Hallo alle miteinander.
Ich bin neu hier und habe schon einiges gelesen.Das problem ist ein Rechner meiner bekannten.
Es ist ein Medion Pc mit Vista Home Premium.Ich schreibe hier jetzt nicht mehr über den PC und seine Komponenten, weil ich nicht weiß, was Ihr benötigt und dann unnütz lesen müßt.Schreibt einfach ,wenn Ihr Angaben braucht. Hier erst mal die Probleme. Als erstes werden alle Updates für Sicherheitsprogramme geblockt. Sie hat drei auf Ihrem Rechner: Avira Free Antivirus, Avast Free Antivirus und Ad Aware Free Version. Avira macht allerdings einen kompletten Durchlauf
wenn man es startet, findet aber nichts. Den Avast habe ich zusätzlich instaliert nachdem Antivir sich nicht updaten läßt. Aber damit ging garnichts, derläßt sich noch nichtmal starten. Dazu kommt das der Windows Defender sich nicht aktiveren läßt. So nun habe ich von Eurer Home-Page die folgenden Programme geladen und auch durchlaufen lassen. FRST und GMER haben funktioniert. Defogger startet und läuft auch, zeigt Finished an ich klicke auf OK und dann ist wieder das Anfangfenster da mit unten "Disable links und rechts Re-enable. Da wußte ich jetzt nicht weiter und habe ihn ausgeschaltet ohne Re-enable zu klicken. Jetzt kommt das große Problem, die Logdateien von FRST und GMER hier sichtbar zu machen.
Ich versuchs erstmal mit FRST:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-04-2015
Ran by PC (administrator) on PC-PC on 21-04-2015 19:22:19
Running from C:\Users\PC\Downloads
Loaded Profiles: PC (Available profiles: PC)
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Antivirus\sched.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
() C:\Acer\Empowering Technology\SysMonitor.exe
(HiTRUST) C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
(CyberLink Corp.) C:\Program Files\Acer Arcade Live\Acer PlayMovie\PMVService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Geek Software GmbH) C:\Program Files\PDF24\pdf24.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(APN) C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Vodafone) C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Antivirus\avgnt.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Simple Star, Inc.) C:\Program Files\Simple Star\PhotoShow Deluxe 3\data\Xtras\mssysmgr.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Garmin Ltd or its subsidiaries) C:\Program Files\Garmin\Express Tray\ExpressTray.exe
() C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Acer Inc.) C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
() C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Antivirus\avguard.exe
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
(HiTRSUT) C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareService.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files\epson\MyEpson Portal\mepService.exe
(SEIKO EPSON CORPORATION) C:\Program Files\epson\MyEpson Portal\mep.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Antivirus\avshadow.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
(Vodafone) C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Garmin Ltd or its subsidiaries) C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Bytemobile, Inc.) C:\Program Files\Vodafone\Vodafone Mobile Connect\Optimization Client\bmctl.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\sdclt.exe
() C:\Users\PC\Downloads\Defogger.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4669440 2007-07-06] (Realtek Semiconductor)
HKLM\...\Run: [Acer Tour] => [X]
HKLM\...\Run: [Acer Empowering Technology Monitor] => C:\Acer\Empowering Technology\SysMonitor.exe [319488 2007-01-24] ()
HKLM\...\Run: [eDataSecurity Loader] => C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [464168 2007-02-07] (HiTRUST)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-06-15] (Realtek Semiconductor Corp.)
HKLM\...\Run: [PlayMovie] => C:\Program Files\Acer Arcade Live\Acer PlayMovie\PMVService.exe [178280 2007-07-13] (CyberLink Corp.)
HKLM\...\Run: [WarReg_PopUp] => C:\Acer\WR_PopUp\WarReg_PopUp.exe [57344 2006-11-05] (Acer Inc.)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] ()
HKLM\...\Run: [eRecoveryService] => [X]
HKLM\...\Run: [Acer Tour Reminder] => C:\Acer\AcerTour\Reminder.exe [151552 2007-02-15] (Acer Inc.)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM\...\Run: [PDFPrint] => C:\Program Files\PDF24\pdf24.exe [220552 2011-02-01] (Geek Software GmbH)
HKLM\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [559696 2013-09-27] (Lavasoft)
HKLM\...\Run: [ApnTBMon] => C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [2005896 2015-04-06] (APN)
HKLM\...\Run: [MobileConnect] => C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe [2403840 2009-09-11] (Vodafone)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareTray.exe [8216048 2015-03-10] ()
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\Antivirus\avgnt.exe [726320 2015-03-24] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-04-17] (Avast Software s.r.o.)
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\...\Run: [Acer Tour Reminder] => [X]
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\...\Run: [PhotoShow Deluxe Media Manager] => C:\Program Files\Simple Star\PhotoShow Deluxe 3\data\Xtras\mssysmgr.exe [163840 2005-02-01] (Simple Star, Inc.)
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [31087200 2015-01-23] (Skype Technologies S.A.)
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_TATINFE.EXE [262208 2013-12-16] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\...\Run: [GarminExpressTrayApp] => C:\Program Files\Garmin\Express Tray\ExpressTray.exe [688984 2015-01-28] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\...\MountPoints2: {40c1979e-d38e-11df-a9bd-001c2583e12a} - J:\LaunchU3.exe -a
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\...\MountPoints2: {babcf7fa-afbc-11e4-82e3-001c2583e12a} - J:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\...\MountPoints2: {babcf881-afbc-11e4-82e3-001e101f82a0} - J:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\ACER(W~1.SCR [187392 2006-10-19] ()
HKU\S-1-5-18\...\Run: [Acer Tour Reminder] => C:\Acer\AcerTour\Reminder.exe [151552 2007-02-15] (Acer Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Empowering Technology Launcher.lnk [2007-05-07]
ShortcutTarget: Empowering Technology Launcher.lnk -> C:\Acer\Empowering Technology\eAPLauncher.exe (Acer Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PCM Media Sharing.lnk [2007-05-07]
ShortcutTarget: PCM Media Sharing.lnk -> C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe ()
Startup: C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk [2010-10-30]
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2015-04-17] (Avast Software s.r.o.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
URLSearchHook: HKU\S-1-5-21-1859551519-956376940-1599385416-1000 - Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
SearchScopes: HKU\S-1-5-21-1859551519-956376940-1599385416-1000 -> DefaultScope {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKU\S-1-5-21-1859551519-956376940-1599385416-1000 -> {4816C09D-3D85-4878-A903-D5627AF2A110} URL = hxxp://www.search.ask.com/web?tpid=ORJ&o=100000027&pf=V7&p2=&gct=sb&itbv=12.10.3.24&apn_uid=DDFCA50F-87FC-4FD3-A644-4BD251FBB26D&apn_ptnrs=U3&apn_dtid=YYYYYYYYDE&apn_dbr=ff_15.0.1&doi=2014-02-01&trgb=IE&q={searchTerms}&psv=&pt=tb
SearchScopes: HKU\S-1-5-21-1859551519-956376940-1599385416-1000 -> {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKU\S-1-5-21-1859551519-956376940-1599385416-1000 -> {6D603AC1-6D71-4C69-A516-ED9C1B18BDBF} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-27] (Adobe Systems Incorporated)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-02-10] (Oracle Corporation)
BHO: ShowBarObj Class -> {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} -> C:\Windows\system32\ActiveToolBand.dll [2007-02-06] (HiTRUST)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-17] (Avast Software s.r.o.)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-10-02] (Skype Technologies S.A.)
BHO: Ask Shopping Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files\AskPartnerNetwork\Toolbar\ORJ\Passport.dll [2015-04-06] (APN LLC.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-10] (Oracle Corporation)
Toolbar: HKLM - Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll [2007-02-06] (HiTRUST)
Toolbar: HKLM - Ask Shopping Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\AskPartnerNetwork\Toolbar\ORJ\Passport.dll [2015-04-06] (APN LLC.)
Toolbar: HKU\S-1-5-21-1859551519-956376940-1599385416-1000 -> Acer eDataSecurity Management - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll [2007-02-06] (HiTRUST)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {CAFEEFAC-0018-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2006-10-27] (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-20] (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-10-02] (Skype Technologies S.A.)
Winsock: Catalog9 01 C:\Program Files\Avira\Antivirus\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\Antivirus\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\Antivirus\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\Antivirus\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\Antivirus\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\Antivirus\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\Antivirus\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\Antivirus\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 09 C:\Program Files\Avira\Antivirus\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 10 C:\Program Files\Avira\Antivirus\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 11 bmnet.dll File Not found ()
Winsock: Catalog9 12 bmnet.dll File Not found ()
Winsock: Catalog9 13 bmnet.dll File Not found ()
Winsock: Catalog9 24 C:\Program Files\Avira\Antivirus\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default
FF DefaultSearchUrl: hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q=
FF SearchEngineOrder.1: Ask.com
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-09] ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Windows\system32\npdeployJava1.dll [2015-02-10] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-10] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-10] (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-09] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-09] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2012-07-27] (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\user.js [2011-12-20]
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2006-10-26] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2012-07-27] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\ask-web-search.xml [2014-02-06]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\askcom.xml [2014-02-01]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-1.xml [2015-04-15]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-10.xml [2012-01-06]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-11.xml [2011-06-25]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-12.xml [2011-08-03]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-13.xml [2011-08-26]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-14.xml [2011-08-30]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-15.xml [2011-09-06]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-16.xml [2011-09-13]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-17.xml [2011-09-28]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-18.xml [2011-10-04]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-19.xml [2012-01-10]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-2.xml [2010-10-21]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-20.xml [2012-02-02]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-21.xml [2012-02-13]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-22.xml [2012-02-17]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-23.xml [2012-03-12]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-24.xml [2012-03-19]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-25.xml [2012-03-26]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-26.xml [2012-04-02]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-27.xml [2012-05-09]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-28.xml [2012-06-08]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-29.xml [2012-06-23]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-3.xml [2010-10-28]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-30.xml [2012-07-24]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-31.xml [2012-08-02]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-32.xml [2012-09-03]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-33.xml [2012-09-10]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-34.xml [2012-10-14]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-35.xml [2012-10-28]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-36.xml [2012-12-05]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-37.xml [2013-01-11]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-38.xml [2013-01-20]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-39.xml [2013-02-07]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-4.xml [2010-12-11]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-40.xml [2013-02-28]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-41.xml [2013-03-11]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-42.xml [2013-04-04]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-43.xml [2013-05-26]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-44.xml [2013-05-26]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-45.xml [2013-07-07]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-46.xml [2013-08-17]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-5.xml [2011-02-22]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-6.xml [2011-03-08]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-7.xml [2011-03-27]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-8.xml [2011-05-01]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-9.xml [2011-05-07]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin.gif [2012-07-24]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin.src [2012-07-24]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin.xml [2010-09-12]
FF Extension: Segurança do navegador Avira - C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\Extensions\abs@avira.com [2015-03-31]
FF Extension: Garmin Communicator - C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2013-11-19]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-09-17]
FF Extension: Adblock Plus - C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-03-30]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-04-08]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-05-02]
FF HKLM\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\Vodafone\Vodafone Mobile Connect\Optimization Client\addon
FF Extension: Bytemobile Optimization Client - C:\Program Files\Vodafone\Vodafone Mobile Connect\Optimization Client\addon [2015-02-08]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: No Name - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-04-17]

Chrome:
=======
CHR Profile: C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-17]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 Acer HomeMedia Connect Service; C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [266343 2007-04-04] (CyberLink) [File not signed]
R2 AcerMemUsageCheckService; C:\Acer\Empowering Technology\ePerformance\MemCheck.exe [28672 2006-12-29] () [File not signed]
S2 AntiVirMailService; C:\Program Files\Avira\Antivirus\avmailc.exe [815352 2015-03-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\Antivirus\sched.exe [434424 2015-03-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\Antivirus\avguard.exe [434424 2015-03-24] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files\Avira\Antivirus\AVWEBGRD.EXE [1004032 2015-03-24] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [180632 2015-04-06] (APN LLC.)
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-17] (Avast Software s.r.o.)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [3205216 2015-04-17] (Avast Software)
R2 eDataSecurity Service; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [457512 2007-02-07] (HiTRSUT)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc.exe [126128 2012-05-17] (Seiko Epson Corporation)
R2 eRecoveryService; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [53248 2007-01-31] (Acer Inc.) [File not signed]
R2 Garmin Core Update Service; C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [517464 2015-01-28] (Garmin Ltd or its subsidiaries)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareService.exe [670808 2015-03-10] ()
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440 2007-01-17] (Hewlett-Packard Company) [File not signed]
S2 matlabserver; C:\MATLAB6p1\webserver\bin\win32\matlabserver.exe [258048 2001-04-06] () [File not signed]
R2 MyEpson Portal Service; C:\Program Files\EPSON\MyEpson Portal\mepService.exe [703984 2014-09-22] (SEIKO EPSON CORPORATION)
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [143360 2007-04-09] () [File not signed]
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
R2 VMCService; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [9216 2009-09-11] (Vodafone) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24144 2015-04-17] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [73440 2015-04-17] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [55200 2015-04-17] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49904 2015-04-17] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [788272 2015-04-17] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427736 2015-04-17] (Avast Software s.r.o.)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57888 2015-04-17] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [208024 2015-04-17] ()
R3 avc3; C:\Windows\System32\DRIVERS\avc3.sys [640560 2015-01-06] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [242504 2015-01-06] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [490144 2015-01-06] (BitDefender)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-03-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-03-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2015-03-24] (Avira Operations GmbH & Co. KG)
R1 BdfNdisf; c:\program files\lavasoft\ad-aware antivirus\firewall engine\1.6.0.0\drivers\bdfndisf6.sys [77192 2015-01-06] (BitDefender LLC)
R1 bdftdif; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Firewall Engine\1.6.0.0\Drivers\bdftdif.sys [130640 2015-01-06] (BitDefender LLC)
U0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [22528 2008-10-09] (Bytemobile, Inc.) [File not signed]
S3 grmnusb; C:\Windows\System32\drivers\grmnusb.sys [15720 2012-04-18] (GARMIN Corp.)
R3 gzflt; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\3.0.98.0\gzflt.sys [169992 2015-01-22] (BitDefender LLC)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2010-02-03] (LogMeIn, Inc.)
S3 hwusbfake; C:\Windows\System32\DRIVERS\ewusbfake.sys [102912 2009-06-29] (Huawei Technologies Co., Ltd.)
R2 int15; C:\Acer\Empowering Technology\eRecovery\int15.sys [76584 2006-12-07] ()
R3 NTIDrvr; C:\Windows\System32\DRIVERS\NTIDrvr.sys [6144 2007-05-07] (NewTech Infosystems, Inc.) [File not signed]
R0 PSDFilter; C:\Windows\System32\DRIVERS\psdfilter.sys [20264 2007-02-07] (HiTRUST)
R0 PSDNServ; C:\Windows\System32\drivers\PSDNServ.sys [16680 2007-02-07] (HiTRUST)
R0 psdvdisk; C:\Windows\System32\drivers\psdvdisk.sys [60712 2007-02-07] (HiTRUST)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2015-03-24] (Avira GmbH)
R1 tcpipBM; C:\Windows\system32\Drivers\tcpipBM.sys [18816 2008-10-09] (Bytemobile, Inc.) [File not signed]
S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [408280 2015-01-22] (BitDefender S.R.L.)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [220240 2015-04-17] (Avast Software)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Live\Acer PlayMovie\000.fcl [39408 2007-08-31] (Cyberlink Corp.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S0 Lbd; system32\DRIVERS\Lbd.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-21 19:22 - 2015-04-21 19:23 - 00032762 _____ () C:\Users\PC\Downloads\FRST.txt
2015-04-21 19:21 - 2015-04-21 19:22 - 00000000 ____D () C:\FRST
2015-04-21 19:21 - 2015-04-21 19:21 - 01139200 _____ (Farbar) C:\Users\PC\Downloads\FRST.exe
2015-04-21 19:16 - 2015-04-21 19:18 - 00000466 _____ () C:\Users\PC\Downloads\defogger_disable.log
2015-04-21 19:16 - 2015-04-21 19:16 - 00000000 _____ () C:\Users\PC\defogger_reenable
2015-04-21 19:14 - 2015-04-21 19:14 - 00050477 _____ () C:\Users\PC\Downloads\Defogger.exe
2015-04-20 17:50 - 2015-04-20 17:51 - 00000000 ____D () C:\Users\PC\Downloads\Neuer Ordner
2015-04-19 14:24 - 2015-04-19 14:24 - 00000000 ____D () C:\Users\PC\AppData\Roaming\FLEXnet
2015-04-19 13:00 - 2015-04-19 13:00 - 00000000 ____D () C:\Users\PC\Neuer Ordner
2015-04-17 23:29 - 2015-04-17 23:30 - 00000000 ____D () C:\Users\PC\Desktop\Allerlei Desctop
2015-04-17 22:00 - 2015-04-17 22:00 - 00000556 _____ () C:\Windows\PFRO.log
2015-04-17 21:55 - 2015-04-17 21:55 - 00000000 ____D () C:\Users\PC\AppData\Roaming\AVAST Software
2015-04-17 21:55 - 2015-04-17 21:55 - 00000000 _____ () C:\Windows\setuperr.log
2015-04-17 21:55 - 2015-04-17 21:55 - 00000000 _____ () C:\Windows\setupact.log
2015-04-17 21:54 - 2015-04-17 21:55 - 00000000 ____D () C:\Windows\system32\vbox
2015-04-17 21:53 - 2015-04-17 21:53 - 00001833 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-04-17 21:53 - 2015-04-17 21:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-04-17 21:53 - 2015-04-17 21:52 - 00788272 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-04-17 21:53 - 2015-04-17 21:52 - 00427736 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-04-17 21:53 - 2015-04-17 21:52 - 00291312 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-04-17 21:53 - 2015-04-17 21:52 - 00208024 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-04-17 21:53 - 2015-04-17 21:52 - 00073440 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-04-17 21:53 - 2015-04-17 21:52 - 00057888 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswTdi.sys
2015-04-17 21:53 - 2015-04-17 21:52 - 00055200 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr.sys
2015-04-17 21:53 - 2015-04-17 21:52 - 00049904 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-04-17 21:53 - 2015-04-17 21:52 - 00024144 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-04-17 21:52 - 2015-04-17 21:52 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-04-17 21:51 - 2015-04-17 21:51 - 00000000 ____D () C:\Program Files\AVAST Software
2015-04-17 21:50 - 2015-04-17 21:50 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-04-17 21:34 - 2015-04-17 21:34 - 00000769 _____ () C:\Users\Public\Desktop\EPSON Scan.lnk
2015-04-17 21:34 - 2014-02-25 00:00 - 00342528 _____ (Seiko Epson Corporation) C:\Windows\system32\esw2ud.dll
2015-04-17 21:34 - 2012-05-17 00:00 - 00126128 _____ (Seiko Epson Corporation) C:\Windows\system32\escsvc.exe
2015-04-17 17:56 - 2015-04-17 17:56 - 00000000 ____D () C:\Users\PC\AppData\Roaming\Avira
2015-04-17 17:55 - 2015-04-17 17:55 - 00001809 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2015-04-17 17:55 - 2015-04-17 17:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-17 17:55 - 2015-03-24 14:59 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-04-17 17:55 - 2015-03-24 14:59 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-04-17 17:55 - 2015-03-24 14:59 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-04-17 17:28 - 2015-04-17 17:28 - 00000000 ____D () C:\OETemp
2015-04-14 21:52 - 2015-04-14 21:52 - 00000000 ____D () C:\Users\PC\Desktop\KVART-Bilder
2015-04-14 21:26 - 2015-04-16 04:17 - 00000000 ____D () C:\Users\PC\{8680f3f1-d5a4-4f00-bcba-04d3bbe2ac43}
2015-04-12 20:54 - 2015-04-12 20:54 - 00000000 ____D () C:\ProgramData\BitDefender
2015-04-12 20:51 - 2015-01-06 12:47 - 00842368 _____ (BitDefender S.R.L.) C:\Windows\system32\bdsmtpp.dll
2015-04-12 20:51 - 2015-01-06 12:47 - 00179560 _____ (BitDefender) C:\Windows\system32\BdFirewallSDK.dll
2015-04-12 20:51 - 2015-01-06 12:47 - 00161544 _____ (BitDefender) C:\Windows\system32\httproxy.dll
2015-04-12 20:51 - 2015-01-06 12:47 - 00136824 _____ (BitDefender S.R.L.) C:\Windows\system32\bdpop3p.dll
2015-04-12 20:51 - 2015-01-06 12:47 - 00135288 _____ () C:\Windows\system32\bdfwcore.dll
2015-04-12 20:51 - 2015-01-06 12:47 - 00110568 _____ (BitDefender) C:\Windows\system32\OEMbdpredir.dll
2015-04-12 20:51 - 2015-01-06 12:47 - 00086896 _____ (BitDefender) C:\Windows\system32\bdpredir.dll
2015-04-12 20:51 - 2015-01-06 12:37 - 01516488 _____ (Bitdefender) C:\Windows\system32\bdnc.dll
2015-04-12 20:50 - 2015-04-21 19:01 - 00002224 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2015-04-12 20:50 - 2015-04-12 20:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2015-04-12 20:49 - 2015-04-12 20:49 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2015-04-12 20:48 - 2015-04-12 20:48 - 00000000 ____D () C:\Users\PC\AppData\Roaming\Lavasoft
2015-04-12 20:48 - 2015-04-12 20:48 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2015-04-12 20:47 - 2015-04-12 20:47 - 00000000 ____D () C:\Users\PC\AppData\Local\Lavasoft
2015-04-08 18:41 - 2015-04-08 18:41 - 00000000 ____D () C:\Program Files\Mozilla Firefox

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-21 19:16 - 2010-04-23 08:23 - 00000000 ____D () C:\Users\PC
2015-04-21 19:11 - 2015-02-25 19:11 - 00000917 _____ () C:\Windows\Tasks\EPSON XP-225 Series Update {1998D3F2-57DE-4F62-A20D-6554C0D76ED6}.job
2015-04-21 19:05 - 2013-06-19 17:21 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-21 19:05 - 2010-04-23 07:58 - 01827694 _____ () C:\Windows\WindowsUpdate.log
2015-04-21 19:03 - 2010-05-02 19:06 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-21 19:03 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-21 19:02 - 2006-11-02 15:01 - 00032534 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-21 19:01 - 2010-07-28 14:00 - 00000000 ____D () C:\Users\PC\AppData\Roaming\Skype
2015-04-21 19:01 - 2010-05-02 19:06 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-21 18:56 - 2006-11-02 14:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-21 18:56 - 2006-11-02 14:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-19 16:23 - 2013-02-18 20:50 - 00000000 ____D () C:\Users\PC\Desktop\Minos Belegungkopien !!!!!!(Malteser)
2015-04-19 16:08 - 2010-08-01 17:59 - 00012772 _____ () C:\Users\PC\AppData\Roaming\wklnhst.dat
2015-04-19 15:50 - 2010-05-04 15:47 - 00000000 ____D () C:\Users\PC\Documents\Conny2
2015-04-19 15:42 - 2014-02-07 12:34 - 00000384 _____ () C:\Windows\Tasks\Ad-Aware Update (Weekly).job
2015-04-19 14:33 - 2013-03-28 12:46 - 00000022 _____ () C:\Users\PC\AppData\Local\cmdial32.ini
2015-04-17 21:52 - 2006-11-02 14:37 - 00000000 ____D () C:\Program Files\Windows Sidebar
2015-04-17 21:35 - 2015-02-25 19:08 - 00000933 _____ () C:\Users\Public\Desktop\EPSON-Handbücher.lnk
2015-04-17 21:35 - 2015-02-25 19:08 - 00000123 _____ () C:\Users\Public\Desktop\Epson Connect Site.url
2015-04-17 21:34 - 2015-02-25 19:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2015-04-17 21:34 - 2015-02-25 19:06 - 00000000 ____D () C:\Program Files\epson
2015-04-17 21:34 - 2006-11-02 14:37 - 00000000 ____D () C:\Windows\twain_32
2015-04-17 21:22 - 2015-02-25 19:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Software
2015-04-17 21:22 - 2015-02-25 19:07 - 00000000 ____D () C:\Program Files\EPSON Software
2015-04-17 21:22 - 2007-05-07 00:43 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2015-04-17 17:55 - 2013-08-05 17:57 - 00000000 ____D () C:\ProgramData\Avira
2015-04-17 17:34 - 2014-02-07 19:03 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2015-04-17 17:31 - 2011-07-05 10:44 - 00000000 ____D () C:\Program Files\Avira
2015-04-17 17:28 - 2014-08-24 13:33 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-16 04:17 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2015-04-16 04:17 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2015-04-16 04:17 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2015-04-16 04:17 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-04-16 04:17 - 2006-11-02 12:22 - 50593792 _____ () C:\Windows\system32\config\software_previous
2015-04-16 04:17 - 2006-11-02 12:22 - 23855104 _____ () C:\Windows\system32\config\system_previous
2015-04-16 04:04 - 2006-11-02 12:22 - 46399488 _____ () C:\Windows\system32\config\components_previous
2015-04-16 04:04 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2015-04-15 18:02 - 2006-11-02 12:22 - 00524288 _____ () C:\Windows\system32\config\default_previous
2015-04-15 18:02 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2015-04-14 21:01 - 2015-02-25 19:49 - 00000000 ____D () C:\Users\PC\AppData\Roaming\EPSON
2015-04-14 21:01 - 2015-02-25 19:01 - 00000000 ____D () C:\ProgramData\Epson
2015-04-13 14:25 - 2006-11-02 12:33 - 02244156 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-12 20:49 - 2010-04-27 22:14 - 00000000 ____D () C:\Program Files\Lavasoft
2015-04-12 20:02 - 2010-04-27 22:14 - 00000000 ____D () C:\ProgramData\Lavasoft
2015-04-10 17:58 - 2012-05-05 21:02 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-01 17:46 - 2010-07-23 10:55 - 00007484 _____ () C:\Users\PC\AppData\Local\d3d9caps.dat
2015-03-24 14:59 - 2014-11-07 17:36 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys

==================== Files in the root of some directories =======

2010-08-01 17:59 - 2015-04-19 16:08 - 0012772 _____ () C:\Users\PC\AppData\Roaming\wklnhst.dat
2010-05-04 18:22 - 2009-08-27 11:09 - 0013264 _____ (Arcor Online GmbH) C:\Users\PC\AppData\Local\cmdial32.dll
2013-03-28 12:46 - 2015-04-19 14:33 - 0000022 _____ () C:\Users\PC\AppData\Local\cmdial32.ini
2010-07-23 10:55 - 2015-04-01 17:46 - 0007484 _____ () C:\Users\PC\AppData\Local\d3d9caps.dat
2010-04-23 09:34 - 2013-11-21 00:08 - 0136704 _____ () C:\Users\PC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2009-06-16 14:25 - 2009-06-16 14:25 - 0121512 ____R () C:\ProgramData\DeviceManager.xml.rc4
2010-07-28 15:20 - 2010-07-28 15:20 - 0000056 ____H () C:\ProgramData\ezsidmv.dat

Some content of TEMP:
====================
C:\Users\PC\AppData\Local\Temp\avgnt.exe


Some zero byte size files/folders:
==========================
C:\Windows\System32\NTIBUN5.dll
C:\Windows\System32\NTIDIB4.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-21 19:05

==================== End Of Log ============================

Das hat anscheinend geklappt.
Nun Das nächste.

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 20-04-2015
Ran by PC at 2015-04-21 19:23:22
Running from C:\Users\PC\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Out of date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Ad-Aware Antivirus (Enabled - Up to date) {D87B6541-12A1-DAEA-0033-9B8057AAB996}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Ad-Aware Antivirus (Enabled - Up to date) {631A84A5-349B-D564-3A83-A0F22C2DF32B}
AS: Avira Antivirus (Enabled - Out of date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: Ad-Aware Firewall (Disabled) {E040E464-58CE-DBB2-2B6C-32B5A979FEED}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acer Arcade Live Main Page (HKLM\...\{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}) (Version: 1.0.4010 - Acer Inc.)
Acer DV Magician (HKLM\...\{F6EFFB76-4A07-11DA-9D78-000129760D75}) (Version: 1.2.2810 - Acer Inc.)
Acer DVDivine (HKLM\...\{B145EC69-66F5-11D8-9D75-000129760D75}) (Version: 3.1.1610 - Acer Inc.)
Acer eDataSecurity Management (HKLM\...\{AEEAE013-92F1-4515-B278-139F1A692A36}) (Version: 2.5.3032 - HiTRUST Inc.)
Acer Empowering Technology (HKLM\...\{AB6097D9-D722-4987-BD9E-A076E2848EE2}) (Version: 2.5.3005 - Acer Inc.)
Acer ePerformance Management (HKLM\...\{D462BF9E-0C35-4705-BF9B-3DF9F3816643}) (Version: 2.5.3002 - Acer Inc.)
Acer HomeMedia (HKLM\...\{AA4BF92B-2AAF-11DA-9D78-000129760D75}) (Version: 1.3.4010 - Acer Inc.)
Acer HomeMedia Connect (HKLM\...\{132888AE-EF67-41C5-BCA2-7D5D2488AB63}) (Version: 1.4.4010 - Acer Inc.)
Acer PlayMovie (HKLM\...\{A450831D-25F6-4F42-9662-D000B25E0D82}) (Version: DVD 1.5.3317 - Acer Inc.)
Acer ScreenSaver (HKLM\...\{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}) (Version: 4.01.20070419 - Acer Inc.)
Acer SlideShow DVD (HKLM\...\{41581EF5-45A7-11DA-9D78-000129760D75}) (Version: 1.2.2810 - Acer Inc.)
Acer Tour (HKLM\...\{94389919-B0AA-4882-9BE8-9F0B004ECA35}) (Version: 2.0.1001 - Acer Inc.)
Acer VideoMagician (HKLM\...\{F79A208D-D929-11D9-9D77-000129760D75}) (Version: 1.3.1610 - Acer Inc.)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Ad-Aware Antivirus (HKLM\...\{35CC81F8-F385-4B79-91A8-3163420F5D01}_AdAwareUpdater) (Version: 11.6.306.7947 - Lavasoft)
Ad-Aware Browsing Protection (HKLM\...\Ad-Aware Browsing Protection) (Version: 1.0.1.124 - Lavasoft)
AdAwareInstaller (Version: 11.6.306.7947 - Lavasoft) Hidden
AdAwareUpdater (Version: 11.6.306.7947 - Lavasoft) Hidden
Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader X (10.1.4) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.4 - Adobe Systems Incorporated)
ANT Drivers Installer x86 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
AntimalwareEngine (Version: 3.0.98.0 - Lavasoft) Hidden
AntispamEngine (Version: 2.4.2158.0 - Lavasoft) Hidden
Ask Shopping Toolbar (HKLM\...\{4F524A00-6A76-A76A-76A7-A758B70C1B00}) (Version: 12.27.0.136 - APN, LLC) <==== ATTENTION
ATI Catalyst Install Manager (HKLM\...\{4160DC5B-4C56-D0C3-C5FD-F5BDAD3C882B}) (Version: 3.0.641.0 - ATI Technologies, Inc.)
Avast Free Antivirus (HKLM\...\Avast) (Version: 10.2.2215 - AVAST Software)
AvcEngine (Version: 3.10.7820.0 - Lavasoft) Hidden
Avira Antivirus (HKLM\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
ccc-core-static (Version: 2007.0727.2307.39475 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.15 - Piriform)
Defraggler (HKLM\...\Defraggler) (Version: 2.18 - Piriform)
Deinstallation der Arcor Online Software (HKLM\...\{262DA23B-4BAB-463F-B1DC-9B5287CAB5CA}}_is1) (Version: 5.0.0.7 - Vodafone AG & Co. KG)
Elevated Installer (Version: 3.2.29.0 - Garmin Ltd or its subsidiaries) Hidden
EPSON Scan (HKLM\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
EPSON-Handbücher (HKLM\...\{84CECC1B-21EF-41B1-9A91-3E724E5D99D3}) (Version: 1.32.0.0 - SEIKO EPSON CORPORATION)
eSobi v2 (HKLM\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.1.00133 - esobi Inc.)
eSobi v2 (Version: 2.0.1.00133 - esobi Inc.) Hidden
FirewallEngine (Version: 1.6.0.0 - Lavasoft) Hidden
FreeCommander 2009.02a (HKLM\...\FreeCommander_is1) (Version: 2009.02 - Marek Jasinski)
Garmin Express (HKLM\...\{714dc1e5-69a4-4ecd-9552-93397e084298}) (Version: 3.2.29.0 - Garmin Ltd or its subsidiaries)
Garmin Express (Version: 3.2.29.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (Version: 3.2.29.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin USB Drivers (HKLM\...\{ABA5E381-EC46-425C-86C5-5CD15BBFB4BF}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Hama Wireless LAN Adapter (HKLM\...\{E91E8912-769D-42F0-8408-0E329443BABC}) (Version: 10.1.0 - Hama)
Java 8 Update 31 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
LightScribe 1.4.142.1 (Version: 1.4.142.1 - hxxp://www.lightscribe.com) Hidden
MATLAB 6.1 (HKLM\...\Matlab 6.1) (Version: - )
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Access 2003 Runtime (HKLM\...\{901C0407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs (HKLM\...\{90120000-00B2-0409-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}) (Version: 08.05.0822 - Microsoft Corporation)
Mozilla Firefox 37.0.1 (x86 de) (HKLM\...\Mozilla Firefox 37.0.1 (x86 de)) (Version: 37.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyEpson Portal (HKLM\...\MyEpson Portal) (Version: - SEIKO EPSON Corporation)
MyEpson Portal (Version: 1.1.1.0 - SEIKO EPSON CORPORATION) Hidden
NTI CD & DVD-Maker (HKLM\...\InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}) (Version: 7 - NewTech Infosystems)
NTI CD & DVD-Maker (Version: 7 - NewTech Infosystems) Hidden
OnlineThreatsEngine (Version: 2.2.3.0 - Lavasoft) Hidden
PDF24 Creator 2.9.1 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.0.2 - Frank Heindörfer, Philip Chinery)
PhotoShow Deluxe 3 (HKLM\...\PhotoShow Deluxe 3) (Version: 3.0 - Simple Star, Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5449 - Realtek Semiconductor Corp.)
RStudio (HKLM\...\RStudio) (Version: 0.96.122 - RStudio)
Skins (Version: 2007.0727.2307.39475 - ATI) Hidden
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.3.11079 - Skype Technologies S.A.)
Skype™ 7.1 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)
Software Updater (HKLM\...\{E07D7C7B-F424-4EEF-BA17-B2C32BD1C107}) (Version: 4.3.0 - SEIKO EPSON CORPORATION)
Ulead Photo Explorer 8.0 SE Basic (HKLM\...\{D271DAE0-8D68-4C97-8356-A126D48A1D8C}) (Version: 8.0 - Ulead Systems, Inc.)
Visual C++ 2008 x86 Runtime - v9.0.30729.01 (HKLM\...\{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01) (Version: 9.0.30729.01 - Microsoft Corporation)
VLC media player 1.1.9 (HKLM\...\VLC media player) (Version: 1.1.9 - VideoLAN)
Vodafone Mobile Connect Lite (HKLM\...\{79A64F98-1796-4FA2-B5FF-C90F83D8BACD}) (Version: 9.4.3.17550 - Vodafone)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows-Treiberpaket - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
WinRAR (HKLM\...\WinRAR archiver) (Version: - )
XMedia Recode 3.0.9.0 (HKLM\...\XMedia Recode) (Version: 3.0.9.0 - Sebastian Dörfler)
Yahoo! Detect (HKLM\...\YTdetect) (Version: - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points =========================

11-02-2015 14:49:19 Windows Update
25-02-2015 19:04:25 Gerätetreiber-Paketinstallation: EPSON Drucker
25-02-2015 19:06:54 Gerätetreiber-Paketinstallation: EPSON Bildverarbeitungsgeräte
25-02-2015 19:31:08 Installed Epson Event Manager
25-02-2015 19:32:40 Microsoft Visual C++ 2005 Redistributable wird installiert
02-03-2015 15:14:15 Geplanter Prüfpunkt
12-03-2015 23:10:08 Windows Update
15-03-2015 21:15:56 Garmin Express
15-03-2015 21:18:10 Gerätetreiber-Paketinstallation: Silicon Labs Software USB-Controller
15-03-2015 21:18:24 Gerätetreiber-Paketinstallation: Dynastream Innovations, Inc.
15-03-2015 21:25:45 Gerätetreiber-Paketinstallation: Garmin
12-04-2015 19:57:36 AA11
12-04-2015 20:00:18 Removed Ad-Aware Email Scanner for Outlook
12-04-2015 20:47:43 AA11
14-04-2015 21:26:23 Gerätetreiber-Paketinstallation: EPSON Bildverarbeitungsgeräte
15-04-2015 17:14:00 Windows Update
16-04-2015 20:54:30 Gerätetreiber-Paketinstallation: EPSON Bildverarbeitungsgeräte
17-04-2015 21:21:06 Removed Epson Event Manager
17-04-2015 21:24:54 Removed EPSON-Handbücher
17-04-2015 21:34:21 Gerätetreiber-Paketinstallation: EPSON Bildverarbeitungsgeräte
17-04-2015 21:50:53 avast! antivirus system restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {01F873FD-DBFC-4914-A78E-3EA27EE57B72} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-04-17] (Avast Software s.r.o.)
Task: {0FFB412A-789D-41F7-A020-22BED43C2CDE} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - PC => C:\Program Files\Windows Calendar\wincal.exe [2009-04-11] (Microsoft Corporation)
Task: {5E11F64D-FA3F-4F2E-ACDF-A5B6EA87FB70} - System32\Tasks\{C6CF873A-5216-48DE-9610-54255BB498AA} => Firefox.exe hxxp://ui.skype.com/ui/0/5.3.0.111/en/abandoninstall?page=tsMain&amp;installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chromeffered-installed;madedefault
Task: {6E26C868-244B-42AA-B7DB-7A74943D9A80} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-24] (Google Inc.)
Task: {757ECA8F-1DC6-41C0-8466-ADC6EB871090} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-24] (Google Inc.)
Task: {8292E78D-0D56-4BC6-B44F-FA7D0DE28784} - System32\Tasks\Ad-Aware Update (Weekly) => C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
Task: {99E66413-1514-444E-A589-4C5EE4C1F729} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-06-24] (Piriform Ltd)
Task: {CF7E7F1E-8DEC-4C65-8CAB-142ED37912F9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-09] (Adobe Systems Incorporated)
Task: {DBB515A2-3C3F-44EA-923E-9C5DCCDC23F0} - System32\Tasks\{C071448A-256F-42A6-A988-451B0C71FB44} => C:\Program Files\Skype\Phone\Skype.exe [2015-01-23] (Skype Technologies S.A.)
Task: {DBD8FFD0-8265-4BB5-827C-F7E02D5F3D58} - System32\Tasks\EPSON XP-225 Series Update {1998D3F2-57DE-4F62-A20D-6554C0D76ED6} => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_TTSNFE.EXE [2013-11-21] (SEIKO EPSON CORPORATION)
Task: {F16221F9-80CF-4CFF-A71B-18B955868D5F} - System32\Tasks\{BAFC7D74-7200-4171-BB8B-C5E19AD6C87D} => Firefox.exe hxxp://ui.skype.com/ui/0/7.2.0.103/de/abandoninstall?page=tsMain
Task: {FFB0C5E0-8051-47B2-891C-317D3CBB27D6} - System32\Tasks\GarminUpdaterTask => C:\Program Files\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2015-01-28] ()

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Ad-Aware Update (Weekly).job => C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\EPSON XP-225 Series Update {1998D3F2-57DE-4F62-A20D-6554C0D76ED6}.job => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_TTSNFE.EXE:/EXE:{1998D3F2-57DE-4F62-A20D-6554C0D76ED6} /F:UpdateSYSTEM

Searches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2007-02-06 23:52 - 2007-02-06 23:52 - 00063488 _____ () C:\Windows\system32\ShowErrMsg.dll
2007-02-06 23:56 - 2007-02-06 23:56 - 00028672 _____ () C:\Windows\system32\BatchCrypto.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 02563592 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareShellExtension.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 02423264 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\RCF.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00110104 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_filesystem-vc100-mt-1_57.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00022032 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_system-vc100-mt-1_57.dll
2010-04-28 00:03 - 2009-08-16 17:06 - 00141312 _____ () C:\Program Files\WinRAR\rarext.dll
2007-05-07 01:07 - 2007-01-24 10:27 - 00319488 _____ () C:\Acer\Empowering Technology\SysMonitor.exe
2010-12-05 12:50 - 2009-04-11 08:28 - 00368640 _____ () C:\Windows\system32\msjetoledb40.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 08216048 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareTray.exe
2015-03-10 18:49 - 2015-03-10 18:49 - 00048152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_date_time-vc100-mt-1_57.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00090128 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_thread-vc100-mt-1_57.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00029712 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_chrono-vc100-mt-1_57.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00405520 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_locale-vc100-mt-1_57.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 01632248 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\HtmlFramework.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00870408 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareTrayDefaultSkin.dll
2015-04-17 21:52 - 2015-04-17 21:52 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-04-17 21:52 - 2015-04-17 21:52 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-04-17 21:52 - 2015-04-17 21:52 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2007-05-07 01:11 - 2007-04-04 18:54 - 00200812 _____ () C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
2007-05-07 01:07 - 2007-01-24 10:27 - 00057344 _____ () C:\Acer\Empowering Technology\Acer.Empowering.Framework.DialogManager.dll
2007-05-07 01:07 - 2007-01-24 10:27 - 00024576 _____ () C:\Acer\Empowering Technology\Acer.Empowering.Framework.PasswordSetting.dll
2010-04-23 09:19 - 2007-01-31 18:18 - 00016384 _____ () C:\Acer\Empowering Technology\eRecovery\ServiceInterface.dll
2007-05-07 01:08 - 2006-12-29 17:51 - 00045056 _____ () C:\Acer\Empowering Technology\ePerformance\ePerformance.Plugin.dll
2007-05-07 01:08 - 2006-12-29 17:51 - 00024576 _____ () C:\Acer\Empowering Technology\ePerformance\ePerformance.Presenter.dll
2007-05-07 01:08 - 2006-12-29 17:51 - 00020480 _____ () C:\Acer\Empowering Technology\ePerformance\ePerformance.Model.Interface.dll
2007-05-07 01:08 - 2006-12-29 17:51 - 00028672 _____ () C:\Acer\Empowering Technology\ePerformance\ePerformance.Model.dll
2007-05-07 01:08 - 2006-12-29 17:51 - 00040960 _____ () C:\Acer\Empowering Technology\ePerformance\ePerformance.Library.dll
2007-05-07 01:08 - 2006-12-29 17:51 - 00016384 _____ () C:\Acer\Empowering Technology\MemCheck.Interface.dll
2007-05-07 01:08 - 2006-12-29 17:52 - 00003584 _____ () C:\Acer\Empowering Technology\ePerformance\de\ePerformance.Plugin.resources.dll
2007-05-07 01:08 - 2006-12-29 17:51 - 00028672 _____ () C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
2007-05-07 01:08 - 2006-12-29 17:51 - 00016384 _____ () C:\Acer\Empowering Technology\ePerformance\MemCheck.Interface.dll
2015-03-10 18:47 - 2015-03-10 18:47 - 00670808 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareService.exe
2015-03-10 18:49 - 2015-03-10 18:49 - 10575360 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareServiceKernel.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00634896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_regex-vc100-mt-1_57.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00592896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareActivation.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00415760 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareApplicationUpdater.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00640512 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareGamingMode.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00087536 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareReset.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00104944 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareTime.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00770064 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareDefinitionsUpdater.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00692768 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareDefinitionsUpdaterScheduler.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00866304 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareIgnoreList.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00217600 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareQuarantine.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00806408 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareAntiMalwareEngine.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00182280 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareAntiRootkitEngine.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00873480 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareScannerHistory.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 01019896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareScanner.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00030224 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_timer-vc100-mt-1_57.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00769544 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareScannerScheduler.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00897040 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareRealTimeProtection.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00194048 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareIncompatibles.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00711672 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareAntiSpam.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00677376 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareAntiPhishing.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 02370056 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareParentalControl.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 02667008 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareWebProtection.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 01013768 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareEmailProtection.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00046616 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\boost_iostreams-vc100-mt-1_57.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00998408 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareNetworkProtection.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00766960 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwarePromo.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00304632 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareFeedback.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 02125840 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareThreatWorkAlliance.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00973304 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwarePinCode.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00767480 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareNotice.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00767480 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareAvcEngine.dll
2015-03-10 18:49 - 2015-03-10 18:49 - 00928280 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.6.306.7947\AdAwareRealTimeProtectionHistory.dll
2015-04-12 20:51 - 2015-01-06 12:47 - 00135288 _____ () C:\Windows\system32\bdfwcore.dll
2015-04-12 20:51 - 2015-04-20 16:27 - 00681712 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Online Threats Engine\2.2.3.0\definitions\loc2\ashttpbr.mdl
2015-04-12 20:51 - 2015-04-20 16:27 - 00602384 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Online Threats Engine\2.2.3.0\definitions\loc2\ashttpdsp.mdl
2015-04-12 20:51 - 2015-04-20 16:27 - 02206600 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Online Threats Engine\2.2.3.0\definitions\loc2\ashttpph.mdl
2015-04-12 20:51 - 2015-04-20 16:27 - 01130280 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Online Threats Engine\2.2.3.0\definitions\loc2\ashttprbl.mdl
2007-05-07 01:12 - 2007-04-09 18:29 - 00143360 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2010-04-23 09:19 - 2007-01-31 18:18 - 00016384 _____ () C:\Acer\Empowering Technology\eRecovery\IERYETF.dll
2010-04-23 09:19 - 2006-12-14 16:00 - 00081920 _____ () C:\Acer\Empowering Technology\eRecovery\INT15.dll
2010-04-23 16:53 - 2007-07-27 23:26 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll
2015-04-21 19:14 - 2015-04-21 19:14 - 00050477 _____ () C:\Users\PC\Downloads\Defogger.exe

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1859551519-956376940-1599385416-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\PC\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-1859551519-956376940-1599385416-500 - Administrator - Disabled)
Gast (S-1-5-21-1859551519-956376940-1599385416-501 - Limited - Disabled)
PC (S-1-5-21-1859551519-956376940-1599385416-1000 - Administrator - Enabled) => C:\Users\PC

==================== Faulty Device Manager Devices =============

Name: PS/2-kompatible Maus
Description: PS/2-kompatible Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/21/2015 07:03:19 PM) (Source: Microsoft-Windows-SpoolerSpoolss) (EventID: 1031) (User: NT-AUTORITÄT)
Description: 0x80072afb

Error: (04/21/2015 07:01:18 PM) (Source: Microsoft-Windows-SpoolerSpoolss) (EventID: 1031) (User: NT-AUTORITÄT)
Description: 0x80072afb

Error: (04/21/2015 07:01:07 PM) (Source: matlabserver) (EventID: 0) (User: )
Description: matlabserver error: 0Engine wait timeout 180 reached for instance 0.

Error: (04/21/2015 06:58:12 PM) (Source: VMCService) (EventID: 0) (User: )
Description: conflictManagerTypeValue

Error: (04/21/2015 06:58:05 PM) (Source: matlabserver) (EventID: 0) (User: )
Description: matlabserver error: 0EngOpen() WORKER_THREAD_PROC failed.

Error: (04/21/2015 06:57:04 PM) (Source: Microsoft-Windows-SpoolerSpoolss) (EventID: 1031) (User: NT-AUTORITÄT)
Description: 0x80072afb

Error: (04/21/2015 06:44:10 PM) (Source: matlabserver) (EventID: 0) (User: )
Description: matlabserver error: 0Engine wait timeout 180 reached for instance 0.

Error: (04/21/2015 06:41:11 PM) (Source: VMCService) (EventID: 0) (User: )
Description: conflictManagerTypeValue

Error: (04/21/2015 06:41:08 PM) (Source: matlabserver) (EventID: 0) (User: )
Description: matlabserver error: 0EngOpen() WORKER_THREAD_PROC failed.

Error: (04/21/2015 06:40:05 PM) (Source: Microsoft-Windows-SpoolerSpoolss) (EventID: 1031) (User: NT-AUTORITÄT)
Description: 0x80072afb


System errors:
=============
Error: (04/21/2015 07:04:50 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: 1Neustart des DienstsRAS-Verbindungsverwaltung%%1056

Error: (04/21/2015 07:04:50 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: 1Neustart des DienstsWindows-Verwaltungsinstrumentation%%1056

Error: (04/21/2015 07:01:19 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Druckwarteschlange2600001Neustart des Diensts

Error: (04/21/2015 07:01:09 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Avast Antivirus3

Error: (04/21/2015 07:01:09 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: MATLAB Server1

Error: (04/21/2015 07:00:58 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Avast Antivirus250001Neustart des Diensts

Error: (04/21/2015 06:59:47 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Avast Antivirus150001Neustart des Diensts

Error: (04/21/2015 06:59:41 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Lbd

Error: (04/21/2015 06:59:38 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Druckwarteschlange1600001Neustart des Diensts

Error: (04/21/2015 06:58:22 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Garmin Core Update Service%%1053


Microsoft Office Sessions:
=========================
Error: (12/02/2010 08:00:58 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 44 seconds with 0 seconds of active time. This session ended with a crash.

Error: (12/02/2010 07:53:19 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 531 seconds with 180 seconds of active time. This session ended with a crash.


==================== Memory info ===========================

Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 6000+
Percentage of memory in use: 60%
Total physical RAM: 3326.58 MB
Available physical RAM: 1327.68 MB
Total Pagefile: 6887.15 MB
Available Pagefile: 4569.57 MB
Total Virtual: 2047.88 MB
Available Virtual: 1881.86 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:229.13 GB) (Free:142.6 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:228.82 GB) (Free:195.86 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: A9E4F6A8)
Partition 1: (Not Active) - (Size=7.8 GB) - (Type=27)
Partition 2: (Active) - (Size=229.1 GB) - (Type=06)
Partition 3: (Not Active) - (Size=228.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Ja wer sagts denn, ob das mit GMER auch klappt
Also ich habe die Logdate auf dem Desktop gespeichert, sie läßt sich aber nicht hierhin kopieren wie das mit den anderen geklappt hat. Ich bekomme die meldung: Diese Datei kann nicht geöffnet werden ....usw.
Jetzt hoffe ich, Ihr könnt damit schon mal was anfangen

Schönen Abend noch.

Gruß mannivo

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.


Bitte beachte folgende Hinweise:

• Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
• Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
• Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo. Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
• Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
• Bitte beachten: Download bei filepony.de: So ladet Ihr unsere Tools richtig!
• Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!

Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke aauf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Danke für deine Mitarbeit!






Mehrere Anti-Virus-Programme

Avast
Ad-Aware Antivirus
Avira
         

Mir ist aufgefallen, dass Du mehr als ein Anti-Virus-Programm mit Hintergrundwächter laufen hast. Das ist gefährlich, da sich die Programme in die Quere kommen können und dadurch Viren erst recht auf dem Rechner landen können. Ausserdem bremst es auch das System aus. Entscheide Dich für eine Variante und deinstalliere die anderen über Systemsteuerung => Software.
Berichte, für welches Anti-Virus-Programm Du Dich entschieden hast.

Speedy hat letztens eine einleuchtende Erklärung dazu geliefert: "Man stelle sich einen Torwart vor, der das Tor hüten soll (Anti-Virus-Programm), der Ball kommt angeflogen (Virus), der Torhüter konzentriert sich auf den Ball und fängt ihn. Jetzt stelle Dir zwei Torhüter im Tor vor ...., die knallen aneinander und der Ball kann ungehindert ins Tor wandern."

Zukünftig bitte beachten:

Running from C:\Users\PC\Downloads

Leider hast du unsere Anleitung nicht richtig befolgt:
Bitte alle Tools direkt auf den Desktop downloaden bzw. dorthin verschieben und vom Desktop starten, da unsere Anleitungen daraufhin ausgelegt sind.
Zudem lassen sich dann am Ende der Bereinigung alle verwendeten Tools sehr einfach entfernen.
Alle Tools bis zum Ende der Bereinigung auf dem Desktop lassen, evtl. benötigen wir manche öfter.





Nachdem du zwei AV-Programme deinstalliert hast, bitte TDSS-Killer ausführen:

Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop

• Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
• Drücke Start Scan
  
• Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
  TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
  Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

[CODE]22:34:12.0482 0x1250 TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
22:34:16.0533 0x1250 ============================================================
22:34:16.0533 0x1250 Current date / time: 2015/04/21 22:34:16.0533
22:34:16.0533 0x1250 SystemInfo:
22:34:16.0533 0x1250
22:34:16.0533 0x1250 OS Version: 6.0.6002 ServicePack: 2.0
22:34:16.0533 0x1250 Product type: Workstation
22:34:16.0533 0x1250 ComputerName: PC-PC
22:34:16.0533 0x1250 UserName: PC
22:34:16.0533 0x1250 Windows directory: C:\Windows
22:34:16.0533 0x1250 System windows directory: C:\Windows
22:34:16.0533 0x1250 Processor architecture: Intel x86
22:34:16.0533 0x1250 Number of processors: 2
22:34:16.0533 0x1250 Page size: 0x1000
22:34:16.0533 0x1250 Boot type: Normal boot
22:34:16.0533 0x1250 ============================================================
22:34:17.0564 0x1250 KLMD registered as C:\Windows\system32\drivers\84759581.sys
22:34:17.0713 0x1250 System UUID: {EC0EB9A6-05A3-B455-1D11-8AE7FD6DDE44}
22:34:18.0283 0x1250 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 ( 465.76 Gb ), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
22:34:18.0298 0x1250 ============================================================
22:34:18.0298 0x1250 \Device\Harddisk0\DR0:
22:34:18.0301 0x1250 MBR partitions:
22:34:18.0301 0x1250 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x6, StartLBA 0xF9CA3B, BlocksNum 0x1CA42817
22:34:18.0301 0x1250 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1D9DF252, BlocksNum 0x1C9A59EF
22:34:18.0301 0x1250 ============================================================
22:34:18.0337 0x1250 C: <-> \Device\Harddisk0\DR0\Partition1
22:34:18.0443 0x1250 D: <-> \Device\Harddisk0\DR0\Partition2
22:34:18.0443 0x1250 ============================================================
22:34:18.0443 0x1250 Initialize success
22:34:18.0443 0x1250 ============================================================
22:34:37.0594 0x1354 ============================================================
22:34:37.0594 0x1354 Scan started
22:34:37.0594 0x1354 Mode: Manual; SigCheck; TDLFS;
22:34:37.0594 0x1354 ============================================================
22:34:37.0594 0x1354 KSN ping started
22:34:37.0725 0x1354 KSN ping finished: true
22:34:38.0506 0x1354 ================ Scan system memory ========================
22:34:38.0506 0x1354 System memory - ok
22:34:38.0506 0x1354 ================ Scan services =============================
22:34:38.0670 0x1354 [ A5F948A07B69401683BD809EEA3DC34B, ECBC4783919C2B4F2C24DB45B5799A95A19622FBB6B39C6CB6FE75BD779A9BD0 ] Acer HomeMedia Connect Service C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
22:34:38.0890 0x1354 Acer HomeMedia Connect Service - detected UnsignedFile.Multi.Generic ( 1 )
22:34:39.0234 0x1354 Detect skipped due to KSN trusted
22:34:39.0234 0x1354 Acer HomeMedia Connect Service - ok
22:34:39.0297 0x1354 [ 509980831739ED65E173EC6CAB056B5B, EF2DDB9E124AA11E9803DFE4F6677EBEA0C70CA4D076FA7310ACB3DDEEF6C643 ] AcerMemUsageCheckService C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
22:34:39.0361 0x1354 AcerMemUsageCheckService - detected UnsignedFile.Multi.Generic ( 1 )
22:34:39.0585 0x1354 Detect skipped due to KSN trusted
22:34:39.0585 0x1354 AcerMemUsageCheckService - ok
22:34:39.0756 0x1354 [ 82B296AE1892FE3DBEE00C9CF92F8AC7, 54B22BA63E1DA616B546992141B0C3117BA057283B8F60CB9BECE203661FEBF3 ] ACPI C:\Windows\system32\drivers\acpi.sys
22:34:39.0792 0x1354 ACPI - ok
22:34:39.0921 0x1354 [ D19C4EE2AC7C47B8F5F84FFF1A789D8A, F419E159D3E428A3929A1A983142E7B0783D3F104EE9587585418E51011E4B8F ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
22:34:39.0931 0x1354 AdobeARMservice - ok
22:34:40.0009 0x1354 [ 080255CDCB878813B481B8C348D47D8E, 75808821FBC732D0504795B8F85852E4C01D3B412989A1E597E1295CFF7B7A45 ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
22:34:40.0025 0x1354 AdobeFlashPlayerUpdateSvc - ok
22:34:40.0078 0x1354 [ 2EDC5BBAC6C651ECE337BDE8ED97C9FB, 0342700760874683A6DF4F149DACACEF0569D40C45FC5958C67100B3C5D9BBBC ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
22:34:40.0112 0x1354 adp94xx - ok
22:34:40.0136 0x1354 [ B84088CA3CDCA97DA44A984C6CE1CCAD, 87009809FB101BF51483FA32318CBCD209386582880C82417BE4FFAD1B04C8C1 ] adpahci C:\Windows\system32\drivers\adpahci.sys
22:34:40.0164 0x1354 adpahci - ok
22:34:40.0183 0x1354 [ 7880C67BCCC27C86FD05AA2AFB5EA469, C8B06E203EEA6EAD19651F212432005ABADFF21E2AA5699E34040527394F2677 ] adpu160m C:\Windows\system32\drivers\adpu160m.sys
22:34:40.0204 0x1354 adpu160m - ok
22:34:40.0216 0x1354 [ 9AE713F8E30EFC2ABCCD84904333DF4D, B0C7801AC6E0811C38F0474703F34283914C8873D851F59EE232834F7C0D8087 ] adpu320 C:\Windows\system32\drivers\adpu320.sys
22:34:40.0239 0x1354 adpu320 - ok
22:34:40.0283 0x1354 [ 9D1FDA9E086BA64E3C93C9DE32461BCF, 200FD0BFC811EC8993AF9FC78F58823ECC717063F438B627FBCDD6BD7790CAA8 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
22:34:40.0373 0x1354 AeLookupSvc - ok
22:34:40.0441 0x1354 [ F5272A105F59A7B3B345D9D6D87DA7AD, 9E84776994D04240BF2537330DBB555EDE16DFCFC59DEDCBA05A44ED7F70BEFA ] AFD C:\Windows\system32\drivers\afd.sys
22:34:40.0557 0x1354 AFD - ok
22:34:40.0596 0x1354 [ EF23439CDD587F64C2C1B8825CEAD7D8, 762665CFC202B3E16CA2338887896FDF996331A363DC709F1EC088BF927133A3 ] agp440 C:\Windows\system32\drivers\agp440.sys
22:34:40.0614 0x1354 agp440 - ok
22:34:40.0685 0x1354 [ AE1FDF7BF7BB6C6A70F67699D880592A, B831BF156FC49287A19FC149383D437B1034EA6F42CE9D761EB90ABD0F8D96B1 ] aic78xx C:\Windows\system32\drivers\djsvs.sys
22:34:40.0712 0x1354 aic78xx - ok
22:34:40.0730 0x1354 [ A1545B731579895D8CC44FC0481C1192, 6B0EE833BA39C142D625A03586CCD8F6C9C3136C603CE5DF5BAC1AA3423E3E7F ] ALG C:\Windows\System32\alg.exe
22:34:40.0772 0x1354 ALG - ok
22:34:40.0793 0x1354 [ 90395B64600EBB4552E26E178C94B2E4, 73095893964DC7915983B58A567184FC51949C99341E7E0D04D70CC4C4F95E37 ] aliide C:\Windows\system32\drivers\aliide.sys
22:34:40.0807 0x1354 aliide - ok
22:34:40.0841 0x1354 [ 2B13E304C9DFDFA5EB582F6A149FA2C7, 196CCE13E0376526B79D9C43D4071990576C4DD210A48E9E922B438AA11C95E7 ] amdagp C:\Windows\system32\drivers\amdagp.sys
22:34:40.0859 0x1354 amdagp - ok
22:34:40.0873 0x1354 [ 0577DF1D323FE75A739C787893D300EA, 079EF3CA18FB847DB7E62929071BFF007FAF390E1DBF4C59F28DAAC6B9C2DE51 ] amdide C:\Windows\system32\drivers\amdide.sys
22:34:40.0907 0x1354 amdide - ok
22:34:40.0948 0x1354 [ DC487885BCEF9F28EECE6FAC0E5DDFC5, 24A62F6E628AD46273BC226F7BC3453A9C7B76F81ABB9FB801EBEFADB2AB7C9B ] AmdK7 C:\Windows\system32\drivers\amdk7.sys
22:34:41.0016 0x1354 AmdK7 - ok
22:34:41.0050 0x1354 [ 93AE7F7DD54AB986A6F1A1B37BE7442D, ECE0ABA2DECEED94AC678240A4B604F04022F0740F2295CBD07D25F5917E878A ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
22:34:41.0103 0x1354 AmdK8 - ok
22:34:41.0592 0x1354 [ 6A7BE5D0E66B8121E60EFAD57EB04963, 96EC128BC06E7ED7485D52DD52F8A71FEBD9633415DD8486BDBCC499ED32A0F8 ] AntiVirMailService C:\Program Files\Avira\Antivirus\avmailc.exe
22:34:41.0626 0x1354 AntiVirMailService - ok
22:34:41.0692 0x1354 [ F36D18EF1E66F92094AD89D17BEF007C, A5C793B340311CB7A301B77316E1976E3CD7CA9470CE5F1062CB003BCD4C155C ] AntiVirSchedulerService C:\Program Files\Avira\Antivirus\sched.exe
22:34:41.0713 0x1354 AntiVirSchedulerService - ok
22:34:41.0764 0x1354 [ F36D18EF1E66F92094AD89D17BEF007C, A5C793B340311CB7A301B77316E1976E3CD7CA9470CE5F1062CB003BCD4C155C ] AntiVirService C:\Program Files\Avira\Antivirus\avguard.exe
22:34:41.0784 0x1354 AntiVirService - ok
22:34:41.0847 0x1354 [ EE5FE075D14EABEA9938C812F644371D, 609B7F43784615F5A5FA67F339FFEE84F5F37AFFE88D83B11B338720878412F5 ] AntiVirWebService C:\Program Files\Avira\Antivirus\AVWEBGRD.EXE
22:34:41.0886 0x1354 AntiVirWebService - ok
22:34:42.0004 0x1354 [ 57DDF16B08A72B0136E07691F9732287, 6E4386CB9E5084BC09C84AE695A5F6B8CDD6ECFF0C5E03D5162B37031A41D501 ] APNMCP C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
22:34:42.0018 0x1354 APNMCP - ok
22:34:42.0064 0x1354 [ 8F7D200717A58E9800D391F4C2101577, F07CF0F5636F46D8F3D5133284943E991E8739E5A644BCA5F18BB896B374620D ] Appinfo C:\Windows\System32\appinfo.dll
22:34:42.0125 0x1354 Appinfo - ok
22:34:42.0144 0x1354 [ 5F673180268BB1FDB69C99B6619FE379, C4307A861163F96648109046A6C7D53AB1C9B10D0B841DD1A7D147D22F462649 ] arc C:\Windows\system32\drivers\arc.sys
22:34:42.0163 0x1354 arc - ok
22:34:42.0199 0x1354 [ 957F7540B5E7F602E44648C7DE5A1C05, F03C7708A6C9D2579ECE5A7413AFA068E1067D7191EC653A78BA4FEDE76CFBD8 ] arcsas C:\Windows\system32\drivers\arcsas.sys
22:34:42.0218 0x1354 arcsas - ok
22:34:42.0572 0x1354 [ 9D768C43FEF254DD50B1DBF8AD5C4C0B, A50854EA5C08605133B8BB4DFDC6090357C5665314AA72E0BFA1E07D4E451F09 ] aspnet_state C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
22:34:42.0602 0x1354 aspnet_state - ok
22:34:42.0650 0x1354 [ 53B202ABEE6455406254444303E87BE1, 4C91CA8DD345FEDD74A6AF2C07580717703F979B7DE2532B1D00B9F6896DDE70 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
22:34:42.0701 0x1354 AsyncMac - ok
22:34:42.0735 0x1354 [ 1F05B78AB91C9075565A9D8A4B880BC4, 737BE9F9376DAB0CCDFED93EA6D67F0C432367EA63CD772A453485BE769AF3BD ] atapi C:\Windows\system32\drivers\atapi.sys
22:34:42.0745 0x1354 atapi - ok
22:34:42.0854 0x1354 [ 581B9BE9E92A0F3856CC85EC011EDC6F, 45264D67388DD37E3880E02EB305065B12C1166C0FFAFC8B3BCC08A5CAD84AE7 ] Ati External Event Utility C:\Windows\system32\Ati2evxx.exe
22:34:42.0895 0x1354 Ati External Event Utility - ok
22:34:43.0146 0x1354 [ 22D300F835600C9C634860CF2912F9CF, B60C10B003A0F4BCDD0C4F5BE257857CD7C92E50BC60090D17EEBD419F125BF1 ] atikmdag C:\Windows\system32\DRIVERS\atikmdag.sys
22:34:43.0300 0x1354 atikmdag - ok
22:34:43.0350 0x1354 [ A356E45E8432432C06981EA63A1E0FE8, 98F3BE1023678173B1F2E5788E03F012BD31FE204EABBD7C19AF34620CCEB423 ] AtiPcie C:\Windows\system32\DRIVERS\AtiPcie.sys
22:34:43.0403 0x1354 AtiPcie - ok
22:34:43.0487 0x1354 [ 8E98A99187FF17FC1D48E6FAFFD870BE, 7C935191A0A2BA95CA9A9E450F7C8802E6184F73BC297E91908B59F34C22AB06 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
22:34:43.0539 0x1354 AudioEndpointBuilder - ok
22:34:43.0551 0x1354 [ 8E98A99187FF17FC1D48E6FAFFD870BE, 7C935191A0A2BA95CA9A9E450F7C8802E6184F73BC297E91908B59F34C22AB06 ] Audiosrv C:\Windows\System32\Audiosrv.dll
22:34:43.0570 0x1354 Audiosrv - ok
22:34:43.0592 0x1354 avchv - ok
22:34:43.0630 0x1354 [ AF5DA81B19AFA730F1E5246AD81D140A, 532951071F56896A3B5D47874C14D996C8620EA02F87D4BA21B083EC804FB166 ] avgntflt C:\Windows\system32\DRIVERS\avgntflt.sys
22:34:43.0654 0x1354 avgntflt - ok
22:34:43.0693 0x1354 [ A5674637BCA212D9FE136ADFA04C9857, 95F3632EBB041C539816D285EBE1F379D46A4187379C69D4683D9F4DECBDB80C ] avipbb C:\Windows\system32\DRIVERS\avipbb.sys
22:34:43.0716 0x1354 avipbb - ok
22:34:43.0741 0x1354 [ D8C712305F73CD34D1B344810E522728, 49A474FF6CA44E8427D7A8290B47395125B0148AF384CF2B3B1FA495A4718CBA ] avkmgr C:\Windows\system32\DRIVERS\avkmgr.sys
22:34:43.0759 0x1354 avkmgr - ok
22:34:43.0822 0x1354 [ 67E506B75BD5326A3EC7B70BD014DFB6, 3B07243970CAB4E93A858BEA6E31F56AD0157C42D624F3FEB469E68EEEF65669 ] Beep C:\Windows\system32\drivers\Beep.sys
22:34:43.0882 0x1354 Beep - ok
22:34:43.0935 0x1354 [ C789AF0F724FDA5852FB9A7D3A432381, 4B0F7A3A8F2D45E49630D24F2630B8014BCDB793B9C6E83FD2B2863A54F62BF5 ] BFE C:\Windows\System32\bfe.dll
22:34:43.0971 0x1354 BFE - ok
22:34:44.0041 0x1354 [ 93952506C6D67330367F7E7934B6A02F, 1D9A6B10B9489C1A32F730E22CC399BFF0796E3FCB3BA52BE45ED487CAC59EBD ] BITS C:\Windows\System32\qmgr.dll
22:34:44.0088 0x1354 BITS - ok
22:34:44.0096 0x1354 blbdrive - ok
22:34:44.0144 0x1354 [ D002033C1A37F6AF51B5F0BA6D0211BC, 8D280487B341746DF6FAB9CBA651034D84802D1F10B3F0A70E6818295DA40CD1 ] BMLoad C:\Windows\system32\drivers\BMLoad.sys
22:34:44.0171 0x1354 BMLoad - detected UnsignedFile.Multi.Generic ( 1 )
22:34:44.0423 0x1354 Detect skipped due to KSN trusted
22:34:44.0423 0x1354 BMLoad - ok
22:34:44.0454 0x1354 [ 35F376253F687BDE63976CCB3F2108CA, C5EF6301D7BC067050038DB75D961681D1CBE418285AD60167C1334B0B54DFE9 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
22:34:44.0497 0x1354 bowser - ok
22:34:44.0539 0x1354 [ 9F9ACC7F7CCDE8A15C282D3F88B43309, A9131334BD9CF8FD60BA9D54AA054E2DF2BE1219FB650DF1464F2787BDEAE98F ] BrFiltLo C:\Windows\system32\drivers\brfiltlo.sys
22:34:44.0574 0x1354 BrFiltLo - ok
22:34:44.0598 0x1354 [ 56801AD62213A41F6497F96DEE83755A, 0DEB8318FB47DF6473C171C795C735E26A73FA12232876C6856549EA16F33361 ] BrFiltUp C:\Windows\system32\drivers\brfiltup.sys
22:34:44.0641 0x1354 BrFiltUp - ok
22:34:44.0669 0x1354 [ A3629A0C4226F9E9C72FAAEEBC3AD33C, FB4D2738B64AADA52B95A6CF7ED4CDBFE4DD4BEBCAF1AE9CE64317F97DB38DDF ] Browser C:\Windows\System32\browser.dll
22:34:44.0708 0x1354 Browser - ok
22:34:44.0742 0x1354 [ B304E75CFF293029EDDF094246747113, CB6B219B186C3511A0DE3CDE7F7B8966A9E32D808A952CA8C5B42B3A3A17BFB0 ] Brserid C:\Windows\system32\drivers\brserid.sys
22:34:44.0798 0x1354 Brserid - ok
22:34:44.0841 0x1354 [ 203F0B1E73ADADBBB7B7B1FABD901F6B, 782FA7B26940FE479C49C9BAA2EB582CDAAAD607013E9BCFC85E6FBBB7D49A6D ] BrSerWdm C:\Windows\system32\drivers\brserwdm.sys
22:34:44.0908 0x1354 BrSerWdm - ok
22:34:44.0933 0x1354 [ BD456606156BA17E60A04E18016AE54B, DFBDC9DA6A3EA40BACFF204BC6C55C2C122B5885D2CBF6D45054DE43EE15EC4D ] BrUsbMdm C:\Windows\system32\drivers\brusbmdm.sys
22:34:44.0993 0x1354 BrUsbMdm - ok
22:34:45.0013 0x1354 [ AF72ED54503F717A43268B3CC5FAEC2E, 4A638669B0C30B1BDED242A8BF2015A37749570FF4D67D190BACC8D7E0C44468 ] BrUsbSer C:\Windows\system32\drivers\brusbser.sys
22:34:45.0070 0x1354 BrUsbSer - ok
22:34:45.0110 0x1354 [ AD07C1EC6665B8B35741AB91200C6B68, DCE1305A30D6713222A01C1F1D03ED0ADABE23C742CE1E82BB142531B82A3FF7 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
22:34:45.0181 0x1354 BTHMODEM - ok
22:34:45.0227 0x1354 [ 7ADD03E75BEB9E6DD102C3081D29840A, 0CA14A77CE990B5AA32C0725C22CA190ECBC73B75064DD959CABAD79B8846F1D ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
22:34:45.0273 0x1354 cdfs - ok
22:34:45.0314 0x1354 [ 6B4BFFB9BECD728097024276430DB314, 4451EFEAD37B05C8A3CB610B6D72E73B55D3D1E1CC1B17405598C1EDAA93C2D5 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
22:34:45.0358 0x1354 cdrom - ok
22:34:45.0400 0x1354 [ 312EC3E37A0A1F2006534913E37B4423, 81B8F462336791D162DAFA8092C1F437638DA3022CA24A2458B9FE183FC18C5D ] CertPropSvc C:\Windows\System32\certprop.dll
22:34:45.0443 0x1354 CertPropSvc - ok
22:34:45.0473 0x1354 [ DA8E0AFC7BAA226C538EF53AC2F90897, 2BBB9966671A3B8325D215DBC29FBD7D912C13ADC562A0D4521D1FF9A6F445C0 ] circlass C:\Windows\system32\drivers\circlass.sys
22:34:45.0524 0x1354 circlass - ok
22:34:45.0594 0x1354 [ D7659D3B5B92C31E84E53C1431F35132, 6BFE644AD9890A8CEEDCC4B97ADD564AD57202FBC5D21599469E0C4B31BB27C6 ] CLFS C:\Windows\system32\CLFS.sys
22:34:45.0629 0x1354 CLFS - ok
22:34:45.0661 0x1354 [ 6B6943A0CA56B47D6FB2EE476890854F, 6DA779879487F4A187DF54B0362642643D7871AA8F7E30992D781F558C50F052 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
22:34:45.0683 0x1354 clr_optimization_v2.0.50727_32 - ok
22:34:45.0730 0x1354 [ E87213F37A13E2B54391E40934F071D0, 7EB221127EFB5BF158FB03D18EFDA2C55FB6CE3D1A1FE69C01D70DBED02C87E5 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
22:34:45.0745 0x1354 clr_optimization_v4.0.30319_32 - ok
22:34:45.0789 0x1354 [ 45201046C776FFDAF3FC8A0029C581C8, 68A68CF2B76598BC8610EB5B2D3FD5BDC9D51CFC6F51FB7A0B0C92A2BE910FC6 ] cmdide C:\Windows\system32\drivers\cmdide.sys
22:34:45.0808 0x1354 cmdide - ok
22:34:45.0821 0x1354 [ 82B8C91D327CFECF76CB58716F7D4997, 6F06A4BC44B170BB28BF464E9BB5216D39D11CB8D442570B575A741B032EAEE6 ] Compbatt C:\Windows\system32\drivers\compbatt.sys
22:34:45.0838 0x1354 Compbatt - ok
22:34:45.0844 0x1354 COMSysApp - ok
22:34:45.0860 0x1354 [ 2A213AE086BBEC5E937553C7D9A2B22C, 1F91ACC0426E0ED1717555B282F65629EF15021375B24A63C29C89ADE916EE2A ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
22:34:45.0877 0x1354 crcdisk - ok
22:34:45.0918 0x1354 [ 22A7F883508176489F559EE745B5BF5D, D6341E3FBC8A46D2D1F0477FA60EC4828B585D35B14609CD02868FD04ECD14DB ] Crusoe C:\Windows\system32\drivers\crusoe.sys
22:34:45.0977 0x1354 Crusoe - ok
22:34:46.0035 0x1354 [ 684C130BBC6DB681BAD4920A4C944AA5, DDE434B206984808351C98500824A33E6740B4326C455066027F8D549D4C3B92 ] CryptSvc C:\Windows\system32\cryptsvc.dll
22:34:46.0079 0x1354 CryptSvc - ok
22:34:46.0155 0x1354 [ 3B5B4D53FEC14F7476CA29A20CC31AC9, EC02A412DA5FDE2C759A4A2C5904579E1CE7C4999CE87145812F354FC8F5E183 ] DcomLaunch C:\Windows\system32\rpcss.dll
22:34:46.0220 0x1354 DcomLaunch - ok
22:34:46.0264 0x1354 [ 622C41A07CA7E6DD91770F50D532CB6C, 2A9040949CB45F9970FDE930278F30D2F08E957290CB3D4DC4F2CA94F3D444D2 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
22:34:46.0297 0x1354 DfsC - ok
22:34:46.0445 0x1354 [ 2CC3DCFB533A1035B13DCAB6160AB38B, C88C91F662ADE248EEE3B568E70C2BC2D5075B7D9B7D3C63E83D011C5F7812B0 ] DFSR C:\Windows\system32\DFSR.exe
22:34:46.0660 0x1354 DFSR - ok
22:34:46.0735 0x1354 [ 9028559C132146FB75EB7ACF384B086A, 35159D86706441ED94895B4629411B4445FCB4526AFD1F7036EE647931B7A94D ] Dhcp C:\Windows\System32\dhcpcsvc.dll
22:34:46.0776 0x1354 Dhcp - ok
22:34:46.0828 0x1354 [ 5D4AEFC3386920236A548271F8F1AF6A, 11B74D6800EC6F7AAEFB0B6A9F2E8376C7C3B8DB677F03AC3743CB004CA96B08 ] disk C:\Windows\system32\drivers\disk.sys
22:34:46.0846 0x1354 disk - ok
22:34:46.0904 0x1354 [ 57D762F6F5974AF0DA2BE88A3349BAAA, D9E7DC8F9FB7837F88BBB95B52147AA80E688FB9762EEA99B8046D9C6AD48F3C ] Dnscache C:\Windows\System32\dnsrslvr.dll
22:34:46.0954 0x1354 Dnscache - ok
22:34:46.0996 0x1354 [ 324FD74686B1EF5E7C19A8AF49E748F6, DC6EB4304555B60DD17E04D20DFE4E279718E4041A9310DE29E678834BB22C5B ] dot3svc C:\Windows\System32\dot3svc.dll
22:34:47.0036 0x1354 dot3svc - ok
22:34:47.0068 0x1354 [ A622E888F8AA2F6B49E9BC466F0E5DEF, 3DED7F22A29AD2F8C927DFA0FD87FDE5ED0BDCAC7260BD9F71D8EA34328C772A ] DPS C:\Windows\system32\dps.dll
22:34:47.0138 0x1354 DPS - ok
22:34:47.0177 0x1354 [ 97FEF831AB90BEE128C9AF390E243F80, A7F4118603E2D5DDDB117EF7C058684EA5B37690EFAB2BEBA570EEF9C36281BE ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
22:34:47.0226 0x1354 drmkaud - ok
22:34:47.0261 0x1354 [ 5C2C209CDEFBC51D83D66E8A53B2BE89, 7AE68672A6BEEF601017BE28AA0BF3673318EFE97AA08E70F58A9391C54DF71F ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
22:34:47.0301 0x1354 DXGKrnl - ok
22:34:47.0346 0x1354 [ F88FB26547FD2CE6D0A5AF2985892C48, F02E06E16830F5D3FAF61991F5A91E54BB3461F58AFE3BFB7A9066CD302B879F ] E1G60 C:\Windows\system32\DRIVERS\E1G60I32.sys
22:34:47.0392 0x1354 E1G60 - ok
22:34:47.0450 0x1354 [ C0B95E40D85CD807D614E264248A45B9, 30421DAF1722A225222268CB8BA4FE60CB76C6FD0C9157B0F53FC1368F806A4E ] EapHost C:\Windows\System32\eapsvc.dll
22:34:47.0468 0x1354 EapHost - ok
22:34:47.0531 0x1354 [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371, F3E9CF5D8E9124CB06F08454C5F0E510DE19A92780151FB2F8A58A0905D59B8F ] Ecache C:\Windows\system32\drivers\ecache.sys
22:34:47.0567 0x1354 Ecache - ok
22:34:47.0748 0x1354 [ F87DDE13D57062DA8EBA2368667D8130, 0DC9D5C1E0F560037C586233E374743A3CE8EBA2613663D07C3B23E4954DC4CF ] eDataSecurity Service C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
22:34:47.0770 0x1354 eDataSecurity Service - ok
22:34:47.0886 0x1354 [ 9BE3744D295A7701EB425332014F0797, 1A139EE9232581E466591C5EBEF41E4BF1F82D99C1959F1C68C879B240E9F46D ] ehRecvr C:\Windows\ehome\ehRecvr.exe
22:34:47.0909 0x1354 ehRecvr - ok
22:34:47.0947 0x1354 [ AD1870C8E5D6DD340C829E6074BF3C3F, 064D07106A1BBE80294F1913354832F2B67D22274BB4D36C81D2D83C96FE0B88 ] ehSched C:\Windows\ehome\ehsched.exe
22:34:47.0998 0x1354 ehSched - ok
22:34:48.0010 0x1354 [ C27C4EE8926E74AA72EFCAB24C5242C3, F1EBF78CCE9BA76AFD0478BC66B67CA44DEAF3C380369BFCE91BD8F678C8608A ] ehstart C:\Windows\ehome\ehstart.dll
22:34:48.0038 0x1354 ehstart - ok
22:34:48.0089 0x1354 [ E8F3F21A71720C84BCF423B80028359F, 63114E6120F634224A0E83A5047B37C7D6F26CF99FE3C01CFC0AB8B1763BB084 ] elxstor C:\Windows\system32\drivers\elxstor.sys
22:34:48.0118 0x1354 elxstor - ok
22:34:48.0167 0x1354 [ 4E6B23DFC917EA39306B529B773950F4, C4BA77632B4BD46C4C1797F7F57399DB506D3EB6E5A0A36C269A793DAA3445C2 ] EMDMgmt C:\Windows\system32\emdmgmt.dll
22:34:48.0249 0x1354 EMDMgmt - ok
22:34:48.0332 0x1354 [ B538590B338F5379D4B33E266902008B, D73C4152DE0E9D225E29533FC5451D1C4DD344FE66024E6A8122B59ADD1611C8 ] EpsonScanSvc C:\Windows\system32\EscSvc.exe
22:34:48.0347 0x1354 EpsonScanSvc - ok
22:34:48.0411 0x1354 [ A2580C15D2664D18C3E140C7F98B366C, 4FA1B41E670A31397235D862BE6A68E91127EA7A36E3A42A427E34597A1C994B ] eRecoveryService C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
22:34:48.0436 0x1354 eRecoveryService - detected UnsignedFile.Multi.Generic ( 1 )
22:34:48.0795 0x1354 Detect skipped due to KSN trusted
22:34:48.0795 0x1354 eRecoveryService - ok
22:34:48.0844 0x1354 [ 67058C46504BC12D821F38CF99B7B28F, E8D19F305F78BCA1DA8425315F2C77A377CD51E3CC54323DC2FF355120EA097D ] EventSystem C:\Windows\system32\es.dll
22:34:48.0889 0x1354 EventSystem - ok
22:34:48.0934 0x1354 [ 0F40E249E4DD0CE47C7CA19C5C8FB48A, EBF4A9DCEF2913095BDDACC64D02925B30CC1D779D21D31A1C3B59532D1C97E3 ] ewusbnet C:\Windows\system32\DRIVERS\ewusbnet.sys
22:34:48.0983 0x1354 ewusbnet - ok
22:34:49.0032 0x1354 [ 22B408651F9123527BCEE54B4F6C5CAE, 31AF9649333A9496A9224001266D1B68CE2A31B9FB182A755D127FC5492AA6B2 ] exfat C:\Windows\system32\drivers\exfat.sys
22:34:49.0100 0x1354 exfat - ok
22:34:49.0143 0x1354 [ 4E404505B3F62ECFBDBCBBCF0A72DBC5, 9F446ED06A31BFE52C4F1E8ACC400B8E3F47A3CC02FFC950DB861B2B3BA4C5B9 ] fastfat C:\Windows\system32\drivers\fastfat.sys
22:34:49.0204 0x1354 fastfat - ok
22:34:49.0256 0x1354 [ AFE1E8B9782A0DD7FB46BBD88E43F89A, B4CBE1DC3430F2F3485F49007C71293D5B86E9C405741EA00A67B00A38BE1F8D ] fdc C:\Windows\system32\DRIVERS\fdc.sys
22:34:49.0301 0x1354 fdc - ok
22:34:49.0373 0x1354 [ 6629B5F0E98151F4AFDD87567EA32BA3, 8CC02D5E0639CDF74B2F85DB56D6199E1858F1A58465ED1D8B25C968E986132C ] fdPHost C:\Windows\system32\fdPHost.dll
22:34:49.0405 0x1354 fdPHost - ok
22:34:49.0442 0x1354 [ 89ED56DCE8E47AF40892778A5BD31FD2, 924360875796C3DDDDA8097FDF53F6846B227F7413766F00AEDD981EFD691BF9 ] FDResPub C:\Windows\system32\fdrespub.dll
22:34:49.0479 0x1354 FDResPub - ok
22:34:49.0508 0x1354 [ A8C0139A884861E3AAE9CFE73B208A9F, 3B021D148A2989AAA46AE58E5FED8A2DCA25E9212C2FA7F922880EF5A077E49B ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
22:34:49.0527 0x1354 FileInfo - ok
22:34:49.0563 0x1354 [ 0AE429A696AECBC5970E3CF2C62635AE, 1ECC315C099D17835788B68F0DE00EC98DC5AEE8F329D739E0DB90A898F22244 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
22:34:49.0611 0x1354 Filetrace - ok
22:34:49.0647 0x1354 [ 6603957EFF5EC62D25075EA8AC27DE68, B52D112301A6BFBD60959D7D2502AB2E1EB6BB7F5DCED46899F1F006C7F1E887 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
22:34:49.0721 0x1354 flpydisk - ok
22:34:49.0778 0x1354 [ 01334F9EA68E6877C4EF05D3EA8ABB05, 82F8AA6AD2B5077898773D4A5814819EAF0E872FFD95894E06FEDAB6EE92CF99 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
22:34:49.0812 0x1354 FltMgr - ok
22:34:49.0939 0x1354 [ 2AFA3A46986AE935DAECEBC7E66314CF, 747FAF9B7F8291B83EE44B91E5708395E749DC87BD42CC3BF2CD41209C298F4D ] FontCache C:\Windows\system32\FntCache.dll
22:34:50.0084 0x1354 FontCache - ok
22:34:50.0177 0x1354 [ C7FBDD1ED42F82BFA35167A5C9803EA3, 372FF71070D5ECE17342466A690737A0622E93C98DBED8172C49B0854F0012B7 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
22:34:50.0194 0x1354 FontCache3.0.0.0 - ok
22:34:50.0227 0x1354 [ B972A66758577E0BFD1DE0F91AAA27B5, E934034F3F740A83D4E7ABCD2C581845AC2945B0BCCAACF65CC3F99A1DBDE455 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
22:34:50.0263 0x1354 Fs_Rec - ok
22:34:50.0291 0x1354 [ 4E1CD0A45C50A8882616CAE5BF82F3C5, 1B909AF150F7119A5685999451A85012F4A92F15F38390A281EA507E2D247BAE ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
22:34:50.0317 0x1354 gagp30kx - ok
22:34:50.0565 0x1354 [ 12CD74D8F037AE10E03C2415EFF59EF5, EDE7187DC57010119A46730B63EAF1548E3BDC170D375568880478AB36340726 ] Garmin Core Update Service C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
22:34:50.0592 0x1354 Garmin Core Update Service - ok
22:34:50.0674 0x1354 [ CD5D0AEEE35DFD4E986A5AA1500A6E66, DCED5126837292593F1C1B35DF18E3B631D6C0C6D0742B77C7B7742C55A7825F ] gpsvc C:\Windows\System32\gpsvc.dll
22:34:50.0783 0x1354 gpsvc - ok
22:34:50.0828 0x1354 [ CEC45180029F1012054A41CEEEA9CEAB, FCE330FB9E4A9BA0BD1C31D94A5A73034175DB5FF4115009B3B3FFE327E31995 ] grmnusb C:\Windows\system32\drivers\grmnusb.sys
22:34:50.0842 0x1354 grmnusb - ok
22:34:50.0934 0x1354 [ 51508F0C2476177E50C31B0BBFBF1BDB, 3F62A05181D54711180C8727AC66D624AFA7FC816A4ACC4DC0CFCF2D2DBE7F87 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe
22:34:50.0945 0x1354 gupdate - ok
22:34:50.0951 0x1354 [ 51508F0C2476177E50C31B0BBFBF1BDB, 3F62A05181D54711180C8727AC66D624AFA7FC816A4ACC4DC0CFCF2D2DBE7F87 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
22:34:50.0963 0x1354 gupdatem - ok
22:34:50.0996 0x1354 [ 833051C6C6C42117191935F734CFBD97, 5EB5672ABC7994A4AFF855A572158B8BE4FC6E541CFD4B9BE4FF2739A9A6AFB8 ] hamachi C:\Windows\system32\DRIVERS\hamachi.sys
22:34:51.0011 0x1354 hamachi - ok
22:34:51.0062 0x1354 [ 3F90E001369A07243763BD5A523D8722, 25907F85787D879E75C3FE74C93567382AFB2D528BEEC61D71E3A6BE2D71DFBE ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
22:34:51.0106 0x1354 HdAudAddService - ok
22:34:51.0152 0x1354 [ 062452B7FFD68C8C042A6261FE8DFF4A, DD9873502456D3C058C6177AC223B28C71370E624FA0814C17EA3D93201F2B56 ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
22:34:51.0237 0x1354 HDAudBus - ok
22:34:51.0265 0x1354 [ 1338520E78D90154ED6BE8F84DE5FCEB, 8531F1C5856983EBDA4C2B70162645ECE72FFFBA9FE7A28BCEDDF2169B7ECF9D ] HidBth C:\Windows\system32\drivers\hidbth.sys
22:34:51.0334 0x1354 HidBth - ok
22:34:51.0351 0x1354 [ FF3160C3A2445128C5A6D9B076DA519E, DC1A70C80CD55F33B3AD5A21E86AF7C3086D8CC2DC6148C058E74A871E0BAD4A ] HidIr C:\Windows\system32\drivers\hidir.sys
22:34:51.0420 0x1354 HidIr - ok
22:34:51.0467 0x1354 [ 84067081F3318162797385E11A8F0582, 11E32E3800CFCA37354388243F88D0239D622891BAC5483518A2BE5D1CA19015 ] hidserv C:\Windows\system32\hidserv.dll
22:34:51.0481 0x1354 hidserv - ok
22:34:51.0522 0x1354 [ CCA4B519B17E23A00B826C55716809CC, 91AD0758A6185B0FBBE383BDB1B457FFB850477AFF8DE040DE9527A97D28EF62 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
22:34:51.0554 0x1354 HidUsb - ok
22:34:51.0596 0x1354 [ D8AD255B37DA92434C26E4876DB7D418, C901EADDD93FC90C8F29F4B6DE808F8E4F486C877FC0AA27DA4ACDE17E28899D ] hkmsvc C:\Windows\system32\kmsvc.dll
22:34:51.0623 0x1354 hkmsvc - ok
22:34:51.0683 0x1354 [ DF353B401001246853763C4B7AAA6F50, 05C043493BDD99DEFBB0F5C3D8C475B06C2BF5629565ACF6F3B754002519B836 ] HpCISSs C:\Windows\system32\drivers\hpcisss.sys
22:34:51.0723 0x1354 HpCISSs - ok
22:34:51.0852 0x1354 [ F870AA3E254628EBEAFE754108D664DE, B0444E7D246AA1982094030ACB991690F6A7DD3FB07B1BB6A1BC0F3AA9718A70 ] HTTP C:\Windows\system32\drivers\HTTP.sys
22:34:51.0979 0x1354 HTTP - ok
22:34:52.0029 0x1354 [ 92CA47DA32009CCC00A5ADED04ABBD78, 2159A632B9C519D94180A2EED24AB8A91BE8717F0C13BEC916CF4F70E4DB5D47 ] hwdatacard C:\Windows\system32\DRIVERS\ewusbmdm.sys
22:34:52.0088 0x1354 hwdatacard - ok
22:34:52.0112 0x1354 [ 089085538885367E281686762A973EB5, 9D54E822C6A792A838C5620AE88ECBA5657B33589DF071F99E0E97DC277B24EA ] hwusbfake C:\Windows\system32\DRIVERS\ewusbfake.sys
22:34:52.0149 0x1354 hwusbfake - ok
22:34:52.0190 0x1354 [ 324C2152FF2C61ABAE92D09F3CCA4D63, 2D09964C8003277F7DB1FFAA0DAEF15B205F3C4100FF601950BC9E544DC0B91F ] i2omp C:\Windows\system32\drivers\i2omp.sys
22:34:52.0213 0x1354 i2omp - ok
22:34:52.0281 0x1354 [ 22D56C8184586B7A1F6FA60BE5F5A2BD, D96A2962848C1F59B143BFEC22EC48BD1C5A75D0EBCFD7FB965E66B85FF7D8CA ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
22:34:52.0333 0x1354 i8042prt - ok
22:34:52.0364 0x1354 [ C957BF4B5D80B46C5017BF0101E6C906, 6B9186335E50E7E0DBAF574A224E524EC526B57AA02F509E4A8D0F905C9CE880 ] iaStorV C:\Windows\system32\drivers\iastorv.sys
22:34:52.0389 0x1354 iaStorV - ok
22:34:52.0588 0x1354 [ DD386C45D2B5863740166783448A2E7A, 10B912BA70306644BE73A53AF4DCDFF63880C4C5860FF6DBA92B0914EB566718 ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
22:34:52.0743 0x1354 idsvc - ok
22:34:52.0769 0x1354 [ 2D077BF86E843F901D8DB709C95B49A5, 78FF558A881F307858F5C7C74A748B8B2562AF3CAC7EA8639945609001D790CE ] iirsp C:\Windows\system32\drivers\iirsp.sys
22:34:52.0793 0x1354 iirsp - ok
22:34:52.0835 0x1354 [ 4687EE0C0DD2CE5F7AAA9C2E33C1DC78, FA8EBED2778D9F7560ADC1B563954EEF98AAE651C0553F2803372B37B122AEB3 ] IKEEXT C:\Windows\System32\ikeext.dll
22:34:52.0860 0x1354 IKEEXT - ok
22:34:52.0910 0x1354 [ 9D64201C9E5AC8D1F088762BA00FF3AB, 1F83B0C828654B8C195A33CA4424AD9F9CFE411D503BB79986D7396DB9BBC994 ] int15 C:\Acer\Empowering Technology\eRecovery\int15.sys
22:34:52.0924 0x1354 int15 - ok
22:34:53.0063 0x1354 [ 6F62BAFE6150F3952F877051C65786FE, 331E16BF61AC77592CCB02237C807E1B1E7253EB7EF70FC4EBACEFACB72903A3 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
22:34:53.0304 0x1354 IntcAzAudAddService - ok
22:34:53.0348 0x1354 [ 97469037714070E45194ED318D636401, DDB5AE39BE0BD37ECB44969A5FA740E5B1169342347D0DB3E5DF0353A6708271 ] intelide C:\Windows\system32\drivers\intelide.sys
22:34:53.0362 0x1354 intelide - ok
22:34:53.0392 0x1354 [ CE44CC04262F28216DD4341E9E36A16F, 2B316C4124DCFEAD7838B3D8FB8DBEC3F3B1EA8EA612AABB05B1275D0B230CCD ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
22:34:53.0490 0x1354 intelppm - ok
22:34:53.0539 0x1354 [ 9AC218C6E6105477484C6FDBE7D409A4, FF30D09CD2A0F5BBEC309E953370F194B6F26BF4227E627B594AAA48B0F5D3C2 ] IPBusEnum C:\Windows\system32\ipbusenum.dll
22:34:53.0564 0x1354 IPBusEnum - ok
22:34:53.0597 0x1354 [ 62C265C38769B864CB25B4BCF62DF6C3, CAF6BCE967104233E216464E4729B0275C3BD426D812F404AB0EE83A7F2063D8 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
22:34:53.0658 0x1354 IpFilterDriver - ok
22:34:53.0725 0x1354 [ 1998BD97F950680BB55F55A7244679C2, A4E8BB4C6B2AF4800BD5E0BA8725FD0927F8FB6751AEBF6DD16B59C414CCB9D8 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
22:34:53.0781 0x1354 iphlpsvc - ok
22:34:53.0787 0x1354 IpInIp - ok
22:34:53.0803 0x1354 [ 40F34F8ABA2A015D780E4B09138B6C17, 22F86888C6B4F76836E863A90730D8F0DBD518305D87A399A159387E79E9D2F7 ] IPMIDRV C:\Windows\system32\drivers\ipmidrv.sys
22:34:53.0888 0x1354 IPMIDRV - ok
22:34:53.0913 0x1354 [ 8793643A67B42CEC66490B2A0CF92D68, 8B1ED1314E4C6623824DD6B9C15A0F7F996F4D243BF0B305421251BE40850907 ] IPNAT C:\Windows\system32\DRIVERS\ipnat.sys
22:34:53.0978 0x1354 IPNAT - ok
22:34:54.0007 0x1354 [ 109C0DFB82C3632FBD11949B73AEEAC9, 73B01426100256B7110DF0B74483AF1B62FC209612EEC29A7BF6DC31A7FBEFB6 ] IRENUM C:\Windows\system32\drivers\irenum.sys
22:34:54.0038 0x1354 IRENUM - ok
22:34:54.0081 0x1354 [ 350FCA7E73CF65BCEF43FAE1E4E91293, 68403FE3F4DC40919CD26A2CC42BE4386AE6874F47DD382348FFD79080721A13 ] isapnp C:\Windows\system32\drivers\isapnp.sys
22:34:54.0111 0x1354 isapnp - ok
22:34:54.0165 0x1354 [ 232FA340531D940AAC623B121A595034, 90C93F04D8A0094EEBD118F10223605B8169DA5F24C466F503CED5C014BD17B1 ] iScsiPrt C:\Windows\system32\DRIVERS\msiscsi.sys
22:34:54.0183 0x1354 iScsiPrt - ok
22:34:54.0200 0x1354 [ BCED60D16156E428F8DF8CF27B0DF150, 4934E9AB8A8A548548F0C63517F2BF4DE84B05E5C9C7C2AA6C1517B8F9C340D4 ] iteatapi C:\Windows\system32\drivers\iteatapi.sys
22:34:54.0220 0x1354 iteatapi - ok
22:34:54.0233 0x1354 [ 06FA654504A498C30ADCA8BEC4E87E7E, 651BC35A0A3D504573BBAB40DE81929BB18C9FC0CD7944FEAE0E99CD7658EA88 ] iteraid C:\Windows\system32\drivers\iteraid.sys
22:34:54.0253 0x1354 iteraid - ok
22:34:54.0284 0x1354 [ 37605E0A8CF00CBBA538E753E4344C6E, B9A9FFDCE45B0830E277CF322C28ACB49372C16144B0F676B283BE5DAE9A7F30 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
22:34:54.0320 0x1354 kbdclass - ok
22:34:54.0345 0x1354 [ EDE59EC70E25C24581ADD1FBEC7325F7, 41B37778E9A12675FC0DF74606AAF18C652EB88513B3C4889C5C512E14587CEE ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
22:34:54.0393 0x1354 kbdhid - ok
22:34:54.0411 0x1354 [ A3E186B4B935905B829219502557314E, 7F58EAC6C12208D792C77014AC9D37AD1A7B2E73863C914F5DA831A72E1D52BB ] KeyIso C:\Windows\system32\lsass.exe
22:34:54.0458 0x1354 KeyIso - ok
22:34:54.0493 0x1354 [ 5035EDF1F2E72F78BB1EC5BD9B97463F, 8AFAD580A96F002FFB22761B65D4B414917895C45B11B53089BB3E0331995EF7 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
22:34:54.0559 0x1354 KSecDD - ok
22:34:54.0610 0x1354 [ 8078F8F8F7A79E2E6B494523A828C585, BB399993166853F0C01B7508649ECD7E7473238267BA8333D0441128FE656347 ] KtmRm C:\Windows\system32\msdtckrm.dll
22:34:54.0680 0x1354 KtmRm - ok
22:34:54.0735 0x1354 [ 1BF5EEBFD518DD7298434D8C862F825D, F41C79410345C40B346EB5EDEA397ECD29ECB9B921AC3E19F9453E52A7B9288A ] LanmanServer C:\Windows\system32\srvsvc.dll
22:34:54.0788 0x1354 LanmanServer - ok
22:34:54.0837 0x1354 [ 1DB69705B695B987082C8BAEC0C6B34F, D395B272F6B69D4A9FC3CDEFD812EF0DBFECF3C1B1C787C7CC1E1A1B091B8DB3 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
22:34:54.0878 0x1354 LanmanWorkstation - ok
22:34:54.0887 0x1354 Lbd - ok
22:34:54.0962 0x1354 [ 793FF718477345CD5D232C50BED1E452, 1D39CF9F10742C79FF99B9B4E0361EAEA63B4FC545C58B54B55537D18C802941 ] LightScribeService C:\Program Files\Common Files\LightScribe\LSSrvc.exe
22:34:54.0978 0x1354 LightScribeService - detected UnsignedFile.Multi.Generic ( 1 )
22:34:55.0206 0x1354 Detect skipped due to KSN trusted
22:34:55.0206 0x1354 LightScribeService - ok
22:34:55.0237 0x1354 [ D1C5883087A0C3F1344D9D55A44901F6, 608D67357AFDDD538D2C12C93EB0793ECA4EB3AF2BAB779E881C41F50E4AB911 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
22:34:55.0264 0x1354 lltdio - ok
22:34:55.0299 0x1354 [ 2D5A428872F1442631D0959A34ABFF63, E532C6ECFFB936EFF744CA57BDC6394C89E797B6B0822D04F1F3F35D9BDDD4F0 ] lltdsvc C:\Windows\System32\lltdsvc.dll
22:34:55.0350 0x1354 lltdsvc - ok
22:34:55.0383 0x1354 [ 35D40113E4A5B961B6CE5C5857702518, 453097AEF46ED48107395D9A1696AAC259FD6CEA8A655D38C5E246FDDAB81664 ] lmhosts C:\Windows\System32\lmhsvc.dll
22:34:55.0420 0x1354 lmhosts - ok
22:34:55.0460 0x1354 [ A2262FB9F28935E862B4DB46438C80D2, 792684A68726BC007ACABB584682FDF4F059AE60888FB5B47ED68A97EA0BB5E6 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
22:34:55.0479 0x1354 LSI_FC - ok
22:34:55.0496 0x1354 [ 30D73327D390F72A62F32C103DAF1D6D, 7BB5BFB0DCF33AF9907539B52DF7BA1943C1E75A17715B58DBC702ACA6D406EA ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
22:34:55.0513 0x1354 LSI_SAS - ok
22:34:55.0541 0x1354 [ E1E36FEFD45849A95F1AB81DE0159FE3, DA02B23A881D156A02D3874B41E6D042F84AD558B434280A6A6AC6B619668647 ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
22:34:55.0558 0x1354 LSI_SCSI - ok
22:34:55.0588 0x1354 [ 8F5C7426567798E62A3B3614965D62CC, 659810257D942C5F4168E1247868CDA990F2324AC9ACAA9A6211F64B7AC9EC6E ] luafv C:\Windows\system32\drivers\luafv.sys
22:34:55.0626 0x1354 luafv - ok
22:34:55.0699 0x1354 [ 1578D3D981EB3715A61A3A5B992A364D, C6FF2A7E39074EF5CAF9E8BAF881E561099AF4B5A182FDF6BE4D56FE915FBF4D ] matlabserver C:\MATLAB6p1\webserver\bin\win32\matlabserver.exe
22:34:55.0740 0x1354 matlabserver - detected UnsignedFile.Multi.Generic ( 1 )
22:34:55.0991 0x1354 Detect skipped due to KSN trusted
22:34:55.0991 0x1354 matlabserver - ok
22:34:56.0014 0x1354 [ AEF9BABB8A506BC4CE0451A64AADED46, D5608A703EA7E97F11ED4D029B4B820440B0C9317DB7D7DC0152253CD723DC07 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
22:34:56.0043 0x1354 Mcx2Svc - ok
22:34:56.0076 0x1354 [ D153B14FC6598EAE8422A2037553ADCE, D5408B07B6EBA0146A605F11106497DC3DF8EC72E0DCC44BE1366A2A58ABE478 ] megasas C:\Windows\system32\drivers\megasas.sys
22:34:56.0098 0x1354 megasas - ok
22:34:56.0366 0x1354 [ FAFE367D032ED82E9332B4C741A20216, 7B123766E360570E0FCB211835B7910D6A1806C25A06BCA9227AB9E993376CA8 ] Microsoft Office Groove Audit Service C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
22:34:56.0396 0x1354 Microsoft Office Groove Audit Service - ok
22:34:56.0427 0x1354 [ 1076FFCFFAAE8385FD62DFCB25AC4708, 8C5C106FCB018E019DEBA8E1A6AA170CD7A93293F27994F724EBC486238DA0AA ] MMCSS C:\Windows\system32\mmcss.dll
22:34:56.0466 0x1354 MMCSS - ok
22:34:56.0517 0x1354 [ E13B5EA0F51BA5B1512EC671393D09BA, 5B380D1B435D809CA201FD5ED075D42F3C6BA1A4EEDBC4040F7E3329F05A334A ] Modem C:\Windows\system32\drivers\modem.sys
22:34:56.0564 0x1354 Modem - ok
22:34:56.0612 0x1354 [ 0A9BB33B56E294F686ABB7C1E4E2D8A8, 1E8031D51E074FDFB53E98E26DABF313B901C028D01196BFD402EED5D0A89595 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
22:34:56.0653 0x1354 monitor - ok
22:34:56.0672 0x1354 [ 5BF6A1326A335C5298477754A506D263, CC7F58E5955A448F6CE28D6D8EB98C7479E11F931B5C733CFE71A29B2E95923D ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
22:34:56.0690 0x1354 mouclass - ok
22:34:56.0719 0x1354 [ 93B8D4869E12CFBE663915502900876F, 7464DE60FAAD8793D855F1F86C3C865B3A3EE41C19A3E926D1BE4426E67F5EC2 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
22:34:56.0763 0x1354 mouhid - ok
22:34:56.0794 0x1354 [ BDAFC88AA6B92F7842416EA6A48E1600, 2CA8A7BB260016D6B7953980A94C45A3C5D41F7DC7E73EEFB1C18EA144749503 ] MountMgr C:\Windows\system32\drivers\mountmgr.sys
22:34:56.0813 0x1354 MountMgr - ok
22:34:56.0863 0x1354 [ 269BDB3CB77EB77BABE2862BEAB1F208, EC693365C73D59244CB77E181042128A9901BA5C1109CD4F1B9A2008DF1F9582 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
22:34:56.0890 0x1354 MozillaMaintenance - ok
22:34:56.0951 0x1354 [ 583A41F26278D9E0EA548163D6139397, 1F09D2FEEE1A8D4F1D9E53596158154099FD436A408F7E72E40F50778A3838A1 ] mpio C:\Windows\system32\drivers\mpio.sys
22:34:57.0010 0x1354 mpio - ok
22:34:57.0067 0x1354 [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E, 62055C0DCEB69873B8961AB17DBD002F44319A44CB05EC3A61421A0C6D4736CD ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
22:34:57.0154 0x1354 mpsdrv - ok
22:34:57.0340 0x1354 [ 5DE62C6E9108F14F6794060A9BDECAEC, 655E6645CC4A1EDBE5F51F5F80C7B504DD956851E788A6E4E4E08CDCDCE160D9 ] MpsSvc C:\Windows\system32\mpssvc.dll
22:34:57.0401 0x1354 MpsSvc - ok
22:34:57.0420 0x1354 [ 4FBBB70D30FD20EC51F80061703B001E, 72907A0CA5CFF82F40C02A65CD8EFD51D7CFC33BE67DE572D1ACF4FD3B248F0A ] Mraid35x C:\Windows\system32\drivers\mraid35x.sys
22:34:57.0437 0x1354 Mraid35x - ok
22:34:57.0498 0x1354 [ B0584CA7DEF55929FDB5169BD28B2484, AF6A7E404FEB29F7F3428D0AF6682195E5E8ED106996A04E6947DBD575696546 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
22:34:57.0511 0x1354 MRxDAV - ok
22:34:57.0571 0x1354 [ 1E94971C4B446AB2290DEB71D01CF0C2, 4701AA1B419AEF735CB2DA34532B0F1844433272C36D79F4EB55807E39B923D1 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
22:34:57.0639 0x1354 mrxsmb - ok
22:34:57.0742 0x1354 [ 4FCCB34D793B116423209C0F8B7A3B03, 7A483AEB691ADBE82779F12F0BB1CCCBFFD7E92902EC1ADC99AB7D129F887143 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
22:34:57.0778 0x1354 mrxsmb10 - ok
22:34:57.0805 0x1354 [ C3CB1B40AD4A0124D617A1199B0B9D7C, B975A39DE6D324C6274B6E3B883F36082A958F028335CEB3A37F44481EB284B3 ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
22:34:57.0831 0x1354 mrxsmb20 - ok
22:34:57.0878 0x1354 [ 742AED7939E734C36B7E8D6228CE26B7, 6F727144BBD42C9C5555087CA51DE8D501B5CBEFB9967866CC578733E3C5E681 ] msahci C:\Windows\system32\drivers\msahci.sys
22:34:57.0892 0x1354 msahci - ok
22:34:57.0915 0x1354 [ 3FC82A2AE4CC149165A94699183D3028, 8575BE62A209672A5D8C68D75BBBB4FF06220CA73A939B0793442DAD2272598C ] msdsm C:\Windows\system32\drivers\msdsm.sys
22:34:57.0935 0x1354 msdsm - ok
22:34:57.0983 0x1354 [ FD7520CC3A80C5FC8C48852BB24C6DED, C3F3D7A07FAB9AF38A2A00BF0DF6EEE18CA8FE26277BEC9D8ADB793F2CD5EC1F ] MSDTC C:\Windows\System32\msdtc.exe
22:34:58.0049 0x1354 MSDTC - ok
22:34:58.0113 0x1354 [ A9927F4A46B816C92F461ACB90CF8515, 753284F726F9B4D3E7322C75532244CA43714F00717C2019391FB36DEE0738C0 ] Msfs C:\Windows\system32\drivers\Msfs.sys
22:34:58.0155 0x1354 Msfs - ok
22:34:58.0204 0x1354 [ 0F400E306F385C56317357D6DEA56F62, C48FA8193787359902D20D869F5F602CD66D3C5D061A58DDB72F51EED433C4BC ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
22:34:58.0220 0x1354 msisadrv - ok
22:34:58.0260 0x1354 [ 85466C0757A23D9A9AECDC0755203CB2, 79141B8DF9D7470466872AF03A85C3D3976512BFDBDB8B92A22225DC8EFD70A6 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
22:34:58.0296 0x1354 MSiSCSI - ok
22:34:58.0304 0x1354 msiserver - ok
22:34:58.0334 0x1354 [ D8C63D34D9C9E56C059E24EC7185CC07, D0CBFB8D57E6D908679DC0488ED659CA35B92626DEA890873E165F051A1AD2AE ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
22:34:58.0362 0x1354 MSKSSRV - ok
22:34:58.0396 0x1354 [ 1D373C90D62DDB641D50E55B9E78D65E, 1D4897A96EA54D6FAC7916D69B4E88CAE1397C38CC8FAE08554772808476357B ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
22:34:58.0426 0x1354 MSPCLOCK - ok
22:34:58.0432 0x1354 [ B572DA05BF4E098D4BBA3A4734FB505B, B7923F204CEADD0F62C2FE4B7CF8C56DAB70F88093B15C5692D0E61490CF4BAA ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
22:34:58.0462 0x1354 MSPQM - ok
22:34:58.0505 0x1354 [ B49456D70555DE905C311BCDA6EC6ADB, 8E40586B3A1FAE9996459E0261726C9DD6A8D5F575604868C45604613385C92F ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
22:34:58.0530 0x1354 MsRPC - ok
22:34:58.0551 0x1354 [ E384487CB84BE41D09711C30CA79646C, 520391DEE14D4D6C1EA99C7D31DD95D56B44D54CA3CD8E5C9855E9C0A04F026C ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
22:34:58.0563 0x1354 mssmbios - ok
22:34:58.0616 0x1354 [ 7199C1EEC1E4993CAF96B8C0A26BD58A, DD02DF8ED7AF5BB88BD2A91F38CE4C52432CB8044BDCBC41C320CD22B10B8A3B ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
22:34:58.0691 0x1354 MSTEE - ok
22:34:58.0723 0x1354 [ 6A57B5733D4CB702C8EA4542E836B96C, 080FB0B01E949D24CDD6876125B3A72DA9F88845D8B9A1A425BCA99E7ACF6821 ] Mup C:\Windows\system32\Drivers\mup.sys
22:34:58.0763 0x1354 Mup - ok
22:34:58.0841 0x1354 [ E605F35F03C881DC46902E0E2F5985B3, C97F0C733377E35B463EF7F6A5B879DA21AB512719899160C09278615FE39A21 ] MyEpson Portal Service C:\Program Files\EPSON\MyEpson Portal\mepService.exe
22:34:58.0876 0x1354 MyEpson Portal Service - ok
22:34:58.0909 0x1354 [ E4EAF0C5C1B41B5C83386CF212CA9584, 5946C3DCE65A0DB164169A1775DFCA544AF4E1895ADF6916BB1653F373F8D9AF ] napagent C:\Windows\system32\qagentRT.dll
22:34:58.0961 0x1354 napagent - ok
22:34:59.0006 0x1354 [ 85C44FDFF9CF7E72A40DCB7EC06A4416, DC37C99C458CA69B33BFD3894187089E947F4F9C01EC2ED024FA8614989E0956 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
22:34:59.0035 0x1354 NativeWifiP - ok
22:34:59.0109 0x1354 [ 1357274D1883F68300AEADD15D7BBB42, EE6352CBF0D9D633816F338159CDA27F1A805C3DDC3402D8605B50D8F3CD3300 ] NDIS C:\Windows\system32\drivers\ndis.sys
22:34:59.0149 0x1354 NDIS - ok
22:34:59.0211 0x1354 [ 0E186E90404980569FB449BA7519AE61, DE41791D9D3074007D6DD1D3933E7A2A13E3789D0AD4F029105B58279622FC1B ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
22:34:59.0265 0x1354 NdisTapi - ok
22:34:59.0288 0x1354 [ D6973AA34C4D5D76C0430B181C3CD389, 7C303F3D6BFF8B82E39998135B444837091AB1F9EB8F28D013E5EF45DB237EFC ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
22:34:59.0325 0x1354 Ndisuio - ok
22:34:59.0375 0x1354 [ 818F648618AE34F729FDB47EC68345C3, 5FC8F9237BD7FCE3C62D5BDDD49DC104BE2BECDC2FA8CDC1DB8F1891CBAA9140 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
22:34:59.0429 0x1354 NdisWan - ok
22:34:59.0496 0x1354 [ 71DAB552B41936358F3B541AE5997FB3, 30A8B3E33CBF04FC047254E404C0321F9028F2640036AA8AC1EA0A5E64551684 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
22:34:59.0517 0x1354 NDProxy - ok
22:34:59.0549 0x1354 [ BCD093A5A6777CF626434568DC7DBA78, 2A283DD93230361204EA0897864EAF0224CB8C02E025AE2E4237B07A598B3EBD ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
22:34:59.0570 0x1354 NetBIOS - ok
22:34:59.0663 0x1354 [ ECD64230A59CBD93C85F1CD1CAB9F3F6, 83650D756C1F2768A2AAAFC7924F2A4316ABAEB1708F4B05803CDDD699B5AB6F ] netbt C:\Windows\system32\DRIVERS\netbt.sys
22:34:59.0702 0x1354 netbt - ok
22:34:59.0712 0x1354 [ A3E186B4B935905B829219502557314E, 7F58EAC6C12208D792C77014AC9D37AD1A7B2E73863C914F5DA831A72E1D52BB ] Netlogon C:\Windows\system32\lsass.exe
22:34:59.0723 0x1354 Netlogon - ok
22:34:59.0750 0x1354 [ C8052711DAECC48B982434C5116CA401, 417DEB86D157DD3F0B4678410FE27FDD3E8FA04AB03AF398F6C02BF207070B35 ] Netman C:\Windows\System32\netman.dll
22:34:59.0778 0x1354 Netman - ok
22:34:59.0834 0x1354 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
22:34:59.0862 0x1354 NetMsmqActivator - ok
22:34:59.0875 0x1354 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
22:34:59.0890 0x1354 NetPipeActivator - ok
22:34:59.0924 0x1354 [ 2EF3BBE22E5A5ACD1428EE387A0D0172, 55DB91EDD0339D2434C06445F8A716A48EA90925B0FF7EBF45BB79D4B54B80BF ] netprofm C:\Windows\System32\netprofm.dll
22:34:59.0968 0x1354 netprofm - ok
22:35:00.0055 0x1354 [ C9AFE484B3645DA74FD459F45E4F756F, EC76BE23A104F87F41607CF2C633CA4E8CC0CDDE0F05E3BD897498154C50835B ] netr73 C:\Windows\system32\DRIVERS\netr73.sys
22:35:00.0138 0x1354 netr73 - ok
22:35:00.0191 0x1354 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
22:35:00.0207 0x1354 NetTcpActivator - ok
22:35:00.0224 0x1354 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
22:35:00.0241 0x1354 NetTcpPortSharing - ok
22:35:00.0294 0x1354 [ 2E7FB731D4790A1BC6270ACCEFACB36E, EE9A00B694E8A3A5842CDC56C7BA1364317AC8134E046A0059661D057094B1A3 ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
22:35:00.0324 0x1354 nfrd960 - ok
22:35:00.0361 0x1354 [ C96411DD46AABC0D6F3CF06D0E0E7E14, 0D36F322AF1B923D96735BFFCAC3FDB0B282E59220BADAB8B49AC178A6765380 ] NlaSvc C:\Windows\System32\nlasvc.dll
22:35:00.0403 0x1354 NlaSvc - ok
22:35:00.0428 0x1354 [ D36F239D7CCE1931598E8FB90A0DBC26, DF9397411D0CE5A87E3346D4E6E25BEC537A21BCE196CC55FD999CD08FC4A637 ] Npfs C:\Windows\system32\drivers\Npfs.sys
22:35:00.0453 0x1354 Npfs - ok
22:35:00.0481 0x1354 [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD, 15CA178518EB3D457AA4C109D97A8490821590842AE4E9841703B5A55870C8F6 ] nsi C:\Windows\system32\nsisvc.dll
22:35:00.0506 0x1354 nsi - ok
22:35:00.0551 0x1354 [ 609773E344A97410CE4EBF74A8914FCF, 90B9CBD2B62854DD503DE4A910CB987D402368EB99882FE20FFB6DEACD70F2BD ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
22:35:00.0600 0x1354 nsiproxy - ok
22:35:00.0811 0x1354 [ 2C1121F2B87E9A6B12485DF53CD848C7, E580428F3BA7B201C6C7CFADF1F44A6ECA4F589EDB034DA14260136236195936 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
22:35:00.0934 0x1354 Ntfs - ok
22:35:00.0988 0x1354 [ 7F1C1F78D709C4A54CBB46EDE7E0B48D, 52135D41983A9E9E1DCA250A63017076AE22AA06D77CCF2E5EF41154F958584A ] NTIDrvr C:\Windows\system32\DRIVERS\NTIDrvr.sys
22:35:00.0997 0x1354 NTIDrvr - detected UnsignedFile.Multi.Generic ( 1 )
22:35:01.0172 0x1354 Detect skipped due to KSN trusted
22:35:01.0172 0x1354 NTIDrvr - ok
22:35:01.0184 0x1354 [ E875C093AEC0C978A90F30C9E0DFBB72, D3A480CD7EF374EFBC1BB831B33B81534774DDDBB0FB338BEE1D444949FD8DE7 ] ntrigdigi C:\Windows\system32\drivers\ntrigdigi.sys
22:35:01.0234 0x1354 ntrigdigi - ok
22:35:01.0255 0x1354 [ C5DBBCDA07D780BDA9B685DF333BB41E, 3652893DFF05469A273C3073D8D0A9D6D6BBDEC7855FEA8EAB768F95BA674108 ] Null C:\Windows\system32\drivers\Null.sys
22:35:01.0279 0x1354 Null - ok
22:35:01.0306 0x1354 [ E69E946F80C1C31C53003BFBF50CBB7C, A0A4BC57822B2CBC75602A969E28DCEDE04B41CC084E1EF1532B1BCDAEAA43BB ] nvraid C:\Windows\system32\drivers\nvraid.sys
22:35:01.0333 0x1354 nvraid - ok
22:35:01.0356 0x1354 [ 9E0BA19A28C498A6D323D065DB76DFFC, EA9E33ED2820ED39932FAE114A9CF1D87780ED6605D0260A6F22F920B48F34E9 ] nvstor C:\Windows\system32\drivers\nvstor.sys
22:35:01.0384 0x1354 nvstor - ok
22:35:01.0404 0x1354 [ 07C186427EB8FCC3D8D7927187F260F7, 9AFDE1CB7B7232BD019804BFC691580B9CC2E51A5BC0E5584B23907D532600D8 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
22:35:01.0440 0x1354 nv_agp - ok
22:35:01.0445 0x1354 NwlnkFlt - ok
22:35:01.0453 0x1354 NwlnkFwd - ok
22:35:01.0627 0x1354 [ 84DE1DD996B48B05ACE31AD015FA108A, 4B9D1E4EF83ECED6C77F23D9879C124534F7053D7423E3A2D0F67A4A720CEA94 ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
22:35:01.0672 0x1354 odserv - ok
22:35:01.0766 0x1354 [ 6F310E890D46E246E0E261A63D9B36B4, 7050B0C43CC0DF2DDAD3EB8D2FF9EEE425A627C68654CBB154D55A4B1A47AA08 ] ohci1394 C:\Windows\system32\DRIVERS\ohci1394.sys
22:35:01.0785 0x1354 ohci1394 - ok
22:35:01.0857 0x1354 [ 5A432A042DAE460ABE7199B758E8606C, 6E5D1F477D290905BE27CEBF9572BAC6B05FFEF2FAD901D3C8E11F665F8B9A71 ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
22:35:01.0879 0x1354 ose - ok
22:35:01.0965 0x1354 [ 0C8E8E61AD1EB0B250B846712C917506, 8F23657B90BFFCD7273B93EDA2D3768F35C1C5A313F22AE33452BE3B2A550649 ] p2pimsvc C:\Windows\system32\p2psvc.dll
22:35:02.0072 0x1354 p2pimsvc - ok
22:35:02.0116 0x1354 [ 0C8E8E61AD1EB0B250B846712C917506, 8F23657B90BFFCD7273B93EDA2D3768F35C1C5A313F22AE33452BE3B2A550649 ] p2psvc C:\Windows\system32\p2psvc.dll
22:35:02.0174 0x1354 p2psvc - ok
22:35:02.0224 0x1354 [ 8A79FDF04A73428597E2CAF9D0D67850, DB438FDE5510AB2F350ED1AC4CF0E99D3CC665FE46533A438A8FDA4DAF950F93 ] Parport C:\Windows\system32\DRIVERS\parport.sys
22:35:02.0253 0x1354 Parport - ok
22:35:02.0306 0x1354 [ B9C2B89F08670E159F7181891E449CD9, BD48CE95CF4B75D1FD5FD379B2A8727BC000F2B6748B77636C6BDB0B37B0344A ] partmgr C:\Windows\system32\drivers\partmgr.sys
22:35:02.0343 0x1354 partmgr - ok
22:35:02.0414 0x1354 [ 6C580025C81CAF3AE9E3617C22CAD00E, 64F9061196462085E5DCD3ACB97A0D8FC67CA9A96DDD6E2103AFFF1593AE236A ] Parvdm C:\Windows\system32\DRIVERS\parvdm.sys
22:35:02.0448 0x1354 Parvdm - ok
22:35:02.0531 0x1354 [ C6276AD11F4BB49B58AA1ED88537F14A, 409E956AF994640DF8D062E5E41F87A6EE7EEE0335C191B582722A49322357CE ] PcaSvc C:\Windows\System32\pcasvc.dll
22:35:02.0544 0x1354 PcaSvc - ok
22:35:02.0630 0x1354 [ 941DC1D19E7E8620F40BBC206981EFDB, 156142A8B587131D2D47074CBFD0A31F69B3C27A8C74C8C4F29DFE7B53BBA802 ] pci C:\Windows\system32\drivers\pci.sys
22:35:02.0671 0x1354 pci - ok
22:35:02.0773 0x1354 [ 1636D43F10416AEB483BC6001097B26C, 36E61A993693A46538FE0F726D67BB28886F61D53384AD600D1282296A27662E ] pciide C:\Windows\system32\drivers\pciide.sys
22:35:02.0788 0x1354 pciide - ok
22:35:02.0876 0x1354 [ E6F3FB1B86AA519E7698AD05E58B04E5, 2C4B45DDD3B980C9DAA6F039CAEFCD6E84A4D5BB43AFBA73C0C42B5556C1303C ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
22:35:02.0901 0x1354 pcmcia - ok
22:35:03.0103 0x1354 [ 6349F6ED9C623B44B52EA3C63C831A92, 9EAA3ABD396870123107D6E1B758F56FDA378BD28B28DB8415AA470D24294F92 ] PEAUTH C:\Windows\system32\drivers\peauth.sys
22:35:03.0275 0x1354 PEAUTH - ok
22:35:03.0647 0x1354 [ B1689DF169143F57053F795390C99DB3, 887B8C76B34CABC68067C0F27CC4EEF02457A53634C96FE5B0FE9B99453BDBEF ] pla C:\Windows\system32\pla.dll
22:35:03.0999 0x1354 pla - ok
22:35:04.0099 0x1354 [ C5E7F8A996EC0A82D508FD9064A5569E, 416A93816CDF12DD42DEA796D37E6E2000D3172AAAB20D3EAD3B715DACD4B61F ] PlugPlay C:\Windows\system32\umpnpmgr.dll
22:35:04.0122 0x1354 PlugPlay - ok
22:35:04.0222 0x1354 [ 0C8E8E61AD1EB0B250B846712C917506, 8F23657B90BFFCD7273B93EDA2D3768F35C1C5A313F22AE33452BE3B2A550649 ] PNRPAutoReg C:\Windows\system32\p2psvc.dll
22:35:04.0269 0x1354 PNRPAutoReg - ok
22:35:04.0322 0x1354 [ 0C8E8E61AD1EB0B250B846712C917506, 8F23657B90BFFCD7273B93EDA2D3768F35C1C5A313F22AE33452BE3B2A550649 ] PNRPsvc C:\Windows\system32\p2psvc.dll
22:35:04.0357 0x1354 PNRPsvc - ok
22:35:04.0408 0x1354 [ D0494460421A03CD5225CCA0059AA146, FC30E90522C63F2A66D89381705712D2CDF07B2E029DF40C2DEBB2353E763E90 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
22:35:04.0440 0x1354 PolicyAgent - ok
22:35:04.0468 0x1354 [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1, 6E4B188A4BFDBBCA51347BCCE2873F2D0F858398851B9B5129CB9F36A02E4354 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
22:35:04.0496 0x1354 PptpMiniport - ok
22:35:04.0529 0x1354 [ 0E3CEF5D28B40CF273281D620C50700A, 8ADA99B4563AE2129B95136295EE92A94102B035EBBC83D4C8587ECE8B0DEE60 ] Processor C:\Windows\system32\drivers\processr.sys
22:35:04.0571 0x1354 Processor - ok
22:35:04.0617 0x1354 [ 0D5DAD610D7EA1627581ED06FB2BAA9A, 6E27CF3A1624AE10EECB8B5F38E03D76A6AABE4E75DD66DEDD67E0773935A396 ] ProfSvc C:\Windows\system32\profsvc.dll
22:35:04.0641 0x1354 ProfSvc - ok
22:35:04.0651 0x1354 [ A3E186B4B935905B829219502557314E, 7F58EAC6C12208D792C77014AC9D37AD1A7B2E73863C914F5DA831A72E1D52BB ] ProtectedStorage C:\Windows\system32\lsass.exe
22:35:04.0662 0x1354 ProtectedStorage - ok
22:35:04.0696 0x1354 [ 99514FAA8DF93D34B5589187DB3AA0BA, 4DDE5EC0C721B22E1D7D55ED3514B60EA07435C232A3A931BB49C7F486B52C18 ] PSched C:\Windows\system32\DRIVERS\pacer.sys
22:35:04.0713 0x1354 PSched - ok
22:35:04.0724 0x1354 [ C2821F33B846A52FDC25FF554ACF11F2, CE07828B1995138E313DE06A3FDA8E9B77D0A37DBB2D0424D72FFD20297BC584 ] PSDFilter C:\Windows\system32\DRIVERS\psdfilter.sys
22:35:04.0738 0x1354 PSDFilter - ok
22:35:04.0749 0x1354 [ 28D3A91FE7791B970E6B15C88F98DFBD, E3900EA3088C19C26D8D4825F441E671751F67845B7D25D81D6DEF84C521E2FC ] PSDNServ C:\Windows\system32\drivers\PSDNServ.sys
22:35:04.0762 0x1354 PSDNServ - ok
22:35:04.0826 0x1354 [ 3A66F69459052DE13EF8A0F77D728A73, 57A8359DC91CA69F326D9882213B7825B8120EC454B7E564AA4132EA5E92FC5E ] psdvdisk C:\Windows\system32\drivers\psdvdisk.sys
22:35:04.0866 0x1354 psdvdisk - ok
22:35:05.0055 0x1354 [ CCDAC889326317792480C0A67156A1EC, 3D3B561B6D4E12DE442C98993C929765F002AF5CFB5A00EFACE6ABE957F7E8AF ] ql2300 C:\Windows\system32\drivers\ql2300.sys
22:35:05.0138 0x1354 ql2300 - ok
22:35:05.0160 0x1354 [ 81A7E5C076E59995D54BC1ED3A16E60B, A2988F065F93C41B3B389BFF3BB3FD69F768C2AF249C2356F315CC92E5C9E128 ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
22:35:05.0181 0x1354 ql40xx - ok
22:35:05.0217 0x1354 [ E9ECAE663F47E6CB43962D18AB18890F, F1A05320CAED9E745AA36A6DA9B64C48AAEDE888B42B249840CEB31448F7F432 ] QWAVE C:\Windows\system32\qwave.dll
22:35:05.0241 0x1354 QWAVE - ok
22:35:05.0265 0x1354 [ 9F5E0E1926014D17486901C88ECA2DB7, 67CDFB99AB546DCEEF20507EAC07DD52FFB51BFDFE9416ABEDDC1201B60D720E ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
22:35:05.0284 0x1354 QWAVEdrv - ok
22:35:05.0305 0x1354 [ 147D7F9C556D259924351FEB0DE606C3, E41EBA5F3098C6CF2BE4C0060A5F4BF161C3677D983B7A0D70ACC12FC3CFEFD7 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
22:35:05.0335 0x1354 RasAcd - ok
22:35:05.0359 0x1354 [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F, 6A410ABCCD2211EFF511CDBF22E4152B57D2996336EBE711DFF71904AF232DB2 ] RasAuto C:\Windows\System32\rasauto.dll
22:35:05.0399 0x1354 RasAuto - ok
22:35:05.0426 0x1354 [ A214ADBAF4CB47DD2728859EF31F26B0, A24F37F55E2C018B1B4FA2C568A01AAAAEA1220833ED24A93378386174A70A32 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
22:35:05.0454 0x1354 Rasl2tp - ok
22:35:05.0485 0x1354 [ 75D47445D70CA6F9F894B032FBC64FCF, 9112EA5D25F867136858524C7965ACCEDC02675D1E2985B950598D89CCF25E14 ] RasMan C:\Windows\System32\rasmans.dll
22:35:05.0509 0x1354 RasMan - ok
22:35:05.0531 0x1354 [ 509A98DD18AF4375E1FC40BC175F1DEF, CC7C278CA298CE102D871E34C176E73F903D6687D1E8B5AFAB8772C7DE1A60B1 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
22:35:05.0553 0x1354 RasPppoe - ok
22:35:05.0581 0x1354 [ 2005F4A1E05FA09389AC85840F0A9E4D, D8A664073FDE82F9AB324347024CDB7043635C84EB11C24C59AB384C52F0FD94 ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
22:35:05.0598 0x1354 RasSstp - ok
22:35:05.0628 0x1354 [ B14C9D5B9ADD2F84F70570BBBFAA7935, 3D533767A50554B86C769DF4D8841B3EA680B3807E85EA3533BDA9B649548269 ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
22:35:05.0669 0x1354 rdbss - ok
22:35:05.0687 0x1354 [ 89E59BE9A564262A3FB6C4F4F1CD9899, 6F948FB0E73495CA60B7B19E758268495EC8A084C475EC59AD7940AA619570BB ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
22:35:05.0711 0x1354 RDPCDD - ok
22:35:05.0751 0x1354 [ E8BD98D46F2ED77132BA927FCCB47D8B, 5187CF8F00AD67EDDF27DF675F3210C0D72E552578A89C58DF6953B1D5BEBCB8 ] rdpdr C:\Windows\system32\drivers\rdpdr.sys
22:35:05.0805 0x1354 rdpdr - ok
22:35:05.0828 0x1354 [ 9D91FE5286F748862ECFFA05F8A0710C, 33F37F1B207151A5564BF051BBF16F35D8C5A0F426CCA078A51F125BF09E487B ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
22:35:05.0853 0x1354 RDPENCDD - ok
22:35:05.0891 0x1354 [ C127EBD5AFAB31524662C48DFCEB773A, 40A6B88FEAFF02D1B5C0CA32F290CF3D9B48B85D248C7532F30CC5C09BAA4D89 ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
22:35:05.0932 0x1354 RDPWD - ok
22:35:05.0982 0x1354 [ BCDD6B4804D06B1F7EBF29E53A57ECE9, 8A961CCD0A0265E03D9952C733B593B02B5CF64E308D6B420276D2D6B20F86FC ] RemoteAccess C:\Windows\System32\mprdim.dll
22:35:06.0006 0x1354 RemoteAccess - ok
22:35:06.0032 0x1354 [ 9E6894EA18DAFF37B63E1005F83AE4AB, 5D6DF994D297C875D547C7B111A571AA90D582DAECADE18A53F65AD988819E67 ] RemoteRegistry C:\Windows\system32\regsvc.dll
22:35:06.0054 0x1354 RemoteRegistry - ok
22:35:06.0098 0x1354 [ A76CDDB6D1F25797843E2557A2118E2E, A018DAC943937056E3A4FD1C1A770B61D835CB4B92447C7FCC064516ED78E6C1 ] RichVideo C:\Program Files\CyberLink\Shared Files\RichVideo.exe
22:35:06.0107 0x1354 RichVideo - detected UnsignedFile.Multi.Generic ( 1 )
22:35:06.0439 0x1354 Detect skipped due to KSN trusted
22:35:06.0439 0x1354 RichVideo - ok
22:35:06.0459 0x1354 [ 5123F83CBC4349D065534EEB6BBDC42B, 92A3F38EA924D83D601BB93E3750F9DBC2DD963FB7ACF2A0E776297E21815225 ] RpcLocator C:\Windows\system32\locator.exe
22:35:06.0473 0x1354 RpcLocator - ok
22:35:06.0512 0x1354 [ 3B5B4D53FEC14F7476CA29A20CC31AC9, EC02A412DA5FDE2C759A4A2C5904579E1CE7C4999CE87145812F354FC8F5E183 ] RpcSs C:\Windows\system32\rpcss.dll
22:35:06.0544 0x1354 RpcSs - ok
22:35:06.0567 0x1354 [ 9C508F4074A39E8B4B31D27198146FAD, 84913471E5A6C297B1EDABE45EF3FE7D2C4410EF04370F615109FD9E2690FFDB ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
22:35:06.0595 0x1354 rspndr - ok
22:35:06.0608 0x1354 [ A3E186B4B935905B829219502557314E, 7F58EAC6C12208D792C77014AC9D37AD1A7B2E73863C914F5DA831A72E1D52BB ] SamSs C:\Windows\system32\lsass.exe
22:35:06.0619 0x1354 SamSs - ok
22:35:06.0643 0x1354 [ 3CE8F073A557E172B330109436984E30, CEC281C6076FAA1E34372CF419C6308E73811316606B8D0D9055B7D8952BDC88 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
22:35:06.0672 0x1354 sbp2port - ok
22:35:06.0709 0x1354 [ 77B7A11A0C3D78D3386398FBBEA1B632, A3D290AB793BDC2F84C7B963300DFCE81CFE082A0FFF7489E8E5B14714892C00 ] SCardSvr C:\Windows\System32\SCardSvr.dll
22:35:06.0736 0x1354 SCardSvr - ok
22:35:06.0821 0x1354 [ 1A58069DB21D05EB2AB58EE5753EBE8D, EED8111EB613F4C93D1638C74FDB0A6DC6694E1B108DCD0D794B5B5F9B8C6EE4 ] Schedule C:\Windows\system32\schedsvc.dll
22:35:06.0891 0x1354 Schedule - ok
22:35:06.0956 0x1354 [ 312EC3E37A0A1F2006534913E37B4423, 81B8F462336791D162DAFA8092C1F437638DA3022CA24A2458B9FE183FC18C5D ] SCPolicySvc C:\Windows\System32\certprop.dll
22:35:06.0973 0x1354 SCPolicySvc - ok
22:35:07.0011 0x1354 [ 716313D9F6B0529D03F726D5AAF6F191, 44FE994A11631C1D99C73026340BACE39973C65A1281D87A61B481C9B5FAB251 ] SDRSVC C:\Windows\System32\SDRSVC.dll
22:35:07.0027 0x1354 SDRSVC - ok
22:35:07.0054 0x1354 [ FD5199D4D8A521005E4B5EE7FE00FA9B, 0FB7A1D300C72B1ADC423CC57343C17853E5F8ACFE3EA2C42FAC2FF72E502FBE ] seclogon C:\Windows\system32\seclogon.dll
22:35:07.0078 0x1354 seclogon - ok
22:35:07.0122 0x1354 [ A9BBAB5759771E523F55563D6CBE140F, 415BF6F6A1E4C5F98DABF9C2EEAF8CA49730693046E5F94C7655683717EDAD75 ] SENS C:\Windows\System32\sens.dll
22:35:07.0147 0x1354 SENS - ok
22:35:07.0187 0x1354 [ CE9EC966638EF0B10B864DDEDF62A099, 2DEC5A8C947D87C12B342F15B8A552A0D49B979A2AC32D2C97FC7A3A76C34524 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
22:35:07.0223 0x1354 Serenum - ok
22:35:07.0260 0x1354 [ 6D663022DB3E7058907784AE14B69898, 54263888C64A7F010D3B5E399369B0F3FF3AF0A0DE8ADB502B98277533E4D45F ] Serial C:\Windows\system32\DRIVERS\serial.sys
22:35:07.0293 0x1354 Serial - ok
22:35:07.0318 0x1354 [ 8AF3D28A879BF75DB53A0EE7A4289624, C870BEBB969DCD9170E64584D1CD329A193D9FC812A45EF3574891110CA68B45 ] sermouse C:\Windows\system32\drivers\sermouse.sys
22:35:07.0348 0x1354 sermouse - ok
22:35:07.0388 0x1354 [ D2193326F729B163125610DBF3E17D57, 82C894E24E2C139C884246A693AD37BBF0A4E9375B7F7A288EF1DB22F89434B9 ] SessionEnv C:\Windows\system32\sessenv.dll
22:35:07.0417 0x1354 SessionEnv - ok
22:35:07.0456 0x1354 [ 103B79418DA647736EE95645F305F68A, E4D356FD8C62B616D3584FE84905995A1CEE452288E3A456CC358FF41FEAB1B7 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
22:35:07.0504 0x1354 sffdisk - ok
22:35:07.0532 0x1354 [ 8FD08A310645FE872EEEC6E08C6BF3EE, 702A148C9DE172E7B5E331F057487255E0729FD42F949BB0FF2D5A01775933CF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
22:35:07.0580 0x1354 sffp_mmc - ok
22:35:07.0598 0x1354 [ 9CFA05FCFCB7124E69CFC812B72F9614, E9CFCE695E4D1AF146781CFAA295878536E573F06AEA65438878DE29EC9959AD ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
22:35:07.0636 0x1354 sffp_sd - ok
22:35:07.0660 0x1354 [ 46ED8E91793B2E6F848015445A0AC188, 34A97304F23EA153422848F6F1CAF8ADF0944EA781E12F027B6DEAF751A04B5D ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
22:35:07.0714 0x1354 sfloppy - ok
22:35:07.0772 0x1354 [ E1499BD0FF76B1B2FBBF1AF339D91165, 9A8F0403467E75880D3070C4D862489A75134383BAF8E7C45F8C5E7DFB0605A5 ] SharedAccess C:\Windows\System32\ipnathlp.dll
22:35:07.0833 0x1354 SharedAccess - ok
22:35:07.0920 0x1354 [ C7230FBEE14437716701C15BE02C27B8, 8221DE73D77CF71C2857D78829E807D015D9CB8BDEE4BAFD6950BF0C718CC774 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
22:35:07.0971 0x1354 ShellHWDetection - ok
22:35:08.0018 0x1354 [ D2A595D6EEBEEAF4334F8E50EFBC9931, 851B8205C657BF806C4D815DC75356E99B4246016B6E1C1F51BAF8AD1E6D5299 ] sisagp C:\Windows\system32\drivers\sisagp.sys
22:35:08.0059 0x1354 sisagp - ok
22:35:08.0119 0x1354 [ CEDD6F4E7D84E9F98B34B3FE988373AA, E102977E6FAC30B5ABEEC0B412A9F2A10C5C42F4D9C3AD69296BF9E1E88B6141 ] SiSRaid2 C:\Windows\system32\drivers\sisraid2.sys
22:35:08.0164 0x1354 SiSRaid2 - ok
22:35:08.0217 0x1354 [ DF843C528C4F69D12CE41CE462E973A7, A2BEC74FCB8D8B6B9D8DD4746C013DFDF1DD662AEFE9B88CA495E5B83B4A76F9 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
22:35:08.0235 0x1354 SiSRaid4 - ok
22:35:08.0500 0x1354 [ 388AE59FE75F1B959DFA0900923C61BB, 0D47F8B4B4FBE5BF041DBE75B0A14D905E9310FFA6F0160746455B38A349EA54 ] Skype C2C Service C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
22:35:08.0835 0x1354 Skype C2C Service - ok
22:35:08.0978 0x1354 [ A9C057A9463C25490CF99EA8DF8A4B35, 8F4D1C40D0F17EDBF84ED455B8946F782C7552383F0A07E410A9B6CFF7F51D63 ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe
22:35:08.0998 0x1354 SkypeUpdate - ok
22:35:09.0317 0x1354 [ 862BB4CBC05D80C5B45BE430E5EF872F, F4961B22C93E472C8C862421AA231CDDA9E40D3958741A1D666357F22CC3143D ] slsvc C:\Windows\system32\SLsvc.exe
22:35:09.0664 0x1354 slsvc - ok
22:35:09.0714 0x1354 [ 6EDC422215CD78AA8A9CDE6B30ABBD35, D8342BC3152859F4F7512E85ABEC61147DBCAB515458644728874E42F639D6CA ] SLUINotify C:\Windows\system32\SLUINotify.dll
22:35:09.0739 0x1354 SLUINotify - ok
22:35:09.0800 0x1354 [ 7B75299A4D201D6A6533603D6914AB04, 172BE3951F06B1991EF70B71EB91786D1EFC4E381C22BCA3A5F622CD59F3227E ] Smb C:\Windows\system32\DRIVERS\smb.sys
22:35:09.0827 0x1354 Smb - ok
22:35:09.0881 0x1354 [ 2A146A055B4401C16EE62D18B8E2A032, D0930FFA53951C92F56E1ECB41374F4C0AA01ECBF99F474513A21EAD579CFE47 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
22:35:09.0893 0x1354 SNMPTRAP - ok
22:35:09.0941 0x1354 [ 7AEBDEEF071FE28B0EEF2CDD69102BFF, E03BEE733F4C2A5F39946D4955679A290E22758DFCE4222EE69ABF64FC54EDF7 ] spldr C:\Windows\system32\drivers\spldr.sys
22:35:09.0958 0x1354 spldr - ok
22:35:10.0016 0x1354 [ 8554097E5136C3BF9F69FE578A1B35F4, 2578545CFD647FB18F217B33C8CB4F0184A35F548659494056E455020CC15FB0 ] Spooler C:\Windows\System32\spoolsv.exe
22:35:10.0041 0x1354 Spooler - ok
22:35:10.0077 0x1354 [ 41987F9FC0E61ADF54F581E15029AD91, A46E718648C2DD3B43FC3798932C966315893A59442A0686CE46C605B9E4641E ] srv C:\Windows\system32\DRIVERS\srv.sys
22:35:10.0122 0x1354 srv - ok
22:35:10.0171 0x1354 [ FF33AFF99564B1AA534F58868CBE41EF, EFBB005DA19E5B320009CBF93E686D8BFA6A50A23B5A5001C7C84C7D85EF7D49 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
22:35:10.0194 0x1354 srv2 - ok
22:35:10.0210 0x1354 [ 7605C0E1D01A08F3ECD743F38B834A44, 83A77E31004BCF83443F30EFC290E04BB1A2F332E8DFD614AB6E25B527C92299 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
22:35:10.0243 0x1354 srvnet - ok
22:35:10.0285 0x1354 [ 03D50B37234967433A5EA5BA72BC0B62, 7B61D6A4BF5D446A9473D058BC207FB6DA7C2FEFB8083F3B66CAC8907DBD8327 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
22:35:10.0317 0x1354 SSDPSRV - ok
22:35:10.0367 0x1354 [ A36EE93698802CD899F98BFD553D8185, 224CFED921EA230FF8025D259E34968FD2C0FD34BB3A918FB4B9B8BA42BEA5D3 ] ssmdrv C:\Windows\system32\DRIVERS\ssmdrv.sys
22:35:10.0382 0x1354 ssmdrv - ok
22:35:10.0444 0x1354 [ 6F1A32E7B7B30F004D9A20AFADB14944, AA9D874A14CA4779E76701D2B02F4CCA92CD5917435FB4CACA149FCB2D1D4C4C ] SstpSvc C:\Windows\system32\sstpsvc.dll
22:35:10.0463 0x1354 SstpSvc - ok
22:35:10.0548 0x1354 [ 5DE7D67E49B88F5F07F3E53C4B92A352, 6930A598C35646646ED0E91633797EFE139AE6CDD0012335BD1340754A22F997 ] stisvc C:\Windows\System32\wiaservc.dll
22:35:10.0590 0x1354 stisvc - ok
22:35:10.0605 0x1354 [ 7BA58ECF0C0A9A69D44B3DCA62BECF56, 23CC47FA2D6E183D69DB0D3D3F3081A830D94A58FBC0A9A295B3A56C51E9486A ] swenum C:\Windows\system32\DRIVERS\swenum.sys
22:35:10.0620 0x1354 swenum - ok
22:35:10.0676 0x1354 [ F21FD248040681CCA1FB6C9A03AAA93D, 32FE765841A183A1F2C1ACACBBF8CDB11E7D4D4396F9C9F6CFF1B51C9B620ED3 ] swprv C:\Windows\System32\swprv.dll
22:35:10.0710 0x1354 swprv - ok
22:35:10.0730 0x1354 [ 192AA3AC01DF071B541094F251DEED10, 5C6EB56D1C39F3717EB754A1B37C8A618BA4F2107F64048E985D71FA04D1AD05 ] Symc8xx C:\Windows\system32\drivers\symc8xx.sys
22:35:10.0745 0x1354 Symc8xx - ok
22:35:10.0766 0x1354 [ 8C8EB8C76736EBAF3B13B633B2E64125, A6C4845DDED81CCF4947612A4D6E42035136025BCD80812D2FF396927CAADEC5 ] Sym_hi C:\Windows\system32\drivers\sym_hi.sys
22:35:10.0786 0x1354 Sym_hi - ok
22:35:10.0816 0x1354 [ 8072AF52B5FD103BBBA387A1E49F62CB, D336A7D008D145619E79043EBF5D0D455086BA1FEF89612BC2EA11CC363D82B0 ] Sym_u3 C:\Windows\system32\drivers\sym_u3.sys
22:35:10.0838 0x1354 Sym_u3 - ok
22:35:10.0956 0x1354 [ 9A51B04E9886AA4EE90093586B0BA88D, 1666C29FBFA34174B506678C920636519051D03456A6DDCCD6FF708CAE5D9962 ] SysMain C:\Windows\system32\sysmain.dll
22:35:11.0011 0x1354 SysMain - ok
22:35:11.0047 0x1354 [ 2DCA225EAE15F42C0933E998EE0231C3, 67C7913E41854DFA3043426B7D59AA1FBBB9DE01A6E6904E40A696A7C61A5F98 ] TabletInputService C:\Windows\System32\TabSvc.dll
22:35:11.0063 0x1354 TabletInputService - ok
22:35:11.0097 0x1354 [ D7673E4B38CE21EE54C59EEEB65E2483, 330D0AD13F5008D8569CE8E5EA0BBD69F54F59FEB54FD903FA18D2849CEC6AF0 ] TapiSrv C:\Windows\System32\tapisrv.dll
22:35:11.0127 0x1354 TapiSrv - ok
22:35:11.0175 0x1354 [ CB05822CD9CC6C688168E113C603DBE7, 9DB8945BDC702BB13E9DE477F2D3CCA4CE0E9E8CE9B54CE1A25375F2A2C93F0E ] TBS C:\Windows\System32\tbssvc.dll
22:35:11.0200 0x1354 TBS - ok
22:35:11.0366 0x1354 [ C7B0746FCD576D7EEBA6A2530B0B2966, F8ADAED40AA12BF8427482A00CCF8374458FEA95C3C381AEF59EC057A2791550 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
22:35:11.0443 0x1354 Tcpip - ok
22:35:11.0483 0x1354 [ C7B0746FCD576D7EEBA6A2530B0B2966, F8ADAED40AA12BF8427482A00CCF8374458FEA95C3C381AEF59EC057A2791550 ] Tcpip6 C:\Windows\system32\DRIVERS\tcpip.sys
22:35:11.0557 0x1354 Tcpip6 - ok
22:35:11.0583 0x1354 [ DCFEB82CA988598CEB8F83148616038E, D5ACFD3CCEF1355D524981B85A493E291755BF4D5CCD58F6FBDC738F39811892 ] tcpipBM C:\Windows\system32\drivers\tcpipBM.sys
22:35:11.0593 0x1354 tcpipBM - detected UnsignedFile.Multi.Generic ( 1 )
22:35:11.0843 0x1354 Detect skipped due to KSN trusted
22:35:11.0843 0x1354 tcpipBM - ok
22:35:11.0872 0x1354 [ 608C345A255D82A6289C2D468EB41FD7, 74ECFDD45DC3EB3AFAEF9C42B546241AA1D6ACB2F6591A76DDB8BB1768545889 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
22:35:11.0899 0x1354 tcpipreg - ok
22:35:11.0930 0x1354 [ 5DCF5E267BE67A1AE926F2DF77FBCC56, E00C0A03AEE579B51B39930A72F39F4EFFE7CDA37187B0AE90F4E001AD15473B ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
22:35:11.0955 0x1354 TDPIPE - ok
22:35:11.0975 0x1354 [ 389C63E32B3CEFED425B61ED92D3F021, E4718E290678F00995E754AE66F1027D227BFAB9E1A1D2AC8E4EAD27DC50CB17 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
22:35:12.0011 0x1354 TDTCP - ok
22:35:12.0050 0x1354 [ 76B06EB8A01FC8624D699E7045303E54, EC30F244B48A35622ED3EE91792F6A1517C5A50770FAB3945E7A945EB7AF28A8 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
22:35:12.0085 0x1354 tdx - ok
22:35:12.0096 0x1354 [ 3CAD38910468EAB9A6479E2F01DB43C7, 9D18C71EDF39743A0A592BC0873909D2B75B5B177B2672A865D1EEC0BFD2F61C ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
22:35:12.0126 0x1354 TermDD - ok
22:35:12.0219 0x1354 [ DBD84E59D631569EC3E756EF144E8431, 9E58629EC762584A2D294A619593620626F7CBE467045AD0F920B6CF1D4B4724 ] TermService C:\Windows\System32\termsrv.dll
22:35:12.0258 0x1354 TermService - ok
22:35:12.0309 0x1354 [ C7230FBEE14437716701C15BE02C27B8, 8221DE73D77CF71C2857D78829E807D015D9CB8BDEE4BAFD6950BF0C718CC774 ] Themes C:\Windows\system32\shsvcs.dll
22:35:12.0329 0x1354 Themes - ok
22:35:12.0352 0x1354 [ 1076FFCFFAAE8385FD62DFCB25AC4708, 8C5C106FCB018E019DEBA8E1A6AA170CD7A93293F27994F724EBC486238DA0AA ] THREADORDER C:\Windows\system32\mmcss.dll
22:35:12.0377 0x1354 THREADORDER - ok
22:35:12.0399 0x1354 [ EC74E77D0EB004BD3A809B5F8FB8C2CE, 1E4BBC58D0E35D79C764CF1BA73602C5E29A5A2393D40332801D533E445C6667 ] TrkWks C:\Windows\System32\trkwks.dll
22:35:12.0459 0x1354 TrkWks - ok
22:35:12.0561 0x1354 [ 97D9D6A04E3AD9B6C626B9931DB78DBA, 8E42133ED5EE5EEC414A8B11C1035385C6141E445EA9677F947D20768F25A877 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
22:35:12.0580 0x1354 TrustedInstaller - ok
22:35:12.0611 0x1354 [ F4EAA7ECBCB25DE901C9B7F2CDCDA0B3, 1CBB5106A32362ABDEE73BF170E205FE64DDBF826C5F6DFFCCD229F220B9C85E ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
22:35:12.0658 0x1354 tssecsrv - ok
22:35:12.0687 0x1354 [ CAECC0120AC49E3D2F758B9169872D38, 80DB15ADF5F4FF78D0C7D5081B6C0E8F1E5125872B60D23C19DA8E62C9DAC9A8 ] tunmp C:\Windows\system32\DRIVERS\tunmp.sys
22:35:12.0704 0x1354 tunmp - ok
22:35:12.0711 0x1354 [ 300DB877AC094FEAB0BE7688C3454A9C, 3B36AA191FBE25B1A61150EAA2BDF8BA286DC4C052F6E98B0ED8202135553D8C ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
22:35:12.0729 0x1354 tunnel - ok
22:35:12.0753 0x1354 [ C3ADE15414120033A36C0F293D4A4121, 74A002C4B5EBD94E33EDEACB6639AF44ED72A8DDE3083C6DE71C1EE937EF1A9C ] uagp35 C:\Windows\system32\drivers\uagp35.sys
22:35:12.0778 0x1354 uagp35 - ok
22:35:12.0826 0x1354 [ D9728AF68C4C7693CB100B8441CBDEC6, A2CEE1EE4EF17106349F4E6967F504354801934179FBB3F10B9A4E3C30BC28CE ] udfs C:\Windows\system32\DRIVERS\udfs.sys
22:35:12.0868 0x1354 udfs - ok
22:35:12.0925 0x1354 [ ECEF404F62863755951E09C802C94AD5, 5D92062B3E371F196774EBFE840C78501E55A244DB2A49703C7AC0141C7DABF1 ] UI0Detect C:\Windows\system32\UI0Detect.exe
22:35:12.0954 0x1354 UI0Detect - ok
22:35:12.0976 0x1354 [ 75E6890EBFCE0841D3291B02E7A8BDB0, FDF9CDCCCCC0AA2A52623C5A67AC5F5224557EE4C8F6487CB13CAEB012575E2A ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
22:35:12.0993 0x1354 uliagpkx - ok
22:35:13.0026 0x1354 [ 3CD4EA35A6221B85DCC25DAA46313F8D, 100A7E12B8EA395F70A00874328E87B930CE88FF442F3576FE88B105A22E04C5 ] uliahci C:\Windows\system32\drivers\uliahci.sys
22:35:13.0050 0x1354 uliahci - ok
22:35:13.0065 0x1354 [ 8514D0E5CD0534467C5FC61BE94A569F, A6EFB967044F88335469DB3351587E31CEC659BB6A7D8ED45C68329232C31BB9 ] UlSata C:\Windows\system32\drivers\ulsata.sys
22:35:13.0090 0x1354 UlSata - ok
22:35:13.0119 0x1354 [ 38C3C6E62B157A6BC46594FADA45C62B, 44F87DC955CB4E35E0EB4C8B4E931472B33D97FE000C22370A06AD5EDCEFD0BA ] ulsata2 C:\Windows\system32\drivers\ulsata2.sys
22:35:13.0151 0x1354 ulsata2 - ok
22:35:13.0175 0x1354 [ 32CFF9F809AE9AED85464492BF3E32D2, 91AAA47AEF17F373276B01AC8FA823592A0C854541A7A9A3B78F2350DB964EBC ] umbus C:\Windows\system32\DRIVERS\umbus.sys
22:35:13.0201 0x1354 umbus - ok
22:35:13.0285 0x1354 [ 68308183F4AE0BE7BF8ECD07CB297999, 4444233CA3C42BEE50ED47553D4AE5A7C12D8F288D2FA4B2DAE1D9B9FEC1A72D ] upnphost C:\Windows\System32\upnphost.dll
22:35:13.0323 0x1354 upnphost - ok
22:35:13.0414 0x1354 [ 1114579556DB85E9FAF9590DBC64CD62, 10479A3C12BBBB9B5759082358FE11AC20BAEFA6B4977C8AE6E60AA17BE6C7FA ] usbaudio C:\Windows\system32\drivers\usbaudio.sys
22:35:13.0574 0x1354 usbaudio - ok
22:35:13.0629 0x1354 [ AAB0B5F72D2D726FBFDC895A2902DE1D, 7824AF6E2ADEA23F208526F3A62AD1BACDBBDB23E58EB5806890B0761529C50F ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
22:35:13.0696 0x1354 usbccgp - ok
22:35:13.0759 0x1354 [ E9476E6C486E76BC4898074768FB7131, D14B8F69A511DC1F990A9C123C18689AFE59659BA8130D248D8D03E9BD2143B6 ] usbcir C:\Windows\system32\drivers\usbcir.sys
22:35:13.0814 0x1354 usbcir - ok
22:35:13.0866 0x1354 [ 153E8515CB86F8BB5D1A8B478EBF4BB2, 0F1F79BA7C32ACAAE69184A56E67D6E18E2E2F07E0BE23F266401431169DAE14 ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
22:35:13.0884 0x1354 usbehci - ok
22:35:13.0924 0x1354 [ 2AE6BCEBD85D31317E433733DAF25888, 7B2C0E8703D0275A620160E479166EB7AA31B0F146507603535CEBF0BA4684A4 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
22:35:14.0014 0x1354 usbhub - ok
22:35:14.0061 0x1354 [ D457EBD0C3A8B3A3A144355B5EE91CBC, 6AD52BDBB1607A48F0B02E663B97C3A00E3345B1B12C259608A5AE728C1C06B2 ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys
22:35:14.0087 0x1354 usbohci - ok
22:35:14.0143 0x1354 [ E75C4B5269091D15A2E7DC0B6D35F2F5, B0A4141B69B66276890836DE98EB8BC790D35CE59FA503060593E8CC12AA106B ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
22:35:14.0180 0x1354 usbprint - ok
22:35:14.0218 0x1354 [ 1D714B8497CD68307806D5D3F60A5169, 1914D92ECE39995168E3C8F5A7694B7A94954DB299410A2781D1321C8E60C3D9 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
22:35:14.0265 0x1354 usbscan - ok
22:35:14.0292 0x1354 [ BE3DA31C191BC222D9AD503C5224F2AD, 201FB0FDBF423342202686DC0D8A3221B7798AE04C04A649D3441C257C733CE8 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
22:35:14.0331 0x1354 USBSTOR - ok
22:35:14.0353 0x1354 [ 325DBBACB8A36AF9988CCF40EAC228CC, 22FE5658A12296634FBE9D8565485BEE8CB200C47182F70DC9D2B0442E10C4AA ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
22:35:14.0403 0x1354 usbuhci - ok
22:35:14.0429 0x1354 [ 1509E705F3AC1D474C92454A5C2DD81F, 7F525921A3513224F8B093A16E19B4235B300349A14B0B86EE11B7473BA53337 ] UxSms C:\Windows\System32\uxsms.dll
22:35:14.0456 0x1354 UxSms - ok
22:35:14.0552 0x1354 [ CD88D1B7776DC17A119049742EC07EB4, 6B68B9EDB8C6BCB2644F1F004D5743E928509D12107D996F390A24A72E0AA528 ] vds C:\Windows\System32\vds.exe
22:35:14.0607 0x1354 vds - ok
22:35:14.0629 0x1354 [ 7D92BE0028ECDEDEC74617009084B5EF, D0749CE6FA3415BA4364299F8D6D53F133E8D2F44C6F1057996243415A540A53 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
22:35:14.0671 0x1354 vga - ok
22:35:14.0691 0x1354 [ 2E93AC0A1D8C79D019DB6C51F036636C, 8B6F3B4EE90691A22788915AD0F99D8EE617750430A34E7CEB9AB4FB4E581755 ] VgaSave C:\Windows\System32\drivers\vga.sys
22:35:14.0719 0x1354 VgaSave - ok
22:35:14.0742 0x1354 [ 045D9961E591CF0674A920B6BA3BA5CB, EBF498A0424CEA0F7ECBAAE144A8669CE6B5DD67115DE22CEC5A46AED26CD90B ] viaagp C:\Windows\system32\drivers\viaagp.sys
22:35:14.0758 0x1354 viaagp - ok
22:35:14.0787 0x1354 [ 56A4DE5F02F2E88182B0981119B4DD98, 36FC94BCFD41907838DBCB02E6EA24065FDED4224239CD19E90D14433BE9108B ] ViaC7 C:\Windows\system32\drivers\viac7.sys
22:35:14.0829 0x1354 ViaC7 - ok
22:35:14.0847 0x1354 [ FD2E3175FCADA350C7AB4521DCA187EC, 1C914B184478611A27E0141F90EBC34FC63DFB2A83441DD36DFA43D945FB1C52 ] viaide C:\Windows\system32\drivers\viaide.sys
22:35:14.0861 0x1354 viaide - ok
22:35:14.0938 0x1354 [ 1B0D441D8AB264D39C2B09130CC28045, 15589A3A30B05AAD35152289AAF42CB792198FD15B55D6A7D5E4C1CE58459680 ] VMCService C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
22:35:14.0944 0x1354 VMCService - detected UnsignedFile.Multi.Generic ( 1 )
22:35:15.0127 0x1354 Detect skipped due to KSN trusted
22:35:15.0127 0x1354 VMCService - ok
22:35:15.0144 0x1354 [ 69503668AC66C77C6CD7AF86FBDF8C43, 2CE407674A58313737073F02B9A617460BBA84B36C3A16D98AE5ED45279F5006 ] volmgr C:\Windows\system32\drivers\volmgr.sys
22:35:15.0162 0x1354 volmgr - ok
22:35:15.0220 0x1354 [ 23E41B834759917BFD6B9A0D625D0C28, 9F60992805262F936E8DA33610FDF60A191ECAFC08BBF657C8F9A21833C8EFC5 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
22:35:15.0251 0x1354 volmgrx - ok
22:35:15.0285 0x1354 [ 786DB5771F05EF300390399F626BF30A, 4A07BE5AEDBA4C15C2F9A91250F0488A0B0305C67BB7A037508D5CBF86D4E1B7 ] volsnap C:\Windows\system32\drivers\volsnap.sys
22:35:15.0315 0x1354 volsnap - ok
22:35:15.0343 0x1354 [ D984439746D42B30FC65A4C3546C6829, B134A9890638C2B4964A9C30812A2828A3E0CC641690CBF22D9FCE65EE3C2385 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
22:35:15.0364 0x1354 vsmraid - ok
22:35:15.0559 0x1354 [ DB3D19F850C6EB32BDCB9BC0836ACDDB, D81FF1CDA87A2FE83EFD5B3FE01EFF940952F8BAEE70BEA3B2F6EF30E2121704 ] VSS C:\Windows\system32\vssvc.exe
22:35:15.0701 0x1354 VSS - ok
22:35:15.0775 0x1354 [ 96EA68B9EB310A69C25EBB0282B2B9DE, C76D3427F8A2953CB4D96BBA1523679CBE1BBF7FA821A35D2FBEB3E67AC6A10B ] W32Time C:\Windows\system32\w32time.dll
22:35:15.0806 0x1354 W32Time - ok
22:35:15.0829 0x1354 [ 48DFEE8F1AF7C8235D4E626F0C4FE031, A41D05BC0DA3C476C32E0A4DAF015DF7BADF28A03CE236D5596885FF1772F148 ] WacomPen C:\Windows\system32\drivers\wacompen.sys
22:35:15.0869 0x1354 WacomPen - ok
22:35:15.0899 0x1354 [ 55201897378CCA7AF8B5EFD874374A26, 350ADDCEFAA33E301027CFEA8DDE703F6FBD6E53624598CB2E7B671B9E48F7CC ] Wanarp C:\Windows\system32\DRIVERS\wanarp.sys
22:35:15.0928 0x1354 Wanarp - ok
22:35:15.0938 0x1354 [ 55201897378CCA7AF8B5EFD874374A26, 350ADDCEFAA33E301027CFEA8DDE703F6FBD6E53624598CB2E7B671B9E48F7CC ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
22:35:15.0957 0x1354 Wanarpv6 - ok
22:35:16.0002 0x1354 [ A3CD60FD826381B49F03832590E069AF, 213C5DB5E5D828264286FD7548527566D6160CCA780BC6853B7B28CECF329674 ] wcncsvc C:\Windows\System32\wcncsvc.dll
22:35:16.0075 0x1354 wcncsvc - ok
22:35:16.0102 0x1354 [ 11BCB7AFCDD7AADACB5746F544D3A9C7, 0370E20FD12ED713F94E5CD76F068F7A7A5E7F42416DD2A8A41249020DA7DA31 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
22:35:16.0121 0x1354 WcsPlugInService - ok
22:35:16.0150 0x1354 [ AFC5AD65B991C1E205CF25CFDBF7A6F4, 544173AE85A11B99B9221DB30B6803DAEB3EB7FCA57FE62F0D13EF70B9C69A89 ] Wd C:\Windows\system32\drivers\wd.sys
22:35:16.0166 0x1354 Wd - ok
22:35:16.0203 0x1354 [ 25944D2CC49E0A6C581D02A74B7D6645, AF8FFAFEC07F1A6A3D4008E609E8E1D705A8DFCC7995C766E3946887203F7BEE ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
22:35:16.0276 0x1354 Wdf01000 - ok
22:35:16.0307 0x1354 [ ABFC76B48BB6C96E3338D8943C5D93B5, B5B22D445724D58641A53276063A4AA2A98F07B93865C86E94661EB31BD63511 ] WdiServiceHost C:\Windows\system32\wdi.dll
22:35:16.0331 0x1354 WdiServiceHost - ok
22:35:16.0338 0x1354 [ ABFC76B48BB6C96E3338D8943C5D93B5, B5B22D445724D58641A53276063A4AA2A98F07B93865C86E94661EB31BD63511 ] WdiSystemHost C:\Windows\system32\wdi.dll
22:35:16.0363 0x1354 WdiSystemHost - ok
22:35:16.0410 0x1354 [ 04C37D8107320312FBAE09926103D5E2, 1C6726A9871CBACB240AFA93E57781515F01758D43693DDA395EA683D97234F0 ] WebClient C:\Windows\System32\webclnt.dll
22:35:16.0434 0x1354 WebClient - ok
22:35:16.0509 0x1354 [ AE3736E7E8892241C23E4EBBB7453B60, 0F998116CC07CD719CB237EAE53BB16B2EDD6973828B9C1055EB981AEA0453D1 ] Wecsvc C:\Windows\system32\wecsvc.dll
22:35:16.0559 0x1354 Wecsvc - ok
22:35:16.0583 0x1354 [ 670FF720071ED741206D69BD995EA453, 4B96F5E3545F69AE9EBC75DC4AB27B87306D656EE526AE39E7EC7E2B6F83F7FD ] wercplsupport C:\Windows\System32\wercplsupport.dll
22:35:16.0604 0x1354 wercplsupport - ok
22:35:16.0649 0x1354 [ 32B88481D3B326DA6DEB07B1D03481E7, 821FBAF147E525ED15EB9391B16A96C6D5464841258B11F277EFB57A3BD50E37 ] WerSvc C:\Windows\System32\WerSvc.dll
22:35:16.0671 0x1354 WerSvc - ok
22:35:16.0721 0x1354 [ 4575AA12561C5648483403541D0D7F2B, 2DBB7904285F16E879E1662C4CC4DFAA420D5EB24DDFC4BAC0B7616F5F44649A ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll
22:35:16.0745 0x1354 WinDefend - ok
22:35:16.0755 0x1354 WinHttpAutoProxySvc - ok
22:35:16.0837 0x1354 [ 6B2A1D0E80110E3D04E6863C6E62FD8A, EE8BC7C378993EFE90273764C83119EBF331768CD7B24DE949233C74A51306C2 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
22:35:16.0861 0x1354 Winmgmt - ok
22:35:17.0104 0x1354 [ 7CFE68BDC065E55AA5E8421607037511, C2CE76D52AD4E31FC4216E94457DC16ABF65A5F3E883F0BD97AD387FB7574533 ] WinRM C:\Windows\system32\WsmSvc.dll
22:35:17.0315 0x1354 WinRM - ok
22:35:17.0407 0x1354 [ C008405E4FEEB069E30DA1D823910234, C392A7B5FEACB7D11A3A231C1AD65D533984E6E7429ECD3BFBF90A27E8DEB157 ] Wlansvc C:\Windows\System32\wlansvc.dll
22:35:17.0462 0x1354 Wlansvc - ok
22:35:17.0526 0x1354 [ 701A9F884A294327E9141D73746EE279, C8A46B8C32F9EAC7848D385473F6B5C4B6DA719A941A75AD5F081757FC07A09D ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
22:35:17.0577 0x1354 WmiAcpi - ok
22:35:17.0617 0x1354 [ 43BE3875207DCB62A85C8C49970B66CC, 27169F2E8A30807794407DA8F80611E4287F940AAE2A1F00F547901872FB9703 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
22:35:17.0636 0x1354 wmiApSrv - ok
22:35:17.0857 0x1354 [ 3978704576A121A9204F8CC49A301A9B, 936CC13B90A183613BDA4081556C96D48CA415B5F65D61E18CB5F2E51EEBE59F ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
22:35:18.0043 0x1354 WMPNetworkSvc - ok
22:35:18.0072 0x1354 [ CFC5A04558F5070CEE3E3A7809F3FF52, 45899E04000E21C4E009BE8B6149F199A5B2E0512C657A525770BF9DBFED7D2B ] WPCSvc C:\Windows\System32\wpcsvc.dll
22:35:18.0098 0x1354 WPCSvc - ok
22:35:18.0140 0x1354 [ 801FBDB89D472B3C467EB112A0FC9246, C24053FA12732089384D3AF06C676FF201D282FC5AD56A42B6EE8BAED4379CB2 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
22:35:18.0170 0x1354 WPDBusEnum - ok
22:35:18.0242 0x1354 [ DE9D36F91A4DF3D911626643DEBF11EA, 8029ECE76E29276BFB6ED3387AC560A9A779AAF683A4416E96334FAF7BDBADA0 ] WpdUsb C:\Windows\system32\DRIVERS\wpdusb.sys
22:35:18.0263 0x1354 WpdUsb - ok
22:35:18.0396 0x1354 [ F8D3544ACBCE9110362119F7C10D848E, 31C49201A931751A36286874AC0B929D886F490D7CE48CCC9283850A56AD9FD9 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
22:35:18.0524 0x1354 WPFFontCache_v0400 - ok
22:35:18.0574 0x1354 [ E3A3CB253C0EC2494D4A61F5E43A389C, 10BA8B102E31B961819E524FCA5FA817B588EC77FB26B4E176D0A5CFF11EDF79 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
22:35:18.0600 0x1354 ws2ifsl - ok
22:35:18.0641 0x1354 [ 1CA6C40261DDC0425987980D0CD2AAAB, 727C1E3A170316641F832A8D197EDA6D6EE1206E4ED7B741E5A4017B7F2F7B88 ] wscsvc C:\Windows\System32\wscsvc.dll
22:35:18.0655 0x1354 wscsvc - ok
22:35:18.0660 0x1354 WSearch - ok
22:35:18.0963 0x1354 [ FC3EC24FCE372C89423E015A2AC1A31E, 8D028182CF83667D3E4D148979972D208FA6D9B8540EE47A0A7831B770ECD257 ] wuauserv C:\Windows\system32\wuaueng.dll
22:35:19.0165 0x1354 wuauserv - ok
22:35:19.0219 0x1354 [ 06E6F32C8D0A3F66D956F57B43A2E070, 9A6BD96A28294B0372F16E13D652FD603308F64B74A56E41E0C68C5E8011F943 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
22:35:19.0238 0x1354 WudfPf - ok
22:35:19.0274 0x1354 [ 867C301E8B790040AE9CF6486E8041DF, D867D6498C987944D99508B2FAD6D6B749FA1EDFE8124B0863D4A642352F0855 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
22:35:19.0290 0x1354 WUDFRd - ok
22:35:19.0317 0x1354 [ FE47B7BC8EA320C2D9B5E5BF6E303765, 34518DBD1E9EA6E5DA62273B18613761E1D9C6B4E074A93C6D639FBAF02222EA ] wudfsvc C:\Windows\System32\WUDFSvc.dll
22:35:19.0333 0x1354 wudfsvc - ok
22:35:19.0383 0x1354 [ 7927E830ECDE6DB3682CC319BAD26984, BB7C1A902555C4A7F818A4BFD091162BE97A7310241E107CB86BDCBCD5966777 ] yukonwlh C:\Windows\system32\DRIVERS\yk60x86.sys
22:35:19.0447 0x1354 yukonwlh - ok
22:35:19.0532 0x1354 [ 8903C6979EA677A9AF3D36E0D3709203, 048C5806CB96D228CC099AD5D396A7BCAFFD22DA3B13AFB014ECCC7998CD737A ] {49DE1C67-83F8-4102-99E0-C16DCC7EEC796} C:\Program Files\Acer Arcade Live\Acer PlayMovie\000.fcl
22:35:19.0543 0x1354 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796} - ok
22:35:19.0561 0x1354 ================ Scan global ===============================
22:35:19.0593 0x1354 [ F31EEBC1A1C81FD04005489CC3DCDFE7, 098C35ACFCCE1686C5A6DB6057001CBF8B06A863A0802CB2E9D793F4795F8CEE ] C:\Windows\system32\basesrv.dll
22:35:19.0625 0x1354 [ A508314231C49AEE86987CEA3EAECAD1, D29BCFA967C23C7264592576D62D95FA8C687E8662D19DCCC73653A9EFB6340D ] C:\Windows\system32\winsrv.dll
22:35:19.0653 0x1354 [ A508314231C49AEE86987CEA3EAECAD1, D29BCFA967C23C7264592576D62D95FA8C687E8662D19DCCC73653A9EFB6340D ] C:\Windows\system32\winsrv.dll
22:35:19.0727 0x1354 [ D4E6D91C1349B7BFB3599A6ADA56851B, 8748091BF27F05D28D45688E04DD9229A4B2E159209A64F457703F66A8CECE4D ] C:\Windows\system32\services.exe
22:35:19.0736 0x1354 [ Global ] - ok
22:35:19.0737 0x1354 ================ Scan MBR ==================================
22:35:19.0752 0x1354 [ A863475757CC50891AA8458C415E4B25 ] \Device\Harddisk0\DR0
22:35:22.0198 0x1354 \Device\Harddisk0\DR0 - ok
22:35:22.0198 0x1354 ================ Scan VBR ==================================
22:35:22.0221 0x1354 [ 6253D5A19397FD34D2984A6A6AAC3A7E ] \Device\Harddisk0\DR0\Partition1
22:35:22.0283 0x1354 \Device\Harddisk0\DR0\Partition1 - ok
22:35:22.0297 0x1354 [ 6C9812107BE35DB2BE22E247E18AB385 ] \Device\Harddisk0\DR0\Partition2
22:35:22.0335 0x1354 \Device\Harddisk0\DR0\Partition2 - ok
22:35:22.0335 0x1354 ================ Scan generic autorun ======================
22:35:22.0397 0x1354 [ 0D392EDE3B97E0B3131B2F63EF1DB94E, 3EDA280F91097293E00BF984D377E1111CFDE1FC81B30A3FDEB38F321EF82BB6 ] C:\Program Files\Windows Defender\MSASCui.exe
22:35:22.0473 0x1354 Windows Defender - ok
22:35:22.0677 0x1354 [ A659F31AC25418738351E5BDF4C85780, 771CB4EEFAA83DD7319165483869688C69D76349526953FDE5D973945B6CC337 ] C:\Windows\RtHDVCpl.exe
22:35:22.0941 0x1354 RtHDVCpl - ok
22:35:23.0161 0x1354 [ 7FA32987062D2DF4D897EDE27B079724, 1CFEBF02F04024AA1CE0674F4CD621D25DB185852DD3FB3C77783F77281E715A ] C:\Acer\Empowering Technology\SysMonitor.exe
22:35:23.0178 0x1354 Acer Empowering Technology Monitor - detected UnsignedFile.Multi.Generic ( 1 )
22:35:23.0430 0x1354 Detect skipped due to KSN trusted
22:35:23.0430 0x1354 Acer Empowering Technology Monitor - ok
22:35:23.0489 0x1354 [ 0921A68E8FE9B25DD0EFFAB949376B5F, 4C09C325249BD550CCFAAF16A8B215C787B58748E4807D84976847AE88BE32FB ] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
22:35:23.0516 0x1354 eDataSecurity Loader - ok
22:35:23.0732 0x1354 [ D373E15EB5E2E463EF01CF7BD8D7A1DF, C3422CC25E3591F3A65CE58CE1187A93AA6F71D2976BB67A604473E3C998BEE1 ] C:\Windows\Skytel.exe
22:35:23.0881 0x1354 Skytel - ok
22:35:23.0928 0x1354 [ D25897EBC9D68C7C9B0F95DA47D7E373, 28E18E1C9E5B41AA4C883057E7AF6DF3E0179AF36B7B52188AC79F65F70F289B ] C:\Program Files\Acer Arcade Live\Acer PlayMovie\PMVService.exe
22:35:23.0946 0x1354 PlayMovie - detected UnsignedFile.Multi.Generic ( 1 )
22:35:24.0128 0x1354 Detect skipped due to KSN trusted
22:35:24.0128 0x1354 PlayMovie - ok
22:35:24.0215 0x1354 [ BBADDD291165F398BA4F058287175209, B0F07879DA75CB4027A1EAD18C5E055362E73112CF7E8D6CCE672DDCD9A09F69 ] C:\Acer\WR_PopUp\WarReg_PopUp.exe
22:35:24.0228 0x1354 WarReg_PopUp - detected UnsignedFile.Multi.Generic ( 1 )
22:35:24.0408 0x1354 Detect skipped due to KSN trusted
22:35:24.0408 0x1354 WarReg_PopUp - ok
22:35:24.0482 0x1354 [ 033FF248550305ED52ED2D2844A8A11B, 428AF0600C7658E64C851A8CA1E34208B41FA61CC048A5DC0834C3A2D49F3375 ] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
22:35:24.0496 0x1354 StartCCC - detected UnsignedFile.Multi.Generic ( 1 )
22:35:24.0749 0x1354 Detect skipped due to KSN trusted
22:35:24.0749 0x1354 StartCCC - ok
22:35:24.0806 0x1354 [ 8ABC91FCD511FE7A9367AA3286D8FACF, A4668DF45752CB7FF379FDD01FC0B22CF58846AD43F60923ACAB76AB15B9233A ] C:\Acer\AcerTour\Reminder.exe
22:35:24.0823 0x1354 Acer Tour Reminder - detected UnsignedFile.Multi.Generic ( 1 )
22:35:25.0098 0x1354 Detect skipped due to KSN trusted
22:35:25.0098 0x1354 Acer Tour Reminder - ok
22:35:25.0253 0x1354 [ 38D198A2DD54A67120040566A38103BA, 01604BD91A5B2C0DDC7B52036511F8219952626716E75979D8464F2C56BA0114 ] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
22:35:25.0262 0x1354 GrooveMonitor - ok
22:35:25.0344 0x1354 [ 2B9B417854E1E4829C0BD1D0D69B291B, 1A08B8955334F5EE57DE1B672B05B6D538FD67B2CD51427775171BC7C16B2110 ] C:\Program Files\PDF24\pdf24.exe
22:35:25.0356 0x1354 PDFPrint - ok
22:35:25.0501 0x1354 [ D1A7A7D193A0DDBF31F53610DBA05CAC, 9A122D90081C7AE4A58D409BF6FB128AC828E31E50476590F6850F42AA93CB0C ] C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
22:35:25.0524 0x1354 Ad-Aware Browsing Protection - ok
22:35:25.0930 0x1354 [ 9E3F8CDD3911D4BE824E094E6953CE4A, FB8D8929BFB3C55F0B34CF9A345C7943284FC95879A1543C6E8E49FAFDDCCB50 ] C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
22:35:26.0088 0x1354 ApnTBMon - ok
22:35:26.0422 0x1354 [ 9C2E66D8A9D40C4661943B235E3E5AFB, AC39141C37746AB16BB0F49D575664858AC72120F17361B01042A31102F07FF9 ] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
22:35:26.0647 0x1354 MobileConnect - detected UnsignedFile.Multi.Generic ( 1 )
22:35:26.0823 0x1354 Detect skipped due to KSN trusted
22:35:26.0823 0x1354 MobileConnect - ok
22:35:27.0270 0x1354 [ 3E23D1F7E91627DBD44AC82077E2BA7C, 09235370B85EF5FEA24F1291B9ADAD805C8D7357A78EF8CE3BA0E913F59145EC ] C:\Program Files\Avira\Antivirus\avgnt.exe
22:35:27.0311 0x1354 avgnt - ok
22:35:27.0401 0x1354 [ 9E35FF7F943AE0FB89192BFE058B7FD4, 54712A4FA296AE28CF834F90B77B2EEB69020E3D5B5CF24674BD8DACA25195B9 ] C:\Program Files\Windows Sidebar\Sidebar.exe
22:35:27.0559 0x1354 Sidebar - ok
22:35:27.0565 0x1354 WindowsWelcomeCenter - ok
22:35:27.0657 0x1354 [ 9E35FF7F943AE0FB89192BFE058B7FD4, 54712A4FA296AE28CF834F90B77B2EEB69020E3D5B5CF24674BD8DACA25195B9 ] C:\Program Files\Windows Sidebar\Sidebar.exe
22:35:27.0736 0x1354 Sidebar - ok
22:35:27.0743 0x1354 WindowsWelcomeCenter - ok
22:35:27.0834 0x1354 [ 9E35FF7F943AE0FB89192BFE058B7FD4, 54712A4FA296AE28CF834F90B77B2EEB69020E3D5B5CF24674BD8DACA25195B9 ] C:\Program Files\Windows Sidebar\sidebar.exe
22:35:27.0933 0x1354 Sidebar - ok
22:35:27.0999 0x1354 [ BF08674925F151BD4537B89A493E3E0C, 6A97562E998A2B90649FF7986313AD33823053FF98BBE163AD39AAA5E01FC545 ] C:\Windows\ehome\ehTray.exe
22:35:28.0021 0x1354 ehTray.exe - ok
22:35:28.0097 0x1354 [ 3D317EAF8AF0EA10306D2E8C67A881ED, D0406C963232C33D7453D1BAD4A53E94442B349825575663BB59176E3D5A23FC ] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
22:35:28.0108 0x1354 PhotoShow Deluxe Media Manager - detected UnsignedFile.Multi.Generic ( 1 )
22:35:28.0408 0x1354 PhotoShow Deluxe Media Manager ( UnsignedFile.Multi.Generic ) - warning
22:35:28.0685 0x1354 Skype - ok
22:35:28.0771 0x1354 [ 1D88FDD3AF68CECCFDB8B916C55509CB, 003DD56006235220F1A6D48144EBD64996805984C410CBA95D390A316D3EB15E ] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_TATINFE.EXE
22:35:28.0786 0x1354 EPLTarget\P0000000000000000 - ok
22:35:28.0929 0x1354 [ EEA6332ADF062AC5B24535C098DF1F3C, 91969C7BEBEDA1CA5B49324A1A63CD309DBAD2CB9970B041665F98B0ADC779E6 ] C:\Program Files\Garmin\Express Tray\ExpressTray.exe
22:35:28.0971 0x1354 GarminExpressTrayApp - ok
22:35:28.0973 0x1354 Waiting for KSN requests completion. In queue: 76
22:35:29.0987 0x1354 AV detected via SS2: Avira Antivirus, C:\Program Files\Avira\Antivirus\wsctool.exe ( 15.0.9.460 ), 0x41010 ( enabled : outofdate )
22:35:29.0992 0x1354 Win FW state via NFP2: enabled
22:35:30.0161 0x1354 ============================================================
22:35:30.0161 0x1354 Scan finished
22:35:30.0161 0x1354 ============================================================
22:35:30.0176 0x1734 Detected object count: 1
22:35:30.0176 0x1734 Actual detected object count: 1
22:35:58.0493 0x1734 PhotoShow Deluxe Media Manager ( UnsignedFile.Multi.Generic ) - skipped by user
22:35:58.0493 0x1734 PhotoShow Deluxe Media Manager ( UnsignedFile.Multi.Generic ) - User select action: Skip
/CODE]

Hallo,
ich habe die beiden Programme (Avast und Ad-Aware deinstalliert. Die Reports von tdsskiller vor und nach einem Neustart habe ich wie beauftragt in den Code Tags verstaut. Ich hoffe das war alles richtig so.
Alles noch während dem Bayerspiel im TV.
Erst mal schönen Dank für deine Bemühingen Mathias

Hallo Mathias,
ich habe am Anfang noch vergessen mitzuteilen: Der Drucker Epson XP 225 ist nicht ansprechbar und läßt sich auch nicht neu installieren.
Ich habe jetzt auch die defogger_disable.log gefunde. Ich werde sie dir und die Gmer.txt über Code-tag zukommen lassen. ich hoffe, dass ist in deinem Interesse.
Ich hoffe du kannst damit was anfangen.

Gruß mannivo

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:18 on 21/04/2015 (PC)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-04-21 19:57:10
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST3500830AS rev.3.AAD 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\PC\AppData\Local\Temp\pgtdapoc.sys


---- System - GMER 2.1 ----

SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwAddBootEntry [0x92B35ACC]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                               ZwAllocateVirtualMemory [0x93018464]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwAssignProcessToJobObject [0x92B365AA]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwCreateEvent [0x92B426A0]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwCreateEventPair [0x92B426EC]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwCreateIoCompletion [0x92B42886]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwCreateMutant [0x92B4260E]
SSDT            8C0C422E                                                                                             ZwCreateSection
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwCreateSemaphore [0x92B42656]
SSDT            8C0C4206                                                                                             ZwCreateSymbolicLinkObject
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                               ZwCreateThread [0x93018ACE]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwCreateTimer [0x92B42840]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwDebugActiveProcess [0x92B37398]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwDeleteBootEntry [0x92B35B32]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                               ZwDuplicateObject [0x93018CBC]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                               ZwFreeVirtualMemory [0x9301853C]
SSDT            8C0C420B                                                                                             ZwLoadDriver
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                               ZwMapViewOfSection [0x9301891E]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwModifyBootEntry [0x92B35B98]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwNotifyChangeKey [0x92B3AFE0]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwNotifyChangeMultipleKeys [0x92B37EDC]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwOpenEvent [0x92B426CA]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwOpenEventPair [0x92B4270E]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwOpenIoCompletion [0x92B428AA]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwOpenMutant [0x92B42634]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwOpenProcess [0x92B3A4E2]
SSDT            8C0C4201                                                                                             ZwOpenSection
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwOpenSemaphore [0x92B4267E]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwOpenThread [0x92B3A8CE]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwOpenTimer [0x92B42864]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                               ZwProtectVirtualMemory [0x930186BC]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwQueryObject [0x92B37CF4]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwQueueApcThread [0x92B3784A]
SSDT            8C0C4238                                                                                             ZwRequestWaitReplyPort
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwSetBootEntryOrder [0x92B35BFE]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwSetBootOptions [0x92B35C64]
SSDT            8C0C4233                                                                                             ZwSetContextThread
SSDT            8C0C423D                                                                                             ZwSetSecurityObject
SSDT            8C0C4210                                                                                             ZwSetSystemInformation
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwSetSystemPowerState [0x92B3598A]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwShutdownSystem [0x92B35918]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwSuspendProcess [0x92B37562]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwSuspendThread [0x92B376C4]
SSDT            8C0C4242                                                                                             ZwSystemDebugControl
SSDT            8C0C41CF                                                                                             ZwTerminateProcess
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwTerminateThread [0x92B371F2]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                               ZwUnloadDriver [0x93015906]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                              ZwVdmControl [0x92B35CCA]
SSDT            8C0C41CA                                                                                             ZwWriteVirtualMemory
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                               ZwCreateThreadEx [0x93018BB8]

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!KeSetEvent + 10D                                                                        824AF6D0 4 Bytes  [CC, 5A, B3, 92] {INT 3 ; POP EDX; MOV BL, 0x92}
.text           ntkrnlpa.exe!KeSetEvent + 131                                                                        824AF6F4 4 Bytes  [64, 84, 01, 93] {TEST [FS:ECX], AL; XCHG EBX, EAX}
.text           ntkrnlpa.exe!KeSetEvent + 191                                                                        824AF754 4 Bytes  [AA, 65, B3, 92] {STOSB ; MOV BL, 0x92}
.text           ntkrnlpa.exe!KeSetEvent + 1D1                                                                        824AF794 8 Bytes  [A0, 26, B4, 92, EC, 26, B4, ...] {MOV AL, [0xec92b426]; MOV AH, 0x92}
.text           ntkrnlpa.exe!KeSetEvent + 1DD                                                                        824AF7A0 4 Bytes  [86, 28, B4, 92] {XCHG [EAX], CH; MOV AH, 0x92}
.text           ...                                                                                                  
PAGE            ntkrnlpa.exe!ZwReplyWaitReceivePortEx + 110                                                          8263D07F 4 Bytes  CALL 92B385C3 \SystemRoot\system32\drivers\aswSnx.sys
PAGE            ntkrnlpa.exe!ZwAlpcSendWaitReceivePort + 121                                                         82640CF3 4 Bytes  CALL 92B385D9 \SystemRoot\system32\drivers\aswSnx.sys
                C:\Program Files\Acer Arcade Live\Acer PlayMovie\000.fcl                                             entry point in "" section [0xB0286000]
.clc            C:\Program Files\Acer Arcade Live\Acer PlayMovie\000.fcl                                             unknown last section [0xB0287000, 0x1000, 0x00000000]

---- User code sections - GMER 2.1 ----

.text           C:\Program Files\AVAST Software\Avast\AvastUI.exe[3056] kernel32.dll!SetUnhandledExceptionFilter     762FA9BD 8 Bytes  [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP }

---- User IAT/EAT - GMER 2.1 ----

IAT             C:\Windows\Explorer.EXE[2028] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                [74857817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19299_none_9e595caeca0ff663\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[2028] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                 [74895EFD] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19299_none_9e595caeca0ff663\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[2028] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]             [7485BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19299_none_9e595caeca0ff663\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[2028] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]       [7484F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19299_none_9e595caeca0ff663\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[2028] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                 [748575E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19299_none_9e595caeca0ff663\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[2028] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]              [7484E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19299_none_9e595caeca0ff663\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[2028] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]  [748A92D5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19299_none_9e595caeca0ff663\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[2028] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]     [7485DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19299_none_9e595caeca0ff663\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[2028] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]             [7484FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19299_none_9e595caeca0ff663\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[2028] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]              [7484FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19299_none_9e595caeca0ff663\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[2028] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]               [748471CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19299_none_9e595caeca0ff663\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[2028] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]       [748DCB4D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19299_none_9e595caeca0ff663\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[2028] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]          [7487C840] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19299_none_9e595caeca0ff663\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[2028] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]             [7484D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19299_none_9e595caeca0ff663\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[2028] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                       [74846853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19299_none_9e595caeca0ff663\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[2028] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                      [7484687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19299_none_9e595caeca0ff663\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[2028] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]         [74852AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19299_none_9e595caeca0ff663\gdiplus.dll

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\tdx \Device\Tcp                                                                              tcpipBM.SYS
AttachedDevice  \Driver\tdx \Device\Udp                                                                              aswTdi.sys

---- Disk sectors - GMER 2.1 ----

Disk            \Device\Harddisk0\DR0                                                                                unknown MBR code

---- EOF - GMER 2.1 ----
         

Servus,


welche zwei AV-Programme hast du deinstalliert?



Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

• Starte bitte die mbar.exe.
• Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
• Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
• Klicke auf den CleanUp Button und erlaube den Neustart.
• Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
• Nach dem Neustart starte die mbar.exe erneut.
• Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Hallo,
deinstalliert habe ich Avast und Ad Aware. Antivir ist nun der einzige verbliebene Virenscanner.
So ich habe auch mbar installiert und laufen lassen. Beim erstenmal hat er folgendes gefunden: Infected:C:\Recycle Bin -->[Trojan-Spyeyes].
Er hat aber nicht nach dem Cleanup einen Neustart verlangt. Ich habe den dann nach ca. 10 minuten selber gemacht und danach mbar nochmal durchlaufen lassen, dann hat er allerdings nichts mehr gefunden. Ich möchte noch anmerken, nachdem ich auf den Updatbutten geklickt habe meldete er: Failed: Host not fund . Der grüne Balken ist aber durchgelaufen. Die Meldung hat er bei beiden Durchläufen ausgegeben.
Was mir noch aufgefallen ist, wenn der Curser ruhig auf dem Desktop verweilt macht er ständig zuckungen und dieser grünblaue Ring erscheint ständig und verschwindet wieder. Ich weiß nicht ob dies etwas zu sagen hat.
So weit so gut. Wie geht es jetzt weiter?

Gruß mannivo

Hallo nochmal.
Ich habe gerade erst den letzten Satz von dir entdeckt und gesehen, dass ich die Logdatei hätte übermitteln sollen. Schitt nun ist sie weg. Endschuldige ich hab`s übersehen.

Gruss mannivo

Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org

Database version:
  main:    v2014.11.18.05
  rootkit: v2014.11.12.01

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19607
PC :: PC-PC [administrator]

22.04.2015 19:35:55
mbar-log-2015-04-22 (19-35-55).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 289966
Time elapsed: 15 minute(s), 8 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 1
C:\Recycle.Bin (Trojan.Spyeyes) -> Delete on reboot. [57e6d26bde9e05318d90f11316ed3cc4]

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
         

Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org

Database version:
  main:    v2014.11.18.05
  rootkit: v2014.11.12.01

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19607
PC :: PC-PC [administrator]

22.04.2015 20:07:34
mbar-log-2015-04-22 (20-07-34).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 289666
Time elapsed: 15 minute(s), 8 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
         

Hat doch noch geklappt

Servus,



dann bitte jetzt ComboFix ausführen:

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

So,hier kommt die ComboFix Logdatei. Allerdings hat ads Programm nicht nach einem Neustart verlangt, nachdem es die Logdatei erstellt hat. Ich habe eine ganze zeit gewartet, aber es zeigte nur Immer diese logdatei an. Dann habe ich den Neustart eingeleited. Ich hoffe, dass dies so richtig war, aber geschadet hat es wohl auch nicht.
Noch eine Frage, wie schaffe ich es,damit in der liste der neuen berichte auch meine auftauchen?

mannivo

ComboFix 15-04-19.01 - PC 23.04.2015  20:05:56.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3327.1762 [GMT 2:00]
ausgeführt von:: c:\users\PC\Desktop\ComboFix.exe
AV: Avira Antivirus *Disabled/Outdated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Antivirus *Disabled/Outdated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-03-23 bis 2015-04-23  ))))))))))))))))))))))))))))))
.
.
2015-04-23 18:13 . 2015-04-23 18:13	--------	d-----w-	c:\users\Default\AppData\Local\temp
2015-04-22 17:35 . 2015-04-22 17:35	--------	d-----w-	c:\programdata\Malwarebytes
2015-04-22 17:35 . 2015-04-22 18:22	--------	d-----w-	c:\programdata\Malwarebytes' Anti-Malware (portable)
2015-04-22 17:35 . 2015-04-22 18:07	119512	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-04-22 17:33 . 2015-04-22 18:05	92888	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2015-04-21 17:21 . 2015-04-21 17:26	--------	d-----w-	C:\FRST
2015-04-19 12:24 . 2015-04-19 12:24	--------	d-----w-	c:\users\PC\AppData\Roaming\FLEXnet
2015-04-19 11:00 . 2015-04-19 11:00	--------	d-----w-	c:\users\PC\Neuer Ordner
2015-04-17 19:54 . 2015-04-17 19:55	--------	d-----w-	c:\windows\system32\vbox
2015-04-17 19:50 . 2015-04-21 20:28	--------	d-----w-	c:\programdata\AVAST Software
2015-04-17 19:34 . 2014-02-24 22:00	342528	----a-w-	c:\windows\system32\esw2ud.dll
2015-04-17 19:34 . 2012-05-16 22:00	126128	----a-w-	c:\windows\system32\escsvc.exe
2015-04-17 15:56 . 2015-04-17 15:56	--------	d-----w-	c:\users\PC\AppData\Roaming\Avira
2015-04-17 15:55 . 2015-03-24 12:59	37352	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2015-04-17 15:55 . 2015-03-24 12:59	136216	----a-w-	c:\windows\system32\drivers\avipbb.sys
2015-04-17 15:55 . 2015-03-24 12:59	105864	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2015-04-17 15:28 . 2015-04-17 15:28	--------	d-----w-	C:\OETemp
2015-04-14 19:26 . 2015-04-16 02:17	--------	d-----w-	c:\users\PC\{8680f3f1-d5a4-4f00-bcba-04d3bbe2ac43}
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-03-06 04:01 . 2015-03-12 21:16	279040	----a-w-	c:\windows\system32\schannel.dll
2015-02-26 02:01 . 2015-03-12 21:18	3604408	----a-w-	c:\windows\system32\ntkrnlpa.exe
2015-02-26 02:01 . 2015-03-12 21:18	3552184	----a-w-	c:\windows\system32\ntoskrnl.exe
2015-02-26 00:18 . 2015-03-12 21:30	2064384	----a-w-	c:\windows\system32\win32k.sys
2015-02-20 02:03 . 2015-03-12 21:19	34304	----a-w-	c:\windows\system32\atmlib.dll
2015-02-20 00:28 . 2015-03-12 21:19	296960	----a-w-	c:\windows\system32\atmfd.dll
2015-02-13 01:01 . 2015-03-11 16:57	916992	----a-w-	c:\windows\system32\wininet.dll
2015-02-13 01:01 . 2015-03-11 16:57	420864	----a-w-	c:\windows\system32\vbscript.dll
2015-02-13 01:01 . 2015-03-11 16:57	43520	----a-w-	c:\windows\system32\licmgr10.dll
2015-02-13 01:01 . 2015-03-11 16:57	1469440	----a-w-	c:\windows\system32\inetcpl.cpl
2015-02-13 01:01 . 2015-03-11 16:57	71680	----a-w-	c:\windows\system32\iesetup.dll
2015-02-13 01:01 . 2015-03-11 16:57	109056	----a-w-	c:\windows\system32\iesysprep.dll
2015-02-13 01:01 . 2015-03-11 16:57	19456	----a-w-	c:\windows\system32\corpol.dll
2015-02-12 23:31 . 2015-03-11 16:57	385024	----a-w-	c:\windows\system32\html.iec
2015-02-12 23:24 . 2015-03-11 16:57	133632	----a-w-	c:\windows\system32\ieUnatt.exe
2015-02-12 23:24 . 2015-03-11 16:57	1638912	----a-w-	c:\windows\system32\mshtml.tlb
2015-02-10 12:23 . 2013-11-01 18:44	96680	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2015-02-10 12:23 . 2015-02-10 12:25	897960	----a-w-	c:\windows\system32\npdeployJava1.dll
2015-02-10 12:23 . 2015-02-10 12:25	818088	----a-w-	c:\windows\system32\deployJava1.dll
2015-02-09 21:05 . 2012-12-23 14:39	71344	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2015-02-09 21:05 . 2012-12-23 14:39	701616	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2015-02-08 20:39 . 2015-02-08 20:39	8464	----a-w-	c:\windows\system32\SpOrder.dll
2015-01-29 01:35 . 2015-03-12 21:31	369664	----a-w-	c:\windows\system32\WMPhoto.dll
2015-01-29 01:35 . 2015-03-12 21:30	975360	----a-w-	c:\windows\system32\WindowsCodecs.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"PhotoShow Deluxe Media Manager"="c:\progra~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe" [2005-02-01 163840]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2015-01-23 31087200]
"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\W32X86\3\E_TATINFE.EXE" [2013-12-16 262208]
"GarminExpressTrayApp"="c:\program files\Garmin\Express Tray\ExpressTray.exe" [2015-01-28 688984]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 4669440]
"Acer Empowering Technology Monitor"="c:\acer\Empowering Technology\SysMonitor.exe" [2007-01-24 319488]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-06 464168]
"Skytel"="Skytel.exe" [2007-06-15 1826816]
"PlayMovie"="c:\program files\Acer Arcade Live\Acer PlayMovie\PMVService.exe" [2007-07-13 178280]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"PDFPrint"="c:\program files\PDF24\pdf24.exe" [2011-02-01 220552]
"Ad-Aware Browsing Protection"="c:\programdata\Ad-Aware Browsing Protection\adawarebp.exe" [2013-09-27 559696]
"ApnTBMon"="c:\program files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2015-04-06 2005896]
"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2009-09-11 2403840]
"avgnt"="c:\program files\Avira\Antivirus\avgnt.exe" [2015-03-24 726320]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552]
.
c:\users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2006-10-26 98632]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe 9999 [2007-5-7 528384]
PCM Media Sharing.lnk - c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe [2007-5-7 200812]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
S2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2007-04-04 266343]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - BMLoad
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2015-04-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-23 21:05]
.
2015-04-23 c:\windows\Tasks\EPSON XP-225 Series Update {1998D3F2-57DE-4F62-A20D-6554C0D76ED6}.job
- c:\windows\system32\spool\DRIVERS\W32X86\3\E_TTSNFE.EXE [2015-02-25 16:30]
.
2015-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-02 10:47]
.
2015-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-02 10:47]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = about:blank
mWindow Title = Vodafone AG & Co. KG
uSearchURL,(Default) = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/su/*hxxp://de.yahoo.com
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\program files\Avira\Antivirus\avsda.dll
LSP: bmnet.dll
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q=
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/
FF - ExtSQL: !HIDDEN! 2010-07-22 16:28; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
pref('extensions.shownSelectionUI',true);
pref('extensions.autoDisableScopes',0);
.
.
------- Dateityp-Verknüpfung -------
.
inifile="%SystemRoot%\system32\NOTEPAD.EXE" %1
txtfile="%SystemRoot%\system32\NOTEPAD.EXE" %1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
HKCU-Run-Acer Tour Reminder - (no file)
HKLM-Run-Acer Tour - (no file)
HKLM-Run-eRecoveryService - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2015-04-23 20:14
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Live\Acer PlayMovie\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(688)
c:\windows\system32\bmnet.dll
.
- - - - - - - > 'Explorer.exe'(3624)
c:\windows\system32\MsnChatHook.dll
c:\windows\system32\ShowErrMsg.dll
c:\windows\system32\sysenv.dll
c:\windows\system32\BatchCrypto.dll
c:\windows\system32\CryptoAPI.dll
c:\windows\system32\keyManager.dll
.
Zeit der Fertigstellung: 2015-04-23  20:21:09
ComboFix-quarantined-files.txt  2015-04-23 18:21
.
Vor Suchlauf: 14 Verzeichnis(se), 158.374.199.296 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 158.318.854.144 Bytes frei
.
- - End Of File - - 6820F0D3A840C69B14962C91D52ED5D0
A863475757CC50891AA8458C415E4B25
         

Zitat von mannivo

Noch eine Frage, wie schaffe ich es,damit in der liste der neuen berichte auch meine auftauchen?

Meinst du mit "berichte" den Link "Neue Beiträge", der schwarz hinterlegt ist?




Schritt 1
Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2
Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 3

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Schritt 4

• Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Scan.
• FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
• Poste mir beide Logdateien mit deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort

• die Logdatei von AdwCleaner,
• die Logdatei von MBAM,
• die Logdatei von JRT,
• die beiden neuen Logdateien von FRST.

Hallo,
hier kommen deine gewünschten Log`s.
Erstmal: Adwre Cleaner.

# AdwCleaner v4.201 - Bericht erstellt 23/04/2015 um 22:07:24
# Aktualisiert 08/04/2015 von Xplode
# Datenbank : 2015-04-08.1 [Lokal]
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (x86)
# Benutzername : PC - PC-PC
# Gestarted von : C:\Users\PC\Desktop\AdwCleaner_4.201.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : APNMCPA

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\AskPartnerNetwork
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\Program Files\AskPartnerNetwork
Ordner Gelöscht : C:\Program Files\ICQ6Toolbar
Ordner Gelöscht : C:\Users\PC\AppData\Local\Temp\apn
Ordner Gelöscht : C:\Users\PC\AppData\Local\AskPartnerNetwork
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\ask-web-search.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin.gif
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin.src
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-1.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-10.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-11.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-12.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-13.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-14.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-15.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-16.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-17.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-18.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-19.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-2.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-20.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-21.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-22.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-23.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-24.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-25.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-26.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-27.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-28.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-29.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-3.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-30.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-31.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-32.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-33.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-34.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-35.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-36.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-37.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-38.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-4.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-5.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-6.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-7.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-8.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-9.xml
Datei Gelöscht : C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\user.js

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnTbMon]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{44CBC005-6243-4502-8A02-3A096A282664}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80703783-E415-4EE3-AB60-D36981C5A6F1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D8278076-BC68-4484-9233-6E7F1628B56C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F297534D-7B06-459D-BC19-2DD8EF69297B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{80703783-E415-4EE3-AB60-D36981C5A6F1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9945959C-AAD8-4312-8B57-2DE11927E770}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{EEA63863-87BC-4DCA-A5B5-EB97E3B04806}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6978F29A-3493-40B2-8CDC-9C13A02F85A4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7949A66-D936-4028-9552-14F7DC50F38D}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{4816C09D-3D85-4878-A903-D5627AF2A110}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Schlüssel Gelöscht : HKCU\Software\AskPartnerNetwork
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\adawarebp
Schlüssel Gelöscht : HKLM\SOFTWARE\AskPartnerNetwork
Schlüssel Gelöscht : HKLM\SOFTWARE\ICQ\ICQToolbar
Schlüssel Gelöscht : HKU\.DEFAULT\Software\AskPartnerNetwork
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4F524A00-6A76-A76A-76A7-A758B70C1B00}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00B2-0409-0000-0000000FF1CE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{4F524A00-6A76-A76A-76A7-A758B70C1B00}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{90120000-00B2-0409-0000-0000000FF1CE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7AB5857A57A0687786597A857BFFFFFF

***** [ Internetbrowser ] *****

-\\ Internet Explorer v8.0.6001.19607

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

-\\ Mozilla Firefox v37.0.2 (x86 de)

[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.defaultengine", "Ask.com");
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.defaulturl", "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q=");
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.order.1", "Ask.com");
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark.hp.enabled", false);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "");
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark.lastInstalled", "allin1convert@mindspark.com");
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.allowSendURL", false);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.defSearchChange", true);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.engineVerified", true);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.facebookSmilesAddonShowedPopup", true);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.firstTbRun", false);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.geolastmodified", 1391012877);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.history", "hxxp%3Awebmail.planet-school.dewebmail.planet-school.desmartphone%20%20bis%20250eursporthotel%20und%20hartgummiplatzberlin%20mapssmartphone%20motorola%20ph[...]
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.hpChange", true);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.icqgeo", 49);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.installTime", "1343297811");
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.newtab_most_visited_state", "1");
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.newtab_recently_closed_state", "1");
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.newtab_state", "1");
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.numberOfSearches", 0);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.previousFFVersion", "26.0");
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.skip_default_search", "no");
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.suggestions", false);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.uninstStatSent", true);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.uniqueID", "128344725712834472571283601606524");
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1391162132);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.userEngineApproved", true);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.userHpApproved", true);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.voucherHideClicks", 0);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.voucherMoreLinkClicks", 0);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.voucherRedeemClicks", 0);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.voucherWasShown", 1);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.xmlEnableHomePageDsGuard", false);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false);
[xfzrfnrq.default\prefs.js] - Zeile Gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");

-\\ Google Chrome v


*************************

AdwCleaner[R0].txt - [13821 Bytes] - [23/04/2015 22:04:32]
AdwCleaner[S0].txt - [13983 Bytes] - [23/04/2015 22:07:24]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [14043  Bytes] ##########
         

Jetzt Malwarebytes Anti Malware.

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 23.04.2015
Suchlauf-Zeit: 22:17:49
Logdatei: mbam.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.04.23.05
Rootkit Datenbank: v2015.04.21.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows Vista Service Pack 2
CPU: x86
Dateisystem: NTFS
Benutzer: PC

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 315120
Verstrichene Zeit: 14 Min, 25 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 0
(Keine schädliche Elemente gefunden)

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 1
PUP.Optional.Mindspark.A, C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\Allin1Convert_8h, , [cd34f977a2e8d75f5b93f4a48b78ab55], 

Dateien: 8
PUP.Optional.ICQPlugin.A, C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-39.xml, , [03febab6b6d40b2b981a6c5f1ae98977], 
PUP.Optional.ICQPlugin.A, C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-40.xml, , [976aa3cd2b5f5ed808aad1fa54afbb45], 
PUP.Optional.ICQPlugin.A, C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-41.xml, , [827f78f82466ad895d55b11ad62dee12], 
PUP.Optional.ICQPlugin.A, C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-42.xml, , [fc05531d1278a393931f943721e232ce], 
PUP.Optional.ICQPlugin.A, C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-43.xml, , [3fc2c5ab0c7e3ff7e0d2f6d5c1429769], 
PUP.Optional.ICQPlugin.A, C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-44.xml, , [9071e789dbafb185753db2199d66c13f], 
PUP.Optional.ICQPlugin.A, C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-45.xml, , [a45de68a8a001620c9e9a922986b8977], 
PUP.Optional.ICQPlugin.A, C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\searchplugins\icqplugin-46.xml, , [6d94c5aba3e7f83efcb6ebe0a162ae52], 

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)
         

Nun Junkware Remuval Tool.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.6.1 (04.23.2015:1)
OS: Windows Vista (TM) Home Premium x86
Ran by PC on 23.04.2015 at 22:37:46,77
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ad-aware browsing protection



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\158D6D9E3FE81FA428925F22ACB3A965
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\15E6C514FEFC09F45BAFAAE1D7546ED4
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\189F6D048E923EA48B11D15B30CDAC81
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1DB42320A8525634AA089F0BEC86473B
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\22468B0D6050B2E46B9C4B67A8F59577
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2251BF05A2F606D43BB064BD63CBD87E
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3CDF313E9B28C944FBC7579CF4949414
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\661134B612233374391C95E8AC373BA3
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\71E54748EDD3DC1468548785DC856EDA
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\754590DD06DE8D249B526503432F99D4
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8036C72171EF4BA46856BF57969F6A36
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CBC85D72B148084ABE8C2F072F781F4
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CC5A38A64D6098468BC8395BA0EFF03
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8DF9A1AC557F56C49B56F6B83E293C15
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A08449608E3CA1F4ABF236256A256754
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A431C8F3F57D7844B89242F5F7A5F62C
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B448F401EF39C8346BF7BE9B8D1C7060
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CFA51B44D54927C4E9B7BC1D3FD1E49F
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D14A7F65792054F418578C78367D13F7
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D538E650623CB2C43AD5FBF587227D55
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DFE9F0BD163D827438CB6AD6B100EC48
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F739A19A8327DC64C9A8B641A9E89646



~~~ Files



~~~ Folders

Failed to delete: [Folder] C:\ProgramData\ad-aware browsing protection



~~~ FireFox

Emptied folder: C:\Users\PC\AppData\Roaming\mozilla\firefox\profiles\xfzrfnrq.default\minidumps [308 files]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 23.04.2015 at 22:39:27,66
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Dann nochmal FRST.


FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-04-2015
Ran by PC (administrator) on PC-PC on 23-04-2015 22:47:38
Running from C:\Users\PC\Desktop
Loaded Profiles: PC &  (Available profiles: PC)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Antivirus\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Antivirus\avgnt.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Acer Inc.) C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
(CyberLink) C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Antivirus\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Antivirus\avshadow.exe
(Garmin Ltd or its subsidiaries) C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Vodafone) C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4669440 2007-07-06] (Realtek Semiconductor)
HKLM\...\Run: [Acer Empowering Technology Monitor] => C:\Acer\Empowering Technology\SysMonitor.exe [319488 2007-01-24] ()
HKLM\...\Run: [eDataSecurity Loader] => C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [464168 2007-02-07] (HiTRUST)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-06-15] (Realtek Semiconductor Corp.)
HKLM\...\Run: [PlayMovie] => C:\Program Files\Acer Arcade Live\Acer PlayMovie\PMVService.exe [178280 2007-07-13] (CyberLink Corp.)
HKLM\...\Run: [WarReg_PopUp] => C:\Acer\WR_PopUp\WarReg_PopUp.exe [57344 2006-11-05] (Acer Inc.)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] ()
HKLM\...\Run: [Acer Tour Reminder] => C:\Acer\AcerTour\Reminder.exe [151552 2007-02-15] (Acer Inc.)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM\...\Run: [PDFPrint] => C:\Program Files\PDF24\pdf24.exe [220552 2011-02-01] (Geek Software GmbH)
HKLM\...\Run: [MobileConnect] => C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe [2403840 2009-09-11] (Vodafone)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\Antivirus\avgnt.exe [726320 2015-03-24] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Acer Tour Reminder] => C:\Acer\AcerTour\Reminder.exe [151552 2007-02-15] (Acer Inc.)
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\...\Run: [PhotoShow Deluxe Media Manager] => C:\Program Files\Simple Star\PhotoShow Deluxe 3\data\Xtras\mssysmgr.exe [163840 2005-02-01] (Simple Star, Inc.)
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [31087200 2015-01-23] (Skype Technologies S.A.)
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_TATINFE.EXE [262208 2013-12-16] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\...\Run: [GarminExpressTrayApp] => C:\Program Files\Garmin\Express Tray\ExpressTray.exe [688984 2015-01-28] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\...\Run: [Acer Tour Reminder] => [X]
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\ACER(W~1.SCR [187392 2006-10-19] ()
HKU\S-1-5-21-1859551519-956376940-1599385416-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-1859551519-956376940-1599385416-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [PhotoShow Deluxe Media Manager] => C:\Program Files\Simple Star\PhotoShow Deluxe 3\data\Xtras\mssysmgr.exe [163840 2005-02-01] (Simple Star, Inc.)
HKU\S-1-5-21-1859551519-956376940-1599385416-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [31087200 2015-01-23] (Skype Technologies S.A.)
HKU\S-1-5-21-1859551519-956376940-1599385416-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_TATINFE.EXE [262208 2013-12-16] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1859551519-956376940-1599385416-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [GarminExpressTrayApp] => C:\Program Files\Garmin\Express Tray\ExpressTray.exe [688984 2015-01-28] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-1859551519-956376940-1599385416-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Acer Tour Reminder] => [X]
HKU\S-1-5-21-1859551519-956376940-1599385416-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\ACER(W~1.SCR [187392 2006-10-19] ()
HKU\S-1-5-18\...\Run: [Acer Tour Reminder] => C:\Acer\AcerTour\Reminder.exe [151552 2007-02-15] (Acer Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Empowering Technology Launcher.lnk [2007-05-07]
ShortcutTarget: Empowering Technology Launcher.lnk -> C:\Acer\Empowering Technology\eAPLauncher.exe (Acer Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PCM Media Sharing.lnk [2007-05-07]
ShortcutTarget: PCM Media Sharing.lnk -> C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe ()
Startup: C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk [2010-10-30]
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1859551519-956376940-1599385416-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1859551519-956376940-1599385416-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\Software\Microsoft\Internet Explorer\Main,SEARCH PAGE = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
HKU\S-1-5-21-1859551519-956376940-1599385416-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1859551519-956376940-1599385416-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,SEARCH PAGE = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1859551519-956376940-1599385416-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1859551519-956376940-1599385416-1000 -> {6D603AC1-6D71-4C69-A516-ED9C1B18BDBF} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
SearchScopes: HKU\S-1-5-21-1859551519-956376940-1599385416-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {6D603AC1-6D71-4C69-A516-ED9C1B18BDBF} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-27] (Adobe Systems Incorporated)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-02-10] (Oracle Corporation)
BHO: ShowBarObj Class -> {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} -> C:\Windows\system32\ActiveToolBand.dll [2007-02-06] (HiTRUST)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-10-02] (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-10] (Oracle Corporation)
Toolbar: HKLM - Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll [2007-02-06] (HiTRUST)
Toolbar: HKU\S-1-5-21-1859551519-956376940-1599385416-1000 -> Acer eDataSecurity Management - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll [2007-02-06] (HiTRUST)
Toolbar: HKU\S-1-5-21-1859551519-956376940-1599385416-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> Acer eDataSecurity Management - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll [2007-02-06] (HiTRUST)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {CAFEEFAC-0018-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2006-10-27] (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-20] (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-10-02] (Skype Technologies S.A.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-09] ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Windows\system32\npdeployJava1.dll [2015-02-10] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-10] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-10] (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-09] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-09] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2012-07-27] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2006-10-26] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2012-07-27] (Adobe Systems Inc.)
FF Extension: Segurança do navegador Avira - C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\Extensions\abs@avira.com [2015-03-31]
FF Extension: Garmin Communicator - C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2013-11-19]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-09-17]
FF Extension: Adblock Plus - C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-03-30]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-04-22]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-05-02]
FF HKLM\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\Vodafone\Vodafone Mobile Connect\Optimization Client\addon
FF Extension: Bytemobile Optimization Client - C:\Program Files\Vodafone\Vodafone Mobile Connect\Optimization Client\addon [2015-02-08]

Chrome: 
=======
CHR Profile: C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Acer HomeMedia Connect Service; C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [266343 2007-04-04] (CyberLink) [File not signed]
S2 AcerMemUsageCheckService; C:\Acer\Empowering Technology\ePerformance\MemCheck.exe [28672 2006-12-29] () [File not signed]
S2 AntiVirMailService; C:\Program Files\Avira\Antivirus\avmailc.exe [815352 2015-03-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\Antivirus\sched.exe [434424 2015-03-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\Antivirus\avguard.exe [434424 2015-03-24] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files\Avira\Antivirus\AVWEBGRD.EXE [1004032 2015-03-24] (Avira Operations GmbH & Co. KG)
S2 eDataSecurity Service; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [457512 2007-02-07] (HiTRSUT)
S2 EpsonScanSvc; C:\Windows\system32\EscSvc.exe [126128 2012-05-17] (Seiko Epson Corporation)
S2 eRecoveryService; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [53248 2007-01-31] (Acer Inc.) [File not signed]
R2 Garmin Core Update Service; C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [517464 2015-01-28] (Garmin Ltd or its subsidiaries)
S2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440 2007-01-17] (Hewlett-Packard Company) [File not signed]
S2 matlabserver; C:\MATLAB6p1\webserver\bin\win32\matlabserver.exe [258048 2001-04-06] () [File not signed]
S2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S2 MyEpson Portal Service; C:\Program Files\EPSON\MyEpson Portal\mepService.exe [703984 2014-09-22] (SEIKO EPSON CORPORATION)
S2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [143360 2007-04-09] () [File not signed]
S2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
R2 VMCService; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [9216 2009-09-11] (Vodafone) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-03-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-03-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2015-03-24] (Avira Operations GmbH & Co. KG)
U0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [22528 2008-10-09] (Bytemobile, Inc.) [File not signed]
S3 grmnusb; C:\Windows\System32\drivers\grmnusb.sys [15720 2012-04-18] (GARMIN Corp.)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2010-02-03] (LogMeIn, Inc.)
S3 hwusbfake; C:\Windows\System32\DRIVERS\ewusbfake.sys [102912 2009-06-29] (Huawei Technologies Co., Ltd.)
R2 int15; C:\Acer\Empowering Technology\eRecovery\int15.sys [76584 2006-12-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-04-23] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
R3 NTIDrvr; C:\Windows\System32\DRIVERS\NTIDrvr.sys [6144 2007-05-07] (NewTech Infosystems, Inc.) [File not signed]
R0 PSDFilter; C:\Windows\System32\DRIVERS\psdfilter.sys [20264 2007-02-07] (HiTRUST)
R0 PSDNServ; C:\Windows\System32\drivers\PSDNServ.sys [16680 2007-02-07] (HiTRUST)
R0 psdvdisk; C:\Windows\System32\drivers\psdvdisk.sys [60712 2007-02-07] (HiTRUST)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2015-03-24] (Avira GmbH)
R1 tcpipBM; C:\Windows\system32\Drivers\tcpipBM.sys [18816 2008-10-09] (Bytemobile, Inc.) [File not signed]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Live\Acer PlayMovie\000.fcl [39408 2007-08-31] (Cyberlink Corp.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
S3 avchv; system32\DRIVERS\avchv.sys [X]
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\Users\PC\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S0 Lbd; system32\DRIVERS\Lbd.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-23 22:47 - 2015-04-23 22:47 - 00020635 _____ () C:\Users\PC\Desktop\FRST.txt
2015-04-23 22:39 - 2015-04-23 22:39 - 00004711 _____ () C:\Users\PC\Desktop\JRT.txt
2015-04-23 22:37 - 2015-04-23 22:37 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-PC-PC-Windows-Vista-(TM)-Home-Premium-(32-bit).dat
2015-04-23 22:37 - 2015-04-23 22:37 - 00000000 ____D () C:\RegBackup
2015-04-23 22:34 - 2015-04-23 22:34 - 00002632 _____ () C:\Users\PC\Desktop\mbam.txt
2015-04-23 22:16 - 2015-04-23 22:16 - 00000903 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-23 22:16 - 2015-04-23 22:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-04-23 22:16 - 2015-04-23 22:16 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2015-04-23 22:16 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-23 22:16 - 2015-04-14 09:37 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-23 22:14 - 2015-04-23 22:14 - 00014124 _____ () C:\Users\PC\Desktop\AdwCleaner[S0].txt
2015-04-23 22:04 - 2015-04-23 22:08 - 00000000 ____D () C:\AdwCleaner
2015-04-23 22:04 - 2015-04-23 22:01 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\PC\Desktop\mbam-setup-2.1.6.1022.exe
2015-04-23 22:04 - 2015-04-23 22:01 - 02685470 _____ (Thisisu) C:\Users\PC\Desktop\JRT.exe
2015-04-23 22:04 - 2015-04-23 22:00 - 02217984 _____ () C:\Users\PC\Desktop\AdwCleaner_4.201.exe
2015-04-23 22:01 - 2015-04-23 22:01 - 02685470 _____ (Thisisu) C:\Users\PC\Downloads\JRT.exe
2015-04-23 22:00 - 2015-04-23 22:01 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\PC\Downloads\mbam-setup-2.1.6.1022.exe
2015-04-23 22:00 - 2015-04-23 22:00 - 02217984 _____ () C:\Users\PC\Downloads\AdwCleaner_4.201.exe
2015-04-23 20:26 - 2015-04-23 20:26 - 00013116 _____ () C:\Users\PC\Desktop\ComboFix.txt
2015-04-23 20:21 - 2015-04-23 20:21 - 00013116 _____ () C:\ComboFix.txt
2015-04-23 20:02 - 2015-04-23 20:21 - 00000000 ____D () C:\Qoobox
2015-04-23 20:02 - 2015-04-23 20:18 - 00000000 ____D () C:\Windows\erdnt
2015-04-23 20:02 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-04-23 20:02 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-04-23 20:02 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-04-23 20:02 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-04-23 20:02 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-04-23 20:02 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-04-23 20:02 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-04-23 20:02 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-04-23 20:01 - 2015-04-23 20:00 - 05619466 ____R (Swearware) C:\Users\PC\Desktop\ComboFix.exe
2015-04-23 20:00 - 2015-04-23 20:00 - 05619466 _____ (Swearware) C:\Users\PC\Downloads\ComboFix.exe
2015-04-22 19:35 - 2015-04-23 22:17 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-22 19:35 - 2015-04-23 22:16 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-22 19:35 - 2015-04-22 20:22 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-04-22 19:33 - 2015-04-22 20:22 - 00000000 ____D () C:\Users\PC\Desktop\mbar
2015-04-22 19:33 - 2015-04-22 19:32 - 16502728 _____ (Malwarebytes Corp.) C:\Users\PC\Desktop\mbar-1.09.1.1004.exe
2015-04-22 19:33 - 2015-04-14 09:37 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-22 19:31 - 2015-04-22 19:32 - 16502728 _____ (Malwarebytes Corp.) C:\Users\PC\Downloads\mbar-1.09.1.1004.exe
2015-04-22 19:24 - 2015-04-22 19:24 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-04-21 22:01 - 2015-04-21 21:59 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\PC\Desktop\tdsskiller.exe
2015-04-21 22:01 - 2015-04-21 19:33 - 00380416 _____ () C:\Users\PC\Desktop\Gmer-19357.exe
2015-04-21 22:01 - 2015-04-21 19:21 - 01139200 _____ (Farbar) C:\Users\PC\Desktop\FRST.exe
2015-04-21 22:01 - 2015-04-21 19:18 - 00000466 _____ () C:\Users\PC\Desktop\defogger_disable.log
2015-04-21 22:01 - 2015-04-21 19:14 - 00050477 _____ () C:\Users\PC\Desktop\Defogger.exe
2015-04-21 21:58 - 2015-04-21 21:59 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\PC\Downloads\tdsskiller.exe
2015-04-21 19:57 - 2015-04-21 19:57 - 00014345 _____ () C:\Users\PC\Desktop\Gmer.txt
2015-04-21 19:33 - 2015-04-21 19:33 - 00380416 _____ () C:\Users\PC\Downloads\Gmer-19357.exe
2015-04-21 19:23 - 2015-04-21 19:26 - 00033160 _____ () C:\Users\PC\Downloads\Addition.txt
2015-04-21 19:22 - 2015-04-21 19:26 - 00045112 _____ () C:\Users\PC\Downloads\FRST.txt
2015-04-21 19:21 - 2015-04-23 22:47 - 00000000 ____D () C:\FRST
2015-04-21 19:21 - 2015-04-21 19:21 - 01139200 _____ (Farbar) C:\Users\PC\Downloads\FRST.exe
2015-04-21 19:16 - 2015-04-21 19:18 - 00000466 _____ () C:\Users\PC\Downloads\defogger_disable.log
2015-04-21 19:16 - 2015-04-21 19:16 - 00000000 _____ () C:\Users\PC\defogger_reenable
2015-04-21 19:14 - 2015-04-21 19:14 - 00050477 _____ () C:\Users\PC\Downloads\Defogger.exe
2015-04-20 17:50 - 2015-04-20 17:51 - 00000000 ____D () C:\Users\PC\Downloads\Neuer Ordner
2015-04-19 14:24 - 2015-04-19 14:24 - 00000000 ____D () C:\Users\PC\AppData\Roaming\FLEXnet
2015-04-19 13:00 - 2015-04-19 13:00 - 00000000 ____D () C:\Users\PC\Neuer Ordner
2015-04-17 23:29 - 2015-04-17 23:30 - 00000000 ____D () C:\Users\PC\Desktop\Allerlei Desctop
2015-04-17 22:00 - 2015-04-23 20:28 - 00479088 _____ () C:\Windows\PFRO.log
2015-04-17 21:55 - 2015-04-17 21:55 - 00000000 _____ () C:\Windows\setuperr.log
2015-04-17 21:55 - 2015-04-17 21:55 - 00000000 _____ () C:\Windows\setupact.log
2015-04-17 21:54 - 2015-04-17 21:55 - 00000000 ____D () C:\Windows\system32\vbox
2015-04-17 21:50 - 2015-04-21 22:28 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-04-17 21:34 - 2015-04-17 21:34 - 00000769 _____ () C:\Users\Public\Desktop\EPSON Scan.lnk
2015-04-17 21:34 - 2014-02-25 00:00 - 00342528 _____ (Seiko Epson Corporation) C:\Windows\system32\esw2ud.dll
2015-04-17 21:34 - 2012-05-17 00:00 - 00126128 _____ (Seiko Epson Corporation) C:\Windows\system32\escsvc.exe
2015-04-17 17:56 - 2015-04-17 17:56 - 00000000 ____D () C:\Users\PC\AppData\Roaming\Avira
2015-04-17 17:55 - 2015-04-17 17:55 - 00001809 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2015-04-17 17:55 - 2015-04-17 17:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-17 17:55 - 2015-03-24 14:59 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-04-17 17:55 - 2015-03-24 14:59 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-04-17 17:55 - 2015-03-24 14:59 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-04-17 17:28 - 2015-04-17 17:28 - 00000000 ____D () C:\OETemp
2015-04-14 21:52 - 2015-04-14 21:52 - 00000000 ____D () C:\Users\PC\Desktop\KVART-Bilder
2015-04-14 21:26 - 2015-04-16 04:17 - 00000000 ____D () C:\Users\PC\{8680f3f1-d5a4-4f00-bcba-04d3bbe2ac43}
2015-04-12 20:49 - 2015-04-12 20:49 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_avchv_01009.Wdf

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-23 22:40 - 2006-11-02 14:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-23 22:40 - 2006-11-02 14:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-23 22:38 - 2014-02-07 19:03 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2015-04-23 22:19 - 2010-07-28 14:00 - 00000000 ____D () C:\Users\PC\AppData\Roaming\Skype
2015-04-23 22:15 - 2010-04-23 07:58 - 01975666 _____ () C:\Windows\WindowsUpdate.log
2015-04-23 22:11 - 2015-02-25 19:11 - 00000917 _____ () C:\Windows\Tasks\EPSON XP-225 Series Update {1998D3F2-57DE-4F62-A20D-6554C0D76ED6}.job
2015-04-23 22:10 - 2010-05-02 19:06 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-23 22:10 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-23 22:08 - 2006-11-02 15:01 - 00032534 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-23 22:07 - 2010-09-04 14:00 - 00000000 ____D () C:\ProgramData\ICQ
2015-04-23 22:05 - 2013-06-19 17:21 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-23 22:00 - 2010-05-02 19:06 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-23 20:21 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public
2015-04-23 20:14 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini
2015-04-22 22:36 - 2012-05-05 21:02 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-21 21:49 - 2010-04-27 22:14 - 00000000 ____D () C:\ProgramData\Lavasoft
2015-04-21 19:16 - 2010-04-23 08:23 - 00000000 ____D () C:\Users\PC
2015-04-19 16:23 - 2013-02-18 20:50 - 00000000 ____D () C:\Users\PC\Desktop\Minos Belegungkopien !!!!!!(Malteser)
2015-04-19 16:08 - 2010-08-01 17:59 - 00012772 _____ () C:\Users\PC\AppData\Roaming\wklnhst.dat
2015-04-19 15:50 - 2010-05-04 15:47 - 00000000 ____D () C:\Users\PC\Documents\Conny2
2015-04-19 14:33 - 2013-03-28 12:46 - 00000022 _____ () C:\Users\PC\AppData\Local\cmdial32.ini
2015-04-17 21:52 - 2006-11-02 14:37 - 00000000 ____D () C:\Program Files\Windows Sidebar
2015-04-17 21:35 - 2015-02-25 19:08 - 00000933 _____ () C:\Users\Public\Desktop\EPSON-Handbücher.lnk
2015-04-17 21:35 - 2015-02-25 19:08 - 00000123 _____ () C:\Users\Public\Desktop\Epson Connect Site.url
2015-04-17 21:34 - 2015-02-25 19:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2015-04-17 21:34 - 2015-02-25 19:06 - 00000000 ____D () C:\Program Files\epson
2015-04-17 21:34 - 2006-11-02 14:37 - 00000000 ____D () C:\Windows\twain_32
2015-04-17 21:22 - 2015-02-25 19:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Software
2015-04-17 21:22 - 2015-02-25 19:07 - 00000000 ____D () C:\Program Files\EPSON Software
2015-04-17 21:22 - 2007-05-07 00:43 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2015-04-17 17:55 - 2013-08-05 17:57 - 00000000 ____D () C:\ProgramData\Avira
2015-04-17 17:31 - 2011-07-05 10:44 - 00000000 ____D () C:\Program Files\Avira
2015-04-17 17:28 - 2014-08-24 13:33 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-16 04:17 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2015-04-16 04:17 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2015-04-16 04:17 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2015-04-16 04:17 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-04-16 04:17 - 2006-11-02 12:22 - 50593792 _____ () C:\Windows\system32\config\software_previous
2015-04-16 04:17 - 2006-11-02 12:22 - 23855104 _____ () C:\Windows\system32\config\system_previous
2015-04-16 04:04 - 2006-11-02 12:22 - 46399488 _____ () C:\Windows\system32\config\components_previous
2015-04-16 04:04 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2015-04-15 18:02 - 2006-11-02 12:22 - 00524288 _____ () C:\Windows\system32\config\default_previous
2015-04-15 18:02 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2015-04-14 21:01 - 2015-02-25 19:49 - 00000000 ____D () C:\Users\PC\AppData\Roaming\EPSON
2015-04-14 21:01 - 2015-02-25 19:01 - 00000000 ____D () C:\ProgramData\Epson
2015-04-13 14:25 - 2006-11-02 12:33 - 02244156 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-01 17:46 - 2010-07-23 10:55 - 00007484 _____ () C:\Users\PC\AppData\Local\d3d9caps.dat
2015-03-24 14:59 - 2014-11-07 17:36 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys

==================== Files in the root of some directories =======

2010-08-01 17:59 - 2015-04-19 16:08 - 0012772 _____ () C:\Users\PC\AppData\Roaming\wklnhst.dat
2010-05-04 18:22 - 2009-08-27 11:09 - 0013264 _____ (Arcor Online GmbH) C:\Users\PC\AppData\Local\cmdial32.dll
2013-03-28 12:46 - 2015-04-19 14:33 - 0000022 _____ () C:\Users\PC\AppData\Local\cmdial32.ini
2010-07-23 10:55 - 2015-04-01 17:46 - 0007484 _____ () C:\Users\PC\AppData\Local\d3d9caps.dat
2010-04-23 09:34 - 2013-11-21 00:08 - 0136704 _____ () C:\Users\PC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2009-06-16 14:25 - 2009-06-16 14:25 - 0121512 ____R () C:\ProgramData\DeviceManager.xml.rc4
2010-07-28 15:20 - 2010-07-28 15:20 - 0000056 ____H () C:\ProgramData\ezsidmv.dat

Some content of TEMP:
====================
C:\Users\PC\AppData\Local\Temp\avgnt.exe
C:\Users\PC\AppData\Local\Temp\Quarantine.exe
C:\Users\PC\AppData\Local\Temp\sqlite3.dll


Some zero byte size files/folders:
==========================
C:\Windows\System32\NTIBUN5.dll
C:\Windows\System32\NTIDIB4.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-23 22:23

==================== End Of Log ============================
         

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 20-04-2015
Ran by PC at 2015-04-23 22:48:01
Running from C:\Users\PC\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Disabled - Out of date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Disabled - Out of date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acer Arcade Live Main Page (HKLM\...\{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}) (Version: 1.0.4010 - Acer Inc.)
Acer DV Magician (HKLM\...\{F6EFFB76-4A07-11DA-9D78-000129760D75}) (Version: 1.2.2810 - Acer Inc.)
Acer DVDivine (HKLM\...\{B145EC69-66F5-11D8-9D75-000129760D75}) (Version: 3.1.1610 - Acer Inc.)
Acer eDataSecurity Management (HKLM\...\{AEEAE013-92F1-4515-B278-139F1A692A36}) (Version: 2.5.3032 - HiTRUST Inc.)
Acer Empowering Technology (HKLM\...\{AB6097D9-D722-4987-BD9E-A076E2848EE2}) (Version: 2.5.3005 - Acer Inc.)
Acer ePerformance Management (HKLM\...\{D462BF9E-0C35-4705-BF9B-3DF9F3816643}) (Version: 2.5.3002 - Acer Inc.)
Acer HomeMedia (HKLM\...\{AA4BF92B-2AAF-11DA-9D78-000129760D75}) (Version: 1.3.4010 - Acer Inc.)
Acer HomeMedia Connect (HKLM\...\{132888AE-EF67-41C5-BCA2-7D5D2488AB63}) (Version: 1.4.4010 - Acer Inc.)
Acer PlayMovie (HKLM\...\{A450831D-25F6-4F42-9662-D000B25E0D82}) (Version: DVD 1.5.3317 - Acer Inc.)
Acer ScreenSaver (HKLM\...\{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}) (Version: 4.01.20070419 - Acer Inc.)
Acer SlideShow DVD (HKLM\...\{41581EF5-45A7-11DA-9D78-000129760D75}) (Version: 1.2.2810 - Acer Inc.)
Acer Tour (HKLM\...\{94389919-B0AA-4882-9BE8-9F0B004ECA35}) (Version: 2.0.1001 - Acer Inc.)
Acer VideoMagician (HKLM\...\{F79A208D-D929-11D9-9D77-000129760D75}) (Version: 1.3.1610 - Acer Inc.)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Ad-Aware Browsing Protection (HKLM\...\Ad-Aware Browsing Protection) (Version: 1.0.1.124 - Lavasoft)
Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader X (10.1.4) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.4 - Adobe Systems Incorporated)
ANT Drivers Installer x86 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
ATI Catalyst Install Manager (HKLM\...\{4160DC5B-4C56-D0C3-C5FD-F5BDAD3C882B}) (Version: 3.0.641.0 - ATI Technologies, Inc.)
Avira Antivirus (HKLM\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
ccc-core-static (Version: 2007.0727.2307.39475 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.15 - Piriform)
Defraggler (HKLM\...\Defraggler) (Version: 2.18 - Piriform)
Deinstallation der Arcor Online Software (HKLM\...\{262DA23B-4BAB-463F-B1DC-9B5287CAB5CA}}_is1) (Version: 5.0.0.7 - Vodafone AG & Co. KG)
Elevated Installer (Version: 3.2.29.0 - Garmin Ltd or its subsidiaries) Hidden
EPSON Scan (HKLM\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EPSON-Handbücher (HKLM\...\{84CECC1B-21EF-41B1-9A91-3E724E5D99D3}) (Version: 1.32.0.0 - SEIKO EPSON CORPORATION)
eSobi v2 (HKLM\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.1.00133 - esobi Inc.)
eSobi v2 (Version: 2.0.1.00133 - esobi Inc.) Hidden
FreeCommander 2009.02a (HKLM\...\FreeCommander_is1) (Version: 2009.02 - Marek Jasinski)
Garmin Express (HKLM\...\{714dc1e5-69a4-4ecd-9552-93397e084298}) (Version: 3.2.29.0 - Garmin Ltd or its subsidiaries)
Garmin Express (Version: 3.2.29.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (Version: 3.2.29.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin USB Drivers (HKLM\...\{ABA5E381-EC46-425C-86C5-5CD15BBFB4BF}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Hama Wireless LAN Adapter (HKLM\...\{E91E8912-769D-42F0-8408-0E329443BABC}) (Version: 10.1.0 - Hama)
Java 8 Update 31 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
LightScribe  1.4.142.1 (Version: 1.4.142.1 - hxxp://www.lightscribe.com) Hidden
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
MATLAB 6.1 (HKLM\...\Matlab 6.1) (Version:  - )
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Access 2003 Runtime (HKLM\...\{901C0407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}) (Version: 08.05.0822 - Microsoft Corporation)
Mozilla Firefox 37.0.2 (x86 de) (HKLM\...\Mozilla Firefox 37.0.2 (x86 de)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyEpson Portal (HKLM\...\MyEpson Portal) (Version:  - SEIKO EPSON Corporation)
MyEpson Portal (Version: 1.1.1.0 - SEIKO EPSON CORPORATION) Hidden
NTI CD & DVD-Maker (HKLM\...\InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}) (Version: 7 - NewTech Infosystems)
NTI CD & DVD-Maker (Version: 7 - NewTech Infosystems) Hidden
PDF24 Creator 2.9.1 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.0.2 - Frank Heindörfer, Philip Chinery)
PhotoShow Deluxe 3 (HKLM\...\PhotoShow Deluxe 3) (Version: 3.0 - Simple Star, Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5449 - Realtek Semiconductor Corp.)
RStudio (HKLM\...\RStudio) (Version: 0.96.122 - RStudio)
Skins (Version: 2007.0727.2307.39475 - ATI) Hidden
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.3.11079 - Skype Technologies S.A.)
Skype™ 7.1 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)
Software Updater (HKLM\...\{E07D7C7B-F424-4EEF-BA17-B2C32BD1C107}) (Version: 4.3.0 - SEIKO EPSON CORPORATION)
Ulead Photo Explorer 8.0 SE Basic (HKLM\...\{D271DAE0-8D68-4C97-8356-A126D48A1D8C}) (Version: 8.0 - Ulead Systems, Inc.)
Visual C++ 2008 x86 Runtime - v9.0.30729.01 (HKLM\...\{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01) (Version: 9.0.30729.01 - Microsoft Corporation)
VLC media player 1.1.9 (HKLM\...\VLC media player) (Version: 1.1.9 - VideoLAN)
Vodafone Mobile Connect Lite (HKLM\...\{79A64F98-1796-4FA2-B5FF-C90F83D8BACD}) (Version: 9.4.3.17550 - Vodafone)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows-Treiberpaket - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB  (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
WinRAR (HKLM\...\WinRAR archiver) (Version:  - )
XMedia Recode 3.0.9.0 (HKLM\...\XMedia Recode) (Version: 3.0.9.0 - Sebastian Dörfler)
Yahoo! Detect (HKLM\...\YTdetect) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

02-03-2015 15:14:15 Geplanter Prüfpunkt
12-03-2015 23:10:08 Windows Update
15-03-2015 21:15:56 Garmin Express
15-03-2015 21:18:10 Gerätetreiber-Paketinstallation: Silicon Labs Software USB-Controller
15-03-2015 21:18:24 Gerätetreiber-Paketinstallation: Dynastream Innovations, Inc.
15-03-2015 21:25:45 Gerätetreiber-Paketinstallation: Garmin
12-04-2015 19:57:36 AA11
12-04-2015 20:00:18 Removed Ad-Aware Email Scanner for Outlook
12-04-2015 20:47:43 AA11
14-04-2015 21:26:23 Gerätetreiber-Paketinstallation: EPSON Bildverarbeitungsgeräte
15-04-2015 17:14:00 Windows Update
16-04-2015 20:54:30 Gerätetreiber-Paketinstallation: EPSON Bildverarbeitungsgeräte
17-04-2015 21:21:06 Removed Epson Event Manager
17-04-2015 21:24:54 Removed EPSON-Handbücher
17-04-2015 21:34:21 Gerätetreiber-Paketinstallation: EPSON Bildverarbeitungsgeräte
17-04-2015 21:50:53 avast! antivirus system restore point
21-04-2015 21:42:23 avast! antivirus system restore point
21-04-2015 21:47:08 AA11
22-04-2015 19:50:50 Malwarebytes Anti-Rootkit Restore Point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {5E11F64D-FA3F-4F2E-ACDF-A5B6EA87FB70} - System32\Tasks\{C6CF873A-5216-48DE-9610-54255BB498AA} => Firefox.exe hxxp://ui.skype.com/ui/0/5.3.0.111/en/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:offered-installed;madedefault
Task: {6E26C868-244B-42AA-B7DB-7A74943D9A80} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-24] (Google Inc.)
Task: {757ECA8F-1DC6-41C0-8466-ADC6EB871090} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-24] (Google Inc.)
Task: {99E66413-1514-444E-A589-4C5EE4C1F729} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-06-24] (Piriform Ltd)
Task: {B450E4F6-A374-44BC-94AC-10EF8D553057} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - PC => C:\Program Files\Windows Calendar\wincal.exe [2009-04-11] (Microsoft Corporation)
Task: {CF7E7F1E-8DEC-4C65-8CAB-142ED37912F9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-09] (Adobe Systems Incorporated)
Task: {DBB515A2-3C3F-44EA-923E-9C5DCCDC23F0} - System32\Tasks\{C071448A-256F-42A6-A988-451B0C71FB44} => C:\Program Files\Skype\Phone\Skype.exe [2015-01-23] (Skype Technologies S.A.)
Task: {DBD8FFD0-8265-4BB5-827C-F7E02D5F3D58} - System32\Tasks\EPSON XP-225 Series Update {1998D3F2-57DE-4F62-A20D-6554C0D76ED6} => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_TTSNFE.EXE [2013-11-21] (SEIKO EPSON CORPORATION)
Task: {F16221F9-80CF-4CFF-A71B-18B955868D5F} - System32\Tasks\{BAFC7D74-7200-4171-BB8B-C5E19AD6C87D} => Firefox.exe hxxp://ui.skype.com/ui/0/7.2.0.103/de/abandoninstall?page=tsMain
Task: {FFB0C5E0-8051-47B2-891C-317D3CBB27D6} - System32\Tasks\GarminUpdaterTask => C:\Program Files\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2015-01-28] ()

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\EPSON XP-225 Series Update {1998D3F2-57DE-4F62-A20D-6554C0D76ED6}.job => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_TTSNFE.EXE:/EXE:{1998D3F2-57DE-4F62-A20D-6554C0D76ED6} /F:UpdateSYSTEM

Searches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2007-02-06 23:52 - 2007-02-06 23:52 - 00063488 _____ () C:\Windows\system32\ShowErrMsg.dll
2010-04-28 00:03 - 2009-08-16 17:06 - 00141312 _____ () C:\Program Files\WinRAR\rarext.dll
2007-05-07 01:07 - 2007-01-24 10:27 - 00057344 _____ () C:\Acer\Empowering Technology\Acer.Empowering.Framework.DialogManager.dll
2007-05-07 01:07 - 2007-01-24 10:27 - 00024576 _____ () C:\Acer\Empowering Technology\Acer.Empowering.Framework.PasswordSetting.dll
2010-04-23 09:19 - 2007-01-31 18:18 - 00016384 _____ () C:\Acer\Empowering Technology\eRecovery\ServiceInterface.dll
2007-05-07 01:08 - 2006-12-29 17:51 - 00045056 _____ () C:\Acer\Empowering Technology\ePerformance\ePerformance.Plugin.dll
2007-05-07 01:08 - 2006-12-29 17:51 - 00024576 _____ () C:\Acer\Empowering Technology\ePerformance\ePerformance.Presenter.dll
2007-05-07 01:08 - 2006-12-29 17:51 - 00020480 _____ () C:\Acer\Empowering Technology\ePerformance\ePerformance.Model.Interface.dll
2007-05-07 01:08 - 2006-12-29 17:51 - 00028672 _____ () C:\Acer\Empowering Technology\ePerformance\ePerformance.Model.dll
2007-05-07 01:08 - 2006-12-29 17:51 - 00040960 _____ () C:\Acer\Empowering Technology\ePerformance\ePerformance.Library.dll
2007-05-07 01:08 - 2006-12-29 17:51 - 00016384 _____ () C:\Acer\Empowering Technology\MemCheck.Interface.dll
2007-05-07 01:08 - 2006-12-29 17:52 - 00003584 _____ () C:\Acer\Empowering Technology\ePerformance\de\ePerformance.Plugin.resources.dll
2007-05-07 01:11 - 2007-04-04 18:42 - 00098304 _____ () C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLSchRecordMonitor.dll
2007-05-07 01:11 - 2007-04-04 18:42 - 00260096 _____ () C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\sqlite3.dll
2010-10-18 15:16 - 2001-10-28 17:42 - 00116224 _____ () C:\Windows\System32\pdfcmnnt.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\windows\Web\Wallpaper\img24.jpg
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\windows\Web\Wallpaper\img24.jpg
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\PC\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
HKU\S-1-5-21-1859551519-956376940-1599385416-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\PC\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-1859551519-956376940-1599385416-500 - Administrator - Disabled)
Gast (S-1-5-21-1859551519-956376940-1599385416-501 - Limited - Disabled)
PC (S-1-5-21-1859551519-956376940-1599385416-1000 - Administrator - Enabled) => C:\Users\PC

==================== Faulty Device Manager Devices =============

Name: PS/2-kompatible Maus
Description: PS/2-kompatible Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/23/2015 10:39:14 PM) (Source: VMCService) (EventID: 0) (User: )
Description: conflictManagerTypeValue

Error: (04/23/2015 10:15:00 PM) (Source: matlabserver) (EventID: 0) (User: )
Description: matlabserver error: 0Engine wait timeout 180 reached for instance 0.

Error: (04/23/2015 10:11:12 PM) (Source: VMCService) (EventID: 0) (User: )
Description: conflictManagerTypeValue

Error: (04/23/2015 10:10:59 PM) (Source: matlabserver) (EventID: 0) (User: )
Description: matlabserver error: 0EngOpen() WORKER_THREAD_PROC failed.

Error: (04/23/2015 10:08:25 PM) (Source: VMCService) (EventID: 0) (User: )
Description: conflictManagerTypeValue

Error: (04/23/2015 08:32:54 PM) (Source: Microsoft-Windows-SpoolerSpoolss) (EventID: 1031) (User: NT-AUTORITÄT)
Description: 0x80072afb

Error: (04/23/2015 08:32:26 PM) (Source: matlabserver) (EventID: 0) (User: )
Description: matlabserver error: 0Engine wait timeout 180 reached for instance 0.

Error: (04/23/2015 08:31:30 PM) (Source: Microsoft-Windows-SpoolerSpoolss) (EventID: 1031) (User: NT-AUTORITÄT)
Description: 0x80072afb

Error: (04/23/2015 08:29:28 PM) (Source: VMCService) (EventID: 0) (User: )
Description: conflictManagerTypeValue

Error: (04/23/2015 08:29:24 PM) (Source: matlabserver) (EventID: 0) (User: )
Description: matlabserver error: 0EngOpen() WORKER_THREAD_PROC failed.


System errors:
=============
Error: (04/23/2015 10:38:19 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: MBAMScheduler1

Error: (04/23/2015 10:38:19 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: MBAMService1

Error: (04/23/2015 10:38:14 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Windows Presentation Foundation Font Cache 4.0.0.0101Neustart des Diensts

Error: (04/23/2015 10:38:13 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Vodafone Mobile Connect Service1600001Neustart des Diensts

Error: (04/23/2015 10:38:13 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: eRecovery Service1

Error: (04/23/2015 10:38:13 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Skype C2C Service1

Error: (04/23/2015 10:38:13 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Cyberlink RichVideo Service(CRVS)1

Error: (04/23/2015 10:38:13 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: MyEpson Portal Service1

Error: (04/23/2015 10:38:13 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: LightScribeService Direct Disc Labeling Service1

Error: (04/23/2015 10:38:12 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Epson Scanner Service1


Microsoft Office Sessions:
=========================
Error: (12/02/2010 08:00:58 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 44 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (12/02/2010 07:53:19 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 531 seconds with 180 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2015-04-23 22:47:57.212
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-23 22:47:56.891
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-23 22:47:56.584
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-23 22:47:56.279
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-23 22:47:55.897
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-23 22:47:55.594
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-23 22:47:55.283
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-23 22:47:54.976
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-23 22:47:43.568
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-23 22:47:43.256
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 6000+
Percentage of memory in use: 37%
Total physical RAM: 3326.58 MB
Available physical RAM: 2084.99 MB
Total Pagefile: 6889.15 MB
Available Pagefile: 5647.63 MB
Total Virtual: 2047.88 MB
Available Virtual: 1901.98 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:229.13 GB) (Free:146.93 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:228.82 GB) (Free:195.86 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: A9E4F6A8)
Partition 1: (Not Active) - (Size=7.8 GB) - (Type=27)
Partition 2: (Active) - (Size=229.1 GB) - (Type=06)
Partition 3: (Not Active) - (Size=228.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Viel Spass!! Ach ja, ich meinte die neuen Beiträge.

Servus,


die neuesten Beiträge stehen immer oben. Kurz nachdem du gepostet hast, sollte auch dort dein Thema zu finden sein.

Aber eigentlich ist es unerheblich, da ich dein Thema in meinen Abos habe und sehe, wenn du geantwortest hast.




Wir entfernen die letzten Reste und kontrollieren nochmal alles. ESET kann länger (> 2 h) dauern.
Im Anschluss entfernen wir alle verwendeten Tools und ich gebe dir noch ein paar Tipps mit auf den Weg.




Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

start
CloseProcesses:
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1859551519-956376940-1599385416-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
RemoveProxy:
EmptyTemp:
end
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Schritt 2
Downloade dir die passende Version von HitmanPro auf deinen Desktop: HitmanPro - 32 Bit | HitmanPro - 64 Bit.

• Starte die HitmanPro.exe
• Klicke auf
  
• Entferne den Haken bei
  
• Klicke auf
  und
• Akzeptiere die Lizenzbedingungen und klicke auf
• Klicke auf
  
  und auf
• Wenn der Scan beendet wurde, nichts löschen lassen etc. sondern wähle unten links auf der Button-Leiste
  und speichere die Logdatei auf Deinem Desktop.
• Schließe HitmanPro und poste mir das Log.

 

Schritt 3

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 4
Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.






Bitte poste mit deiner nächsten Antwort

• die Logdatei des FRST-Fix,
• die Logdatei von HitmanPro,
• die Logdatei von ESET,
• die Logdatei von SecurityCheck.

Hallo,
ich habe ein Problem mit Hitman Pro. Das programm ist voll durchgelaufen und hat auch einiges gefunden,aber zum Schluß , nachdem ich die E-mail Adresse eingegeben habe, meldet er einen Fehler (ich glaube Nr 20) und möchte eine Ausnahme bei der Firewall. Diese wollte ich ihm auch genehmigen aber dabei muß ich den Programmnamen und eine Portnummer eingeben, die ich aber nicht weiß.
Wat nu?
Ich übermittle dir aber schonmal Ddie Fixlog.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 20-04-2015
Ran by PC at 2015-04-24 23:29:30 Run:1
Running from C:\Users\PC\Desktop
Loaded Profiles: PC (Available profiles: PC)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
start
CloseProcesses:
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1859551519-956376940-1599385416-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
RemoveProxy:
EmptyTemp:
end
*****************

Processes closed successfully.
"HKU\S-1-5-21-1859551519-956376940-1599385416-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKU\S-1-5-21-1859551519-956376940-1599385416-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer => Key not found. 

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.
HKU\S-1-5-21-1859551519-956376940-1599385416-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.


========= End of RemoveProxy: =========

EmptyTemp: => Removed 139.7 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 23:30:02 ====
         

Servus,


dann weiter mit ESET.

Hallo,
hier kommt Eset und Scan Check.

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=575fec9633224140be6e9cf198a6cb55
# engine=23561
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-04-25 06:53:55
# local_time=2015-04-25 08:53:55 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1=''
# compatibility_mode=5892 16776574 100 100 92960 267520763 0 0
# scanned=234446
# found=10
# cleaned=0
# scan_time=9708
sh=A88AF8F841800AD92D2A2DA91E98EB8557198B27 ft=0 fh=0000000000000000 vn="Win32/Spy.SpyEye.CFG.A Trojaner" ac=I fn="C:\iufshsidjfi\8D1F8D434C89C17"
sh=DA562C9B5C7FE37993981B0CF8E8424EF9015A70 ft=1 fh=cf2a470c799257ca vn="Variante von Win32/Systweak evtl. unerwünschte Anwendung" ac=I fn="D:\Downl.-Schrott\ARO2012_bt(1).exe"
sh=2F35BAAED62CC2DBD1B8D21BE1B2F03D60F63A4E ft=1 fh=85c8c915d16f4ca4 vn="Variante von Win32/Systweak evtl. unerwünschte Anwendung" ac=I fn="D:\Downl.-Schrott\ARO2012_bt.exe"
sh=5DB197A61EF1EAB05B0FBCE3D7B3F19525D8F52C ft=1 fh=7d2ced729139930f vn="Variante von Win32/WinWrapper.A evtl. unerwünschte Anwendung" ac=I fn="D:\Downl.-Schrott\DownloadApp_1_8_0_209r_Setup-29104814.exe"
sh=5DB197A61EF1EAB05B0FBCE3D7B3F19525D8F52C ft=1 fh=7d2ced729139930f vn="Variante von Win32/WinWrapper.A evtl. unerwünschte Anwendung" ac=I fn="D:\Downl.-Schrott\DownloadApp_1_8_0_209r_Setup-29105017.exe"
sh=5DB197A61EF1EAB05B0FBCE3D7B3F19525D8F52C ft=1 fh=7d2ced729139930f vn="Variante von Win32/WinWrapper.A evtl. unerwünschte Anwendung" ac=I fn="D:\Downl.-Schrott\DownloadApp_1_8_0_209r_Setup-29105098.exe"
sh=5DB197A61EF1EAB05B0FBCE3D7B3F19525D8F52C ft=1 fh=7d2ced729139930f vn="Variante von Win32/WinWrapper.A evtl. unerwünschte Anwendung" ac=I fn="D:\Downl.-Schrott\DownloadApp_1_8_0_209r_Setup-29105368.exe"
sh=817EB5EC54413DEED18A8BB49E141807A4412E4D ft=1 fh=78b88fb2d561cc06 vn="Win32/RegistryBooster evtl. unerwünschte Anwendung" ac=I fn="D:\Downl.-Schrott\registrybooster2rrlab.exe"
sh=45E7449F1A82158B429BE44611AE49BCEFDAB6E1 ft=1 fh=dffb77abfb1a8bfc vn="Win32/ReImageRepair.F evtl. unerwünschte Anwendung" ac=I fn="D:\Downl.-Schrott\ReimageRepair.exe"
sh=9EB25F28F8D9A8842D78B3573CC058E857443A77 ft=0 fh=0000000000000000 vn="Win32/Spy.SpyEye.CFG.A Trojaner" ac=I fn="D:\PC-PC\Backup Set 2012-05-21 005226\Backup Files 2012-05-21 005226\Backup files 1.zip"
         

 Results of screen317's Security Check version 1.00  
 Windows Vista Service Pack 2 x86   
 Internet Explorer 8 Out of date! 
 Internet Explorer 8  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Antivirus   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Ad-Aware 
 CCleaner     
 Java 8 Update 31  
 Java version 32-bit out of Date! 
 Adobe Flash Player 	17.0.0.169  
 Adobe Reader 10.1.4 Adobe Reader out of Date!  
 Mozilla Firefox (37.0.2) 
````````Process Check: objlist.exe by Laurent````````  
 Ad-Aware AAWService.exe is disabled! 
 Ad-Aware AAWTray.exe is disabled! 
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 Avira Antivirus sched.exe  
 Avira Antivirus avshadow.exe  
 Malwarebytes Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````
         

Reste entfernen
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

start
CloseProcesses:
C:\iufshsidjfi
D:\Downl.-Schrott\*.exe
EmptyTemp:
end
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Die Fixlog von FRST gleich posten, da diese sonst mit DelFix (siehe weiter unten) automatisch entfernt wird!

Hinweis: Registry Cleaner

Ich sehe, dass du sogenannte Registry Cleaner installiert hast.
In deinem Fall CCleaner.

Wir raten von der Verwendung jeglicher Art von Registry Cleaner ab.

Der Grund ist ganz einfach:
Die Registry ist das Hirn des Systems. Funktioniert das Hirn nicht, funktioniert der Rest nicht mehr wirklich.
Man sollte nicht unnötigerweise an der Registry rumbasteln. Schon ein kleiner Fehler kann gravierende Folgen haben und auch Programme machen manchmal Fehler.
Zerstörst du die Registry, zerstörst du Windows.

Zudem ist der Nutzen zur Performancesteigerung umstritten und meist kaum im wahrnehmbaren Bereich.

Ich würde dir empfehlen, Registry Cleaner nicht weiterhin zu verwenden und über

Start --> Systemsteuerung --> Software (bei Windows XP)
Start --> Systemsteuerung --> Programme und Funktionen (bei Vista / Win 7)

zu deinstallieren.

Wenn du keine Probleme mehr mit Malware hast, dann sind wir hier fertig. Deine Logdateien sind sauber.
Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.


Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
Combofix deinstallieren

• Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
  
• Drücke bitte die + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
• Klicke auf OK.
  Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
• Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte DelFix herunter.

• Schließe alle offenen Programme.
• Starte die delfix.exe mit einem Doppelklick.
• Setze vor jede Funktion ein Häkchen.
• Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...und/oder das Forum mit einer kleinen Spende unterstützen.


Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein einziges der folgenden Antivirusprogramme mit Echtzeitscanner und stets aktueller Signaturendatenbank:

	Emsisoft	Avast	MSE

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:
NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.


Lade Software von einem sauberen Portal wie .
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .


Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 20-04-2015
Ran by PC at 2015-04-25 21:38:44 Run:2
Running from C:\Users\PC\Desktop
Loaded Profiles: PC (Available profiles: PC)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
start
CloseProcesses:
C:\iufshsidjfi
D:\Downl.-Schrott\*.exe
EmptyTemp:
end
*****************

Processes closed successfully.
C:\iufshsidjfi => Moved successfully.
D:\Downl.-Schrott\*.exe => Moved successfully.
EmptyTemp: => Removed 12.8 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 21:40:30 ====
         

Hallo,
ComboFix läßt sich nicht deinstallieren über Windowstaste +R. Nach der Eingabe "Combofix/Uninstall "und ok erscheint die Meldung das diese nicht gefunden wurde. Ich habe mehrere Schreibweisen versucht.
Dann möchte ich noch anmerken, dass bei drücken der Strg oder der Umschalttaste beim ersten mal nach einem Rechner-Neustart ein furchterregender Quiklaut zu hören ist.
Wie soll ich weiter verfahren?