Trojaner-Board - S.M.A.R.T Repair Malware auf VISTA

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - S.M.A.R.T Repair Malware auf VISTA (https://www.trojaner-board.de/115848-s-m-a-r-t-repair-malware-vista.html)

S.M.A.R.T Repair Malware auf VISTA

Hallo,

ich habe mir vor einigen Tagen auf meinem VISTA-Notebook den SMART Repair Virus eingefangen.

Die Symptome:

Der Bildschirm ist schwarz, nur der Internet Explorer ist noch sichtbar
Eine ganze Batterie von Fehlermeldungen (System Message - Write Fault Error) erscheint.
Ein Scan-Fenster S.M.A.R.T Repair erscheint und zeigt etliche System-Probleme an. Das Fenster läßt sich nur minimieren, nicht schliessen.
So gut wie alle Dateien und Ordner scheinen weg, nur Laufwerk C zeigt noch eine Datei BOOTSEC.BAK an.
Der Taskmanager läßt ich nicht mehr öffnen.

Meine bisherigen Aktionen:

Ich habe Defogger als Admin gestartet und Disable geklickt. Es kam keine Fehlermeldung. Bisher habe ich noch nicht Re-enable geklickt.
Ich habe dds.com per Doppelklick gestartet, die Protokolle stehen weiter unten.
Ich habe Gmer gestartet, allerdings kam da ein Bluescreen. Bisher habe ich das nicht wiederholt.
Ich habe unhide ausgeführt. Ich glaube, dass alle Dateien und Ordner wieder sichtbar sind.

Microsoft Security Essentials hat heute - wohl nach Aktualisierung der Signatur (1.127.836.0 vom 27.05.2012 10:14) - eine Bereinigung durchgeführt, während ich den Forumsbeitrag formuliert habe.
Leider weiß ich nicht, wo ich davon ein Logfile herbekommen kann :confused:
Seit dem von MS SecurityEssentials verlangten Neustart kommen die Fehlermeldungen und das Scan-Fenster nicht mehr.
Nachdem ich unhide ausgeführt habe, erkannte MS Security Essentials eine weiter Bedrohung. Die Details habe ich in Code-Blöcken unten eingefügt.
Mittlerweile hat MS SecuritaEssentials da auch schon eine Bereinigung durchgeführt und leuchtet wieder freundlich grün.

DDS.txt:

Code:

.

DDS (Ver_2011-08-26.01) - NTFSx86 

Internet Explorer: 8.0.6001.18904

Run by ******* at 19:20:27 on 2012-05-27

Microsoft® Windows Vista™ Home Premium   6.0.6000.0.1252.49.1031.18.1014.163 [GMT 2:00]

.

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k imgsvc

C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\DRIVERS\xaudio.exe

C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\Google\Update\GoogleUpdate.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Keyboard Manager\Manager Utility\KeyboardManager.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe

C:\Program Files\FreePDF_XP\fpassist.exe

C:\ProgramData\NamKXRvEQrip.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\ehome\ehmsas.exe

C:\Windows\system32\igfxext.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\system32\conime.exe

C:\ProgramData\SfvACqtJ74g9Ik.exe

C:\Windows\system32\taskeng.exe

C:\Windows\ehome\mcupdate.EXE

C:\Windows\system32\sdclt.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\lpremove.exe

C:\Windows\system32\lpksetup.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\System32\svchost.exe -k swprv

C:\Windows\system32\WUDFHost.exe

C:\Windows\System32\mobsync.exe

C:\Program Files\Windows Media Player\wmplayer.exe

\\?\C:\Windows\system32\wbem\WMIADAP.EXE

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.de/

mWinlogon: Userinit=c:\windows\system32\userinit.exe,d:\users\*******\appdata\roaming\appconf32.exe,

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe

uRun: [NokiaOviSuite2] c:\program files\nokia\nokia ovi suite\NokiaOviSuite.exe -tray

uRun: [Imgfla] d:\users\*******\appdata\roaming\adobe\update\forimg.exe

uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe

uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe

uRun: [4W1W8B7A8ZVD1HVGVJBRH] c:\washer2.rar\D60D32919C0.exe /q

uRun: [bbccfaedacbedcdbdct] "c:\programdata\bbccfaedacbedcdbdct.exe"

mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

mRun: [IgfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [Keyboard Manager Utility] "c:\program files\keyboard manager\manager utility\KeyboardManager.exe" /lang DE /H

mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop elements 5.0\apdproxy.exe"

mRun: [FreePDF Assistant] c:\program files\freepdf_xp\fpassist.exe

mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [NamKXRvEQrip.exe] c:\programdata\NamKXRvEQrip.exe

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

mPolicies-system: EnableLUA = 0 (0x0)

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: {474F00F5-3853-492C-AC3A-476512BBC336} - hxxp://picasaweb.google.com/s/v/24.16/uploader2.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 192.168.178.1

TCP: Interfaces\{6B2C3213-04F5-4CC7-A18B-296A232C3C11} : DhcpNameServer = 192.168.178.1

TCP: Interfaces\{CB9F5C1F-04BC-4231-9D96-D652DD20BDA9} : DhcpNameServer = 192.168.1.1

Notify: igfxcui - igfxdev.dll

Hosts: 127.0.0.1        www.spywareinfo.com

.

============= SERVICES / DRIVERS ===============

.

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-4-5 61960]

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2011-4-18 43392]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\avira\antivir desktop\sched.exe [2010-3-26 136360]

S2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-3-26 269480]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-9-9 133104]

S3 BthAvrcp;Bluetooth-AVRCP-Profil;c:\windows\system32\drivers\BthAvrcp.sys [2010-2-5 28048]

S3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-9-9 133104]

.

=============== Created Last 30 ================

.

2012-05-27 17:19:34        713784        ----a-w-        c:\programdata\microsoft\microsoft antimalware\definition updates\{9012fb24-35dc-48d2-98e1-a998582ff975}
 

\gapaengine.dll

2012-05-27 17:14:16        6737808        ----a-w-        c:\programdata\microsoft\microsoft antimalware\definition updates\{954c594a-dc17-4590-8737-4d17510b0ba2}
 

\mpengine.dll

2012-05-21 19:17:04        --------        d--h--w-        c:\programdata\AVAST Software

2012-05-21 19:17:04        --------        d--h--w-        c:\program files\AVAST Software

2012-05-21 11:13:35        1474530        ----a-w-        c:\windows\system32\PerfStringBackup.TMP

2012-05-21 08:59:24        6737808        ---ha-w-        c:\programdata\microsoft\microsoft antimalware\definition updates\updates\mpengine.dll

2012-05-21 07:14:32        56200        ----a-w-        c:\programdata\microsoft\microsoft antimalware\definition updates\{206dad07-f92e-4374-ae80-cf200f38b51b}
 

\offreg.dll

2012-05-20 19:07:30        6737808        ------w-        c:\programdata\microsoft\microsoft antimalware\definition updates\{206dad07-f92e-4374-ae80-cf200f38b51b}
 

\mpengine.dll

2012-05-20 18:48:21        269824        ---ha-w-        c:\programdata\SfvACqtJ74g9Ik.exe

2012-05-20 18:36:25        380928        ---ha-w-        c:\programdata\NamKXRvEQrip.exe

2012-05-09 10:51:58        6737808        ----a-w-        c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll

2012-05-09 10:20:57        6734704        ---h--w-        c:\programdata\microsoft\windows defender\definition updates\{700337a2-8e3b-4ce2-b579-5b318a62e7b5}
 

\mpengine.dll

2012-05-08 11:30:11        --------        d--h--w-        C:\04001785caae1820ebce7865ce

.

==================== Find3M  ====================

.

2012-03-11 18:34:56        414368        ---ha-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

.

============= FINISH: 19:22:06,53 ===============

Attach.txt:

Code:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft® Windows Vista™ Home Premium 

Boot Device: \Device\HarddiskVolume2

Install Date: 03.07.2007 18:11:10

System Uptime: 27.05.2012 18:57:33 (1 hours ago)

.

Motherboard: FUJITSU   |  | 10AD

Processor: Intel(R) Core(TM)2 CPU         T5600  @ 1.83GHz | U1 | 1833/mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 79 GiB total, 37,409 GiB free.

D: is FIXED (NTFS) - 19 GiB total, 3,54 GiB free.

E: is CDROM ()

F: is Removable

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

.

==== Installed Programs ======================

.

Adobe Flash Player 11 ActiveX

Adobe Help Center 2.1

Adobe Photoshop Elements 5.0

Adobe Reader 9.5.0 - Deutsch

Amazon MP3-Downloader 1.0.5

Apple Mobile Device Support

Apple Software Update

Conexant HD Audio

FirstSteps Diagnostics

FreePDF XP (Remove only)

Google Earth

Google Update Helper

GPL Ghostscript 8.60

HDAUDIO Soft Data Fax Modem with SmartCP

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Intel(R) Graphics Media Accelerator Driver

iTunes

J2SE Development Kit 5.0 Update 11

J2SE Runtime Environment 5.0 Update 11

Java Auto Updater

Java(TM) 6 Update 22

Keyboard Manager Utility

Microsoft .NET Framework 3.5 Language Pack SP1 - DEU

Microsoft .NET Framework 3.5 SP1

Microsoft Antimalware

Microsoft Antimalware Service DE-DE Language Pack

Microsoft Security Client

Microsoft Security Client DE-DE Language Pack

Microsoft Security Essentials

Microsoft Visual C++ 2005 SP1 CRT Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Works

MSVC80_x86_v2

MSVC90_x86

MSXML 4.0 SP2 (KB936181)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Nero 7 Essentials

PC Connectivity Solution

QuickTime

RedMon - Redirection Port Monitor

Spybot - Search & Destroy

Synaptics Pointing Device Driver

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

WISO Sparbuch 2010

WISO Steuer-Sparbuch 2011

WISO Steuer-Sparbuch 2012

XMedia Recode 2.2.9.3

Yahoo! Music Jukebox

.

==== End Of File ===========================

MS Security Essentials Warnung(1)

Code:

Kategorie: Ausnutzen
 

Beschreibung: Dieses Programm ist gefährlich. Es nutzt die Sicherheitslücken eines Computers aus.
 

Empfohlene Aktion: Entfernen Sie diese Software unverzüglich.
 

Security Essentials hat Programme erkannt, die Ihre Privatsphäre gefährden oder Ihren Computer beschädigen könnten. Sie können auf die von diesen Programmen 
 

verwendeten Dateien weiterhin zugreifen, ohne sie zu entfernen (nicht empfohlen). Wählen Sie zum Zugreifen auf diese Dateien die Aktion "Zulassen" aus, und 
 

klicken Sie dann auf "Aktionen anwenden". Wenn diese Option nicht verfügbar ist, melden Sie sich als Administrator an, oder bitten Sie den 
 

Sicherheitsadministrator um Unterstützung.
 

Elemente: 

file:D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\356821a5-426d0701->Leps.class

Code:

Kategorie: Ausnutzen
 

Beschreibung: Dieses Programm ist gefährlich. Es nutzt die Sicherheitslücken eines Computers aus.
 

Empfohlene Aktion: Entfernen Sie diese Software unverzüglich.
 

Security Essentials hat Programme erkannt, die Ihre Privatsphäre gefährden oder Ihren Computer beschädigen könnten. Sie können auf die von diesen Programmen 
 

verwendeten Dateien weiterhin zugreifen, ohne sie zu entfernen (nicht empfohlen). Wählen Sie zum Zugreifen auf diese Dateien die Aktion "Zulassen" aus, und 
 

klicken Sie dann auf "Aktionen anwenden". Wenn diese Option nicht verfügbar ist, melden Sie sich als Administrator an, oder bitten Sie den 
 

Sicherheitsadministrator um Unterstützung.
 

Elemente: 

file:D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\112134e7-576d605a->aqmfacpj/hnvtbt.class

Viele Grüße

Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Hallo Arne,

vielen Dank für die schnelle Antwort!

Hier ist das Logfile von Malwarebytes:

Code:

Malwarebytes Anti-Malware (Test) 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.05.29.05
 

Windows Vista x86 NTFS

Internet Explorer 8.0.6001.18904

***** :: *****-PC [Administrator]
 

Schutz: Aktiviert
 

29.05.2012 20:56:14

mbam-log-2012-05-29 (20-56-14).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 348590

Laufzeit: 1 Stunde(n), 42 Minute(n), 37 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 3

HKCR\CLSID\{C689C99E-3A8C-4c87-A79C-C80DC9C81632} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C689C99E-3A8C-4C87-A79C-C80DC9C81632} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C689C99E-3A8C-4C87-A79C-C80DC9C81632} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|4W1W8B7A8ZVD1HVGVJBRH (Trojan.SpyEyes) -> Daten: C:\Washer2.rar\D60D32919C0.exe /q -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateiobjekte der Registrierung: 1

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Userinit (Hijack.UserInit) -> Bösartig: (C:\Windows\system32\userinit.exe,D:\Users\*****\AppData\Roaming\appconf32.exe,) Gut: (userinit.exe) -> Erfolgreich ersetzt und in Quarantäne gestellt.
 

Infizierte Verzeichnisse: 1

C:\sifgayiguha (Trojan.SpyEyes) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateien: 1

D:\Users\*****\AppData\Local\Temp\0.9966188480413017.exe (Exploit.Drop.2) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Und hier das von ESET:

Code:

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=7cfb663ad8213f4d9601841ec029e429

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-05-29 10:50:46

# local_time=2012-05-30 12:50:46 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.0.6000 NT 

# compatibility_mode=768 16777215 100 0 50665912 50665912 0 0

# compatibility_mode=1792 16777175 100 0 29207492 29207492 0 0

# compatibility_mode=5892 16776549 100 100 1442 175858310 0 0

# compatibility_mode=8192 67108863 100 0 284 284 0 0

# scanned=128022

# found=9

# cleaned=0

# scan_time=6258

D:\Users\*****\AppData\Local\Temp\jar_cache8456681225022311029.tmp        Java/Exploit.CVE-2011-3544.AP trojan (unable to clean)        00000000000000000000000000000000        I

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\3b719b51-565074ac        Java/Agent.ED trojan (unable to clean)        00000000000000000000000000000000        I

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\5b377f62-2c364dea        a variant of Java/TrojanDownloader.OpenStream.NCI trojan (unable to clean)        00000000000000000000000000000000        I

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\5b377f62-2f7c0e7f        a variant of Java/TrojanDownloader.OpenStream.NCI trojan (unable to clean)        00000000000000000000000000000000        I

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\5b377f62-47485651        a variant of Java/TrojanDownloader.OpenStream.NCI trojan (unable to clean)        00000000000000000000000000000000        I

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\5b377f62-64e566a8        a variant of Java/TrojanDownloader.OpenStream.NCI trojan (unable to clean)        00000000000000000000000000000000        I

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\5b377f62-6849256b        a variant of Java/TrojanDownloader.OpenStream.NCI trojan (unable to clean)        00000000000000000000000000000000        I

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\5b377f62-7380dd30        a variant of Java/TrojanDownloader.OpenStream.NCI trojan (unable to clean)        00000000000000000000000000000000        I

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\356821a5-426d0701        a variant of Java/Exploit.CVE-2012-0507.AM trojan (unable to clean)        00000000000000000000000000000000        I

Viele Grüße

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Ja, der normale Modus geht - ich hab den Rechner gar nicht im abgesicherten Modus gestartet.

Soweit ich das jetzt sehe, fehlt nichts im Start-Menü.
Ein paar Links hab ich stichprobenartig ausprobiert, die Progamme wurden gestartet.

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Klar gerne, hier ist das OTL-Log:

Code:

OTL logfile created on: 30.05.2012 22:29:48 - Run 2

OTL by OldTimer - Version 3.2.43.1     Folder = D:\Users\Martina\Desktop

Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18904)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1013,56 Mb Total Physical Memory | 232,80 Mb Available Physical Memory | 22,97% Memory free

2,22 Gb Paging File | 1,36 Gb Available in Paging File | 61,09% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 78,76 Gb Total Space | 36,56 Gb Free Space | 46,42% Space Free | Partition Type: NTFS

Drive D: | 19,36 Gb Total Space | 3,62 Gb Free Space | 18,70% Space Free | Partition Type: NTFS

Drive F: | 983,72 Mb Total Space | 666,67 Mb Free Space | 67,77% Space Free | Partition Type: FAT

 

Computer Name: MARTINA-PC | User Name: Martina | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.05.22 16:09:46 | 000,595,968 | ---- | M] (OldTimer Tools) -- D:\Users\Martina\Desktop\OTL.exe

PRC - [2012.04.26 11:00:19 | 001,380,464 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\mshaktuell.exe

PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2009.03.05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\TeaTimer.exe

PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe

PRC - [2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2007.06.26 21:27:46 | 000,312,320 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe

PRC - [2007.06.13 19:01:53 | 001,006,264 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe

PRC - [2007.01.11 20:54:12 | 001,359,872 | ---- | M] (Quanta Computer, INC.) -- C:\Programme\Keyboard Manager\Manager Utility\KeyboardManager.exe

PRC - [2006.12.22 07:31:50 | 000,108,712 | ---- | M] () -- C:\Programme\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

PRC - [2006.12.22 07:29:56 | 000,067,752 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Photoshop Elements 5.0\apdproxy.exe

PRC - [2006.12.08 10:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe

PRC - [2006.11.02 14:36:04 | 000,895,488 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2006.11.02 14:36:04 | 000,201,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.04.26 11:17:29 | 002,002,032 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\wfvie12.dll

MOD - [2012.04.26 11:17:24 | 000,319,600 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\rsguiwinapi47.dll

MOD - [2012.04.26 11:17:23 | 001,543,280 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\wsteu12.dll

MOD - [2012.04.26 11:17:20 | 000,275,056 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\rscorewinapi47.dll

MOD - [2012.04.26 11:01:32 | 007,921,776 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\wgui12.dll

MOD - [2012.04.26 11:01:14 | 002,984,560 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\wcore12.dll

MOD - [2012.04.26 11:01:02 | 004,443,760 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\wauff12.dll

MOD - [2012.04.26 11:00:34 | 001,640,560 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\wreli12.dll

MOD - [2012.04.26 11:00:19 | 001,380,464 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\mshaktuell.exe

MOD - [2012.04.26 11:00:11 | 000,135,792 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\rsodbc47.dll

MOD - [2012.04.26 11:00:08 | 000,028,672 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\rsdcom47.dll

MOD - [2012.01.25 11:01:03 | 000,720,896 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qtsqlrs47.dll

MOD - [2011.11.04 13:47:20 | 000,865,280 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qtcluceners47.dll

MOD - [2011.11.04 13:47:18 | 000,271,872 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\phononrs47.dll

MOD - [2011.11.04 13:47:16 | 011,163,648 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qtwebkitrs47.dll

MOD - [2011.11.04 13:47:14 | 000,108,544 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qttestrs47.dll

MOD - [2011.11.04 13:47:12 | 001,340,416 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qtscriptrs47.dll

MOD - [2011.11.04 13:47:12 | 000,281,088 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qtsvgrs47.dll

MOD - [2011.11.04 13:47:10 | 008,934,400 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qtguirs47.dll

MOD - [2011.11.04 13:47:10 | 002,395,648 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qt3supportrs47.dll

MOD - [2011.11.04 13:47:10 | 000,990,208 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qtnetworkrs47.dll

MOD - [2011.11.04 13:47:10 | 000,358,400 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qtxmlrs47.dll

MOD - [2011.11.04 13:47:08 | 002,356,736 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qtcorers47.dll

MOD - [2006.11.06 10:05:40 | 000,061,440 | ---- | M] () -- C:\Windows\System32\igfxTMM.dll

MOD - [2006.11.06 10:00:56 | 000,077,824 | ---- | M] () -- C:\Windows\System32\hccutils.dll

MOD - [2006.10.25 19:33:48 | 000,015,872 | ---- | M] () -- C:\Programme\Keyboard Manager\Manager Utility\QManager.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SBSDWSCService)

SRV - File not found [Auto | Stopped] -- c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon -- (CLTNetCnService)

SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2011.04.29 19:55:24 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.03.18 19:24:16 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2010.01.26 12:41:08 | 000,652,800 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)

SRV - [2007.06.13 19:01:53 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2006.12.22 07:31:50 | 000,108,712 | ---- | M] () [Auto | Running] -- C:\Programme\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor5.0)

SRV - [2006.12.08 10:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) [Auto | Running] -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe -- (TestHandler)

SRV - [2006.11.02 14:36:04 | 000,895,488 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\usbser_lowerflt.sys -- (upperdev)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\dtwmnic5.sys -- (dtwmnic5)

DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)

DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2011.03.18 19:24:16 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2010.11.22 13:01:24 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010.02.05 06:16:10 | 000,028,048 | ---- | M] (CSR, plc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BthAvrcp.sys -- (BthAvrcp)

DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2008.08.26 09:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)

DRV - [2008.03.04 02:32:00 | 000,188,416 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)

DRV - [2007.04.03 16:53:12 | 000,047,872 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)

DRV - [2006.11.15 18:16:24 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)

DRV - [2006.11.15 13:42:46 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)

DRV - [2006.11.15 11:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)

DRV - [2006.11.01 23:43:50 | 000,145,920 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CHDART.sys -- (HdAudAddService)

DRV - [2006.10.30 09:42:28 | 001,786,880 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)

DRV - [2006.08.17 15:32:26 | 000,033,664 | ---- | M] (Quanta Computer Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\qkbfiltr.sys -- (qkbfiltr)

DRV - [2006.08.04 17:39:10 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)

DRV - [2006.07.14 14:55:34 | 000,105,088 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nvatabus.sys -- (nvatabus)

DRV - [2006.02.07 19:52:58 | 000,006,912 | ---- | M] (JMicron ) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\JGOGO.sys -- (JGOGO)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

 

 

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\.DEFAULT\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-18\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000\..\SearchScopes,DefaultScope = {0E21D2FC-E1F5-4282-938C-18F6ABE547DA}

IE - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC

IE - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000\..\SearchScopes\{0E21D2FC-E1F5-4282-938C-18F6ABE547DA}: "URL" = hxxp://www.google.de/search?q={searchTerms}

IE - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 
 ========== FireFox ==========

 

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

 

 

O1 HOSTS File: ([2012.04.21 20:49:19 | 000,442,689 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O1 - Hosts: 127.0.0.1        www.007guard.com

O1 - Hosts: 127.0.0.1        007guard.com

O1 - Hosts: 127.0.0.1        008i.com

O1 - Hosts: 127.0.0.1        www.008k.com

O1 - Hosts: 127.0.0.1        008k.com

O1 - Hosts: 127.0.0.1        www.00hq.com

O1 - Hosts: 127.0.0.1        00hq.com

O1 - Hosts: 127.0.0.1        010402.com

O1 - Hosts: 127.0.0.1        www.032439.com

O1 - Hosts: 127.0.0.1        032439.com

O1 - Hosts: 127.0.0.1        www.0scan.com

O1 - Hosts: 127.0.0.1        0scan.com

O1 - Hosts: 127.0.0.1        1000gratisproben.com

O1 - Hosts: 127.0.0.1        www.1000gratisproben.com

O1 - Hosts: 127.0.0.1        1001namen.com

O1 - Hosts: 127.0.0.1        www.1001namen.com

O1 - Hosts: 127.0.0.1        100888290cs.com

O1 - Hosts: 127.0.0.1        www.100888290cs.com

O1 - Hosts: 127.0.0.1        www.100sexlinks.com

O1 - Hosts: 127.0.0.1        100sexlinks.com

O1 - Hosts: 127.0.0.1        10sek.com

O1 - Hosts: 127.0.0.1        www.10sek.com

O1 - Hosts: 127.0.0.1        www.1-2005-search.com

O1 - Hosts: 15213 more lines...

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)

O4 - HKLM..\Run: [Keyboard Manager Utility] c:\Program Files\Keyboard Manager\Manager Utility\KeyboardManager.exe (Quanta Computer, INC.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000..\Run: [bbccfaedacbedcdbdct] "C:\ProgramData\bbccfaedacbedcdbdct.exe" File not found

O4 - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000..\Run: [Imgfla] D:\Users\Martina\AppData\Roaming\Adobe\Update\forimg.exe File not found

O4 - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000..\Run: [NokiaOviSuite2] C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray File not found

O4 - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)

O4 - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O13 - gopher Prefix: missing

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)

O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} hxxp://picasaweb.google.com/s/v/24.16/uploader2.cab (UploadListView Class)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Java Plug-in 1.5.0_11)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6B2C3213-04F5-4CC7-A18B-296A232C3C11}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CB9F5C1F-04BC-4231-9D96-D652DD20BDA9}: DhcpNameServer = 192.168.1.1

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{2cc3060e-a376-11e1-9cdd-001636cad7f9}\Shell\AutoRun\command - "" = wscript.exe Deploy\Scripts\BDD_AutoRun.wsf

O33 - MountPoints2\{8f81981c-297f-11dc-9079-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{8f81981c-297f-11dc-9079-806e6f6e6963}\Shell\AutoRun\command - "" = E:\start.exe /auto

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

 

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {38539595-3E29-410d-ABBD-3D6A75BC9A73} - Reg Error: Value error.

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.05.29 23:01:38 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.05.27 20:41:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.05.27 20:41:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.05.27 20:41:20 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.05.27 20:41:19 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.05.21 21:17:04 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software

[2012.05.08 13:30:11 | 000,000,000 | ---D | C] -- C:\04001785caae1820ebce7865ce

[2012.05.01 09:53:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WISO Steuer-Sparbuch 2012

[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

[1 C:\*.tmp files -> C:\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.05.30 22:32:00 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{43D47738-EC2A-4BC5-85D2-AC0F3B7ED4A3}.job

[2012.05.30 22:20:49 | 000,054,156 | ---- | M] () -- C:\Windows\QTFont.qfn

[2012.05.30 22:20:20 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.05.30 22:20:11 | 000,003,200 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.05.30 22:20:11 | 000,003,200 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.05.30 22:20:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.05.30 22:19:59 | 1063,444,480 | -HS- | M] () -- C:\hiberfil.sys

[2012.05.30 20:17:40 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2012.05.30 02:46:00 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.05.29 20:52:04 | 000,000,422 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{0941ED73-D275-454C-A0A6-94DA8B7E2A8D}.job

[2012.05.28 10:30:18 | 000,002,106 | ---- | M] () -- C:\Windows\epplauncher.mif

[2012.05.27 20:41:29 | 000,000,794 | ---- | M] () -- D:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.05.27 19:38:55 | 189,208,887 | ---- | M] () -- C:\Windows\MEMORY.DMP

[2012.05.27 19:11:02 | 000,000,000 | ---- | M] () -- D:\Users\Martina\defogger_reenable

[2012.05.21 08:05:36 | 000,000,256 | ---- | M] () -- C:\ProgramData\SfvACqtJ74g9Ik

[2012.05.21 07:51:57 | 000,635,060 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.05.21 07:51:57 | 000,603,858 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.05.21 07:51:57 | 000,101,696 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.05.21 07:51:56 | 000,114,478 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.05.21 07:48:41 | 000,000,152 | ---- | M] () -- C:\ProgramData\-SfvACqtJ74g9Ikr

[2012.05.21 07:48:41 | 000,000,000 | ---- | M] () -- C:\ProgramData\-SfvACqtJ74g9Ik

[2012.05.17 19:26:23 | 000,001,166 | ---- | M] () -- C:\Windows\wiso.ini

[2012.05.01 09:54:03 | 000,001,912 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk

[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

[1 C:\*.tmp files -> C:\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.05.27 20:53:30 | 000,002,267 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yahoo! Music Jukebox.lnk

[2012.05.27 20:53:30 | 000,002,149 | ---- | C] () -- D:\Users\Public\Desktop\iTunes.lnk

[2012.05.27 20:53:30 | 000,002,111 | ---- | C] () -- D:\Users\Public\Desktop\Yahoo! Music Jukebox.lnk

[2012.05.27 20:53:30 | 000,001,947 | ---- | C] () -- D:\Users\Public\Desktop\Google Earth.lnk

[2012.05.27 20:53:30 | 000,001,773 | ---- | C] () -- D:\Users\Public\Desktop\Adobe Reader 9.lnk

[2012.05.27 20:53:30 | 000,000,990 | ---- | C] () -- D:\Users\Public\Desktop\Adobe Photoshop Elements 5.0.lnk

[2012.05.27 20:53:30 | 000,000,760 | ---- | C] () -- D:\Users\Public\Desktop\XMedia Recode.lnk

[2012.05.27 20:53:27 | 000,001,950 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Photo Gallery.lnk

[2012.05.27 20:53:27 | 000,001,912 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk

[2012.05.27 20:53:27 | 000,001,852 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Collaboration.lnk

[2012.05.27 20:53:27 | 000,001,803 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk

[2012.05.27 20:53:27 | 000,001,770 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Calendar.lnk

[2012.05.27 20:53:27 | 000,001,768 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Movie Maker.lnk

[2012.05.27 20:53:27 | 000,001,757 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Defender.lnk

[2012.05.27 20:53:27 | 000,001,743 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk

[2012.05.27 20:53:27 | 000,001,703 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Contacts.lnk

[2012.05.27 20:53:27 | 000,000,604 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live.lnk

[2012.05.27 20:53:26 | 000,001,799 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works-Start.lnk

[2012.05.27 20:53:25 | 000,001,901 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office PowerPoint Viewer 2003.lnk

[2012.05.27 20:53:25 | 000,001,630 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk

[2012.05.27 20:53:24 | 000,001,896 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help Center.lnk

[2012.05.27 20:53:24 | 000,001,804 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk

[2012.05.27 20:53:24 | 000,001,002 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Elements 5.0.lnk

[2012.05.27 20:41:29 | 000,000,794 | ---- | C] () -- D:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.05.27 19:11:02 | 000,000,000 | ---- | C] () -- D:\Users\Martina\defogger_reenable

[2012.05.20 20:48:52 | 000,000,152 | ---- | C] () -- C:\ProgramData\-SfvACqtJ74g9Ikr

[2012.05.20 20:48:52 | 000,000,000 | ---- | C] () -- C:\ProgramData\-SfvACqtJ74g9Ik

[2012.05.20 20:48:42 | 000,000,256 | ---- | C] () -- C:\ProgramData\SfvACqtJ74g9Ik

 
 ========== LOP Check ==========

 

[2009.12.20 01:02:48 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Amazon

[2008.07.10 16:52:31 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Buhl Data Service

[2007.11.18 17:43:02 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Engelmann Media

[2011.05.31 16:46:18 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\kock

[2010.06.07 11:49:14 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Nokia

[2012.04.27 19:07:04 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Opera

[2010.06.18 19:04:59 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\PC Suite

[2007.11.18 17:43:10 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Template

[2010.10.13 14:06:03 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\TrusteerHelp

[2011.06.06 12:45:04 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\UAs

[2010.12.17 23:00:56 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\XMedia Recode

[2011.06.09 12:30:57 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\xmldm

[2009.08.03 18:23:31 | 000,000,000 | ---D | M] -- D:\Users\Test\AppData\Roaming\Template

[2012.05.30 20:17:41 | 000,032,620 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2012.05.29 20:52:04 | 000,000,422 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{0941ED73-D275-454C-A0A6-94DA8B7E2A8D}.job

[2012.05.30 22:32:00 | 000,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{43D47738-EC2A-4BC5-85D2-AC0F3B7ED4A3}.job

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.07.18 09:28:43 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Adobe

[2007.11.18 17:42:59 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Ahead

[2009.12.20 01:02:48 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Amazon

[2007.11.18 17:43:02 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Apple Computer

[2008.07.10 16:52:31 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Buhl Data Service

[2007.11.18 17:43:02 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Engelmann Media

[2007.11.18 17:43:02 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Google

[2010.10.14 12:37:35 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Helper

[2007.11.18 17:43:02 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Identities

[2012.05.01 09:40:51 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\InstallShield

[2011.05.31 16:46:18 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\kock

[2007.11.18 17:43:02 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Macromedia

[2012.05.27 20:41:38 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Malwarebytes

[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Media Center Programs

[2010.10.24 22:46:17 | 000,000,000 | --SD | M] -- D:\Users\Martina\AppData\Roaming\Microsoft

[2010.06.07 11:49:14 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Nokia

[2012.04.27 19:07:04 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Opera

[2010.06.18 19:04:59 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\PC Suite

[2007.11.18 17:43:10 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Template

[2010.10.13 14:06:03 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\TrusteerHelp

[2011.06.06 12:45:04 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\UAs

[2010.12.17 23:00:56 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\XMedia Recode

[2011.06.09 12:30:57 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\xmldm

 
 < %APPDATA%\*.exe /s >

[2010.09.03 12:36:31 | 068,725,024 | ---- | M] () -- D:\Users\Martina\AppData\Roaming\Nokia\Ovi Suite\Software Updater\NokiaOviSuite2Installer.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys

[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

[2008.01.19 07:06:48 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\drivers\atapi.sys

[2008.01.19 07:06:48 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys

[2008.01.19 07:06:48 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys

[2008.01.19 06:33:23 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2006.05.11 11:30:52 | 000,247,808 | ---- | M] (Intel Corporation) MD5=294110966CEDD127629C5BE48367C8CF -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_6c3369af\iaStor.sys

[2006.05.11 11:30:52 | 000,247,808 | ---- | M] (Intel Corporation) MD5=294110966CEDD127629C5BE48367C8CF -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_0d20ce62\iaStor.sys

[2006.10.31 14:46:36 | 000,250,368 | ---- | M] (Intel Corporation) MD5=DE01BF14FFB150C779FD561BD0E3C5C5 -- C:\DRIVER\SATA\INTEL\iaStor.sys

[2006.10.31 14:46:36 | 000,250,368 | ---- | M] (Intel Corporation) MD5=DE01BF14FFB150C779FD561BD0E3C5C5 -- C:\Windows\System32\drivers\iaStor.sys

[2006.10.31 14:46:36 | 000,250,368 | ---- | M] (Intel Corporation) MD5=DE01BF14FFB150C779FD561BD0E3C5C5 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_3bb7bc45\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\System32\netlogon.dll

[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll

 
 < MD5 for: NVATABUS.SYS  >

[2006.07.14 14:55:34 | 000,105,088 | ---- | M] (NVIDIA Corporation) MD5=7D960340BE5B0E008BB94E4C3B991339 -- C:\Windows\System32\drivers\nvatabus.sys

[2006.07.14 14:55:34 | 000,105,088 | ---- | M] (NVIDIA Corporation) MD5=7D960340BE5B0E008BB94E4C3B991339 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_27229839\nvatabus.sys

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys

[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\System32\scecli.dll

[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2007.06.13 18:56:59 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll

[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll

[2007.06.13 18:56:59 | 000,633,856 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2007.06.13 18:56:59 | 000,633,856 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\System32\userinit.exe

[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

 
 < MD5 for: VIAMRAID.SYS  >

[2006.03.31 02:18:30 | 000,100,992 | ---- | M] (VIA Technologies inc,.ltd) MD5=9F3F276C7300ED211129757A411B605F -- C:\Windows\System32\drivers\viamraid.sys

[2006.03.31 02:18:30 | 000,100,992 | ---- | M] (VIA Technologies inc,.ltd) MD5=9F3F276C7300ED211129757A411B605F -- C:\Windows\System32\DriverStore\FileRepository\viamraid.inf_2d6a7e3a\viamraid.sys

 
 < MD5 for: WININIT.EXE  >

[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\System32\wininit.exe

[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\System32\winlogon.exe

[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\System32\drivers\ws2ifsl.sys

[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2007.06.13 11:59:40 | 006,664,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2007.06.13 11:59:37 | 000,102,400 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2007.06.13 11:59:41 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2007.06.13 11:59:57 | 015,720,448 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2007.06.13 12:00:00 | 006,021,120 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

 
 <           >
 

< End of report >

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

O4 - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000..\Run: [bbccfaedacbedcdbdct] "C:\ProgramData\bbccfaedacbedcdbdct.exe" File not found

O4 - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000..\Run: [Imgfla] D:\Users\Martina\AppData\Roaming\Adobe\Update\forimg.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{2cc3060e-a376-11e1-9cdd-001636cad7f9}\Shell\AutoRun\command - "" = wscript.exe Deploy\Scripts\BDD_AutoRun.wsf

O33 - MountPoints2\{8f81981c-297f-11dc-9079-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{8f81981c-297f-11dc-9079-806e6f6e6963}\Shell\AutoRun\command - "" = E:\start.exe /auto

[2012.05.21 08:05:36 | 000,000,256 | ---- | M] () -- C:\ProgramData\SfvACqtJ74g9Ik

[2012.05.21 07:48:41 | 000,000,152 | ---- | M] () -- C:\ProgramData\-SfvACqtJ74g9Ikr

[2012.05.21 07:48:41 | 000,000,000 | ---- | M] () -- C:\ProgramData\-SfvACqtJ74g9Ik

[2011.06.09 12:30:57 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\xmldm

[2011.05.31 16:46:18 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\kock

[2011.06.06 12:45:04 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\UAs

:Files

D:\Users\Martina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0

:Commands

[purity]

[emptytemp]

[emptyflash]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Aaalso ... ich hab den Fix mit OTL gemacht.

Nach Klicken auf OK wurde der Rechner sofort ohne Rückfrage durchgestartet.
Beim wieder Hochfahren konnte ich mich mit meinem Administrator-Account nicht mehr anmelden. :wtf: (Die Anmeldung des Dienstes "Benutzerprofildienst" ist fehlgeschlagen. Das Benutzerprofil kann nicht geladen werden.)

Mit einem Standard-Account kann ich mich anmelden. Nach der Anmeldung kam das OTL-Logfile hoch (siehe unten).
Unter diesem Account kann ich dann auch das Administrator-Passwort engeben (erfolgreich) wenn ich z.B. in die Benutzerkontensteuerung gehe.

Nach der ersten Anmeldung mit dem Standard-Account konnte ich einen Benutzerwechsel zum Admin-Account durchführen. Das ging aber nur einmal.
Nach dieser Anmeldung sagte mir aber eine Fehlermeldung, dass der Zugriff auf D: verweigert oder nicht möglich sei.

Falls das was mit dem OTL-Fix zu tun haben könnte, hoffe ich dass sich das mit den nächsten Aktionen irgendwann wieder legt.
Ansonsten versuch ich nach der Fertigstellung unserer Reparatur-Party, einen neuen Administrativen Account anzulegen und hoff, dass mit dem dann wieder alles in Ordnung sein wird... in die Benutzerkontensteuerung komm ich ja rein.

Hier ist jedenfalls erst mal das OTL-Log:

Code:

All processes killed

========== OTL ==========

Registry value HKEY_USERS\S-1-5-21-3794037573-2674974133-3482154547-1000\Software\Microsoft\Windows\CurrentVersion\Run\\bbccfaedacbedcdbdct deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3794037573-2674974133-3482154547-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Imgfla deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.

Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\autoexec.bat moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2cc3060e-a376-11e1-9cdd-001636cad7f9}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2cc3060e-a376-11e1-9cdd-001636cad7f9}\ not found.

File wscript.exe Deploy\Scripts\BDD_AutoRun.wsf not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f81981c-297f-11dc-9079-806e6f6e6963}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f81981c-297f-11dc-9079-806e6f6e6963}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f81981c-297f-11dc-9079-806e6f6e6963}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f81981c-297f-11dc-9079-806e6f6e6963}\ not found.

File E:\start.exe /auto not found.

C:\ProgramData\SfvACqtJ74g9Ik moved successfully.

C:\ProgramData\-SfvACqtJ74g9Ikr moved successfully.

C:\ProgramData\-SfvACqtJ74g9Ik moved successfully.

D:\Users\*****\AppData\Roaming\xmldm folder moved successfully.

D:\Users\*****\AppData\Roaming\kock folder moved successfully.

D:\Users\*****\AppData\Roaming\UAs folder moved successfully.

========== FILES ==========

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.

D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: Default

 

User: *****

 

User: Public

 

User: Test

 

%systemdrive% .tmp files removed: 12797680 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 1474530 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 223609230 bytes

RecycleBin emptied: 104 bytes

 

Total Files Cleaned = 227,00 mb

 

 

[EMPTYFLASH]

 

User: Default

 

User: *****

 

User: Public

 

User: Test

 

Total Flash Files Cleaned = 0,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.43.1 log created on 05312012_190628
 

Files\Folders moved on Reboot...
 

Registry entries deleted on Reboot...

Viele hoffnungsvolle Grüße :)

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Logfile von TDSS-Killer:

Code:

21:59:05.0732 4292        TDSS rootkit removing tool 2.7.36.0 May 21 2012 16:40:16

21:59:05.0820 4292        ============================================================

21:59:05.0820 4292        Current date / time: 2012/06/01 21:59:05.0820

21:59:05.0820 4292        SystemInfo:

21:59:05.0820 4292        

21:59:05.0820 4292        OS Version: 6.0.6000 ServicePack: 0.0

21:59:05.0820 4292        Product type: Workstation

21:59:05.0820 4292        ComputerName: ******-PC

21:59:05.0820 4292        UserName: ******

21:59:05.0820 4292        Windows directory: C:\Windows

21:59:05.0820 4292        System windows directory: C:\Windows

21:59:05.0821 4292        Processor architecture: Intel x86

21:59:05.0821 4292        Number of processors: 2

21:59:05.0821 4292        Page size: 0x1000

21:59:05.0821 4292        Boot type: Normal boot

21:59:05.0821 4292        ============================================================

21:59:06.0734 4292        Drive \Device\Harddisk0\DR0 - Size: 0x1BF2976000 (111.79 Gb), SectorSize: 0x200, Cylinders: 0x3901, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050

21:59:06.0766 4292        Drive \Device\Harddisk1\DR1 - Size: 0x3D800000 (0.96 Gb), SectorSize: 0x200, Cylinders: 0x7D, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

21:59:06.0767 4292        ============================================================

21:59:06.0767 4292        \Device\Harddisk0\DR0:

21:59:06.0767 4292        MBR partitions:

21:59:06.0767 4292        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1770800, BlocksNum 0x9D84000

21:59:06.0767 4292        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0xB8DC800, BlocksNum 0x26B7800

21:59:06.0767 4292        \Device\Harddisk1\DR1:

21:59:06.0769 4292        MBR partitions:

21:59:06.0769 4292        \Device\Harddisk1\DR1\Partition0: MBR, Type 0x6, StartLBA 0x20, BlocksNum 0x1EBFE0

21:59:06.0769 4292        ============================================================

21:59:06.0805 4292        C: <-> \Device\Harddisk0\DR0\Partition0

21:59:06.0862 4292        D: <-> \Device\Harddisk0\DR0\Partition1

21:59:06.0862 4292        ============================================================

21:59:06.0862 4292        Initialize success

21:59:06.0862 4292        ============================================================

22:01:10.0786 2724        ============================================================

22:01:10.0786 2724        Scan started

22:01:10.0786 2724        Mode: Manual; SigCheck; TDLFS; 

22:01:10.0786 2724        ============================================================

22:01:12.0746 2724        ACPI            (84fc6df81212d16be5c4f441682feccc) C:\Windows\system32\drivers\acpi.sys

22:01:12.0934 2724        ACPI - ok

22:01:13.0080 2724        AdobeActiveFileMonitor5.0 (63ab43534cbf5d7f3eb81dfdc8161490) C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

22:01:13.0091 2724        AdobeActiveFileMonitor5.0 - ok

22:01:13.0170 2724        adp94xx         (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys

22:01:13.0217 2724        adp94xx - ok

22:01:13.0265 2724        adpahci         (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys

22:01:13.0306 2724        adpahci - ok

22:01:13.0345 2724        adpu160m        (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys

22:01:13.0364 2724        adpu160m - ok

22:01:13.0405 2724        adpu320         (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys

22:01:13.0425 2724        adpu320 - ok

22:01:13.0474 2724        AeLookupSvc     (9d1fda9e086ba64e3c93c9de32461bcf) C:\Windows\System32\aelupsvc.dll

22:01:13.0560 2724        AeLookupSvc - ok

22:01:13.0606 2724        AFD             (5d24caf8efd924a875698ff28384db8b) C:\Windows\system32\drivers\afd.sys

22:01:13.0756 2724        AFD - ok

22:01:13.0808 2724        agp440          (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys

22:01:13.0817 2724        agp440 - ok

22:01:13.0847 2724        aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

22:01:13.0858 2724        aic78xx - ok

22:01:13.0889 2724        ALG             (e69fb0e3112c40fdc0ef7d21a52dc951) C:\Windows\System32\alg.exe

22:01:13.0921 2724        ALG - ok

22:01:13.0953 2724        aliide          (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys

22:01:13.0962 2724        aliide - ok

22:01:13.0991 2724        amdagp          (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys

22:01:14.0000 2724        amdagp - ok

22:01:14.0025 2724        amdide          (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys

22:01:14.0041 2724        amdide - ok

22:01:14.0073 2724        AmdK7           (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys

22:01:14.0174 2724        AmdK7 - ok

22:01:14.0204 2724        AmdK8           (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys

22:01:14.0292 2724        AmdK8 - ok

22:01:14.0410 2724        AntiVirSchedulerService (c27d46b06d340293670450fce9dfb166) C:\Program Files\Avira\AntiVir Desktop\sched.exe

22:01:14.0438 2724        AntiVirSchedulerService - ok

22:01:14.0474 2724        AntiVirService  (c9fb073fd3c306b9eb32993be72f8ab7) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

22:01:14.0538 2724        AntiVirService - ok

22:01:14.0609 2724        Appinfo         (cfa455816879f06f1c4e5bbf9e8aef7d) C:\Windows\System32\appinfo.dll

22:01:14.0695 2724        Appinfo - ok

22:01:14.0804 2724        Apple Mobile Device (e4e3a862fee8061adc922a73b15800f3) C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

22:01:14.0835 2724        Apple Mobile Device ( UnsignedFile.Multi.Generic ) - warning

22:01:14.0835 2724        Apple Mobile Device - detected UnsignedFile.Multi.Generic (1)

22:01:14.0854 2724        arc             (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys

22:01:14.0864 2724        arc - ok

22:01:14.0916 2724        arcsas          (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys

22:01:14.0934 2724        arcsas - ok

22:01:14.0990 2724        AsyncMac        (e86cf7ce67d5de898f27ef884dc357d8) C:\Windows\system32\DRIVERS\asyncmac.sys

22:01:15.0088 2724        AsyncMac - ok

22:01:15.0133 2724        atapi           (b35cfcef838382ab6490b321c87edf17) C:\Windows\system32\drivers\atapi.sys

22:01:15.0150 2724        atapi - ok

22:01:15.0269 2724        AudioEndpointBuilder (e760fc1bd68f7f6f1b17eb4e8d9480b0) C:\Windows\System32\Audiosrv.dll

22:01:15.0364 2724        AudioEndpointBuilder - ok

22:01:15.0371 2724        Audiosrv        (e760fc1bd68f7f6f1b17eb4e8d9480b0) C:\Windows\System32\Audiosrv.dll

22:01:15.0422 2724        Audiosrv - ok

22:01:15.0516 2724        avgntflt        (47b879406246ffdced59e18d331a0e7d) C:\Windows\system32\DRIVERS\avgntflt.sys

22:01:15.0694 2724        avgntflt - ok

22:01:15.0749 2724        avipbb          (5fedef54757b34fb611b9ec8fb399364) C:\Windows\system32\DRIVERS\avipbb.sys

22:01:15.0768 2724        avipbb - ok

22:01:15.0825 2724        Beep            (ac3dd1708b22761ebd7cbe14dcc3b5d7) C:\Windows\system32\drivers\Beep.sys

22:01:15.0927 2724        Beep - ok

22:01:16.0023 2724        BFE             (98ebdffb824a7c265337d68dd480e45c) C:\Windows\System32\bfe.dll

22:01:16.0170 2724        BFE - ok

22:01:16.0291 2724        BITS            (da551697e34d2b9943c8b1c8eaffe89a) C:\Windows\System32\qmgr.dll

22:01:16.0451 2724        BITS - ok

22:01:16.0457 2724        blbdrive - ok

22:01:16.0485 2724        bowser          (913cd06fbe9105ce6077e90fd4418561) C:\Windows\system32\DRIVERS\bowser.sys

22:01:16.0592 2724        bowser - ok

22:01:16.0642 2724        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

22:01:16.0750 2724        BrFiltLo - ok

22:01:16.0771 2724        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

22:01:16.0878 2724        BrFiltUp - ok

22:01:16.0919 2724        Browser         (beb6470532b7461d7bb426e3facb424f) C:\Windows\System32\browser.dll

22:01:17.0022 2724        Browser - ok

22:01:17.0074 2724        Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

22:01:17.0169 2724        Brserid - ok

22:01:17.0195 2724        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

22:01:17.0265 2724        BrSerWdm - ok

22:01:17.0282 2724        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

22:01:17.0347 2724        BrUsbMdm - ok

22:01:17.0374 2724        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys

22:01:17.0455 2724        BrUsbSer - ok

22:01:17.0503 2724        BthAvrcp        (3472331b9d460212965b51a8d38e8bec) C:\Windows\system32\DRIVERS\BthAvrcp.sys

22:01:17.0515 2724        BthAvrcp - ok

22:01:17.0563 2724        BthEnum         (cf97c2d6a011ee9403b42191b5f95ba8) C:\Windows\system32\DRIVERS\BthEnum.sys

22:01:17.0625 2724        BthEnum - ok

22:01:17.0658 2724        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\DRIVERS\bthmodem.sys

22:01:17.0763 2724        BTHMODEM - ok

22:01:17.0812 2724        BthPan          (b8c3d9ddf85fd197c3e5f849fef71144) C:\Windows\system32\DRIVERS\bthpan.sys

22:01:17.0885 2724        BthPan - ok

22:01:17.0937 2724        BTHPORT         (b4ce8000aab30a9ab16cd0fb3db4d7cf) C:\Windows\system32\Drivers\BTHport.sys

22:01:17.0975 2724        BTHPORT - ok

22:01:18.0029 2724        BthServ         (58ee7f5e68310bc8d4e7cebd8358c12e) C:\Windows\System32\bthserv.dll

22:01:18.0145 2724        BthServ - ok

22:01:18.0169 2724        BTHUSB          (9a4ddc8544c1459aa2a118a8858dade3) C:\Windows\system32\Drivers\BTHUSB.sys

22:01:18.0205 2724        BTHUSB - ok

22:01:18.0263 2724        cdfs            (6c3a437fc873c6f6a4fc620b6888cb86) C:\Windows\system32\DRIVERS\cdfs.sys

22:01:18.0310 2724        cdfs - ok

22:01:18.0332 2724        cdrom           (8d1866e61af096ae8b582454f5e4d303) C:\Windows\system32\DRIVERS\cdrom.sys

22:01:18.0380 2724        cdrom - ok

22:01:18.0421 2724        CertPropSvc     (0600e04315fe543802a379d5d23c8be0) C:\Windows\System32\certprop.dll

22:01:18.0489 2724        CertPropSvc - ok

22:01:18.0506 2724        circlass        (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys

22:01:18.0553 2724        circlass - ok

22:01:18.0614 2724        CLFS            (1b84fd0937d3b99af9ba38ddff3daf54) C:\Windows\system32\CLFS.sys

22:01:18.0629 2724        CLFS - ok

22:01:18.0711 2724        clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

22:01:18.0723 2724        clr_optimization_v2.0.50727_32 - ok

22:01:18.0816 2724        CLTNetCnService - ok

22:01:18.0874 2724        CmBatt          (ed97ad3df1b9005989eaf149bf06c821) C:\Windows\system32\DRIVERS\CmBatt.sys

22:01:18.0939 2724        CmBatt - ok

22:01:18.0970 2724        cmdide          (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys

22:01:18.0985 2724        cmdide - ok

22:01:19.0045 2724        CnxtHdAudService (b6e7991e3d6146c04c85cd31af22a381) C:\Windows\system32\drivers\CHDRT32.sys

22:01:19.0153 2724        CnxtHdAudService - ok

22:01:19.0160 2724        Compbatt        (722936afb75a7f509662b69b5632f48a) C:\Windows\system32\DRIVERS\compbatt.sys

22:01:19.0177 2724        Compbatt - ok

22:01:19.0184 2724        COMSysApp - ok

22:01:19.0197 2724        crcdisk         (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys

22:01:19.0213 2724        crcdisk - ok

22:01:19.0248 2724        Crusoe          (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys

22:01:19.0317 2724        Crusoe - ok

22:01:19.0420 2724        CryptSvc        (1c26fb097170a2a91066d1e3a24366e3) C:\Windows\system32\cryptsvc.dll

22:01:19.0494 2724        CryptSvc - ok

22:01:19.0573 2724        DcomLaunch      (7b981222a257d076885bffb66f19b7ce) C:\Windows\system32\rpcss.dll

22:01:19.0731 2724        DcomLaunch - ok

22:01:19.0819 2724        DfsC            (a7179de59ae269ab70345527894ccd7c) C:\Windows\system32\Drivers\dfsc.sys

22:01:19.0931 2724        DfsC - ok

22:01:20.0162 2724        DFSR            (e0d584aa76c7d845ba9f3a788260528f) C:\Windows\system32\DFSR.exe

22:01:20.0474 2724        DFSR - ok

22:01:20.0638 2724        Dhcp            (dc45739bc22d528d2b3e50d3f6761750) C:\Windows\System32\dhcpcsvc.dll

22:01:20.0741 2724        Dhcp - ok

22:01:20.0841 2724        disk            (841af4c4d41d3e3b2f244e976b0f7963) C:\Windows\system32\drivers\disk.sys

22:01:20.0858 2724        disk - ok

22:01:20.0928 2724        Dnscache        (eecba1dd142bf8693c476be8f32fe253) C:\Windows\System32\dnsrslvr.dll

22:01:21.0023 2724        Dnscache - ok

22:01:21.0081 2724        dot3svc         (1f795d214820e496bf1124434a6db546) C:\Windows\System32\dot3svc.dll

22:01:21.0199 2724        dot3svc - ok

22:01:21.0271 2724        DPS             (032c90ad677bf7b7a8013d6087c7a921) C:\Windows\system32\dps.dll

22:01:21.0306 2724        DPS - ok

22:01:21.0365 2724        drmkaud         (ee472cd2c01f6f8e8aa1fa06ffef61b6) C:\Windows\system32\drivers\drmkaud.sys

22:01:21.0436 2724        drmkaud - ok

22:01:21.0459 2724        dtwmnic5 - ok

22:01:21.0524 2724        DXGKrnl         (a2b160c1bb13ee3303c342e551373c59) C:\Windows\System32\drivers\dxgkrnl.sys

22:01:21.0573 2724        DXGKrnl - ok

22:01:21.0669 2724        E100B           (c0b00e55cf82d122d25983c7a6a53dea) C:\Windows\system32\DRIVERS\e100b325.sys

22:01:21.0773 2724        E100B - ok

22:01:21.0836 2724        E1G60           (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys

22:01:21.0893 2724        E1G60 - ok

22:01:21.0936 2724        EapHost         (90a0a875642e18618010645311b4e89e) C:\Windows\System32\eapsvc.dll

22:01:22.0024 2724        EapHost - ok

22:01:22.0081 2724        Ecache          (0efc7531b936ee57fdb4e837664c509f) C:\Windows\system32\drivers\ecache.sys

22:01:22.0097 2724        Ecache - ok

22:01:22.0216 2724        ehRecvr         (b4580122b0a7b263b6ee9acba69c8013) C:\Windows\ehome\ehRecvr.exe

22:01:22.0279 2724        ehRecvr - ok

22:01:22.0341 2724        ehSched         (ad1870c8e5d6dd340c829e6074bf3c3f) C:\Windows\ehome\ehsched.exe

22:01:22.0390 2724        ehSched - ok

22:01:22.0428 2724        ehstart         (c27c4ee8926e74aa72efcab24c5242c3) C:\Windows\ehome\ehstart.dll

22:01:22.0447 2724        ehstart - ok

22:01:22.0561 2724        elxstor         (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys

22:01:22.0601 2724        elxstor - ok

22:01:22.0699 2724        EMDMgmt         (3226fda08988526e819e364e8cce4cee) C:\Windows\system32\emdmgmt.dll

22:01:22.0911 2724        EMDMgmt - ok

22:01:22.0991 2724        EventSystem     (7b4971c3d43525175a4ea0d143e0412e) C:\Windows\system32\es.dll

22:01:23.0094 2724        EventSystem - ok

22:01:23.0114 2724        fastfat         (84a317cb0b3954d3768cdcd018dbf670) C:\Windows\system32\drivers\fastfat.sys

22:01:23.0187 2724        fastfat - ok

22:01:23.0206 2724        fdc             (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys

22:01:23.0276 2724        fdc - ok

22:01:23.0302 2724        fdPHost         (e43bce1a77d6fd4ed5f8e0482b9e7df1) C:\Windows\system32\fdPHost.dll

22:01:23.0369 2724        fdPHost - ok

22:01:23.0375 2724        FDResPub        (89ed56dce8e47af40892778a5bd31fd2) C:\Windows\system32\fdrespub.dll

22:01:23.0428 2724        FDResPub - ok

22:01:23.0454 2724        FileInfo        (65773d6115c037ffd7ef8280ae85eb9d) C:\Windows\system32\drivers\fileinfo.sys

22:01:23.0464 2724        FileInfo - ok

22:01:23.0494 2724        Filetrace       (c226dd0de060745f3e042f58dcf78402) C:\Windows\system32\drivers\filetrace.sys

22:01:23.0562 2724        Filetrace - ok

22:01:23.0579 2724        flpydisk        (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys

22:01:23.0625 2724        flpydisk - ok

22:01:23.0639 2724        FltMgr          (a6a8da7ae4d53394ab22ac3ab6d3f5d3) C:\Windows\system32\drivers\fltmgr.sys

22:01:23.0653 2724        FltMgr - ok

22:01:23.0726 2724        FontCache3.0.0.0 (c9be08664611ddaf98e2331e9288b00b) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

22:01:23.0736 2724        FontCache3.0.0.0 - ok

22:01:23.0772 2724        Fs_Rec          (66a078591208baa210c7634b11eb392c) C:\Windows\system32\drivers\Fs_Rec.sys

22:01:23.0806 2724        Fs_Rec - ok

22:01:23.0828 2724        gagp30kx        (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys

22:01:23.0839 2724        gagp30kx - ok

22:01:23.0870 2724        GEARAspiWDM     (4ac51459805264affd5f6fdfb9d9235f) C:\Windows\system32\Drivers\GEARAspiWDM.sys

22:01:23.0886 2724        GEARAspiWDM - ok

22:01:23.0957 2724        gpsvc           (bcf6589c42d8f6a20f33ef133ffe0524) C:\Windows\System32\gpsvc.dll

22:01:24.0114 2724        gpsvc - ok

22:01:24.0223 2724        gupdate         (626a24ed1228580b9518c01930936df9) C:\Program Files\Google\Update\GoogleUpdate.exe

22:01:24.0238 2724        gupdate - ok

22:01:24.0260 2724        gupdatem        (626a24ed1228580b9518c01930936df9) C:\Program Files\Google\Update\GoogleUpdate.exe

22:01:24.0278 2724        gupdatem - ok

22:01:24.0334 2724        HdAudAddService (de4020f928a2f8a6327f5687f36d361b) C:\Windows\system32\drivers\CHDART.sys

22:01:24.0413 2724        HdAudAddService - ok

22:01:24.0442 2724        HDAudBus        (0db613a7e427b5663563677796fd5258) C:\Windows\system32\DRIVERS\HDAudBus.sys

22:01:24.0486 2724        HDAudBus - ok

22:01:24.0516 2724        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

22:01:24.0596 2724        HidBth - ok

22:01:24.0622 2724        HidIr           (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys

22:01:24.0668 2724        HidIr - ok

22:01:24.0699 2724        hidserv         (8fa640195279ace21bea91396a0054fc) C:\Windows\system32\hidserv.dll

22:01:24.0771 2724        hidserv - ok

22:01:24.0801 2724        HidUsb          (01e7971e9f4bd6ac6a08db52d0ea0418) C:\Windows\system32\DRIVERS\hidusb.sys

22:01:24.0827 2724        HidUsb - ok

22:01:24.0856 2724        hkmsvc          (d40aa05e29bf6ed29b139f044b461e9b) C:\Windows\system32\kmsvc.dll

22:01:24.0923 2724        hkmsvc - ok

22:01:24.0947 2724        HpCISSs         (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys

22:01:24.0956 2724        HpCISSs - ok

22:01:25.0011 2724        HSFHWAZL        (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS

22:01:25.0098 2724        HSFHWAZL - ok

22:01:25.0193 2724        HSF_DPV         (53229dcf431d76434816cd29251168a0) C:\Windows\system32\DRIVERS\HSX_DPV.sys

22:01:25.0348 2724        HSF_DPV - ok

22:01:25.0397 2724        HSXHWAZL        (31f949d452201f2f0af0c88d7db512cd) C:\Windows\system32\DRIVERS\HSXHWAZL.sys

22:01:25.0455 2724        HSXHWAZL - ok

22:01:25.0598 2724        HTTP            (ea24fe637d974a8a31bc650f478e3533) C:\Windows\system32\drivers\HTTP.sys

22:01:25.0754 2724        HTTP - ok

22:01:25.0787 2724        i2omp           (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys

22:01:25.0804 2724        i2omp - ok

22:01:25.0900 2724        i8042prt        (1c9ee072baa3abb460b91d7ee9152660) C:\Windows\system32\DRIVERS\i8042prt.sys

22:01:25.0950 2724        i8042prt - ok

22:01:26.0150 2724        ialm            (0215e1204d5410e50a5ea9d442fe7da3) C:\Windows\system32\DRIVERS\igdkmd32.sys

22:01:26.0380 2724        ialm - ok

22:01:26.0552 2724        iaStor          (de01bf14ffb150c779fd561bd0e3c5c5) C:\Windows\system32\drivers\iastor.sys

22:01:26.0640 2724        iaStor - ok

22:01:26.0688 2724        iaStorV         (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys

22:01:26.0718 2724        iaStorV - ok

22:01:26.0857 2724        idsvc           (7b630acaed64fef0c3e1cf255cb56686) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

22:01:26.0956 2724        idsvc - ok

22:01:27.0136 2724        igfx            (0215e1204d5410e50a5ea9d442fe7da3) C:\Windows\system32\DRIVERS\igdkmd32.sys

22:01:27.0248 2724        igfx - ok

22:01:27.0391 2724        iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

22:01:27.0408 2724        iirsp - ok

22:01:27.0475 2724        IKEEXT          (35662fe4d8622f667aa5a5568f7f1b40) C:\Windows\System32\ikeext.dll

22:01:27.0616 2724        IKEEXT - ok

22:01:27.0667 2724        intelide        (988981c840084f480ba9e3319cebde1b) C:\Windows\system32\drivers\intelide.sys

22:01:27.0683 2724        intelide - ok

22:01:27.0710 2724        intelppm        (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys

22:01:27.0814 2724        intelppm - ok

22:01:27.0845 2724        IPBusEnum       (88cf5281ed9880d74dc9011cf8b5262d) C:\Windows\system32\ipbusenum.dll

22:01:27.0961 2724        IPBusEnum - ok

22:01:27.0986 2724        IpFilterDriver  (880c6f86cc3f551b8fea2c11141268c0) C:\Windows\system32\DRIVERS\ipfltdrv.sys

22:01:28.0088 2724        IpFilterDriver - ok

22:01:28.0135 2724        iphlpsvc        (ecc9ad72cfc4ab41cf6a9bcc11f9fef6) C:\Windows\System32\iphlpsvc.dll

22:01:28.0241 2724        iphlpsvc - ok

22:01:28.0250 2724        IpInIp - ok

22:01:28.0278 2724        IPMIDRV         (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys

22:01:28.0376 2724        IPMIDRV - ok

22:01:28.0401 2724        IPNAT           (10077c35845101548037df04fd1a420b) C:\Windows\system32\DRIVERS\ipnat.sys

22:01:28.0449 2724        IPNAT - ok

22:01:28.0551 2724        iPod Service    (d462588d99310a87f758a2af4a82d98f) C:\Program Files\iPod\bin\iPodService.exe

22:01:28.0593 2724        iPod Service - ok

22:01:28.0649 2724        IRENUM          (a82f328f4792304184642d6d397bb1e3) C:\Windows\system32\drivers\irenum.sys

22:01:28.0748 2724        IRENUM - ok

22:01:28.0793 2724        isapnp          (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys

22:01:28.0803 2724        isapnp - ok

22:01:28.0847 2724        iScsiPrt        (4dca456d4d5723f8fa9c6760d240b0df) C:\Windows\system32\DRIVERS\msiscsi.sys

22:01:28.0861 2724        iScsiPrt - ok

22:01:28.0882 2724        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

22:01:28.0892 2724        iteatapi - ok

22:01:28.0910 2724        iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

22:01:28.0919 2724        iteraid - ok

22:01:28.0961 2724        JGOGO           (c995c0e8b4503fac38793bb0236ad246) C:\Windows\system32\drivers\jgogo.sys

22:01:28.0994 2724        JGOGO - ok

22:01:29.0013 2724        JRAID           (6568289bc2e9ca3e8082817f0933685b) C:\Windows\system32\drivers\jraid.sys

22:01:29.0020 2724        JRAID ( UnsignedFile.Multi.Generic ) - warning

22:01:29.0021 2724        JRAID - detected UnsignedFile.Multi.Generic (1)

22:01:29.0045 2724        kbdclass        (b076b2ab806b3f696dab21375389101c) C:\Windows\system32\DRIVERS\kbdclass.sys

22:01:29.0059 2724        kbdclass - ok

22:01:29.0088 2724        kbdhid          (d2600cb17b7408b4a83f231dc9a11ac3) C:\Windows\system32\drivers\kbdhid.sys

22:01:29.0151 2724        kbdhid - ok

22:01:29.0180 2724        KeyIso          (c731b1fe449d4e9cea358c9d55b69be9) C:\Windows\system32\lsass.exe

22:01:29.0263 2724        KeyIso - ok

22:01:29.0312 2724        KSecDD          (0a829977b078dea11641fc2af87ceade) C:\Windows\system32\Drivers\ksecdd.sys

22:01:29.0407 2724        KSecDD - ok

22:01:29.0489 2724        KtmRm           (45c537fe5dde9a0146aeff76e615737d) C:\Windows\system32\msdtckrm.dll

22:01:29.0593 2724        KtmRm - ok

22:01:29.0646 2724        LanmanServer    (53d1482fc1aa36ac015a85e6cf2146bd) C:\Windows\system32\srvsvc.dll

22:01:29.0754 2724        LanmanServer - ok

22:01:29.0795 2724        LanmanWorkstation (435f0f6dc87a4b5da78f1fa309884189) C:\Windows\System32\wkssvc.dll

22:01:29.0877 2724        LanmanWorkstation - ok

22:01:29.0916 2724        lltdio          (fd015b4f95daa2b712f0e372a116fbad) C:\Windows\system32\DRIVERS\lltdio.sys

22:01:30.0001 2724        lltdio - ok

22:01:30.0057 2724        lltdsvc         (7450dbcf754391dd6363fffd5ef0e789) C:\Windows\System32\lltdsvc.dll

22:01:30.0139 2724        lltdsvc - ok

22:01:30.0164 2724        lmhosts         (35d40113e4a5b961b6ce5c5857702518) C:\Windows\System32\lmhsvc.dll

22:01:30.0233 2724        lmhosts - ok

22:01:30.0264 2724        LSI_FC          (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys

22:01:30.0274 2724        LSI_FC - ok

22:01:30.0295 2724        LSI_SAS         (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys

22:01:30.0307 2724        LSI_SAS - ok

22:01:30.0345 2724        LSI_SCSI        (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys

22:01:30.0356 2724        LSI_SCSI - ok

22:01:30.0381 2724        luafv           (42885bb44b6e065b8575a8dd6c430c52) C:\Windows\system32\drivers\luafv.sys

22:01:30.0448 2724        luafv - ok

22:01:30.0492 2724        MBAMProtector   (fb097bbc1a18f044bd17bd2fccf97865) C:\Windows\system32\drivers\mbam.sys

22:01:30.0509 2724        MBAMProtector - ok

22:01:30.0822 2724        MBAMService     (ba400ed640bca1eae5c727ae17c10207) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

22:01:30.0866 2724        MBAMService - ok

22:01:30.0912 2724        Mcx2Svc         (e93c1ad58e88a0846eaee10671c2a8f3) C:\Windows\system32\Mcx2Svc.dll

22:01:30.0954 2724        Mcx2Svc - ok

22:01:31.0000 2724        mdmxsdk         (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys

22:01:31.0042 2724        mdmxsdk - ok

22:01:31.0085 2724        megasas         (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys

22:01:31.0101 2724        megasas - ok

22:01:31.0166 2724        MMCSS           (9dfa3a459af0954aa85b4f7622ad87bb) C:\Windows\system32\mmcss.dll

22:01:31.0285 2724        MMCSS - ok

22:01:31.0320 2724        Modem           (21755967298a46fb6adfec9db6012211) C:\Windows\system32\drivers\modem.sys

22:01:31.0389 2724        Modem - ok

22:01:31.0428 2724        monitor         (7446e104a5fe5987ca9e4983fbac4f97) C:\Windows\system32\DRIVERS\monitor.sys

22:01:31.0488 2724        monitor - ok

22:01:31.0514 2724        mouclass        (5fba13c1a1841b0885d316ed3589489d) C:\Windows\system32\DRIVERS\mouclass.sys

22:01:31.0525 2724        mouclass - ok

22:01:31.0560 2724        mouhid          (b569b5c5d3bde545df3a6af512cccdba) C:\Windows\system32\DRIVERS\mouhid.sys

22:01:31.0589 2724        mouhid - ok

22:01:31.0615 2724        MountMgr        (01f1e5a3e4877c931cbb31613fec16a6) C:\Windows\system32\drivers\mountmgr.sys

22:01:31.0629 2724        MountMgr - ok

22:01:31.0660 2724        mpio            (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys

22:01:31.0674 2724        mpio - ok

22:01:31.0710 2724        mpsdrv          (6e7a7f0c1193ee5648443fe2d4b789ec) C:\Windows\system32\drivers\mpsdrv.sys

22:01:31.0782 2724        mpsdrv - ok

22:01:31.0842 2724        MpsSvc          (563ed845885c6a7c09a7715d8bd0585c) C:\Windows\system32\mpssvc.dll

22:01:31.0936 2724        MpsSvc - ok

22:01:31.0978 2724        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

22:01:31.0995 2724        Mraid35x - ok

22:01:32.0022 2724        MRxDAV          (1d8828b98ee309d65e006f0829e280e5) C:\Windows\system32\drivers\mrxdav.sys

22:01:32.0071 2724        MRxDAV - ok

22:01:32.0103 2724        mrxsmb          (8af705ce1bb907932157fab821170f27) C:\Windows\system32\DRIVERS\mrxsmb.sys

22:01:32.0170 2724        mrxsmb - ok

22:01:32.0199 2724        mrxsmb10        (47e13ab23371be3279eef22bbfa2c1be) C:\Windows\system32\DRIVERS\mrxsmb10.sys

22:01:32.0324 2724        mrxsmb10 - ok

22:01:32.0351 2724        mrxsmb20        (90b3fc7bd6b3d7ee7635debba2187f66) C:\Windows\system32\DRIVERS\mrxsmb20.sys

22:01:32.0394 2724        mrxsmb20 - ok

22:01:32.0426 2724        msahci          (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys

22:01:32.0443 2724        msahci - ok

22:01:32.0495 2724        msdsm           (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys

22:01:32.0513 2724        msdsm - ok

22:01:32.0584 2724        MSDTC           (bc64a92d821efea8bab8e8caf1b668bc) C:\Windows\System32\msdtc.exe

22:01:32.0621 2724        MSDTC - ok

22:01:32.0679 2724        Msfs            (729eafefd4e7417165f353a18dbe947d) C:\Windows\system32\drivers\Msfs.sys

22:01:32.0776 2724        Msfs - ok

22:01:32.0828 2724        msisadrv        (5f454a16a5146cd91a176d70f0cfa3ec) C:\Windows\system32\drivers\msisadrv.sys

22:01:32.0837 2724        msisadrv - ok

22:01:32.0871 2724        MSiSCSI         (8acf956d9154e893e789881430c12632) C:\Windows\system32\iscsiexe.dll

22:01:32.0948 2724        MSiSCSI - ok

22:01:32.0955 2724        msiserver - ok

22:01:32.0984 2724        MSKSSRV         (892cedefa7e0ffe7be8da651b651d047) C:\Windows\system32\drivers\MSKSSRV.sys

22:01:33.0031 2724        MSKSSRV - ok

22:01:33.0050 2724        MSPCLOCK        (ae2cb1da69b2676b4cee2a501af5871c) C:\Windows\system32\drivers\MSPCLOCK.sys

22:01:33.0125 2724        MSPCLOCK - ok

22:01:33.0154 2724        MSPQM           (f910da84fa90c44a3addb7cd874463fd) C:\Windows\system32\drivers\MSPQM.sys

22:01:33.0202 2724        MSPQM - ok

22:01:33.0228 2724        MsRPC           (84571c0ae07647ba38d493f5f0015df7) C:\Windows\system32\drivers\MsRPC.sys

22:01:33.0241 2724        MsRPC - ok

22:01:33.0260 2724        mssmbios        (4385c80ede885e25492d408cad91bd6f) C:\Windows\system32\DRIVERS\mssmbios.sys

22:01:33.0270 2724        mssmbios - ok

22:01:33.0289 2724        MSTEE           (c826dd1373f38afd9ca46ec3c436a14e) C:\Windows\system32\drivers\MSTEE.sys

22:01:33.0335 2724        MSTEE - ok

22:01:33.0342 2724        Mup             (fa7aa70050cf5e2d15de00941e5665e5) C:\Windows\system32\Drivers\mup.sys

22:01:33.0352 2724        Mup - ok

22:01:33.0393 2724        napagent        (1cdbb5d002fe2bc5300aa20550d8a52e) C:\Windows\system32\qagentRT.dll

22:01:33.0479 2724        napagent - ok

22:01:33.0527 2724        NativeWifiP     (6da4a0fc7c0e83df0cb3cfd0a514c3bc) C:\Windows\system32\DRIVERS\nwifi.sys

22:01:33.0565 2724        NativeWifiP - ok

22:01:33.0616 2724        NDIS            (227c11e1e7cf6ef8afb2a238d209760c) C:\Windows\system32\drivers\ndis.sys

22:01:33.0662 2724        NDIS - ok

22:01:33.0724 2724        NdisTapi        (81659cdcbd0f9a9e07e6878ad8c78d3f) C:\Windows\system32\DRIVERS\ndistapi.sys

22:01:33.0763 2724        NdisTapi - ok

22:01:33.0783 2724        Ndisuio         (5de5ee546bf40838ebe0e01cb629df64) C:\Windows\system32\DRIVERS\ndisuio.sys

22:01:33.0866 2724        Ndisuio - ok

22:01:33.0886 2724        NdisWan         (397402adcbb8946223a1950101f6cd94) C:\Windows\system32\DRIVERS\ndiswan.sys

22:01:33.0959 2724        NdisWan - ok

22:01:34.0004 2724        NDProxy         (1b24fa907af283199a81b3bb37e5e526) C:\Windows\system32\drivers\NDProxy.sys

22:01:34.0043 2724        NDProxy - ok

22:01:34.0070 2724        NetBIOS         (356dbb9f98e8dc1028dd3092fceeb877) C:\Windows\system32\DRIVERS\netbios.sys

22:01:34.0179 2724        NetBIOS - ok

22:01:34.0222 2724        netbt           (e3a168912e7eefc3bd3b814720d68b41) C:\Windows\system32\DRIVERS\netbt.sys

22:01:34.0329 2724        netbt - ok

22:01:34.0366 2724        Netlogon        (c731b1fe449d4e9cea358c9d55b69be9) C:\Windows\system32\lsass.exe

22:01:34.0395 2724        Netlogon - ok

22:01:34.0461 2724        Netman          (90a4dae28b94497f83bea0f2a3b77092) C:\Windows\System32\netman.dll

22:01:34.0583 2724        Netman - ok

22:01:34.0625 2724        netprofm        (7c5c3d9ceee838856b828ab6f98a2857) C:\Windows\System32\netprofm.dll

22:01:34.0724 2724        netprofm - ok

22:01:34.0800 2724        NetTcpPortSharing (0ad5876ef4e9eb77c8f93eb5b2fff386) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

22:01:34.0812 2724        NetTcpPortSharing - ok

22:01:34.0960 2724        NETw3v32        (acc6170d80c69e50145b370023b64ed3) C:\Windows\system32\DRIVERS\NETw3v32.sys

22:01:35.0203 2724        NETw3v32 - ok

22:01:35.0342 2724        nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

22:01:35.0358 2724        nfrd960 - ok

22:01:35.0414 2724        NlaSvc          (c424117a562f2de37a42266894c79aeb) C:\Windows\System32\nlasvc.dll

22:01:35.0525 2724        NlaSvc - ok

22:01:35.0682 2724        NMIndexingService (7b273501c59d52978b761f82bebadb06) C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

22:01:35.0721 2724        NMIndexingService - ok

22:01:35.0815 2724        Npfs            (4f9832beb9fafd8ceb0e541f1323b26e) C:\Windows\system32\drivers\Npfs.sys

22:01:35.0923 2724        Npfs - ok

22:01:35.0962 2724        nsi             (23b8201a363de0e649fc75ee9874dee2) C:\Windows\system32\nsisvc.dll

22:01:36.0046 2724        nsi - ok

22:01:36.0078 2724        nsiproxy        (b488dfec274de1fc9d653870ef2587be) C:\Windows\system32\drivers\nsiproxy.sys

22:01:36.0142 2724        nsiproxy - ok

22:01:36.0256 2724        Ntfs            (37430aa7a66d7a63407adc2c0d05e9f6) C:\Windows\system32\drivers\Ntfs.sys

22:01:36.0367 2724        Ntfs - ok

22:01:36.0406 2724        ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

22:01:36.0487 2724        ntrigdigi - ok

22:01:36.0494 2724        Null            (ec5efb3c60f1b624648344a328bce596) C:\Windows\system32\drivers\Null.sys

22:01:36.0573 2724        Null - ok

22:01:36.0631 2724        nvatabus        (7d960340be5b0e008bb94e4c3b991339) C:\Windows\system32\drivers\nvatabus.sys

22:01:36.0691 2724        nvatabus - ok

22:01:36.0729 2724        nvraid          (52f54c59a0ec7920c23638313e99e43c) C:\Windows\system32\drivers\nvraid.sys

22:01:36.0741 2724        nvraid - ok

22:01:36.0769 2724        nvstor          (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys

22:01:36.0781 2724        nvstor - ok

22:01:36.0810 2724        nv_agp          (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys

22:01:36.0825 2724        nv_agp - ok

22:01:36.0830 2724        NwlnkFlt - ok

22:01:36.0842 2724        NwlnkFwd - ok

22:01:36.0882 2724        ohci1394        (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\DRIVERS\ohci1394.sys

22:01:36.0948 2724        ohci1394 - ok

22:01:37.0060 2724        p2pimsvc        (016d01d3b8fb976a193c7434bed8dccf) C:\Windows\system32\p2psvc.dll

22:01:37.0144 2724        p2pimsvc - ok

22:01:37.0160 2724        p2psvc          (016d01d3b8fb976a193c7434bed8dccf) C:\Windows\system32\p2psvc.dll

22:01:37.0194 2724        p2psvc - ok

22:01:37.0245 2724        Parport         (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys

22:01:37.0325 2724        Parport - ok

22:01:37.0353 2724        partmgr         (555a5b2c8022983bc7467bc925b222ee) C:\Windows\system32\drivers\partmgr.sys

22:01:37.0367 2724        partmgr - ok

22:01:37.0390 2724        Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys

22:01:37.0500 2724        Parvdm - ok

22:01:37.0540 2724        PcaSvc          (d8c5c215c932233a4f1d7f368f4e4e65) C:\Windows\System32\pcasvc.dll

22:01:37.0582 2724        PcaSvc - ok

22:01:37.0673 2724        pccsmcfd        (fd2041e9ba03db7764b2248f02475079) C:\Windows\system32\DRIVERS\pccsmcfd.sys

22:01:37.0736 2724        pccsmcfd - ok

22:01:37.0755 2724        pci             (1085d75657807e0e8b32f9e19a1647c3) C:\Windows\system32\drivers\pci.sys

22:01:37.0774 2724        pci - ok

22:01:37.0837 2724        pciide          (3b1901e401473e03eb8c874271e50c26) C:\Windows\system32\drivers\pciide.sys

22:01:37.0847 2724        pciide - ok

22:01:37.0873 2724        pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys

22:01:37.0887 2724        pcmcia - ok

22:01:37.0963 2724        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

22:01:38.0135 2724        PEAUTH - ok

22:01:38.0275 2724        pla             (cd05a38d166beade18030bafc0c0a939) C:\Windows\system32\pla.dll

22:01:38.0525 2724        pla - ok

22:01:38.0578 2724        PlugPlay        (747bb4c31f3b6e8d1b5ed0ad61518cb5) C:\Windows\system32\umpnpmgr.dll

22:01:38.0641 2724        PlugPlay - ok

22:01:38.0737 2724        PNRPAutoReg     (016d01d3b8fb976a193c7434bed8dccf) C:\Windows\system32\p2psvc.dll

22:01:38.0778 2724        PNRPAutoReg - ok

22:01:38.0792 2724        PNRPsvc         (016d01d3b8fb976a193c7434bed8dccf) C:\Windows\system32\p2psvc.dll

22:01:38.0833 2724        PNRPsvc - ok

22:01:38.0914 2724        PolicyAgent     (5ebdec613bd377ce9a85382be5c6b83b) C:\Windows\System32\ipsecsvc.dll

22:01:39.0048 2724        PolicyAgent - ok

22:01:39.0150 2724        PptpMiniport    (c04dec5ace67c5247b150c4223970bb7) C:\Windows\system32\DRIVERS\raspptp.sys

22:01:39.0222 2724        PptpMiniport - ok

22:01:39.0299 2724        Processor       (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys

22:01:39.0376 2724        Processor - ok

22:01:39.0409 2724        ProfSvc         (213112e152e68f0e4705e36f052a2880) C:\Windows\system32\profsvc.dll

22:01:39.0488 2724        ProfSvc - ok

22:01:39.0520 2724        ProtectedStorage (c731b1fe449d4e9cea358c9d55b69be9) C:\Windows\system32\lsass.exe

22:01:39.0534 2724        ProtectedStorage - ok

22:01:39.0568 2724        PxHelp20        (1962166e0ceb740704f30fa55ad3d509) C:\Windows\system32\Drivers\PxHelp20.sys

22:01:39.0597 2724        PxHelp20 ( UnsignedFile.Multi.Generic ) - warning

22:01:39.0597 2724        PxHelp20 - detected UnsignedFile.Multi.Generic (1)

22:01:39.0649 2724        qkbfiltr        (3a9036152131478f2d6e1e8531df6825) C:\Windows\system32\DRIVERS\qkbfiltr.sys

22:01:39.0709 2724        qkbfiltr - ok

22:01:39.0811 2724        ql2300          (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys

22:01:39.0930 2724        ql2300 - ok

22:01:39.0968 2724        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

22:01:39.0987 2724        ql40xx - ok

22:01:40.0071 2724        QWAVE           (ca61bdfd3713a7ce75f2812afc431594) C:\Windows\system32\qwave.dll

22:01:40.0147 2724        QWAVE - ok

22:01:40.0184 2724        QWAVEdrv        (d2b3e2b7426dc23e185fbc73c8936c12) C:\Windows\system32\drivers\qwavedrv.sys

22:01:40.0232 2724        QWAVEdrv - ok

22:01:40.0261 2724        RasAcd          (bd7b30f55b3649506dd8b3d38f571d2a) C:\Windows\system32\DRIVERS\rasacd.sys

22:01:40.0361 2724        RasAcd - ok

22:01:40.0397 2724        RasAuto         (f14f4aab9f54d099fe99192bdb100ac9) C:\Windows\System32\rasauto.dll

22:01:40.0479 2724        RasAuto - ok

22:01:40.0505 2724        Rasl2tp         (68b0019fee429ec49d29017af937e482) C:\Windows\system32\DRIVERS\rasl2tp.sys

22:01:40.0518 2724        Rasl2tp - ok

22:01:40.0545 2724        RasMan          (11d65e29bc9d1e4114d18fe68194394c) C:\Windows\System32\rasmans.dll

22:01:40.0627 2724        RasMan - ok

22:01:40.0654 2724        RasPppoe        (ccf4e9c6cbbac81437f88cb2ae0b6c96) C:\Windows\system32\DRIVERS\raspppoe.sys

22:01:40.0713 2724        RasPppoe - ok

22:01:40.0741 2724        rdbss           (54129c5d9581bbec8bd1ebd3ba813f47) C:\Windows\system32\DRIVERS\rdbss.sys

22:01:40.0855 2724        rdbss - ok

22:01:40.0895 2724        RDPCDD          (794585276b5d7fca9f3fc15543f9f0b9) C:\Windows\system32\DRIVERS\RDPCDD.sys

22:01:40.0981 2724        RDPCDD - ok

22:01:41.0033 2724        rdpdr           (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys

22:01:41.0092 2724        rdpdr - ok

22:01:41.0097 2724        RDPENCDD        (980b56e2e273e19d3a9d72d5c420f008) C:\Windows\system32\drivers\rdpencdd.sys

22:01:41.0146 2724        RDPENCDD - ok

22:01:41.0184 2724        RDPWD           (8830e790a74a96605faba74f9665bb3c) C:\Windows\system32\drivers\RDPWD.sys

22:01:41.0233 2724        RDPWD - ok

22:01:41.0285 2724        RemoteAccess    (6c1a43c589ee8011a1ebfd51c01b77ce) C:\Windows\System32\mprdim.dll

22:01:41.0334 2724        RemoteAccess - ok

22:01:41.0364 2724        RemoteRegistry  (9a043808667c8c1893da7275af373f0e) C:\Windows\system32\regsvc.dll

22:01:41.0444 2724        RemoteRegistry - ok

22:01:41.0481 2724        RFCOMM          (7ec90c316177ba3f1bce92005264b447) C:\Windows\system32\DRIVERS\rfcomm.sys

22:01:41.0529 2724        RFCOMM - ok

22:01:41.0570 2724        rimmptsk        (d85e3fa9f5b1f29bb4ed185c450d1470) C:\Windows\system32\DRIVERS\rimmptsk.sys

22:01:41.0595 2724        rimmptsk - ok

22:01:41.0627 2724        rimsptsk        (db8eb01c58c9fada00c70b1775278ae0) C:\Windows\system32\DRIVERS\rimsptsk.sys

22:01:41.0690 2724        rimsptsk - ok

22:01:41.0720 2724        rismxdp         (6c1f93c0760c9f79a1869d07233df39d) C:\Windows\system32\DRIVERS\rixdptsk.sys

22:01:41.0740 2724        rismxdp - ok

22:01:41.0791 2724        ROOTMODEM       (d49d61312b273de069584d48c81c8b1d) C:\Windows\system32\Drivers\RootMdm.sys

22:01:41.0874 2724        ROOTMODEM - ok

22:01:41.0905 2724        RpcLocator      (5123f83cbc4349d065534eeb6bbdc42b) C:\Windows\system32\locator.exe

22:01:41.0923 2724        RpcLocator - ok

22:01:41.0988 2724        RpcSs           (7b981222a257d076885bffb66f19b7ce) C:\Windows\system32\rpcss.dll

22:01:42.0027 2724        RpcSs - ok

22:01:42.0063 2724        rspndr          (97e939d2128fec5d5a3e6e79b290a2f4) C:\Windows\system32\DRIVERS\rspndr.sys

22:01:42.0112 2724        rspndr - ok

22:01:42.0136 2724        SamSs           (c731b1fe449d4e9cea358c9d55b69be9) C:\Windows\system32\lsass.exe

22:01:42.0149 2724        SamSs - ok

22:01:42.0178 2724        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

22:01:42.0190 2724        sbp2port - ok

22:01:42.0360 2724        SBSDWSCService  (794d4b48dfb6e999537c7c3947863463) C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

22:01:42.0559 2724        SBSDWSCService - ok

22:01:42.0615 2724        SCardSvr        (565b4b9e5ad2f2f18a4f8aafa6c06bbb) C:\Windows\System32\SCardSvr.dll

22:01:42.0722 2724        SCardSvr - ok

22:01:42.0800 2724        Schedule        (886cec884b5be29ab9828b8ab46b11f7) C:\Windows\system32\schedsvc.dll

22:01:42.0869 2724        Schedule - ok

22:01:42.0937 2724        SCPolicySvc     (0600e04315fe543802a379d5d23c8be0) C:\Windows\System32\certprop.dll

22:01:42.0997 2724        SCPolicySvc - ok

22:01:43.0045 2724        sdbus           (7b3973cc28b8aa3e9e2e5d53e720e2c9) C:\Windows\system32\DRIVERS\sdbus.sys

22:01:43.0071 2724        sdbus - ok

22:01:43.0094 2724        SDRSVC          (f7b6bf02240d0a764adf8c8966735552) C:\Windows\System32\SDRSVC.dll

22:01:43.0155 2724        SDRSVC - ok

22:01:43.0192 2724        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

22:01:43.0239 2724        secdrv - ok

22:01:43.0251 2724        seclogon        (8388c4133ddbe62ad7bc3ec9f14271ed) C:\Windows\system32\seclogon.dll

22:01:43.0325 2724        seclogon - ok

22:01:43.0366 2724        SENS            (34350ae2c1d33d21c7305f861bd8dad8) C:\Windows\System32\sens.dll

22:01:43.0430 2724        SENS - ok

22:01:43.0451 2724        Serenum         (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys

22:01:43.0520 2724        Serenum - ok

22:01:43.0552 2724        Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys

22:01:43.0614 2724        Serial - ok

22:01:43.0651 2724        sermouse        (450accd77ec5cea720c1cdb9e26b953b) C:\Windows\system32\drivers\sermouse.sys

22:01:43.0691 2724        sermouse - ok

22:01:43.0832 2724        ServiceLayer    (5bf59c6bc737baaf541168e5cb2ec1d9) C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

22:01:43.0862 2724        ServiceLayer ( UnsignedFile.Multi.Generic ) - warning

22:01:43.0862 2724        ServiceLayer - detected UnsignedFile.Multi.Generic (1)

22:01:43.0931 2724        SessionEnv      (78878235da4df0d116e86837a0a21df8) C:\Windows\system32\sessenv.dll

22:01:43.0984 2724        SessionEnv - ok

22:01:44.0009 2724        sffdisk         (51cf56aa8bcc241f134b420b8f850406) C:\Windows\system32\DRIVERS\sffdisk.sys

22:01:44.0043 2724        sffdisk - ok

22:01:44.0081 2724        sffp_mmc        (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys

22:01:44.0169 2724        sffp_mmc - ok

22:01:44.0194 2724        sffp_sd         (8b08cab1267b2c377883fc9e56981f90) C:\Windows\system32\DRIVERS\sffp_sd.sys

22:01:44.0210 2724        sffp_sd - ok

22:01:44.0235 2724        sfloppy         (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys

22:01:44.0310 2724        sfloppy - ok

22:01:44.0375 2724        SharedAccess    (9a82bf4c90b00a63150a606a1e2fd82b) C:\Windows\System32\ipnathlp.dll

22:01:44.0441 2724        SharedAccess - ok

22:01:44.0503 2724        ShellHWDetection (b264dfa21677728613267fe63802b332) C:\Windows\System32\shsvcs.dll

22:01:44.0548 2724        ShellHWDetection - ok

22:01:44.0572 2724        sisagp          (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys

22:01:44.0589 2724        sisagp - ok

22:01:44.0616 2724        SiSRaid2        (b8a2f8dcdc75f19962d975727f393920) C:\Windows\system32\drivers\sisraid2.sys

22:01:44.0702 2724        SiSRaid2 - ok

22:01:44.0732 2724        SiSRaid4        (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys

22:01:44.0750 2724        SiSRaid4 - ok

22:01:45.0036 2724        slsvc           (a1dcd30534835cb67733ad00175125a6) C:\Windows\system32\SLsvc.exe

22:01:45.0343 2724        slsvc - ok

22:01:45.0463 2724        SLUINotify      (56da296e7b376a727e7bdc5ac7fbee02) C:\Windows\system32\SLUINotify.dll

22:01:45.0504 2724        SLUINotify - ok

22:01:45.0560 2724        Smb             (ac0d90738adb51a6fd12ff00874a2162) C:\Windows\system32\DRIVERS\smb.sys

22:01:45.0639 2724        Smb - ok

22:01:45.0668 2724        SNMPTRAP        (2a146a055b4401c16ee62d18b8e2a032) C:\Windows\System32\snmptrap.exe

22:01:45.0683 2724        SNMPTRAP - ok

22:01:45.0727 2724        spldr           (426f9b029aa9162ceccf65369457d046) C:\Windows\system32\drivers\spldr.sys

22:01:45.0736 2724        spldr - ok

22:01:45.0755 2724        Spooler         (da612ef2556776df2630b68bf2d48935) C:\Windows\System32\spoolsv.exe

22:01:45.0772 2724        Spooler - ok

22:01:45.0818 2724        srv             (038579c35f7cad4a4bbf735dbf83277d) C:\Windows\system32\DRIVERS\srv.sys

22:01:45.0997 2724        srv - ok

22:01:46.0083 2724        srv2            (6971a757af8cb5e2cbcbb76cc530db6c) C:\Windows\system32\DRIVERS\srv2.sys

22:01:46.0168 2724        srv2 - ok

22:01:46.0244 2724        srvnet          (9e1a4603b874eebce0298113951abefb) C:\Windows\system32\DRIVERS\srvnet.sys

22:01:46.0269 2724        srvnet - ok

22:01:46.0326 2724        SSDPSRV         (8d3e4baff8b3997138c38eb1b600519a) C:\Windows\System32\ssdpsrv.dll

22:01:46.0424 2724        SSDPSRV - ok

22:01:46.0460 2724        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys

22:01:46.0468 2724        ssmdrv - ok

22:01:46.0523 2724        stisvc          (a941e099ef46e3cc12f898cbe1c39910) C:\Windows\System32\wiaservc.dll

22:01:46.0605 2724        stisvc - ok

22:01:46.0646 2724        swenum          (1379bdb336f8158c176a465e30759f57) C:\Windows\system32\DRIVERS\swenum.sys

22:01:46.0659 2724        swenum - ok

22:01:46.0709 2724        swprv           (749ada8d6c18a08adfede69cbf5db2e0) C:\Windows\System32\swprv.dll

22:01:46.0812 2724        swprv - ok

22:01:46.0834 2724        Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

22:01:46.0850 2724        Symc8xx - ok

22:01:46.0871 2724        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

22:01:46.0881 2724        Sym_hi - ok

22:01:46.0893 2724        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

22:01:46.0903 2724        Sym_u3 - ok

22:01:46.0950 2724        SynTP           (2d2c815364a878c7e358d5f549711197) C:\Windows\system32\DRIVERS\SynTP.sys

22:01:46.0964 2724        SynTP - ok

22:01:47.0026 2724        SysMain         (8f2b5fede18bd3c4c926cbf88e6f1264) C:\Windows\system32\sysmain.dll

22:01:47.0169 2724        SysMain - ok

22:01:47.0186 2724        TabletInputService (2dca225eae15f42c0933e998ee0231c3) C:\Windows\System32\TabSvc.dll

22:01:47.0246 2724        TabletInputService - ok

22:01:47.0291 2724        TapiSrv         (ef3dd33c740fc2f82e7e4622f1c49289) C:\Windows\System32\tapisrv.dll

22:01:47.0351 2724        TapiSrv - ok

22:01:47.0402 2724        TBS             (68fa52794ae9acc61bde16fe0956b414) C:\Windows\System32\tbssvc.dll

22:01:47.0485 2724        TBS - ok

22:01:47.0588 2724        Tcpip           (4a82fa8f0df67aa354580c3faaf8bde3) C:\Windows\system32\drivers\tcpip.sys

22:01:47.0647 2724        Tcpip - ok

22:01:47.0660 2724        Tcpip6          (4a82fa8f0df67aa354580c3faaf8bde3) C:\Windows\system32\DRIVERS\tcpip.sys

22:01:47.0695 2724        Tcpip6 - ok

22:01:47.0746 2724        tcpipreg        (5ce0c4a7b12d0067dad527d72b68c726) C:\Windows\system32\drivers\tcpipreg.sys

22:01:47.0812 2724        tcpipreg - ok

22:01:47.0860 2724        TDPIPE          (964248aef49c31fa6a93201a73ffaf50) C:\Windows\system32\drivers\tdpipe.sys

22:01:47.0950 2724        TDPIPE - ok

22:01:47.0975 2724        TDTCP           (7d2c1ae1648a60fce4aa0f7982e419d3) C:\Windows\system32\drivers\tdtcp.sys

22:01:48.0058 2724        TDTCP - ok

22:01:48.0086 2724        tdx             (ab4fde8af4a0270a46a001c08cbce1c2) C:\Windows\system32\DRIVERS\tdx.sys

22:01:48.0135 2724        tdx - ok

22:01:48.0148 2724        TermDD          (2c549bd9dd091fbfaa0a2a48e82ec2fb) C:\Windows\system32\DRIVERS\termdd.sys

22:01:48.0159 2724        TermDD - ok

22:01:48.0195 2724        TermService     (fad71c1e8e4047b154e899ae31eb8caa) C:\Windows\System32\termsrv.dll

22:01:48.0267 2724        TermService - ok

22:01:48.0345 2724        TestHandler     (8c80a73a5d77b2208ca91e4fa269981d) C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe

22:01:48.0377 2724        TestHandler ( UnsignedFile.Multi.Generic ) - warning

22:01:48.0378 2724        TestHandler - detected UnsignedFile.Multi.Generic (1)

22:01:48.0438 2724        Themes          (b264dfa21677728613267fe63802b332) C:\Windows\system32\shsvcs.dll

22:01:48.0458 2724        Themes - ok

22:01:48.0489 2724        THREADORDER     (9dfa3a459af0954aa85b4f7622ad87bb) C:\Windows\system32\mmcss.dll

22:01:48.0552 2724        THREADORDER - ok

22:01:48.0570 2724        TrkWks          (6bba0582c0025d43729a1112d3b57897) C:\Windows\System32\trkwks.dll

22:01:48.0655 2724        TrkWks - ok

22:01:48.0731 2724        TrustedInstaller (34e388a395fedba1d0511ed39bbf4074) C:\Windows\servicing\TrustedInstaller.exe

22:01:48.0768 2724        TrustedInstaller - ok

22:01:48.0804 2724        tssecsrv        (29f0eca726f0d51f7e048bdb0b372f29) C:\Windows\system32\DRIVERS\tssecsrv.sys

22:01:48.0886 2724        tssecsrv - ok

22:01:48.0934 2724        tunmp           (65e953bc0084d44498b51f59784d2a82) C:\Windows\system32\DRIVERS\tunmp.sys

22:01:48.0952 2724        tunmp - ok

22:01:48.0959 2724        tunnel          (4a39bda5e0fd30bdf4884f9d33ae6105) C:\Windows\system32\DRIVERS\tunnel.sys

22:01:48.0977 2724        tunnel - ok

22:01:49.0019 2724        uagp35          (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys

22:01:49.0032 2724        uagp35 - ok

22:01:49.0071 2724        udfs            (6348da98707ceda8a0dfb05820e17732) C:\Windows\system32\DRIVERS\udfs.sys

22:01:49.0138 2724        udfs - ok

22:01:49.0191 2724        UI0Detect       (24a333f4f14dcfb6ff6d5a1b9e5d79dd) C:\Windows\system32\UI0Detect.exe

22:01:49.0213 2724        UI0Detect - ok

22:01:49.0235 2724        uliagpkx        (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys

22:01:49.0245 2724        uliagpkx - ok

22:01:49.0278 2724        uliahci         (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys

22:01:49.0294 2724        uliahci - ok

22:01:49.0311 2724        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

22:01:49.0326 2724        UlSata - ok

22:01:49.0357 2724        ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

22:01:49.0369 2724        ulsata2 - ok

22:01:49.0401 2724        umbus           (3fb78f1d1dd86d87bececd9dffa24dd9) C:\Windows\system32\DRIVERS\umbus.sys

22:01:49.0491 2724        umbus - ok

22:01:49.0531 2724        upnphost        (8eb871a3deb6b3d5a85eb6ddfc390b59) C:\Windows\System32\upnphost.dll

22:01:49.0620 2724        upnphost - ok

22:01:49.0634 2724        upperdev - ok

22:01:49.0685 2724        usbccgp         (8bd3ae150d97ba4e633c6c5c51b41ae1) C:\Windows\system32\drivers\usbccgp.sys

22:01:49.0812 2724        usbccgp - ok

22:01:49.0837 2724        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

22:01:49.0943 2724        usbcir - ok

22:01:50.0001 2724        usbehci         (11fa3acbf0de0286829c69e01fe705e4) C:\Windows\system32\DRIVERS\usbehci.sys

22:01:50.0013 2724        usbehci - ok

22:01:50.0040 2724        usbhub          (6a7858a38b5105731e219e7c6a238730) C:\Windows\system32\DRIVERS\usbhub.sys

22:01:50.0082 2724        usbhub - ok

22:01:50.0110 2724        usbohci         (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys

22:01:50.0183 2724        usbohci - ok

22:01:50.0214 2724        usbprint        (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys

22:01:50.0299 2724        usbprint - ok

22:01:50.0337 2724        USBSTOR         (7887ce56934e7f104e98c975f47353c5) C:\Windows\system32\DRIVERS\USBSTOR.SYS

22:01:50.0394 2724        USBSTOR - ok

22:01:50.0414 2724        usbuhci         (4013315fed70a2d293b998cbba4022ee) C:\Windows\system32\DRIVERS\usbuhci.sys

22:01:50.0462 2724        usbuhci - ok

22:01:50.0516 2724        UxSms           (f79d0d7c9004474cb42746d9b2c30a2b) C:\Windows\System32\uxsms.dll

22:01:50.0604 2724        UxSms - ok

22:01:50.0655 2724        vds             (c9d0bafee0d0a2681f048ca61bc0da96) C:\Windows\System32\vds.exe

22:01:50.0730 2724        vds - ok

22:01:50.0801 2724        vga             (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys

22:01:50.0944 2724        vga - ok

22:01:50.0990 2724        VgaSave         (17a8f877314e4067f8c8172cc6d9101c) C:\Windows\System32\drivers\vga.sys

22:01:51.0072 2724        VgaSave - ok

22:01:51.0100 2724        viaagp          (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys

22:01:51.0110 2724        viaagp - ok

22:01:51.0131 2724        ViaC7           (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys

22:01:51.0178 2724        ViaC7 - ok

22:01:51.0198 2724        viaide          (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys

22:01:51.0208 2724        viaide - ok

22:01:51.0249 2724        viamraid        (9f3f276c7300ed211129757a411b605f) C:\Windows\system32\drivers\viamraid.sys

22:01:51.0307 2724        viamraid - ok

22:01:51.0322 2724        volmgr          (103e84c95832d0ed93507997cc7b54e8) C:\Windows\system32\drivers\volmgr.sys

22:01:51.0332 2724        volmgr - ok

22:01:51.0363 2724        volmgrx         (294da8d3f965f6a8db934a83c7b461ff) C:\Windows\system32\drivers\volmgrx.sys

22:01:51.0388 2724        volmgrx - ok

22:01:51.0432 2724        volsnap         (80dc0c9bcb579ed9815001a4d37cbfd5) C:\Windows\system32\drivers\volsnap.sys

22:01:51.0448 2724        volsnap - ok

22:01:51.0471 2724        vsmraid         (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys

22:01:51.0488 2724        vsmraid - ok

22:01:51.0582 2724        VSS             (e0e29d9ef2524abd11749c7c2fd7f607) C:\Windows\system32\vssvc.exe

22:01:51.0695 2724        VSS - ok

22:01:51.0745 2724        W32Time         (62b0d0f6f5580d9d0dfa5e0b466ff2ed) C:\Windows\system32\w32time.dll

22:01:51.0869 2724        W32Time - ok

22:01:51.0920 2724        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

22:01:52.0029 2724        WacomPen - ok

22:01:52.0076 2724        Wanarp          (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys

22:01:52.0089 2724        Wanarp - ok

22:01:52.0093 2724        Wanarpv6        (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys

22:01:52.0105 2724        Wanarpv6 - ok

22:01:52.0132 2724        wcncsvc         (c1b19162e0509ceab4cdf664e139d956) C:\Windows\System32\wcncsvc.dll

22:01:52.0200 2724        wcncsvc - ok

22:01:52.0227 2724        WcsPlugInService (11bcb7afcdd7aadacb5746f544d3a9c7) C:\Windows\System32\WcsPlugInService.dll

22:01:52.0276 2724        WcsPlugInService - ok

22:01:52.0295 2724        Wd              (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys

22:01:52.0325 2724        Wd - ok

22:01:52.0404 2724        Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys

22:01:52.0495 2724        Wdf01000 - ok

22:01:52.0533 2724        WdiServiceHost  (2a424b89b14ef17a3d06bcb5a8f79601) C:\Windows\system32\wdi.dll

22:01:52.0563 2724        WdiServiceHost - ok

22:01:52.0569 2724        WdiSystemHost   (2a424b89b14ef17a3d06bcb5a8f79601) C:\Windows\system32\wdi.dll

22:01:52.0588 2724        WdiSystemHost - ok

22:01:52.0618 2724        WebClient       (01e41c264eedcb827820a1909162579f) C:\Windows\System32\webclnt.dll

22:01:52.0636 2724        WebClient - ok

22:01:52.0669 2724        Wecsvc          (9cf67ff7f8d34cbf115d0c278b9f74aa) C:\Windows\system32\wecsvc.dll

22:01:52.0739 2724        Wecsvc - ok

22:01:52.0774 2724        wercplsupport   (b68cab45db1dab59d92acadfad6364a8) C:\Windows\System32\wercplsupport.dll

22:01:52.0852 2724        wercplsupport - ok

22:01:52.0882 2724        WerSvc          (36ba0707680ef4236fd752bee982cc25) C:\Windows\System32\WerSvc.dll

22:01:52.0932 2724        WerSvc - ok

22:01:53.0005 2724        winachsf        (6d2350bb6e77e800fc4be4e5b7a2e89a) C:\Windows\system32\DRIVERS\HSX_CNXT.sys

22:01:53.0052 2724        winachsf - ok

22:01:53.0199 2724        WinDefend       (0d5ad0e71ff5ddac5dd2f443b499abd0) C:\Program Files\Windows Defender\mpsvc.dll

22:01:53.0241 2724        WinDefend - ok

22:01:53.0251 2724        WinHttpAutoProxySvc - ok

22:01:53.0330 2724        Winmgmt         (38a7b89de4e3417c122317949667fdd8) C:\Windows\system32\wbem\WMIsvc.dll

22:01:53.0439 2724        Winmgmt - ok

22:01:53.0514 2724        WinRM           (3f6823040030c3e4da1cf11cd40b7534) C:\Windows\system32\WsmSvc.dll

22:01:53.0691 2724        WinRM - ok

22:01:53.0775 2724        Wlansvc         (7640acea41348bfef34b76e245501261) C:\Windows\System32\wlansvc.dll

22:01:53.0908 2724        Wlansvc - ok

22:01:53.0978 2724        WmiAcpi         (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys

22:01:54.0062 2724        WmiAcpi - ok

22:01:54.0095 2724        wmiApSrv        (a279323bee5fffafda222910bce92132) C:\Windows\system32\wbem\WmiApSrv.exe

22:01:54.0140 2724        wmiApSrv - ok

22:01:54.0258 2724        WMPNetworkSvc   (acb2e63d50157e3ea7140f29d9e76a48) C:\Program Files\Windows Media Player\wmpnetwk.exe

22:01:54.0407 2724        WMPNetworkSvc - ok

22:01:54.0451 2724        WPCSvc          (3d3b3b80c12abe506f56930c46422c28) C:\Windows\System32\wpcsvc.dll

22:01:54.0487 2724        WPCSvc - ok

22:01:54.0530 2724        WPDBusEnum      (c24844a1d0d9528b19d5bc266b8cd572) C:\Windows\system32\wpdbusenum.dll

22:01:54.0610 2724        WPDBusEnum - ok

22:01:54.0665 2724        WpdUsb          (2d27171b16a577ef14c1273668753485) C:\Windows\system32\DRIVERS\wpdusb.sys

22:01:54.0769 2724        WpdUsb - ok

22:01:54.0811 2724        ws2ifsl         (84620aecdcfd2a7a14e6263927d8c0ed) C:\Windows\system32\drivers\ws2ifsl.sys

22:01:54.0919 2724        ws2ifsl - ok

22:01:54.0948 2724        wscsvc          (f97cbb919af6d0a6643d1a59c15014d1) C:\Windows\System32\wscsvc.dll

22:01:54.0979 2724        wscsvc - ok

22:01:54.0986 2724        WSearch - ok

22:01:55.0189 2724        wuauserv        (6298277b73c77fa99106b271a7525163) C:\Windows\system32\wuaueng.dll

22:01:55.0408 2724        wuauserv - ok

22:01:56.0078 2724        WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

22:01:56.0148 2724        WUDFRd - ok

22:01:56.0216 2724        wudfsvc         (b746bc5f820318c21f28a4981c437c5e) C:\Windows\System32\WUDFSvc.dll

22:01:56.0241 2724        wudfsvc - ok

22:01:56.0325 2724        XAudio          (5a7ff9a18ff6d7e0527fe3abf9204ef8) C:\Windows\system32\DRIVERS\xaudio.sys

22:01:56.0341 2724        XAudio - ok

22:01:56.0436 2724        XAudioService   (28dc5d626e036a75a572556f0a6eb1f6) C:\Windows\system32\DRIVERS\xaudio.exe

22:01:56.0484 2724        XAudioService - ok

22:01:56.0530 2724        MBR (0x1B8)     (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0

22:01:57.0023 2724        \Device\Harddisk0\DR0 - ok

22:01:57.0031 2724        MBR (0x1B8)     (e5fa06aca0d60ba9c870d0ef3d9898c9) \Device\Harddisk1\DR1

22:01:59.0927 2724        \Device\Harddisk1\DR1 - ok

22:01:59.0932 2724        Boot (0x1200)   (192157ad9df017d880d2f51a6ba0364b) \Device\Harddisk0\DR0\Partition0

22:01:59.0933 2724        \Device\Harddisk0\DR0\Partition0 - ok

22:01:59.0984 2724        Boot (0x1200)   (b71a2c423c58cf9481b211c4c63e2a29) \Device\Harddisk0\DR0\Partition1

22:01:59.0986 2724        \Device\Harddisk0\DR0\Partition1 - ok

22:01:59.0991 2724        Boot (0x1200)   (477c97c953891c6d0d59ad139db50e51) \Device\Harddisk1\DR1\Partition0

22:01:59.0992 2724        \Device\Harddisk1\DR1\Partition0 - ok

22:01:59.0994 2724        ============================================================

22:01:59.0994 2724        Scan finished

22:01:59.0994 2724        ============================================================

22:02:00.0008 4908        Detected object count: 5

22:02:00.0008 4908        Actual detected object count: 5

22:03:57.0354 4908        Apple Mobile Device ( UnsignedFile.Multi.Generic ) - skipped by user

22:03:57.0354 4908        Apple Mobile Device ( UnsignedFile.Multi.Generic ) - User select action: Skip 

22:03:57.0357 4908        JRAID ( UnsignedFile.Multi.Generic ) - skipped by user

22:03:57.0357 4908        JRAID ( UnsignedFile.Multi.Generic ) - User select action: Skip 

22:03:57.0361 4908        PxHelp20 ( UnsignedFile.Multi.Generic ) - skipped by user

22:03:57.0361 4908        PxHelp20 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

22:03:57.0365 4908        ServiceLayer ( UnsignedFile.Multi.Generic ) - skipped by user

22:03:57.0365 4908        ServiceLayer ( UnsignedFile.Multi.Generic ) - User select action: Skip 

22:03:57.0368 4908        TestHandler ( UnsignedFile.Multi.Generic ) - skipped by user

22:03:57.0368 4908        TestHandler ( UnsignedFile.Multi.Generic ) - User select action: Skip 

22:04:05.0296 4192        Deinitialize success

...

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Hallo,

ich hab Combofix runtergeladen, Virenscanner, Firewall und alle offenen Fenster geschlossen und Combofix gestartet.

Die Anzeige "versuche Wiederherstellungspunkt zu erstellen" kam, ebenfalls die Auflistung der diversen Stufen.

Aber dann wurde der Rechner ohne Rückfrage neu gestartet und seit dem kommen bei jedem Hochfahren im Millisekundentakt Combofix-Fenster hoch, immer geschätzt 5-10 Stück, die von links oben nach rechts unten aufblitzen. Beim ersten mal hab ich noch recht lange gewartet, ca. 1/2 Std. bevor mir das zu unheimlich wurde und ich den Rechner hab durchstarten lassen.

Leider kommen die Fenster immer wieder so lange bis ich es schaffe den Task abzuschiessen :killpc:.
Laut Taskmanager sind das - soweit ich das erkennen kann, geht ziemlich schnell - mindestens 3 verschiedene Programme, mind. 2 davon enden auf 3XE.
Ach ja, mein Windows-Firewall-Dienst ist jetzt weg und Logfile gibt's auch keins :(

Bislang hab ich Combofix nicht deinstalliert.

... bitte hilfe ?

Viele Grüße

Starte Windows neu, lösch die alte combofix.exe, lade CF neu runter und probier es bitte nochmal.

Ok, hab ich gemacht.

Ich hoffe, da ist jetzt nicht zu viel irrelevanter Kram dabei, aber ich schreib einach mal alles auf, was mir aufgefallen ist:

Ziemlich am Anfang und nochmal nach Stufe 38 kam im Combofix-Fenster die Meldung "Failed to get data for 'EnableLUA'". Combofix kam bis Stufe 50.

Dann kam die Meldung "Starte Windows neu. Bitte warten...".
Nach dem automatischen Reboot ging es wieder los mit den vielen Fenstern. Die Anwendungen zu denen diese Fenster gehörten waren zumindest:

ComboFix
C:\Combofix\pev.3XE
c:\ComboFix\CF19265.3XE

Nach einiger Zeit hab ich wieder den Task abgeschossen und einen Benutzerwechsel zum Administrator-Account versucht. Das hat auch funktioniert und nach der Anmeldung sagte Combofix dann endlich, dass das Logfile erstellt wird, siehe weiter unten.
Jetzt kann ich mich generell wieder ganz normal mit meinem Admin-Account anmelden :applaus:.

Was bisher noch seltsam oder anders als vorher ist:

Der Windows-Firewall Dienst ist noch weg und das wird nach der Anmedlung vom Sicherheitscenter moniert
MS Security Essentials ist auch weg
freePDF meldet nach der Anmeldung "Invalid Picture" (FreePDF ist mir aber nicht wichtig, wenn das nix Bekanntes ist kann ich den am Ende deinstallieren)
Mein WISO-Programm meldet nach der Anmeldung: "DAO-ODBC Message" - "D:\Users\******\Documents\Mein Steuer-Sparbuch Heute\msndb.mdb (3051): Unable to connect"
Beim Starten von Internet Explorer kam die Meldung "Internet Explorer Standardsuchanbieter" - "Ein Programm auf dem Computer hat die Einstellung für den Standardsuchanbieter für Internet Explorer beschädigt.
Diese Einstellung wurde von IE auf den ursprünglichen Suchanbieter zurückgesetzt, Live Search (search.live.com)
Es werden jetzt die Sucheinstellungen geöffnet, in denen Sie diese Einstellung ändern oder weiter Suchanbieter" installieren können."

Nach der Anmedlung meldet sich "Java Auto Updater" mit "Java-Update verfügbar" - aber da trau ich mich noch nicht zu bestätigen.

Logfile von Combofix:

Code:

ComboFix 12-06-03.02 - ****** 03.06.2012  21:07:03.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6000.0.1252.49.1031.18.1014.220 [GMT 2:00]

ausgeführt von:: d:\users\Test\Desktop\ComboFix.exe

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

---- Vorheriger Suchlauf -------

.

C:\Washer2.rar

d:\users\******\AppData\Roaming\srvblck2.tmp

d:\users\******\AppData\Roaming\TrusteerHelp

d:\users\******\AppData\Roaming\TrusteerHelp\spuninst.inf

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-05-03 bis 2012-06-03  ))))))))))))))))))))))))))))))

.

.

2012-06-03 19:16 . 2012-06-03 19:31        --------        d-----w-        d:\users\******\AppData\Local\temp

2012-06-03 19:16 . 2012-06-03 19:16        --------        d-----w-        d:\users\Default\AppData\Local\temp

2012-06-03 19:16 . 2012-06-03 19:16        --------        d-----w-        c:\windows\system32\config\systemprofile\AppData\Local\temp

2012-06-01 20:08 . 2012-06-01 20:08        --------        d-----w-        d:\users\Test\AppData\Roaming\Malwarebytes

2012-06-01 20:07 . 2012-05-08 16:40        6737808        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{55840B83-8E7E-4CDE-8DC9-CCE387008862}\mpengine.dll

2012-06-01 19:54 . 2012-06-01 19:54        --------        d-----w-        d:\users\Test\AppData\Roaming\PC Suite

2012-05-31 17:56 . 2012-05-31 17:56        --------        d-----w-        C:\msh

2012-05-29 21:01 . 2012-05-29 21:01        --------        d-----w-        c:\program files\ESET

2012-05-28 08:27 . 2012-05-08 16:40        6737808        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8B22AA2C-5B2B-40A6-BF55-CFB5D3B64153}\mpengine.dll

2012-05-28 08:23 . 2012-05-08 16:40        6737808        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll

2012-05-27 18:41 . 2012-05-27 18:41        --------        d-----w-        d:\users\******\AppData\Roaming\Malwarebytes

2012-05-27 18:41 . 2012-05-27 18:41        --------        d-----w-        c:\programdata\Malwarebytes

2012-05-27 18:41 . 2012-04-04 13:56        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-05-27 18:41 . 2012-05-27 18:41        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2012-05-27 17:19 . 2012-02-09 11:17        713784        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9012FB24-35DC-48D2-98E1-A998582FF975}\gapaengine.dll

2012-05-27 17:14 . 2012-05-08 16:40        6737808        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{954C594A-DC17-4590-8737-4D17510B0BA2}\mpengine.dll

2012-05-21 19:17 . 2012-05-21 19:17        --------        d-----w-        c:\program files\AVAST Software

2012-05-09 10:51 . 2012-05-08 16:40        6737808        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-05-08 11:30 . 2012-05-08 11:30        --------        d-----w-        C:\04001785caae1820ebce7865ce

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-03-20 18:44 . 2011-04-18 11:18        171064        ----a-w-        c:\windows\system32\drivers\MpFilter.sys

2012-03-11 18:34 . 2012-03-11 18:34        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-06 98304]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-06 106496]

"Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-06 81920]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-26 815104]

"Keyboard Manager Utility"="c:\program files\Keyboard Manager\Manager Utility\KeyboardManager.exe" [2007-01-11 1359872]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-02-26 153136]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-08-15 271672]

"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 5.0\apdproxy.exe" [2006-12-22 67752]

"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2007-06-26 312320]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

WISO Mein Steuer-Sparbuch heute.lnk - c:\program files\WISO\Steuersoftware 2012\mshaktuell.exe [2012-5-1 1380464]

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3794037573-2674974133-3482154547-1000]

"EnableNotificationsRef"=dword:00000004

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs        REG_MULTI_SZ           BthServ

.

Inhalt des "geplante Tasks" Ordners

.

2012-06-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-09 20:08]

.

2012-06-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-09 20:08]

.

2012-06-03 c:\windows\Tasks\User_Feed_Synchronization-{0941ED73-D275-454C-A0A6-94DA8B7E2A8D}.job

- c:\windows\system32\msfeedssync.exe [2010-04-06 04:54]

.

2012-06-02 c:\windows\Tasks\User_Feed_Synchronization-{43D47738-EC2A-4BC5-85D2-AC0F3B7ED4A3}.job

- c:\windows\system32\msfeedssync.exe [2010-04-06 04:54]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

TCP: DhcpNameServer = 192.168.178.1

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKCU-Run-NokiaOviSuite2 - c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe

.

.

.

**************************************************************************

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MpsSvc]

"ImagePath"="."

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="YMP.Media"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="YMP.Media"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="YMP.Media"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="YMP.Media"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="YMP.Media"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="YMP.Media"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="YMP.Media"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="YMP.Media"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="YMP.Media"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="YMP.Media"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="YMP.Media"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pls\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="YMP.Media"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="YMP.Media"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.spx\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="YMP.Media"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="YMP.Media"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="YMP.Media"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000001

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe

c:\windows\system32\DRIVERS\xaudio.exe

c:\program files\Spybot - Search & Destroy\SDWinSec.exe

c:\program files\iPod\bin\iPodService.exe

c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe

c:\program files\Windows Sidebar\sidebar.exe

c:\windows\system32\igfxext.exe

c:\windows\system32\igfxsrvc.exe

c:\windows\system32\conime.exe

c:\windows\system32\wbem\unsecapp.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\windows\system32\igfxext.exe

c:\windows\system32\igfxsrvc.exe

c:\windows\servicing\TrustedInstaller.exe

c:\windows\system32\consent.exe

c:\windows\system32\sdclt.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-06-03  21:41:16 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-06-03 19:40

.

Vor Suchlauf: 23 Verzeichnis(se), 39.946.235.904 Bytes frei

Nach Suchlauf: 26 Verzeichnis(se), 39.640.600.576 Bytes frei

.

- - End Of File - - CECC73C8A511338E6EA71E9834220344

Ich hätt da noch eine Frage:
Wäre es in Ordnung, wenn ich zwischendrin eine Datensicherung mache?
Wie jeder vernünftige User hab ich natürlich schon sehr lange keine Sicherung meiner Daten mehr gemacht :o.
Oder kommt das den Reparatur-Arbeiten eher in die Quere?

Viele Grüße