KB

Als Anhang rtf ... vielleicht ist es ja nicht so wichtig.

Wer ist eigentlich auf die Idee gekommen Bilder in Word- oder RTF-Dokumente zu kippen?!
Was soll dieser Umstand, du kannst das Bild direkt hochladen, man muss es doch nicht in ein Textdokument kippen um es dann neu abzuspeichern

Lad das Bild entweder hier als Anhang hoch oder bei Saved.im

Tja, z.B. Lehrer fügen stänig Bilder in Textdateien ein... bin aber auch Autodidakt, was die Bildbearbeitung angeht!
Ich kann es leider nur als bmp abspeichern und bislang krieg ich es nicht klein genug, als dass es bei saved im angenommen würde. Ich hab zwar paint, aber das erzeugt keine jpg-Datei. Und irgendwo muss ich es doch speichern, bevor ich es hochlade, oder was bedeutet "direkt"? Ich probier weiter,

screenshotbootca.bmp - Saved.im

Ich hoffe, das ist es... Danke für die Geduld.

Bittte?
MS-Paint kann in JPG und PNG und anderen Formaten speichern.
Sonst nimm einfach einen anderen Screenshotter zB Greenshot oder einfach das Bordmittel "Snipping Tool" von Windows.

So, nun hab ich das Bild hoffentlich angehängt...
Danke!

Das scheint eine rel.alte Datei zu sein, die warum auch immer nicht automatisch gelöscht wurde. Irrelevant im Moment.

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

• Lade dir ComboFix hier herunter auf deinen Desktop.

• Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

• Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
  Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

• Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Dank auch für die genaue Anleitung, ich musste tatsächlich neu starten vor Zugang zum Internet; hier das log:

ComboFix 13-01-28.02 - Kathrin 28.01.2013  21:41:12.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3070.2123 [GMT 1:00]
ausgeführt von:: c:\users\Kathrin\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-12-28 bis 2013-01-28  ))))))))))))))))))))))))))))))
.
.
2013-01-28 20:48 . 2013-01-28 20:48	--------	d-----w-	c:\users\Kathrin\AppData\Local\temp
2013-01-28 20:48 . 2013-01-28 20:48	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-01-27 18:03 . 2013-01-27 18:04	--------	d-----w-	c:\program files\Paint.NET
2013-01-27 18:03 . 2013-01-27 18:06	--------	d-----w-	c:\users\Kathrin\AppData\Local\Paint.NET
2013-01-25 18:30 . 2013-01-08 04:57	6991832	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{E5AE9216-EFDA-4007-8AD1-24790BFE42B2}\mpengine.dll
2013-01-23 19:58 . 2013-01-27 18:11	--------	d-----w-	c:\users\Kathrin\Computerpflege
2013-01-21 22:12 . 2013-01-21 22:12	100352	----a-w-	C:\ugdiafow.sys
2013-01-20 21:45 . 2013-01-20 21:45	--------	d-----w-	c:\users\Kathrin\AppData\Roaming\Malwarebytes
2013-01-20 21:45 . 2013-01-20 21:45	--------	d-----w-	c:\programdata\Malwarebytes
2013-01-20 21:45 . 2013-01-20 21:45	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2013-01-20 21:45 . 2012-12-14 15:49	21104	----a-w-	c:\windows\system32\drivers\mbam.sys
2013-01-20 19:48 . 2013-01-20 19:48	--------	d-----w-?	c:\progra~2\P2223~1
2013-01-20 11:34 . 2013-01-20 11:34	--------	d-----w-	c:\progra~2\30B9~1
2013-01-20 09:16 . 2013-01-20 09:16	--------	d-----w-	c:\progra~2\9D81~1
2013-01-19 13:59 . 2013-01-19 13:59	--------	d-----w-	c:\progra~2\9899~1
2013-01-17 17:32 . 2013-01-17 17:32	--------	d-----w-	c:\progra~2\6EA1~1
2013-01-16 16:47 . 2013-01-16 16:47	--------	d-----w-	c:\progra~2\7DA1~1
2013-01-12 18:38 . 2013-01-12 18:38	--------	d-----w-	c:\progra~2\B099~1
2013-01-12 10:17 . 2013-01-12 10:17	--------	d-----w-	c:\progra~2\1F81~1
2013-01-12 09:35 . 2013-01-12 09:35	--------	d-----w-	c:\progra~2\DCA9~1
2013-01-10 20:56 . 2013-01-10 20:56	--------	d-----w-	c:\progra~2\28A9~1
2013-01-10 05:18 . 2012-11-23 01:35	2048000	----a-w-	c:\windows\system32\win32k.sys
2013-01-10 05:17 . 2012-11-20 04:22	204288	----a-w-	c:\windows\system32\ncrypt.dll
2013-01-10 05:17 . 2012-11-02 10:19	1400832	----a-w-	c:\windows\system32\msxml6.dll
2013-01-10 05:06 . 2013-01-10 05:06	--------	d-----w-	c:\progra~2\F899~1
2013-01-09 15:46 . 2013-01-09 15:46	--------	d-----w-	c:\progra~2\1AA1~1
2013-01-06 09:12 . 2013-01-06 09:12	--------	d-----w-	c:\progra~2\GGA681~1
2013-01-05 20:06 . 2013-01-05 20:06	--------	d-----w-	c:\progra~2\3299~1
2013-01-05 12:35 . 2013-01-05 12:35	--------	d-----w-	c:\progra~2\E491~1
2013-01-03 16:45 . 2013-01-03 16:45	--------	d-----w-	c:\progra~2\6BA1~1
2013-01-03 06:36 . 2013-01-03 06:36	--------	d-----w-	c:\progra~2\E3A1~1
2013-01-02 10:19 . 2013-01-02 10:19	--------	d-----w-	c:\progra~2\EE77~1
2013-01-01 21:36 . 2013-01-01 21:36	--------	d-----w-	c:\progra~2\FC89~1
2013-01-01 14:27 . 2013-01-01 14:27	--------	d-----w-	c:\progra~2\EEA9~1
2012-12-31 15:57 . 2012-12-31 15:57	--------	d-----w-	c:\progra~2\FDA9~1
2012-12-30 23:13 . 2012-12-30 23:13	--------	d-----w-	c:\program files\DomaIQ Uninstaller
2012-12-30 23:06 . 2012-12-30 23:06	--------	d-----w-	c:\programdata\Tarma Installer
2012-12-30 23:06 . 2012-12-30 23:06	--------	d-----w-	c:\programdata\Babylon
2012-12-30 23:06 . 2012-12-30 23:06	--------	d-----w-	c:\users\Kathrin\AppData\Roaming\Babylon
2012-12-30 21:45 . 2012-12-16 13:12	34304	----a-w-	c:\windows\system32\atmlib.dll
2012-12-30 21:45 . 2012-12-16 10:50	293376	----a-w-	c:\windows\system32\atmfd.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-10 05:10 . 2012-05-01 19:57	697864	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-01-10 05:10 . 2012-02-26 18:51	74248	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-11-14 02:09 . 2012-12-15 11:15	1800704	----a-w-	c:\windows\system32\jscript9.dll
2012-11-14 01:58 . 2012-12-15 11:15	1427968	----a-w-	c:\windows\system32\inetcpl.cpl
2012-11-14 01:57 . 2012-12-15 11:15	1129472	----a-w-	c:\windows\system32\wininet.dll
2012-11-14 01:49 . 2012-12-15 11:15	142848	----a-w-	c:\windows\system32\ieUnatt.exe
2012-11-14 01:48 . 2012-12-15 11:15	420864	----a-w-	c:\windows\system32\vbscript.dll
2012-11-14 01:44 . 2012-12-15 11:15	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2012-11-13 01:29 . 2012-12-12 14:36	2048	----a-w-	c:\windows\system32\tzres.dll
2012-11-02 10:18 . 2012-12-12 14:37	376320	----a-w-	c:\windows\system32\dpnet.dll
2012-11-02 08:26 . 2012-12-12 14:37	23040	----a-w-	c:\windows\system32\dpnsvr.exe
2013-01-20 09:34 . 2012-12-08 18:31	262552	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-08-14 348664]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2012-11-04 98304]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
HPService	REG_MULTI_SZ   	HPSLPSVC
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2013-01-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-01 05:10]
.
2013-01-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-02-26 18:51]
.
2013-01-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-02-26 18:51]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.babylon.com/?affID=115935&tt=5212_2&babsrc=HP_ss&mntrId=ca977a3d0000000000000016d38b9fd2
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tg1lbb8p.default\
FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
FF - prefs.js: browser.startup.homepage - hxxps://startpage.com/deu/
FF - prefs.js: network.proxy.type - 0
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=ca977a3d0000000000000016d38b9fd2&q=
FF - user.js: extensions.BabylonToolbar.id - ca977a3d0000000000000016d38b9fd2
FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB}
FF - user.js: extensions.BabylonToolbar.instlDay - 15704
FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.7.2
FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.7.2
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.8.7.20:07
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar_i.excTlbr - false
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=115935&tt=5212_2
FF - user.js: extensions.BabylonToolbar_i.babExt - 
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar.autoRvrt - false
FF - user.js: extensions.BabylonToolbar.rvrt - false
FF - user.js: extensions.BabylonToolbar_i.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-WudfPf
SafeBoot-WudfRd
AddRemove-Updater Service - c:\programdata\IBUpdaterService\ibsvc.exe
AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\bm_installer.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-01-28 21:48
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Zeit der Fertigstellung: 2013-01-28  21:50:29
ComboFix-quarantined-files.txt  2013-01-28 20:50
.
Vor Suchlauf: 13 Verzeichnis(se), 159.887.917.056 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 159.841.013.760 Bytes frei
.
- - End Of File - - 040E32CB82F4AB00EA940534570A50B7
         

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Folder::
c:\progra~2\P2223~1
c:\progra~2\30B9~1
c:\progra~2\9D81~1
c:\progra~2\9899~1
c:\progra~2\6EA1~1
c:\progra~2\7DA1~1
c:\progra~2\B099~1
c:\progra~2\1F81~1
c:\progra~2\DCA9~1
c:\progra~2\28A9~1
c:\progra~2\F899~1
c:\progra~2\1AA1~1
c:\progra~2\GGA681~1
c:\progra~2\3299~1
c:\progra~2\E491~1
c:\progra~2\6BA1~1
c:\progra~2\E3A1~1
c:\progra~2\EE77~1
c:\progra~2\FC89~1
c:\progra~2\EEA9~1
c:\progra~2\FDA9~1
         

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.



6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Ja ich habe das Script erstellt, zögere nun, da ich Antivir deaktivieren kann, aber ...

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

... hab ich da noch was zu schließen? Gibt es ein Windows Defender? Hatt ich doch mal, aber wo? Was ist ein Tea Timer?
Und wieso ist meine Reboot D total voll?
hxxp://www.trojaner-board.de/images/smilies/dankeschoen.gif

Vergiss jetzt mal den TeaTimer und den WindowsDefender, einfach den Fix machen wenn AntiVir inaktiv ist

Danke für das Skript!

ComboFix 13-01-28.02 - Kathrin 30.01.2013  16:16:52.2.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3070.2220 [GMT 1:00]
ausgeführt von:: c:\users\Kathrin\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Kathrin\Desktop\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\progra~2\1AA1~1
c:\progra~2\1F81~1
c:\progra~2\28A9~1
c:\progra~2\30B9~1
c:\progra~2\3299~1
c:\progra~2\6BA1~1
c:\progra~2\6EA1~1
c:\progra~2\7DA1~1
c:\progra~2\9899~1
c:\progra~2\9D81~1
c:\progra~2\B099~1
c:\progra~2\DCA9~1
c:\progra~2\E3A1~1
c:\progra~2\E491~1
c:\progra~2\EE77~1
c:\progra~2\EEA9~1
c:\progra~2\F899~1
c:\progra~2\FC89~1
c:\progra~2\FDA9~1
c:\progra~2\GGA681~1
c:\progra~2\P2223~1
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-12-28 bis 2013-01-30  ))))))))))))))))))))))))))))))
.
.
2013-01-30 15:25 . 2013-01-30 15:25	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-01-29 20:50 . 2013-01-29 20:50	--------	d-----w-	c:\users\Kathrin\AppData\Local\Apps
2013-01-29 20:17 . 2013-01-08 04:57	6991832	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{A45CE073-6E1D-457C-BD32-5D0A544EB3CD}\mpengine.dll
2013-01-28 20:50 . 2013-01-30 15:25	--------	d-----w-	c:\users\Kathrin\AppData\Local\temp
2013-01-27 18:03 . 2013-01-27 18:04	--------	d-----w-	c:\program files\Paint.NET
2013-01-27 18:03 . 2013-01-27 18:06	--------	d-----w-	c:\users\Kathrin\AppData\Local\Paint.NET
2013-01-23 19:58 . 2013-01-27 18:11	--------	d-----w-	c:\users\Kathrin\Computerpflege
2013-01-21 22:12 . 2013-01-21 22:12	100352	----a-w-	C:\ugdiafow.sys
2013-01-20 21:45 . 2013-01-20 21:45	--------	d-----w-	c:\users\Kathrin\AppData\Roaming\Malwarebytes
2013-01-20 21:45 . 2013-01-20 21:45	--------	d-----w-	c:\programdata\Malwarebytes
2013-01-20 21:45 . 2013-01-20 21:45	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2013-01-20 21:45 . 2012-12-14 15:49	21104	----a-w-	c:\windows\system32\drivers\mbam.sys
2013-01-10 05:18 . 2012-11-23 01:35	2048000	----a-w-	c:\windows\system32\win32k.sys
2013-01-10 05:17 . 2012-11-20 04:22	204288	----a-w-	c:\windows\system32\ncrypt.dll
2013-01-10 05:17 . 2012-11-02 10:19	1400832	----a-w-	c:\windows\system32\msxml6.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-10 05:10 . 2012-05-01 19:57	697864	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-01-10 05:10 . 2012-02-26 18:51	74248	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-16 13:12 . 2012-12-30 21:45	34304	----a-w-	c:\windows\system32\atmlib.dll
2012-12-16 10:50 . 2012-12-30 21:45	293376	----a-w-	c:\windows\system32\atmfd.dll
2012-11-14 02:09 . 2012-12-15 11:15	1800704	----a-w-	c:\windows\system32\jscript9.dll
2012-11-14 01:58 . 2012-12-15 11:15	1427968	----a-w-	c:\windows\system32\inetcpl.cpl
2012-11-14 01:57 . 2012-12-15 11:15	1129472	----a-w-	c:\windows\system32\wininet.dll
2012-11-14 01:49 . 2012-12-15 11:15	142848	----a-w-	c:\windows\system32\ieUnatt.exe
2012-11-14 01:48 . 2012-12-15 11:15	420864	----a-w-	c:\windows\system32\vbscript.dll
2012-11-14 01:44 . 2012-12-15 11:15	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2012-11-13 01:29 . 2012-12-12 14:36	2048	----a-w-	c:\windows\system32\tzres.dll
2012-11-02 10:18 . 2012-12-12 14:37	376320	----a-w-	c:\windows\system32\dpnet.dll
2012-11-02 08:26 . 2012-12-12 14:37	23040	----a-w-	c:\windows\system32\dpnsvr.exe
2013-01-20 09:34 . 2012-12-08 18:31	262552	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-08-14 348664]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2012-11-04 98304]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
HPService	REG_MULTI_SZ   	HPSLPSVC
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2013-01-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-01 05:10]
.
2013-01-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-02-26 18:51]
.
2013-01-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-02-26 18:51]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.babylon.com/?affID=115935&tt=5212_2&babsrc=HP_ss&mntrId=ca977a3d0000000000000016d38b9fd2
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tg1lbb8p.default\
FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
FF - prefs.js: browser.startup.homepage - hxxps://startpage.com/deu/
FF - prefs.js: network.proxy.type - 0
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=ca977a3d0000000000000016d38b9fd2&q=
FF - user.js: extensions.BabylonToolbar.id - ca977a3d0000000000000016d38b9fd2
FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB}
FF - user.js: extensions.BabylonToolbar.instlDay - 15704
FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.7.2
FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.7.2
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.8.7.20:07
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar_i.excTlbr - false
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=115935&tt=5212_2
FF - user.js: extensions.BabylonToolbar_i.babExt - 
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar.autoRvrt - false
FF - user.js: extensions.BabylonToolbar.rvrt - false
FF - user.js: extensions.BabylonToolbar_i.newTab - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-01-30 16:25
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Zeit der Fertigstellung: 2013-01-30  16:30:44
ComboFix-quarantined-files.txt  2013-01-30 15:30
ComboFix2.txt  2013-01-28 20:50
.
Vor Suchlauf: 16 Verzeichnis(se), 162.983.301.120 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 162.960.896.000 Bytes frei
.
- - End Of File - - 6ADFBD45021514DB00D23EB010F8AB7A