Trojaner-Board - vermeintlicher BKA-Trojaner

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - vermeintlicher BKA-Trojaner - wirklich weg? (https://www.trojaner-board.de/112592-vermeintlicher-bka-trojaner-wirklich-weg.html)

vermeintlicher BKA-Trojaner - wirklich weg?

Hallo Leute,

vor 3 Tagen hab ich mir bei ner stinknormalen Google-Bildersuche den Trojaner eingefangen. Es erschien eine Fehlermeldung mit: "Ihr System wurde gesperrt" oder so ähnlich. Nach einer 50€-Gebühr sollte angeblich alles wieder funktionieren. Habs natürlich nicht gemacht. Konnte kein anderes Progeamm mehr ausführen, weil die Meldung immer im Vordergrund war. Ein Ab- und Anmelden des Users hat auch nichts gebracht. Hab dann die Verbindung zum Inet getrennt, dann konnte ich wieder rein. Hab Avira und Malwarebytes drüber laufen lassen, wonach Malwarebytes ein Fund hatte, den ich gelöscht hab, und anschließend hab ich eine OTL-Logfile erstellt. Irgendwie steht in der ersten log aber nichts von dem Fund.

Hier die erste Malwarebytes Log und OTL Log:

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.03.27.02
 

Windows 7 x64 NTFS

Internet Explorer 9.0.8112.16421

S :: SCHWEDE [Administrator]
 

Schutz: Deaktiviert
 

27.03.2012 11:07:10

mbam-log-2012-03-27 (11-07-10).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 384702

Laufzeit: 2 Stunde(n), 49 Minute(n), 24 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

OTL logfile created on: 27.03.2012 11:10:32 - Run 1

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\S\Desktop

64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,86 Gb Total Physical Memory | 2,24 Gb Available Physical Memory | 57,96% Memory free

7,71 Gb Paging File | 5,74 Gb Available in Paging File | 74,44% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 236,56 Gb Total Space | 156,88 Gb Free Space | 66,32% Space Free | Partition Type: NTFS

Drive E: | 215,77 Gb Total Space | 112,50 Gb Free Space | 52,14% Space Free | Partition Type: NTFS

 

Computer Name: SCHWEDE | User Name: S | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\S\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

PRC - C:\program files (x86)\avira\antivir desktop\avcenter.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Programme\Sony\VAIO Care\VCService.exe (Sony Corporation)

PRC - C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)

PRC - C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe (Sony Corporation)

PRC - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)

PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)

PRC - C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)

PRC - C:\Program Files (x86)\RocketDock\RocketDock.exe ()

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\966a138f3aed60400472ac415bd16bc8\IAStorUtil.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0a894f77b9aa64acbd3ce791916357d8\System.Runtime.Remoting.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ff30db6905f8ec024fc808ed8779c0f3\System.Windows.Forms.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\a09ee392fa90849f2e9313a1ebbe0279\System.Drawing.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\585ac5899ab444221c8b41df13b194bc\WindowsBase.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49f4cb0755ccc34cd35ff96dc2ef9e3\System.Xml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\15742b3597258ce67cbe219005c197e5\System.Configuration.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1f14b3e1ee0847f8662f513e67f92547\System.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll ()

MOD - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL ()

MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll ()

MOD - C:\Program Files (x86)\RocketDock\Docklets\StackDocklet\StackDocklet.dll ()

MOD - C:\Program Files (x86)\RocketDock\RocketDock.exe ()

MOD - C:\Program Files (x86)\RocketDock\RocketDock.dll ()

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - (SampleCollector) -- C:\Program Files\Sony\VAIO Care\VCPerfService.exe (Sony Corporation)

SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)

SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (VUAgent) -- C:\Programme\Sony\VAIO Update Common\VUAgent.exe (Sony Corporation)

SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)

SRV - (VCService) -- C:\Programme\Sony\VAIO Care\VCService.exe (Sony Corporation)

SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)

SRV - (VAIO Power Management) -- C:\Programme\Sony\VAIO Power Management\SPMService.exe (Sony Corporation)

SRV - (btwdins) -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)

SRV - (VSNService) -- C:\Programme\Sony\VAIO Smart Network\VSNService.exe (Sony Corporation)

SRV - (PMBDeviceInfoProvider) -- C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)

SRV - (VAIO Event Service) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)

SRV - (UNS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)

SRV - (LMS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)

SRV - (CVPND) -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (ACDaemon) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)

SRV - (IAStorDataMgrSvc) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)

SRV - (AdobeActiveFileMonitor8.0) -- C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (uCamMonitor) -- C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)

DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)

DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd)

DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)

DRV:64bit: - (IntcDAud) Intel(R) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)

DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)

DRV:64bit: - (btwrchid) -- C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)

DRV:64bit: - (btwampfl) -- C:\Windows\SysNative\drivers\btwampfl.sys (Broadcom Corporation.)

DRV:64bit: - (btwavdt) -- C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)

DRV:64bit: - (btwaudio) -- C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)

DRV:64bit: - (btwl2cap) -- C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)

DRV:64bit: - (risdsnpe) -- C:\Windows\SysNative\drivers\risdsne64.sys (REDC)

DRV:64bit: - (rimspci) -- C:\Windows\SysNative\drivers\rimssne64.sys (REDC)

DRV:64bit: - (ApfiltrService) -- C:\Windows\SysNative\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)

DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys (Marvell)

DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)

DRV:64bit: - (RTHDMIAzAudService) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)

DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)

DRV:64bit: - (HECIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)

DRV:64bit: - (SFEP) -- C:\Windows\SysNative\drivers\SFEP.sys (Sony Corporation)

DRV:64bit: - (CVPNDRVA) -- C:\Windows\SysNative\drivers\CVPNDRVA.sys ()

DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)

DRV:64bit: - (CVirtA) -- C:\Windows\SysNative\drivers\CVirtA64.sys (Cisco Systems, Inc.)

DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)

DRV:64bit: - (irda) -- C:\Windows\SysNative\drivers\irda.sys (Microsoft Corporation)

DRV:64bit: - (Dot4Scan) -- C:\Windows\SysNative\drivers\Dot4Scan.sys (Microsoft Corporation)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (ArcSoftKsUFilter) -- C:\Windows\SysNative\drivers\ArcSoftKsUFilter.sys (ArcSoft, Inc.)

DRV:64bit: - (FTDIBUS) -- C:\Windows\SysNative\drivers\ftdibus.sys (FTDI Ltd.)

DRV:64bit: - (FTSER2K) -- C:\Windows\SysNative\drivers\ftser2k.sys (FTDI Ltd.)

DRV:64bit: - (DNE) -- C:\Windows\SysNative\drivers\dne64x.sys (Deterministic Networks, Inc.)

DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)

DRV:64bit: - (STIrUsb) -- C:\Windows\SysNative\drivers\irstusb.sys (SigmaTel, Inc.)

DRV - (WinRing0_1_2_0) -- C:\Users\S\AppData\Local\Microsoft\Windows Sidebar\Gadgets\IntelCoreSeries24.gadget\WinRing0x64.sys (OpenLibSys.org)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

DRV - (PolarUSB) -- C:\Windows\SysWOW64\drivers\PolarUSB.sys (Polar Electro)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\S\Desktop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SVEE&bmod=SVEE

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.spox.com/de/index.html

IE - HKCU\..\URLSearchHook:  - No CLSID value found

IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SVEE_deDE413DE413

IE - HKCU\..\SearchScopes\{89616134-0458-4972-B851-E92B7D44C4C7}: "URL" = hxxp://rover.ebay.com/rover/1/707-37276-16609-9/4?satitle={searchTerms}

IE - HKCU\..\SearchScopes\{ADD2E8FB-7284-4AAB-B53D-B9A38F70BB3F}: "URL" = hxxp://de.shopping.com/?linkin_id=8056363

IE - HKCU\..\SearchScopes\{CA0BD1B5-A06D-4B17-B78F-31373DF84432}: "URL" = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://www.zeit.de/index"

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1

FF - prefs.js..extensions.enabledItems: {20cc25e2-48c9-45e1-9a1f-1ccc1882b81b}:1.9

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q="

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.03.19 09:59:44 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.01.11 21:33:33 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.08.20 12:28:55 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins

 

[2011.01.06 01:52:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\S\AppData\Roaming\mozilla\Extensions

[2011.01.06 01:52:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\S\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2012.03.12 22:44:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\S\AppData\Roaming\mozilla\Firefox\Profiles\l062mb0m.default\extensions

[2011.01.04 23:15:03 | 000,000,000 | ---D | M] ("Facebook PhotoZoom") -- C:\Users\S\AppData\Roaming\mozilla\Firefox\Profiles\l062mb0m.default\extensions\{20cc25e2-48c9-45e1-9a1f-1ccc1882b81b}

[2011.10.15 13:31:06 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\S\AppData\Roaming\mozilla\Firefox\Profiles\l062mb0m.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2011.12.25 12:11:11 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\S\AppData\Roaming\mozilla\Firefox\Profiles\l062mb0m.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2012.03.01 18:00:21 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\S\AppData\Roaming\mozilla\Firefox\Profiles\l062mb0m.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}

[2012.03.25 15:22:51 | 000,001,056 | ---- | M] () -- C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\l062mb0m.default\searchplugins\icqplugin.xml

[2011.03.05 16:34:09 | 000,001,583 | ---- | M] () -- C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\l062mb0m.default\searchplugins\web-search.xml

[2012.01.06 13:41:32 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

() (No name found) -- C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\EXTENSIONS\{C45C406E-AB73-11D8-BE73-000A95BE3B12}.XPI

() (No name found) -- C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\EXTENSIONS\{E9AD55AB-4D1C-42D2-A40C-A5563A9AD5E6}.XPI

() (No name found) -- C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI

[2012.03.19 09:59:44 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2011.10.03 05:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2010.12.09 12:47:06 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll

[2011.11.05 05:38:54 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.11.05 05:32:18 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2011.11.05 05:38:54 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2011.11.05 05:38:54 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.11.05 05:38:54 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.11.05 05:38:54 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

O4:64bit: - HKLM..\Run: [Apoint] C:\Programme\Apoint\Apoint.exe (Alps Electric Co., Ltd.)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)

O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKCU..\Run: [RocketDock] C:\Program Files (x86)\RocketDock\RocketDock.exe ()

O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108860

O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\S\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\S\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html File not found

O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Free YouTube Download - C:\Users\S\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\S\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html File not found

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe (PokerStars)

O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Users\S\Desktop\PartyPoker.lnk File not found

O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Users\S\Desktop\PartyPoker.lnk File not found

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Reg Error: Key error.)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BC863AAA-54E2-4F05-A57B-5B003D0368DB}: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C3FA99C0-6D20-46D3-A571-87208C430CB4}: DhcpNameServer = 192.168.0.1

O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{54b0a060-3ae6-11e1-a9a2-544249ef1016}\Shell - "" = AutoRun

O33 - MountPoints2\{54b0a060-3ae6-11e1-a9a2-544249ef1016}\Shell\AutoRun\command - "" = J:\KODAK_Camera_Setup_App.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.03.27 11:05:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.03.27 11:05:47 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.03.27 11:05:21 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\S\Desktop\OTL.exe

[2012.03.27 11:04:58 | 009,502,424 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\S\Desktop\mbam--setup-1.60.1.1000.exe

[2012.03.26 23:00:59 | 000,000,000 | ---D | C] -- C:\Users\S\AppData\Roaming\Malwarebytes

[2012.03.26 23:00:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.03.26 23:00:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.03.18 19:52:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PokerTH-0.9.3

[2012.03.17 21:52:57 | 000,000,000 | ---D | C] -- C:\Users\S\AppData\Local\PokerStars

[2012.03.17 21:52:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerStars

[2012.03.17 21:52:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PokerStars

[2012.03.14 13:04:55 | 005,504,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe

[2012.03.14 13:04:55 | 003,957,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe

[2012.03.14 13:04:54 | 003,902,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe

[2012.03.14 11:33:03 | 001,541,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll

[2012.03.14 11:33:02 | 001,837,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll

[2012.03.14 11:33:02 | 000,902,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll

[2012.03.14 11:33:02 | 000,320,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll

[2012.03.14 11:33:02 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll

[2012.03.14 11:32:27 | 001,031,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcore.dll

[2012.03.14 11:32:26 | 000,826,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpcore.dll

[2012.03.14 11:32:25 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll

[2012.03.14 11:32:25 | 000,076,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll

[2012.03.14 11:32:25 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.03.27 12:01:35 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.03.27 12:01:35 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.03.27 11:59:01 | 001,613,412 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.03.27 11:59:01 | 000,697,098 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.03.27 11:59:01 | 000,652,376 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.03.27 11:59:01 | 000,148,362 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.03.27 11:59:01 | 000,121,308 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.03.27 11:53:33 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.03.27 11:53:22 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl

[2012.03.27 11:53:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.03.27 11:53:05 | 3106,480,128 | -HS- | M] () -- C:\hiberfil.sys

[2012.03.27 11:26:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.03.27 11:21:48 | 000,000,162 | -H-- | M] () -- C:\Users\S\Desktop\~$rmatvorlage_Leipzig.dot

[2012.03.27 11:05:49 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.27 11:05:23 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\S\Desktop\OTL.exe

[2012.03.27 11:05:04 | 009,502,424 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\S\Desktop\mbam--setup-1.60.1.1000.exe

[2012.03.22 14:29:48 | 003,334,095 | ---- | M] () -- C:\Users\S\Desktop\BTA-59628780.pdf

[2012.03.20 20:37:55 | 002,031,429 | ---- | M] () -- C:\Users\S\Desktop\faltblatt_honky_lpz_2012_12s-web.pdf

[2012.03.19 18:42:44 | 000,572,207 | ---- | M] () -- C:\Users\S\Desktop\leistungsstruktur.jpg

[2012.03.18 21:21:02 | 000,717,605 | ---- | M] () -- C:\Users\S\Desktop\Unbenannt-1 Kopie.jpg

[2012.03.16 13:37:52 | 000,334,900 | ---- | M] () -- C:\Users\S\Desktop\fulltext.pdf

[2012.03.14 15:32:45 | 000,590,555 | ---- | M] () -- C:\Users\S\Desktop\vortragkamenalfermann_289945_2007.pdf

[2012.03.14 14:35:45 | 000,017,408 | ---- | M] () -- C:\Users\S\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.03.14 14:13:22 | 002,840,800 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.03.13 16:22:26 | 003,025,220 | ---- | M] () -- C:\Users\S\Desktop\Ben l Oncle Soul - 'Seven Nation Army' [cover] + transcript lyrics.mp3

[2012.03.13 16:20:21 | 002,044,769 | ---- | M] () -- C:\Users\S\Desktop\Ben l'oncle Soul - Seven Nation Army.mp3

[2012.03.13 16:07:41 | 000,039,319 | ---- | M] () -- C:\Users\S\Desktop\DFB-Mitglieder-Statistik-2011.pdf

[2012.03.11 12:36:45 | 863,472,378 | ---- | M] () -- C:\Users\S\Desktop\KONY_2012.mp4

[2012.02.29 20:08:19 | 000,035,266 | ---- | M] () -- C:\Users\S\Desktop\Youtube_logo.png

[2012.02.29 12:47:16 | 000,025,600 | ---- | M] () -- C:\Users\S\Desktop\Formatvorlage_Leipzig.dot

[2012.02.28 14:23:46 | 001,591,306 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.03.27 11:21:48 | 000,000,162 | -H-- | C] () -- C:\Users\S\Desktop\~$rmatvorlage_Leipzig.dot

[2012.03.27 11:05:49 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.22 14:29:48 | 003,334,095 | ---- | C] () -- C:\Users\S\Desktop\BTA-59628780.pdf

[2012.03.20 20:37:55 | 002,031,429 | ---- | C] () -- C:\Users\S\Desktop\faltblatt_honky_lpz_2012_12s-web.pdf

[2012.03.19 18:42:44 | 000,572,207 | ---- | C] () -- C:\Users\S\Desktop\leistungsstruktur.jpg

[2012.03.18 21:21:00 | 000,717,605 | ---- | C] () -- C:\Users\S\Desktop\Unbenannt-1 Kopie.jpg

[2012.03.16 13:37:52 | 000,334,900 | ---- | C] () -- C:\Users\S\Desktop\fulltext.pdf

[2012.03.14 15:32:45 | 000,590,555 | ---- | C] () -- C:\Users\S\Desktop\vortragkamenalfermann_289945_2007.pdf

[2012.03.13 16:22:14 | 003,025,220 | ---- | C] () -- C:\Users\S\Desktop\Ben l Oncle Soul - 'Seven Nation Army' [cover] + transcript lyrics.mp3

[2012.03.13 16:20:11 | 002,044,769 | ---- | C] () -- C:\Users\S\Desktop\Ben l'oncle Soul - Seven Nation Army.mp3

[2012.03.13 16:07:41 | 000,039,319 | ---- | C] () -- C:\Users\S\Desktop\DFB-Mitglieder-Statistik-2011.pdf

[2012.03.11 12:32:58 | 863,472,378 | ---- | C] () -- C:\Users\S\Desktop\KONY_2012.mp4

[2012.02.29 20:08:19 | 000,035,266 | ---- | C] () -- C:\Users\S\Desktop\Youtube_logo.png

[2012.02.29 12:47:15 | 000,025,600 | ---- | C] () -- C:\Users\S\Desktop\Formatvorlage_Leipzig.dot

[2012.01.21 15:38:23 | 001,591,306 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2012.01.06 17:33:12 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini

[2011.11.17 19:53:22 | 000,000,600 | ---- | C] () -- C:\Users\S\AppData\Local\PUTTY.RND

[2011.06.25 16:58:23 | 000,001,025 | ---- | C] () -- C:\Windows\SysWow64\sysprs7.dll

[2011.06.25 16:58:23 | 000,000,205 | ---- | C] () -- C:\Windows\SysWow64\lsprst7.dll

[2011.03.18 15:01:05 | 000,007,615 | ---- | C] () -- C:\Users\S\AppData\Local\resmon.resmoncfg

[2011.02.19 23:21:47 | 000,005,642 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys

[2011.02.19 23:21:47 | 000,000,088 | RHS- | C] () -- C:\ProgramData\24C97DD5D8.sys

[2011.01.11 14:20:06 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll

[2011.01.08 20:59:13 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI

[2011.01.06 22:02:23 | 000,017,408 | ---- | C] () -- C:\Users\S\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.01.06 02:37:05 | 000,540,178 | ---- | C] () -- C:\Windows\SysWow64\x264vfw.dll

[2011.01.06 02:37:04 | 003,596,288 | ---- | C] () -- C:\Windows\SysWow64\qt-dx331.dll

[2011.01.06 02:37:04 | 000,761,856 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll

[2011.01.06 02:37:04 | 000,180,224 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll

[2011.01.06 02:37:01 | 000,019,968 | ---- | C] () -- C:\Windows\SysWow64\cpuinf32.dll

[2011.01.06 01:52:33 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

[2011.01.04 01:43:14 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat

[2010.10.08 08:55:10 | 000,002,023 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

[2010.07.13 00:11:37 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2010.07.12 22:27:34 | 000,870,560 | ---- | C] () -- C:\Windows\SysWow64\igkrng575.bin

[2010.07.12 22:27:34 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\iglhsip32.dll

[2010.07.12 22:27:34 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\iglhcp32.dll

[2010.07.12 22:27:33 | 000,104,636 | ---- | C] () -- C:\Windows\SysWow64\igfcg575m.bin

[2010.07.12 22:27:32 | 000,127,868 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng575.bin

[2010.07.12 22:27:25 | 000,028,732 | ---- | C] () -- C:\Windows\SysWow64\ativvsny.dat

[2010.07.12 22:27:25 | 000,026,936 | ---- | C] () -- C:\Windows\SysWow64\ativvsnl.dat
 

< End of report >

Hab aber irgendwie Bedenken, ob das Virus weg ist. Seitdem gehts wieder alles. Hab jetzt nochmal Malwarebytes drüber laufen lassen und dann noch eine ESET Log erstellt. In einem anderen Thread hab ich das gelesen. Hier die Logs:

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.03.29.03
 

Windows 7 x64 NTFS

Internet Explorer 9.0.8112.16421

S :: SCHWEDE [Administrator]
 

Schutz: Deaktiviert
 

29.03.2012 11:57:18

mbam-log-2012-03-29 (11-57-18).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 366095

Laufzeit: 1 Stunde(n), 13 Minute(n), 26 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=306476dcc9229040be0b1a929e2bd6b4

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-03-29 03:47:53

# local_time=2012-03-29 05:47:53 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7600 NT 

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=1792 16777215 100 0 13996196 13996196 0 0

# compatibility_mode=5893 16776573 100 94 180610 84652803 0 0

# compatibility_mode=8192 67108863 100 0 105 105 0 0

# scanned=306285

# found=1

# cleaned=0

# scan_time=13120

E:\Dreckszeug\Nero_Setup7.8.5.0_Demo.exe        Win32/Toolbar.AskSBar application (unable to clean)        00000000000000000000000000000000        I

Ich wüsste jetzt gern, ob der Trojaner, oder was das auch immer war, weg ist. Vielen Dank schonmal für eure Hilfe!!!

Liebe Grüße
Micha

Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

Leider hab ich Malwarebytes erst eingesetzt, als ich das Ding schon drauf hatte. Diese beiden Logs oben sind alle, die ich hab.

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Ok. Hab ich gemacht. Hier die Log:
OTL Logfile:

Code:

OTL logfile created on: 01.04.2012 16:29:02 - Run 2

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\S\Desktop

64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,86 Gb Total Physical Memory | 2,59 Gb Available Physical Memory | 67,21% Memory free

7,71 Gb Paging File | 5,99 Gb Available in Paging File | 77,65% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 236,56 Gb Total Space | 154,67 Gb Free Space | 65,38% Space Free | Partition Type: NTFS

Drive E: | 215,77 Gb Total Space | 112,45 Gb Free Space | 52,11% Space Free | Partition Type: NTFS

 

Computer Name: SCHWEDE | User Name: S | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\S\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Programme\Sony\VAIO Care\VCService.exe (Sony Corporation)

PRC - C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)

PRC - C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe (Sony Corporation)

PRC - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)

PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)

PRC - C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)

PRC - C:\Program Files (x86)\RocketDock\RocketDock.exe ()

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\966a138f3aed60400472ac415bd16bc8\IAStorUtil.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0a894f77b9aa64acbd3ce791916357d8\System.Runtime.Remoting.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ff30db6905f8ec024fc808ed8779c0f3\System.Windows.Forms.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\a09ee392fa90849f2e9313a1ebbe0279\System.Drawing.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\585ac5899ab444221c8b41df13b194bc\WindowsBase.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49f4cb0755ccc34cd35ff96dc2ef9e3\System.Xml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\15742b3597258ce67cbe219005c197e5\System.Configuration.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1f14b3e1ee0847f8662f513e67f92547\System.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll ()

MOD - C:\Program Files (x86)\RocketDock\Docklets\StackDocklet\StackDocklet.dll ()

MOD - C:\Program Files (x86)\RocketDock\RocketDock.exe ()

MOD - C:\Program Files (x86)\RocketDock\RocketDock.dll ()

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - (SampleCollector) -- C:\Program Files\Sony\VAIO Care\VCPerfService.exe (Sony Corporation)

SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)

SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (VUAgent) -- C:\Programme\Sony\VAIO Update Common\VUAgent.exe (Sony Corporation)

SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)

SRV - (VCService) -- C:\Programme\Sony\VAIO Care\VCService.exe (Sony Corporation)

SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)

SRV - (VAIO Power Management) -- C:\Programme\Sony\VAIO Power Management\SPMService.exe (Sony Corporation)

SRV - (btwdins) -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)

SRV - (VSNService) -- C:\Programme\Sony\VAIO Smart Network\VSNService.exe (Sony Corporation)

SRV - (PMBDeviceInfoProvider) -- C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)

SRV - (VAIO Event Service) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)

SRV - (UNS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)

SRV - (LMS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)

SRV - (CVPND) -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (ACDaemon) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)

SRV - (IAStorDataMgrSvc) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)

SRV - (AdobeActiveFileMonitor8.0) -- C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (uCamMonitor) -- C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)

DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)

DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)

DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd)

DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)

DRV:64bit: - (IntcDAud) Intel(R) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)

DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)

DRV:64bit: - (btwrchid) -- C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)

DRV:64bit: - (btwampfl) -- C:\Windows\SysNative\drivers\btwampfl.sys (Broadcom Corporation.)

DRV:64bit: - (btwavdt) -- C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)

DRV:64bit: - (btwaudio) -- C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)

DRV:64bit: - (btwl2cap) -- C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)

DRV:64bit: - (risdsnpe) -- C:\Windows\SysNative\drivers\risdsne64.sys (REDC)

DRV:64bit: - (rimspci) -- C:\Windows\SysNative\drivers\rimssne64.sys (REDC)

DRV:64bit: - (ApfiltrService) -- C:\Windows\SysNative\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)

DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys (Marvell)

DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)

DRV:64bit: - (RTHDMIAzAudService) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)

DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)

DRV:64bit: - (HECIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)

DRV:64bit: - (SFEP) -- C:\Windows\SysNative\drivers\SFEP.sys (Sony Corporation)

DRV:64bit: - (CVPNDRVA) -- C:\Windows\SysNative\drivers\CVPNDRVA.sys ()

DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)

DRV:64bit: - (CVirtA) -- C:\Windows\SysNative\drivers\CVirtA64.sys (Cisco Systems, Inc.)

DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)

DRV:64bit: - (irda) -- C:\Windows\SysNative\drivers\irda.sys (Microsoft Corporation)

DRV:64bit: - (Dot4Scan) -- C:\Windows\SysNative\drivers\Dot4Scan.sys (Microsoft Corporation)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (ArcSoftKsUFilter) -- C:\Windows\SysNative\drivers\ArcSoftKsUFilter.sys (ArcSoft, Inc.)

DRV:64bit: - (FTDIBUS) -- C:\Windows\SysNative\drivers\ftdibus.sys (FTDI Ltd.)

DRV:64bit: - (FTSER2K) -- C:\Windows\SysNative\drivers\ftser2k.sys (FTDI Ltd.)

DRV:64bit: - (DNE) -- C:\Windows\SysNative\drivers\dne64x.sys (Deterministic Networks, Inc.)

DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)

DRV:64bit: - (STIrUsb) -- C:\Windows\SysNative\drivers\irstusb.sys (SigmaTel, Inc.)

DRV - (WinRing0_1_2_0) -- C:\Users\S\AppData\Local\Microsoft\Windows Sidebar\Gadgets\IntelCoreSeries24.gadget\WinRing0x64.sys (OpenLibSys.org)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

DRV - (PolarUSB) -- C:\Windows\SysWOW64\drivers\PolarUSB.sys (Polar Electro)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-2356455393-4161031106-362288086-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\S\Desktop

IE - HKU\S-1-5-21-2356455393-4161031106-362288086-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SVEE&bmod=SVEE

IE - HKU\S-1-5-21-2356455393-4161031106-362288086-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.spox.com/de/index.html

IE - HKU\S-1-5-21-2356455393-4161031106-362288086-1000\..\URLSearchHook:  - No CLSID value found

IE - HKU\S-1-5-21-2356455393-4161031106-362288086-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKU\S-1-5-21-2356455393-4161031106-362288086-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

IE - HKU\S-1-5-21-2356455393-4161031106-362288086-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SVEE_deDE413DE413

IE - HKU\S-1-5-21-2356455393-4161031106-362288086-1000\..\SearchScopes\{89616134-0458-4972-B851-E92B7D44C4C7}: "URL" = hxxp://rover.ebay.com/rover/1/707-37276-16609-9/4?satitle={searchTerms}

IE - HKU\S-1-5-21-2356455393-4161031106-362288086-1000\..\SearchScopes\{ADD2E8FB-7284-4AAB-B53D-B9A38F70BB3F}: "URL" = hxxp://de.shopping.com/?linkin_id=8056363

IE - HKU\S-1-5-21-2356455393-4161031106-362288086-1000\..\SearchScopes\{CA0BD1B5-A06D-4B17-B78F-31373DF84432}: "URL" = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices

IE - HKU\S-1-5-21-2356455393-4161031106-362288086-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2356455393-4161031106-362288086-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://www.zeit.de/index"

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1

FF - prefs.js..extensions.enabledItems: {20cc25e2-48c9-45e1-9a1f-1ccc1882b81b}:1.9

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q="

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.03.19 09:59:44 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.01.11 21:33:33 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.08.20 12:28:55 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins

 

[2011.01.06 01:52:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\S\AppData\Roaming\mozilla\Extensions

[2011.01.06 01:52:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\S\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2012.03.30 16:04:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\S\AppData\Roaming\mozilla\Firefox\Profiles\l062mb0m.default\extensions

[2011.01.04 23:15:03 | 000,000,000 | ---D | M] ("Facebook PhotoZoom") -- C:\Users\S\AppData\Roaming\mozilla\Firefox\Profiles\l062mb0m.default\extensions\{20cc25e2-48c9-45e1-9a1f-1ccc1882b81b}

[2011.10.15 13:31:06 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\S\AppData\Roaming\mozilla\Firefox\Profiles\l062mb0m.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2012.03.30 16:04:19 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\S\AppData\Roaming\mozilla\Firefox\Profiles\l062mb0m.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2012.03.01 18:00:21 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\S\AppData\Roaming\mozilla\Firefox\Profiles\l062mb0m.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}

[2012.03.25 15:22:51 | 000,001,056 | ---- | M] () -- C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\l062mb0m.default\searchplugins\icqplugin.xml

[2011.03.05 16:34:09 | 000,001,583 | ---- | M] () -- C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\l062mb0m.default\searchplugins\web-search.xml

[2012.01.06 13:41:32 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

() (No name found) -- C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\EXTENSIONS\{C45C406E-AB73-11D8-BE73-000A95BE3B12}.XPI

() (No name found) -- C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\EXTENSIONS\{E9AD55AB-4D1C-42D2-A40C-A5563A9AD5E6}.XPI

() (No name found) -- C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI

[2012.03.19 09:59:44 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2011.10.03 05:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2010.12.09 12:47:06 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll

[2011.11.05 05:38:54 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.11.05 05:32:18 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2011.11.05 05:38:54 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2011.11.05 05:38:54 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.11.05 05:38:54 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.11.05 05:38:54 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O3 - HKU\S-1-5-21-2356455393-4161031106-362288086-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

O4:64bit: - HKLM..\Run: [Apoint] C:\Programme\Apoint\Apoint.exe (Alps Electric Co., Ltd.)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)

O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-2356455393-4161031106-362288086-1000..\Run: [RocketDock] C:\Program Files (x86)\RocketDock\RocketDock.exe ()

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKU\S-1-5-21-2356455393-4161031106-362288086-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-2356455393-4161031106-362288086-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108860

O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\S\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\S\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html File not found

O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Free YouTube Download - C:\Users\S\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\S\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html File not found

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe (PokerStars)

O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Users\S\Desktop\PartyPoker.lnk File not found

O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Users\S\Desktop\PartyPoker.lnk File not found

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Reg Error: Key error.)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C3FA99C0-6D20-46D3-A571-87208C430CB4}: DhcpNameServer = 192.168.0.1

O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{54b0a060-3ae6-11e1-a9a2-544249ef1016}\Shell - "" = AutoRun

O33 - MountPoints2\{54b0a060-3ae6-11e1-a9a2-544249ef1016}\Shell\AutoRun\command - "" = J:\KODAK_Camera_Setup_App.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

 

MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

MsConfig:64bit - StartUpReg: Akamai NetSession Interface - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: DAEMON Tools Lite - hkey= - key= - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

MsConfig:64bit - StartUpReg: HP Deskjet 3070 B611 series (NET) - hkey= - key= - C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)

MsConfig:64bit - StartUpReg: HP Software Update - hkey= - key= - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe (Hewlett-Packard)

MsConfig:64bit - StartUpReg: ICQ - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: PMBVolumeWatcher - hkey= - key= - C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe (Sony Corporation)

MsConfig:64bit - StartUpReg: Standby - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: Steam - hkey= - key= - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)

MsConfig:64bit - StartUpReg: swg - hkey= - key= -  File not found

MsConfig:64bit - State: "startup" - Reg Error: Key error.

MsConfig:64bit - State: "services" - Reg Error: Key error.

 

SafeBootMin:64bit: AppMgmt - Service

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: MCODS - Reg Error: Value error.

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: MCODS - Reg Error: Value error.

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: AppMgmt - Service

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - 

ActiveX:64bit: >{F65A5BD6-CBD5-44BB-92EE-7CD500DC5948} - RunDLL32 IEDKCS32.DLL,BrandIE4 CUSTOM

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker 2.6

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.ac3acm - C:\Windows\SysWow64\ac3acm.acm (fccHandler)

Drivers32: msacm.divxa32 - C:\Windows\SysWow64\divxa32.acm (Kristal StudioDFileDescription)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3fhg - C:\Windows\SysWow64\mp3fhg.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.lameacm - C:\Windows\SysWow64\lameACM.acm (hxxp://www.mp3dev.org/)

Drivers32: VIDC.3iv2 - C:\Windows\SysWow64\3ivxVfWCodec.dll (3ivx.com)

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

Drivers32: VIDC.DIV3 - C:\Windows\SysWow64\DivXc32.dll (Hacked with Joy !)

Drivers32: VIDC.DIV4 - C:\Windows\SysWow64\DivXc32f.dll (Hacked with Joy !)

Drivers32: VIDC.DIVX - C:\Windows\SysWow64\divx.dll (DivX, Inc.)

Drivers32: vidc.i420 - C:\Windows\SysWow64\i420vfw.dll (www.helixcommunity.org)

Drivers32: VIDC.MP42 - MPG4C32.dll File not found

Drivers32: VIDC.MP43 - C:\Windows\SysWow64\msmpeg4.dll (Microsoft Corporation)

Drivers32: VIDC.MPG4 - C:\Windows\SysWow64\msmpeg4.dll (Microsoft Corporation)

Drivers32: VIDC.VP31 - C:\Windows\SysWow64\vp31vfw.dll (On2.com)

Drivers32: VIDC.VP60 - C:\Windows\SysWow64\vp6vfw.dll (On2.com)

Drivers32: VIDC.VP61 - C:\Windows\SysWow64\vp6vfw.dll (On2.com)

Drivers32: VIDC.VP62 - C:\Windows\SysWow64\vp6vfw.dll (On2.com)

Drivers32: VIDC.VP70 - C:\Windows\SysWow64\vp7vfw.dll (On2.com)

Drivers32: VIDC.wmv3 - C:\Windows\SysWow64\WMV9VCM.dll (Microsoft Corporation)

Drivers32: VIDC.X264 - C:\Windows\SysWow64\x264vfw.dll ()

Drivers32: VIDC.XVID - C:\Windows\SysWow64\xvidvfw.dll ()

Drivers32: vidc.yv12 - C:\Windows\SysWow64\yv12vfw.dll (www.helixcommunity.org)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.04.01 16:26:16 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\S\Desktop\OTL.exe

[2012.03.29 14:07:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET

[2012.03.29 11:55:55 | 002,322,184 | ---- | C] (ESET) -- C:\Users\S\Desktop\esetsmartinstaller_enu.exe

[2012.03.29 11:49:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.03.29 11:49:55 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.03.29 11:49:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.03.29 11:49:32 | 009,502,424 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\S\Desktop\mbam--setup-1.60.1.1000.exe

[2012.03.29 11:35:26 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\S\Desktop\HiJackThis204.exe

[2012.03.28 18:42:47 | 000,000,000 | ---D | C] -- C:\Users\S\Desktop\Neuer Ordner

[2012.03.27 14:08:41 | 003,645,304 | ---- | C] (Piriform Ltd) -- C:\Users\S\Desktop\ccsetup317.exe

[2012.03.26 23:00:59 | 000,000,000 | ---D | C] -- C:\Users\S\AppData\Roaming\Malwarebytes

[2012.03.26 23:00:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.03.18 19:52:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PokerTH-0.9.3

[2012.03.17 21:52:57 | 000,000,000 | ---D | C] -- C:\Users\S\AppData\Local\PokerStars

[2012.03.17 21:52:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerStars

[2012.03.17 21:52:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PokerStars

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.04.01 16:31:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.04.01 16:26:18 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\S\Desktop\OTL.exe

[2012.04.01 16:19:41 | 001,613,412 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.04.01 16:19:41 | 000,697,098 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.04.01 16:19:41 | 000,652,376 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.04.01 16:19:41 | 000,148,362 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.04.01 16:19:41 | 000,121,308 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.04.01 16:18:56 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.04.01 16:18:56 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.04.01 16:18:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.04.01 15:47:08 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.04.01 15:46:57 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl

[2012.04.01 15:46:43 | 3106,480,128 | -HS- | M] () -- C:\hiberfil.sys

[2012.03.29 17:22:25 | 001,128,441 | ---- | M] () -- C:\Users\S\Desktop\com_akeeba-3.4.3-core.zip

[2012.03.29 15:25:24 | 000,195,055 | ---- | M] () -- C:\Users\S\Desktop\Getraenkekarte.pdf

[2012.03.29 11:55:57 | 002,322,184 | ---- | M] (ESET) -- C:\Users\S\Desktop\esetsmartinstaller_enu.exe

[2012.03.29 11:49:36 | 009,502,424 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\S\Desktop\mbam--setup-1.60.1.1000.exe

[2012.03.29 11:35:27 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\S\Desktop\HiJackThis204.exe

[2012.03.27 14:09:38 | 003,645,304 | ---- | M] (Piriform Ltd) -- C:\Users\S\Desktop\ccsetup317.exe

[2012.03.22 14:29:48 | 003,334,095 | ---- | M] () -- C:\Users\S\Desktop\BTA-59628780.pdf

[2012.03.20 20:37:55 | 002,031,429 | ---- | M] () -- C:\Users\S\Desktop\faltblatt_honky_lpz_2012_12s-web.pdf

[2012.03.19 18:42:44 | 000,572,207 | ---- | M] () -- C:\Users\S\Desktop\leistungsstruktur.jpg

[2012.03.18 21:21:02 | 000,717,605 | ---- | M] () -- C:\Users\S\Desktop\Unbenannt-1 Kopie.jpg

[2012.03.16 13:37:52 | 000,334,900 | ---- | M] () -- C:\Users\S\Desktop\fulltext.pdf

[2012.03.14 15:32:45 | 000,590,555 | ---- | M] () -- C:\Users\S\Desktop\vortragkamenalfermann_289945_2007.pdf

[2012.03.14 14:35:45 | 000,017,408 | ---- | M] () -- C:\Users\S\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.03.14 14:13:22 | 002,840,800 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.03.13 16:22:26 | 003,025,220 | ---- | M] () -- C:\Users\S\Desktop\Ben l Oncle Soul - 'Seven Nation Army' [cover] + transcript lyrics.mp3

[2012.03.13 16:20:21 | 002,044,769 | ---- | M] () -- C:\Users\S\Desktop\Ben l'oncle Soul - Seven Nation Army.mp3

[2012.03.13 16:07:41 | 000,039,319 | ---- | M] () -- C:\Users\S\Desktop\DFB-Mitglieder-Statistik-2011.pdf

[2012.03.11 12:36:45 | 863,472,378 | ---- | M] () -- C:\Users\S\Desktop\KONY_2012.mp4

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.03.29 17:22:20 | 001,128,441 | ---- | C] () -- C:\Users\S\Desktop\com_akeeba-3.4.3-core.zip

[2012.03.29 15:25:20 | 000,195,055 | ---- | C] () -- C:\Users\S\Desktop\Getraenkekarte.pdf

[2012.03.22 14:29:48 | 003,334,095 | ---- | C] () -- C:\Users\S\Desktop\BTA-59628780.pdf

[2012.03.20 20:37:55 | 002,031,429 | ---- | C] () -- C:\Users\S\Desktop\faltblatt_honky_lpz_2012_12s-web.pdf

[2012.03.19 18:42:44 | 000,572,207 | ---- | C] () -- C:\Users\S\Desktop\leistungsstruktur.jpg

[2012.03.18 21:21:00 | 000,717,605 | ---- | C] () -- C:\Users\S\Desktop\Unbenannt-1 Kopie.jpg

[2012.03.16 13:37:52 | 000,334,900 | ---- | C] () -- C:\Users\S\Desktop\fulltext.pdf

[2012.03.14 15:32:45 | 000,590,555 | ---- | C] () -- C:\Users\S\Desktop\vortragkamenalfermann_289945_2007.pdf

[2012.03.13 16:22:14 | 003,025,220 | ---- | C] () -- C:\Users\S\Desktop\Ben l Oncle Soul - 'Seven Nation Army' [cover] + transcript lyrics.mp3

[2012.03.13 16:20:11 | 002,044,769 | ---- | C] () -- C:\Users\S\Desktop\Ben l'oncle Soul - Seven Nation Army.mp3

[2012.03.13 16:07:41 | 000,039,319 | ---- | C] () -- C:\Users\S\Desktop\DFB-Mitglieder-Statistik-2011.pdf

[2012.03.11 12:32:58 | 863,472,378 | ---- | C] () -- C:\Users\S\Desktop\KONY_2012.mp4

[2012.01.21 15:38:23 | 001,591,306 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2012.01.06 17:33:12 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini

[2011.11.17 19:53:22 | 000,000,600 | ---- | C] () -- C:\Users\S\AppData\Local\PUTTY.RND

[2011.06.25 16:58:23 | 000,001,025 | ---- | C] () -- C:\Windows\SysWow64\sysprs7.dll

[2011.06.25 16:58:23 | 000,000,205 | ---- | C] () -- C:\Windows\SysWow64\lsprst7.dll

[2011.03.18 15:01:05 | 000,007,615 | ---- | C] () -- C:\Users\S\AppData\Local\resmon.resmoncfg

[2011.02.19 23:21:47 | 000,005,642 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys

[2011.02.19 23:21:47 | 000,000,088 | RHS- | C] () -- C:\ProgramData\24C97DD5D8.sys

[2011.01.11 14:20:06 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll

[2011.01.08 20:59:13 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI

[2011.01.06 22:02:23 | 000,017,408 | ---- | C] () -- C:\Users\S\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.01.06 02:37:05 | 000,540,178 | ---- | C] () -- C:\Windows\SysWow64\x264vfw.dll

[2011.01.06 02:37:04 | 003,596,288 | ---- | C] () -- C:\Windows\SysWow64\qt-dx331.dll

[2011.01.06 02:37:04 | 000,761,856 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll

[2011.01.06 02:37:04 | 000,180,224 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll

[2011.01.06 02:37:01 | 000,019,968 | ---- | C] () -- C:\Windows\SysWow64\cpuinf32.dll

[2011.01.06 01:52:33 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

[2011.01.04 01:43:14 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat

[2010.10.08 08:55:10 | 000,002,023 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

[2010.07.13 00:11:37 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2010.07.12 22:27:34 | 000,870,560 | ---- | C] () -- C:\Windows\SysWow64\igkrng575.bin

[2010.07.12 22:27:34 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\iglhsip32.dll

[2010.07.12 22:27:34 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\iglhcp32.dll

[2010.07.12 22:27:33 | 000,104,636 | ---- | C] () -- C:\Windows\SysWow64\igfcg575m.bin

[2010.07.12 22:27:32 | 000,127,868 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng575.bin

[2010.07.12 22:27:25 | 000,028,732 | ---- | C] () -- C:\Windows\SysWow64\ativvsny.dat

[2010.07.12 22:27:25 | 000,026,936 | ---- | C] () -- C:\Windows\SysWow64\ativvsnl.dat

 
 ========== LOP Check ==========

 

[2011.03.20 12:52:31 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\AniTuner

[2011.03.31 00:11:31 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Auslogics

[2011.01.14 23:46:31 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Command & Conquer 3 Tiberium Wars

[2012.02.24 20:23:34 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\DAEMON Tools Lite

[2012.01.02 14:39:02 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\DVDVideoSoft

[2011.05.15 22:49:03 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\DVDVideoSoftIEHelpers

[2012.03.29 17:57:39 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\FileZilla

[2011.05.15 22:41:37 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\HandBrake

[2011.07.18 20:30:03 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\ICQ

[2011.05.19 21:26:03 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\ImgBurn

[2011.04.17 22:49:19 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Notepad++

[2011.08.03 21:07:56 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\pokerth

[2012.03.27 10:52:24 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\streamripper

[2011.01.06 01:52:33 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Thunderbird

[2012.03.27 14:14:41 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\TS3Client

[2012.03.27 10:52:25 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\ts3overlay

[2012.01.19 18:02:00 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.09.10 19:27:40 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Adobe

[2011.03.20 12:52:31 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\AniTuner

[2011.03.27 09:39:01 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Apple Computer

[2011.04.17 22:49:19 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\ArcSoft

[2011.01.03 16:52:59 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\ATI

[2011.03.31 00:11:31 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Auslogics

[2011.10.19 14:19:44 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Avira

[2012.01.11 15:36:58 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\AVS4YOU

[2011.01.14 23:46:31 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Command & Conquer 3 Tiberium Wars

[2012.02.24 20:23:34 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\DAEMON Tools Lite

[2012.01.02 14:39:02 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\DVDVideoSoft

[2011.05.15 22:49:03 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\DVDVideoSoftIEHelpers

[2012.03.29 17:57:39 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\FileZilla

[2011.01.03 17:16:53 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Google

[2011.05.15 22:41:37 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\HandBrake

[2012.01.06 17:34:30 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\HpUpdate

[2011.07.18 20:30:03 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\ICQ

[2011.01.03 16:52:28 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Identities

[2011.05.19 21:26:03 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\ImgBurn

[2011.01.03 16:53:11 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Intel Corporation

[2010.07.28 13:24:28 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Macromedia

[2012.03.26 23:00:59 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Malwarebytes

[2010.07.13 20:20:19 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Media Center Programs

[2011.05.15 22:45:56 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Media Player Classic

[2012.01.09 22:52:24 | 000,000,000 | --SD | M] -- C:\Users\S\AppData\Roaming\Microsoft

[2011.01.03 17:18:25 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Mozilla

[2011.01.21 19:18:27 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Mozilla-Cache

[2011.04.17 22:49:19 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Notepad++

[2011.08.03 21:07:56 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\pokerth

[2011.01.14 23:39:22 | 000,000,000 | RH-D | M] -- C:\Users\S\AppData\Roaming\SecuROM

[2012.03.27 15:25:29 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Skype

[2012.03.27 14:43:53 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\skypePM

[2011.01.03 18:04:26 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Sony Corporation

[2012.03.27 10:52:24 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\streamripper

[2011.01.06 01:52:33 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Thunderbird

[2012.03.27 14:14:41 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\TS3Client

[2012.03.27 10:52:25 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\ts3overlay

[2012.03.27 14:14:43 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\Winamp

[2011.01.04 16:14:49 | 000,000,000 | ---D | M] -- C:\Users\S\AppData\Roaming\WinRAR

 
 < %APPDATA%\*.exe /s >

[2010.07.28 13:24:05 | 000,038,784 | ---- | M] () -- C:\Users\S\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

[2011.03.20 12:35:29 | 000,290,182 | R--- | M] () -- C:\Users\S\AppData\Roaming\Microsoft\Installer\{69A05CAD-B0AA-4586-8FDD-D4827B2652DC}\AniTunerShortcutIcon.exe

 
 < %SYSTEMDRIVE%\*.exe >

[2007.11.07 08:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2010.03.04 04:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- C:\Windows\SysNative\drivers\iaStor.sys

[2010.03.04 04:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_78ebae21a80aa2b4\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0033117673c16921\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\SysNative\netlogon.dll

[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_38e464dbe521cc7f\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\SysNative\scecli.dll

[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\SysNative\user32.dll

[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll

[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\SysNative\userinit.exe

[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\SysNative\winlogon.exe

[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >
 

< End of report >

--- --- ---

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:

:OTL

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q="

FF - user.js - File not found

[2012.03.25 15:22:51 | 000,001,056 | ---- | M] () -- C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\l062mb0m.default\searchplugins\icqplugin.xml

[2011.03.05 16:34:09 | 000,001,583 | ---- | M] () -- C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\l062mb0m.default\searchplugins\web-search.xml

O3 - HKU\S-1-5-21-2356455393-4161031106-362288086-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

O4 - HKLM..\Run: []  File not found

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKU\S-1-5-21-2356455393-4161031106-362288086-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-2356455393-4161031106-362288086-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108860

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{54b0a060-3ae6-11e1-a9a2-544249ef1016}\Shell - "" = AutoRun

O33 - MountPoints2\{54b0a060-3ae6-11e1-a9a2-544249ef1016}\Shell\AutoRun\command - "" = J:\KODAK_Camera_Setup_App.exe

:Commands

[purity]

[emptytemp]

[emptyflash]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

ok habs so gemacht, hier die log:

Code:

All processes killed

========== OTL ==========

Prefs.js: "ICQ Search" removed from browser.search.defaultenginename

Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=" removed from keyword.URL

C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\l062mb0m.default\searchplugins\icqplugin.xml moved successfully.

C:\Users\S\AppData\Roaming\Mozilla\Firefox\Profiles\l062mb0m.default\searchplugins\web-search.xml moved successfully.

Registry value HKEY_USERS\S-1-5-21-2356455393-4161031106-362288086-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.

Registry value HKEY_USERS\S-1-5-21-2356455393-4161031106-362288086-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_USERS\S-1-5-21-2356455393-4161031106-362288086-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{54b0a060-3ae6-11e1-a9a2-544249ef1016}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{54b0a060-3ae6-11e1-a9a2-544249ef1016}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{54b0a060-3ae6-11e1-a9a2-544249ef1016}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{54b0a060-3ae6-11e1-a9a2-544249ef1016}\ not found.

File J:\KODAK_Camera_Setup_App.exe not found.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 41620 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Public

 

User: S

->Temp folder emptied: 1196446 bytes

->Temporary Internet Files folder emptied: 876705038 bytes

->Java cache emptied: 366691 bytes

->FireFox cache emptied: 1087150568 bytes

->Flash cache emptied: 47848 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 82160 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 465047 bytes

RecycleBin emptied: 152875337 bytes

 

Total Files Cleaned = 2.021,00 mb

 

 

[EMPTYFLASH]

 

User: All Users

 

User: Default

->Flash cache emptied: 0 bytes

 

User: Default User

->Flash cache emptied: 0 bytes

 

User: Public

 

User: S

->Flash cache emptied: 0 bytes

 

Total Flash Files Cleaned = 0,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.39.2 log created on 04022012_165725
 

Files\Folders moved on Reboot...

C:\Users\S\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
 

Registry entries deleted on Reboot...

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten, Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

erledigt:

Code:

18:39:50.0884 3864        TDSS rootkit removing tool 2.7.24.0 Apr  2 2012 10:31:48

18:39:51.0371 3864        ============================================================

18:39:51.0371 3864        Current date / time: 2012/04/02 18:39:51.0371

18:39:51.0371 3864        SystemInfo:

18:39:51.0371 3864        

18:39:51.0371 3864        OS Version: 6.1.7600 ServicePack: 0.0

18:39:51.0371 3864        Product type: Workstation

18:39:51.0371 3864        ComputerName: SCHWEDE

18:39:51.0371 3864        UserName: S

18:39:51.0371 3864        Windows directory: C:\Windows

18:39:51.0371 3864        System windows directory: C:\Windows

18:39:51.0371 3864        Running under WOW64

18:39:51.0371 3864        Processor architecture: Intel x64

18:39:51.0371 3864        Number of processors: 4

18:39:51.0371 3864        Page size: 0x1000

18:39:51.0371 3864        Boot type: Normal boot

18:39:51.0371 3864        ============================================================

18:39:51.0798 3864        Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

18:39:51.0802 3864        \Device\Harddisk0\DR0:

18:39:51.0803 3864        MBR used

18:39:51.0803 3864        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1AA7000, BlocksNum 0x32000

18:39:51.0803 3864        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1AD9000, BlocksNum 0x1D91F830

18:39:51.0832 3864        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1F3F9800, BlocksNum 0x1AF8C000

18:39:51.0912 3864        Initialize success

18:39:51.0912 3864        ============================================================

18:41:09.0803 6012        ============================================================

18:41:09.0803 6012        Scan started

18:41:09.0803 6012        Mode: Manual; SigCheck; TDLFS; 

18:41:09.0803 6012        ============================================================

18:41:10.0131 6012        1394ohci        (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\drivers\1394ohci.sys

18:41:10.0256 6012        1394ohci - ok

18:41:10.0349 6012        ACDaemon        (adc420616c501b45d26c0fd3ef1e54e4) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

18:41:10.0412 6012        ACDaemon - ok

18:41:10.0474 6012        ACPI            (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\drivers\ACPI.sys

18:41:10.0505 6012        ACPI - ok

18:41:10.0552 6012        AcpiPmi         (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\drivers\acpipmi.sys

18:41:10.0615 6012        AcpiPmi - ok

18:41:10.0739 6012        AdobeActiveFileMonitor8.0 (34400005de52842c4d6d4ee978b4d7ce) C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe

18:41:10.0771 6012        AdobeActiveFileMonitor8.0 - ok

18:41:10.0895 6012        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

18:41:10.0895 6012        AdobeARMservice - ok

18:41:11.0020 6012        adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\drivers\adp94xx.sys

18:41:11.0051 6012        adp94xx - ok

18:41:11.0129 6012        adpahci         (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\drivers\adpahci.sys

18:41:11.0161 6012        adpahci - ok

18:41:11.0207 6012        adpu320         (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\drivers\adpu320.sys

18:41:11.0223 6012        adpu320 - ok

18:41:11.0270 6012        AeLookupSvc     (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll

18:41:11.0317 6012        AeLookupSvc - ok

18:41:11.0379 6012        AFD             (db9d6c6b2cd95a9ca414d045b627422e) C:\Windows\system32\drivers\afd.sys

18:41:11.0441 6012        AFD - ok

18:41:11.0488 6012        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys

18:41:11.0519 6012        agp440 - ok

18:41:11.0551 6012        ALG             (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe

18:41:11.0613 6012        ALG - ok

18:41:11.0660 6012        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys

18:41:11.0675 6012        aliide - ok

18:41:11.0722 6012        AMD External Events Utility (3f9b03b72577a6a7405bf30801cbd159) C:\Windows\system32\atiesrxx.exe

18:41:11.0769 6012        AMD External Events Utility - ok

18:41:11.0800 6012        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys

18:41:11.0816 6012        amdide - ok

18:41:11.0831 6012        AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\drivers\amdk8.sys

18:41:11.0863 6012        AmdK8 - ok

18:41:12.0003 6012        amdkmdag        (ea244a8b88de8b5986bf3b7903b063af) C:\Windows\system32\DRIVERS\atikmdag.sys

18:41:12.0284 6012        amdkmdag - ok

18:41:12.0377 6012        amdkmdap        (dca6e341a4a7c31ea8a14c6166c9b249) C:\Windows\system32\DRIVERS\atikmpag.sys

18:41:12.0424 6012        amdkmdap - ok

18:41:12.0455 6012        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\drivers\amdppm.sys

18:41:12.0502 6012        AmdPPM - ok

18:41:12.0549 6012        amdsata         (ec7ebab00a4d8448bab68d1e49b4beb9) C:\Windows\system32\drivers\amdsata.sys

18:41:12.0580 6012        amdsata - ok

18:41:12.0611 6012        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\drivers\amdsbs.sys

18:41:12.0643 6012        amdsbs - ok

18:41:12.0674 6012        amdxata         (db27766102c7bf7e95140a2aa81d042e) C:\Windows\system32\drivers\amdxata.sys

18:41:12.0689 6012        amdxata - ok

18:41:12.0814 6012        AntiVirSchedulerService (a122d68ea2541453f787f341877cb40b) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

18:41:12.0830 6012        AntiVirSchedulerService - ok

18:41:12.0908 6012        AntiVirService  (2fe359edeb34efcf42574752f8aebd3f) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

18:41:12.0908 6012        AntiVirService - ok

18:41:13.0048 6012        ApfiltrService  (2d45f2dfbc3d8f53df7ebeffa8c9bc38) C:\Windows\system32\drivers\Apfiltr.sys

18:41:13.0079 6012        ApfiltrService - ok

18:41:13.0142 6012        AppID           (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys

18:41:13.0251 6012        AppID - ok

18:41:13.0282 6012        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll

18:41:13.0360 6012        AppIDSvc - ok

18:41:13.0391 6012        Appinfo         (d065be66822847b7f127d1f90158376e) C:\Windows\System32\appinfo.dll

18:41:13.0423 6012        Appinfo - ok

18:41:13.0485 6012        arc             (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\drivers\arc.sys

18:41:13.0516 6012        arc - ok

18:41:13.0547 6012        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\drivers\arcsas.sys

18:41:13.0579 6012        arcsas - ok

18:41:13.0625 6012        ArcSoftKsUFilter (c130bc4a51b1382b2be8e44579ec4c0a) C:\Windows\system32\DRIVERS\ArcSoftKsUFilter.sys

18:41:13.0625 6012        ArcSoftKsUFilter - ok

18:41:13.0735 6012        aspnet_state    (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

18:41:13.0766 6012        aspnet_state - ok

18:41:13.0797 6012        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

18:41:13.0859 6012        AsyncMac - ok

18:41:13.0891 6012        atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys

18:41:13.0906 6012        atapi - ok

18:41:13.0984 6012        athr            (cca705cdf038d5bc243203ce4416b345) C:\Windows\system32\DRIVERS\athrx.sys

18:41:14.0047 6012        athr - ok

18:41:14.0234 6012        atikmdag        (ea244a8b88de8b5986bf3b7903b063af) C:\Windows\system32\DRIVERS\atikmdag.sys

18:41:14.0327 6012        atikmdag - ok

18:41:14.0421 6012        AudioEndpointBuilder (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll

18:41:14.0515 6012        AudioEndpointBuilder - ok

18:41:14.0515 6012        AudioSrv        (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll

18:41:14.0577 6012        AudioSrv - ok

18:41:14.0655 6012        avgntflt        (aa8f79a1bdfc03b3bc70c44ab00589b4) C:\Windows\system32\DRIVERS\avgntflt.sys

18:41:14.0671 6012        avgntflt - ok

18:41:14.0717 6012        avipbb          (852e3c0a60d368c487949e55ad52a47f) C:\Windows\system32\DRIVERS\avipbb.sys

18:41:14.0733 6012        avipbb - ok

18:41:14.0764 6012        avkmgr          (248db59fc86de44d2779f4c7fb1a567d) C:\Windows\system32\DRIVERS\avkmgr.sys

18:41:14.0764 6012        avkmgr - ok

18:41:14.0842 6012        AxInstSV        (b20b5fa5ca050e9926e4d1db81501b32) C:\Windows\System32\AxInstSV.dll

18:41:14.0889 6012        AxInstSV - ok

18:41:14.0967 6012        b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\drivers\bxvbda.sys

18:41:15.0014 6012        b06bdrv - ok

18:41:15.0061 6012        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

18:41:15.0107 6012        b57nd60a - ok

18:41:15.0170 6012        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll

18:41:15.0201 6012        BDESVC - ok

18:41:15.0217 6012        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

18:41:15.0279 6012        Beep - ok

18:41:15.0326 6012        BFE             (4992c609a6315671463e30f6512bc022) C:\Windows\System32\bfe.dll

18:41:15.0404 6012        BFE - ok

18:41:15.0466 6012        BITS            (7f0c323fe3da28aa4aa1bda3f575707f) C:\Windows\System32\qmgr.dll

18:41:15.0544 6012        BITS - ok

18:41:15.0622 6012        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\drivers\blbdrive.sys

18:41:15.0669 6012        blbdrive - ok

18:41:15.0716 6012        bowser          (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys

18:41:15.0763 6012        bowser - ok

18:41:15.0794 6012        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\BrFiltLo.sys

18:41:15.0825 6012        BrFiltLo - ok

18:41:15.0872 6012        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\BrFiltUp.sys

18:41:15.0887 6012        BrFiltUp - ok

18:41:15.0934 6012        Browser         (94fbc06f294d58d02361918418f996e3) C:\Windows\System32\browser.dll

18:41:15.0997 6012        Browser - ok

18:41:16.0028 6012        Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

18:41:16.0059 6012        Brserid - ok

18:41:16.0090 6012        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

18:41:16.0121 6012        BrSerWdm - ok

18:41:16.0153 6012        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

18:41:16.0199 6012        BrUsbMdm - ok

18:41:16.0215 6012        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

18:41:16.0246 6012        BrUsbSer - ok

18:41:16.0293 6012        BthEnum         (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\drivers\BthEnum.sys

18:41:16.0340 6012        BthEnum - ok

18:41:16.0371 6012        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys

18:41:16.0402 6012        BTHMODEM - ok

18:41:16.0433 6012        BthPan          (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys

18:41:16.0480 6012        BthPan - ok

18:41:16.0511 6012        BTHPORT         (21084ceb85280468c9aca3c805c0f8cf) C:\Windows\System32\Drivers\BTHport.sys

18:41:16.0543 6012        BTHPORT - ok

18:41:16.0589 6012        bthserv         (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll

18:41:16.0667 6012        bthserv - ok

18:41:16.0699 6012        BTHUSB          (8504842634dd144c075b6b0c982ccec4) C:\Windows\System32\Drivers\BTHUSB.sys

18:41:16.0699 6012        BTHUSB - ok

18:41:16.0792 6012        btwampfl        (59e3510784548c6939c1b3b985c232e3) C:\Windows\system32\drivers\btwampfl.sys

18:41:16.0808 6012        btwampfl - ok

18:41:16.0839 6012        btwaudio        (1872074ed0a3fb22e3f1e3197b984bfa) C:\Windows\system32\drivers\btwaudio.sys

18:41:16.0855 6012        btwaudio - ok

18:41:16.0917 6012        btwavdt         (691cf076c33ab1c3a5b2fd5450300733) C:\Windows\system32\drivers\btwavdt.sys

18:41:16.0933 6012        btwavdt - ok

18:41:17.0042 6012        btwdins         (8ba6e93a182126781952a7895ec1e4b2) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

18:41:17.0089 6012        btwdins - ok

18:41:17.0104 6012        btwl2cap        (07096d2bc22ccb6cea5a532df0be8a75) C:\Windows\system32\DRIVERS\btwl2cap.sys

18:41:17.0151 6012        btwl2cap - ok

18:41:17.0167 6012        btwrchid        (c9273b20dec8ce38dbce5d29de63c907) C:\Windows\system32\DRIVERS\btwrchid.sys

18:41:17.0167 6012        btwrchid - ok

18:41:17.0198 6012        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

18:41:17.0291 6012        cdfs - ok

18:41:17.0401 6012        cdrom           (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys

18:41:17.0447 6012        cdrom - ok

18:41:17.0525 6012        CertPropSvc     (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll

18:41:17.0603 6012        CertPropSvc - ok

18:41:17.0650 6012        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\drivers\circlass.sys

18:41:17.0681 6012        circlass - ok

18:41:17.0697 6012        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

18:41:17.0713 6012        CLFS - ok

18:41:17.0791 6012        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

18:41:17.0791 6012        clr_optimization_v2.0.50727_32 - ok

18:41:17.0853 6012        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

18:41:17.0869 6012        clr_optimization_v2.0.50727_64 - ok

18:41:17.0947 6012        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

18:41:17.0978 6012        clr_optimization_v4.0.30319_32 - ok

18:41:18.0025 6012        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

18:41:18.0025 6012        clr_optimization_v4.0.30319_64 - ok

18:41:18.0103 6012        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\drivers\CmBatt.sys

18:41:18.0134 6012        CmBatt - ok

18:41:18.0165 6012        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys

18:41:18.0165 6012        cmdide - ok

18:41:18.0212 6012        CNG             (937beb186a735aca91d717044a49d17e) C:\Windows\system32\Drivers\cng.sys

18:41:18.0243 6012        CNG - ok

18:41:18.0290 6012        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\drivers\compbatt.sys

18:41:18.0305 6012        Compbatt - ok

18:41:18.0352 6012        CompositeBus    (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\drivers\CompositeBus.sys

18:41:18.0368 6012        CompositeBus - ok

18:41:18.0415 6012        COMSysApp - ok

18:41:18.0446 6012        crcdisk         (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\drivers\crcdisk.sys

18:41:18.0461 6012        crcdisk - ok

18:41:18.0508 6012        CryptSvc        (8c57411b66282c01533cb776f98ad384) C:\Windows\system32\cryptsvc.dll

18:41:18.0586 6012        CryptSvc - ok

18:41:18.0633 6012        CVirtA          (44bddeb03c84a1c993c992ffb5700357) C:\Windows\system32\DRIVERS\CVirtA64.sys

18:41:18.0680 6012        CVirtA - ok

18:41:18.0773 6012        CVPND           (66257cb4e4fb69887cddc71663741435) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe

18:41:18.0820 6012        CVPND - ok

18:41:18.0961 6012        CVPNDRVA        (cc8e52daa9826064ba464dbe531f2bb5) C:\Windows\system32\Drivers\CVPNDRVA.sys

18:41:19.0023 6012        CVPNDRVA - ok

18:41:19.0085 6012        DcomLaunch      (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll

18:41:19.0163 6012        DcomLaunch - ok

18:41:19.0210 6012        defragsvc       (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll

18:41:19.0273 6012        defragsvc - ok

18:41:19.0319 6012        DfsC            (9c253ce7311ca60fc11c774692a13208) C:\Windows\system32\Drivers\dfsc.sys

18:41:19.0366 6012        DfsC - ok

18:41:19.0413 6012        Dhcp            (ce3b9562d997f69b330d181a8875960f) C:\Windows\system32\dhcpcore.dll

18:41:19.0460 6012        Dhcp - ok

18:41:19.0491 6012        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

18:41:19.0569 6012        discache - ok

18:41:19.0631 6012        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\drivers\disk.sys

18:41:19.0647 6012        Disk - ok

18:41:19.0709 6012        DNE             (05cb5910b3ca6019fc3cca815ee06ffb) C:\Windows\system32\DRIVERS\dne64x.sys

18:41:19.0725 6012        DNE - ok

18:41:19.0772 6012        Dnscache        (85cf424c74a1d5ec33533e1dbff9920a) C:\Windows\System32\dnsrslvr.dll

18:41:19.0834 6012        Dnscache - ok

18:41:19.0865 6012        dot3svc         (14452acdb09b70964c8c21bf80a13acb) C:\Windows\System32\dot3svc.dll

18:41:19.0928 6012        dot3svc - ok

18:41:20.0006 6012        dot4            (b42ed0320c6e41102fde0005154849bb) C:\Windows\system32\DRIVERS\Dot4.sys

18:41:20.0037 6012        dot4 - ok

18:41:20.0068 6012        Dot4Print       (85135ad27e79b689335c08167d917cde) C:\Windows\system32\DRIVERS\Dot4Prt.sys

18:41:20.0115 6012        Dot4Print - ok

18:41:20.0146 6012        Dot4Scan        (488669cd1cd3bdcfdd9a5fda72209069) C:\Windows\system32\DRIVERS\Dot4Scan.sys

18:41:20.0177 6012        Dot4Scan - ok

18:41:20.0209 6012        dot4usb         (fd05a02b0370bc3000f402e543ca5814) C:\Windows\system32\DRIVERS\dot4usb.sys

18:41:20.0240 6012        dot4usb - ok

18:41:20.0271 6012        DPS             (8c2ba6bea949ee6e68385f5692bafb94) C:\Windows\system32\dps.dll

18:41:20.0333 6012        DPS - ok

18:41:20.0380 6012        drmkaud         (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

18:41:20.0396 6012        drmkaud - ok

18:41:20.0443 6012        dtsoftbus01     (9f98d7afa293947a0dfc6ffd4671fe70) C:\Windows\system32\DRIVERS\dtsoftbus01.sys

18:41:20.0489 6012        dtsoftbus01 - ok

18:41:20.0552 6012        DXGKrnl         (1633b9abf52784a1331476397a48cbef) C:\Windows\System32\drivers\dxgkrnl.sys

18:41:20.0583 6012        DXGKrnl - ok

18:41:20.0630 6012        EapHost         (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll

18:41:20.0708 6012        EapHost - ok

18:41:20.0801 6012        ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\drivers\evbda.sys

18:41:20.0879 6012        ebdrv - ok

18:41:20.0973 6012        EFS             (156f6159457d0aa7e59b62681b56eb90) C:\Windows\System32\lsass.exe

18:41:21.0004 6012        EFS - ok

18:41:21.0082 6012        ehRecvr         (47c071994c3f649f23d9cd075ac9304a) C:\Windows\ehome\ehRecvr.exe

18:41:21.0129 6012        ehRecvr - ok

18:41:21.0160 6012        ehSched         (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe

18:41:21.0223 6012        ehSched - ok

18:41:21.0316 6012        elxstor         (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\drivers\elxstor.sys

18:41:21.0332 6012        elxstor - ok

18:41:21.0379 6012        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys

18:41:21.0410 6012        ErrDev - ok

18:41:21.0441 6012        EventSystem     (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll

18:41:21.0503 6012        EventSystem - ok

18:41:21.0535 6012        exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

18:41:21.0597 6012        exfat - ok

18:41:21.0613 6012        fastfat         (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

18:41:21.0659 6012        fastfat - ok

18:41:21.0706 6012        Fax             (d607b2f1bee3992aa6c2c92c0a2f0855) C:\Windows\system32\fxssvc.exe

18:41:21.0769 6012        Fax - ok

18:41:21.0815 6012        fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\drivers\fdc.sys

18:41:21.0847 6012        fdc - ok

18:41:21.0878 6012        fdPHost         (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll

18:41:21.0940 6012        fdPHost - ok

18:41:21.0956 6012        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll

18:41:21.0987 6012        FDResPub - ok

18:41:22.0034 6012        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

18:41:22.0065 6012        FileInfo - ok

18:41:22.0096 6012        Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

18:41:22.0143 6012        Filetrace - ok

18:41:22.0330 6012        FLEXnet Licensing Service (abedfd48ac042c6aaad32452e77217a1) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

18:41:22.0361 6012        FLEXnet Licensing Service - ok

18:41:22.0393 6012        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\drivers\flpydisk.sys

18:41:22.0408 6012        flpydisk - ok

18:41:22.0439 6012        FltMgr          (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys

18:41:22.0455 6012        FltMgr - ok

18:41:22.0611 6012        FontCache       (cb5e4b9c319e3c6bb363eb7e58a4a051) C:\Windows\system32\FntCache.dll

18:41:22.0689 6012        FontCache - ok

18:41:22.0814 6012        FontCache3.0.0.0 (8d89e3131c27fdd6932189cb785e1b7a) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

18:41:22.0829 6012        FontCache3.0.0.0 - ok

18:41:22.0876 6012        FsDepends       (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

18:41:22.0876 6012        FsDepends - ok

18:41:22.0907 6012        Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys

18:41:22.0907 6012        Fs_Rec - ok

18:41:22.0954 6012        FTDIBUS         (82d4bd620f7e27ea268ea0e2f701a7ae) C:\Windows\system32\drivers\ftdibus.sys

18:41:22.0970 6012        FTDIBUS - ok

18:41:23.0017 6012        FTSER2K         (1fa21ff2d7b50b528d8b73db34ad06bc) C:\Windows\system32\drivers\ftser2k.sys

18:41:23.0032 6012        FTSER2K - ok

18:41:23.0079 6012        fvevol          (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys

18:41:23.0095 6012        fvevol - ok

18:41:23.0157 6012        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\drivers\gagp30kx.sys

18:41:23.0157 6012        gagp30kx - ok

18:41:23.0219 6012        gpsvc           (fe5ab4525bc2ec68b9119a6e5d40128b) C:\Windows\System32\gpsvc.dll

18:41:23.0282 6012        gpsvc - ok

18:41:23.0391 6012        gupdate         (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

18:41:23.0407 6012        gupdate - ok

18:41:23.0453 6012        gupdatem        (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

18:41:23.0469 6012        gupdatem - ok

18:41:23.0547 6012        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

18:41:23.0594 6012        hcw85cir - ok

18:41:23.0656 6012        HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys

18:41:23.0703 6012        HdAudAddService - ok

18:41:23.0734 6012        HDAudBus        (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\drivers\HDAudBus.sys

18:41:23.0797 6012        HDAudBus - ok

18:41:23.0828 6012        HECIx64         (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\drivers\HECIx64.sys

18:41:23.0859 6012        HECIx64 - ok

18:41:23.0890 6012        HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\drivers\HidBatt.sys

18:41:23.0906 6012        HidBatt - ok

18:41:23.0937 6012        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\drivers\hidbth.sys

18:41:23.0984 6012        HidBth - ok

18:41:24.0031 6012        HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\drivers\hidir.sys

18:41:24.0046 6012        HidIr - ok

18:41:24.0093 6012        hidserv         (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll

18:41:24.0155 6012        hidserv - ok

18:41:24.0218 6012        HidUsb          (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys

18:41:24.0249 6012        HidUsb - ok

18:41:24.0280 6012        hkmsvc          (efa58ede58dd74388ffd04cb32681518) C:\Windows\system32\kmsvc.dll

18:41:24.0358 6012        hkmsvc - ok

18:41:24.0389 6012        HomeGroupListener (046b2673767ca626e2cfb7fdf735e9e8) C:\Windows\system32\ListSvc.dll

18:41:24.0436 6012        HomeGroupListener - ok

18:41:24.0483 6012        HomeGroupProvider (06a7422224d9865a5613710a089987df) C:\Windows\system32\provsvc.dll

18:41:24.0514 6012        HomeGroupProvider - ok

18:41:24.0592 6012        HpSAMD          (0886d440058f203eba0e1825e4355914) C:\Windows\system32\drivers\HpSAMD.sys

18:41:24.0608 6012        HpSAMD - ok

18:41:24.0670 6012        HTTP            (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys

18:41:24.0717 6012        HTTP - ok

18:41:24.0733 6012        hwpolicy        (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys

18:41:24.0748 6012        hwpolicy - ok

18:41:24.0795 6012        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys

18:41:24.0811 6012        i8042prt - ok

18:41:24.0857 6012        iaStor          (abbf174cb394f5c437410a788b7e404a) C:\Windows\system32\drivers\iaStor.sys

18:41:24.0889 6012        iaStor - ok

18:41:24.0982 6012        IAStorDataMgrSvc (31a0e93cdf29007d6c6fffb632f375ed) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

18:41:25.0013 6012        IAStorDataMgrSvc - ok

18:41:25.0060 6012        iaStorV         (b75e45c564e944a2657167d197ab29da) C:\Windows\system32\drivers\iaStorV.sys

18:41:25.0076 6012        iaStorV - ok

18:41:25.0185 6012        idsvc           (2f2be70d3e02b6fa877921ab9516d43c) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

18:41:25.0216 6012        idsvc - ok

18:41:25.0481 6012        igfx            (2a22ab054f4630d2ef4bab2853f6d5f6) C:\Windows\system32\DRIVERS\igdkmd64.sys

18:41:25.0762 6012        igfx ( UnsignedFile.Multi.Generic ) - warning

18:41:25.0762 6012        igfx - detected UnsignedFile.Multi.Generic (1)

18:41:25.0871 6012        iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\drivers\iirsp.sys

18:41:25.0887 6012        iirsp - ok

18:41:25.0949 6012        IKEEXT          (c5b4683680df085b57bc53e5ef34861f) C:\Windows\System32\ikeext.dll

18:41:26.0027 6012        IKEEXT - ok

18:41:26.0059 6012        Impcd           (dd587a55390ed2295bce6d36ad567da9) C:\Windows\system32\DRIVERS\Impcd.sys

18:41:26.0090 6012        Impcd - ok

18:41:26.0199 6012        IntcAzAudAddService (526e482afb586cb1cdd687869decf686) C:\Windows\system32\drivers\RTKVHD64.sys

18:41:26.0308 6012        IntcAzAudAddService - ok

18:41:26.0402 6012        IntcDAud        (58cf58dee26c909bd6f977b61d246295) C:\Windows\system32\DRIVERS\IntcDAud.sys

18:41:26.0417 6012        IntcDAud ( UnsignedFile.Multi.Generic ) - warning

18:41:26.0417 6012        IntcDAud - detected UnsignedFile.Multi.Generic (1)

18:41:26.0449 6012        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys

18:41:26.0464 6012        intelide - ok

18:41:26.0511 6012        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\drivers\intelppm.sys

18:41:26.0527 6012        intelppm - ok

18:41:26.0589 6012        IPBusEnum       (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll

18:41:26.0667 6012        IPBusEnum - ok

18:41:26.0714 6012        IpFilterDriver  (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys

18:41:26.0776 6012        IpFilterDriver - ok

18:41:26.0823 6012        iphlpsvc        (f8e058d17363ec580e4b7232778b6cb5) C:\Windows\System32\iphlpsvc.dll

18:41:26.0901 6012        iphlpsvc - ok

18:41:26.0917 6012        IPMIDRV         (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\drivers\IPMIDrv.sys

18:41:26.0948 6012        IPMIDRV - ok

18:41:26.0979 6012        IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

18:41:27.0041 6012        IPNAT - ok

18:41:27.0073 6012        irda            (05360b1ea5a2abf620d1d96ebd8bd8f1) C:\Windows\system32\DRIVERS\irda.sys

18:41:27.0119 6012        irda - ok

18:41:27.0166 6012        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

18:41:27.0182 6012        IRENUM - ok

18:41:27.0229 6012        Irmon           (3848384ab383f0a8f506c4370635c1f9) C:\Windows\System32\irmon.dll

18:41:27.0275 6012        Irmon - ok

18:41:27.0307 6012        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys

18:41:27.0322 6012        isapnp - ok

18:41:27.0369 6012        iScsiPrt        (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\drivers\msiscsi.sys

18:41:27.0385 6012        iScsiPrt - ok

18:41:27.0431 6012        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys

18:41:27.0431 6012        kbdclass - ok

18:41:27.0478 6012        kbdhid          (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys

18:41:27.0509 6012        kbdhid - ok

18:41:27.0541 6012        KeyIso          (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe

18:41:27.0572 6012        KeyIso - ok

18:41:27.0587 6012        KSecDD          (16c1b906fc5ead84769f90b736b6bf0e) C:\Windows\system32\Drivers\ksecdd.sys

18:41:27.0619 6012        KSecDD - ok

18:41:27.0650 6012        KSecPkg         (0b711550c56444879d71c7daabda6c83) C:\Windows\system32\Drivers\ksecpkg.sys

18:41:27.0650 6012        KSecPkg - ok

18:41:27.0697 6012        ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

18:41:27.0759 6012        ksthunk - ok

18:41:27.0806 6012        KtmRm           (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll

18:41:27.0884 6012        KtmRm - ok

18:41:27.0946 6012        LanmanServer    (81f1d04d4d0e433099365127375fd501) C:\Windows\system32\srvsvc.dll

18:41:27.0993 6012        LanmanServer - ok

18:41:28.0040 6012        LanmanWorkstation (27026eac8818e8a6c00a1cad2f11d29a) C:\Windows\System32\wkssvc.dll

18:41:28.0118 6012        LanmanWorkstation - ok

18:41:28.0196 6012        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

18:41:28.0258 6012        lltdio - ok

18:41:28.0289 6012        lltdsvc         (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll

18:41:28.0352 6012        lltdsvc - ok

18:41:28.0383 6012        lmhosts         (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll

18:41:28.0430 6012        lmhosts - ok

18:41:28.0508 6012        LMS             (3d23191672d83e90d1cf63927ee98136) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

18:41:28.0570 6012        LMS - ok

18:41:28.0633 6012        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\drivers\lsi_fc.sys

18:41:28.0648 6012        LSI_FC - ok

18:41:28.0695 6012        LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\drivers\lsi_sas.sys

18:41:28.0695 6012        LSI_SAS - ok

18:41:28.0742 6012        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\drivers\lsi_sas2.sys

18:41:28.0773 6012        LSI_SAS2 - ok

18:41:28.0804 6012        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\drivers\lsi_scsi.sys

18:41:28.0820 6012        LSI_SCSI - ok

18:41:28.0867 6012        luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

18:41:28.0929 6012        luafv - ok

18:41:28.0991 6012        MBAMProtector   (79da94b35371b9e7104460c7693dcb2c) C:\Windows\system32\drivers\mbam.sys

18:41:29.0038 6012        MBAMProtector - ok

18:41:29.0116 6012        MBAMService     (056b19651bd7b7ce5f89a3ac46dbdc08) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

18:41:29.0147 6012        MBAMService - ok

18:41:29.0194 6012        Mcx2Svc         (f84c8f1000bc11e3b7b23cbd3baff111) C:\Windows\system32\Mcx2Svc.dll

18:41:29.0225 6012        Mcx2Svc - ok

18:41:29.0257 6012        megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\drivers\megasas.sys

18:41:29.0272 6012        megasas - ok

18:41:29.0319 6012        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\drivers\MegaSR.sys

18:41:29.0350 6012        MegaSR - ok

18:41:29.0428 6012        Microsoft Office Groove Audit Service (123271bd5237ab991dc5c21fdf8835eb) C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe

18:41:29.0444 6012        Microsoft Office Groove Audit Service - ok

18:41:29.0475 6012        MMCSS           (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

18:41:29.0537 6012        MMCSS - ok

18:41:29.0569 6012        Modem           (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

18:41:29.0678 6012        Modem - ok

18:41:29.0693 6012        monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

18:41:29.0725 6012        monitor - ok

18:41:29.0756 6012        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys

18:41:29.0771 6012        mouclass - ok

18:41:29.0803 6012        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys

18:41:29.0818 6012        mouhid - ok

18:41:29.0834 6012        mountmgr        (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys

18:41:29.0849 6012        mountmgr - ok

18:41:29.0881 6012        mpio            (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\drivers\mpio.sys

18:41:29.0896 6012        mpio - ok

18:41:29.0943 6012        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

18:41:30.0005 6012        mpsdrv - ok

18:41:30.0052 6012        MpsSvc          (aecab449567d1846dad63ece49e893e3) C:\Windows\system32\mpssvc.dll

18:41:30.0115 6012        MpsSvc - ok

18:41:30.0146 6012        MRxDAV          (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys

18:41:30.0177 6012        MRxDAV - ok

18:41:30.0208 6012        mrxsmb          (040d62a9d8ad28922632137acdd984f2) C:\Windows\system32\DRIVERS\mrxsmb.sys

18:41:30.0224 6012        mrxsmb - ok

18:41:30.0271 6012        mrxsmb10        (f0067552f8f9b33d7c59403ab808a3cb) C:\Windows\system32\DRIVERS\mrxsmb10.sys

18:41:30.0302 6012        mrxsmb10 - ok

18:41:30.0333 6012        mrxsmb20        (3c142d31de9f2f193218a53fe2632051) C:\Windows\system32\DRIVERS\mrxsmb20.sys

18:41:30.0380 6012        mrxsmb20 - ok

18:41:30.0411 6012        msahci          (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\drivers\msahci.sys

18:41:30.0427 6012        msahci - ok

18:41:30.0473 6012        msdsm           (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\drivers\msdsm.sys

18:41:30.0473 6012        msdsm - ok

18:41:30.0520 6012        MSDTC           (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe

18:41:30.0536 6012        MSDTC - ok

18:41:30.0583 6012        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

18:41:30.0614 6012        Msfs - ok

18:41:30.0645 6012        mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

18:41:30.0676 6012        mshidkmdf - ok

18:41:30.0707 6012        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys

18:41:30.0723 6012        msisadrv - ok

18:41:30.0754 6012        MSiSCSI         (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll

18:41:30.0801 6012        MSiSCSI - ok

18:41:30.0817 6012        msiserver - ok

18:41:30.0848 6012        MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

18:41:30.0895 6012        MSKSSRV - ok

18:41:30.0910 6012        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

18:41:30.0973 6012        MSPCLOCK - ok

18:41:30.0988 6012        MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

18:41:31.0035 6012        MSPQM - ok

18:41:31.0066 6012        MsRPC           (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys

18:41:31.0082 6012        MsRPC - ok

18:41:31.0113 6012        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys

18:41:31.0129 6012        mssmbios - ok

18:41:31.0160 6012        MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

18:41:31.0222 6012        MSTEE - ok

18:41:31.0238 6012        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\drivers\MTConfig.sys

18:41:31.0269 6012        MTConfig - ok

18:41:31.0316 6012        Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

18:41:31.0331 6012        Mup - ok

18:41:31.0378 6012        napagent        (4987e079a4530fa737a128be54b63b12) C:\Windows\system32\qagentRT.dll

18:41:31.0441 6012        napagent - ok

18:41:31.0503 6012        NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

18:41:31.0565 6012        NativeWifiP - ok

18:41:31.0597 6012        NDIS            (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys

18:41:31.0643 6012        NDIS - ok

18:41:31.0659 6012        NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

18:41:31.0706 6012        NdisCap - ok

18:41:31.0737 6012        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

18:41:31.0799 6012        NdisTapi - ok

18:41:31.0846 6012        Ndisuio         (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys

18:41:31.0893 6012        Ndisuio - ok

18:41:31.0924 6012        NdisWan         (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys

18:41:31.0971 6012        NdisWan - ok

18:41:31.0987 6012        NDProxy         (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys

18:41:32.0033 6012        NDProxy - ok

18:41:32.0065 6012        NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

18:41:32.0096 6012        NetBIOS - ok

18:41:32.0127 6012        NetBT           (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys

18:41:32.0189 6012        NetBT - ok

18:41:32.0221 6012        Netlogon        (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe

18:41:32.0252 6012        Netlogon - ok

18:41:32.0299 6012        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll

18:41:32.0392 6012        Netman - ok

18:41:32.0501 6012        NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

18:41:32.0517 6012        NetMsmqActivator - ok

18:41:32.0548 6012        NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

18:41:32.0564 6012        NetPipeActivator - ok

18:41:32.0579 6012        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll

18:41:32.0673 6012        netprofm - ok

18:41:32.0689 6012        NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

18:41:32.0689 6012        NetTcpActivator - ok

18:41:32.0704 6012        NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

18:41:32.0704 6012        NetTcpPortSharing - ok

18:41:32.0767 6012        nfrd960         (77889813be4d166cdab78ddba990da92) C:\Windows\system32\drivers\nfrd960.sys

18:41:32.0798 6012        nfrd960 - ok

18:41:32.0845 6012        NlaSvc          (d9a0ce66046d6efa0c61baa885cba0a8) C:\Windows\System32\nlasvc.dll

18:41:32.0923 6012        NlaSvc - ok

18:41:32.0954 6012        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

18:41:33.0032 6012        Npfs - ok

18:41:33.0063 6012        nsi             (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll

18:41:33.0110 6012        nsi - ok

18:41:33.0125 6012        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

18:41:33.0172 6012        nsiproxy - ok

18:41:33.0219 6012        Ntfs            (378e0e0dfea67d98ae6ea53adbbd76bc) C:\Windows\system32\drivers\Ntfs.sys

18:41:33.0266 6012        Ntfs - ok

18:41:33.0297 6012        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

18:41:33.0328 6012        Null - ok

18:41:33.0375 6012        nvraid          (a4d9c9a608a97f59307c2f2600edc6a4) C:\Windows\system32\drivers\nvraid.sys

18:41:33.0422 6012        nvraid - ok

18:41:33.0469 6012        nvstor          (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\Windows\system32\drivers\nvstor.sys

18:41:33.0484 6012        nvstor - ok

18:41:33.0515 6012        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys

18:41:33.0531 6012        nv_agp - ok

18:41:33.0625 6012        odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

18:41:33.0656 6012        odserv - ok

18:41:33.0687 6012        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys

18:41:33.0703 6012        ohci1394 - ok

18:41:33.0749 6012        ose             (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

18:41:33.0765 6012        ose - ok

18:41:33.0812 6012        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

18:41:33.0859 6012        p2pimsvc - ok

18:41:33.0905 6012        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll

18:41:33.0937 6012        p2psvc - ok

18:41:33.0983 6012        Parport         (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\drivers\parport.sys

18:41:33.0999 6012        Parport - ok

18:41:34.0046 6012        partmgr         (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys

18:41:34.0061 6012        partmgr - ok

18:41:34.0093 6012        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll

18:41:34.0139 6012        PcaSvc - ok

18:41:34.0171 6012        pci             (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\drivers\pci.sys

18:41:34.0186 6012        pci - ok

18:41:34.0217 6012        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys

18:41:34.0217 6012        pciide - ok

18:41:34.0249 6012        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\drivers\pcmcia.sys

18:41:34.0264 6012        pcmcia - ok

18:41:34.0280 6012        pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

18:41:34.0295 6012        pcw - ok

18:41:34.0327 6012        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

18:41:34.0389 6012        PEAUTH - ok

18:41:34.0451 6012        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe

18:41:34.0483 6012        PerfHost - ok

18:41:34.0561 6012        pla             (557e9a86f65f0de18c9b6751dfe9d3f1) C:\Windows\system32\pla.dll

18:41:34.0654 6012        pla - ok

18:41:34.0701 6012        PlugPlay        (98b1721b8718164293b9701b98c52d77) C:\Windows\system32\umpnpmgr.dll

18:41:34.0748 6012        PlugPlay - ok

18:41:34.0841 6012        PMBDeviceInfoProvider (80e85394d8cd7f84340b1c6f4b9d698f) C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe

18:41:34.0857 6012        PMBDeviceInfoProvider - ok

18:41:34.0904 6012        PNRPAutoReg     (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll

18:41:34.0919 6012        PNRPAutoReg - ok

18:41:34.0951 6012        PNRPsvc         (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

18:41:34.0966 6012        PNRPsvc - ok

18:41:35.0029 6012        PolarUSB - ok

18:41:35.0075 6012        PolicyAgent     (166eb40d1f5b47e615de3d0fffe5f243) C:\Windows\System32\ipsecsvc.dll

18:41:35.0122 6012        PolicyAgent - ok

18:41:35.0169 6012        Power           (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll

18:41:35.0231 6012        Power - ok

18:41:35.0278 6012        PptpMiniport    (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys

18:41:35.0387 6012        PptpMiniport - ok

18:41:35.0403 6012        Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\drivers\processr.sys

18:41:35.0434 6012        Processor - ok

18:41:35.0481 6012        ProfSvc         (f381975e1f4346de875cb07339ce8d3a) C:\Windows\system32\profsvc.dll

18:41:35.0528 6012        ProfSvc - ok

18:41:35.0559 6012        ProtectedStorage (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe

18:41:35.0590 6012        ProtectedStorage - ok

18:41:35.0699 6012        Psched          (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys

18:41:35.0762 6012        Psched - ok

18:41:35.0809 6012        PxHlpa64        (fbf4db6d53585437e41a113300002a2b) C:\Windows\system32\Drivers\PxHlpa64.sys

18:41:35.0855 6012        PxHlpa64 - ok

18:41:35.0996 6012        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\drivers\ql2300.sys

18:41:36.0058 6012        ql2300 - ok

18:41:36.0089 6012        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\drivers\ql40xx.sys

18:41:36.0105 6012        ql40xx - ok

18:41:36.0152 6012        QWAVE           (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll

18:41:36.0183 6012        QWAVE - ok

18:41:36.0230 6012        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

18:41:36.0261 6012        QWAVEdrv - ok

18:41:36.0277 6012        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

18:41:36.0355 6012        RasAcd - ok

18:41:36.0386 6012        RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

18:41:36.0464 6012        RasAgileVpn - ok

18:41:36.0495 6012        RasAuto         (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll

18:41:36.0557 6012        RasAuto - ok

18:41:36.0573 6012        Rasl2tp         (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys

18:41:36.0620 6012        Rasl2tp - ok

18:41:36.0682 6012        RasMan          (47394ed3d16d053f5906efe5ab51cc83) C:\Windows\System32\rasmans.dll

18:41:36.0745 6012        RasMan - ok

18:41:36.0807 6012        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

18:41:36.0869 6012        RasPppoe - ok

18:41:36.0901 6012        RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

18:41:36.0947 6012        RasSstp - ok

18:41:36.0979 6012        rdbss           (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys

18:41:37.0025 6012        rdbss - ok

18:41:37.0057 6012        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\drivers\rdpbus.sys

18:41:37.0088 6012        rdpbus - ok

18:41:37.0119 6012        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

18:41:37.0166 6012        RDPCDD - ok

18:41:37.0181 6012        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

18:41:37.0244 6012        RDPENCDD - ok

18:41:37.0259 6012        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

18:41:37.0306 6012        RDPREFMP - ok

18:41:37.0353 6012        RDPWD           (074ac702d8b8b660b0e1371555995386) C:\Windows\system32\drivers\RDPWD.sys

18:41:37.0400 6012        RDPWD - ok

18:41:37.0447 6012        rdyboost        (e5dc9ba9e439d6dbdd79f8caacb5bf01) C:\Windows\system32\drivers\rdyboost.sys

18:41:37.0478 6012        rdyboost - ok

18:41:37.0525 6012        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll

18:41:37.0571 6012        RemoteAccess - ok

18:41:37.0618 6012        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll

18:41:37.0696 6012        RemoteRegistry - ok

18:41:37.0727 6012        RFCOMM          (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys

18:41:37.0774 6012        RFCOMM - ok

18:41:37.0821 6012        rimspci         (fa6abc06b629da29634d31f1fe0347bd) C:\Windows\system32\drivers\rimssne64.sys

18:41:37.0837 6012        rimspci - ok

18:41:37.0883 6012        risdsnpe        (8f8539a7f5c117d4407b2985995671f2) C:\Windows\system32\drivers\risdsne64.sys

18:41:37.0899 6012        risdsnpe - ok

18:41:37.0930 6012        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll

18:41:37.0993 6012        RpcEptMapper - ok

18:41:38.0024 6012        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe

18:41:38.0024 6012        RpcLocator - ok

18:41:38.0071 6012        RpcSs           (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll

18:41:38.0117 6012        RpcSs - ok

18:41:38.0149 6012        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

18:41:38.0227 6012        rspndr - ok

18:41:38.0305 6012        RTHDMIAzAudService (d6d381b76056c668679723938f06f16c) C:\Windows\system32\drivers\RtHDMIVX.sys

18:41:38.0351 6012        RTHDMIAzAudService - ok

18:41:38.0414 6012        SamSs           (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe

18:41:38.0429 6012        SamSs - ok

18:41:38.0476 6012        sbp2port        (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\drivers\sbp2port.sys

18:41:38.0492 6012        sbp2port - ok

18:41:38.0539 6012        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll

18:41:38.0601 6012        SCardSvr - ok

18:41:38.0632 6012        scfilter        (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys

18:41:38.0695 6012        scfilter - ok

18:41:38.0741 6012        Schedule        (624d0f5ff99428bb90a5b8a4123e918e) C:\Windows\system32\schedsvc.dll

18:41:38.0804 6012        Schedule - ok

18:41:38.0851 6012        SCPolicySvc     (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll

18:41:38.0913 6012        SCPolicySvc - ok

18:41:38.0991 6012        sdbus           (2c8d162efaf73abd36d8bcbb6340cae7) C:\Windows\system32\DRIVERS\sdbus.sys

18:41:39.0022 6012        sdbus - ok

18:41:39.0069 6012        SDRSVC          (765a27c3279ce11d14cb9e4f5869fca5) C:\Windows\System32\SDRSVC.dll

18:41:39.0131 6012        SDRSVC - ok

18:41:39.0163 6012        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

18:41:39.0225 6012        secdrv - ok

18:41:39.0256 6012        seclogon        (463b386ebc70f98da5dff85f7e654346) C:\Windows\system32\seclogon.dll

18:41:39.0303 6012        seclogon - ok

18:41:39.0334 6012        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll

18:41:39.0428 6012        SENS - ok

18:41:39.0459 6012        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll

18:41:39.0506 6012        SensrSvc - ok

18:41:39.0553 6012        Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys

18:41:39.0584 6012        Serenum - ok

18:41:39.0615 6012        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\drivers\serial.sys

18:41:39.0646 6012        Serial - ok

18:41:39.0693 6012        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\drivers\sermouse.sys

18:41:39.0724 6012        sermouse - ok

18:41:39.0771 6012        SessionEnv      (c3bc61ce47ff6f4e88ab8a3b429a36af) C:\Windows\system32\sessenv.dll

18:41:39.0833 6012        SessionEnv - ok

18:41:39.0865 6012        SFEP            (286d3889e6ab5589646ff8a63cb928ae) C:\Windows\system32\drivers\SFEP.sys

18:41:39.0896 6012        SFEP - ok

18:41:39.0911 6012        sffdisk         (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys

18:41:39.0958 6012        sffdisk - ok

18:41:39.0989 6012        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys

18:41:40.0005 6012        sffp_mmc - ok

18:41:40.0036 6012        sffp_sd         (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\drivers\sffp_sd.sys

18:41:40.0067 6012        sffp_sd - ok

18:41:40.0114 6012        sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\drivers\sfloppy.sys

18:41:40.0130 6012        sfloppy - ok

18:41:40.0177 6012        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll

18:41:40.0239 6012        SharedAccess - ok

18:41:40.0286 6012        ShellHWDetection (0298ac45d0efffb2db4baa7dd186e7bf) C:\Windows\System32\shsvcs.dll

18:41:40.0333 6012        ShellHWDetection - ok

18:41:40.0379 6012        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\drivers\SiSRaid2.sys

18:41:40.0395 6012        SiSRaid2 - ok

18:41:40.0411 6012        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\drivers\sisraid4.sys

18:41:40.0426 6012        SiSRaid4 - ok

18:41:40.0473 6012        Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

18:41:40.0535 6012        Smb - ok

18:41:40.0551 6012        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe

18:41:40.0582 6012        SNMPTRAP - ok

18:41:40.0598 6012        spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

18:41:40.0613 6012        spldr - ok

18:41:40.0660 6012        Spooler         (f8e1fa03cb70d54a9892ac88b91d1e7b) C:\Windows\System32\spoolsv.exe

18:41:40.0691 6012        Spooler - ok

18:41:40.0801 6012        sppsvc          (913d843498553a1bc8f8dbad6358e49f) C:\Windows\system32\sppsvc.exe

18:41:40.0879 6012        sppsvc - ok

18:41:40.0957 6012        sppuinotify     (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll

18:41:41.0019 6012        sppuinotify - ok

18:41:41.0066 6012        srv             (2408c0366d96bcdf63e8f1c78e4a29c5) C:\Windows\system32\DRIVERS\srv.sys

18:41:41.0113 6012        srv - ok

18:41:41.0128 6012        srv2            (76548f7b818881b47d8d1ae1be9c11f8) C:\Windows\system32\DRIVERS\srv2.sys

18:41:41.0159 6012        srv2 - ok

18:41:41.0191 6012        srvnet          (0af6e19d39c70844c5caa8fb0183c36e) C:\Windows\system32\DRIVERS\srvnet.sys

18:41:41.0222 6012        srvnet - ok

18:41:41.0269 6012        SSDPSRV         (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll

18:41:41.0331 6012        SSDPSRV - ok

18:41:41.0347 6012        SstpSvc         (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll

18:41:41.0393 6012        SstpSvc - ok

18:41:41.0456 6012        Steam Client Service - ok

18:41:41.0518 6012        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\drivers\stexstor.sys

18:41:41.0534 6012        stexstor - ok

18:41:41.0596 6012        StillCam        (decacb6921ded1a38642642685d77dac) C:\Windows\system32\DRIVERS\serscan.sys

18:41:41.0627 6012        StillCam - ok

18:41:41.0705 6012        STIrUsb         (1a807a037503b285016e61100d04614a) C:\Windows\system32\DRIVERS\irstusb.sys

18:41:41.0737 6012        STIrUsb - ok

18:41:41.0799 6012        stisvc          (52d0e33b681bd0f33fdc08812fee4f7d) C:\Windows\System32\wiaservc.dll

18:41:41.0830 6012        stisvc - ok

18:41:41.0877 6012        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys

18:41:41.0893 6012        swenum - ok

18:41:41.0924 6012        swprv           (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll

18:41:42.0002 6012        swprv - ok

18:41:42.0064 6012        SysMain         (3c1284516a62078fb68f768de4f1a7be) C:\Windows\system32\sysmain.dll

18:41:42.0127 6012        SysMain - ok

18:41:42.0158 6012        TabletInputService (238935c3cf2854886dc7cbb2a0e2cc66) C:\Windows\System32\TabSvc.dll

18:41:42.0189 6012        TabletInputService - ok

18:41:42.0220 6012        TapiSrv         (884264ac597b690c5707c89723bb8e7b) C:\Windows\System32\tapisrv.dll

18:41:42.0283 6012        TapiSrv - ok

18:41:42.0298 6012        TBS             (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll

18:41:42.0345 6012        TBS - ok

18:41:42.0423 6012        Tcpip           (f18f56efc0bfb9c87ba01c37b27f4da5) C:\Windows\system32\drivers\tcpip.sys

18:41:42.0501 6012        Tcpip - ok

18:41:42.0563 6012        TCPIP6          (f18f56efc0bfb9c87ba01c37b27f4da5) C:\Windows\system32\DRIVERS\tcpip.sys

18:41:42.0595 6012        TCPIP6 - ok

18:41:42.0626 6012        tcpipreg        (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys

18:41:42.0657 6012        tcpipreg - ok

18:41:42.0688 6012        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

18:41:42.0719 6012        TDPIPE - ok

18:41:42.0751 6012        TDTCP           (7518f7bcfd4b308abc9192bacaf6c970) C:\Windows\system32\drivers\tdtcp.sys

18:41:42.0766 6012        TDTCP - ok

18:41:42.0797 6012        tdx             (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys

18:41:42.0860 6012        tdx - ok

18:41:42.0922 6012        TermDD          (c448651339196c0e869a355171875522) C:\Windows\system32\drivers\termdd.sys

18:41:42.0938 6012        TermDD - ok

18:41:42.0985 6012        TermService     (0f05ec2887bfe197ad82a13287d2f404) C:\Windows\System32\termsrv.dll

18:41:43.0063 6012        TermService - ok

18:41:43.0094 6012        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll

18:41:43.0109 6012        Themes - ok

18:41:43.0156 6012        THREADORDER     (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

18:41:43.0187 6012        THREADORDER - ok

18:41:43.0219 6012        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll

18:41:43.0265 6012        TrkWks - ok

18:41:43.0328 6012        TrustedInstaller (840f7fb849f5887a49ba18c13b2da920) C:\Windows\servicing\TrustedInstaller.exe

18:41:43.0343 6012        TrustedInstaller - ok

18:41:43.0421 6012        tssecsrv        (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys

18:41:43.0499 6012        tssecsrv - ok

18:41:43.0531 6012        tunnel          (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys

18:41:43.0593 6012        tunnel - ok

18:41:43.0609 6012        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\drivers\uagp35.sys

18:41:43.0624 6012        uagp35 - ok

18:41:43.0671 6012        uCamMonitor     (63f6d08c54d5b3c1b12a6172032055c7) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe

18:41:43.0718 6012        uCamMonitor - ok

18:41:43.0749 6012        udfs            (0e5e962b5649d544be54e8c90761ea2b) C:\Windows\system32\DRIVERS\udfs.sys

18:41:43.0796 6012        udfs - ok

18:41:43.0843 6012        UI0Detect       (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe

18:41:43.0858 6012        UI0Detect - ok

18:41:43.0905 6012        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys

18:41:43.0905 6012        uliagpkx - ok

18:41:43.0952 6012        umbus           (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys

18:41:43.0967 6012        umbus - ok

18:41:44.0014 6012        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\drivers\umpass.sys

18:41:44.0030 6012        UmPass - ok

18:41:44.0186 6012        UNS             (11a559e0f10cc5e788984023df400a6f) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

18:41:44.0248 6012        UNS - ok

18:41:44.0326 6012        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll

18:41:44.0389 6012        upnphost - ok

18:41:44.0467 6012        usbaudio        (77b01bc848298223a95d4ec23e1785a1) C:\Windows\system32\drivers\usbaudio.sys

18:41:44.0498 6012        usbaudio - ok

18:41:44.0545 6012        usbccgp         (7b6a127c93ee590e4d79a5f2a76fe46f) C:\Windows\system32\DRIVERS\usbccgp.sys

18:41:44.0591 6012        usbccgp - ok

18:41:44.0638 6012        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys

18:41:44.0669 6012        usbcir - ok

18:41:44.0701 6012        usbehci         (92969ba5ac44e229c55a332864f79677) C:\Windows\system32\drivers\usbehci.sys

18:41:44.0716 6012        usbehci - ok

18:41:44.0747 6012        usbhub          (e7df1cfd28ca86b35ef5add0735ceef3) C:\Windows\system32\DRIVERS\usbhub.sys

18:41:44.0779 6012        usbhub - ok

18:41:44.0810 6012        usbohci         (f1bb1e55f1e7a65c5839ccc7b36d773e) C:\Windows\system32\drivers\usbohci.sys

18:41:44.0825 6012        usbohci - ok

18:41:44.0888 6012        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys

18:41:44.0919 6012        usbprint - ok

18:41:44.0966 6012        usbscan         (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys

18:41:44.0997 6012        usbscan - ok

18:41:45.0028 6012        USBSTOR         (f39983647bc1f3e6100778ddfe9dce29) C:\Windows\system32\DRIVERS\USBSTOR.SYS

18:41:45.0075 6012        USBSTOR - ok

18:41:45.0106 6012        usbuhci         (bc3070350a491d84b518d7cca9abd36f) C:\Windows\system32\drivers\usbuhci.sys

18:41:45.0122 6012        usbuhci - ok

18:41:45.0184 6012        usbvideo        (7cb8c573c6e4a2714402cc0a36eab4fe) C:\Windows\system32\Drivers\usbvideo.sys

18:41:45.0200 6012        usbvideo - ok

18:41:45.0231 6012        UxSms           (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll

18:41:45.0293 6012        UxSms - ok

18:41:45.0387 6012        VAIO Event Service (a60605fc66552b421ee1f3d4ebb9a4e0) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe

18:41:45.0403 6012        VAIO Event Service - ok

18:41:45.0496 6012        VAIO Power Management (d469be2723f79cf4b384680b1fdc577d) C:\Program Files\Sony\VAIO Power Management\SPMService.exe

18:41:45.0527 6012        VAIO Power Management - ok

18:41:45.0559 6012        VaultSvc        (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe

18:41:45.0590 6012        VaultSvc - ok

18:41:45.0652 6012        VCService       (d347d3abe070aa09c22fc37121555d52) C:\Program Files\Sony\VAIO Care\VCService.exe

18:41:45.0668 6012        VCService - ok

18:41:45.0730 6012        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys

18:41:45.0746 6012        vdrvroot - ok

18:41:45.0793 6012        vds             (44d73e0bbc1d3c8981304ba15135c2f2) C:\Windows\System32\vds.exe

18:41:45.0824 6012        vds - ok

18:41:45.0855 6012        vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

18:41:45.0871 6012        vga - ok

18:41:45.0886 6012        VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

18:41:45.0949 6012        VgaSave - ok

18:41:45.0980 6012        vhdmp           (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\drivers\vhdmp.sys

18:41:46.0011 6012        vhdmp - ok

18:41:46.0042 6012        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys

18:41:46.0073 6012        viaide - ok

18:41:46.0089 6012        volmgr          (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\drivers\volmgr.sys

18:41:46.0105 6012        volmgr - ok

18:41:46.0151 6012        volmgrx         (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys

18:41:46.0167 6012        volmgrx - ok

18:41:46.0214 6012        volsnap         (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\drivers\volsnap.sys

18:41:46.0229 6012        volsnap - ok

18:41:46.0276 6012        vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\drivers\vsmraid.sys

18:41:46.0307 6012        vsmraid - ok

18:41:46.0448 6012        VSNService      (a7eb62c664a03901165290a714bd48d0) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe

18:41:46.0479 6012        VSNService ( UnsignedFile.Multi.Generic ) - warning

18:41:46.0479 6012        VSNService - detected UnsignedFile.Multi.Generic (1)

18:41:46.0557 6012        VSS             (787898bf9fb6d7bd87a36e2d95c899ba) C:\Windows\system32\vssvc.exe

18:41:46.0619 6012        VSS - ok

18:41:46.0760 6012        VUAgent         (d62d16e057be87f5b84a54d1b83822c4) C:\Program Files\Sony\VAIO Update Common\VUAgent.exe

18:41:46.0791 6012        VUAgent - ok

18:41:46.0885 6012        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys

18:41:46.0916 6012        vwifibus - ok

18:41:46.0947 6012        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys

18:41:46.0963 6012        vwififlt - ok

18:41:46.0994 6012        W32Time         (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll

18:41:47.0041 6012        W32Time - ok

18:41:47.0072 6012        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\drivers\wacompen.sys

18:41:47.0103 6012        WacomPen - ok

18:41:47.0134 6012        WANARP          (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys

18:41:47.0181 6012        WANARP - ok

18:41:47.0197 6012        Wanarpv6        (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys

18:41:47.0228 6012        Wanarpv6 - ok

18:41:47.0290 6012        wbengine        (5ab1bb85bd8b5089cc5d64200dedae68) C:\Windows\system32\wbengine.exe

18:41:47.0353 6012        wbengine - ok

18:41:47.0384 6012        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll

18:41:47.0399 6012        WbioSrvc - ok

18:41:47.0431 6012        wcncsvc         (dd1bae8ebfc653824d29ccf8c9054d68) C:\Windows\System32\wcncsvc.dll

18:41:47.0477 6012        wcncsvc - ok

18:41:47.0509 6012        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll

18:41:47.0540 6012        WcsPlugInService - ok

18:41:47.0587 6012        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\drivers\wd.sys

18:41:47.0602 6012        Wd - ok

18:41:47.0649 6012        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

18:41:47.0696 6012        Wdf01000 - ok

18:41:47.0711 6012        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

18:41:47.0743 6012        WdiServiceHost - ok

18:41:47.0758 6012        WdiSystemHost   (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

18:41:47.0774 6012        WdiSystemHost - ok

18:41:47.0821 6012        WebClient       (733006127f235be7c35354ebee7b9a7b) C:\Windows\System32\webclnt.dll

18:41:47.0852 6012        WebClient - ok

18:41:47.0899 6012        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll

18:41:47.0977 6012        Wecsvc - ok

18:41:47.0992 6012        wercplsupport   (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll

18:41:48.0055 6012        wercplsupport - ok

18:41:48.0070 6012        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll

18:41:48.0133 6012        WerSvc - ok

18:41:48.0195 6012        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

18:41:48.0273 6012        WfpLwf - ok

18:41:48.0304 6012        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

18:41:48.0320 6012        WIMMount - ok

18:41:48.0351 6012        WinDefend - ok

18:41:48.0351 6012        WinHttpAutoProxySvc - ok

18:41:48.0429 6012        Winmgmt         (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll

18:41:48.0507 6012        Winmgmt - ok

18:41:48.0601 6012        WinRing0_1_2_0  (0c0195c48b6b8582fa6f6373032118da) C:\Users\S\AppData\Local\Microsoft\Windows Sidebar\Gadgets\IntelCoreSeries24.gadget\WinRing0x64.sys

18:41:48.0679 6012        WinRing0_1_2_0 - ok

18:41:48.0741 6012        WinRM           (41fbb751936b387f9179e7f03a74fe29) C:\Windows\system32\WsmSvc.dll

18:41:48.0835 6012        WinRM - ok

18:41:48.0944 6012        WinUsb          (817eaff5d38674edd7713b9dfb8e9791) C:\Windows\system32\DRIVERS\WinUsb.sys

18:41:48.0975 6012        WinUsb - ok

18:41:49.0022 6012        Wlansvc         (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll

18:41:49.0069 6012        Wlansvc - ok

18:41:49.0100 6012        WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys

18:41:49.0131 6012        WmiAcpi - ok

18:41:49.0193 6012        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe

18:41:49.0240 6012        wmiApSrv - ok

18:41:49.0303 6012        WMPNetworkSvc - ok

18:41:49.0334 6012        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll

18:41:49.0365 6012        WPCSvc - ok

18:41:49.0396 6012        WPDBusEnum      (2e57ddf2880a7e52e76f41c7e96d327b) C:\Windows\system32\wpdbusenum.dll

18:41:49.0427 6012        WPDBusEnum - ok

18:41:49.0490 6012        ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

18:41:49.0552 6012        ws2ifsl - ok

18:41:49.0583 6012        wscsvc          (8f9f3969933c02da96eb0f84576db43e) C:\Windows\System32\wscsvc.dll

18:41:49.0630 6012        wscsvc - ok

18:41:49.0646 6012        WSearch - ok

18:41:49.0739 6012        wuauserv        (38340204a2d0228f1e87740fc5e554a7) C:\Windows\system32\wuaueng.dll

18:41:49.0817 6012        wuauserv - ok

18:41:49.0895 6012        WudfPf          (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys

18:41:49.0958 6012        WudfPf - ok

18:41:49.0989 6012        WUDFRd          (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys

18:41:50.0083 6012        WUDFRd - ok

18:41:50.0114 6012        wudfsvc         (b551d6637aa0e132c18ac6e504f7b79b) C:\Windows\System32\WUDFSvc.dll

18:41:50.0161 6012        wudfsvc - ok

18:41:50.0192 6012        WwanSvc         (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll

18:41:50.0223 6012        WwanSvc - ok

18:41:50.0270 6012        yukonw7         (5250193ef8e173aa7491250f00eb367f) C:\Windows\system32\DRIVERS\yk62x64.sys

18:41:50.0285 6012        yukonw7 - ok

18:41:50.0332 6012        MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0

18:41:50.0519 6012        \Device\Harddisk0\DR0 - ok

18:41:50.0519 6012        Boot (0x1200)   (166f3974c1b00ef8ad1c2a6bdfafab78) \Device\Harddisk0\DR0\Partition0

18:41:50.0519 6012        \Device\Harddisk0\DR0\Partition0 - ok

18:41:50.0551 6012        Boot (0x1200)   (fdc314447f484821d0381c1e21131669) \Device\Harddisk0\DR0\Partition1

18:41:50.0551 6012        \Device\Harddisk0\DR0\Partition1 - ok

18:41:50.0566 6012        Boot (0x1200)   (c4ebd99878f2d197e8b0dc163cf881c4) \Device\Harddisk0\DR0\Partition2

18:41:50.0582 6012        \Device\Harddisk0\DR0\Partition2 - ok

18:41:50.0582 6012        ============================================================

18:41:50.0582 6012        Scan finished

18:41:50.0582 6012        ============================================================

18:41:50.0597 5804        Detected object count: 3

18:41:50.0597 5804        Actual detected object count: 3

18:41:59.0957 5804        igfx ( UnsignedFile.Multi.Generic ) - skipped by user

18:41:59.0957 5804        igfx ( UnsignedFile.Multi.Generic ) - User select action: Skip 

18:41:59.0957 5804        IntcDAud ( UnsignedFile.Multi.Generic ) - skipped by user

18:41:59.0957 5804        IntcDAud ( UnsignedFile.Multi.Generic ) - User select action: Skip 

18:41:59.0957 5804        VSNService ( UnsignedFile.Multi.Generic ) - skipped by user

18:41:59.0957 5804        VSNService ( UnsignedFile.Multi.Generic ) - User select action: Skip

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

auch das hab ich erledigt:
[code]
Combofix Logfile:

Code:

ComboFix 12-04-01.03 - S 02.04.2012  21:19:21.1.4 - x64

Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.3950.2591 [GMT 2:00]

ausgeführt von:: c:\users\S\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\Install.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-03-02 bis 2012-04-02  ))))))))))))))))))))))))))))))

.

.

2012-04-02 19:25 . 2012-04-02 19:25        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-04-02 19:23 . 2012-04-02 19:23        69000        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{88814F36-05F7-4673-A7FB-ABA3D5F84D0C}\offreg.dll

2012-04-02 14:57 . 2012-04-02 14:57        --------        d-----w-        C:\_OTL

2012-03-30 11:38 . 2012-03-14 03:27        8669240        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{88814F36-05F7-4673-A7FB-ABA3D5F84D0C}\mpengine.dll

2012-03-29 12:07 . 2012-03-29 12:07        --------        d-----w-        c:\program files (x86)\ESET

2012-03-29 09:49 . 2012-03-29 09:49        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2012-03-29 09:49 . 2011-12-10 13:24        23152        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-03-26 21:00 . 2012-03-26 21:00        --------        d-----w-        c:\users\S\AppData\Roaming\Malwarebytes

2012-03-26 21:00 . 2012-03-26 21:00        --------        d-----w-        c:\programdata\Malwarebytes

2012-03-19 07:59 . 2012-03-19 07:59        592824        ----a-w-        c:\program files (x86)\Mozilla Firefox\gkmedias.dll

2012-03-19 07:59 . 2012-03-19 07:59        44472        ----a-w-        c:\program files (x86)\Mozilla Firefox\mozglue.dll

2012-03-18 17:52 . 2012-03-18 17:52        --------        d-----w-        c:\program files (x86)\PokerTH-0.9.3

2012-03-17 19:52 . 2012-03-17 19:53        --------        d-----w-        c:\users\S\AppData\Local\PokerStars

2012-03-17 19:52 . 2012-03-17 19:53        --------        d-----w-        c:\program files (x86)\PokerStars

2012-03-14 11:04 . 2011-11-19 18:30        5504880        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-03-14 11:04 . 2011-11-19 14:25        3957616        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2012-03-14 11:04 . 2011-11-19 14:25        3902320        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2012-03-14 09:33 . 2012-02-03 04:16        3143168        ----a-w-        c:\windows\system32\win32k.sys

2012-03-14 09:33 . 2012-02-10 06:18        1541120        ----a-w-        c:\windows\system32\DWrite.dll

2012-03-14 09:33 . 2012-02-10 05:41        1074176        ----a-w-        c:\windows\SysWow64\DWrite.dll

2012-03-14 09:33 . 2012-02-10 06:17        1837568        ----a-w-        c:\windows\system32\d3d10warp.dll

2012-03-14 09:33 . 2012-02-10 06:17        902656        ----a-w-        c:\windows\system32\d2d1.dll

2012-03-14 09:33 . 2012-02-10 06:17        320512        ----a-w-        c:\windows\system32\d3d10_1core.dll

2012-03-14 09:33 . 2012-02-10 06:17        197120        ----a-w-        c:\windows\system32\d3d10_1.dll

2012-03-14 09:33 . 2012-02-10 05:41        218624        ----a-w-        c:\windows\SysWow64\d3d10_1core.dll

2012-03-14 09:33 . 2012-02-10 05:41        161792        ----a-w-        c:\windows\SysWow64\d3d10_1.dll

2012-03-14 09:33 . 2012-02-10 05:41        1170944        ----a-w-        c:\windows\SysWow64\d3d10warp.dll

2012-03-14 09:33 . 2012-02-10 05:41        739840        ----a-w-        c:\windows\SysWow64\d2d1.dll

2012-03-14 09:32 . 2012-02-15 06:27        1031680        ----a-w-        c:\windows\system32\rdpcore.dll

2012-03-14 09:32 . 2012-02-15 05:44        826368        ----a-w-        c:\windows\SysWow64\rdpcore.dll

2012-03-14 09:32 . 2012-02-15 04:47        204800        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-03-14 09:32 . 2012-02-15 04:46        23552        ----a-w-        c:\windows\system32\drivers\tdtcp.sys

2012-03-14 09:32 . 2012-01-25 06:27        76288        ----a-w-        c:\windows\system32\rdpwsx.dll

2012-03-14 09:32 . 2012-01-25 06:27        149504        ----a-w-        c:\windows\system32\rdpcorekmts.dll

2012-03-14 09:32 . 2012-01-25 06:20        9216        ----a-w-        c:\windows\system32\rdrmemptylst.exe

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-02-23 07:18 . 2011-01-03 16:14        279656        ------w-        c:\windows\system32\MpSigStub.exe

2012-02-22 09:00 . 2011-05-19 19:40        414368        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-02-15 18:51 . 2011-10-19 12:19        132320        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2012-01-04 09:58 . 2012-02-15 18:37        509952        ----a-w-        c:\windows\system32\ntshrui.dll

2012-01-04 09:03 . 2012-02-15 18:37        442880        ----a-w-        c:\windows\SysWow64\ntshrui.dll

2006-05-03 10:06        163328        --sh--r-        c:\windows\SysWOW64\flvDX.dll

2007-02-21 11:47        31232        --sh--r-        c:\windows\SysWOW64\msfDX.dll

2008-03-16 13:30        216064        --sh--r-        c:\windows\SysWOW64\nbDX.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]

"RocketDock"="c:\program files (x86)\RocketDock\RocketDock.exe" [2007-09-02 495616]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]

"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2010-05-31 673136]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-09-20 102400]

"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-28 136176]

R3 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-10-09 169312]

R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]

R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-28 136176]

R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]

R3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]

R3 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe [2011-01-29 259192]

R3 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2010-06-21 575856]

R3 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2010-06-08 836608]

R4 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-06-01 367456]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-10-11 86224]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]

S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys [x]

S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys [x]

S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960]

S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-05-28 2320920]

S2 WinRing0_1_2_0;WinRing0_1_2_0;c:\users\S\AppData\Local\Microsoft\Windows Sidebar\Gadgets\IntelCoreSeries24.gadget\WinRing0x64.sys [2011-01-04 14544]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [x]

S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]

S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\drivers\HECIx64.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys [x]

S3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe [2011-02-14 44736]

S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update Common\VUAgent.exe [2011-10-27 1429608]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - 53445547

*Deregistered* - 53445547

.

Inhalt des "geplante Tasks" Ordners

.

2012-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-28 11:35]

.

2012-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-28 11:35]

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.spox.com/de/index.html

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = <local>

IE: Free YouTube Download - c:\users\S\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

IE: Free YouTube to MP3 Converter - c:\users\S\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html

IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe

TCP: DhcpNameServer = 192.168.0.1

FF - ProfilePath - c:\users\S\AppData\Roaming\Mozilla\Firefox\Profiles\l062mb0m.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.zeit.de/index

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM-Run-Apoint - c:\program files (x86)\Apoint\Apoint.exe

.

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]

"ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=5000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=c:\programdata\Sony Corporation\VAIO Care\inteldata\""

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-2356455393-4161031106-362288086-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

@Allowed: (Read) (RestrictedCode)

"??"=hex:97,06,98,7d,da,cc,42,48,1f,51,73,a2,7d,c1,12,c8,19,3e,40,e0,67,6d,fe,

   e9,0f,57,42,99,f8,b0,3e,94,84,4b,5b,95,42,6f,6e,b0,31,14,90,22,b3,73,3f,fa,\

"??"=hex:9e,1f,10,d0,08,67,e4,8b,6c,b9,b1,20,00,45,74,e2

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2012-04-02  21:27:22

ComboFix-quarantined-files.txt  2012-04-02 19:27

.

Vor Suchlauf: 18 Verzeichnis(se), 168.344.805.376 Bytes frei

Nach Suchlauf: 23 Verzeichnis(se), 167.957.467.136 Bytes frei

.

- - End Of File - - 44ECF12291758C9EB31F3FDDF1F42D2A

--- --- ---

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr", dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

ok hier das ergebnis:

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-04-03 16:36:01

-----------------------------

16:36:01.497    OS Version: Windows x64 6.1.7600 

16:36:01.497    Number of processors: 4 586 0x2505

16:36:01.498    ComputerName: S  UserName: S

16:36:02.471    Initialize success

16:36:35.803    AVAST engine download error: 0

16:36:49.896    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

16:36:49.901    Disk 0 Vendor: SAMSUNG_ 2AC1 Size: 476940MB BusType: 3

16:36:49.925    Disk 0 MBR read successfully

16:36:49.930    Disk 0 MBR scan

16:36:49.934    Disk 0 Windows 7 default MBR code

16:36:49.946    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS        13645 MB offset 2048

16:36:49.961    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 27947008

16:36:49.973    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       242239 MB offset 28151808

16:36:49.979    Disk 0 Partition - 00     0F Extended LBA            220953 MB offset 524259328

16:36:50.003    Disk 0 Partition 4 00     07    HPFS/NTFS NTFS       220952 MB offset 524261376

16:36:50.030    Disk 0 scanning C:\Windows\system32\drivers

16:36:57.035    Service scanning

16:37:13.757    Modules scanning

16:37:14.101    Disk 0 trace - called modules:

16:37:14.133    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll 

16:37:14.142    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800636a060]

16:37:14.150    3 CLASSPNP.SYS[fffff88001afa43f] -> nt!IofCallDriver -> [0xfffffa8003572760]

16:37:14.158    5 ACPI.sys[fffff88000eca781] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800432b050]

16:37:14.165    Scan finished successfully

16:37:29.622    Disk 0 MBR has been saved successfully to "C:\Users\S\Desktop\MBR.dat"

16:37:29.627    The log file has been saved successfully to "C:\Users\S\Desktop\aswMBR.txt"

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

ok. das beruhigt mich schonmal. hab die scans gemacht. kannst du vielleicht noch kurz schreiben, was der OTL-Fix bewirkt hat?

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 04/05/2012 at 05:36 PM
 

Application Version : 5.0.1146
 

Core Rules Database Version : 8418

Trace Rules Database Version: 6230
 

Scan type       : Complete Scan

Total Scan Time : 02:09:49
 

Operating System Information

Windows 7 Home Premium 64-bit (Build 6.01.7600)

UAC On - Administrator
 

Memory items scanned      : 821

Memory threats detected   : 0

Registry items scanned    : 67810

Registry threats detected : 0

File items scanned        : 309417

File threats detected     : 79
 

Adware.Tracking Cookie

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\CQX5AYNW.txt [ /adtech.de ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\GKKOC3MH.txt [ /adbrite.com ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\VTSVLW2E.txt [ /www.pornhub.com ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\0YNGTJA4.txt [ /pornhub.com ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\JM1K9BGO.txt [ /revsci.net ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\K6SF26JU.txt [ /ad3.adfarm1.adition.com ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\44ASRTUU.txt [ /mediaplex.com ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\DK7M55J2.txt [ /doubleclick.net ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\IM1AA08L.txt [ /sextracker.com ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\U60L62KD.txt [ /atdmt.com ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\LTVHI0PE.txt [ /ad.yieldmanager.com ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\NC5IIPG2.txt [ /dyntracker.com ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\7WP7J8SC.txt [ /ad.zanox.com ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\MFVGW0RZ.txt [ /adviva.net ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\BLJ1B1II.txt [ /specificclick.net ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\2U83LI7H.txt [ /adfarm1.adition.com ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\YBPWS30N.txt [ /smartadserver.com ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\19OORGQL.txt [ /im.banner.t-online.de ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\BTU65H3B.txt [ /invitemedia.com ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\YD7W3ZAC.txt [ /zanox.com ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\22P5RGUX.txt [ /fastclick.net ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\23MKVTC9.txt [ /apmebf.com ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\65OKUZ14.txt [ /tracking.quisma.com ]

        C:\Users\S\AppData\Roaming\Microsoft\Windows\Cookies\Y0S52TF1.txt [ /counter8.sextracker.com ]

        C:\USERS\S\Cookies\CQX5AYNW.txt [ Cookie:s@adtech.de/ ]

        C:\USERS\S\Cookies\GKKOC3MH.txt [ Cookie:s@adbrite.com/ ]

        C:\USERS\S\Cookies\VTSVLW2E.txt [ Cookie:s@www.pornhub.com/ ]

        C:\USERS\S\Cookies\0YNGTJA4.txt [ Cookie:s@pornhub.com/ ]

        C:\USERS\S\Cookies\JM1K9BGO.txt [ Cookie:s@revsci.net/ ]

        C:\USERS\S\Cookies\K6SF26JU.txt [ Cookie:s@ad3.adfarm1.adition.com/ ]

        C:\USERS\S\Cookies\44ASRTUU.txt [ Cookie:s@mediaplex.com/ ]

        C:\USERS\S\Cookies\IM1AA08L.txt [ Cookie:s@sextracker.com/ ]

        C:\USERS\S\Cookies\U60L62KD.txt [ Cookie:s@atdmt.com/ ]

        C:\USERS\S\Cookies\LTVHI0PE.txt [ Cookie:s@ad.yieldmanager.com/ ]

        C:\USERS\S\Cookies\NC5IIPG2.txt [ Cookie:s@dyntracker.com/ ]

        C:\USERS\S\Cookies\7WP7J8SC.txt [ Cookie:s@ad.zanox.com/ ]

        C:\USERS\S\Cookies\MFVGW0RZ.txt [ Cookie:s@adviva.net/ ]

        C:\USERS\S\Cookies\BLJ1B1II.txt [ Cookie:s@specificclick.net/ ]

        C:\USERS\S\Cookies\2U83LI7H.txt [ Cookie:s@adfarm1.adition.com/ ]

        C:\USERS\S\Cookies\YBPWS30N.txt [ Cookie:s@smartadserver.com/ ]

        C:\USERS\S\Cookies\19OORGQL.txt [ Cookie:s@im.banner.t-online.de/ ]

        C:\USERS\S\Cookies\22P5RGUX.txt [ Cookie:s@fastclick.net/ ]

        C:\USERS\S\Cookies\23MKVTC9.txt [ Cookie:s@apmebf.com/ ]

        C:\USERS\S\Cookies\65OKUZ14.txt [ Cookie:s@tracking.quisma.com/ ]

        secure-uk.imrworldwide.com [ C:\USERS\S\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\N9LY6MSS ]

        terrashop.traffective-tracking.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        terrashop.traffective-tracking.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        terrashop.traffective-tracking.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        terrashop.traffective-tracking.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        terrashop.traffective-tracking.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .histats.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .histats.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .yadro.ru [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .rambler.ru [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .rambler.ru [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .xiti.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .premiumtv.122.2o7.net [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .guj.122.2o7.net [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .getclicky.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .static.getclicky.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        in.getclicky.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        statse.webtrendslive.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .deutschepostag.112.2o7.net [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .4stats.de [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .4stats.de [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .4stats.de [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .vogelservices.122.2o7.net [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

        .skydeutschland.122.2o7.net [ C:\USERS\S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L062MB0M.DEFAULT\COOKIES.SQLITE ]

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.04.07.02
 

Windows 7 x64 NTFS

Internet Explorer 9.0.8112.16421

S :: SCHWEDE [Administrator]
 

Schutz: Aktiviert
 

07.04.2012 10:17:59

mbam-log-2012-04-07 (10-17-59).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 486268

Laufzeit: 1 Stunde(n), 43 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)