Searchcore und mehr auf PC?

UliBa · 11.02.2013, 21:44

Hallo,
erst mal vielen Dank, dass Ihr diese Möglichkeit der Hilfe anbiete!
Ich bin also neu hier und versuche einem Freund zu hlefen, der von T-Online einen Brief bekam, von seinem COmputer gingen Hackerangriffe aus. Genauere Infos gab's nicht.
Ich habe dann mit diversen Live-CDs gescannt (Kaspersky, Avira, Bitdefender), Malwarbytes Anti-Malware, Spybbot S und D; und nun noch GMER und OTL.
Kaspersky fand gar nichts, Avira fand angeblich was im Werksimage (Factory.WIM) und Bitdefender wiederum verdächtigte eine Avira-Datei.
Malwarbytes fand etwas, siehe beigefügte Logs.
Zu GMER und OTL hätte ich gerne Eure Hilfe bezüglich der Auswertung und weiteren Vorgehensweise. Bei OTL war ich unsicher und habe einen Scan mit 30 Tagen und einen mit 360 Tagen durchgeführt.
In den Logs habe ich seinen Namen immer durch NAME ersetzt.
Danke schon mal!

cosinus · 12.02.2013, 15:40

Hallo und

Mal eine kurze Frage, das ist jetzt nichts speziell gegen dich, ich hätte auch jeden anderen fragen können der die Logs so postet - wo bitte steht, dass die Logs in den Anhang gelegt werden sollen bzw. wo genau hast du das herausgelesen?

Logfiles im Anhang erschweren die Auswertung massivst

Bitte um Erläuterung damit man die Textstelle in der Anleitung für alle Neulinge mal gezielt ändern/verbessern kann. Danke.

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.

Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.
Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.
Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!
Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!
Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

UliBa · 12.02.2013, 18:48

Hallo Cosinus,

zunächst danke für Deine Antwort.
Dass die Logs als Anhänge kommen liegt daran, dass es zu viele waren bzw. zu lang, so dass mir immer, wenn ich das Thema posten wollte, angezeigt wurde, der Text sei zu lang und ich solle die Logs zippen und als Anhang schicken.
Tut mir leid, dass das die Arbeit erschwert, was ich verstehe. Ich hatte nämlich vorher alles schön in die Code-Tags gesetzt.

Ansonsten mache ich mich jetzt an die Arbeit und folge Deinen Anweisungen. Melde mch dann wieder.

Hier das Log von Malwarebytes Anti-Rootkit, das erfreulicherweise nichts gefunden hat:

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 1.01.0.1020
www.malwarebytes.org

Database version: v2013.02.12.07

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
NAME :: NAME-PC [administrator]

12.02.2013 19:39:50
mbar-log-2013-02-12 (19-39-50).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled: 
Objects scanned: 28960
Time elapsed: 28 minute(s), 49 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

Und hier das Log von aswMBR:

Code:

ATTFilter

aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2013-02-12 19:43:04
-----------------------------
19:43:04.225    OS Version: Windows 6.0.6002 Service Pack 2
19:43:04.225    Number of processors: 2 586 0x301
19:43:04.225    ComputerName: NAME-PC  UserName: NAME
19:43:05.239    Initialize success
19:44:21.040    AVAST engine defs: 13021200
19:44:29.198    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000008d
19:44:29.214    Disk 0 Vendor: WDC_WD32 11.0 Size: 305245MB BusType: 8
19:44:29.230    Disk 0 MBR read successfully
19:44:29.245    Disk 0 MBR scan
19:44:29.261    Disk 0 Windows VISTA default MBR code
19:44:29.292    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS         9000 MB offset 2048
19:44:29.323    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        96419 MB offset 18434048
19:44:29.370    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       199824 MB offset 215900160
19:44:29.401    Disk 0 scanning sectors +625140400
19:44:29.557    Disk 0 scanning C:\Windows\system32\drivers
19:44:47.903    Service scanning
19:45:17.636    Modules scanning
19:45:26.014    Disk 0 trace - called modules:
19:45:26.076    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys ahcix86s.sys 
19:45:26.107    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86272ac8]
19:45:26.107    3 CLASSPNP.SYS[88b9d8b3] -> nt!IofCallDriver -> [0x85b3cb68]
19:45:26.123    5 acpi.sys[806176bc] -> nt!IofCallDriver -> \Device\0000008d[0x8554e960]
19:45:28.057    AVAST engine scan C:\Windows
19:45:33.938    AVAST engine scan C:\Windows\system32
19:51:09.448    AVAST engine scan C:\Windows\system32\drivers
19:51:27.902    AVAST engine scan C:\Users\NAME
20:00:23.201    AVAST engine scan C:\ProgramData
20:05:45.029    Scan finished successfully
20:07:33.194    Disk 0 MBR has been saved successfully to "C:\Users\NAME\Desktop\MBR.dat"
20:07:33.194    The log file has been saved successfully to "C:\Users\NAME\Desktop\aswMBR.txt"

cosinus · 13.02.2013, 08:59

Ist unauffällig, weiter gehts:

Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

UliBa · 13.02.2013, 12:00

Hier das Log von TDSSKiller

Code:

ATTFilter

11:55:50.0735 3700  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
11:55:51.0078 3700  ============================================================
11:55:51.0078 3700  Current date / time: 2013/02/13 11:55:51.0078
11:55:51.0078 3700  SystemInfo:
11:55:51.0078 3700  
11:55:51.0078 3700  OS Version: 6.0.6002 ServicePack: 2.0
11:55:51.0078 3700  Product type: Workstation
11:55:51.0078 3700  ComputerName: NAME-PC
11:55:51.0078 3700  UserName: NAME
11:55:51.0078 3700  Windows directory: C:\Windows
11:55:51.0078 3700  System windows directory: C:\Windows
11:55:51.0078 3700  Processor architecture: Intel x86
11:55:51.0078 3700  Number of processors: 2
11:55:51.0078 3700  Page size: 0x1000
11:55:51.0078 3700  Boot type: Normal boot
11:55:51.0078 3700  ============================================================
11:55:57.0443 3700  Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
11:55:57.0459 3700  ============================================================
11:55:57.0459 3700  \Device\Harddisk0\DR0:
11:55:57.0474 3700  MBR partitions:
11:55:57.0474 3700  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1194800, BlocksNum 0xBC51800
11:55:57.0474 3700  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0xCDE6000, BlocksNum 0x186482B0
11:55:57.0474 3700  ============================================================
11:55:57.0568 3700  C: <-> \Device\Harddisk0\DR0\Partition1
11:55:57.0646 3700  D: <-> \Device\Harddisk0\DR0\Partition2
11:55:57.0646 3700  ============================================================
11:55:57.0646 3700  Initialize success
11:55:57.0646 3700  ============================================================
11:56:34.0930 2184  ============================================================
11:56:34.0930 2184  Scan started
11:56:34.0930 2184  Mode: Manual; 
11:56:34.0930 2184  ============================================================
11:56:37.0909 2184  ================ Scan system memory ========================
11:56:37.0909 2184  System memory - ok
11:56:37.0925 2184  ================ Scan services =============================
11:56:38.0393 2184  [ B33CF4DE909A5B30F526D82053A63C8E ] ABBYY.Licensing.FineReader.Sprint.9.0 C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
11:56:38.0487 2184  ABBYY.Licensing.FineReader.Sprint.9.0 - ok
11:56:38.0689 2184  [ ADC420616C501B45D26C0FD3EF1E54E4 ] ACDaemon        C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
11:56:38.0705 2184  ACDaemon - ok
11:56:39.0454 2184  [ 66DC3740111238C91B875D8A0021834D ] acedrv11        C:\Windows\system32\drivers\acedrv11.sys
11:56:39.0563 2184  acedrv11 - ok
11:56:39.0703 2184  [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI            C:\Windows\system32\drivers\acpi.sys
11:56:39.0735 2184  ACPI - ok
11:56:39.0969 2184  [ 563CDCFEEAEF97163E206AF71A61AA6E ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
11:56:39.0969 2184  AdobeFlashPlayerUpdateSvc - ok
11:56:40.0156 2184  [ 04F0FCAC69C7C71A3AC4EB97FAFC8303 ] adp94xx         C:\Windows\system32\drivers\adp94xx.sys
11:56:40.0218 2184  adp94xx - ok
11:56:40.0327 2184  [ 60505E0041F7751BDBB80F88BF45C2CE ] adpahci         C:\Windows\system32\drivers\adpahci.sys
11:56:40.0374 2184  adpahci - ok
11:56:40.0499 2184  [ 8A42779B02AEC986EAB64ECFC98F8BD7 ] adpu160m        C:\Windows\system32\drivers\adpu160m.sys
11:56:40.0530 2184  adpu160m - ok
11:56:40.0624 2184  [ 241C9E37F8CE45EF51C3DE27515CA4E5 ] adpu320         C:\Windows\system32\drivers\adpu320.sys
11:56:40.0655 2184  adpu320 - ok
11:56:40.0717 2184  [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
11:56:40.0749 2184  AeLookupSvc - ok
11:56:41.0014 2184  [ 666920E5A29A23916116AB93A5F12740 ] AF9035HB        C:\Windows\system32\Drivers\AF9035HB.sys
11:56:41.0045 2184  AF9035HB - ok
11:56:41.0123 2184  [ FE3EA6E9AFC1A78E6EDCA121E006AFB7 ] Afc             C:\Windows\system32\drivers\Afc.sys
11:56:41.0139 2184  Afc - ok
11:56:41.0232 2184  [ 3911B972B55FEA0478476B2E777B29FA ] AFD             C:\Windows\system32\drivers\afd.sys
11:56:41.0248 2184  AFD - ok
11:56:41.0295 2184  [ 13F9E33747E6B41A3FF305C37DB0D360 ] agp440          C:\Windows\system32\drivers\agp440.sys
11:56:41.0295 2184  agp440 - ok
11:56:41.0357 2184  [ FBE4016F9EF3AB3DB547E40A936B6CD9 ] ahcix86s        C:\Windows\system32\drivers\ahcix86s.sys
11:56:41.0357 2184  ahcix86s - ok
11:56:41.0388 2184  [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx         C:\Windows\system32\drivers\djsvs.sys
11:56:41.0388 2184  aic78xx - ok
11:56:41.0419 2184  [ A1545B731579895D8CC44FC0481C1192 ] ALG             C:\Windows\System32\alg.exe
11:56:41.0419 2184  ALG - ok
11:56:41.0435 2184  [ 9EAEF5FC9B8E351AFA7E78A6FAE91F91 ] aliide          C:\Windows\system32\drivers\aliide.sys
11:56:41.0451 2184  aliide - ok
11:56:41.0482 2184  [ C47344BC706E5F0B9DCE369516661578 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
11:56:41.0482 2184  amdagp - ok
11:56:41.0513 2184  [ 9B78A39A4C173FDBC1321E0DD659B34C ] amdide          C:\Windows\system32\drivers\amdide.sys
11:56:41.0513 2184  amdide - ok
11:56:41.0529 2184  [ 18F29B49AD23ECEE3D2A826C725C8D48 ] AmdK7           C:\Windows\system32\drivers\amdk7.sys
11:56:41.0529 2184  AmdK7 - ok
11:56:41.0544 2184  [ 93AE7F7DD54AB986A6F1A1B37BE7442D ] AmdK8           C:\Windows\system32\drivers\amdk8.sys
11:56:41.0544 2184  AmdK8 - ok
11:56:41.0685 2184  [ 459465DA28E49B358ECFE0D788F328F4 ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe
11:56:41.0685 2184  AntiVirSchedulerService - ok
11:56:41.0763 2184  [ BCDD17E8469D647A71B347C4B6F86685 ] AntiVirService  C:\Program Files\Avira\AntiVir Desktop\avguard.exe
11:56:41.0763 2184  AntiVirService - ok
11:56:41.0809 2184  [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo         C:\Windows\System32\appinfo.dll
11:56:41.0809 2184  Appinfo - ok
11:56:41.0841 2184  [ 5D2888182FB46632511ACEE92FDAD522 ] arc             C:\Windows\system32\drivers\arc.sys
11:56:41.0841 2184  arc - ok
11:56:41.0887 2184  [ BD3087540E5B33EA62FCE7EDC54135CD ] archlp          C:\Windows\system32\drivers\archlp.sys
11:56:41.0903 2184  archlp - ok
11:56:41.0950 2184  [ 5E2A321BD7C8B3624E41FDEC3E244945 ] arcsas          C:\Windows\system32\drivers\arcsas.sys
11:56:41.0950 2184  arcsas - ok
11:56:41.0981 2184  [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
11:56:41.0997 2184  AsyncMac - ok
11:56:42.0028 2184  [ 2D9C903DC76A66813D350A562DE40ED9 ] atapi           C:\Windows\system32\drivers\atapi.sys
11:56:42.0028 2184  atapi - ok
11:56:42.0137 2184  [ 24B4375ABBC587BDC99E231383C16B8F ] athr            C:\Windows\system32\DRIVERS\athr.sys
11:56:42.0184 2184  athr - ok
11:56:42.0246 2184  [ 14872220A3642D653E32B2B5480C5928 ] Ati External Event Utility C:\Windows\system32\Ati2evxx.exe
11:56:42.0262 2184  Ati External Event Utility - ok
11:56:42.0402 2184  [ 5A1E51FF7BA5F23AA4585B25AC0E484D ] atikmdag        C:\Windows\system32\DRIVERS\atikmdag.sys
11:56:42.0511 2184  atikmdag - ok
11:56:42.0543 2184  [ 5A1465AD2E7C1BC39CDA12A355329096 ] AtiPcie         C:\Windows\system32\DRIVERS\AtiPcie.sys
11:56:42.0543 2184  AtiPcie - ok
11:56:42.0605 2184  [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
11:56:42.0605 2184  AudioEndpointBuilder - ok
11:56:42.0621 2184  [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv        C:\Windows\System32\Audiosrv.dll
11:56:42.0636 2184  Audiosrv - ok
11:56:42.0667 2184  [ A5C175039B1D6D85D0E79F5855828E4D ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
11:56:42.0667 2184  avgntflt - ok
11:56:42.0745 2184  [ 37B854C7D1F477E66C5B49C7700C47CC ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
11:56:42.0761 2184  avipbb - ok
11:56:42.0777 2184  [ CC4EBA25D80DE42BBC2BF3E553219388 ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
11:56:42.0792 2184  avkmgr - ok
11:56:42.0823 2184  [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep            C:\Windows\system32\drivers\Beep.sys
11:56:42.0823 2184  Beep - ok
11:56:42.0886 2184  [ C789AF0F724FDA5852FB9A7D3A432381 ] BFE             C:\Windows\System32\bfe.dll
11:56:42.0917 2184  BFE - ok
11:56:43.0011 2184  [ 93952506C6D67330367F7E7934B6A02F ] BITS            C:\Windows\System32\qmgr.dll
11:56:43.0057 2184  BITS - ok
11:56:43.0073 2184  [ D4DF28447741FD3D953526E33A617397 ] blbdrive        C:\Windows\system32\drivers\blbdrive.sys
11:56:43.0073 2184  blbdrive - ok
11:56:43.0120 2184  [ 35F376253F687BDE63976CCB3F2108CA ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
11:56:43.0135 2184  bowser - ok
11:56:43.0182 2184  [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo        C:\Windows\system32\drivers\brfiltlo.sys
11:56:43.0182 2184  BrFiltLo - ok
11:56:43.0198 2184  [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp        C:\Windows\system32\drivers\brfiltup.sys
11:56:43.0198 2184  BrFiltUp - ok
11:56:43.0229 2184  [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser         C:\Windows\System32\browser.dll
11:56:43.0229 2184  Browser - ok
11:56:43.0260 2184  [ B304E75CFF293029EDDF094246747113 ] Brserid         C:\Windows\system32\drivers\brserid.sys
11:56:43.0260 2184  Brserid - ok
11:56:43.0291 2184  [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm        C:\Windows\system32\drivers\brserwdm.sys
11:56:43.0291 2184  BrSerWdm - ok
11:56:43.0307 2184  [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm        C:\Windows\system32\drivers\brusbmdm.sys
11:56:43.0323 2184  BrUsbMdm - ok
11:56:43.0338 2184  [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer        C:\Windows\system32\drivers\brusbser.sys
11:56:43.0338 2184  BrUsbSer - ok
11:56:43.0354 2184  [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
11:56:43.0369 2184  BTHMODEM - ok
11:56:43.0416 2184  [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
11:56:43.0416 2184  cdfs - ok
11:56:43.0463 2184  [ 6B4BFFB9BECD728097024276430DB314 ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
11:56:43.0463 2184  cdrom - ok
11:56:43.0525 2184  [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc     C:\Windows\System32\certprop.dll
11:56:43.0525 2184  CertPropSvc - ok
11:56:43.0541 2184  [ E5D4133F37219DBCFE102BC61072589D ] circlass        C:\Windows\system32\drivers\circlass.sys
11:56:43.0541 2184  circlass - ok
11:56:43.0650 2184  [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS            C:\Windows\system32\CLFS.sys
11:56:43.0681 2184  CLFS - ok
11:56:43.0697 2184  ClipInc001 - ok
11:56:43.0791 2184  [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
11:56:43.0822 2184  clr_optimization_v2.0.50727_32 - ok
11:56:43.0900 2184  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
11:56:43.0962 2184  clr_optimization_v4.0.30319_32 - ok
11:56:43.0993 2184  [ 99AFC3795B58CC478FBBBCDC658FCB56 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
11:56:43.0993 2184  CmBatt - ok
11:56:44.0040 2184  [ 0CA25E686A4928484E9FDABD168AB629 ] cmdide          C:\Windows\system32\drivers\cmdide.sys
11:56:44.0040 2184  cmdide - ok
11:56:44.0071 2184  [ 6AFEF0B60FA25DE07C0968983EE4F60A ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
11:56:44.0087 2184  Compbatt - ok
11:56:44.0103 2184  COMSysApp - ok
11:56:44.0118 2184  [ 741E9DFF4F42D2D8477D0FC1DC0DF871 ] crcdisk         C:\Windows\system32\drivers\crcdisk.sys
11:56:44.0149 2184  crcdisk - ok
11:56:44.0165 2184  [ 1F07BECDCA750766A96CDA811BA86410 ] Crusoe          C:\Windows\system32\drivers\crusoe.sys
11:56:44.0181 2184  Crusoe - ok
11:56:44.0227 2184  [ F1E8C34892336D33EDDCDFE44E474F64 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
11:56:44.0227 2184  CryptSvc - ok
11:56:44.0321 2184  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch      C:\Windows\system32\rpcss.dll
11:56:44.0399 2184  DcomLaunch - ok
11:56:44.0493 2184  [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
11:56:44.0493 2184  DfsC - ok
11:56:44.0695 2184  [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR            C:\Windows\system32\DFSR.exe
11:56:44.0820 2184  DFSR - ok
11:56:44.0914 2184  [ 9028559C132146FB75EB7ACF384B086A ] Dhcp            C:\Windows\System32\dhcpcsvc.dll
11:56:44.0914 2184  Dhcp - ok
11:56:44.0961 2184  [ 5D4AEFC3386920236A548271F8F1AF6A ] disk            C:\Windows\system32\drivers\disk.sys
11:56:44.0961 2184  disk - ok
11:56:45.0007 2184  [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache        C:\Windows\System32\dnsrslvr.dll
11:56:45.0007 2184  Dnscache - ok
11:56:45.0070 2184  [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc         C:\Windows\System32\dot3svc.dll
11:56:45.0101 2184  dot3svc - ok
11:56:45.0132 2184  [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS             C:\Windows\system32\dps.dll
11:56:45.0132 2184  DPS - ok
11:56:45.0195 2184  [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
11:56:45.0195 2184  drmkaud - ok
11:56:45.0241 2184  [ C68AC676B0EF30CFBB1080ADCE49EB1F ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
11:56:45.0257 2184  DXGKrnl - ok
11:56:45.0304 2184  [ 5425F74AC0C1DBD96A1E04F17D63F94C ] E1G60           C:\Windows\system32\DRIVERS\E1G60I32.sys
11:56:45.0319 2184  E1G60 - ok
11:56:45.0351 2184  [ C0B95E40D85CD807D614E264248A45B9 ] EapHost         C:\Windows\System32\eapsvc.dll
11:56:45.0351 2184  EapHost - ok
11:56:45.0429 2184  [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache          C:\Windows\system32\drivers\ecache.sys
11:56:45.0429 2184  Ecache - ok
11:56:45.0475 2184  [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
11:56:45.0475 2184  ehRecvr - ok
11:56:45.0491 2184  [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched         C:\Windows\ehome\ehsched.exe
11:56:45.0491 2184  ehSched - ok
11:56:45.0507 2184  [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart         C:\Windows\ehome\ehstart.dll
11:56:45.0507 2184  ehstart - ok
11:56:45.0538 2184  [ 23B62471681A124889978F6295B3F4C6 ] elxstor         C:\Windows\system32\drivers\elxstor.sys
11:56:45.0553 2184  elxstor - ok
11:56:45.0616 2184  [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt         C:\Windows\system32\emdmgmt.dll
11:56:45.0631 2184  EMDMgmt - ok
11:56:45.0647 2184  [ 3DB974F3935483555D7148663F726C61 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
11:56:45.0663 2184  ErrDev - ok
11:56:45.0725 2184  [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem     C:\Windows\system32\es.dll
11:56:45.0741 2184  EventSystem - ok
11:56:45.0787 2184  [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat           C:\Windows\system32\drivers\exfat.sys
11:56:45.0787 2184  exfat - ok
11:56:45.0834 2184  [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
11:56:45.0834 2184  fastfat - ok
11:56:45.0897 2184  [ AFE1E8B9782A0DD7FB46BBD88E43F89A ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
11:56:45.0897 2184  fdc - ok
11:56:45.0912 2184  [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost         C:\Windows\system32\fdPHost.dll
11:56:45.0912 2184  fdPHost - ok
11:56:45.0928 2184  [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub        C:\Windows\system32\fdrespub.dll
11:56:45.0928 2184  FDResPub - ok
11:56:45.0943 2184  [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
11:56:45.0943 2184  FileInfo - ok
11:56:45.0959 2184  [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
11:56:45.0959 2184  Filetrace - ok
11:56:45.0975 2184  [ 85B7CF99D532820495D68D747FDA9EBD ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
11:56:45.0975 2184  flpydisk - ok
11:56:46.0037 2184  [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
11:56:46.0053 2184  FltMgr - ok
11:56:46.0146 2184  [ 8CE364388C8ECA59B14B539179276D44 ] FontCache       C:\Windows\system32\FntCache.dll
11:56:46.0193 2184  FontCache - ok
11:56:46.0271 2184  [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
11:56:46.0271 2184  FontCache3.0.0.0 - ok
11:56:46.0302 2184  [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
11:56:46.0302 2184  Fs_Rec - ok
11:56:46.0333 2184  [ 34582A6E6573D54A07ECE5FE24A126B5 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
11:56:46.0333 2184  gagp30kx - ok
11:56:46.0443 2184  [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc           C:\Windows\System32\gpsvc.dll
11:56:46.0567 2184  gpsvc - ok
11:56:46.0692 2184  [ 626A24ED1228580B9518C01930936DF9 ] gupdate1c9b94ba14fe1d3 C:\Program Files\Google\Update\GoogleUpdate.exe
11:56:46.0708 2184  gupdate1c9b94ba14fe1d3 - ok
11:56:46.0739 2184  [ 626A24ED1228580B9518C01930936DF9 ] gupdatem        C:\Program Files\Google\Update\GoogleUpdate.exe
11:56:46.0739 2184  gupdatem - ok
11:56:46.0786 2184  [ 5467F1FF0AF264566740F67E8B810735 ] gusvc           C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
11:56:46.0786 2184  gusvc - ok
11:56:46.0864 2184  [ 3F90E001369A07243763BD5A523D8722 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
11:56:46.0879 2184  HdAudAddService - ok
11:56:47.0129 2184  [ 062452B7FFD68C8C042A6261FE8DFF4A ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
11:56:47.0160 2184  HDAudBus - ok
11:56:47.0207 2184  [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth          C:\Windows\system32\drivers\hidbth.sys
11:56:47.0207 2184  HidBth - ok
11:56:47.0223 2184  [ FF3160C3A2445128C5A6D9B076DA519E ] HidIr           C:\Windows\system32\drivers\hidir.sys
11:56:47.0223 2184  HidIr - ok
11:56:47.0285 2184  [ 84067081F3318162797385E11A8F0582 ] hidserv         C:\Windows\system32\hidserv.dll
11:56:47.0285 2184  hidserv - ok
11:56:47.0347 2184  [ CCA4B519B17E23A00B826C55716809CC ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
11:56:47.0363 2184  HidUsb - ok
11:56:47.0394 2184  [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc          C:\Windows\system32\kmsvc.dll
11:56:47.0394 2184  hkmsvc - ok
11:56:47.0425 2184  [ 8B566EA71D5B76157A9CDB78F25A5731 ] Hotkey          C:\Windows\system32\drivers\Hotkey.sys
11:56:47.0425 2184  Hotkey - ok
11:56:47.0441 2184  [ 16EE7B23A009E00D835CDB79574A91A6 ] HpCISSs         C:\Windows\system32\drivers\hpcisss.sys
11:56:47.0457 2184  HpCISSs - ok
11:56:47.0519 2184  [ F870AA3E254628EBEAFE754108D664DE ] HTTP            C:\Windows\system32\drivers\HTTP.sys
11:56:47.0535 2184  HTTP - ok
11:56:47.0566 2184  [ C6B032D69650985468160FC9937CF5B4 ] i2omp           C:\Windows\system32\drivers\i2omp.sys
11:56:47.0566 2184  i2omp - ok
11:56:47.0597 2184  [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
11:56:47.0613 2184  i8042prt - ok
11:56:47.0659 2184  [ E5A0034847537EAEE3C00349D5C34C5F ] iaStor          C:\Windows\system32\drivers\iastor.sys
11:56:47.0675 2184  iaStor - ok
11:56:47.0737 2184  [ 54155EA1B0DF185878E0FC9EC3AC3A14 ] iaStorV         C:\Windows\system32\drivers\iastorv.sys
11:56:47.0753 2184  iaStorV - ok
11:56:47.0831 2184  [ 6F95324909B502E2651442C1548AB12F ] IDriverT        C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
11:56:47.0847 2184  IDriverT - ok
11:56:48.0003 2184  [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc           C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
11:56:48.0018 2184  idsvc - ok
11:56:48.0065 2184  [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp           C:\Windows\system32\drivers\iirsp.sys
11:56:48.0065 2184  iirsp - ok
11:56:48.0159 2184  [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT          C:\Windows\System32\ikeext.dll
11:56:48.0190 2184  IKEEXT - ok
11:56:48.0767 2184  [ 23EBCEE9AAA4D6C88728791FAB462456 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
11:56:48.0861 2184  IntcAzAudAddService - ok
11:56:48.0892 2184  [ 83AA759F3189E6370C30DE5DC5590718 ] intelide        C:\Windows\system32\drivers\intelide.sys
11:56:48.0892 2184  intelide - ok
11:56:48.0939 2184  [ 224191001E78C89DFA78924C3EA595FF ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
11:56:48.0939 2184  intelppm - ok
11:56:49.0001 2184  [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
11:56:49.0032 2184  IPBusEnum - ok
11:56:49.0063 2184  [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
11:56:49.0063 2184  IpFilterDriver - ok
11:56:49.0110 2184  [ 1998BD97F950680BB55F55A7244679C2 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
11:56:49.0157 2184  iphlpsvc - ok
11:56:49.0173 2184  IpInIp - ok
11:56:49.0204 2184  [ B25AAF203552B7B3491139D582B39AD1 ] IPMIDRV         C:\Windows\system32\drivers\ipmidrv.sys
11:56:49.0204 2184  IPMIDRV - ok
11:56:49.0235 2184  [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT           C:\Windows\system32\DRIVERS\ipnat.sys
11:56:49.0251 2184  IPNAT - ok
11:56:49.0266 2184  [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
11:56:49.0266 2184  IRENUM - ok
11:56:49.0282 2184  [ 6C70698A3E5C4376C6AB5C7C17FB0614 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
11:56:49.0282 2184  isapnp - ok
11:56:49.0360 2184  [ 232FA340531D940AAC623B121A595034 ] iScsiPrt        C:\Windows\system32\DRIVERS\msiscsi.sys
11:56:49.0375 2184  iScsiPrt - ok
11:56:49.0391 2184  [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi        C:\Windows\system32\drivers\iteatapi.sys
11:56:49.0391 2184  iteatapi - ok
11:56:49.0407 2184  [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid         C:\Windows\system32\drivers\iteraid.sys
11:56:49.0407 2184  iteraid - ok
11:56:49.0453 2184  [ DEDB6CC1B166928A8F3F68DEF1766DB0 ] JMCR            C:\Windows\system32\DRIVERS\jmcr.sys
11:56:49.0469 2184  JMCR - ok
11:56:49.0485 2184  [ C36F3A1A4E8416EF43F30DEAB7701730 ] JRAID           C:\Windows\system32\drivers\jraid.sys
11:56:49.0500 2184  JRAID - ok
11:56:49.0516 2184  [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
11:56:49.0516 2184  kbdclass - ok
11:56:49.0563 2184  [ EDE59EC70E25C24581ADD1FBEC7325F7 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
11:56:49.0563 2184  kbdhid - ok
11:56:49.0609 2184  [ A3E186B4B935905B829219502557314E ] KeyIso          C:\Windows\system32\lsass.exe
11:56:49.0609 2184  KeyIso - ok
11:56:49.0656 2184  [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
11:56:49.0687 2184  KSecDD - ok
11:56:49.0828 2184  [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm           C:\Windows\system32\msdtckrm.dll
11:56:49.0859 2184  KtmRm - ok
11:56:49.0906 2184  [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer    C:\Windows\system32\srvsvc.dll
11:56:49.0921 2184  LanmanServer - ok
11:56:49.0984 2184  [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
11:56:49.0984 2184  LanmanWorkstation - ok
11:56:50.0062 2184  [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
11:56:50.0077 2184  lltdio - ok
11:56:50.0124 2184  [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
11:56:50.0140 2184  lltdsvc - ok
11:56:50.0187 2184  [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts         C:\Windows\System32\lmhsvc.dll
11:56:50.0202 2184  lmhosts - ok
11:56:50.0233 2184  [ C7E15E82879BF3235B559563D4185365 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
11:56:50.0233 2184  LSI_FC - ok
11:56:50.0265 2184  [ EE01EBAE8C9BF0FA072E0FF68718920A ] LSI_SAS         C:\Windows\system32\drivers\lsi_sas.sys
11:56:50.0280 2184  LSI_SAS - ok
11:56:50.0405 2184  [ 912A04696E9CA30146A62AFA1463DD5C ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
11:56:50.0436 2184  LSI_SCSI - ok
11:56:50.0452 2184  [ 8F5C7426567798E62A3B3614965D62CC ] luafv           C:\Windows\system32\drivers\luafv.sys
11:56:50.0452 2184  luafv - ok
11:56:50.0483 2184  [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
11:56:50.0514 2184  Mcx2Svc - ok
11:56:50.0545 2184  [ 0001CE609D66632FA17B84705F658879 ] megasas         C:\Windows\system32\drivers\megasas.sys
11:56:50.0545 2184  megasas - ok
11:56:50.0577 2184  [ C252F32CD9A49DBFC25ECF26EBD51A99 ] MegaSR          C:\Windows\system32\drivers\megasr.sys
11:56:50.0623 2184  MegaSR - ok
11:56:50.0655 2184  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS           C:\Windows\system32\mmcss.dll
11:56:50.0670 2184  MMCSS - ok
11:56:50.0701 2184  [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem           C:\Windows\system32\drivers\modem.sys
11:56:50.0701 2184  Modem - ok
11:56:50.0733 2184  [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
11:56:50.0733 2184  monitor - ok
11:56:50.0764 2184  [ 5BF6A1326A335C5298477754A506D263 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
11:56:50.0764 2184  mouclass - ok
11:56:50.0795 2184  [ 93B8D4869E12CFBE663915502900876F ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
11:56:50.0795 2184  mouhid - ok
11:56:50.0811 2184  [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr        C:\Windows\system32\drivers\mountmgr.sys
11:56:50.0811 2184  MountMgr - ok
11:56:50.0873 2184  [ 51A84B690DF519DCF656F780243D953E ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
11:56:50.0873 2184  MozillaMaintenance - ok
11:56:50.0904 2184  [ 511D011289755DD9F9A7579FB0B064E6 ] mpio            C:\Windows\system32\drivers\mpio.sys
11:56:50.0904 2184  mpio - ok
11:56:50.0935 2184  [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
11:56:50.0935 2184  mpsdrv - ok
11:56:50.0998 2184  [ 5DE62C6E9108F14F6794060A9BDECAEC ] MpsSvc          C:\Windows\system32\mpssvc.dll
11:56:51.0013 2184  MpsSvc - ok
11:56:51.0045 2184  [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x        C:\Windows\system32\drivers\mraid35x.sys
11:56:51.0045 2184  Mraid35x - ok
11:56:51.0091 2184  [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
11:56:51.0091 2184  MRxDAV - ok
11:56:51.0123 2184  [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
11:56:51.0138 2184  mrxsmb - ok
11:56:51.0185 2184  [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
11:56:51.0201 2184  mrxsmb10 - ok
11:56:51.0201 2184  [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
11:56:51.0216 2184  mrxsmb20 - ok
11:56:51.0232 2184  [ 28023E86F17001F7CD9B15A5BC9AE07D ] msahci          C:\Windows\system32\drivers\msahci.sys
11:56:51.0232 2184  msahci - ok
11:56:51.0247 2184  [ 4468B0F385A86ECDDAF8D3CA662EC0E7 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
11:56:51.0263 2184  msdsm - ok
11:56:51.0279 2184  [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC           C:\Windows\System32\msdtc.exe
11:56:51.0279 2184  MSDTC - ok
11:56:51.0310 2184  [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
11:56:51.0310 2184  Msfs - ok
11:56:51.0310 2184  [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
11:56:51.0310 2184  msisadrv - ok
11:56:51.0341 2184  [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
11:56:51.0357 2184  MSiSCSI - ok
11:56:51.0357 2184  msiserver - ok
11:56:51.0388 2184  [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
11:56:51.0403 2184  MSKSSRV - ok
11:56:51.0403 2184  [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
11:56:51.0419 2184  MSPCLOCK - ok
11:56:51.0450 2184  [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
11:56:51.0450 2184  MSPQM - ok
11:56:51.0544 2184  [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
11:56:51.0559 2184  MsRPC - ok
11:56:51.0606 2184  [ E384487CB84BE41D09711C30CA79646C ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
11:56:51.0653 2184  mssmbios - ok
11:56:51.0669 2184  [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
11:56:51.0669 2184  MSTEE - ok
11:56:51.0684 2184  [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup             C:\Windows\system32\Drivers\mup.sys
11:56:51.0700 2184  Mup - ok
11:56:51.0762 2184  [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent        C:\Windows\system32\qagentRT.dll
11:56:51.0825 2184  napagent - ok
11:56:51.0887 2184  [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
11:56:51.0887 2184  NativeWifiP - ok
11:56:52.0012 2184  [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS            C:\Windows\system32\drivers\ndis.sys
11:56:52.0059 2184  NDIS - ok
11:56:52.0121 2184  [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
11:56:52.0121 2184  NdisTapi - ok
11:56:52.0152 2184  [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
11:56:52.0152 2184  Ndisuio - ok
11:56:52.0199 2184  [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
11:56:52.0199 2184  NdisWan - ok
11:56:52.0215 2184  [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
11:56:52.0230 2184  NDProxy - ok
11:56:52.0573 2184  [ B044BB341E164DA6750A9B8E6A5FF6A1 ] Nero BackItUp Scheduler 3 C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
11:56:52.0605 2184  Nero BackItUp Scheduler 3 - ok
11:56:52.0636 2184  [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
11:56:52.0636 2184  NetBIOS - ok
11:56:52.0683 2184  [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt           C:\Windows\system32\DRIVERS\netbt.sys
11:56:52.0698 2184  netbt - ok
11:56:52.0714 2184  [ A3E186B4B935905B829219502557314E ] Netlogon        C:\Windows\system32\lsass.exe
11:56:52.0714 2184  Netlogon - ok
11:56:52.0776 2184  [ C8052711DAECC48B982434C5116CA401 ] Netman          C:\Windows\System32\netman.dll
11:56:52.0792 2184  Netman - ok
11:56:52.0807 2184  [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm        C:\Windows\System32\netprofm.dll
11:56:52.0823 2184  netprofm - ok
11:56:52.0885 2184  [ EBBD48D3F4361773B812CA67A9CFC69B ] netr28          C:\Windows\system32\DRIVERS\netr28.sys
11:56:52.0917 2184  netr28 - ok
11:56:52.0979 2184  [ D6C4E4A39A36029AC0813D476FBD0248 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
11:56:52.0979 2184  NetTcpPortSharing - ok
11:56:52.0995 2184  [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960         C:\Windows\system32\drivers\nfrd960.sys
11:56:53.0010 2184  nfrd960 - ok
11:56:53.0041 2184  [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc          C:\Windows\System32\nlasvc.dll
11:56:53.0041 2184  NlaSvc - ok
11:56:53.0166 2184  [ EBA1B4BF2E2375ABDADEDB649F283541 ] NMIndexingService C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
11:56:53.0197 2184  NMIndexingService - ok
11:56:53.0244 2184  [ B9730495E0CF674680121E34BD95A73B ] NPF             C:\Windows\system32\drivers\npf.sys
11:56:53.0260 2184  NPF - ok
11:56:53.0307 2184  [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
11:56:53.0307 2184  Npfs - ok
11:56:53.0338 2184  [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi             C:\Windows\system32\nsisvc.dll
11:56:53.0338 2184  nsi - ok
11:56:53.0385 2184  [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
11:56:53.0385 2184  nsiproxy - ok
11:56:53.0650 2184  [ 6A4A98CEE84CF9E99564510DDA4BAA47 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
11:56:53.0681 2184  Ntfs - ok
11:56:53.0712 2184  [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi       C:\Windows\system32\drivers\ntrigdigi.sys
11:56:53.0728 2184  ntrigdigi - ok
11:56:53.0743 2184  [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null            C:\Windows\system32\drivers\Null.sys
11:56:53.0759 2184  Null - ok
11:56:53.0775 2184  [ 2EDF9E7751554B42CBB60116DE727101 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
11:56:53.0790 2184  nvraid - ok
11:56:53.0806 2184  [ ABED0C09758D1D97DB0042DBB2688177 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
11:56:53.0821 2184  nvstor - ok
11:56:53.0837 2184  [ 18BBDF913916B71BD54575BDB6EEAC0B ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
11:56:53.0853 2184  nv_agp - ok
11:56:53.0853 2184  NwlnkFlt - ok
11:56:53.0868 2184  NwlnkFwd - ok
11:56:53.0931 2184  [ 6F310E890D46E246E0E261A63D9B36B4 ] ohci1394        C:\Windows\system32\DRIVERS\ohci1394.sys
11:56:53.0946 2184  ohci1394 - ok
11:56:53.0993 2184  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc        C:\Windows\system32\p2psvc.dll
11:56:54.0024 2184  p2pimsvc - ok
11:56:54.0040 2184  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc          C:\Windows\system32\p2psvc.dll
11:56:54.0040 2184  p2psvc - ok
11:56:54.0055 2184  [ 0FA9B5055484649D63C303FE404E5F4D ] Parport         C:\Windows\system32\drivers\parport.sys
11:56:54.0055 2184  Parport - ok
11:56:54.0102 2184  [ B9C2B89F08670E159F7181891E449CD9 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
11:56:54.0102 2184  partmgr - ok
11:56:54.0118 2184  [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm          C:\Windows\system32\drivers\parvdm.sys
11:56:54.0118 2184  Parvdm - ok
11:56:54.0149 2184  [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc          C:\Windows\System32\pcasvc.dll
11:56:54.0149 2184  PcaSvc - ok
11:56:54.0227 2184  [ 941DC1D19E7E8620F40BBC206981EFDB ] pci             C:\Windows\system32\drivers\pci.sys
11:56:54.0243 2184  pci - ok
11:56:54.0258 2184  [ FC175F5DDAB666D7F4D17449A547626F ] pciide          C:\Windows\system32\drivers\pciide.sys
11:56:54.0258 2184  pciide - ok
11:56:54.0289 2184  [ E6F3FB1B86AA519E7698AD05E58B04E5 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
11:56:54.0289 2184  pcmcia - ok
11:56:54.0352 2184  [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
11:56:54.0383 2184  PEAUTH - ok
11:56:54.0555 2184  [ B1689DF169143F57053F795390C99DB3 ] pla             C:\Windows\system32\pla.dll
11:56:54.0648 2184  pla - ok
11:56:54.0695 2184  [ 875E4E0661F3A5994DF9E5E3A0A4F96B ] PLFlash DeviceIoControl Service C:\Windows\system32\IoctlSvc.exe
11:56:54.0711 2184  PLFlash DeviceIoControl Service - ok
11:56:54.0820 2184  [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
11:56:54.0835 2184  PlugPlay - ok
11:56:54.0898 2184  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg     C:\Windows\system32\p2psvc.dll
11:56:54.0929 2184  PNRPAutoReg - ok
11:56:55.0038 2184  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc         C:\Windows\system32\p2psvc.dll
11:56:55.0054 2184  PNRPsvc - ok
11:56:55.0116 2184  [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
11:56:55.0132 2184  PolicyAgent - ok
11:56:55.0210 2184  [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
11:56:55.0210 2184  PptpMiniport - ok
11:56:55.0272 2184  [ 2027293619DD0F047C584CF2E7DF4FFD ] Processor       C:\Windows\system32\DRIVERS\processr.sys
11:56:55.0272 2184  Processor - ok
11:56:55.0335 2184  [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc         C:\Windows\system32\profsvc.dll
11:56:55.0350 2184  ProfSvc - ok
11:56:55.0537 2184  [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\Windows\system32\lsass.exe
11:56:55.0553 2184  ProtectedStorage - ok
11:56:55.0678 2184  [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched          C:\Windows\system32\DRIVERS\pacer.sys
11:56:55.0693 2184  PSched - ok
11:56:55.0771 2184  [ D24DFD16A1E2A76034DF5AA18125C35D ] PSI             C:\Windows\system32\DRIVERS\psi_mf.sys
11:56:55.0771 2184  PSI - ok
11:56:55.0849 2184  [ 49452BFCEC22F36A7A9B9C2181BC3042 ] PxHelp20        C:\Windows\system32\Drivers\PxHelp20.sys
11:56:55.0865 2184  PxHelp20 - ok
11:56:56.0005 2184  [ 0A6DB55AFB7820C99AA1F3A1D270F4F6 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
11:56:56.0068 2184  ql2300 - ok
11:56:56.0130 2184  [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
11:56:56.0130 2184  ql40xx - ok
11:56:56.0239 2184  [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE           C:\Windows\system32\qwave.dll
11:56:56.0255 2184  QWAVE - ok
11:56:56.0302 2184  [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
11:56:56.0302 2184  QWAVEdrv - ok
11:56:56.0333 2184  [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
11:56:56.0333 2184  RasAcd - ok
11:56:56.0380 2184  [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto         C:\Windows\System32\rasauto.dll
11:56:56.0395 2184  RasAuto - ok
11:56:56.0411 2184  [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
11:56:56.0411 2184  Rasl2tp - ok
11:56:56.0536 2184  [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan          C:\Windows\System32\rasmans.dll
11:56:56.0551 2184  RasMan - ok
11:56:56.0583 2184  [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
11:56:56.0583 2184  RasPppoe - ok
11:56:56.0614 2184  [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
11:56:56.0614 2184  RasSstp - ok
11:56:56.0661 2184  [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
11:56:56.0661 2184  rdbss - ok
11:56:56.0676 2184  [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
11:56:56.0676 2184  RDPCDD - ok
11:56:56.0723 2184  [ FBC0BACD9C3D7F6956853F64A66E252D ] rdpdr           C:\Windows\system32\drivers\rdpdr.sys
11:56:56.0723 2184  rdpdr - ok
11:56:56.0739 2184  [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
11:56:56.0739 2184  RDPENCDD - ok
11:56:56.0770 2184  [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
11:56:56.0785 2184  RDPWD - ok
11:56:56.0832 2184  [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess    C:\Windows\System32\mprdim.dll
11:56:56.0832 2184  RemoteAccess - ok
11:56:56.0879 2184  [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry  C:\Windows\system32\regsvc.dll
11:56:56.0895 2184  RemoteRegistry - ok
11:56:56.0941 2184  [ A780D3EAA74582EA1DEB6BD9C7A3D9C9 ] rpcapd          C:\Program Files\WinPcap\rpcapd.exe
11:56:56.0941 2184  rpcapd - ok
11:56:57.0004 2184  [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator      C:\Windows\system32\locator.exe
11:56:57.0019 2184  RpcLocator - ok
11:56:57.0082 2184  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs           C:\Windows\system32\rpcss.dll
11:56:57.0097 2184  RpcSs - ok
11:56:57.0175 2184  [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
11:56:57.0207 2184  rspndr - ok
11:56:57.0238 2184  [ ABBE0F54BA3A378262C9CB86CF7D91F8 ] RTL8169         C:\Windows\system32\DRIVERS\Rtlh86.sys
11:56:57.0253 2184  RTL8169 - ok
11:56:57.0487 2184  [ A0EEA6F631349D0E0B7A6CAA7E099CB0 ] RUBotSrv        C:\Program Files\Trend Micro\RUBotted\RUBotSrv.exe
11:56:57.0534 2184  RUBotSrv - ok
11:56:57.0565 2184  [ A3E186B4B935905B829219502557314E ] SamSs           C:\Windows\system32\lsass.exe
11:56:57.0565 2184  SamSs - ok
11:56:57.0612 2184  [ 3CE8F073A557E172B330109436984E30 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
11:56:57.0628 2184  sbp2port - ok
11:56:57.0675 2184  [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
11:56:57.0706 2184  SCardSvr - ok
11:56:57.0909 2184  [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule        C:\Windows\system32\schedsvc.dll
11:56:57.0940 2184  Schedule - ok
11:56:57.0987 2184  [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc     C:\Windows\System32\certprop.dll
11:56:57.0987 2184  SCPolicySvc - ok
11:56:58.0049 2184  [ 126EA89BCC413EE45E3004FB0764888F ] sdbus           C:\Windows\system32\DRIVERS\sdbus.sys
11:56:58.0080 2184  sdbus - ok
11:56:58.0143 2184  [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
11:56:58.0158 2184  SDRSVC - ok
11:56:58.0533 2184  [ 206387AB881E93A1A6EB89966C8651F1 ] SDScannerService C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
11:56:58.0564 2184  SDScannerService - ok
11:56:58.0813 2184  [ A529CFE32565C0B145578FFB2B32C9A5 ] SDUpdateService C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
11:56:58.0876 2184  SDUpdateService - ok
11:56:58.0954 2184  [ CB63BDB77BB86549FC3303C2F11EDC18 ] SDWSCService    C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
11:56:58.0985 2184  SDWSCService - ok
11:56:59.0016 2184  [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
11:56:59.0032 2184  secdrv - ok
11:56:59.0079 2184  [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon        C:\Windows\system32\seclogon.dll
11:56:59.0079 2184  seclogon - ok
11:56:59.0578 2184  [ 306F9390976E41063D21AB9AB6D48122 ] Secunia PSI Agent C:\Program Files\Secunia\PSI\PSIA.exe
11:56:59.0640 2184  Secunia PSI Agent - ok
11:56:59.0827 2184  [ 29C852880E9634F8C6BD77A4E68B5B34 ] Secunia Update Agent C:\Program Files\Secunia\PSI\sua.exe
11:56:59.0843 2184  Secunia Update Agent - ok
11:56:59.0874 2184  [ A9BBAB5759771E523F55563D6CBE140F ] SENS            C:\Windows\System32\sens.dll
11:56:59.0905 2184  SENS - ok
11:56:59.0952 2184  [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum         C:\Windows\system32\drivers\serenum.sys
11:56:59.0952 2184  Serenum - ok
11:56:59.0983 2184  [ C70D69A918B178D3C3B06339B40C2E1B ] Serial          C:\Windows\system32\drivers\serial.sys
11:56:59.0983 2184  Serial - ok
11:57:00.0015 2184  [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
11:57:00.0046 2184  sermouse - ok
11:57:00.0093 2184  [ D2193326F729B163125610DBF3E17D57 ] SessionEnv      C:\Windows\system32\sessenv.dll
11:57:00.0108 2184  SessionEnv - ok
11:57:00.0139 2184  [ 3EFA810BDCA87F6ECC24F9832243FE86 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
11:57:00.0155 2184  sffdisk - ok
11:57:00.0155 2184  [ E95D451F7EA3E583AEC75F3B3EE42DC5 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
11:57:00.0171 2184  sffp_mmc - ok
11:57:00.0186 2184  [ 3D0EA348784B7AC9EA9BD9F317980979 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
11:57:00.0186 2184  sffp_sd - ok
11:57:00.0202 2184  [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy         C:\Windows\system32\drivers\sfloppy.sys
11:57:00.0217 2184  sfloppy - ok
11:57:00.0249 2184  [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
11:57:00.0280 2184  SharedAccess - ok
11:57:00.0389 2184  [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
11:57:00.0405 2184  ShellHWDetection - ok
11:57:00.0436 2184  [ 1D76624A09A054F682D746B924E2DBC3 ] sisagp          C:\Windows\system32\drivers\sisagp.sys
11:57:00.0436 2184  sisagp - ok
11:57:00.0451 2184  [ 43CB7AA756C7DB280D01DA9B676CFDE2 ] SiSRaid2        C:\Windows\system32\drivers\sisraid2.sys
11:57:00.0467 2184  SiSRaid2 - ok
11:57:00.0483 2184  [ A99C6C8B0BAA970D8AA59DDC50B57F94 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
11:57:00.0498 2184  SiSRaid4 - ok
11:57:01.0060 2184  [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc           C:\Windows\system32\SLsvc.exe
11:57:01.0169 2184  slsvc - ok
11:57:01.0231 2184  [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify      C:\Windows\system32\SLUINotify.dll
11:57:01.0247 2184  SLUINotify - ok
11:57:01.0294 2184  [ 7B75299A4D201D6A6533603D6914AB04 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
11:57:01.0294 2184  Smb - ok
11:57:01.0325 2184  [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
11:57:01.0341 2184  SNMPTRAP - ok
11:57:01.0356 2184  [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr           C:\Windows\system32\drivers\spldr.sys
11:57:01.0356 2184  spldr - ok
11:57:01.0403 2184  [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler         C:\Windows\System32\spoolsv.exe
11:57:01.0403 2184  Spooler - ok
11:57:01.0465 2184  [ 41987F9FC0E61ADF54F581E15029AD91 ] srv             C:\Windows\system32\DRIVERS\srv.sys
11:57:01.0481 2184  srv - ok
11:57:01.0512 2184  [ FF33AFF99564B1AA534F58868CBE41EF ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
11:57:01.0512 2184  srv2 - ok
11:57:01.0543 2184  [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
11:57:01.0559 2184  srvnet - ok
11:57:01.0575 2184  [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
11:57:01.0575 2184  SSDPSRV - ok
11:57:01.0621 2184  [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv          C:\Windows\system32\DRIVERS\ssmdrv.sys
11:57:01.0621 2184  ssmdrv - ok
11:57:01.0653 2184  [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc         C:\Windows\system32\sstpsvc.dll
11:57:01.0653 2184  SstpSvc - ok
11:57:01.0731 2184  [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc          C:\Windows\System32\wiaservc.dll
11:57:01.0762 2184  stisvc - ok
11:57:01.0793 2184  [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
11:57:01.0793 2184  swenum - ok
11:57:01.0871 2184  [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv           C:\Windows\System32\swprv.dll
11:57:01.0871 2184  swprv - ok
11:57:01.0902 2184  [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx         C:\Windows\system32\drivers\symc8xx.sys
11:57:01.0902 2184  Symc8xx - ok
11:57:01.0918 2184  [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi          C:\Windows\system32\drivers\sym_hi.sys
11:57:01.0918 2184  Sym_hi - ok
11:57:01.0933 2184  [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3          C:\Windows\system32\drivers\sym_u3.sys
11:57:01.0949 2184  Sym_u3 - ok
11:57:01.0980 2184  [ DB835C324CD488A86E9BFC2C3FD29CD8 ] SynTP           C:\Windows\system32\DRIVERS\SynTP.sys
11:57:01.0996 2184  SynTP - ok
11:57:02.0043 2184  [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain         C:\Windows\system32\sysmain.dll
11:57:02.0074 2184  SysMain - ok
11:57:02.0105 2184  [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll
11:57:02.0121 2184  TabletInputService - ok
11:57:02.0183 2184  [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv         C:\Windows\System32\tapisrv.dll
11:57:02.0199 2184  TapiSrv - ok
11:57:02.0230 2184  [ CB05822CD9CC6C688168E113C603DBE7 ] TBS             C:\Windows\System32\tbssvc.dll
11:57:02.0230 2184  TBS - ok
11:57:02.0433 2184  [ 74E2D020C47BB2B2FCCBA29A518A7EB4 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
11:57:02.0479 2184  Tcpip - ok
11:57:02.0526 2184  [ 74E2D020C47BB2B2FCCBA29A518A7EB4 ] Tcpip6          C:\Windows\system32\DRIVERS\tcpip.sys
11:57:02.0557 2184  Tcpip6 - ok
11:57:02.0635 2184  [ 608C345A255D82A6289C2D468EB41FD7 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
11:57:02.0635 2184  tcpipreg - ok
11:57:02.0651 2184  [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
11:57:02.0667 2184  TDPIPE - ok
11:57:02.0682 2184  [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
11:57:02.0698 2184  TDTCP - ok
11:57:02.0745 2184  [ 76B06EB8A01FC8624D699E7045303E54 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
11:57:02.0745 2184  tdx - ok
11:57:02.0807 2184  [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
11:57:02.0823 2184  TermDD - ok
11:57:02.0854 2184  [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService     C:\Windows\System32\termsrv.dll
11:57:02.0869 2184  TermService - ok
11:57:02.0963 2184  [ 250B9120C7C103AFDC0C6643F9691055 ] TestHandler     C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
11:57:02.0979 2184  TestHandler - ok
11:57:03.0010 2184  [ C7230FBEE14437716701C15BE02C27B8 ] Themes          C:\Windows\system32\shsvcs.dll
11:57:03.0025 2184  Themes - ok
11:57:03.0041 2184  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER     C:\Windows\system32\mmcss.dll
11:57:03.0041 2184  THREADORDER - ok
11:57:03.0088 2184  [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks          C:\Windows\System32\trkwks.dll
11:57:03.0103 2184  TrkWks - ok
11:57:03.0166 2184  [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
11:57:03.0166 2184  TrustedInstaller - ok
11:57:03.0213 2184  [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
11:57:03.0228 2184  tssecsrv - ok
11:57:03.0275 2184  [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp           C:\Windows\system32\DRIVERS\tunmp.sys
11:57:03.0275 2184  tunmp - ok
11:57:03.0337 2184  [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
11:57:03.0337 2184  tunnel - ok
11:57:03.0369 2184  [ 7D33C4DB2CE363C8518D2DFCF533941F ] uagp35          C:\Windows\system32\drivers\uagp35.sys
11:57:03.0369 2184  uagp35 - ok
11:57:03.0493 2184  [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
11:57:03.0509 2184  udfs - ok
11:57:03.0556 2184  [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect       C:\Windows\system32\UI0Detect.exe
11:57:03.0571 2184  UI0Detect - ok
11:57:03.0603 2184  [ B0ACFDC9E4AF279E9116C03E014B2B27 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
11:57:03.0603 2184  uliagpkx - ok
11:57:03.0634 2184  [ 9224BB254F591DE4CA8D572A5F0D635C ] uliahci         C:\Windows\system32\drivers\uliahci.sys
11:57:03.0649 2184  uliahci - ok
11:57:03.0681 2184  [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata          C:\Windows\system32\drivers\ulsata.sys
11:57:03.0681 2184  UlSata - ok
11:57:03.0696 2184  [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2         C:\Windows\system32\drivers\ulsata2.sys
11:57:03.0712 2184  ulsata2 - ok
11:57:03.0727 2184  [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
11:57:03.0727 2184  umbus - ok
11:57:03.0743 2184  [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost        C:\Windows\System32\upnphost.dll
11:57:03.0774 2184  upnphost - ok
11:57:03.0868 2184  [ 32DB9517628FF0D070682AAB61E688F0 ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
11:57:03.0915 2184  usbaudio - ok
11:57:03.0977 2184  [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
11:57:04.0008 2184  usbccgp - ok
11:57:04.0039 2184  [ E9476E6C486E76BC4898074768FB7131 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
11:57:04.0039 2184  usbcir - ok
11:57:04.0086 2184  [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys
11:57:04.0086 2184  usbehci - ok
11:57:04.0133 2184  [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
11:57:04.0133 2184  usbhub - ok
11:57:04.0180 2184  [ CE697FEE0D479290D89BEC80DFE793B7 ] usbohci         C:\Windows\system32\DRIVERS\usbohci.sys
11:57:04.0195 2184  usbohci - ok
11:57:04.0242 2184  [ E75C4B5269091D15A2E7DC0B6D35F2F5 ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
11:57:04.0242 2184  usbprint - ok
11:57:04.0289 2184  [ A508C9BD8724980512136B039BBA65E9 ] usbscan         C:\Windows\system32\DRIVERS\usbscan.sys
11:57:04.0289 2184  usbscan - ok
11:57:04.0320 2184  [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
11:57:04.0320 2184  USBSTOR - ok
11:57:04.0351 2184  [ 814D653EFC4D48BE3B04A307ECEFF56F ] usbuhci         C:\Windows\system32\DRIVERS\usbuhci.sys
11:57:04.0351 2184  usbuhci - ok
11:57:04.0398 2184  [ E67998E8F14CB0627A769F6530BCB352 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys
11:57:04.0398 2184  usbvideo - ok
11:57:04.0445 2184  [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms           C:\Windows\System32\uxsms.dll
11:57:04.0445 2184  UxSms - ok
11:57:04.0507 2184  [ CD88D1B7776DC17A119049742EC07EB4 ] vds             C:\Windows\System32\vds.exe
11:57:04.0523 2184  vds - ok
11:57:04.0554 2184  [ 87B06E1F30B749A114F74622D013F8D4 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
11:57:04.0554 2184  vga - ok
11:57:04.0570 2184  [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave         C:\Windows\System32\drivers\vga.sys
11:57:04.0570 2184  VgaSave - ok
11:57:04.0585 2184  [ 5D7159DEF58A800D5781BA3A879627BC ] viaagp          C:\Windows\system32\drivers\viaagp.sys
11:57:04.0601 2184  viaagp - ok
11:57:04.0617 2184  [ C4F3A691B5BAD343E6249BD8C2D45DEE ] ViaC7           C:\Windows\system32\drivers\viac7.sys
11:57:04.0617 2184  ViaC7 - ok
11:57:04.0648 2184  [ AADF5587A4063F52C2C3FED7887426FC ] viaide          C:\Windows\system32\drivers\viaide.sys
11:57:04.0648 2184  viaide - ok
11:57:04.0663 2184  [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
11:57:04.0663 2184  volmgr - ok
11:57:04.0710 2184  [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
11:57:04.0726 2184  volmgrx - ok
11:57:04.0819 2184  [ 786DB5771F05EF300390399F626BF30A ] volsnap         C:\Windows\system32\drivers\volsnap.sys
11:57:04.0835 2184  volsnap - ok
11:57:04.0866 2184  [ 587253E09325E6BF226B299774B728A9 ] vsmraid         C:\Windows\system32\drivers\vsmraid.sys
11:57:04.0882 2184  vsmraid - ok
11:57:04.0944 2184  [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS             C:\Windows\system32\vssvc.exe
11:57:05.0022 2184  VSS - ok
11:57:05.0085 2184  [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time         C:\Windows\system32\w32time.dll
11:57:05.0131 2184  W32Time - ok
11:57:05.0178 2184  [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
11:57:05.0178 2184  WacomPen - ok
11:57:05.0209 2184  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp          C:\Windows\system32\DRIVERS\wanarp.sys
11:57:05.0209 2184  Wanarp - ok
11:57:05.0225 2184  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
11:57:05.0225 2184  Wanarpv6 - ok
11:57:05.0287 2184  [ A3CD60FD826381B49F03832590E069AF ] wcncsvc         C:\Windows\System32\wcncsvc.dll
11:57:05.0319 2184  wcncsvc - ok
11:57:05.0350 2184  [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
11:57:05.0365 2184  WcsPlugInService - ok
11:57:05.0397 2184  [ 78FE9542363F297B18C027B2D7E7C07F ] Wd              C:\Windows\system32\drivers\wd.sys
11:57:05.0397 2184  Wd - ok
11:57:05.0443 2184  [ A840213F1ACDCC175B4D1D5AAEAC0D7A ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
11:57:05.0475 2184  Wdf01000 - ok
11:57:05.0490 2184  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost  C:\Windows\system32\wdi.dll
11:57:05.0506 2184  WdiServiceHost - ok
11:57:05.0506 2184  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost   C:\Windows\system32\wdi.dll
11:57:05.0521 2184  WdiSystemHost - ok
11:57:05.0568 2184  [ 04C37D8107320312FBAE09926103D5E2 ] WebClient       C:\Windows\System32\webclnt.dll
11:57:05.0584 2184  WebClient - ok
11:57:05.0599 2184  [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc          C:\Windows\system32\wecsvc.dll
11:57:05.0615 2184  Wecsvc - ok
11:57:05.0631 2184  [ 670FF720071ED741206D69BD995EA453 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
11:57:05.0646 2184  wercplsupport - ok
11:57:05.0693 2184  [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc          C:\Windows\System32\WerSvc.dll
11:57:05.0693 2184  WerSvc - ok
11:57:05.0755 2184  [ 4575AA12561C5648483403541D0D7F2B ] WinDefend       C:\Program Files\Windows Defender\mpsvc.dll
11:57:05.0771 2184  WinDefend - ok
11:57:05.0787 2184  WinHttpAutoProxySvc - ok
11:57:06.0005 2184  [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
11:57:06.0036 2184  Winmgmt - ok
11:57:06.0192 2184  [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM           C:\Windows\system32\WsmSvc.dll
11:57:06.0255 2184  WinRM - ok
11:57:06.0379 2184  [ 40B6CE57B2B209115C0426535D4253F2 ] WisLMSvc        C:\Program Files\Launch Manager\WisLMSvc.exe
11:57:06.0395 2184  WisLMSvc - ok
11:57:06.0520 2184  [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc         C:\Windows\System32\wlansvc.dll
11:57:06.0551 2184  Wlansvc - ok
11:57:06.0613 2184  [ 2E7255D172DF0B8283CDFB7B433B864E ] WmiAcpi         C:\Windows\system32\DRIVERS\wmiacpi.sys
11:57:06.0613 2184  WmiAcpi - ok
11:57:06.0738 2184  [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
11:57:06.0769 2184  wmiApSrv - ok
11:57:07.0128 2184  [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc   C:\Program Files\Windows Media Player\wmpnetwk.exe
11:57:07.0159 2184  WMPNetworkSvc - ok
11:57:07.0222 2184  [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc          C:\Windows\System32\wpcsvc.dll
11:57:07.0253 2184  WPCSvc - ok
11:57:07.0331 2184  [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
11:57:07.0347 2184  WPDBusEnum - ok
11:57:07.0425 2184  [ DE9D36F91A4DF3D911626643DEBF11EA ] WpdUsb          C:\Windows\system32\DRIVERS\wpdusb.sys
11:57:07.0440 2184  WpdUsb - ok
11:57:07.0768 2184  [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
11:57:07.0799 2184  WPFFontCache_v0400 - ok
11:57:07.0846 2184  [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
11:57:07.0877 2184  ws2ifsl - ok
11:57:07.0924 2184  [ 1CA6C40261DDC0425987980D0CD2AAAB ] wscsvc          C:\Windows\System32\wscsvc.dll
11:57:07.0955 2184  wscsvc - ok
11:57:07.0971 2184  WSearch - ok
11:57:08.0283 2184  [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv        C:\Windows\system32\wuaueng.dll
11:57:08.0392 2184  wuauserv - ok
11:57:08.0485 2184  [ 06E6F32C8D0A3F66D956F57B43A2E070 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
11:57:08.0501 2184  WudfPf - ok
11:57:08.0548 2184  [ 867C301E8B790040AE9CF6486E8041DF ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
11:57:08.0563 2184  WUDFRd - ok
11:57:08.0610 2184  [ FE47B7BC8EA320C2D9B5E5BF6E303765 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
11:57:08.0641 2184  wudfsvc - ok
11:57:08.0704 2184  ================ Scan global ===============================
11:57:08.0735 2184  [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll
11:57:08.0922 2184  [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
11:57:08.0969 2184  [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
11:57:09.0047 2184  [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\system32\services.exe
11:57:09.0078 2184  [Global] - ok
11:57:09.0078 2184  ================ Scan MBR ==================================
11:57:09.0094 2184  [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk0\DR0
11:57:11.0403 2184  \Device\Harddisk0\DR0 - ok
11:57:11.0434 2184  ================ Scan VBR ==================================
11:57:11.0496 2184  [ 7EFE7558B7D6D7F3BAC04F35CB788CCC ] \Device\Harddisk0\DR0\Partition1
11:57:11.0512 2184  \Device\Harddisk0\DR0\Partition1 - ok
11:57:11.0559 2184  [ 685ABCD3C9F0234A67465A4D1F034D2F ] \Device\Harddisk0\DR0\Partition2
11:57:11.0590 2184  \Device\Harddisk0\DR0\Partition2 - ok
11:57:11.0590 2184  ============================================================
11:57:11.0590 2184  Scan finished
11:57:11.0590 2184  ============================================================
11:57:11.0621 1072  Detected object count: 0
11:57:11.0621 1072  Actual detected object count: 0
11:58:05.0613 1936  Deinitialize success

cosinus · 13.02.2013, 12:01

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Danach eine Kontrolle mit OTL bitte:

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Setze oben mittig den Haken bei Scanne alle Benutzer
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles in CODE-Tags hier in den Thread.

UliBa · 13.02.2013, 12:10

Hier schon mal adwCleaner, OTL folgt.

Code:

ATTFilter

# AdwCleaner v2.112 - Datei am 13/02/2013 um 12:04:37 erstellt
# Aktualisiert am 10/02/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzer : NAME - NAME-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\NAME\Downloads\adwcleaner0.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\Program Files\vShare.tv plugin
Ordner Gelöscht : C:\Program Files\Windows iLivid Toolbar
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\Users\NAME\AppData\Local\Ilivid Player

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\searchqutoolbar
Schlüssel Gelöscht : HKCU\Software\DataMngr
Schlüssel Gelöscht : HKCU\Software\ilivid
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{28387537-E3F9-4ED7-860C-11E69AF4A8A0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\StartSearch
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{28387537-E3F9-4ED7-860C-11E69AF4A8A0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{44B619BC-3D2B-4990-AA4F-9AA366921792}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{79D60450-56C5-4A8C-9321-6D5BC2A81E5A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99C22A61-21BA-4F81-85FF-CDC9EB5DB10B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16464

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v18.0.2 (de)

Datei : C:\Users\NAME\AppData\Roaming\Mozilla\Firefox\Profiles\w04rohdy.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Google Chrome v24.0.1312.57

Datei : C:\Users\NAME\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [3746 octets] - [13/02/2013 12:04:37]

########## EOF - C:\AdwCleaner[S1].txt - [3806 octets] ##########

OTL

Code:

ATTFilter

OTL logfile created on: 13.02.2013 12:17:20 - Run 5
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\NAME\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,22 Gb Total Physical Memory | 1,19 Gb Available Physical Memory | 53,62% Memory free
4,65 Gb Paging File | 3,42 Gb Available in Paging File | 73,37% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 94,16 Gb Total Space | 3,33 Gb Free Space | 3,53% Space Free | Partition Type: NTFS
Drive D: | 195,14 Gb Total Space | 56,65 Gb Free Space | 29,03% Space Free | Partition Type: NTFS
 
Computer Name: NAME-PC | User Name: NAME | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\NAME\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\Macromed\Flash\FlashUtil32_11_6_602_168_ActiveX.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Google\Update\1.3.21.124\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Programme\Secunia\PSI\psia.exe (Secunia)
PRC - C:\Programme\Secunia\PSI\sua.exe (Secunia)
PRC - C:\Programme\Spybot - Search & Destroy 2\SDUpdate.exe (Safer-Networking Ltd.)
PRC - C:\Programme\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.)
PRC - C:\Programme\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.)
PRC - C:\Programme\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.)
PRC - C:\Programme\Internet Explorer\ielowutil.exe (Microsoft Corporation)
PRC - C:\Programme\Trend Micro\RUBotted\RUBotSrv.exe (Trend Micro Inc.)
PRC - C:\Windows\System32\spool\drivers\w32x86\3\E_FATIHJE.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Programme\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
PRC - C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Programme\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe (ABBYY)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Tobit ClipInc\Server\ClipInc-Server.exe ()
PRC - C:\Programme\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)
PRC - C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\System32\atitmmxx.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (SDWSCService) -- C:\Program Files\Spybot File not found
SRV - (SDUpdateService) -- C:\Program Files\Spybot File not found
SRV - (SDScannerService) -- C:\Program Files\Spybot File not found
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Secunia PSI Agent) -- C:\Programme\Secunia\PSI\psia.exe (Secunia)
SRV - (Secunia Update Agent) -- C:\Programme\Secunia\PSI\sua.exe (Secunia)
SRV - (RUBotSrv) -- C:\Programme\Trend Micro\RUBotted\RUBotSrv.exe (Trend Micro Inc.)
SRV - (ACDaemon) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (rpcapd) -- C:\Programme\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (ABBYY.Licensing.FineReader.Sprint.9.0) -- C:\Programme\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe (ABBYY)
SRV - (ClipInc001) -- C:\Program Files\Tobit ClipInc\Server\ClipInc-Server.exe ()
SRV - (TestHandler) -- C:\Programme\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WisLMSvc) -- C:\Programme\Launch Manager\WisLMSvc.exe (Wistron Corp.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (PSI) -- C:\Windows\System32\drivers\psi_mf.sys (Secunia)
DRV - (AF9035HB) -- C:\Windows\System32\drivers\AF9035HB.sys (AfaTech                  )
DRV - (NPF) -- C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (archlp) -- C:\Windows\System32\drivers\archlp.sys ()
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (ahcix86s) -- C:\Windows\System32\drivers\ahcix86s.sys (AMD Technologies Inc.)
DRV - (AtiPcie) -- C:\Windows\System32\drivers\AtiPcie.sys (ATI Technologies Inc.)
DRV - (JMCR) -- C:\Windows\System32\drivers\jmcr.sys (JMicron Technology Corp.)
DRV - (JRAID) -- C:\Windows\System32\drivers\jraid.sys (JMicron Technology Corp.)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (acedrv11) -- C:\Windows\System32\drivers\ACEDRV11.sys (Protect Software GmbH)
DRV - (Afc) -- C:\Windows\System32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (Hotkey) -- C:\Windows\System32\drivers\HOTKEY.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://alice.aol.de
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope = 
 
 
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-1388797816-4094107319-3979931936-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE - HKU\S-1-5-21-1388797816-4094107319-3979931936-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 
IE - HKU\S-1-5-21-1388797816-4094107319-3979931936-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1388797816-4094107319-3979931936-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-1388797816-4094107319-3979931936-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-1388797816-4094107319-3979931936-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.4.4
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.2
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_168.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.10 10:56:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.10 10:56:37 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2011.07.01 12:22:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\NAME\AppData\Roaming\mozilla\Extensions
[2011.07.01 12:22:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\NAME\AppData\Roaming\mozilla\Extensions\ideskbrowser@haufe.de
[2013.02.10 10:58:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\NAME\AppData\Roaming\mozilla\Firefox\Profiles\w04rohdy.default\extensions
[2013.02.10 10:58:09 | 000,533,536 | ---- | M] () (No name found) -- C:\Users\NAME\AppData\Roaming\mozilla\firefox\profiles\w04rohdy.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013.02.10 10:56:24 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013.02.10 10:56:37 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.11.29 10:19:31 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.11.29 10:19:31 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.11.29 10:19:31 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.11.29 10:19:32 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.11.29 10:19:31 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.11.29 10:19:31 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\24.0.1312.57\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Disabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\24.0.1312.57\pdf.dll
CHR - plugin: vShare.tv plug-in (Enabled) = C:\Users\NAME\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj\1.3_0\chvsharetvplg.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.124\npGoogleUpdate3.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Picasa2\npPicasa2.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Picasa2\npPicasa3.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_149.dll
CHR - Extension: Docs = C:\Users\NAME\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\
CHR - Extension: Google Drive = C:\Users\NAME\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\
CHR - Extension: YouTube = C:\Users\NAME\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\NAME\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: vshare plugin = C:\Users\NAME\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj\1.3_0\
CHR - Extension: Google Mail = C:\Users\NAME\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [EEventManager] C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [LexwareInfoService] C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG)
O4 - HKLM..\Run: [SDTray] C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKLM..\Run: [SynTPStart] C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [Trend Micro RUBotted V2.0 Beta] C:\Programme\Trend Micro\RUBotted\RUBottedGUI.exe (Trend Micro Inc.)
O4 - HKU\.DEFAULT..\Run: [Picasa Media Detector] C:\Programme\Picasa2\PicasaMediaDetector.exe (Google Inc.)
O4 - HKU\S-1-5-18..\Run: [Picasa Media Detector] C:\Programme\Picasa2\PicasaMediaDetector.exe (Google Inc.)
O4 - HKU\S-1-5-21-1388797816-4094107319-3979931936-1000..\Run: [EPSON SX130 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIHJE.EXE (SEIKO EPSON CORPORATION)
O4 - HKU\S-1-5-21-1388797816-4094107319-3979931936-1000..\Run: [Spybot-S&D Cleaning] C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe (Safer-Networking Ltd.)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - Reg Error: Key error. File not found
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DDBDAFC3-859B-4779-86A1-A7D3E631782F}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\NAME\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\NAME\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.02.12 22:29:09 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013.02.12 22:29:07 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013.02.12 22:29:07 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013.02.12 22:29:07 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013.02.12 22:29:07 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013.02.12 22:29:05 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013.02.12 22:29:05 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013.02.12 22:29:04 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013.02.12 20:30:40 | 002,048,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013.02.12 20:30:39 | 001,314,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2013.02.12 20:30:36 | 003,602,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2013.02.12 20:30:36 | 003,550,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2013.02.12 19:00:49 | 004,732,416 | ---- | C] (AVAST Software) -- C:\Users\NAME\Desktop\aswMBR.exe
[2013.02.12 18:57:05 | 000,000,000 | ---D | C] -- C:\Users\NAME\Desktop\mbar-1.01.0.1020
[2013.02.11 17:41:06 | 000,000,000 | ---D | C] -- C:\Program Files\OTL
[2013.02.11 16:57:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2013.02.10 19:40:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2013.02.10 19:28:03 | 000,000,000 | ---D | C] -- C:\Users\NAME\Documents\Eigene Webs
[2013.02.10 13:29:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2013.02.10 13:29:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
[2013.02.10 13:29:43 | 000,015,224 | ---- | C] (Safer Networking Limited) -- C:\Windows\System32\sdnclean.exe
[2013.02.10 13:29:37 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy 2
[2013.02.10 12:40:11 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Portable Devices
[2013.02.10 12:39:15 | 000,000,000 | ---D | C] -- C:\Windows\System32\WindowsPowerShell
[2013.02.10 12:30:18 | 000,092,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAnimation.dll
[2013.02.10 12:30:17 | 003,023,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIRibbon.dll
[2013.02.10 12:30:17 | 001,164,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIRibbonRes.dll
[2013.02.10 12:29:41 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\BthMtpContextHandler.dll
[2013.02.10 12:29:41 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WPDShextAutoplay.exe
[2013.02.10 12:29:38 | 000,060,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceConnectApi.dll
[2013.02.10 12:29:37 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WpdConns.dll
[2013.02.10 12:29:36 | 000,546,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wpd_ci.dll
[2013.02.10 12:29:36 | 000,350,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WPDSp.dll
[2013.02.10 12:29:36 | 000,334,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceApi.dll
[2013.02.10 12:29:36 | 000,226,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WpdMtp.dll
[2013.02.10 12:29:36 | 000,196,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceWMDRM.dll
[2013.02.10 12:29:36 | 000,160,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceTypes.dll
[2013.02.10 12:29:36 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceClassExtension.dll
[2013.02.10 12:29:36 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WpdMtpUS.dll
[2013.02.10 12:10:33 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Wdfres.dll
[2013.02.10 12:10:30 | 000,172,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFPlatform.dll
[2013.02.10 12:10:30 | 000,047,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfLdr.sys
[2013.02.10 12:10:30 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winusb.dll
[2013.02.10 12:10:29 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFx.dll
[2013.02.10 12:10:29 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFCoinstaller.dll
[2013.02.10 12:02:15 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrsmgr.dll
[2013.02.10 12:01:59 | 000,040,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrs.exe
[2013.02.10 12:01:59 | 000,020,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrshost.exe
[2013.02.10 12:01:59 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wsmprovhost.exe
[2013.02.10 12:01:58 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wsmplpxy.dll
[2013.02.10 12:01:58 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrssrv.dll
[2013.02.10 12:01:57 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wevtfwd.dll
[2013.02.10 12:01:57 | 000,079,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wecutil.exe
[2013.02.10 12:01:57 | 000,056,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wecapi.dll
[2013.02.10 12:01:57 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmRes.dll
[2013.02.10 12:01:57 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pwrshplugin.dll
[2013.02.10 12:01:52 | 000,252,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSManMigrationPlugin.dll
[2013.02.10 12:01:52 | 000,246,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSManHTTPConfig.exe
[2013.02.10 12:01:52 | 000,241,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrscmd.dll
[2013.02.10 12:01:52 | 000,214,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmWmiPl.dll
[2013.02.10 12:01:52 | 000,145,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmAuto.dll
[2013.02.10 11:59:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3
[2013.02.10 11:58:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2013.02.10 11:57:56 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2013.02.10 11:56:49 | 000,714,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\timedate.cpl
[2013.02.10 11:56:40 | 000,288,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2013.02.10 11:56:23 | 001,696,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gameux.dll
[2013.02.10 11:56:22 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll
[2013.02.10 11:56:21 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll
[2013.02.10 11:56:09 | 000,876,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2013.02.10 11:56:02 | 000,471,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_isv.dll
[2013.02.10 11:56:02 | 000,471,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc.dll
[2013.02.10 11:56:01 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_isv.exe
[2013.02.10 11:56:01 | 000,347,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp.exe
[2013.02.10 11:56:01 | 000,346,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp_isv.exe
[2013.02.10 11:56:00 | 000,518,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate.exe
[2013.02.10 11:56:00 | 000,332,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdrm.dll
[2013.02.10 11:56:00 | 000,152,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp_isv.dll
[2013.02.10 11:56:00 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp.dll
[2013.02.10 11:55:00 | 000,310,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\unregmp2.exe
[2013.02.10 11:43:05 | 000,000,000 | ---D | C] -- C:\Users\NAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\_VIREN- und Malwareschutz
[2013.02.10 11:40:03 | 000,000,000 | ---D | C] -- C:\Users\NAME\AppData\Local\WindowsUpdate
[2013.02.10 11:38:57 | 000,000,000 | ---D | C] -- C:\Users\NAME\AppData\Local\Secunia PSI
[2013.02.10 11:38:44 | 000,000,000 | ---D | C] -- C:\Program Files\Secunia
[2013.02.10 11:37:33 | 000,000,000 | ---D | C] -- C:\Users\NAME\AppData\Roaming\vlc
[2013.02.10 11:37:24 | 000,000,000 | ---D | C] -- C:\Users\NAME\AppData\Local\Macromedia
[2013.02.10 11:37:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2013.02.10 11:36:23 | 000,000,000 | ---D | C] -- C:\Program Files\VideoLAN
[2013.02.10 10:56:23 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013.02.10 08:38:55 | 000,000,000 | ---D | C] -- C:\Users\NAME\AppData\Local\Mozilla
[2013.02.10 08:38:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2013.02.10 08:38:48 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2013.02.09 23:14:40 | 000,000,000 | ---D | C] -- C:\Users\NAME\AppData\Roaming\Avira
[2013.02.09 23:13:30 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2013.02.09 23:13:29 | 000,134,336 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avipbb.sys
[2013.02.09 23:13:29 | 000,083,944 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avgntflt.sys
[2013.02.09 23:13:29 | 000,036,552 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avkmgr.sys
[2013.02.09 23:13:25 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2013.02.08 21:36:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Trend Micro
[2013.02.08 21:34:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap
[2013.02.08 21:34:42 | 000,000,000 | ---D | C] -- C:\Program Files\WinPcap
[2013.02.08 21:33:39 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2013.02.08 18:48:09 | 000,000,000 | ---D | C] -- C:\Users\NAME\AppData\Roaming\Malwarebytes
[2013.02.08 18:47:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.02.08 18:47:55 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013.02.08 18:47:55 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013.01.14 19:34:12 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2013.01.14 19:31:31 | 000,000,000 | ---D | C] -- C:\Users\NAME\Documents\Rückrunde 12-13
 
========== Files - Modified Within 30 Days ==========
 
[2013.02.13 12:07:01 | 000,000,264 | ---- | M] () -- C:\Windows\tasks\RegistryBooster.job
[2013.02.13 12:06:59 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.02.13 12:06:59 | 000,000,620 | ---- | M] () -- C:\Windows\tasks\Check for updates (Spybot - Search & Destroy).job
[2013.02.13 12:06:54 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.13 12:06:54 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.13 12:06:52 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.02.13 12:06:48 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.02.13 12:06:02 | 2378,252,288 | -HS- | M] () -- C:\hiberfil.sys
[2013.02.13 11:57:15 | 000,691,568 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.02.13 11:57:15 | 000,071,024 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.02.13 11:36:42 | 000,336,256 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.02.12 22:26:22 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.02.12 22:26:21 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.02.12 22:26:21 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.02.12 22:26:21 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.02.12 22:22:54 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.02.12 20:07:33 | 000,000,512 | ---- | M] () -- C:\Users\NAME\Desktop\MBR.dat
[2013.02.12 19:40:46 | 000,037,964 | ---- | M] () -- C:\Users\NAME\Desktop\malwarebytes anti-rootkit ergebnis.jpg
[2013.02.12 19:00:01 | 004,732,416 | ---- | M] (AVAST Software) -- C:\Users\NAME\Desktop\aswMBR.exe
[2013.02.12 13:03:46 | 000,044,085 | ---- | M] () -- C:\Users\NAME\Desktop\ESET ergebnis.jpg
[2013.02.11 21:43:26 | 000,010,773 | ---- | M] () -- C:\Users\NAME\Desktop\Extras-30 Tage.zip
[2013.02.11 21:43:17 | 000,010,873 | ---- | M] () -- C:\Users\NAME\Desktop\OTL-30 Tage.zip
[2013.02.11 21:34:53 | 000,010,866 | ---- | M] () -- C:\Users\NAME\Desktop\OTL.zip
[2013.02.11 16:57:10 | 000,002,079 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2013.02.11 16:56:15 | 000,001,977 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013.02.10 17:46:17 | 000,000,616 | ---- | M] () -- C:\Windows\tasks\Refresh immunization (Spybot - Search & Destroy).job
[2013.02.10 17:46:17 | 000,000,446 | ---- | M] () -- C:\Windows\tasks\Scan the system (Spybot - Search & Destroy).job
[2013.02.10 13:29:49 | 000,001,964 | ---- | M] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2013.02.10 13:17:25 | 384,883,214 | ---- | M] () -- C:\Users\NAME\Desktop\regsich.reg
[2013.02.10 12:38:57 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2013.02.10 12:36:48 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2013.02.10 11:58:10 | 000,001,732 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2013.02.10 11:38:46 | 000,000,905 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2013.02.10 11:37:17 | 000,000,865 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2013.02.10 08:38:51 | 000,000,852 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.02.09 23:13:49 | 000,001,853 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.01.27 22:21:10 | 000,365,568 | ---- | M] () -- C:\Users\NAME\Desktop\gmer.exe
[2013.01.25 14:02:31 | 001,332,843 | ---- | M] () -- C:\Users\NAME\Documents\manual_deutsch.pdf
[2013.01.17 01:28:58 | 000,232,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2013.01.16 19:20:55 | 000,538,404 | ---- | M] () -- C:\Users\NAME\Documents\Einladung_hennes_geburtstag.pdf
 
========== Files Created - No Company Name ==========
 
[2013.02.12 20:07:33 | 000,000,512 | ---- | C] () -- C:\Users\NAME\Desktop\MBR.dat
[2013.02.12 19:40:46 | 000,037,964 | ---- | C] () -- C:\Users\NAME\Desktop\malwarebytes anti-rootkit ergebnis.jpg
[2013.02.12 13:03:46 | 000,044,085 | ---- | C] () -- C:\Users\NAME\Desktop\ESET ergebnis.jpg
[2013.02.11 21:43:26 | 000,010,773 | ---- | C] () -- C:\Users\NAME\Desktop\Extras-30 Tage.zip
[2013.02.11 21:43:17 | 000,010,873 | ---- | C] () -- C:\Users\NAME\Desktop\OTL-30 Tage.zip
[2013.02.11 21:34:53 | 000,010,866 | ---- | C] () -- C:\Users\NAME\Desktop\OTL.zip
[2013.02.11 19:02:00 | 000,365,568 | ---- | C] () -- C:\Users\NAME\Desktop\gmer.exe
[2013.02.11 16:57:10 | 000,002,079 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2013.02.10 19:40:28 | 000,001,977 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013.02.10 13:30:00 | 000,000,446 | ---- | C] () -- C:\Windows\tasks\Scan the system (Spybot - Search & Destroy).job
[2013.02.10 13:29:59 | 000,000,616 | ---- | C] () -- C:\Windows\tasks\Refresh immunization (Spybot - Search & Destroy).job
[2013.02.10 13:29:58 | 000,000,620 | ---- | C] () -- C:\Windows\tasks\Check for updates (Spybot - Search & Destroy).job
[2013.02.10 13:29:49 | 000,001,976 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
[2013.02.10 13:29:49 | 000,001,964 | ---- | C] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2013.02.10 13:16:48 | 384,883,214 | ---- | C] () -- C:\Users\NAME\Desktop\regsich.reg
[2013.02.10 12:38:57 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2013.02.10 12:36:48 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2013.02.10 12:10:41 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2013.02.10 12:10:41 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2013.02.10 12:01:53 | 000,201,184 | ---- | C] () -- C:\Windows\System32\winrm.vbs
[2013.02.10 12:01:53 | 000,004,675 | ---- | C] () -- C:\Windows\System32\wsmanconfig_schema.xml
[2013.02.10 12:01:53 | 000,002,426 | ---- | C] () -- C:\Windows\System32\WsmTxt.xsl
[2013.02.10 11:58:10 | 000,001,732 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2013.02.10 11:38:46 | 000,000,905 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2013.02.10 11:37:17 | 000,000,865 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2013.02.10 08:38:51 | 000,000,864 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013.02.10 08:38:51 | 000,000,852 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.02.09 23:13:49 | 000,001,853 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.01.25 14:02:31 | 001,332,843 | ---- | C] () -- C:\Users\NAME\Documents\manual_deutsch.pdf
[2013.01.16 19:20:55 | 000,538,404 | ---- | C] () -- C:\Users\NAME\Documents\Einladung_hennes_geburtstag.pdf
[2012.12.30 17:36:25 | 002,027,252 | ---- | C] () -- C:\Users\NAME\mdb_93264_dbaut-1301_fahrplan_sommer_de_online_1017.pdf
[2012.11.03 20:31:22 | 001,725,913 | ---- | C] () -- C:\Users\NAME\Halbjahresprogramm_okt12-mar13.pdf
[2012.01.19 16:57:13 | 000,211,600 | ---- | C] () -- C:\Users\NAME\Anlage_2800002.pdf
[2011.10.28 17:32:30 | 000,000,000 | ---- | C] () -- C:\Users\NAME\AppData\Local\{5F6E8424-E0DD-43CA-9076-75321D668169}
[2009.04.15 09:41:38 | 000,000,680 | ---- | C] () -- C:\Users\NAME\AppData\Local\d3d9caps.dat
[2009.04.09 20:12:29 | 000,093,696 | ---- | C] () -- C:\Users\NAME\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2009.11.26 14:09:53 | 000,000,000 | ---D | M] -- C:\Users\NAME\AppData\Roaming\Auslogics
[2012.06.13 12:40:08 | 000,000,000 | ---D | M] -- C:\Users\NAME\AppData\Roaming\Canon
[2012.06.27 19:19:15 | 000,000,000 | ---D | M] -- C:\Users\NAME\AppData\Roaming\Epson
[2010.08.06 16:33:37 | 000,000,000 | ---D | M] -- C:\Users\NAME\AppData\Roaming\Haufe
[2011.07.01 12:22:47 | 000,000,000 | ---D | M] -- C:\Users\NAME\AppData\Roaming\Haufe Mediengruppe
[2010.05.18 15:38:35 | 000,000,000 | ---D | M] -- C:\Users\NAME\AppData\Roaming\Leadertech
[2009.08.05 12:33:32 | 000,000,000 | ---D | M] -- C:\Users\NAME\AppData\Roaming\Lexware
[2011.11.01 22:18:12 | 000,000,000 | ---D | M] -- C:\Users\NAME\AppData\Roaming\MusicNet
[2009.12.30 18:13:11 | 000,000,000 | ---D | M] -- C:\Users\NAME\AppData\Roaming\phonostar GmbH
[2009.05.25 18:19:34 | 000,000,000 | ---D | M] -- C:\Users\NAME\AppData\Roaming\Steinberg
[2010.01.03 22:14:16 | 000,000,000 | ---D | M] -- C:\Users\NAME\AppData\Roaming\Tobit
[2011.11.01 22:51:26 | 000,000,000 | ---D | M] -- C:\Users\NAME\AppData\Roaming\Uniblue
 
========== Purity Check ==========
  

< End of report >

Und OTL Extras

Code:

ATTFilter

OTL Extras logfile created on: 13.02.2013 12:17:20 - Run 5
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\NAME\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,22 Gb Total Physical Memory | 1,19 Gb Available Physical Memory | 53,62% Memory free
4,65 Gb Paging File | 3,42 Gb Available in Paging File | 73,37% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 94,16 Gb Total Space | 3,33 Gb Free Space | 3,53% Space Free | Partition Type: NTFS
Drive D: | 195,14 Gb Total Space | 56,65 Gb Free Space | 29,03% Space Free | Partition Type: NTFS
 
Computer Name: NAME-PC | User Name: NAME | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.vbe [@ = VBEFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] -- C:\Windows\System32\CScript.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-1388797816-4094107319-3979931936-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
vbefile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
vbsfile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
wsffile [open] -- %SystemRoot%\System32\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service -- (Safer-Networking Ltd.)
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{28104A53-ED60-4B54-9C67-1F1AAF06F088}" = lport=139 | protocol=6 | dir=in | app=system | 
"{2C7DF05D-74E5-4E48-A96E-EDDB9CEB33F3}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{43A41ABE-A988-4B91-8DE6-5A5092262462}" = rport=139 | protocol=6 | dir=out | app=system | 
"{633533DB-6D3D-4716-9E83-32F43C794094}" = rport=445 | protocol=6 | dir=out | app=system | 
"{6E0E50E8-2985-48DB-8FD6-015EF657F6EB}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{7B7BC29C-45A3-4635-B525-DAA07EAF59D9}" = rport=137 | protocol=17 | dir=out | app=system | 
"{87C1DC4A-7041-4A99-9A55-FEC5830B19D5}" = lport=445 | protocol=6 | dir=in | app=system | 
"{D845C7AF-7035-4318-BE9B-4FB9D41EFBE2}" = lport=138 | protocol=17 | dir=in | app=system | 
"{EEDCA3B8-B4A9-40E4-91FB-4073DAB393CB}" = lport=137 | protocol=17 | dir=in | app=system | 
"{F3DF908E-DBD5-4FBB-8479-BAC5AADFEEB1}" = rport=138 | protocol=17 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{171C8D43-3960-4504-9EC1-5BAFCFF6B424}" = protocol=17 | dir=in | app=c:\program files\tobit clipinc\player\radiorecorder.exe | 
"{20A75DAF-5C73-430E-855F-35395CF2CB49}" = protocol=17 | dir=in | app=c:\program files\arcsoft\totalmedia 3.5\totalmedia.exe | 
"{3026C95A-DC6C-4AAA-928D-FBF608A1DF81}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe | 
"{3934F179-E9E0-4484-B147-2B79FC4077BE}" = protocol=6 | dir=in | app=c:\program files\tobit clipinc\server\clipinc-server.exe | 
"{4EEB9522-74C9-4C93-B497-40234A409FB8}" = protocol=6 | dir=in | app=c:\program files\tobit clipinc\player\clipinc-player.exe | 
"{59382819-53ED-4C24-AB68-6C8BC5DB0869}" = protocol=17 | dir=in | app=c:\program files\tobit clipinc\server\clipinc-server.exe | 
"{7A36E6C2-76D1-4E4A-B43C-4769C95DDA8B}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{88D0FAFD-AF19-4088-AFE5-25D8A46F29C8}" = protocol=6 | dir=in | app=c:\program files\arcsoft\totalmedia 3.5\totalmedia.exe | 
"{A8F17A19-111C-4028-B248-F304BEEE2BAF}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{ABA8DF2B-A2BE-4484-9898-D79814EEF2CA}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{B1699B03-7CA7-4CFD-B1E9-1B9605408D9F}" = protocol=6 | dir=in | app=c:\program files\imesh applications\imesh\imesh.exe | 
"{B3BDBB26-CEF7-4E28-A3B9-06C20B8CF77F}" = protocol=6 | dir=in | app=c:\program files\tobit clipinc\player\radiorecorder.exe | 
"{C7B0768E-C063-483B-B240-A5676D144781}" = protocol=17 | dir=in | app=c:\program files\imesh applications\imesh\imesh.exe | 
"{CC2542CA-EC09-4057-8AD9-BDD6CA5F4C8C}" = protocol=6 | dir=in | app=c:\program files\imesh applications\imesh\imesh.exe | 
"{DE99B24A-7E9B-4C31-89F0-B486206EBE89}" = protocol=17 | dir=in | app=c:\program files\imesh applications\imesh\imesh.exe | 
"{EDA030CC-DCB6-498D-AAEE-C32780A28A00}" = protocol=17 | dir=in | app=c:\program files\tobit clipinc\player\clipinc-player.exe | 
"{F4E61B4B-5819-4E58-BE3E-75540F47E8D2}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"TCP Query User{1BA6142C-AC94-4975-947B-BDCD28BD5702}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"TCP Query User{56ED5D7A-2169-4B95-8C70-497045EC7503}C:\program files\epson software\event manager\eeventmanager.exe" = protocol=6 | dir=in | app=c:\program files\epson software\event manager\eeventmanager.exe | 
"TCP Query User{6465F4F4-55C9-4DB9-BB34-C9DEEF79874F}C:\program files\epson software\event manager\eeventmanager.exe" = protocol=6 | dir=in | app=c:\program files\epson software\event manager\eeventmanager.exe | 
"TCP Query User{6756DB9F-1E79-4813-822C-1782CCFE436A}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"TCP Query User{A1D5513C-D58E-42EB-B5FB-2B6556EE1F3B}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"TCP Query User{A6F2EBAA-4554-47F0-95C4-C06E664B9143}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"TCP Query User{C08E323D-B86D-4AFE-BDAC-0BBCD97D919E}C:\program files\imesh applications\imesh\imesh.exe" = protocol=6 | dir=in | app=c:\program files\imesh applications\imesh\imesh.exe | 
"UDP Query User{00048435-3350-4207-8634-92789A97BD51}C:\program files\epson software\event manager\eeventmanager.exe" = protocol=17 | dir=in | app=c:\program files\epson software\event manager\eeventmanager.exe | 
"UDP Query User{24297334-12CE-433F-BFAE-E2306E5F9ADA}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{6E9A0BB9-84A0-4A52-8E56-6F754A6F8D1E}C:\program files\epson software\event manager\eeventmanager.exe" = protocol=17 | dir=in | app=c:\program files\epson software\event manager\eeventmanager.exe | 
"UDP Query User{900D1571-C98A-4607-8886-B6305CE022BA}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"UDP Query User{920C5BD7-241E-46FC-8295-0DC7C0640106}C:\program files\imesh applications\imesh\imesh.exe" = protocol=17 | dir=in | app=c:\program files\imesh applications\imesh\imesh.exe | 
"UDP Query User{E06A22B2-C01E-4FC1-A5AD-2B2783460261}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"UDP Query User{F8C5075E-2860-4B7E-9BB1-BCD828DBA3DF}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{016F5FA1-FD85-FA69-885F-96A03EEEF9C1}" = CCC Help Dutch
"{017C6E75-766C-DE1C-1B48-D0230CB155BC}" = Catalyst Control Center Localization Korean
"{021C8270-F2A6-C941-3A19-EBE139C966E7}" = Catalyst Control Center Graphics Full Existing
"{03F1CC67-5BD8-4C36-8394-76311B2AE69A}" = ArcSoft PhotoStudio 5
"{04FC3DE9-BC19-E2A2-2FB9-24684DA82A36}" = CCC Help Spanish
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05DD3745-0898-FCA7-0A52-689F128B84F9}" = CCC Help French
"{0739951F-27F4-F7FF-C26D-3C44A681933F}" = ccc-utility
"{099F2D26-B862-F04A-FC7B-E7B0B6196CA7}" = CCC Help Chinese Standard
"{0C58BA84-88A3-39FD-61DB-4DF780D1E0B9}" = CCC Help Polish
"{0C8DFC9B-FB65-1444-3E12-9DF64270347A}" = CCC Help Korean
"{0F32914F-A633-4516-B531-7084C8F19F93}" = Haufe iDesk-Browser
"{139B7164-4C7B-BF85-4CA6-0DD5C611179B}" = Catalyst Control Center Localization Turkish
"{14D68B6D-4C3E-6771-1C77-4384BB653B9E}" = Catalyst Control Center Localization Chinese Traditional
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1D081AB0-B1CC-11E0-80C0-005056B12123}" = Haufe iDesk-Service
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{22E719FE-F76D-0BF3-229D-7A9337458CD0}" = CCC Help German
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron JMB38X Flash Media Controller
"{26D421BE-752E-1070-0C26-2DE993ED00B0}" = CCC Help Portuguese
"{2A63E819-5359-62CF-FCDB-3707391A08A0}" = CCC Help Chinese Traditional
"{2F926AE7-9FB7-4B34-906F-9C29A6D146A7}" = SystemDiagnostics
"{31F2D65F-84A8-D3AD-E3AF-DF127860E39E}" = CCC Help Turkish
"{373C3C97-2FA9-4E18-85A2-255060C21031}" = Nero 8 Essentials
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{39AF5C9F-9673-438F-BBF9-47690B989F7F}" = QuickSteuer 2012
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3F026B88-D153-93DB-A99B-2A78AFEFF813}" = Catalyst Control Center Localization Polish
"{3F03121C-CA62-D0E1-7957-5C82A4CF3C69}" = Catalyst Control Center Localization Norwegian
"{45A34A3F-3597-AA37-E44B-9B95852055A9}" = CCC Help Swedish
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4811A487-6830-E60D-CD37-816E46C8988D}" = Catalyst Control Center Localization Portuguese
"{49083280-8601-EF0D-EC78-6A8FD9C54172}" = CCC Help Thai
"{497A1721-088F-41EF-8876-B43C9DA5528B}" = ArcSoft Software Suite
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A5DC837-AD1B-D80E-FDE5-4793DC47F695}" = CCC Help Finnish
"{4AAF1376-9CB5-B232-22EE-D0EE53ED9148}" = Catalyst Control Center Localization Danish
"{4EBE8518-B14F-B69E-082B-E6FB85F6B52E}" = CCC Help Italian
"{4F2E897D-39A4-73B7-6614-F1EC2B43A1B5}" = CCC Help Czech
"{5413DF9C-4FCC-39A1-FB67-6945428DA718}" = Catalyst Control Center Localization Russian
"{54D4EAF5-4C80-4878-B4AC-5AE454A02E3C}_is1" = Trend Micro RUBotted 2.0 Beta
"{55035C7B-61D2-1DC1-EC53-CFD01C3F82F9}" = CCC Help Hungarian
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{587FD9A4-65A2-423E-AB1D-3BE7F1890AD5}" = ArcSoft TotalMedia Theatre
"{60DCEC40-8854-B0B5-7828-A6E14DBE71EC}" = Catalyst Control Center Graphics Previews Vista
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6DC0B476-B032-83DE-9637-3F6809A344C1}" = Skins
"{6F545E5E-4595-11E2-93B6-B8AC6F97B88E}" = Google Earth
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74292F90-895A-4FC6-A692-9641532B1B63}" = ArcSoft TotalMedia 3.5
"{774715EC-6B2F-092E-0221-B464A80F565A}" = Catalyst Control Center Localization Italian
"{78B1919F-EFDD-5A23-7393-7887C53BE013}" = CCC Help Danish
"{7E1043B7-AA4D-A877-9A26-D1B3E78DF051}" = CCC Help Norwegian
"{81758E18-D5EA-4049-844A-E2DDDDDA9798}" = CCC Help English
"{81794E08-21DA-189A-1DD5-AEDBBE0BE37B}" = CCC Help Russian
"{8A17C27D-0325-400C-8AA9-DAA6B16CBD74}" = Epson Event Manager
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{939FF87B-4ADE-4CB3-A363-153984CD4A49}" = QuickSteuer Wissens-Center 2011
"{94F3D243-2006-4B2D-9160-C2A33F74BB84}" = Windows Media Center Edition MPEG Codec Plug-in
"{95104E32-1B84-0E33-14BE-BA115643629C}" = Catalyst Control Center Graphics Light
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{9687697B-1055-E1E5-2D31-061CC502AB31}" = ATI Catalyst Install Manager
"{98383302-798D-2089-9143-D64E35D666BD}" = Catalyst Control Center Localization Greek
"{9860F761-0ADB-1149-1A0D-1CBBFD693A3D}" = Catalyst Control Center Localization Finnish
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A9DBEBC-C800-4776-A970-D76D6AA405B1}" = PHOTOfunSTUDIO -viewer-
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D26F264-EFA2-31BB-D49F-380FD60207FA}" = Catalyst Control Center Core Implementation
"{A02D7029-C4EF-44C1-9FD4-C0D3CA518113}" = Epson Easy Photo Print 2
"{A72FC039-FE41-4BAD-B36E-64368EC54B54}" = ArcSoft MediaConverter 2.5
"{A777FF2A-942F-CBB0-C36B-F9B72E95B7D9}" = Catalyst Control Center Localization Czech
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC42EE05-1F5D-4B92-851A-DBFE81088A0C}" = QuickSteuer 2010
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{AFC454ED-A26F-4816-826B-C35129D82E1F}" = Fujitsu Siemens Computers Recovery
"{B1EEB795-48EE-AA3B-7CF9-5CE4B7883792}" = Catalyst Control Center Localization German
"{B2D55EB8-32C5-4B43-9006-9E97DECBA178}" = Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser)
"{B3905755-64EC-422E-A4D9-644D6D8FDE5E}" = ccc-core-static
"{B3D068F7-34DD-2BB7-6F2F-D67274819ACC}" = Catalyst Control Center Localization Swedish
"{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" = Spybot - Search & Destroy
"{C1D14C0D-FDAA-4DF2-8441-A902805CCE8C}" = ArcSoft PhotoBase 3
"{C61B2B59-75D2-4203-B589-E0102C3A6F32}" = QuickSteuer Wissens-Center 2012
"{C698749A-7BB4-BE2A-9551-EC85C8A65E2F}" = CCC Help Greek
"{CA45B622-88F9-4836-A529-DBF14698498D}" = Catalyst Control Center - Branding
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF06DB43-2F14-EA98-AB1B-124FD65A8AEE}" = Catalyst Control Center InstallProxy
"{D0846526-66DD-4DC9-A02C-98F9A2806812}" = Launch Manager V1.5.4
"{D21E879C-8400-BEE3-23AB-9399DEF9F7D1}" = Catalyst Control Center Localization Hungarian
"{DCA2E1BC-7FB4-217C-54C6-B99D4EA7FFCF}" = Catalyst Control Center Localization Dutch
"{E3CDAAD3-F806-4F2A-BACF-487AD2E5B3EB}" = QuickSteuer 2011
"{E7B4D6A2-D6B1-29A3-7720-C35599A8718B}" = Catalyst Control Center Localization Thai
"{EBFD0EFA-9AEF-D432-9330-717FE34FB717}" = Catalyst Control Center Localization French
"{ECA7C500-48DF-4A0E-8E99-70BC6607F92A}_is1" = Transcend Digital Music Player Utility
"{ED3B736A-7C2E-35DB-0F33-E8C9CF101662}" = Catalyst Control Center Localization Chinese Standard
"{EDF80EF9-3903-4DDC-96BC-F7D863E689C4}" = QuickSteuer Wissens-Center 2010
"{EECA2BE9-BB32-8E29-3293-536B600B04B4}" = Catalyst Control Center Localization Spanish
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2E272DA-CB23-936D-268E-030DE425AD11}" = Catalyst Control Center Graphics Full New
"{F3C2ECAA-1B4D-4B75-9105-106B0D03EF02}" = Lexware Info Service
"{F87C6FBE-FBD2-CC11-FF28-AC687D08EDF0}" = CCC Help Japanese
"{F9000000-0018-0000-0000-074957833700}" = ABBYY FineReader 9.0 Sprint
"{FD65BBF8-5EEB-BE96-44E8-5887B035E0F6}" = Catalyst Control Center Localization Japanese
"ABBYY FineReader 9.0 Sprint" = ABBYY FineReader 9.0 Sprint
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Audacity_is1" = Audacity 1.2.6
"Avira AntiVir Desktop" = Avira Free Antivirus
"dradio-Recorder_is1" = dradio-Recorder Version 3.02.0
"EPSON Scanner" = EPSON Scan
"EPSON SX130 Series" = Druckerdeinstallation für EPSON SX130 Series
"EPSON SX130 Series Useg" = Benutzerhandbuch EPSON SX130 Series
"Google Chrome" = Google Chrome
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 18.0.2 (x86 de)" = Mozilla Firefox 18.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"My MP3 3.0" = My MP3 3.0
"Niedersachsen/Bremen 3D" = Niedersachsen/Bremen 3D
"Picasa 3" = Picasa 3
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"Secunia PSI" = Secunia PSI (3.0.0.6001)
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Tobit ClipInc Server" = WDR RadioRecorder
"VLC media player" = VLC media player 2.0.5
"WinPcapInst" = WinPcap 4.1.1
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 12.02.2013 14:07:16 | Computer Name = NAME-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 12.02.2013 14:07:16 | Computer Name = NAME-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 12.02.2013 14:07:16 | Computer Name = NAME-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 12.02.2013 14:07:16 | Computer Name = NAME-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 12.02.2013 14:07:16 | Computer Name = NAME-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 12.02.2013 14:07:16 | Computer Name = NAME-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 12.02.2013 15:17:44 | Computer Name = NAME-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 13.02.2013 06:37:56 | Computer Name = NAME-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 13.02.2013 07:07:16 | Computer Name = NAME-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 13.02.2013 07:13:01 | Computer Name = NAME-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 9.0.8112.16464 arbeitet nicht mehr 
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen 
über das Problem zu suchen.  Prozess-ID: 9d0  Anfangszeit: 01ce09dadd27f268  Zeitpunkt
 der Beendigung: 0
 
[ Spybot - Search and Destroy Events ]
Error - 10.02.2013 09:54:22 | Computer Name = NAME-PC | Source = SDCleaner | ID = 100
Description = LoadCleaningInstructions
 
[ System Events ]
Error - 10.02.2013 13:20:43 | Computer Name = NAME-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = 
 
Error - 11.02.2013 11:35:33 | Computer Name = NAME-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = 
 
Error - 12.02.2013 05:13:13 | Computer Name = NAME-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = 
 
Error - 12.02.2013 13:52:27 | Computer Name = NAME-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = 
 
Error - 12.02.2013 15:17:25 | Computer Name = NAME-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = 
 
Error - 12.02.2013 15:24:25 | Computer Name = NAME-PC | Source = Service Control Manager | ID = 7022
Description = 
 
Error - 13.02.2013 06:36:57 | Computer Name = NAME-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = 
 
Error - 13.02.2013 06:40:47 | Computer Name = NAME-PC | Source = Service Control Manager | ID = 7009
Description = 
 
Error - 13.02.2013 06:40:47 | Computer Name = NAME-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 13.02.2013 07:06:52 | Computer Name = NAME-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = 
 
 
< End of report >

cosinus · 13.02.2013, 13:09

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes - denk bitte vorher daran, Malwarebytes über den Updatebutton zu aktualisieren

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

UliBa · 13.02.2013, 13:17

ESET hatte ich gestern oder vorgestern schon mal laufen lassen, ohne Befund, werde das jetzt aber wiederholen, ebenso MBAM.
Kann mich aber erst heute Abend wieder melden.

Kannst Du mir vielleicht noch einen Hinweis geben, was überhaupt gefunden wurde bzw. welchen "Schaden" die Funde anrichten können? Passt das zu den Aussagen der Telekom, dass von diesem PC aus Anggriffe auf fremde Rechner erfolgt sein sollen?

So weit schon mal vielen Dank für Deine Hilfe und bis später!

ESET hat gemeldet, dass nichts gefunden wurde.
Im Log steht nur das hier:

Code:

ATTFilter

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK

MBAM findet auch nichts:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.02.13.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
NAME :: NAME-PC [Administrator]

13.02.2013 13:40:23
mbam-log-2013-02-13 (13-40-23).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 206046
Laufzeit: 6 Minute(n), 7 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

cosinus · 14.02.2013, 11:11

ESET hast du wahrscheinlich falsch gemacht, bitte mach ESET nochmal, neu runterladen und den Installer unbedingt per Rechtsklick als Administrator ausführen

UliBa · 14.02.2013, 17:02

Hier noch mal ESET:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=0c40c11e76cbca4797ef2f5520a0d1bd
# engine=13153
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-02-14 01:40:49
# local_time=2013-02-14 02:40:49 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1799 16775165 100 97 75223 226272539 67975 0
# compatibility_mode=5892 16776574 100 100 493115 198381977 0 0
# scanned=196317
# found=0
# cleaned=0
# scan_time=8376

Sieht aber trotzdem gut aus, oder?

cosinus · 14.02.2013, 17:12

Sieht soweit ok aus

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

UliBa · 14.02.2013, 17:18

Hallo Cosinus,

denke, so weit ist alles in Ordnung.
Cookies sind nicht das Problem. Habe das jetzt zumindest so eingestellt, dass die beim Schließen des Browsers gelöscht werden.

Noch mal die Frage, ob Du mir noch sagen kannst, was für eine Art Schädling(e) überhaupt gefunden wurde. Wenn ich es einigermaßen richtig verfolgt habe, gings vor allem um Toolbars.
Ausgangspunkt war ja das Schreiben der Telekom, es seien von diesem Rechner aus "Angriffe auf fremde Computer" erfolgt.
Kann das mit den Funden in Zusammenhang gebracht werden?
Wenn die Einschätzung schwierig ist, ist das auch okay. Ich frage halt nur, um es besser zu verstehen.

Auf alle Fälle vielen Dank für Deine Hilfe!!!

cosinus · 14.02.2013, 17:23

Soweit ich das richtig gesehen hab nur nervige Crapware wie Toolbars und andere Werbezecken

Dann wären wir durch!

Die Programme, die hier zum Einsatz kamen, können alle wieder runter.

Combofix entfernen (nur relevant wenn es hier benutzt wurde!) : Start/Ausführen (Tastenkombination WIN+R), dort den Befehl combofix /uninstall eintippen und ausführen

Mit Hilfe von OTL kannst du auch viele andere Tools entfernen: Starte dazu einfach OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate
Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.
Windows Vista/7: Start, Systemsteuerung, Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks findest du hier => Browsers and Plugins - FilePony.de

Alle Plugins im Firefox-Browser kannst du auch ganz einfach hier auf Aktualität prüfen => https://www.mozilla.org/de/plugincheck

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

UliBa · 14.02.2013, 17:32

Um den Rest kümmer ich mich dann.

Noch mal danke und Tschüss.

14.02.2013, 11:11	#10
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Searchcore und mehr auf PC? ESET hast du wahrscheinlich falsch gemacht, bitte mach ESET nochmal, neu runterladen und den Installer unbedingt per Rechtsklick als Administrator ausführen __________________ Logfiles bitte immer in CODE-Tags posten

Searchcore und mehr auf PC?

Log-Analyse und Auswertung: Searchcore und mehr auf PC?