Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Unregelmäßige Selbstneustarts (https://www.trojaner-board.de/123146-unregelmaessige-selbstneustarts.html)

Donald92 31.08.2012 10:58
Unregelmäßige Selbstneustarts
 
Hallo,

ich habe seit einigen Tagen das Problem, dass sich mein Rechner quasi "mittendrin" einfach neustartet, einfriert oder ein Bluescreen kommt... mehr weiß ich dazu nicht! Avira Antivir hat nichts gefunden!
mbam-log-2012-08-31 (11-48-17).log:
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.31.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Donald :: DONALD-PC [Administrator]

31.08.2012 11:48:17
mbam-log-2012-08-31 (11-48-17).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 215990
Laufzeit: 4 Minute(n), 28 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 4
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00CBB66B-1D3B-46D3-9577-323A336ACB50} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00CBB66B-1D3B-46D3-9577-323A336ACB50} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{963B125B-8B21-49A2-A3A8-E37092276531} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{963B125B-8B21-49A2-A3A8-E37092276531} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\Program Files\BrowserCompanion (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 5
C:\Users\Donald\AppData\Roaming\advantage\AdVantage.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\BrowserCompanion\blabbers-ch.crx (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\BrowserCompanion\BCHelper.exe (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\BrowserCompanion\logo.ico (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\BrowserCompanion\sqlite3.dll (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)



OTL.txt:OTL Logfile:
Code:
OTL logfile created on: 31.08.2012 12:02:15 - Run 1
OTL by OldTimer - Version 3.2.59.1    Folder = C:\Users\Donald\Desktop
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,50 Gb Total Physical Memory | 2,47 Gb Available Physical Memory | 70,50% Memory free
7,00 Gb Paging File | 5,77 Gb Available in Paging File | 82,52% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 98,47 Gb Total Space | 51,66 Gb Free Space | 52,46% Space Free | Partition Type: NTFS
Drive D: | 146,48 Gb Total Space | 142,49 Gb Free Space | 97,27% Space Free | Partition Type: NTFS
Drive E: | 220,70 Gb Total Space | 207,53 Gb Free Space | 94,03% Space Free | Partition Type: NTFS
Drive H: | 232,88 Gb Total Space | 27,50 Gb Free Space | 11,81% Space Free | Partition Type: NTFS
 
Computer Name: DONALD-PC | User Name: Donald | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.31 12:00:28 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Donald\Desktop\OTL.exe
PRC - [2012.08.18 11:07:36 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.06.26 19:31:46 | 001,184,312 | ---- | M] (GlavSoft LLC.) -- C:\Programme\TightVNC\tvnserver.exe
PRC - [2012.05.09 17:58:10 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.09 17:58:09 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.09 17:58:09 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.03.23 14:25:24 | 000,087,040 | ---- | M] () -- C:\Programme\HTC\Internet Pass-Through\PassThruSvr.exe
PRC - [2012.03.01 01:59:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.02.29 22:58:46 | 000,857,408 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe
PRC - [2012.02.29 22:58:36 | 001,820,480 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvtray.exe
PRC - [2012.02.19 10:00:46 | 000,775,968 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe
PRC - [2012.02.15 00:55:29 | 000,034,728 | ---- | M] (Arainia Solutions) -- C:\Programme\Gizmo\gservice.exe
PRC - [2012.01.08 15:32:56 | 000,105,160 | ---- | M] () -- C:\Programme\Rainmeter\Rainmeter.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.12.14 09:25:08 | 000,112,920 | ---- | M] (Logitech, Inc.) -- C:\Programme\Logitech\ScrollApp\KhalScroll.exe
PRC - [2011.10.07 11:40:42 | 001,387,288 | ---- | M] (Logitech, Inc.) -- C:\Programme\Logitech\SetPointP\SetPoint.exe
PRC - [2011.09.27 21:05:24 | 000,149,784 | ---- | M] (Logitech, Inc.) -- C:\Programme\Common Files\Logishrd\KHAL3\KHALMNPR.exe
PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.12.20 19:10:14 | 000,352,256 | ---- | M] (Realtime Soft Ltd) -- C:\Programme\UltraMon\UltraMonTaskbar.exe
PRC - [2010.12.20 19:09:52 | 000,505,856 | ---- | M] (Realtime Soft Ltd) -- C:\Programme\UltraMon\UltraMon.exe
PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2007.05.31 09:21:28 | 000,648,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\WindowsMobile\wmdcBase.exe
PRC - [2007.02.02 18:26:44 | 000,283,136 | ---- | M] (AVM Berlin) -- C:\Programme\avmwlanstick\FRITZWLANMini.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.02.15 00:55:29 | 000,059,304 | ---- | M] () -- C:\Programme\Gizmo\gshell.dll
MOD - [2012.01.09 20:44:20 | 000,166,912 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2012.01.08 15:32:56 | 000,567,496 | ---- | M] () -- C:\Programme\Rainmeter\Rainmeter.dll
MOD - [2012.01.08 15:32:56 | 000,105,160 | ---- | M] () -- C:\Programme\Rainmeter\Rainmeter.exe
MOD - [2012.01.08 15:30:20 | 000,023,040 | ---- | M] () -- C:\Programme\Rainmeter\Plugins\RecycleManager.dll
MOD - [2012.01.08 15:30:18 | 000,143,360 | ---- | M] () -- C:\Programme\Rainmeter\Plugins\WebParser.dll
MOD - [2011.10.07 11:41:16 | 000,879,896 | ---- | M] () -- C:\Programme\Logitech\SetPointP\Macros\MacroCore.dll
MOD - [2011.03.17 00:11:16 | 004,297,568 | ---- | M] () -- C:\Programme\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
 
 
========== Services (SafeList) ==========
 
SRV - [2012.07.20 22:38:05 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.15 17:50:15 | 004,419,392 | ---- | M] () [Auto | Running] -- c:\program files\common files\akamai/netsession_win_4f7fccd.dll -- (Akamai)
SRV - [2012.06.26 19:31:46 | 001,184,312 | ---- | M] (GlavSoft LLC.) [Auto | Running] -- C:\Programme\TightVNC\tvnserver.exe -- (tvnserver)
SRV - [2012.05.09 17:58:10 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.09 17:58:09 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.03.23 14:25:24 | 000,087,040 | ---- | M] () [Auto | Running] -- C:\Programme\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
SRV - [2012.03.01 01:59:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.02.19 10:00:46 | 000,775,968 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2012.02.15 00:55:29 | 000,034,728 | ---- | M] (Arainia Solutions) [Auto | Running] -- C:\Programme\Gizmo\gservice.exe -- (Gizmo Central)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.09.27 21:03:28 | 000,295,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2011.06.12 11:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.02.19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010.01.09 22:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 22:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.05.31 09:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 09:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2003.04.18 20:06:26 | 000,008,192 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\srvany.exe -- (KMService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tsusbhub.sys -- (tsusbhub)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\synth3dvsc.sys -- (Synth3dVsc)
DRV - [2012.08.31 11:53:59 | 000,054,016 | ---- | M] () [Kernel | Boot | Unknown] -- C:\Windows\System32\drivers\jmgbgyuu.sys -- (dcdosp)
DRV - [2012.06.29 20:39:02 | 000,004,608 | ---- | M] (RealVNC Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vncmirror.sys -- (vncmirror)
DRV - [2012.05.09 17:58:10 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.09 17:58:10 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.03.01 01:59:00 | 010,819,392 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2012.02.15 00:55:29 | 000,025,488 | ---- | M] (Arainia Solutions LLC) [Kernel | System | Running] -- C:\Windows\System32\drivers\gizmodrv.sys -- (GizmoDrv)
DRV - [2011.12.15 16:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.09.02 08:31:28 | 000,039,192 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2011.09.02 08:31:28 | 000,030,360 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2011.09.02 08:31:20 | 000,041,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2011.04.12 21:29:40 | 000,006,144 | ---- | M] (Phoenix Technologies Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\SGDrv.sys -- (SGDrv)
DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 12:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.10.29 23:11:08 | 000,197,224 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV - [2010.06.23 11:24:56 | 000,023,040 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\htcnprot.sys -- (htcnprot)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.03.22 18:29:08 | 000,018,944 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2010.03.04 18:26:56 | 000,296,936 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmf6232.sys -- (NVNET)
DRV - [2009.10.26 23:54:24 | 000,025,088 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ANDROIDUSB.sys -- (HTCAND32)
DRV - [2009.08.21 22:24:03 | 000,066,592 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2009.07.14 02:18:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2009.07.14 02:14:49 | 000,020,480 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDScan.sys -- (WSDScan)
DRV - [2009.07.14 00:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2008.11.14 03:11:30 | 000,017,184 | ---- | M] (Realtime Soft Ltd) [Kernel | Auto | Running] -- C:\Programme\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys -- (UltraMonUtility)
DRV - [2007.01.26 02:00:00 | 000,265,088 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\fwlanusb.sys -- (FWLANUSB)
DRV - [2007.01.26 02:00:00 | 000,004,352 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avmeject.sys -- (avmeject)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?babsrc=HP_ss&affID=101365&mntrId=14e69262000000000000001f3f038f3d
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/web/{searchTerms}?babsrc=SP_ss&affID=101365&mntrId=14e69262000000000000001f3f038f3d
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={60081444-930C-4271-945D-8EE6CB31388F}&mid=a3e40530bea247d096c1d1445ee5ada6-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=en&ds=ins13&pr=sa&d=2012-04-17 17:10:48&v=10.2.0.3&sap=dsp&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>
 
========== FireFox ==========
 
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.3.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.3.1: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\Donald\AppData\Local\Facebook\Messenger\2.1.4590.0\npFbDesktopPlugin.dll (Facebook, Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{5D3F3872-91E9-4d59-AD9F-AA174A3145DD}: C:\Program Files\Logitech\ScrollApp\LogiSmoothFirefoxExt [2012.02.15 01:05:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.03.19 23:09:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.20 22:38:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.05.20 15:00:55 | 000,000,000 | ---D | M]
 
[2012.02.15 00:48:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\Extensions
[2012.08.28 20:51:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions
[2012.06.26 22:04:31 | 000,000,000 | ---D | M] (FEBE) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2012.03.30 10:04:23 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.02.15 00:51:40 | 000,000,000 | ---D | M] (20-20 3D Viewer - IKEA) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions\2020Player_IKEA@2020Technologies.com
[2012.03.10 14:24:28 | 000,000,000 | ---D | M] (Browser Companion Helper) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions\bbrs_002@blabbers.com
[2012.05.17 11:43:31 | 000,000,000 | ---D | M] ("FRITZ!Box AddOn") -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions\fb_add_on@avm.de
[2012.05.19 12:44:27 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions\ich@maltegoetz.de
[2012.03.10 14:24:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\k2asmm9i.default\extensions
[2012.02.15 00:50:32 | 000,000,000 | ---D | M] (FEBE) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\k2asmm9i.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2012.02.15 00:57:40 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\k2asmm9i.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.03.10 14:24:28 | 000,000,000 | ---D | M] (Browser Companion Helper) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\k2asmm9i.default\extensions\bbrs_002@blabbers.com
[2012.03.10 14:24:17 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.03.10 14:24:19 | 000,000,000 | ---D | M] (Babylon) -- C:\Programme\Mozilla Firefox\extensions\ffxtlbr@babylon.com
[2012.07.20 22:38:05 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.08 19:36:16 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.04.17 17:10:44 | 000,003,749 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012.03.10 14:24:17 | 000,002,288 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012.02.08 19:21:19 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.08 19:36:16 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.08 19:36:16 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.08 19:36:16 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.08 19:36:16 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com
CHR - Extension: YouTube = C:\Users\Donald\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\
CHR - Extension: Google-Suche = C:\Users\Donald\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\
CHR - Extension: Logitech Scroll App = C:\Users\Donald\AppData\Local\Google\Chrome\User Data\Default\Extensions\geooogfhpjdpeiphckpbgkhpbeobcaoi\3.0.31_0\
CHR - Extension: Google Mail = C:\Users\Donald\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Logitech Scroll App) - {E11DB59D-5008-42ff-9069-535843BC0BE1} - C:\Programme\Logitech\ScrollApp\LogiSmooth.dll (Logitech, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\FRITZWLANMini.exe (AVM Berlin)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Driver Genius]  File not found
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [LogiScrollApp] C:\Programme\Logitech\ScrollApp\KhalScroll.exe (Logitech, Inc.)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdcBase.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Programme\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Programme\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.1)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{67DE1C44-243D-45F7-A638-C662805A00EA}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{64d439ec-575b-11e1-8554-000d18014455}\Shell - "" = AutoRun
O33 - MountPoints2\{64d439ec-575b-11e1-8554-000d18014455}\Shell\AutoRun\command - "" = I:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.31 12:00:24 | 000,598,528 | ---- | C] (OldTimer Tools) -- C:\Users\Donald\Desktop\OTL.exe
[2012.08.31 11:47:27 | 000,000,000 | ---D | C] -- C:\Users\Donald\AppData\Roaming\Malwarebytes
[2012.08.31 11:47:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.31 11:47:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.31 11:47:18 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.08.31 11:47:18 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.08.22 17:01:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012.08.18 11:10:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.31 12:00:28 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Donald\Desktop\OTL.exe
[2012.08.31 11:59:19 | 000,000,000 | ---- | M] () -- C:\Users\Donald\defogger_reenable
[2012.08.31 11:58:18 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.31 11:58:18 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.31 11:53:59 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\jmgbgyuu.sys
[2012.08.31 11:53:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.31 11:47:19 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.31 11:45:59 | 000,816,466 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.08.31 11:45:59 | 000,688,858 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.08.31 11:45:59 | 000,185,070 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.08.31 11:45:59 | 000,154,194 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.08.31 11:41:36 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.31 11:41:21 | 2817,974,272 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.31 11:37:58 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.31 10:45:01 | 000,001,142 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1542967910-1392352476-3196196125-1000UA.job
[2012.08.31 10:45:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1542967910-1392352476-3196196125-1000Core.job
[2012.08.29 18:10:27 | 000,074,528 | ---- | M] () -- C:\Users\Donald\Desktop\IMAG0760.jpg
[2012.08.25 11:52:16 | 100,596,726 | ---- | M] () -- C:\Users\Donald\Desktop\Dennis und Tina.mp4
[2012.08.18 18:08:03 | 003,791,784 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2012.08.31 11:59:19 | 000,000,000 | ---- | C] () -- C:\Users\Donald\defogger_reenable
[2012.08.31 11:53:59 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\jmgbgyuu.sys
[2012.08.31 11:47:19 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.29 18:10:24 | 000,074,528 | ---- | C] () -- C:\Users\Donald\Desktop\IMAG0760.jpg
[2012.08.25 11:46:53 | 100,596,726 | ---- | C] () -- C:\Users\Donald\Desktop\Dennis und Tina.mp4
[2012.05.22 22:17:03 | 000,272,629 | ---- | C] () -- C:\Windows\System32\drivers\RTAIODAT.DAT
[2012.05.14 20:11:37 | 000,000,001 | R--- | C] () -- C:\Users\Donald\serverport
[2012.04.19 20:03:26 | 000,010,084 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2012.04.19 19:11:59 | 002,515,790 | ---- | C] () -- C:\Windows\System32\nvcoproc.bin
[2012.04.14 22:14:50 | 000,000,132 | ---- | C] () -- C:\Users\Donald\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012.04.12 18:14:52 | 000,000,017 | ---- | C] () -- C:\Users\Donald\AppData\Local\resmon.resmoncfg
[2012.03.19 23:20:21 | 000,175,616 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2012.03.19 22:54:52 | 000,057,344 | ---- | C] () -- C:\Windows\System32\MMTray2k.exe
[2012.03.19 14:18:49 | 000,008,192 | ---- | C] () -- C:\Windows\System32\srvany.exe
[2012.03.12 20:15:54 | 000,100,712 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2012.02.29 13:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe
[2012.02.27 21:47:53 | 000,410,942 | ---- | C] () -- C:\Windows\adb.exe
[2012.02.27 21:47:53 | 000,401,408 | ---- | C] () -- C:\Windows\wget.exe
[2012.02.27 21:47:53 | 000,356,009 | ---- | C] () -- C:\Windows\fastboot.exe
[2012.02.27 21:47:53 | 000,063,488 | ---- | C] () -- C:\Windows\md5sum.exe
[2012.02.21 14:55:13 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2012.02.21 14:54:04 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2012.02.15 00:30:58 | 000,097,360 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin
 
========== LOP Check ==========
 
[2012.08.31 11:53:59 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\advantage
[2012.08.31 11:37:46 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\AIMP3
[2012.04.19 14:51:23 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Audacity
[2012.03.10 14:24:15 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Babylon
[2012.03.24 21:33:13 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\DeepBurner
[2012.02.20 00:45:14 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\DVDVideoSoft
[2012.02.15 00:56:03 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Gizmo
[2012.06.04 23:11:49 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\HTC
[2012.06.04 23:13:36 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2012.06.05 16:46:54 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\ICQ
[2012.02.15 00:57:45 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\ICQ Search
[2012.04.17 17:00:18 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Iggels
[2012.02.15 01:12:57 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\JAM Software
[2012.02.15 01:04:28 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Leadertech
[2012.04.29 20:21:38 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\LolClient
[2012.06.05 17:25:16 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\LolClient2
[2012.04.19 17:28:29 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\MotionDSP
[2012.08.04 14:43:30 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Mp3tag
[2012.03.19 22:56:57 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\MPEG Streamclip
[2012.02.16 13:27:22 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\OpenOffice.org
[2012.02.15 01:00:21 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\PhotoFiltre
[2012.02.15 01:11:54 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Publish Providers
[2012.07.21 20:01:59 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Rainmeter
[2012.02.15 01:11:52 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Sony
[2012.03.19 22:20:21 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Sony Creative Software
[2012.06.28 16:30:46 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\TS3Client
[2012.08.31 10:45:00 | 000,001,120 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1542967910-1392352476-3196196125-1000Core.job
[2012.08.31 10:45:01 | 000,001,142 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1542967910-1392352476-3196196125-1000UA.job
[2012.08.02 13:53:41 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:890CC2F3

< End of report >
--- --- ---

Extras.txt:OTL Logfile:
Code:
OTL Extras logfile created on: 31.08.2012 12:02:15 - Run 1
OTL by OldTimer - Version 3.2.59.1    Folder = C:\Users\Donald\Desktop
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,50 Gb Total Physical Memory | 2,47 Gb Available Physical Memory | 70,50% Memory free
7,00 Gb Paging File | 5,77 Gb Available in Paging File | 82,52% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 98,47 Gb Total Space | 51,66 Gb Free Space | 52,46% Space Free | Partition Type: NTFS
Drive D: | 146,48 Gb Total Space | 142,49 Gb Free Space | 97,27% Space Free | Partition Type: NTFS
Drive E: | 220,70 Gb Total Space | 207,53 Gb Free Space | 94,03% Space Free | Partition Type: NTFS
Drive H: | 232,88 Gb Total Space | 27,50 Gb Free Space | 11,81% Space Free | Partition Type: NTFS
 
Computer Name: DONALD-PC | User Name: Donald | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05B4679E-160A-4CF9-8528-39CFFA737B45}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1A0AE7CE-19D5-49F5-92C2-5474769EB0E5}" = lport=445 | protocol=6 | dir=in | app=system |
"{1F906761-7FB9-4A0A-9D4D-987D97932E05}" = lport=10243 | protocol=6 | dir=in | app=system |
"{2F739048-FA79-463E-A3B4-E38CC696B370}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{372BE223-964B-459A-8FBA-1076F2F47C6F}" = lport=138 | protocol=17 | dir=in | app=system |
"{46A7B373-8B5D-4E53-928A-CF9F7437315B}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{59B873C4-7815-4729-9428-682A88A8858C}" = rport=138 | protocol=17 | dir=out | app=system |
"{5C0B8B30-BCCF-4B45-954B-AEDCA0D0D6CF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{63FA8AC7-2CFF-4382-9BB4-C1047905CB75}" = lport=137 | protocol=17 | dir=in | app=system |
"{679B0CD1-4D1F-49D4-8249-8836E788DCC4}" = rport=445 | protocol=6 | dir=out | app=system |
"{808E4FB6-718C-43A7-AC4D-384F8835560E}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{940A5955-2D3F-491E-A7F4-BF839D59F33E}" = lport=49187 | protocol=6 | dir=in | name=akamai netsession interface |
"{96FF0D97-0156-493F-B137-B8FD6C1255BD}" = rport=137 | protocol=17 | dir=out | app=system |
"{A60698E5-36EC-408E-9519-DB04940B2B72}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B2C9E517-0EEE-419C-B5CE-2B4A166F2C37}" = rport=10243 | protocol=6 | dir=out | app=system |
"{B4A014D7-C116-4F8E-995B-B8775574263C}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B6F5939C-FEDB-404E-BA3E-FC9C02953AF2}" = lport=2869 | protocol=6 | dir=in | app=system |
"{C633FF9D-B6D5-4D42-9582-E96542F2B2EC}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{DD254589-D57C-4924-9AB9-A002D1A7FF92}" = rport=139 | protocol=6 | dir=out | app=system |
"{E0FC532C-B7EA-499E-AE64-4B1E7105476F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{ED87F123-1C4E-409D-B776-584A44F12FE5}" = lport=139 | protocol=6 | dir=in | app=system |
"{F3B6327D-2329-44EF-977B-4498EFDEC9E2}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{F6BA0D23-D978-477B-949C-EA678DB9CD88}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FB77B627-E36B-4EFA-8FDC-A98092DF1C18}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe |
"{FCBCAE83-CEC5-4C17-9443-1E0952F14FE6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01FBD268-CC62-4EBE-8C3B-E0E4BC9938AF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{02B73728-8C1D-4571-82D7-9FC81AB1DF38}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{03D7934F-9EB1-4771-BD07-F8DA22AE47C6}" = protocol=17 | dir=in | app=e:\diablo iii\diablo iii.exe |
"{091376CB-C851-47FF-A690-53B51A409846}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{0DA849DD-6287-45E4-A902-C329E05786CD}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{0FA86B1A-0CD1-41CD-9E75-E0E6B80554E6}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{143C1AB7-6FD6-43B3-92D3-51ADA98DDCCF}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{1A66B0E3-3408-4CB7-8709-40B56D4B1FD5}" = protocol=17 | dir=in | app=c:\users\donald\appdata\local\akamai\netsession_win.exe |
"{253ABB93-7699-417B-AE6D-EF433ECA3FCE}" = protocol=6 | dir=in | app=e:\diablo iii\diablo iii.exe |
"{27BF481F-8B49-40B7-8043-C563416E5D84}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{2ADE1679-1F05-423E-B6E3-466D8C0A6E66}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{346B0FD6-FEEB-4E8B-92E7-CE2D6017BB33}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{365295A4-3336-43D2-8B9C-C417DA273872}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{390A5ED2-C0F5-450A-A313-3B85AB5726B1}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{3A90ADDE-5116-4F61-9DF2-B4FAAB70B3F9}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{3CA78A19-DA35-4B4D-B0C8-66F3AB6DCA75}" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"{3DAAB908-5ECB-4007-96A6-B1C5896F9EF5}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{44530DE9-8B70-4A93-A6E8-3AEAF0DFC0C7}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{46A9CD94-AC32-419B-A240-E20DB798BF15}" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"{47D412D3-33A8-46CA-A7D9-80E33F9F6CC3}" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"{4895D188-67B2-4DBA-B890-7E2D97A7CD6B}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{48CE8040-95B2-4765-B311-321FEDB7747B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{536A0C16-A2FF-41AC-A6EC-B415ECA1C6AA}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{5539893F-32A1-4D9A-AF5A-1031B3517A02}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{5A9BE58F-AE1D-48BA-83E5-EDF5B873DB6B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{5D0E45DC-2736-4B0F-9FBA-09A71A03648B}" = protocol=6 | dir=out | app=system |
"{5EB23132-7FB5-400A-B114-B19865C7CAA4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{5F51373B-6873-45DB-83D1-B612D9E74206}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{605B05C3-F7F7-4720-8763-5FAB73EBBB7D}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe |
"{62443F57-3543-4B5D-8BB4-A4D1E183606A}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{6CB9D98F-7AAD-46F5-AFE8-CA8AA0883C6D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{72A0B933-1026-4E5A-94DB-ABE949E48D8E}" = dir=in | app=c:\program files\tightvnc\tvnserver.exe |
"{7670B3CB-8BD2-444D-A67C-C9CD69D01CF9}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{786ABF54-75E0-471F-8F69-8CA77F0A0D10}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{80038D74-9C98-42CB-9F7D-AB749AAA66FF}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{804ECD7F-7BEF-4F6E-BF5E-CB92AFF9304D}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{80D2462D-A50C-4EE9-8771-2FF2391A4AE9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{88E40273-7361-4346-82C8-0131F11C354E}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{8FC382D7-BDF8-4101-B4AC-FF0B24B6AB93}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{90F17606-FEE4-4119-A278-B2B981DB8CF7}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{9D834F60-C8F0-41B4-A493-176F8AC568D9}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"{A776E01A-6B9F-428C-80E7-7D2AED6A2D90}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{B08E6FE8-333A-49BD-B743-8900570B7057}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{B32B3E12-503B-4FDC-B1DA-D70EC656D71E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{C3952E04-E1ED-4537-BCB8-3ED8C0A680EF}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"{C98859CB-E030-4BEE-9ACF-D639ADC75038}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe |
"{D1C0517C-ECD9-4FC3-888B-FA621FC188A0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E4C5E179-DB3F-4CCF-B80A-57CAFC954CBA}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{E8B32D1C-7007-424B-B37F-5547AD2A4E19}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{EBB95719-8E44-470B-B90D-8EC520BCF692}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{EC254287-A461-4D21-84D4-F6CAC3561822}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F0F50EB7-B68C-4944-9F0B-1F765DFD0583}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{F1126536-461D-4783-B713-1E4F717F3B0E}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{F307A223-1297-41BE-A1E4-6606E70B6AB2}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{F32286BA-C358-4838-8AB2-E455BC22EDE1}" = protocol=6 | dir=in | app=c:\users\donald\appdata\local\akamai\netsession_win.exe |
"{F5D670D1-23D0-420A-B17D-7E41DFD3E2B9}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{F689D0D7-9E56-4B07-99D2-FDBE296B8AE4}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{FB11A7DA-2119-4F73-95AD-0DC13666A013}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{FB566BAE-2A56-42B4-802D-FE33FA022E71}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{FCE9C210-CF7C-492D-BF3E-35987E4E10BB}" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"{FD6A300D-9057-47A2-853E-86ADC147DF45}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"TCP Query User{1C2F8AD0-DA94-4673-BB7E-1AF1600FAD5C}C:\program files\aimp3\aimp3.exe" = protocol=6 | dir=in | app=c:\program files\aimp3\aimp3.exe |
"TCP Query User{214C4F91-DB3E-4B6F-A6B7-02AA247F2691}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"TCP Query User{712B58FA-C376-4B0D-9249-186DE5E82445}E:\spiele\warcraft iii\warcraft 1.24.4\war3.exe" = protocol=6 | dir=in | app=e:\spiele\warcraft iii\warcraft 1.24.4\war3.exe |
"TCP Query User{9CD8C4A5-5E56-4B14-A420-3E978B148572}C:\users\donald\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\donald\appdata\local\akamai\netsession_win.exe |
"UDP Query User{3A74DCF3-F118-4E83-A2E1-18C4C188E058}C:\program files\aimp3\aimp3.exe" = protocol=17 | dir=in | app=c:\program files\aimp3\aimp3.exe |
"UDP Query User{9B74B858-66C8-4F1D-8932-A64233B71C7A}E:\spiele\warcraft iii\warcraft 1.24.4\war3.exe" = protocol=17 | dir=in | app=e:\spiele\warcraft iii\warcraft 1.24.4\war3.exe |
"UDP Query User{D25D318D-DE63-4322-B201-41EECD80410E}C:\users\donald\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\donald\appdata\local\akamai\netsession_win.exe |
"UDP Query User{DB80A96F-4B28-46A5-B0F5-A4FF465C016E}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{1111706F-666A-4037-7777-203328764D10}" = JavaFX 2.0.3
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{12EE0B2A-84C6-494E-A7AC-6771E898F6A0}_is1" = HD2 Toolkit Version 4.2
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1ACD399C-7F26-43A6-9F16-3AB28F63FDC7}" = TightVNC
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21AE04E8-EBF6-40DB-9AA9-B7A80C5D057D}" = mkv2vob
"{2222706F-666A-4037-7777-203328764D10}" = JavaFX 2.0.3 SDK
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29
"{26A24AE4-039D-4CA4-87B4-2F83217003FF}" = Java(TM) 7 Update 3
"{2ADE2157-7A5E-122C-B51D-EB8A01B15943}" = DeepBurner v1.9.0.228
"{31A559C1-9E4D-423B-9DD3-34A6C5398752}" = HTC BMP USB Driver
"{32A3A4F4-B792-11D6-A78A-00B0D0170030}" = Java(TM) SE Development Kit 7 Update 3
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{42103338-9038-4D1B-9A5E-48C94F8EFF84}" = CWM-Toolkit [26.06.2011]
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4F8477EA-40EE-4ABD-B3DC-F95E1AF8DE31}" = Spek
"{537056B7-32A4-4408-9B54-0341963C7C9C}" = UltraMon
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6AD9F5F3-5BD0-4000-BD9C-B536CF86D988}" = iTunes
"{6D6664A9-3342-4948-9B7E-034EFE366F0F}" = HTC Driver Installer
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}" = ICQ7.7
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7BB5E925-A3DD-48C2-9A82-017AF5982FFE}" = Facebook Messenger 2.1.4590.0
"{8F1ADE4D-EFAC-4F5A-B346-23C2687FAF50}" = Apple Mobile Device Support
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUS_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUS_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A1439D4F-FD46-47F2-A1D3-FEE097C29A09}" = WIDCOMM Bluetooth Software
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB77DFDE-9949-4AEF-B180-BE322C3E65D0}" = HTC Sync
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.7.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.2.24.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{BE78C655-F936-4ACE-B9B0-12F4287CBD1F}_is1" = MSI PLC Utility
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{D9D1A2FD-56B2-4F21-B959-745FE43CAB8C}" = Vegas Pro 9.0
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E7044E25-3038-4A76-9064-344AC038043E}" = Windows Mobile-Gerätecenter: Treiberupdate
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AIMP3" = AIMP3
"Akamai" = Akamai NetSession Interface Service
"Android SDK Tools" = Android SDK Tools
"Audacity_is1" = Audacity 2.0
"Avira AntiVir Desktop" = Avira Free Antivirus
"CCleaner" = CCleaner
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Diablo III" = Diablo III
"DivX Setup" = DivX-Setup
"Driver Genius Professional Edition_is1" = Driver Genius Professional Edition
"EPSON BX320FW Series" = Druckerdeinstallation für EPSON BX320FW Series
"Gizmo Central" = Gizmo Central
"LAME_is1" = LAME v3.99.3 (for Windows)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Mp3tag" = Mp3tag v2.49b
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"Rainmeter" = Rainmeter
"Sn1" = Logitech Scroll App 3.0
"sp6" = Logitech SetPoint 6.32
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TreeSize Professional_is1" = TreeSize Professional V5.4.4
"VLC media player" = VLC media player 2.0.2
"vReveal" = vReveal
"WinRAR archiver" = WinRAR 4.10 (32-Bit)
"Zero Assumption Recovery_is1" = Zero Assumption Recovery Version 9
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"bb91a114638258b8" = Google Contact Sync
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 28.08.2012 11:53:52 | Computer Name = Donald-PC | Source = Windows Search Service | ID = 1019
Description =
 
Error - 29.08.2012 10:22:35 | Computer Name = Donald-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
 werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
 ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
 DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
 und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
 
Error - 29.08.2012 10:22:35 | Computer Name = Donald-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
 werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
 ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
 DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
 und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
 
Error - 29.08.2012 10:22:35 | Computer Name = Donald-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
 für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
 
Error - 29.08.2012 11:06:31 | Computer Name = Donald-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
 werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
 ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
 DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
 und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
 
Error - 29.08.2012 11:06:31 | Computer Name = Donald-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
 werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
 ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
 DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
 und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
 
Error - 29.08.2012 11:06:31 | Computer Name = Donald-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
 für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
 
Error - 29.08.2012 12:09:03 | Computer Name = Donald-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
 werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
 ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
 DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
 und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
 
Error - 29.08.2012 12:09:03 | Computer Name = Donald-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
 werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
 ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
 DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
 und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
 
Error - 29.08.2012 12:09:03 | Computer Name = Donald-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
 für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
 
[ System Events ]
Error - 27.07.2012 06:03:15 | Computer Name = Donald-PC | Source = DCOM | ID = 10016
Description =
 
Error - 27.07.2012 13:03:21 | Computer Name = Donald-PC | Source = DCOM | ID = 10016
Description =
 
Error - 29.07.2012 05:57:57 | Computer Name = Donald-PC | Source = DCOM | ID = 10010
Description =
 
Error - 29.07.2012 05:58:08 | Computer Name = Donald-PC | Source = DCOM | ID = 10016
Description =
 
Error - 29.07.2012 12:55:32 | Computer Name = Donald-PC | Source = DCOM | ID = 10016
Description =
 
Error - 29.07.2012 13:25:01 | Computer Name = Donald-PC | Source = DCOM | ID = 10016
Description =
 
Error - 29.07.2012 14:35:46 | Computer Name = Donald-PC | Source = DCOM | ID = 10016
Description =
 
Error - 30.07.2012 13:47:04 | Computer Name = Donald-PC | Source = DCOM | ID = 10016
Description =
 
Error - 31.07.2012 13:02:02 | Computer Name = Donald-PC | Source = DCOM | ID = 10016
Description =
 
Error - 01.08.2012 10:51:49 | Computer Name = Donald-PC | Source = DCOM | ID = 10016
Description =
 
 
< End of report >
--- --- ---

Gmer.log:

GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-08-31 12:30:37
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-3 Hitachi_HDP725050GLA360 rev.GM4OA5CA
Running: nu14vsoe.exe; Driver: C:\Users\Donald\AppData\Local\Temp\pwdirpow.sys


---- System - GMER 1.0.15 ----

SSDT            92C53BB6                                                                                          ZwCreateSection
SSDT            92C53BC0                                                                                          ZwRequestWaitReplyPort
SSDT            92C53BBB                                                                                          ZwSetContextThread
SSDT            92C53BC5                                                                                          ZwSetSecurityObject
SSDT            92C53BCA                                                                                          ZwSystemDebugControl
SSDT            92C53B57                                                                                          ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwRollbackEnlistment + 140D                                                          832893C9 1 Byte  [06]
.text          ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                            832C2D52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text          ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                              832C9EAC 4 Bytes  [B6, 3B, C5, 92]
.text          ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                              832CA208 4 Bytes  [C0, 3B, C5, 92] {SAR BYTE [EBX], 0xc5; XCHG EDX, EAX}
.text          ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                              832CA24C 4 Bytes  [BB, 3B, C5, 92]
.text          ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                              832CA2C8 4 Bytes  [C5, 3B, C5, 92]
.text          ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                              832CA31C 4 Bytes  [CA, 3B, C5, 92] {RETF 0xc53b; XCHG EDX, EAX}
.text          ...                                                                                             

---- User code sections - GMER 1.0.15 ----

.text          C:\Program Files\Mozilla Firefox\firefox.exe[3944] ntdll.dll!LdrGetProcedureAddress + 26          77D82239 7 Bytes  JMP 5BF1B52A C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text          C:\Program Files\Mozilla Firefox\firefox.exe[3944] kernel32.dll!K32GetDeviceDriverBaseNameW + 5D  768993D6 7 Bytes  JMP 5C1CB6D2 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text          C:\Program Files\Mozilla Firefox\firefox.exe[3944] kernel32.dll!QueryPerformanceCounter + 13      7689C435 7 Bytes  JMP 5C1CB6F5 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text          C:\Program Files\Mozilla Firefox\firefox.exe[3944] GDI32.dll!GetViewportOrgEx + 26C              76CD884B 7 Bytes  JMP 5C1CB653 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

Device          \Driver\BTHUSB \Device\00000084                                                                  bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)
Device          \Driver\BTHUSB \Device\00000086                                                                  bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)
Device          \Driver\ACPI_HAL \Device\0000004d                                                                halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000d18014455                     
Reg            HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000d18014455@d8b3778ad69b          0xCE 0xDA 0x42 0x9C ...
Reg            HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000d18014455 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000d18014455@d8b3778ad69b              0xCE 0xDA 0x42 0x9C ...

---- EOF - GMER 1.0.15 ----
--- --- ---


Hoffentlich bekommen wir das ohne Neuinstallation hin! :wtf:

Lieben Gruß
Donald

cosinus 01.09.2012 13:05
Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

Donald92 02.09.2012 17:04
Vollständiger Scan von MBAM:

Code:
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.09.02.02

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Donald :: DONALD-PC [Administrator]

02.09.2012 12:54:28
mbam-log-2012-09-02 (12-54-28).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 351976
Laufzeit: 1 Stunde(n), 1 Minute(n), 42 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Scan von ESET

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=fbe9d26a22e7384a995048ca9c4bd5ab
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-02 03:58:36
# local_time=2012-09-02 05:58:36 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 17290320 17290320 0 0
# compatibility_mode=5893 16776573 100 94 185159 98218430 0 0
# compatibility_mode=8192 67108863 100 0 198 198 0 0
# scanned=190147
# found=0
# cleaned=0
# scan_time=14277

cosinus 03.09.2012 19:23
adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Suche.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Donald92 04.09.2012 15:52
Code:
# AdwCleaner v2.000 - Datei am 09/04/2012 um 16:52:02 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (32 bits)
# Benutzer : Donald - DONALD-PC
# Normaler Modus : Normal
# Ausgeführt unter : D:\Firefox Downloads\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gefunden : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml
Datei Gefunden : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
Datei Gefunden : C:\user.js
Ordner Gefunden : C:\ProgramData\Babylon
Ordner Gefunden : C:\Users\Donald\AppData\Local\Babylon
Ordner Gefunden : C:\Users\Donald\AppData\LocalLow\boost_interprocess
Ordner Gefunden : C:\Users\Donald\AppData\Roaming\advantage
Ordner Gefunden : C:\Users\Donald\AppData\Roaming\Babylon
Ordner Gefunden : C:\Users\Donald\AppData\Roaming\Mozilla\Firefox\Profiles\febeprof.Donald\extensions\bbrs_002@blabbers.com
Ordner Gefunden : C:\Users\Donald\AppData\Roaming\Mozilla\Firefox\Profiles\k2asmm9i.default\extensions\bbrs_002@blabbers.com

***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\IGearSettings
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gefunden : HKLM\Software\Babylon
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\ibgfbdggapddbjjbopabhlhianklajie
Schlüssel Gefunden : HKU\S-1-5-21-1542967910-1392352476-3196196125-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : HKU\S-1-5-21-1542967910-1392352476-3196196125-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gefunden : HKU\S-1-5-21-1542967910-1392352476-3196196125-1005\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : HKU\S-1-5-21-1542967910-1392352476-3196196125-1005\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.babylon.com/?babsrc=HP_ss&affID=101365&mntrId=14e69262000000000000001f3f038f3d

-\\ Mozilla Firefox v14.0.1 (de)

Profilname : default
Datei : C:\Users\Donald\AppData\Roaming\Mozilla\Firefox\Profiles\k2asmm9i.default\prefs.js

[OK] Die Datei ist sauber.

Profilname : Donald [Profil par défaut]
Datei : C:\Users\Donald\AppData\Roaming\Mozilla\Firefox\Profiles\febeprof.Donald\prefs.js

Gefunden : user_pref("browser.search.defaultengine", "Ask.com");
Gefunden : user_pref("browser.search.order.1", "Ask.com");
Gefunden : user_pref("extensions.BabylonToolbar.admin", false);
Gefunden : user_pref("extensions.BabylonToolbar.aflt", "orgnl");
Gefunden : user_pref("extensions.BabylonToolbar.bbDpng", 10);
Gefunden : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Gefunden : user_pref("extensions.BabylonToolbar.dfltSrch", true);
Gefunden : user_pref("extensions.BabylonToolbar.hmpg", true);
Gefunden : user_pref("extensions.BabylonToolbar.lastDP", 10);
Gefunden : user_pref("extensions.BabylonToolbar.lastVrsnTs", "");
Gefunden : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "10.0");
Gefunden : user_pref("extensions.BabylonToolbar.newTab", true);
Gefunden : user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_ss&affID=1013[...]
Gefunden : user_pref("extensions.BabylonToolbar.noFFXTlbr", false);
Gefunden : user_pref("extensions.BabylonToolbar.propectorlck", 69964469);
Gefunden : user_pref("extensions.BabylonToolbar.prtkHmpg", 1);
Gefunden : user_pref("extensions.BabylonToolbar.smplGrp", "free");
Gefunden : user_pref("keyword.URL", "hxxp://isearch.avg.com/search?cid=%7Bb3594a20-7b3f-4cec-bd21-efe0f9485d5d%[...]

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\Donald\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [4967 octets] - [04/09/2012 16:52:02]

########## EOF - C:\AdwCleaner[R1].txt - [5027 octets] ##########

cosinus 04.09.2012 18:44
adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Löschen.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Donald92 04.09.2012 19:15
Code:
# AdwCleaner v2.000 - Datei am 09/04/2012 um 20:11:27 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (32 bits)
# Benutzer : Donald - DONALD-PC
# Normaler Modus : Normal
# Ausgeführt unter : D:\Firefox Downloads\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml
Datei Gelöscht : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
Datei Gelöscht : C:\user.js
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\Users\Donald\AppData\Local\Babylon
Ordner Gelöscht : C:\Users\Donald\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Users\Donald\AppData\Roaming\advantage
Ordner Gelöscht : C:\Users\Donald\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Donald\AppData\Roaming\Mozilla\Firefox\Profiles\febeprof.Donald\extensions\bbrs_002@blabbers.com
Ordner Gelöscht : C:\Users\Donald\AppData\Roaming\Mozilla\Firefox\Profiles\k2asmm9i.default\extensions\bbrs_002@blabbers.com

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\IGearSettings
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ibgfbdggapddbjjbopabhlhianklajie
Schlüssel Gelöscht : HKU\S-1-5-21-1542967910-1392352476-3196196125-1005\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKU\S-1-5-21-1542967910-1392352476-3196196125-1005\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-21-1542967910-1392352476-3196196125-1005\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.babylon.com/?babsrc=HP_ss&affID=101365&mntrId=14e69262000000000000001f3f038f3d --> hxxp://www.google.com

-\\ Mozilla Firefox v14.0.1 (de)

Profilname : default
Datei : C:\Users\Donald\AppData\Roaming\Mozilla\Firefox\Profiles\k2asmm9i.default\prefs.js

C:\Users\Donald\AppData\Roaming\Mozilla\Firefox\Profiles\k2asmm9i.default\user.js ... Gelöscht !

[OK] Die Datei ist sauber.

Profilname : Donald [Profil par défaut]
Datei : C:\Users\Donald\AppData\Roaming\Mozilla\Firefox\Profiles\febeprof.Donald\prefs.js

C:\Users\Donald\AppData\Roaming\Mozilla\Firefox\Profiles\febeprof.Donald\user.js ... Gelöscht !

Gelöscht : user_pref("browser.search.defaultengine", "Ask.com");
Gelöscht : user_pref("browser.search.order.1", "Ask.com");
Gelöscht : user_pref("extensions.BabylonToolbar.admin", false);
Gelöscht : user_pref("extensions.BabylonToolbar.aflt", "orgnl");
Gelöscht : user_pref("extensions.BabylonToolbar.bbDpng", 10);
Gelöscht : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Gelöscht : user_pref("extensions.BabylonToolbar.dfltSrch", true);
Gelöscht : user_pref("extensions.BabylonToolbar.hmpg", true);
Gelöscht : user_pref("extensions.BabylonToolbar.lastDP", 10);
Gelöscht : user_pref("extensions.BabylonToolbar.lastVrsnTs", "");
Gelöscht : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "10.0");
Gelöscht : user_pref("extensions.BabylonToolbar.newTab", true);
Gelöscht : user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_ss&affID=1013[...]
Gelöscht : user_pref("extensions.BabylonToolbar.noFFXTlbr", false);
Gelöscht : user_pref("extensions.BabylonToolbar.propectorlck", 69964469);
Gelöscht : user_pref("extensions.BabylonToolbar.prtkHmpg", 1);
Gelöscht : user_pref("extensions.BabylonToolbar.smplGrp", "free");
Gelöscht : user_pref("keyword.URL", "hxxp://isearch.avg.com/search?cid=%7Bb3594a20-7b3f-4cec-bd21-efe0f9485d5d%[...]

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\Donald\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [5096 octets] - [04/09/2012 16:52:02]
AdwCleaner[S1].txt - [5475 octets] - [04/09/2012 20:11:27]

########## EOF - C:\AdwCleaner[S1].txt - [5535 octets] ##########

cosinus 04.09.2012 19:54
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Donald92 05.09.2012 15:18
Erstmal ein fettes Dankeschön für deine Hilfe!!! :)

zu 1.) seit meinem ersten Post hatte ich keinen Restart mehr
zu 2.) ich bin gerade alle Ordner im Startmenü durchgegangen und habe keinen leeren Ordner gefunden... auch nach einem Start des PCs vermisse ich nichts

cosinus 05.09.2012 15:33
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Donald92 05.09.2012 16:06
*doppelt gepostet*

Donald92 05.09.2012 16:07
Code:
OTL logfile created on: 05.09.2012 16:49:50 - Run 2
OTL by OldTimer - Version 3.2.61.0    Folder = C:\Users\Donald\Desktop
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,50 Gb Total Physical Memory | 2,42 Gb Available Physical Memory | 69,16% Memory free
7,00 Gb Paging File | 5,67 Gb Available in Paging File | 81,06% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 98,47 Gb Total Space | 46,83 Gb Free Space | 47,56% Space Free | Partition Type: NTFS
Drive D: | 146,48 Gb Total Space | 114,46 Gb Free Space | 78,14% Space Free | Partition Type: NTFS
Drive E: | 220,70 Gb Total Space | 207,53 Gb Free Space | 94,03% Space Free | Partition Type: NTFS
 
Computer Name: DONALD-PC | User Name: Donald | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.09.05 16:48:41 | 000,599,040 | ---- | M] (OldTimer Tools) -- C:\Users\Donald\Desktop\OTL.exe
PRC - [2012.08.28 12:39:12 | 000,246,704 | ---- | M] (Facebook) -- C:\Users\Donald\AppData\Local\Facebook\Messenger\2.1.4623.0\FacebookMessenger.exe
PRC - [2012.08.18 11:07:36 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.06.26 19:31:46 | 001,184,312 | ---- | M] (GlavSoft LLC.) -- C:\Programme\TightVNC\tvnserver.exe
PRC - [2012.05.09 17:58:10 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.09 17:58:09 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.09 17:58:09 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.03.23 14:25:24 | 000,087,040 | ---- | M] () -- C:\Programme\HTC\Internet Pass-Through\PassThruSvr.exe
PRC - [2012.03.01 01:59:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.02.29 22:58:46 | 000,857,408 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe
PRC - [2012.02.29 22:58:36 | 001,820,480 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvtray.exe
PRC - [2012.02.19 10:00:46 | 000,775,968 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe
PRC - [2012.02.15 00:55:29 | 000,034,728 | ---- | M] (Arainia Solutions) -- C:\Programme\Gizmo\gservice.exe
PRC - [2012.01.20 21:03:48 | 000,719,672 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office14\MSOSYNC.EXE
PRC - [2012.01.17 12:07:58 | 000,505,736 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Common Files\Java\Java Update\jucheck.exe
PRC - [2012.01.08 15:32:56 | 000,105,160 | ---- | M] () -- C:\Programme\Rainmeter\Rainmeter.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.12.14 09:25:08 | 000,112,920 | ---- | M] (Logitech, Inc.) -- C:\Programme\Logitech\ScrollApp\KhalScroll.exe
PRC - [2011.10.07 11:40:42 | 001,387,288 | ---- | M] (Logitech, Inc.) -- C:\Programme\Logitech\SetPointP\SetPoint.exe
PRC - [2011.09.27 21:05:24 | 000,149,784 | ---- | M] (Logitech, Inc.) -- C:\Programme\Common Files\Logishrd\KHAL3\KHALMNPR.exe
PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.06.12 11:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office14\GROOVE.EXE
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.12.20 19:10:14 | 000,352,256 | ---- | M] (Realtime Soft Ltd) -- C:\Programme\UltraMon\UltraMonTaskbar.exe
PRC - [2010.12.20 19:09:52 | 000,505,856 | ---- | M] (Realtime Soft Ltd) -- C:\Programme\UltraMon\UltraMon.exe
PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.03.06 05:04:24 | 000,310,224 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
PRC - [2010.01.09 22:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
PRC - [2007.05.31 09:21:28 | 000,648,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\WindowsMobile\wmdcBase.exe
PRC - [2007.02.02 18:26:44 | 000,283,136 | ---- | M] (AVM Berlin) -- C:\Programme\avmwlanstick\FRITZWLANMini.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.08.28 12:39:24 | 022,425,008 | ---- | M] () -- C:\Users\Donald\AppData\Local\Facebook\Messenger\2.1.4623.0\libcef.dll
MOD - [2012.08.28 12:39:06 | 000,287,152 | ---- | M] () -- C:\Users\Donald\AppData\Local\Facebook\Messenger\2.1.4623.0\CefSharp.WinForms.dll
MOD - [2012.08.28 12:39:02 | 000,450,984 | ---- | M] () -- C:\Users\Donald\AppData\Local\Facebook\Messenger\2.1.4623.0\CefSharp.dll
MOD - [2012.06.15 19:25:35 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\6dc7ae907d0a57aa19331225f5192ca7\System.Web.ni.dll
MOD - [2012.06.15 19:25:05 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012.06.15 19:24:58 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012.05.23 13:56:38 | 006,611,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\f3814b488d9e083cbbc623e01b389f09\System.Data.ni.dll
MOD - [2012.05.23 13:55:37 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012.05.23 13:55:33 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012.05.23 13:55:30 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012.05.23 13:55:25 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2012.02.15 00:55:29 | 000,059,304 | ---- | M] () -- C:\Programme\Gizmo\gshell.dll
MOD - [2012.01.09 20:44:20 | 000,166,912 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2012.01.08 15:32:56 | 000,567,496 | ---- | M] () -- C:\Programme\Rainmeter\Rainmeter.dll
MOD - [2012.01.08 15:32:56 | 000,105,160 | ---- | M] () -- C:\Programme\Rainmeter\Rainmeter.exe
MOD - [2012.01.08 15:30:20 | 000,023,040 | ---- | M] () -- C:\Programme\Rainmeter\Plugins\RecycleManager.dll
MOD - [2012.01.08 15:30:18 | 000,143,360 | ---- | M] () -- C:\Programme\Rainmeter\Plugins\WebParser.dll
MOD - [2011.10.07 11:41:16 | 000,879,896 | ---- | M] () -- C:\Programme\Logitech\SetPointP\Macros\MacroCore.dll
MOD - [2011.03.17 00:11:16 | 004,297,568 | ---- | M] () -- C:\Programme\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2010.11.13 02:02:21 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.11.05 03:58:05 | 002,927,616 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2012.07.20 22:38:05 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.15 17:50:15 | 004,419,392 | ---- | M] () [Auto | Running] -- c:\program files\common files\akamai/netsession_win_4f7fccd.dll -- (Akamai)
SRV - [2012.06.26 19:31:46 | 001,184,312 | ---- | M] (GlavSoft LLC.) [Auto | Running] -- C:\Programme\TightVNC\tvnserver.exe -- (tvnserver)
SRV - [2012.05.09 17:58:10 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.09 17:58:09 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.03.23 14:25:24 | 000,087,040 | ---- | M] () [Auto | Running] -- C:\Programme\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
SRV - [2012.03.01 01:59:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.02.19 10:00:46 | 000,775,968 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2012.02.15 00:55:29 | 000,034,728 | ---- | M] (Arainia Solutions) [Auto | Running] -- C:\Programme\Gizmo\gservice.exe -- (Gizmo Central)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.09.27 21:03:28 | 000,295,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2011.06.12 11:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.02.19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010.01.09 22:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 22:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.05.31 09:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 09:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2003.04.18 20:06:26 | 000,008,192 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\srvany.exe -- (KMService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tsusbhub.sys -- (tsusbhub)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\synth3dvsc.sys -- (Synth3dVsc)
DRV - [2012.06.29 20:39:02 | 000,004,608 | ---- | M] (RealVNC Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vncmirror.sys -- (vncmirror)
DRV - [2012.05.09 17:58:10 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.09 17:58:10 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.03.01 01:59:00 | 010,819,392 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2012.02.15 00:55:29 | 000,025,488 | ---- | M] (Arainia Solutions LLC) [Kernel | System | Running] -- C:\Windows\System32\drivers\gizmodrv.sys -- (GizmoDrv)
DRV - [2011.12.15 16:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.09.02 08:31:28 | 000,039,192 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2011.09.02 08:31:28 | 000,030,360 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2011.09.02 08:31:20 | 000,041,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2011.04.12 21:29:40 | 000,006,144 | ---- | M] (Phoenix Technologies Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\SGDrv.sys -- (SGDrv)
DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 12:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.10.29 23:11:08 | 000,197,224 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV - [2010.06.23 11:24:56 | 000,023,040 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\htcnprot.sys -- (htcnprot)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.03.22 18:29:08 | 000,018,944 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2010.03.04 18:26:56 | 000,296,936 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmf6232.sys -- (NVNET)
DRV - [2009.10.26 23:54:24 | 000,025,088 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ANDROIDUSB.sys -- (HTCAND32)
DRV - [2009.08.21 22:24:03 | 000,066,592 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2009.07.14 02:18:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2009.07.14 02:14:49 | 000,020,480 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDScan.sys -- (WSDScan)
DRV - [2009.07.14 00:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2008.11.14 03:11:30 | 000,017,184 | ---- | M] (Realtime Soft Ltd) [Kernel | Auto | Running] -- C:\Programme\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys -- (UltraMonUtility)
DRV - [2007.01.26 02:00:00 | 000,265,088 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\fwlanusb.sys -- (FWLANUSB)
DRV - [2007.01.26 02:00:00 | 000,004,352 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avmeject.sys -- (avmeject)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
 
IE - HKU\S-1-5-21-1542967910-1392352476-3196196125-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKU\S-1-5-21-1542967910-1392352476-3196196125-1000\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-1542967910-1392352476-3196196125-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1542967910-1392352476-3196196125-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1542967910-1392352476-3196196125-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>
 
IE - HKU\S-1-5-21-1542967910-1392352476-3196196125-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?babsrc=HP_ss&affID=101365&mntrId=14e69262000000000000001f3f038f3d
IE - HKU\S-1-5-21-1542967910-1392352476-3196196125-1005\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-1542967910-1392352476-3196196125-1005\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1542967910-1392352476-3196196125-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1542967910-1392352476-3196196125-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledAddons: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:7.0.3.2
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.3.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.3.1: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\Donald\AppData\Local\Facebook\Messenger\2.1.4623.0\npFbDesktopPlugin.dll (Facebook, Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{5D3F3872-91E9-4d59-AD9F-AA174A3145DD}: C:\Program Files\Logitech\ScrollApp\LogiSmoothFirefoxExt [2012.02.15 01:05:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.03.19 23:09:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.20 22:38:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.05.20 15:00:55 | 000,000,000 | ---D | M]
 
[2012.02.15 00:48:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\Extensions
[2012.09.04 20:11:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions
[2012.06.26 22:04:31 | 000,000,000 | ---D | M] (FEBE) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2012.03.30 10:04:23 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.02.15 00:51:40 | 000,000,000 | ---D | M] (20-20 3D Viewer - IKEA) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions\2020Player_IKEA@2020Technologies.com
[2012.05.17 11:43:31 | 000,000,000 | ---D | M] ("FRITZ!Box AddOn") -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions\fb_add_on@avm.de
[2012.05.19 12:44:27 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions\ich@maltegoetz.de
[2012.09.04 20:11:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\k2asmm9i.default\extensions
[2012.02.15 00:50:32 | 000,000,000 | ---D | M] (FEBE) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\k2asmm9i.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2012.02.15 00:57:40 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\k2asmm9i.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.08.28 20:51:42 | 000,518,756 | ---- | M] () (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\toolbar@web.de.xpi
[2012.03.16 16:07:35 | 000,009,524 | ---- | M] () (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\{3e9a3920-1b27-11da-8cd6-0800200c9a66}.xpi
[2012.07.25 11:25:13 | 000,276,167 | ---- | M] () (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
[2011.05.27 11:14:54 | 000,089,442 | ---- | M] () (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}.xpi
[2012.07.27 09:47:26 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.10.30 14:45:11 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi
[2012.08.18 18:11:38 | 000,045,226 | ---- | M] () (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6}.xpi
[2012.03.10 14:24:17 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.03.10 14:24:19 | 000,000,000 | ---D | M] (Babylon) -- C:\Programme\Mozilla Firefox\extensions\ffxtlbr@babylon.com
[2012.07.20 22:38:05 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.08 19:36:16 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.08 19:21:19 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.08 19:36:16 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.08 19:36:16 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.08 19:36:16 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.08 19:36:16 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com
CHR - Extension: YouTube = C:\Users\Donald\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\
CHR - Extension: Google-Suche = C:\Users\Donald\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\
CHR - Extension: Logitech Scroll App = C:\Users\Donald\AppData\Local\Google\Chrome\User Data\Default\Extensions\geooogfhpjdpeiphckpbgkhpbeobcaoi\3.0.31_0\
CHR - Extension: Google Mail = C:\Users\Donald\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Logitech Scroll App) - {E11DB59D-5008-42ff-9069-535843BC0BE1} - C:\Programme\Logitech\ScrollApp\LogiSmooth.dll (Logitech, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\FRITZWLANMini.exe (AVM Berlin)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Driver Genius]  File not found
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [LogiScrollApp] C:\Programme\Logitech\ScrollApp\KhalScroll.exe (Logitech, Inc.)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdcBase.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1542967910-1392352476-3196196125-1000..\Run: [OfficeSyncProcess] C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE (Microsoft Corporation)
O4 - HKU\S-1-5-21-1542967910-1392352476-3196196125-1005..\Run: [GizmoDriveDelegate] C:\Program Files\Gizmo\gizmo.exe (Arainia Solutions)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1542967910-1392352476-3196196125-1005..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Donald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk = C:\Users\Donald\AppData\Local\Facebook\Messenger\2.1.4623.0\FacebookMessenger.exe (Facebook)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1
O7 - HKU\S-1-5-21-1542967910-1392352476-3196196125-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Programme\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Programme\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.1)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4BA2809F-F1C1-4CB1-82E8-9F13D0848341}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{67DE1C44-243D-45F7-A638-C662805A00EA}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{64d439ec-575b-11e1-8554-000d18014455}\Shell - "" = AutoRun
O33 - MountPoints2\{64d439ec-575b-11e1-8554-000d18014455}\Shell\AutoRun\command - "" = I:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe - (Broadcom Corporation.)
MsConfig - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
MsConfig - StartUpReg: GizmoDriveDelegate - hkey= - key= - C:\Program Files\Gizmo\gizmo.exe (Arainia Solutions)
MsConfig - StartUpReg: SwitchBoard - hkey= - key= - C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Programme\Combined Community Codec Pack\Filters\FFDShow\ff_vfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.04 19:46:27 | 000,000,000 | ---D | C] -- C:\Users\Donald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Facebook
[2012.09.04 19:35:49 | 000,000,000 | ---D | C] -- C:\Users\Donald\Local Settings
[2012.09.04 19:35:08 | 000,000,000 | ---D | C] -- C:\Users\Donald\Documents\My Photos
[2012.09.04 19:35:08 | 000,000,000 | ---D | C] -- C:\Users\Donald\Documents\My Documents
[2012.09.04 18:46:36 | 000,000,000 | ---D | C] -- C:\Users\Donald\AppData\Roaming\Media Player Classic
[2012.09.04 18:42:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Combined Community Codec Pack
[2012.09.04 18:42:22 | 000,000,000 | ---D | C] -- C:\Program Files\Combined Community Codec Pack
[2012.09.02 13:57:21 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.08.31 12:00:24 | 000,599,040 | ---- | C] (OldTimer Tools) -- C:\Users\Donald\Desktop\OTL.exe
[2012.08.31 11:47:27 | 000,000,000 | ---D | C] -- C:\Users\Donald\AppData\Roaming\Malwarebytes
[2012.08.31 11:47:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.31 11:47:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.31 11:47:18 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.08.31 11:47:18 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.08.22 17:01:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012.08.18 11:10:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.05 16:48:41 | 000,599,040 | ---- | M] (OldTimer Tools) -- C:\Users\Donald\Desktop\OTL.exe
[2012.09.05 16:45:01 | 000,001,142 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1542967910-1392352476-3196196125-1000UA.job
[2012.09.05 16:20:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.09.05 16:17:46 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.05 16:17:46 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.05 16:17:10 | 001,136,390 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.09.05 16:17:10 | 000,782,402 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.09.05 16:17:10 | 000,284,466 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.09.05 16:17:10 | 000,243,514 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.09.05 16:12:45 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.09.05 16:12:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.05 16:12:25 | 2817,974,272 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.04 19:46:28 | 000,001,322 | ---- | M] () -- C:\Users\Donald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
[2012.09.02 18:11:33 | 039,667,358 | ---- | M] () -- C:\Users\Donald\Desktop\5_Jahre_Zeitraffer.mp4
[2012.09.02 15:38:54 | 3498,020,864 | ---- | M] () -- C:\Users\Donald\Desktop\Windows8-ReleasePreview-64bit-German.iso
[2012.08.31 11:59:19 | 000,000,000 | ---- | M] () -- C:\Users\Donald\defogger_reenable
[2012.08.31 11:47:19 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.31 10:45:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1542967910-1392352476-3196196125-1000Core.job
[2012.08.29 18:10:27 | 000,074,528 | ---- | M] () -- C:\Users\Donald\Desktop\IMAG0760.jpg
[2012.08.25 11:52:16 | 100,596,726 | ---- | M] () -- C:\Users\Donald\Desktop\Dennis und Tina.mp4
[2012.08.18 18:08:03 | 003,791,784 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2012.09.04 19:46:27 | 000,001,322 | ---- | C] () -- C:\Users\Donald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
[2012.09.03 10:53:20 | 3498,020,864 | ---- | C] () -- C:\Users\Donald\Desktop\Windows8-ReleasePreview-64bit-German.iso
[2012.09.02 18:11:28 | 039,667,358 | ---- | C] () -- C:\Users\Donald\Desktop\5_Jahre_Zeitraffer.mp4
[2012.08.31 11:59:19 | 000,000,000 | ---- | C] () -- C:\Users\Donald\defogger_reenable
[2012.08.31 11:47:19 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.29 18:10:24 | 000,074,528 | ---- | C] () -- C:\Users\Donald\Desktop\IMAG0760.jpg
[2012.08.25 11:46:53 | 100,596,726 | ---- | C] () -- C:\Users\Donald\Desktop\Dennis und Tina.mp4
[2012.05.22 22:17:03 | 000,272,629 | ---- | C] () -- C:\Windows\System32\drivers\RTAIODAT.DAT
[2012.05.14 20:11:37 | 000,000,001 | R--- | C] () -- C:\Users\Donald\serverport
[2012.04.19 20:03:26 | 000,010,084 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2012.04.19 19:11:59 | 002,515,790 | ---- | C] () -- C:\Windows\System32\nvcoproc.bin
[2012.04.14 22:14:50 | 000,000,132 | ---- | C] () -- C:\Users\Donald\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012.04.12 18:14:52 | 000,000,017 | ---- | C] () -- C:\Users\Donald\AppData\Local\resmon.resmoncfg
[2012.03.19 23:20:21 | 000,175,616 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2012.03.19 22:54:52 | 000,057,344 | ---- | C] () -- C:\Windows\System32\MMTray2k.exe
[2012.03.19 14:18:49 | 000,008,192 | ---- | C] () -- C:\Windows\System32\srvany.exe
[2012.03.12 20:15:54 | 000,100,712 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2012.02.29 13:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe
[2012.02.27 21:47:53 | 000,410,942 | ---- | C] () -- C:\Windows\adb.exe
[2012.02.27 21:47:53 | 000,401,408 | ---- | C] () -- C:\Windows\wget.exe
[2012.02.27 21:47:53 | 000,356,009 | ---- | C] () -- C:\Windows\fastboot.exe
[2012.02.27 21:47:53 | 000,063,488 | ---- | C] () -- C:\Windows\md5sum.exe
[2012.02.21 14:55:13 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2012.02.21 14:54:04 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2012.02.15 00:30:58 | 000,097,360 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin
 
========== LOP Check ==========
 
[2012.09.04 18:51:03 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\AIMP3
[2012.04.19 14:51:23 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Audacity
[2012.03.24 21:33:13 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\DeepBurner
[2012.02.20 00:45:14 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\DVDVideoSoft
[2012.02.15 00:56:03 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Gizmo
[2012.06.04 23:11:49 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\HTC
[2012.06.04 23:13:36 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2012.06.05 16:46:54 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\ICQ
[2012.02.15 00:57:45 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\ICQ Search
[2012.04.17 17:00:18 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Iggels
[2012.02.15 01:12:57 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\JAM Software
[2012.02.15 01:04:28 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Leadertech
[2012.04.29 20:21:38 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\LolClient
[2012.06.05 17:25:16 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\LolClient2
[2012.04.19 17:28:29 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\MotionDSP
[2012.08.04 14:43:30 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Mp3tag
[2012.03.19 22:56:57 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\MPEG Streamclip
[2012.02.16 13:27:22 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\OpenOffice.org
[2012.02.15 01:00:21 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\PhotoFiltre
[2012.02.15 01:11:54 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Publish Providers
[2012.07.21 20:01:59 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Rainmeter
[2012.02.15 01:11:52 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Sony
[2012.03.19 22:20:21 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Sony Creative Software
[2012.06.28 16:30:46 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\TS3Client
[2012.08.31 10:45:00 | 000,001,120 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1542967910-1392352476-3196196125-1000Core.job
[2012.09.05 16:45:01 | 000,001,142 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1542967910-1392352476-3196196125-1000UA.job
[2012.08.02 13:53:41 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.02.24 15:37:33 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Adobe
[2012.09.04 18:51:03 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\AIMP3
[2012.06.23 13:19:27 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Apple Computer
[2012.04.19 14:51:23 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Audacity
[2012.02.15 12:14:03 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Avira
[2012.03.24 21:33:13 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\DeepBurner
[2012.03.19 23:21:08 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\DivX
[2012.02.20 00:45:14 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\DVDVideoSoft
[2012.02.15 00:56:03 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Gizmo
[2012.06.04 23:11:49 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\HTC
[2012.06.04 23:13:36 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2012.06.05 16:46:54 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\ICQ
[2012.02.15 00:57:45 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\ICQ Search
[2012.02.15 00:26:50 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Identities
[2012.04.17 17:00:18 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Iggels
[2012.02.15 01:12:57 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\JAM Software
[2012.02.15 01:04:28 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Leadertech
[2012.02.15 01:05:24 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Logishrd
[2012.02.15 01:04:32 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Logitech
[2012.04.29 20:21:38 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\LolClient
[2012.06.05 17:25:16 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\LolClient2
[2012.02.15 00:37:28 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Macromedia
[2012.08.31 11:47:27 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Malwarebytes
[2009.07.14 10:56:41 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Media Center Programs
[2012.09.04 18:46:36 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Media Player Classic
[2012.08.24 15:32:59 | 000,000,000 | --SD | M] -- C:\Users\Donald\AppData\Roaming\Microsoft
[2012.04.19 17:28:29 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\MotionDSP
[2012.02.15 00:48:54 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Mozilla
[2012.08.04 14:43:30 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Mp3tag
[2012.03.19 22:56:57 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\MPEG Streamclip
[2012.05.22 20:33:59 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\NVIDIA
[2012.02.16 13:27:22 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\OpenOffice.org
[2012.02.15 01:00:21 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\PhotoFiltre
[2012.02.15 01:11:54 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Publish Providers
[2012.07.21 20:01:59 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Rainmeter
[2012.02.15 01:17:06 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Realtime Soft
[2012.02.15 01:11:52 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Sony
[2012.03.19 22:20:21 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Sony Creative Software
[2012.06.28 16:30:46 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\TS3Client
[2012.09.04 19:50:00 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\vlc
[2012.02.16 13:16:04 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2012.06.04 23:09:12 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Donald\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2012.07.06 21:06:58 | 000,029,184 | R--- | M] () -- C:\Users\Donald\AppData\Roaming\Microsoft\Installer\{21AE04E8-EBF6-40DB-9AA9-B7A80C5D057D}\Icon21AE04E8.exe
[2012.02.15 01:04:28 | 000,053,248 | R--- | M] (Acresso Software Inc.) -- C:\Users\Donald\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
[2012.04.11 22:53:00 | 000,395,776 | ---- | M] (RainmeterSkin.com) -- C:\Users\Donald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rainmeter\SkinGallery.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011.03.11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011.03.11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2010.04.09 02:32:56 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=8C98D67A228B7C4476656B80633CD485 -- C:\NVIDIA\nForceWin7VistaInt\15.56\IDE\Win7\sataraid\nvstor32.sys
[2010.04.09 02:32:56 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=8C98D67A228B7C4476656B80633CD485 -- C:\NVIDIA\nForceWin7VistaInt\15.56\IDE\WinVista\sataraid\nvstor32.sys
[2010.04.09 02:32:56 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=8C98D67A228B7C4476656B80633CD485 -- C:\NVIDIA\nForceWin7VistaInt\15.57\IDE\Win7\sataraid\nvstor32.sys
[2010.04.09 02:32:56 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=8C98D67A228B7C4476656B80633CD485 -- C:\NVIDIA\nForceWin7VistaInt\15.57\IDE\WinVista\sataraid\nvstor32.sys
[2010.04.09 02:32:36 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=97778C3CB3AF6B2243648D0DCD4D8916 -- C:\NVIDIA\nForceWin7VistaInt\15.56\IDE\Win7\sata_ide\nvstor32.sys
[2010.04.09 02:32:36 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=97778C3CB3AF6B2243648D0DCD4D8916 -- C:\NVIDIA\nForceWin7VistaInt\15.56\IDE\WinVista\sata_ide\nvstor32.sys
[2010.04.09 02:32:36 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=97778C3CB3AF6B2243648D0DCD4D8916 -- C:\NVIDIA\nForceWin7VistaInt\15.57\IDE\Win7\sata_ide\nvstor32.sys
[2010.04.09 02:32:36 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=97778C3CB3AF6B2243648D0DCD4D8916 -- C:\NVIDIA\nForceWin7VistaInt\15.57\IDE\WinVista\sata_ide\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<          >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:890CC2F3

< End of report >

cosinus 06.09.2012 10:21
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
FF - user.js - File not found
[2012.02.15 00:57:40 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\k2asmm9i.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.08.28 20:51:42 | 000,518,756 | ---- | M] () (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\toolbar@web.de.xpi
[2012.03.16 16:07:35 | 000,009,524 | ---- | M] () (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\{3e9a3920-1b27-11da-8cd6-0800200c9a66}.xpi
[2012.07.25 11:25:13 | 000,276,167 | ---- | M] () (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
[2011.05.27 11:14:54 | 000,089,442 | ---- | M] () (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}.xpi
[2012.07.27 09:47:26 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.10.30 14:45:11 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi
[2012.08.18 18:11:38 | 000,045,226 | ---- | M] () (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6}.xpi
[2012.03.10 14:24:17 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.03.10 14:24:19 | 000,000,000 | ---D | M] (Babylon) -- C:\Programme\Mozilla Firefox\extensions\ffxtlbr@babylon.com
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1
O7 - HKU\S-1-5-21-1542967910-1392352476-3196196125-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{64d439ec-575b-11e1-8554-000d18014455}\Shell - "" = AutoRun
O33 - MountPoints2\{64d439ec-575b-11e1-8554-000d18014455}\Shell\AutoRun\command - "" = I:\pushinst.exe
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:890CC2F3
:Files
C:\Users\Donald\AppData\Roaming\ICQ Search
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Donald92 06.09.2012 18:39
So...
1. Hatte gerade einen Neustart mit anschließenden Einfrieren in dem "ersten Bildschirm" (wo Bios-Name angezeigt wird und man F8 und so drücken kann)
2. Nach dem manuellen Neustart hat er ganz gebootet um dann eine Bluescreen zu fabrizieren
3. Der darauffolgende Boot ging gut bis der Desktop voll da war, ab da war der PC wie tot (Maus, Tastatur tot, USB nix erkannt)
4. Nochmal manuell neugestartet dann kam ein Bildschirm mit roter Schrift "Shut Down due Over Heat..."
5. Habe jetzt die linke Abdeckung vom PC abgemacht und gebootet - läuft jetzt wieder und habe den OTL-Fix hier:

Code:
All processes killed
========== OTL ==========
Folder C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\k2asmm9i.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\ not found.
File C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\toolbar@web.de.xpi not found.
File C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\{3e9a3920-1b27-11da-8cd6-0800200c9a66}.xpi not found.
File C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi not found.
File C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}.xpi not found.
File C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi not found.
File C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi not found.
File C:\Users\Donald\AppData\Roaming\mozilla\firefox\profiles\febeprof.Donald\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6}.xpi not found.
Folder C:\Programme\Mozilla Firefox\extensions\ not found.
Folder C:\Programme\Mozilla Firefox\extensions\ffxtlbr@babylon.com\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\SoftwareSASGeneration not found.
Registry value HKEY_USERS\S-1-5-21-1542967910-1392352476-3196196125-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File C:\autoexec.bat not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{64d439ec-575b-11e1-8554-000d18014455}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64d439ec-575b-11e1-8554-000d18014455}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{64d439ec-575b-11e1-8554-000d18014455}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64d439ec-575b-11e1-8554-000d18014455}\ not found.
File I:\pushinst.exe not found.
Unable to delete ADS C:\ProgramData\TEMP:890CC2F3 .
========== FILES ==========
File\Folder C:\Users\Donald\AppData\Roaming\ICQ Search not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Donald\Desktop\cmd.bat deleted successfully.
C:\Users\Donald\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56466 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Donald
->Temp folder emptied: 3839327 bytes
->Temporary Internet Files folder emptied: 6534398 bytes
->Java cache emptied: 17677975 bytes
->FireFox cache emptied: 451882372 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 61852 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 41620 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 32354 bytes
RecycleBin emptied: 2786393202 bytes
 
Total Files Cleaned = 3.115,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Donald
->Flash cache emptied: 0 bytes
 
User: Public
 
User: UpdatusUser
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.61.0 log created on 09062012_193005

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

cosinus 06.09.2012 21:05
Zitat:
mit roter Schrift "Shut Down due Over Heat..."
Dann solltest du mal dringend die Drehzahl des CPU-Lüfters kontrollieren!
Hast du die CPU übertaktet? Wenn nicht könnte der Lüfter schon einen Lagerschaden haben oder die Drehzahl ist zu niedrig im BIOS eingestellt
Evtl. ist aber auch die Shutdown-Temepratur zu niedrig gewählt kontrollere daher auch das und die aktuelle bzw. max. Temp der CPU im BIOS

Donald92 06.09.2012 21:32
Ich habe nichts an der CPU gemacht - wo kontrolliere ich diese Werte und was sind "normale" Werte?

cosinus 07.09.2012 09:59
Geh ins BIOS in der Health-Sektion! Erstmal nur die Werte beobachten und notieren, dann hier posten

Donald92 07.09.2012 18:02
Das sind die aktuellen Werte - war da auch nicht dran oder so!

Bild anzeigen geht nicht, deshalb hier der Link --> hxxp://www.imagebanana.com/view/0waznh1c/IMAG0031.jpg

cosinus 10.09.2012 13:55
Hm, hast recht, das Bild kann man nicht direkt posten :wtf:

Ich versuchs mal so:

http://saved.im/mtg4mte3andr/imag0031.jpg

Also 51°C liegt noch im völlig gründen Bereich. Die Drehzahl passt auch und die shutdown temperature ist deaktiviert....
Trat das mit der Temperatur denn nochmal auf? :wtf:

Mach aber trotzdem weiter:

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtg4nzy0ywy5/settings_2012-09-04.png

Donald92 11.09.2012 16:55
Habe seit dem die Seitenklappe vom PC offen und ist noch nicht wieder aufgetreten - dafür aber einige Reboots und Einfrierungen... :(

Code:
17:52:24.0174 5632  TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
17:52:24.0342 5632  ============================================================
17:52:24.0342 5632  Current date / time: 2012/09/11 17:52:24.0342
17:52:24.0342 5632  SystemInfo:
17:52:24.0342 5632 
17:52:24.0342 5632  OS Version: 6.1.7601 ServicePack: 1.0
17:52:24.0342 5632  Product type: Workstation
17:52:24.0342 5632  ComputerName: DONALD-PC
17:52:24.0342 5632  UserName: Donald
17:52:24.0342 5632  Windows directory: C:\Windows
17:52:24.0342 5632  System windows directory: C:\Windows
17:52:24.0342 5632  Processor architecture: Intel x86
17:52:24.0342 5632  Number of processors: 2
17:52:24.0343 5632  Page size: 0x1000
17:52:24.0343 5632  Boot type: Normal boot
17:52:24.0343 5632  ============================================================
17:52:25.0610 5632  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
17:52:25.0612 5632  ============================================================
17:52:25.0612 5632  \Device\Harddisk0\DR0:
17:52:25.0612 5632  MBR partitions:
17:52:25.0612 5632  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
17:52:25.0612 5632  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0xC4F3000
17:52:25.0612 5632  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0xC525800, BlocksNum 0x124F8000
17:52:25.0612 5632  \Device\Harddisk0\DR0\Partition4: MBR, Type 0x7, StartLBA 0x1EA1D800, BlocksNum 0x1B968000
17:52:25.0612 5632  ============================================================
17:52:25.0669 5632  C: <-> \Device\Harddisk0\DR0\Partition2
17:52:25.0696 5632  D: <-> \Device\Harddisk0\DR0\Partition3
17:52:25.0735 5632  E: <-> \Device\Harddisk0\DR0\Partition4
17:52:25.0736 5632  ============================================================
17:52:25.0736 5632  Initialize success
17:52:25.0736 5632  ============================================================
17:53:18.0179 3916  ============================================================
17:53:18.0179 3916  Scan started
17:53:18.0179 3916  Mode: Manual; SigCheck; TDLFS;
17:53:18.0179 3916  ============================================================
17:53:18.0892 3916  ================ Scan system memory ========================
17:53:18.0892 3916  System memory - ok
17:53:18.0892 3916  ================ Scan services =============================
17:53:19.0032 3916  [ 1B133875B8AA8AC48969BD3458AFE9F5 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
17:53:19.0079 3916  1394ohci - ok
17:53:19.0110 3916  [ CEA80C80BED809AA0DA6FEBC04733349 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
17:53:19.0126 3916  ACPI - ok
17:53:19.0141 3916  [ 1EFBC664ABFF416D1D07DB115DCB264F ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
17:53:19.0157 3916  AcpiPmi - ok
17:53:19.0266 3916  [ 62B7936F9036DD6ED36E6A7EFA805DC0 ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
17:53:19.0282 3916  AdobeARMservice - ok
17:53:19.0313 3916  [ 21E785EBD7DC90A06391141AAC7892FB ] adp94xx        C:\Windows\system32\DRIVERS\adp94xx.sys
17:53:19.0328 3916  adp94xx - ok
17:53:19.0360 3916  [ 0C676BC278D5B59FF5ABD57BBE9123F2 ] adpahci        C:\Windows\system32\DRIVERS\adpahci.sys
17:53:19.0375 3916  adpahci - ok
17:53:19.0391 3916  [ 7C7B5EE4B7B822EC85321FE23A27DB33 ] adpu320        C:\Windows\system32\DRIVERS\adpu320.sys
17:53:19.0391 3916  adpu320 - ok
17:53:19.0422 3916  [ 8B5EEFEEC1E6D1A72A06C526628AD161 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
17:53:19.0453 3916  AeLookupSvc - ok
17:53:19.0500 3916  [ 9EBBBA55060F786F0FCAA3893BFA2806 ] AFD            C:\Windows\system32\drivers\afd.sys
17:53:19.0531 3916  AFD - ok
17:53:19.0578 3916  [ 507812C3054C21CEF746B6EE3D04DD6E ] agp440          C:\Windows\system32\drivers\agp440.sys
17:53:19.0578 3916  agp440 - ok
17:53:19.0609 3916  [ 8B30250D573A8F6B4BD23195160D8707 ] aic78xx        C:\Windows\system32\DRIVERS\djsvs.sys
17:53:19.0625 3916  aic78xx - ok
17:53:19.0750 3916  [ 0923671CF87CD511E46D4668B53F5E76 ] Akamai          c:\program files\common files\akamai/netsession_win_5891ae0.dll
17:53:19.0750 3916  Suspicious file (Hidden): c:\program files\common files\akamai/netsession_win_5891ae0.dll. md5: 0923671CF87CD511E46D4668B53F5E76
17:53:19.0750 3916  Akamai ( HiddenFile.Multi.Generic ) - warning
17:53:19.0750 3916  Akamai - detected HiddenFile.Multi.Generic (1)
17:53:19.0796 3916  [ 18A54E132947CD98FEA9ACCC57F98F13 ] ALG            C:\Windows\System32\alg.exe
17:53:19.0828 3916  ALG - ok
17:53:19.0859 3916  [ 0D40BCF52EA90FC7DF2AEAB6503DEA44 ] aliide          C:\Windows\system32\drivers\aliide.sys
17:53:19.0874 3916  aliide - ok
17:53:19.0874 3916  [ 3C6600A0696E90A463771C7422E23AB5 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
17:53:19.0890 3916  amdagp - ok
17:53:19.0890 3916  [ CD5914170297126B6266860198D1D4F0 ] amdide          C:\Windows\system32\drivers\amdide.sys
17:53:19.0906 3916  amdide - ok
17:53:19.0937 3916  [ 00DDA200D71BAC534BF56A9DB5DFD666 ] AmdK8          C:\Windows\system32\DRIVERS\amdk8.sys
17:53:19.0968 3916  AmdK8 - ok
17:53:19.0968 3916  [ 3CBF30F5370FDA40DD3E87DF38EA53B6 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
17:53:19.0999 3916  AmdPPM - ok
17:53:20.0015 3916  [ D320BF87125326F996D4904FE24300FC ] amdsata        C:\Windows\system32\drivers\amdsata.sys
17:53:20.0030 3916  amdsata - ok
17:53:20.0046 3916  [ EA43AF0C423FF267355F74E7A53BDABA ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
17:53:20.0046 3916  amdsbs - ok
17:53:20.0062 3916  [ 46387FB17B086D16DEA267D5BE23A2F2 ] amdxata        C:\Windows\system32\drivers\amdxata.sys
17:53:20.0077 3916  amdxata - ok
17:53:20.0140 3916  [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe
17:53:20.0140 3916  AntiVirSchedulerService - ok
17:53:20.0155 3916  [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService  C:\Program Files\Avira\AntiVir Desktop\avguard.exe
17:53:20.0171 3916  AntiVirService - ok
17:53:20.0218 3916  [ AEA177F783E20150ACE5383EE368DA19 ] AppID          C:\Windows\system32\drivers\appid.sys
17:53:20.0249 3916  AppID - ok
17:53:20.0280 3916  [ 62A9C86CB6085E20DB4823E4E97826F5 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
17:53:20.0311 3916  AppIDSvc - ok
17:53:20.0358 3916  [ FB1959012294D6AD43E5304DF65E3C26 ] Appinfo        C:\Windows\System32\appinfo.dll
17:53:20.0389 3916  Appinfo - ok
17:53:20.0452 3916  [ F401929EE0CC92BFE7F15161CA535383 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
17:53:20.0452 3916  Apple Mobile Device - ok
17:53:20.0483 3916  [ A45D184DF6A8803DA13A0B329517A64A ] AppMgmt        C:\Windows\System32\appmgmts.dll
17:53:20.0514 3916  AppMgmt - ok
17:53:20.0530 3916  [ 2932004F49677BD84DBC72EDB754FFB3 ] arc            C:\Windows\system32\DRIVERS\arc.sys
17:53:20.0545 3916  arc - ok
17:53:20.0561 3916  [ 5D6F36C46FD283AE1B57BD2E9FEB0BC7 ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
17:53:20.0576 3916  arcsas - ok
17:53:20.0842 3916  [ 776ACEFA0CA9DF0FAA51A5FB2F435705 ] aspnet_state    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
17:53:20.0857 3916  aspnet_state - ok
17:53:20.0873 3916  [ ADD2ADE1C2B285AB8378D2DAAF991481 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
17:53:20.0904 3916  AsyncMac - ok
17:53:20.0935 3916  [ 338C86357871C167A96AB976519BF59E ] atapi          C:\Windows\system32\drivers\atapi.sys
17:53:20.0935 3916  atapi - ok
17:53:20.0982 3916  [ CE3B4E731638D2EF62FCB419BE0D39F0 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
17:53:21.0029 3916  AudioEndpointBuilder - ok
17:53:21.0029 3916  [ CE3B4E731638D2EF62FCB419BE0D39F0 ] Audiosrv        C:\Windows\System32\Audiosrv.dll
17:53:21.0060 3916  Audiosrv - ok
17:53:21.0091 3916  [ D5541F0AFB767E85FC412FC609D96A74 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
17:53:21.0107 3916  avgntflt - ok
17:53:21.0138 3916  [ 7D967A682D4694DF7FA57D63A2DB01FE ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
17:53:21.0138 3916  avipbb - ok
17:53:21.0154 3916  [ 271CFD1A989209B1964E24D969552BF7 ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
17:53:21.0169 3916  avkmgr - ok
17:53:21.0200 3916  [ 263CF9D248FD5E020A1333ED4F7EAA88 ] avmeject        C:\Windows\system32\drivers\avmeject.sys
17:53:21.0216 3916  avmeject ( UnsignedFile.Multi.Generic ) - warning
17:53:21.0216 3916  avmeject - detected UnsignedFile.Multi.Generic (1)
17:53:21.0247 3916  [ 6E30D02AAC9CAC84F421622E3A2F6178 ] AxInstSV        C:\Windows\System32\AxInstSV.dll
17:53:21.0294 3916  AxInstSV - ok
17:53:21.0325 3916  [ 1A231ABEC60FD316EC54C66715543CEC ] b06bdrv        C:\Windows\system32\DRIVERS\bxvbdx.sys
17:53:21.0356 3916  b06bdrv - ok
17:53:21.0388 3916  [ BD8869EB9CDE6BBE4508D869929869EE ] b57nd60x        C:\Windows\system32\DRIVERS\b57nd60x.sys
17:53:21.0403 3916  b57nd60x - ok
17:53:21.0434 3916  [ EE1E9C3BB8228AE423DD38DB69128E71 ] BDESVC          C:\Windows\System32\bdesvc.dll
17:53:21.0481 3916  BDESVC - ok
17:53:21.0497 3916  [ 505506526A9D467307B3C393DEDAF858 ] Beep            C:\Windows\system32\drivers\Beep.sys
17:53:21.0528 3916  Beep - ok
17:53:21.0575 3916  [ 1E2BAC209D184BB851E1A187D8A29136 ] BFE            C:\Windows\System32\bfe.dll
17:53:21.0622 3916  BFE - ok
17:53:21.0653 3916  [ E585445D5021971FAE10393F0F1C3961 ] BITS            C:\Windows\System32\qmgr.dll
17:53:21.0700 3916  BITS - ok
17:53:21.0715 3916  [ 2287078ED48FCFC477B05B20CF38F36F ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
17:53:21.0746 3916  blbdrive - ok
17:53:21.0793 3916  [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
17:53:21.0809 3916  Bonjour Service - ok
17:53:21.0840 3916  [ 8F2DA3028D5FCBD1A060A3DE64CD6506 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
17:53:21.0856 3916  bowser - ok
17:53:21.0871 3916  [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
17:53:21.0887 3916  BrFiltLo - ok
17:53:21.0902 3916  [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
17:53:21.0949 3916  BrFiltUp - ok
17:53:21.0980 3916  [ 3DAA727B5B0A45039B0E1C9A211B8400 ] Browser        C:\Windows\System32\browser.dll
17:53:22.0027 3916  Browser - ok
17:53:22.0058 3916  [ 845B8CE732E67F3B4133164868C666EA ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
17:53:22.0105 3916  Brserid - ok
17:53:22.0121 3916  [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
17:53:22.0136 3916  BrSerWdm - ok
17:53:22.0152 3916  [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
17:53:22.0168 3916  BrUsbMdm - ok
17:53:22.0183 3916  [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
17:53:22.0199 3916  BrUsbSer - ok
17:53:22.0246 3916  [ 2865A5C8E98C70C605F417908CEBB3A4 ] BthEnum        C:\Windows\system32\drivers\BthEnum.sys
17:53:22.0277 3916  BthEnum - ok
17:53:22.0292 3916  [ ED3DF7C56CE0084EB2034432FC56565A ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
17:53:22.0324 3916  BTHMODEM - ok
17:53:22.0339 3916  [ AD1872E5829E8A2C3B5B4B641C3EAB0E ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
17:53:22.0355 3916  BthPan - ok
17:53:22.0386 3916  [ 1153DE2E4F5941E10C399CB5592F78A1 ] BTHPORT        C:\Windows\System32\Drivers\BTHport.sys
17:53:22.0402 3916  BTHPORT - ok
17:53:22.0448 3916  [ 1DF19C96EEF6C29D1C3E1A8678E07190 ] bthserv        C:\Windows\system32\bthserv.dll
17:53:22.0480 3916  bthserv - ok
17:53:22.0526 3916  [ C81E9413A25A439F436B1D4B6A0CF9E9 ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys
17:53:22.0542 3916  BTHUSB - ok
17:53:22.0604 3916  [ 23D519629B2ABE57AE30965A0BC2C150 ] btwampfl        C:\Windows\system32\drivers\btwampfl.sys
17:53:22.0620 3916  btwampfl - ok
17:53:22.0651 3916  [ 18FC7249D77577E6E74D2ABE4F6880CB ] btwaudio        C:\Windows\system32\drivers\btwaudio.sys
17:53:22.0651 3916  btwaudio - ok
17:53:22.0698 3916  [ 51DD1428D9F9B546F178AF8CA32D6E70 ] btwavdt        C:\Windows\system32\drivers\btwavdt.sys
17:53:22.0714 3916  btwavdt - ok
17:53:22.0776 3916  [ E8D3F4D88BA197B0D3436523EEF4191D ] btwdins        C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
17:53:22.0792 3916  btwdins - ok
17:53:22.0823 3916  [ E26610D44609574E13BAAD367AB34967 ] btwl2cap        C:\Windows\system32\DRIVERS\btwl2cap.sys
17:53:22.0823 3916  btwl2cap - ok
17:53:22.0838 3916  [ D3BAA463BB95CD596B0F0D89F6B82E89 ] btwrchid        C:\Windows\system32\DRIVERS\btwrchid.sys
17:53:22.0854 3916  btwrchid - ok
17:53:22.0870 3916  [ 77EA11B065E0A8AB902D78145CA51E10 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
17:53:22.0916 3916  cdfs - ok
17:53:22.0948 3916  [ BE167ED0FDB9C1FA1133953C18D5A6C9 ] cdrom          C:\Windows\system32\drivers\cdrom.sys
17:53:22.0979 3916  cdrom - ok
17:53:23.0010 3916  [ 319C6B309773D063541D01DF8AC6F55F ] CertPropSvc    C:\Windows\System32\certprop.dll
17:53:23.0057 3916  CertPropSvc - ok
17:53:23.0072 3916  [ 3FE3FE94A34DF6FB06E6418D0F6A0060 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
17:53:23.0072 3916  circlass - ok
17:53:23.0119 3916  [ 635181E0E9BBF16871BF5380D71DB02D ] CLFS            C:\Windows\system32\CLFS.sys
17:53:23.0135 3916  CLFS - ok
17:53:23.0182 3916  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
17:53:23.0182 3916  clr_optimization_v2.0.50727_32 - ok
17:53:23.0228 3916  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
17:53:23.0244 3916  clr_optimization_v4.0.30319_32 - ok
17:53:23.0275 3916  [ DEA805815E587DAD1DD2C502220B5616 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
17:53:23.0291 3916  CmBatt - ok
17:53:23.0322 3916  [ C537B1DB64D495B9B4717B4D6D9EDBF2 ] cmdide          C:\Windows\system32\drivers\cmdide.sys
17:53:23.0322 3916  cmdide - ok
17:53:23.0369 3916  [ 247B4CE2DAB1160CD422D532D5241E1F ] CNG            C:\Windows\system32\Drivers\cng.sys
17:53:23.0384 3916  CNG - ok
17:53:23.0400 3916  [ A6023D3823C37043986713F118A89BEE ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
17:53:23.0416 3916  Compbatt - ok
17:53:23.0431 3916  [ CBE8C58A8579CFE5FCCF809E6F114E89 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
17:53:23.0447 3916  CompositeBus - ok
17:53:23.0462 3916  COMSysApp - ok
17:53:23.0462 3916  [ 2C4EBCFC84A9B44F209DFF6C6E6C61D1 ] crcdisk        C:\Windows\system32\DRIVERS\crcdisk.sys
17:53:23.0478 3916  crcdisk - ok
17:53:23.0509 3916  [ 06E771AA596B8761107AB57E99F128D7 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
17:53:23.0540 3916  CryptSvc - ok
17:53:23.0572 3916  [ 3C2177A897B4CA2788C6FB0C3FD81D4B ] CSC            C:\Windows\system32\drivers\csc.sys
17:53:23.0603 3916  CSC - ok
17:53:23.0650 3916  [ 15F93B37F6801943360D9EB42485D5D3 ] CscService      C:\Windows\System32\cscsvc.dll
17:53:23.0681 3916  CscService - ok
17:53:23.0712 3916  [ 7660F01D3B38ACA1747E397D21D790AF ] DcomLaunch      C:\Windows\system32\rpcss.dll
17:53:23.0743 3916  DcomLaunch - ok
17:53:23.0774 3916  [ 8D6E10A2D9A5EED59562D9B82CF804E1 ] defragsvc      C:\Windows\System32\defragsvc.dll
17:53:23.0790 3916  defragsvc - ok
17:53:23.0821 3916  [ F024449C97EC1E464AAFFDA18593DB88 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
17:53:23.0852 3916  DfsC - ok
17:53:23.0884 3916  [ E9E01EB683C132F7FA27CD607B8A2B63 ] Dhcp            C:\Windows\system32\dhcpcore.dll
17:53:23.0915 3916  Dhcp - ok
17:53:23.0930 3916  [ 1A050B0274BFB3890703D490F330C0DA ] discache        C:\Windows\system32\drivers\discache.sys
17:53:23.0962 3916  discache - ok
17:53:23.0993 3916  [ 565003F326F99802E68CA78F2A68E9FF ] Disk            C:\Windows\system32\DRIVERS\disk.sys
17:53:23.0993 3916  Disk - ok
17:53:24.0024 3916  [ 33EF4861F19A0736B11314AAD9AE28D0 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
17:53:24.0071 3916  Dnscache - ok
17:53:24.0102 3916  [ 366BA8FB4B7BB7435E3B9EACB3843F67 ] dot3svc        C:\Windows\System32\dot3svc.dll
17:53:24.0133 3916  dot3svc - ok
17:53:24.0164 3916  [ 8EC04CA86F1D68DA9E11952EB85973D6 ] DPS            C:\Windows\system32\dps.dll
17:53:24.0211 3916  DPS - ok
17:53:24.0258 3916  [ B918E7C5F9BF77202F89E1A9539F2EB4 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
17:53:24.0274 3916  drmkaud - ok
17:53:24.0320 3916  [ 23F5D28378A160352BA8F817BD8C71CB ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
17:53:24.0352 3916  DXGKrnl - ok
17:53:24.0383 3916  [ 22EF8965101685ADD128F03A2B03CE16 ] E1G60          C:\Windows\system32\DRIVERS\E1G60I32.sys
17:53:24.0398 3916  E1G60 - ok
17:53:24.0414 3916  [ 8600142FA91C1B96367D3300AD0F3F3A ] EapHost        C:\Windows\System32\eapsvc.dll
17:53:24.0445 3916  EapHost - ok
17:53:24.0523 3916  [ 024E1B5CAC09731E4D868E64DBFB4AB0 ] ebdrv          C:\Windows\system32\DRIVERS\evbdx.sys
17:53:24.0601 3916  ebdrv - ok
17:53:24.0632 3916  [ 81951F51E318AECC2D68559E47485CC4 ] EFS            C:\Windows\System32\lsass.exe
17:53:24.0664 3916  EFS - ok
17:53:24.0726 3916  [ A8C362018EFC87BEB013EE28F29C0863 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
17:53:24.0773 3916  ehRecvr - ok
17:53:24.0788 3916  [ D389BFF34F80CAEDE417BF9D1507996A ] ehSched        C:\Windows\ehome\ehsched.exe
17:53:24.0820 3916  ehSched - ok
17:53:24.0851 3916  [ 0ED67910C8C326796FAA00B2BF6D9D3C ] elxstor        C:\Windows\system32\DRIVERS\elxstor.sys
17:53:24.0866 3916  elxstor - ok
17:53:24.0882 3916  [ 8FC3208352DD3912C94367A206AB3F11 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
17:53:24.0898 3916  ErrDev - ok
17:53:24.0929 3916  [ F6916EFC29D9953D5D0DF06882AE8E16 ] EventSystem    C:\Windows\system32\es.dll
17:53:24.0976 3916  EventSystem - ok
17:53:25.0007 3916  [ 2DC9108D74081149CC8B651D3A26207F ] exfat          C:\Windows\system32\drivers\exfat.sys
17:53:25.0054 3916  exfat - ok
17:53:25.0069 3916  [ 7E0AB74553476622FB6AE36F73D97D35 ] fastfat        C:\Windows\system32\drivers\fastfat.sys
17:53:25.0100 3916  fastfat - ok
17:53:25.0147 3916  [ 967EA5B213E9984CBE270205DF37755B ] Fax            C:\Windows\system32\fxssvc.exe
17:53:25.0178 3916  Fax - ok
17:53:25.0194 3916  [ E817A017F82DF2A1F8CFDBDA29388B29 ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
17:53:25.0194 3916  fdc - ok
17:53:25.0225 3916  [ F3222C893BD2F5821A0179E5C71E88FB ] fdPHost        C:\Windows\system32\fdPHost.dll
17:53:25.0256 3916  fdPHost - ok
17:53:25.0288 3916  [ 7DBE8CBFE79EFBDEB98C9FB08D3A9A5B ] FDResPub        C:\Windows\system32\fdrespub.dll
17:53:25.0334 3916  FDResPub - ok
17:53:25.0334 3916  [ 6CF00369C97F3CF563BE99BE983D13D8 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
17:53:25.0350 3916  FileInfo - ok
17:53:25.0366 3916  [ 42C51DC94C91DA21CB9196EB64C45DB9 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
17:53:25.0397 3916  Filetrace - ok
17:53:25.0428 3916  [ 87907AA70CB3C56600F1C2FB8841579B ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
17:53:25.0444 3916  flpydisk - ok
17:53:25.0475 3916  [ 7520EC808E0C35E0EE6F841294316653 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
17:53:25.0490 3916  FltMgr - ok
17:53:25.0522 3916  [ B3A5EC6B6B6673DB7E87C2BCDBDDC074 ] FontCache      C:\Windows\system32\FntCache.dll
17:53:25.0568 3916  FontCache - ok
17:53:25.0615 3916  [ E56F39F6B7FDA0AC77A79B0FD3DE1A2F ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
17:53:25.0631 3916  FontCache3.0.0.0 - ok
17:53:25.0662 3916  [ 1A16B57943853E598CFF37FE2B8CBF1D ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
17:53:25.0662 3916  FsDepends - ok
17:53:25.0709 3916  [ 7DAE5EBCC80E45D3253F4923DC424D05 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
17:53:25.0709 3916  Fs_Rec - ok
17:53:25.0740 3916  [ 8A73E79089B282100B9393B644CB853B ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
17:53:25.0756 3916  fvevol - ok
17:53:25.0787 3916  [ FF12FA487265DA2AC7DE4BE53F72FF1A ] FWLANUSB        C:\Windows\system32\DRIVERS\fwlanusb.sys
17:53:25.0802 3916  FWLANUSB - ok
17:53:25.0849 3916  [ 65EE0C7A58B65E74AE05637418153938 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
17:53:25.0849 3916  gagp30kx - ok
17:53:25.0880 3916  [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM    C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
17:53:25.0896 3916  GEARAspiWDM - ok
17:53:25.0927 3916  [ B1C9B932F5A728800AB9C2C88C92594A ] Gizmo Central  C:\Program Files\Gizmo\gservice.exe
17:53:25.0927 3916  Gizmo Central - ok
17:53:25.0943 3916  [ E48DA656DF32EDA6E5B9D06E3D410B49 ] GizmoDrv        C:\Windows\system32\drivers\GizmoDrv.sys
17:53:25.0943 3916  GizmoDrv - ok
17:53:25.0990 3916  [ E897EAF5ED6BA41E081060C9B447A673 ] gpsvc          C:\Windows\System32\gpsvc.dll
17:53:26.0036 3916  gpsvc - ok
17:53:26.0114 3916  [ F02A533F517EB38333CB12A9E8963773 ] gupdate        C:\Program Files\Google\Update\GoogleUpdate.exe
17:53:26.0114 3916  gupdate - ok
17:53:26.0130 3916  [ F02A533F517EB38333CB12A9E8963773 ] gupdatem        C:\Program Files\Google\Update\GoogleUpdate.exe
17:53:26.0146 3916  gupdatem - ok
17:53:26.0161 3916  [ C44E3C2BAB6837DB337DDEE7544736DB ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
17:53:26.0192 3916  hcw85cir - ok
17:53:26.0239 3916  [ A5EF29D5315111C80A5C1ABAD14C8972 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
17:53:26.0270 3916  HdAudAddService - ok
17:53:26.0302 3916  [ 9036377B8A6C15DC2EEC53E489D159B5 ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
17:53:26.0317 3916  HDAudBus - ok
17:53:26.0317 3916  [ 1D58A7F3E11A9731D0EAAAA8405ACC36 ] HidBatt        C:\Windows\system32\DRIVERS\HidBatt.sys
17:53:26.0333 3916  HidBatt - ok
17:53:26.0348 3916  [ 89448F40E6DF260C206A193A4683BA78 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
17:53:26.0380 3916  HidBth - ok
17:53:26.0411 3916  [ CF50B4CF4A4F229B9F3C08351F99CA5E ] HidIr          C:\Windows\system32\DRIVERS\hidir.sys
17:53:26.0411 3916  HidIr - ok
17:53:26.0442 3916  [ 2BC6F6A1992B3A77F5F41432CA6B3B6B ] hidserv        C:\Windows\system32\hidserv.dll
17:53:26.0473 3916  hidserv - ok
17:53:26.0504 3916  [ 10C19F8290891AF023EAEC0832E1EB4D ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
17:53:26.0520 3916  HidUsb - ok
17:53:26.0551 3916  [ 196B4E3F4CCCC24AF836CE58FACBB699 ] hkmsvc          C:\Windows\system32\kmsvc.dll
17:53:26.0582 3916  hkmsvc - ok
17:53:26.0614 3916  [ 6658F4404DE03D75FE3BA09F7ABA6A30 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
17:53:26.0660 3916  HomeGroupListener - ok
17:53:26.0692 3916  [ DBC02D918FFF1CAD628ACBE0C0EAA8E8 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
17:53:26.0723 3916  HomeGroupProvider - ok
17:53:26.0738 3916  [ 295FDC419039090EB8B49FFDBB374549 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
17:53:26.0754 3916  HpSAMD - ok
17:53:26.0785 3916  [ 950CC1E6AE3A6CD23E0945CDE089B02C ] HTCAND32        C:\Windows\system32\Drivers\ANDROIDUSB.sys
17:53:26.0816 3916  HTCAND32 - ok
17:53:26.0848 3916  [ 339ADEFAD60353F960E3CA67CE468C24 ] htcnprot        C:\Windows\system32\DRIVERS\htcnprot.sys
17:53:26.0863 3916  htcnprot - ok
17:53:26.0910 3916  [ 871917B07A141BFF43D76D8844D48106 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
17:53:26.0941 3916  HTTP - ok
17:53:26.0972 3916  [ 0C4E035C7F105F1299258C90886C64C5 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
17:53:26.0988 3916  hwpolicy - ok
17:53:27.0035 3916  [ F151F0BDC47F4A28B1B20A0818EA36D6 ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
17:53:27.0050 3916  i8042prt - ok
17:53:27.0082 3916  [ 5CD5F9A5444E6CDCB0AC89BD62D8B76E ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
17:53:27.0097 3916  iaStorV - ok
17:53:27.0144 3916  [ C521D7EB6497BB1AF6AFA89E322FB43C ] idsvc          C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
17:53:27.0175 3916  idsvc - ok
17:53:27.0206 3916  [ 4173FF5708F3236CF25195FECD742915 ] iirsp          C:\Windows\system32\DRIVERS\iirsp.sys
17:53:27.0222 3916  iirsp - ok
17:53:27.0269 3916  [ F95622F161474511B8D80D6B093AA610 ] IKEEXT          C:\Windows\System32\ikeext.dll
17:53:27.0316 3916  IKEEXT - ok
17:53:27.0409 3916  [ B35F19AFF279E08B567B281FB2E94291 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
17:53:27.0456 3916  IntcAzAudAddService - ok
17:53:27.0472 3916  [ A0F12F2C9BA6C72F3987CE780E77C130 ] intelide        C:\Windows\system32\drivers\intelide.sys
17:53:27.0487 3916  intelide - ok
17:53:27.0518 3916  [ 3B514D27BFC4ACCB4037BC6685F766E0 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
17:53:27.0534 3916  intelppm - ok
17:53:27.0565 3916  [ ACB364B9075A45C0736E5C47BE5CAE19 ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
17:53:27.0596 3916  IPBusEnum - ok
17:53:27.0596 3916  [ 709D1761D3B19A932FF0238EA6D50200 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
17:53:27.0643 3916  IpFilterDriver - ok
17:53:27.0690 3916  [ 4D65A07B795D6674312F879D09AA7663 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
17:53:27.0721 3916  iphlpsvc - ok
17:53:27.0752 3916  [ 4BD7134618C1D2A27466A099062547BF ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
17:53:27.0784 3916  IPMIDRV - ok
17:53:27.0799 3916  [ A5FA468D67ABCDAA36264E463A7BB0CD ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
17:53:27.0846 3916  IPNAT - ok
17:53:27.0924 3916  [ E6BE7A41A28D8F2DB174957454D32448 ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe
17:53:27.0940 3916  iPod Service - ok
17:53:27.0971 3916  [ 42996CFF20A3084A56017B7902307E9F ] IRENUM          C:\Windows\system32\drivers\irenum.sys
17:53:27.0986 3916  IRENUM - ok
17:53:28.0018 3916  [ 1F32BB6B38F62F7DF1A7AB7292638A35 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
17:53:28.0033 3916  isapnp - ok
17:53:28.0049 3916  [ CB7A9ABB12B8415BCE5D74994C7BA3AE ] iScsiPrt        C:\Windows\system32\DRIVERS\msiscsi.sys
17:53:28.0064 3916  iScsiPrt - ok
17:53:28.0080 3916  [ ADEF52CA1AEAE82B50DF86B56413107E ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
17:53:28.0096 3916  kbdclass - ok
17:53:28.0111 3916  [ 9E3CED91863E6EE98C24794D05E27A71 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
17:53:28.0127 3916  kbdhid - ok
17:53:28.0142 3916  [ 81951F51E318AECC2D68559E47485CC4 ] KeyIso          C:\Windows\system32\lsass.exe
17:53:28.0158 3916  KeyIso - ok
17:53:28.0189 3916  [ 4635935FC972C582632BF45C26BFCB0E ] KMService      C:\Windows\system32\srvany.exe
17:53:28.0205 3916  KMService ( UnsignedFile.Multi.Generic ) - warning
17:53:28.0205 3916  KMService - detected UnsignedFile.Multi.Generic (1)
17:53:28.0236 3916  [ B7895B4182C0D16F6EFADEB8081E8D36 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
17:53:28.0252 3916  KSecDD - ok
17:53:28.0267 3916  [ D30159AC9237519FBC62C6EC247D2D46 ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
17:53:28.0283 3916  KSecPkg - ok
17:53:28.0314 3916  [ 89A7B9CC98D0D80C6F31B91C0A310FCD ] KtmRm          C:\Windows\system32\msdtckrm.dll
17:53:28.0345 3916  KtmRm - ok
17:53:28.0361 3916  [ D64AF876D53ECA3668BB97B51B4E70AB ] LanmanServer    C:\Windows\system32\srvsvc.dll
17:53:28.0392 3916  LanmanServer - ok
17:53:28.0408 3916  [ 58405E4F68BA8E4057C6E914F326ABA2 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
17:53:28.0439 3916  LanmanWorkstation - ok
17:53:28.0517 3916  [ 910344E2A984010435AE84783B25E5EB ] LBTServ        C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
17:53:28.0532 3916  LBTServ - ok
17:53:28.0579 3916  [ 01CC7FB6E790EF044B411377F3A1FF41 ] LHidFilt        C:\Windows\system32\DRIVERS\LHidFilt.Sys
17:53:28.0579 3916  LHidFilt - ok
17:53:28.0610 3916  [ F7611EC07349979DA9B0AE1F18CCC7A6 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
17:53:28.0642 3916  lltdio - ok
17:53:28.0673 3916  [ 5700673E13A2117FA3B9020C852C01E2 ] lltdsvc        C:\Windows\System32\lltdsvc.dll
17:53:28.0704 3916  lltdsvc - ok
17:53:28.0704 3916  [ 55CA01BA19D0006C8F2639B6C045E08B ] lmhosts        C:\Windows\System32\lmhsvc.dll
17:53:28.0751 3916  lmhosts - ok
17:53:28.0766 3916  [ A2E7EAE8898D7B4B8C302B8F4E836BB5 ] LMouFilt        C:\Windows\system32\DRIVERS\LMouFilt.Sys
17:53:28.0766 3916  LMouFilt - ok
17:53:28.0782 3916  [ EB119A53CCF2ACC000AC71B065B78FEF ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
17:53:28.0798 3916  LSI_FC - ok
17:53:28.0813 3916  [ 8ADE1C877256A22E49B75D1CC9161F9C ] LSI_SAS        C:\Windows\system32\DRIVERS\lsi_sas.sys
17:53:28.0829 3916  LSI_SAS - ok
17:53:28.0844 3916  [ DC9DC3D3DAA0E276FD2EC262E38B11E9 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
17:53:28.0860 3916  LSI_SAS2 - ok
17:53:28.0860 3916  [ 0A036C7D7CAB643A7F07135AC47E0524 ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
17:53:28.0876 3916  LSI_SCSI - ok
17:53:28.0891 3916  [ 6703E366CC18D3B6E534F5CF7DF39CEE ] luafv          C:\Windows\system32\drivers\luafv.sys
17:53:28.0922 3916  luafv - ok
17:53:28.0969 3916  [ DDFA88E36D5F8DB5FBDBDDDC4969DB0A ] LUsbFilt        C:\Windows\system32\Drivers\LUsbFilt.Sys
17:53:28.0985 3916  LUsbFilt - ok
17:53:29.0016 3916  [ BFB9EE8EE977EFE85D1A3105ABEF6DD1 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
17:53:29.0032 3916  Mcx2Svc - ok
17:53:29.0047 3916  [ 0FFF5B045293002AB38EB1FD1FC2FB74 ] megasas        C:\Windows\system32\DRIVERS\megasas.sys
17:53:29.0063 3916  megasas - ok
17:53:29.0078 3916  [ DCBAB2920C75F390CAF1D29F675D03D6 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
17:53:29.0094 3916  MegaSR - ok
17:53:29.0156 3916  Microsoft SharePoint Workspace Audit Service - ok
17:53:29.0188 3916  [ 146B6F43A673379A3C670E86D89BE5EA ] MMCSS          C:\Windows\system32\mmcss.dll
17:53:29.0219 3916  MMCSS - ok
17:53:29.0234 3916  [ F001861E5700EE84E2D4E52C712F4964 ] Modem          C:\Windows\system32\drivers\modem.sys
17:53:29.0266 3916  Modem - ok
17:53:29.0281 3916  [ 79D10964DE86B292320E9DFE02282A23 ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
17:53:29.0297 3916  monitor - ok
17:53:29.0344 3916  [ FB18CC1D4C2E716B6B903B0AC0CC0609 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
17:53:29.0359 3916  mouclass - ok
17:53:29.0375 3916  [ 2C388D2CD01C9042596CF3C8F3C7B24D ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
17:53:29.0406 3916  mouhid - ok
17:53:29.0437 3916  [ FC8771F45ECCCFD89684E38842539B9B ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
17:53:29.0437 3916  mountmgr - ok
17:53:29.0500 3916  [ CB8AF049AC9BE419A77ADAE288673359 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
17:53:29.0515 3916  MozillaMaintenance - ok
17:53:29.0531 3916  [ 2D699FB6E89CE0D8DA14ECC03B3EDFE0 ] mpio            C:\Windows\system32\drivers\mpio.sys
17:53:29.0531 3916  mpio - ok
17:53:29.0546 3916  [ AD2723A7B53DD1AACAE6AD8C0BFBF4D0 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
17:53:29.0578 3916  mpsdrv - ok
17:53:29.0624 3916  [ 9835584E999D25004E1EE8E5F3E3B881 ] MpsSvc          C:\Windows\system32\mpssvc.dll
17:53:29.0671 3916  MpsSvc - ok
17:53:29.0702 3916  [ CEB46AB7C01C9F825F8CC6BABC18166A ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
17:53:29.0718 3916  MRxDAV - ok
17:53:29.0765 3916  [ 5D16C921E3671636C0EBA3BBAAC5FD25 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
17:53:29.0780 3916  mrxsmb - ok
17:53:29.0812 3916  [ 6D17A4791ACA19328C685D256349FEFC ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
17:53:29.0827 3916  mrxsmb10 - ok
17:53:29.0843 3916  [ B81F204D146000BE76651A50670A5E9E ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
17:53:29.0858 3916  mrxsmb20 - ok
17:53:29.0890 3916  [ 012C5F4E9349E711E11E0F19A8589F0A ] msahci          C:\Windows\system32\drivers\msahci.sys
17:53:29.0905 3916  msahci - ok
17:53:29.0905 3916  [ 55055F8AD8BE27A64C831322A780A228 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
17:53:29.0921 3916  msdsm - ok
17:53:29.0936 3916  [ E1BCE74A3BD9902B72599C0192A07E27 ] MSDTC          C:\Windows\System32\msdtc.exe
17:53:29.0968 3916  MSDTC - ok
17:53:29.0999 3916  [ DAEFB28E3AF5A76ABCC2C3078C07327F ] Msfs            C:\Windows\system32\drivers\Msfs.sys
17:53:30.0014 3916  Msfs - ok
17:53:30.0030 3916  [ 3E1E5767043C5AF9367F0056295E9F84 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
17:53:30.0061 3916  mshidkmdf - ok
17:53:30.0077 3916  [ 0A4E5757AE09FA9622E3158CC1AEF114 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
17:53:30.0092 3916  msisadrv - ok
17:53:30.0124 3916  [ 90F7D9E6B6F27E1A707D4A297F077828 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
17:53:30.0155 3916  MSiSCSI - ok
17:53:30.0170 3916  msiserver - ok
17:53:30.0186 3916  [ 8C0860D6366AAFFB6C5BB9DF9448E631 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
17:53:30.0217 3916  MSKSSRV - ok
17:53:30.0233 3916  [ 3EA8B949F963562CEDBB549EAC0C11CE ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
17:53:30.0264 3916  MSPCLOCK - ok
17:53:30.0280 3916  [ F456E973590D663B1073E9C463B40932 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
17:53:30.0311 3916  MSPQM - ok
17:53:30.0326 3916  [ 0E008FC4819D238C51D7C93E7B41E560 ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
17:53:30.0342 3916  MsRPC - ok
17:53:30.0373 3916  [ FC6B9FF600CC585EA38B12589BD4E246 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
17:53:30.0389 3916  mssmbios - ok
17:53:30.0404 3916  [ B42C6B921F61A6E55159B8BE6CD54A36 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
17:53:30.0420 3916  MSTEE - ok
17:53:30.0436 3916  [ 33599130F44E1F34631CEA241DE8AC84 ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
17:53:30.0436 3916  MTConfig - ok
17:53:30.0451 3916  [ 159FAD02F64E6381758C990F753BCC80 ] Mup            C:\Windows\system32\Drivers\mup.sys
17:53:30.0467 3916  Mup - ok
17:53:30.0498 3916  [ 61D57A5D7C6D9AFE10E77DAE6E1B445E ] napagent        C:\Windows\system32\qagentRT.dll
17:53:30.0529 3916  napagent - ok
17:53:30.0560 3916  [ 26384429FCD85D83746F63E798AB1480 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
17:53:30.0576 3916  NativeWifiP - ok
17:53:30.0592 3916  [ E7C54812A2AAF43316EB6930C1FFA108 ] NDIS            C:\Windows\system32\drivers\ndis.sys
17:53:30.0607 3916  NDIS - ok
17:53:30.0623 3916  [ 0E1787AA6C9191D3D319E8BAFE86F80C ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
17:53:30.0654 3916  NdisCap - ok
17:53:30.0685 3916  [ E4A8AEC125A2E43A9E32AFEEA7C9C888 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
17:53:30.0716 3916  NdisTapi - ok
17:53:30.0763 3916  [ D8A65DAFB3EB41CBB622745676FCD072 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
17:53:30.0794 3916  Ndisuio - ok
17:53:30.0841 3916  [ 38FBE267E7E6983311179230FACB1017 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
17:53:30.0888 3916  NdisWan - ok
17:53:30.0904 3916  [ A4BDC541E69674FBFF1A8FF00BE913F2 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
17:53:30.0950 3916  NDProxy - ok
17:53:31.0013 3916  [ 80B275B1CE3B0E79909DB7B39AF74D51 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
17:53:31.0075 3916  NetBIOS - ok
17:53:31.0106 3916  [ 280122DDCF04B378EDD1AD54D71C1E54 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
17:53:31.0138 3916  NetBT - ok
17:53:31.0153 3916  [ 81951F51E318AECC2D68559E47485CC4 ] Netlogon        C:\Windows\system32\lsass.exe
17:53:31.0169 3916  Netlogon - ok
17:53:31.0200 3916  [ 7CCCFCA7510684768DA22092D1FA4DB2 ] Netman          C:\Windows\System32\netman.dll
17:53:31.0231 3916  Netman - ok
17:53:31.0278 3916  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
17:53:31.0294 3916  NetMsmqActivator - ok
17:53:31.0294 3916  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
17:53:31.0309 3916  NetPipeActivator - ok
17:53:31.0325 3916  [ 8C338238C16777A802D6A9211EB2BA50 ] netprofm        C:\Windows\System32\netprofm.dll
17:53:31.0372 3916  netprofm - ok
17:53:31.0372 3916  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
17:53:31.0387 3916  NetTcpActivator - ok
17:53:31.0387 3916  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
17:53:31.0403 3916  NetTcpPortSharing - ok
17:53:31.0434 3916  [ 1D85C4B390B0EE09C7A46B91EFB2C097 ] nfrd960        C:\Windows\system32\DRIVERS\nfrd960.sys
17:53:31.0450 3916  nfrd960 - ok
17:53:31.0481 3916  [ 912084381D30D8B89EC4E293053F4710 ] NlaSvc          C:\Windows\System32\nlasvc.dll
17:53:31.0512 3916  NlaSvc - ok
17:53:31.0528 3916  [ 1DB262A9F8C087E8153D89BEF3D2235F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
17:53:31.0559 3916  Npfs - ok
17:53:31.0574 3916  [ BA387E955E890C8A88306D9B8D06BF17 ] nsi            C:\Windows\system32\nsisvc.dll
17:53:31.0606 3916  nsi - ok
17:53:31.0606 3916  [ E9A0A4D07E53D8FEA2BB8387A3293C58 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
17:53:31.0637 3916  nsiproxy - ok
17:53:31.0684 3916  [ 81189C3D7763838E55C397759D49007A ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
17:53:31.0715 3916  Ntfs - ok
17:53:31.0730 3916  [ F9756A98D69098DCA8945D62858A812C ] Null            C:\Windows\system32\drivers\Null.sys
17:53:31.0777 3916  Null - ok
17:53:31.0808 3916  [ B5E37E31C053BC9950455A257526514B ] NVENETFD        C:\Windows\system32\DRIVERS\nvm62x32.sys
17:53:31.0840 3916  NVENETFD - ok
17:53:31.0886 3916  [ A0A9E53B4AAC3C6534A063ABA69BC19F ] NVHDA          C:\Windows\system32\drivers\nvhda32v.sys
17:53:31.0902 3916  NVHDA - ok
17:53:32.0105 3916  [ AFB33A823AABC112FC7BD62AFBCDB0CD ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
17:53:32.0276 3916  nvlddmkm - ok
17:53:32.0323 3916  [ 0219B05730635FCAB3A9925D3374C464 ] NVNET          C:\Windows\system32\DRIVERS\nvmf6232.sys
17:53:32.0339 3916  NVNET - ok
17:53:32.0386 3916  [ B3E25EE28883877076E0E1FF877D02E0 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
17:53:32.0401 3916  nvraid - ok
17:53:32.0432 3916  [ 02A9F366BCB94B286E34825B2094CB38 ] nvsmu          C:\Windows\system32\DRIVERS\nvsmu.sys
17:53:32.0448 3916  nvsmu - ok
17:53:32.0464 3916  [ 4380E59A170D88C4F1022EFF6719A8A4 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
17:53:32.0479 3916  nvstor - ok
17:53:32.0526 3916  [ 782945716AD010AC3D41758E8E52C735 ] nvsvc          C:\Windows\system32\nvvsvc.exe
17:53:32.0542 3916  nvsvc - ok
17:53:32.0620 3916  [ A974E5C310B9B00894070CEB055D467F ] nvUpdatusService C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
17:53:32.0651 3916  nvUpdatusService - ok
17:53:32.0682 3916  [ 5A0983915F02BAE73267CC2A041F717D ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
17:53:32.0698 3916  nv_agp - ok
17:53:32.0713 3916  [ 08A70A1F2CDDE9BB49B885CB817A66EB ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
17:53:32.0744 3916  ohci1394 - ok
17:53:32.0791 3916  [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose            C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
17:53:32.0791 3916  ose - ok
17:53:32.0947 3916  [ 358A9CCA612C68EB2F07DDAD4CE1D8D7 ] osppsvc        C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
17:53:33.0041 3916  osppsvc - ok
17:53:33.0072 3916  [ 82A8521DDC60710C3D3D3E7325209BEC ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
17:53:33.0103 3916  p2pimsvc - ok
17:53:33.0134 3916  [ 59C3DDD501E39E006DAC31BF55150D91 ] p2psvc          C:\Windows\system32\p2psvc.dll
17:53:33.0150 3916  p2psvc - ok
17:53:33.0181 3916  [ 2EA877ED5DD9713C5AC74E8EA7348D14 ] Parport        C:\Windows\system32\DRIVERS\parport.sys
17:53:33.0197 3916  Parport - ok
17:53:33.0228 3916  [ 3F34A1B4C5F6475F320C275E63AFCE9B ] partmgr        C:\Windows\system32\drivers\partmgr.sys
17:53:33.0244 3916  partmgr - ok
17:53:33.0259 3916  [ EB0A59F29C19B86479D36B35983DAADC ] Parvdm          C:\Windows\system32\DRIVERS\parvdm.sys
17:53:33.0275 3916  Parvdm - ok
17:53:33.0306 3916  [ AFADA8B97BE3C9398DC6C770409C3544 ] PassThru Service C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
17:53:33.0322 3916  PassThru Service ( UnsignedFile.Multi.Generic ) - warning
17:53:33.0322 3916  PassThru Service - detected UnsignedFile.Multi.Generic (1)
17:53:33.0353 3916  [ 358AB7956D3160000726574083DFC8A6 ] PcaSvc          C:\Windows\System32\pcasvc.dll
17:53:33.0368 3916  PcaSvc - ok
17:53:33.0384 3916  [ 673E55C3498EB970088E812EA820AA8F ] pci            C:\Windows\system32\drivers\pci.sys
17:53:33.0384 3916  pci - ok
17:53:33.0431 3916  [ AFE86F419014DB4E5593F69FFE26CE0A ] pciide          C:\Windows\system32\drivers\pciide.sys
17:53:33.0431 3916  pciide - ok
17:53:33.0462 3916  [ F396431B31693E71E8A80687EF523506 ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
17:53:33.0462 3916  pcmcia - ok
17:53:33.0493 3916  [ 250F6B43D2B613172035C6747AEEB19F ] pcw            C:\Windows\system32\drivers\pcw.sys
17:53:33.0509 3916  pcw - ok
17:53:33.0540 3916  [ 9E0104BA49F4E6973749A02BF41344ED ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
17:53:33.0571 3916  PEAUTH - ok
17:53:33.0634 3916  [ AF4D64D2A57B9772CF3801950B8058A6 ] PeerDistSvc    C:\Windows\system32\peerdistsvc.dll
17:53:33.0680 3916  PeerDistSvc - ok
17:53:33.0743 3916  [ 414BBA67A3DED1D28437EB66AEB8A720 ] pla            C:\Windows\system32\pla.dll
17:53:33.0805 3916  pla - ok
17:53:33.0836 3916  [ EC7BC28D207DA09E79B3E9FAF8B232CA ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
17:53:33.0868 3916  PlugPlay - ok
17:53:33.0883 3916  [ 63FF8572611249931EB16BB8EED6AFC8 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
17:53:33.0914 3916  PNRPAutoReg - ok
17:53:33.0930 3916  [ 82A8521DDC60710C3D3D3E7325209BEC ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
17:53:33.0946 3916  PNRPsvc - ok
17:53:33.0961 3916  [ 53946B69BA0836BD95B03759530C81EC ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
17:53:34.0008 3916  PolicyAgent - ok
17:53:34.0024 3916  [ F87D30E72E03D579A5199CCB3831D6EA ] Power          C:\Windows\system32\umpo.dll
17:53:34.0055 3916  Power - ok
17:53:34.0070 3916  [ 631E3E205AD6D86F2AED6A4A8E69F2DB ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
17:53:34.0102 3916  PptpMiniport - ok
17:53:34.0117 3916  [ 85B1E3A0C7585BC4AAE6899EC6FCF011 ] Processor      C:\Windows\system32\DRIVERS\processr.sys
17:53:34.0148 3916  Processor - ok
17:53:34.0180 3916  [ CADEFAC453040E370A1BDFF3973BE00D ] ProfSvc        C:\Windows\system32\profsvc.dll
17:53:34.0211 3916  ProfSvc - ok
17:53:34.0226 3916  [ 81951F51E318AECC2D68559E47485CC4 ] ProtectedStorage C:\Windows\system32\lsass.exe
17:53:34.0242 3916  ProtectedStorage - ok
17:53:34.0258 3916  [ 6270CCAE2A86DE6D146529FE55B3246A ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
17:53:34.0289 3916  Psched - ok
17:53:34.0336 3916  [ AB95ECF1F6659A60DDC166D8315B0751 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
17:53:34.0382 3916  ql2300 - ok
17:53:34.0382 3916  [ B4DD51DD25182244B86737DC51AF2270 ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
17:53:34.0398 3916  ql40xx - ok
17:53:34.0429 3916  [ 31AC809E7707EB580B2BDB760390765A ] QWAVE          C:\Windows\system32\qwave.dll
17:53:34.0460 3916  QWAVE - ok
17:53:34.0492 3916  [ 584078CA1B95CA72DF2A27C336F9719D ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
17:53:34.0507 3916  QWAVEdrv - ok
17:53:34.0554 3916  [ 8F97D374AD1857E1EED85A79F29A1D3D ] RapiMgr        C:\Windows\WindowsMobile\rapimgr.dll
17:53:34.0570 3916  RapiMgr - ok
17:53:34.0570 3916  [ 30A81B53C766D0133BB86D234E5556AB ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
17:53:34.0616 3916  RasAcd - ok
17:53:34.0648 3916  [ 57EC4AEF73660166074D8F7F31C0D4FD ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
17:53:34.0694 3916  RasAgileVpn - ok
17:53:34.0726 3916  [ A60F1839849C0C00739787FD5EC03F13 ] RasAuto        C:\Windows\System32\rasauto.dll
17:53:34.0757 3916  RasAuto - ok
17:53:34.0757 3916  [ D9F91EAFEC2815365CBE6D167E4E332A ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
17:53:34.0788 3916  Rasl2tp - ok
17:53:34.0835 3916  [ CB9E04DC05EACF5B9A36CA276D475006 ] RasMan          C:\Windows\System32\rasmans.dll
17:53:34.0866 3916  RasMan - ok
17:53:34.0882 3916  [ 0FE8B15916307A6AC12BFB6A63E45507 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
17:53:34.0913 3916  RasPppoe - ok
17:53:34.0928 3916  [ 44101F495A83EA6401D886E7FD70096B ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
17:53:34.0975 3916  RasSstp - ok
17:53:34.0991 3916  [ D528BC58A489409BA40334EBF96A311B ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
17:53:35.0022 3916  rdbss - ok
17:53:35.0038 3916  [ 0D8F05481CB76E70E1DA06EE9F0DA9DF ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
17:53:35.0069 3916  rdpbus - ok
17:53:35.0100 3916  [ 23DAE03F29D253AE74C44F99E515F9A1 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
17:53:35.0116 3916  RDPCDD - ok
17:53:35.0147 3916  [ B973FCFC50DC1434E1970A146F7E3885 ] RDPDR          C:\Windows\system32\drivers\rdpdr.sys
17:53:35.0162 3916  RDPDR - ok
17:53:35.0209 3916  [ 5A53CA1598DD4156D44196D200C94B8A ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
17:53:35.0240 3916  RDPENCDD - ok
17:53:35.0240 3916  [ 44B0A53CD4F27D50ED461DAE0C0B4E1F ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
17:53:35.0272 3916  RDPREFMP - ok
17:53:35.0334 3916  [ 68A0387F58E226DEEE23D9715955572A ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
17:53:35.0365 3916  RdpVideoMiniport - ok
17:53:35.0396 3916  [ F031683E6D1FEA157ABB2FF260B51E61 ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
17:53:35.0428 3916  RDPWD - ok
17:53:35.0459 3916  [ 518395321DC96FE2C9F0E96AC743B656 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
17:53:35.0474 3916  rdyboost - ok
17:53:35.0506 3916  [ 7B5E1419717FAC363A31CC302895217A ] RemoteAccess    C:\Windows\System32\mprdim.dll
17:53:35.0537 3916  RemoteAccess - ok
17:53:35.0568 3916  [ CB9A8683F4EF2BF99E123D79950D7935 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
17:53:35.0599 3916  RemoteRegistry - ok
17:53:35.0630 3916  [ CB928D9E6DAF51879DD6BA8D02F01321 ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
17:53:35.0646 3916  RFCOMM - ok
17:53:35.0646 3916  [ 78D072F35BC45D9E4E1B61895C152234 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
17:53:35.0693 3916  RpcEptMapper - ok
17:53:35.0693 3916  [ 94D36C0E44677DD26981D2BFEEF2A29D ] RpcLocator      C:\Windows\system32\locator.exe
17:53:35.0724 3916  RpcLocator - ok
17:53:35.0740 3916  [ 7660F01D3B38ACA1747E397D21D790AF ] RpcSs          C:\Windows\system32\rpcss.dll
17:53:35.0771 3916  RpcSs - ok
17:53:35.0802 3916  [ 032B0D36AD92B582D869879F5AF5B928 ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
17:53:35.0818 3916  rspndr - ok
17:53:35.0864 3916  [ 247B0A8164069CD4FE6F3094C581B13B ] RSUSBSTOR      C:\Windows\system32\Drivers\RtsUStor.sys
17:53:35.0880 3916  RSUSBSTOR - ok
17:53:35.0911 3916  [ 7FA7F2E249A5DCBB7970630E15E1F482 ] s3cap          C:\Windows\system32\drivers\vms3cap.sys
17:53:35.0927 3916  s3cap - ok
17:53:35.0942 3916  [ 81951F51E318AECC2D68559E47485CC4 ] SamSs          C:\Windows\system32\lsass.exe
17:53:35.0942 3916  SamSs - ok
17:53:35.0989 3916  [ 05D860DA1040F111503AC416CCEF2BCA ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
17:53:36.0005 3916  sbp2port - ok
17:53:36.0036 3916  [ 8FC518FFE9519C2631D37515A68009C4 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
17:53:36.0052 3916  SCardSvr - ok
17:53:36.0067 3916  [ 0693B5EC673E34DC147E195779A4DCF6 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
17:53:36.0098 3916  scfilter - ok
17:53:36.0145 3916  [ A04BB13F8A72F8B6E8B4071723E4E336 ] Schedule        C:\Windows\system32\schedsvc.dll
17:53:36.0192 3916  Schedule - ok
17:53:36.0223 3916  [ 319C6B309773D063541D01DF8AC6F55F ] SCPolicySvc    C:\Windows\System32\certprop.dll
17:53:36.0239 3916  SCPolicySvc - ok
17:53:36.0270 3916  [ 08236C4BCE5EDD0A0318A438AF28E0F7 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
17:53:36.0301 3916  SDRSVC - ok
17:53:36.0332 3916  [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
17:53:36.0364 3916  secdrv - ok
17:53:36.0379 3916  [ A59B3A4442C52060CC7A85293AA3546F ] seclogon        C:\Windows\system32\seclogon.dll
17:53:36.0410 3916  seclogon - ok
17:53:36.0442 3916  [ DCB7FCDCC97F87360F75D77425B81737 ] SENS            C:\Windows\System32\sens.dll
17:53:36.0473 3916  SENS - ok
17:53:36.0473 3916  [ 50087FE1EE447009C9CC2997B90DE53F ] SensrSvc        C:\Windows\system32\sensrsvc.dll
17:53:36.0504 3916  SensrSvc - ok
17:53:36.0520 3916  [ 9AD8B8B515E3DF6ACD4212EF465DE2D1 ] Serenum        C:\Windows\system32\DRIVERS\serenum.sys
17:53:36.0551 3916  Serenum - ok
17:53:36.0566 3916  [ 5FB7FCEA0490D821F26F39CC5EA3D1E2 ] Serial          C:\Windows\system32\DRIVERS\serial.sys
17:53:36.0582 3916  Serial - ok
17:53:36.0598 3916  [ 79BFFB520327FF916A582DFEA17AA813 ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
17:53:36.0613 3916  sermouse - ok
17:53:36.0660 3916  [ 4AE380F39A0032EAB7DD953030B26D28 ] SessionEnv      C:\Windows\system32\sessenv.dll
17:53:36.0691 3916  SessionEnv - ok
17:53:36.0722 3916  [ 9F976E1EB233DF46FCE808D9DEA3EB9C ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
17:53:36.0738 3916  sffdisk - ok
17:53:36.0769 3916  [ 932A68EE27833CFD57C1639D375F2731 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
17:53:36.0785 3916  sffp_mmc - ok
17:53:36.0785 3916  [ 6D4CCAEDC018F1CF52866BBBAA235982 ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
17:53:36.0800 3916  sffp_sd - ok
17:53:36.0816 3916  [ DB96666CC8312EBC45032F30B007A547 ] sfloppy        C:\Windows\system32\DRIVERS\sfloppy.sys
17:53:36.0847 3916  sfloppy - ok
17:53:36.0894 3916  [ 02C41EF0DA7C662C4301F86F2CAA1FCB ] SGDrv          C:\Windows\system32\DRIVERS\SGdrv.sys
17:53:36.0910 3916  SGDrv - ok
17:53:36.0925 3916  [ D1A079A0DE2EA524513B6930C24527A2 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
17:53:36.0956 3916  SharedAccess - ok
17:53:36.0972 3916  [ 414DA952A35BF5D50192E28263B40577 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
17:53:37.0019 3916  ShellHWDetection - ok
17:53:37.0034 3916  [ 2565CAC0DC9FE0371BDCE60832582B2E ] sisagp          C:\Windows\system32\drivers\sisagp.sys
17:53:37.0034 3916  sisagp - ok
17:53:37.0066 3916  [ A9F0486851BECB6DDA1D89D381E71055 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
17:53:37.0081 3916  SiSRaid2 - ok
17:53:37.0097 3916  [ 3727097B55738E2F554972C3BE5BC1AA ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
17:53:37.0097 3916  SiSRaid4 - ok
17:53:37.0128 3916  [ 3E21C083B8A01CB70BA1F09303010FCE ] Smb            C:\Windows\system32\DRIVERS\smb.sys
17:53:37.0159 3916  Smb - ok
17:53:37.0190 3916  [ 6A984831644ECA1A33FFEAE4126F4F37 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
17:53:37.0190 3916  SNMPTRAP - ok
17:53:37.0206 3916  [ 95CF1AE7527FB70F7816563CBC09D942 ] spldr          C:\Windows\system32\drivers\spldr.sys
17:53:37.0222 3916  spldr - ok
17:53:37.0268 3916  [ 9AEA093B8F9C37CF45538382CABA2475 ] Spooler        C:\Windows\System32\spoolsv.exe
17:53:37.0284 3916  Spooler - ok
17:53:37.0378 3916  [ CF87A1DE791347E75B98885214CED2B8 ] sppsvc          C:\Windows\system32\sppsvc.exe
17:53:37.0440 3916  sppsvc - ok
17:53:37.0471 3916  [ B0180B20B065D89232A78A40FE56EAA6 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
17:53:37.0502 3916  sppuinotify - ok
17:53:37.0549 3916  [ E4C2764065D66EA1D2D3EBC28FE99C46 ] srv            C:\Windows\system32\DRIVERS\srv.sys
17:53:37.0565 3916  srv - ok
17:53:37.0580 3916  [ 03F0545BD8D4C77FA0AE1CEEDFCC71AB ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
17:53:37.0612 3916  srv2 - ok
17:53:37.0612 3916  [ BE6BD660CAA6F291AE06A718A4FA8ABC ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
17:53:37.0643 3916  srvnet - ok
17:53:37.0658 3916  [ D887C9FD02AC9FA880F6E5027A43E118 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
17:53:37.0690 3916  SSDPSRV - ok
17:53:37.0721 3916  [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv          C:\Windows\system32\DRIVERS\ssmdrv.sys
17:53:37.0736 3916  ssmdrv - ok
17:53:37.0736 3916  [ D318F23BE45D5E3A107469EB64815B50 ] SstpSvc        C:\Windows\system32\sstpsvc.dll
17:53:37.0768 3916  SstpSvc - ok
17:53:37.0846 3916  [ C354621B6B94E10AE7F5CDBE745FEB86 ] Stereo Service  C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
17:53:37.0861 3916  Stereo Service - ok
17:53:37.0892 3916  [ DB32D325C192B801DF274BFD12A7E72B ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
17:53:37.0908 3916  stexstor - ok
17:53:37.0955 3916  [ E1FB3706030FB4578A0D72C2FC3689E4 ] StiSvc          C:\Windows\System32\wiaservc.dll
17:53:37.0986 3916  StiSvc - ok
17:53:38.0002 3916  [ 472AF0311073DCECEAA8FA18BA2BDF89 ] storflt        C:\Windows\system32\drivers\vmstorfl.sys
17:53:38.0002 3916  storflt - ok
17:53:38.0033 3916  [ DCAFFD62259E0BDB433DD67B5BB37619 ] storvsc        C:\Windows\system32\drivers\storvsc.sys
17:53:38.0048 3916  storvsc - ok
17:53:38.0080 3916  [ E58C78A848ADD9610A4DB6D214AF5224 ] swenum          C:\Windows\system32\drivers\swenum.sys
17:53:38.0095 3916  swenum - ok
17:53:38.0158 3916  [ F577910A133A592234EBAAD3F3AFA258 ] SwitchBoard    C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
17:53:38.0189 3916  SwitchBoard ( UnsignedFile.Multi.Generic ) - warning
17:53:38.0189 3916  SwitchBoard - detected UnsignedFile.Multi.Generic (1)
17:53:38.0204 3916  [ A28BD92DF340E57B024BA433165D34D7 ] swprv          C:\Windows\System32\swprv.dll
17:53:38.0236 3916  swprv - ok
17:53:38.0251 3916  Synth3dVsc - ok
17:53:38.0298 3916  [ 36650D618CA34C9D357DFD3D89B2C56F ] SysMain        C:\Windows\system32\sysmain.dll
17:53:38.0329 3916  SysMain - ok
17:53:38.0360 3916  [ 763FECDC3D30C815FE72DD57936C6CD1 ] TabletInputService C:\Windows\System32\TabSvc.dll
17:53:38.0392 3916  TabletInputService - ok
17:53:38.0423 3916  [ 613BF4820361543956909043A265C6AC ] TapiSrv        C:\Windows\System32\tapisrv.dll
17:53:38.0454 3916  TapiSrv - ok
17:53:38.0454 3916  [ B799D9FDB26111737F58288D8DC172D9 ] TBS            C:\Windows\System32\tbssvc.dll
17:53:38.0485 3916  TBS - ok
17:53:38.0563 3916  [ 7FA2E0F8B072BD04B77B421480B6CC22 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
17:53:38.0594 3916  Tcpip - ok
17:53:38.0626 3916  [ 7FA2E0F8B072BD04B77B421480B6CC22 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
17:53:38.0657 3916  TCPIP6 - ok
17:53:38.0688 3916  [ CCA24162E055C3714CE5A88B100C64ED ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
17:53:38.0735 3916  tcpipreg - ok
17:53:38.0766 3916  [ 1CB91B2BD8F6DD367DFC2EF26FD751B2 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
17:53:38.0797 3916  TDPIPE - ok
17:53:38.0813 3916  [ 2C2C5AFE7EE4F620D69C23C0617651A8 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
17:53:38.0844 3916  TDTCP - ok
17:53:38.0860 3916  [ B459575348C20E8121D6039DA063C704 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
17:53:38.0906 3916  tdx - ok
17:53:38.0922 3916  [ 04DBF4B01EA4BF25A9A3E84AFFAC9B20 ] TermDD          C:\Windows\system32\drivers\termdd.sys
17:53:38.0922 3916  TermDD - ok
17:53:38.0969 3916  [ 382C804C92811BE57829D8E550A900E2 ] TermService    C:\Windows\System32\termsrv.dll
17:53:39.0016 3916  TermService - ok
17:53:39.0031 3916  [ 42FB6AFD6B79D9FE07381609172E7CA4 ] Themes          C:\Windows\system32\themeservice.dll
17:53:39.0062 3916  Themes - ok
17:53:39.0078 3916  [ 146B6F43A673379A3C670E86D89BE5EA ] THREADORDER    C:\Windows\system32\mmcss.dll
17:53:39.0094 3916  THREADORDER - ok
17:53:39.0109 3916  [ 4792C0378DB99A9BC2AE2DE6CFFF0C3A ] TrkWks          C:\Windows\System32\trkwks.dll
17:53:39.0140 3916  TrkWks - ok
17:53:39.0187 3916  [ 2C49B175AEE1D4364B91B531417FE583 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
17:53:39.0218 3916  TrustedInstaller - ok
17:53:39.0250 3916  [ 254BB140EEE3C59D6114C1A86B636877 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
17:53:39.0281 3916  tssecsrv - ok
17:53:39.0312 3916  [ FD1D6C73E6333BE727CBCC6054247654 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
17:53:39.0359 3916  TsUsbFlt - ok
17:53:39.0359 3916  tsusbhub - ok
17:53:39.0390 3916  [ B2FA25D9B17A68BB93D58B0556E8C90D ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
17:53:39.0421 3916  tunnel - ok
17:53:39.0499 3916  [ 3338B908F6383053D956229A1EB2F6A3 ] tvnserver      C:\Program Files\TightVNC\tvnserver.exe
17:53:39.0530 3916  tvnserver - ok
17:53:39.0546 3916  [ 750FBCB269F4D7DD2E420C56B795DB6D ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
17:53:39.0562 3916  uagp35 - ok
17:53:39.0577 3916  [ EE43346C7E4B5E63E54F927BABBB32FF ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
17:53:39.0608 3916  udfs - ok
17:53:39.0640 3916  [ 8344FD4FCE927880AA1AA7681D4927E5 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
17:53:39.0655 3916  UI0Detect - ok
17:53:39.0702 3916  [ 44E8048ACE47BEFBFDC2E9BE4CBC8880 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
17:53:39.0702 3916  uliagpkx - ok
17:53:39.0749 3916  [ 5A5BD0F66E84EB039CB227520D49908C ] UltraMonUtility C:\Program Files\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys
17:53:39.0749 3916  UltraMonUtility - ok
17:53:39.0780 3916  [ D295BED4B898F0FD999FCFA9B32B071B ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
17:53:39.0780 3916  umbus - ok
17:53:39.0811 3916  [ 7550AD0C6998BA1CB4843E920EE0FEAC ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
17:53:39.0842 3916  UmPass - ok
17:53:39.0874 3916  [ 409994A8EACEEE4E328749C0353527A0 ] UmRdpService    C:\Windows\System32\umrdp.dll
17:53:39.0905 3916  UmRdpService - ok
17:53:39.0936 3916  [ 833FBB672460EFCE8011D262175FAD33 ] upnphost        C:\Windows\System32\upnphost.dll
17:53:39.0967 3916  upnphost - ok
17:53:40.0014 3916  [ EAFE1E00739AFE6C51487A050E772E17 ] USBAAPL        C:\Windows\system32\Drivers\usbaapl.sys
17:53:40.0030 3916  USBAAPL - ok
17:53:40.0045 3916  [ BD9C55D7023C5DE374507ACC7A14E2AC ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
17:53:40.0061 3916  usbccgp - ok
17:53:40.0092 3916  [ 04EC7CEC62EC3B6D9354EEE93327FC82 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
17:53:40.0108 3916  usbcir - ok
17:53:40.0123 3916  [ F92DE757E4B7CE9C07C5E65423F3AE3B ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
17:53:40.0139 3916  usbehci - ok
17:53:40.0154 3916  [ 8DC94AEC6A7E644A06135AE7506DC2E9 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
17:53:40.0186 3916  usbhub - ok
17:53:40.0186 3916  [ E185D44FAC515A18D9DEDDC23C2CDF44 ] usbohci        C:\Windows\system32\DRIVERS\usbohci.sys
17:53:40.0217 3916  usbohci - ok
17:53:40.0232 3916  [ 797D862FE0875E75C7CC4C1AD7B30252 ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
17:53:40.0248 3916  usbprint - ok
17:53:40.0264 3916  [ F991AB9CC6B908DB552166768176896A ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
17:53:40.0279 3916  USBSTOR - ok
17:53:40.0279 3916  [ 68DF884CF41CDADA664BEB01DAF67E3D ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
17:53:40.0295 3916  usbuhci - ok
17:53:40.0310 3916  [ 081E6E1C91AEC36758902A9F727CD23C ] UxSms          C:\Windows\System32\uxsms.dll
17:53:40.0357 3916  UxSms - ok
17:53:40.0373 3916  [ 81951F51E318AECC2D68559E47485CC4 ] VaultSvc        C:\Windows\system32\lsass.exe
17:53:40.0373 3916  VaultSvc - ok
17:53:40.0420 3916  [ A059C4C3EDB09E07D21A8E5C0AABD3CB ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
17:53:40.0420 3916  vdrvroot - ok
17:53:40.0466 3916  [ C3CD30495687C2A2F66A65CA6FD89BE9 ] vds            C:\Windows\System32\vds.exe
17:53:40.0513 3916  vds - ok
17:53:40.0529 3916  [ 17C408214EA61696CEC9C66E388B14F3 ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
17:53:40.0544 3916  vga - ok
17:53:40.0560 3916  [ 8E38096AD5C8570A6F1570A61E251561 ] VgaSave        C:\Windows\System32\drivers\vga.sys
17:53:40.0576 3916  VgaSave - ok
17:53:40.0591 3916  VGPU - ok
17:53:40.0607 3916  [ 5461686CCA2FDA57B024547733AB42E3 ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
17:53:40.0607 3916  vhdmp - ok
17:53:40.0638 3916  [ C829317A37B4BEA8F39735D4B076E923 ] viaagp          C:\Windows\system32\drivers\viaagp.sys
17:53:40.0654 3916  viaagp - ok
17:53:40.0669 3916  [ E02F079A6AA107F06B16549C6E5C7B74 ] ViaC7          C:\Windows\system32\DRIVERS\viac7.sys
17:53:40.0685 3916  ViaC7 - ok
17:53:40.0716 3916  [ E43574F6A56A0EE11809B48C09E4FD3C ] viaide          C:\Windows\system32\drivers\viaide.sys
17:53:40.0732 3916  viaide - ok
17:53:40.0732 3916  [ C2F2911156FDC7817C52829C86DA494E ] vmbus          C:\Windows\system32\drivers\vmbus.sys
17:53:40.0747 3916  vmbus - ok
17:53:40.0763 3916  [ D4D77455211E204F370D08F4963063CE ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
17:53:40.0778 3916  VMBusHID - ok
17:53:40.0825 3916  [ 3B8F222B23917C041E4DA29CCC57E7D0 ] vncmirror      C:\Windows\system32\DRIVERS\vncmirror.sys
17:53:40.0856 3916  vncmirror - ok
17:53:40.0872 3916  [ 4C63E00F2F4B5F86AB48A58CD990F212 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
17:53:40.0888 3916  volmgr - ok
17:53:40.0919 3916  [ B5BB72067DDDDBBFB04B2F89FF8C3C87 ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
17:53:40.0934 3916  volmgrx - ok
17:53:40.0966 3916  [ F497F67932C6FA693D7DE2780631CFE7 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
17:53:40.0981 3916  volsnap - ok
17:53:41.0012 3916  [ 9DFA0CC2F8855A04816729651175B631 ] vsmraid        C:\Windows\system32\DRIVERS\vsmraid.sys
17:53:41.0028 3916  vsmraid - ok
17:53:41.0075 3916  [ 209A3B1901B83AEB8527ED211CCE9E4C ] VSS            C:\Windows\system32\vssvc.exe
17:53:41.0122 3916  VSS - ok
17:53:41.0137 3916  [ 90567B1E658001E79D7C8BBD3DDE5AA6 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
17:53:41.0153 3916  vwifibus - ok
17:53:41.0184 3916  [ 55187FD710E27D5095D10A472C8BAF1C ] W32Time        C:\Windows\system32\w32time.dll
17:53:41.0231 3916  W32Time - ok
17:53:41.0246 3916  [ DE3721E89C653AA281428C8A69745D90 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
17:53:41.0262 3916  WacomPen - ok
17:53:41.0309 3916  [ 3C3C78515F5AB448B022BDF5B8FFDD2E ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
17:53:41.0324 3916  WANARP - ok
17:53:41.0324 3916  [ 3C3C78515F5AB448B022BDF5B8FFDD2E ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
17:53:41.0356 3916  Wanarpv6 - ok
17:53:41.0418 3916  [ 691E3285E53DCA558E1A84667F13E15A ] wbengine        C:\Windows\system32\wbengine.exe
17:53:41.0465 3916  wbengine - ok
17:53:41.0480 3916  [ 9614B5D29DC76AC3C29F6D2D3AA70E67 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
17:53:41.0512 3916  WbioSrvc - ok
17:53:41.0605 3916  [ 59E19BD13C3BDB857646B9E436BA27F7 ] WcesComm        C:\Windows\WindowsMobile\wcescomm.dll
17:53:41.0652 3916  WcesComm - ok
17:53:41.0824 3916  [ 34EEE0DFAADB4F691D6D5308A51315DC ] wcncsvc        C:\Windows\System32\wcncsvc.dll
17:53:41.0855 3916  wcncsvc - ok
17:53:41.0870 3916  [ 5D930B6357A6D2AF4D7653BDABBF352F ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
17:53:41.0902 3916  WcsPlugInService - ok
17:53:41.0933 3916  [ 1112A9BADACB47B7C0BB0392E3158DFF ] Wd              C:\Windows\system32\DRIVERS\wd.sys
17:53:41.0933 3916  Wd - ok
17:53:41.0948 3916  [ 9950E3D0F08141C7E89E64456AE7DC73 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
17:53:41.0980 3916  Wdf01000 - ok
17:53:41.0995 3916  [ 46EF9DC96265FD0B423DB72E7C38C2A5 ] WdiServiceHost  C:\Windows\system32\wdi.dll
17:53:42.0026 3916  WdiServiceHost - ok
17:53:42.0042 3916  [ 46EF9DC96265FD0B423DB72E7C38C2A5 ] WdiSystemHost  C:\Windows\system32\wdi.dll
17:53:42.0058 3916  WdiSystemHost - ok
17:53:42.0089 3916  [ A9D880F97530D5B8FEE278923349929D ] WebClient      C:\Windows\System32\webclnt.dll
17:53:42.0120 3916  WebClient - ok
17:53:42.0151 3916  [ 760F0AFE937A77CFF27153206534F275 ] Wecsvc          C:\Windows\system32\wecsvc.dll
17:53:42.0167 3916  Wecsvc - ok
17:53:42.0182 3916  [ AC804569BB2364FB6017370258A4091B ] wercplsupport  C:\Windows\System32\wercplsupport.dll
17:53:42.0214 3916  wercplsupport - ok
17:53:42.0229 3916  [ 08E420D873E4FD85241EE2421B02C4A4 ] WerSvc          C:\Windows\System32\WerSvc.dll
17:53:42.0276 3916  WerSvc - ok
17:53:42.0292 3916  [ 8B9A943F3B53861F2BFAF6C186168F79 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
17:53:42.0307 3916  WfpLwf - ok
17:53:42.0323 3916  [ 5CF95B35E59E2A38023836FFF31BE64C ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
17:53:42.0338 3916  WIMMount - ok
17:53:42.0385 3916  [ 3FAE8F94296001C32EAB62CD7D82E0FD ] WinDefend      C:\Program Files\Windows Defender\mpsvc.dll
17:53:42.0416 3916  WinDefend - ok
17:53:42.0416 3916  WinHttpAutoProxySvc - ok
17:53:42.0479 3916  [ F62E510B6AD4C21EB9FE8668ED251826 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
17:53:42.0494 3916  Winmgmt - ok
17:53:42.0557 3916  [ 1B91CD34EA3A90AB6A4EF0550174F4CC ] WinRM          C:\Windows\system32\WsmSvc.dll
17:53:42.0604 3916  WinRM - ok
17:53:42.0666 3916  [ A67E5F9A400F3BD1BE3D80613B45F708 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
17:53:42.0682 3916  WinUsb - ok
17:53:42.0713 3916  [ 16935C98FF639D185086A3529B1F2067 ] Wlansvc        C:\Windows\System32\wlansvc.dll
17:53:42.0744 3916  Wlansvc - ok
17:53:42.0775 3916  [ 0217679B8FCA58714C3BF2726D2CA84E ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
17:53:42.0775 3916  WmiAcpi - ok
17:53:42.0806 3916  [ 6EB6B66517B048D87DC1856DDF1F4C3F ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
17:53:42.0838 3916  wmiApSrv - ok
17:53:42.0900 3916  [ 3B40D3A61AA8C21B88AE57C58AB3122E ] WMPNetworkSvc  C:\Program Files\Windows Media Player\wmpnetwk.exe
17:53:42.0947 3916  WMPNetworkSvc - ok
17:53:42.0962 3916  [ A2F0EC770A92F2B3F9DE6D518E11409C ] WPCSvc          C:\Windows\System32\wpcsvc.dll
17:53:42.0994 3916  WPCSvc - ok
17:53:43.0040 3916  [ AA53356D60AF47EACC85BC617A4F3F66 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
17:53:43.0056 3916  WPDBusEnum - ok
17:53:43.0087 3916  [ 6DB3276587B853BF886B69528FDB048C ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
17:53:43.0118 3916  ws2ifsl - ok
17:53:43.0134 3916  [ 6F5D49EFE0E7164E03AE773A3FE25340 ] wscsvc          C:\Windows\System32\wscsvc.dll
17:53:43.0165 3916  wscsvc - ok
17:53:43.0181 3916  [ 553F6CCD7C58EB98D4A8FBDAF283D7A9 ] WSDPrintDevice  C:\Windows\system32\DRIVERS\WSDPrint.sys
17:53:43.0212 3916  WSDPrintDevice - ok
17:53:43.0228 3916  [ 7DC0270CFD4A05B4112E3EBBF083B595 ] WSDScan        C:\Windows\system32\DRIVERS\WSDScan.sys
17:53:43.0243 3916  WSDScan - ok
17:53:43.0259 3916  WSearch - ok
17:53:43.0321 3916  [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv        C:\Windows\system32\wuaueng.dll
17:53:43.0368 3916  wuauserv - ok
17:53:43.0399 3916  [ E714A1C0354636837E20CCBF00888EE7 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
17:53:43.0430 3916  WudfPf - ok
17:53:43.0462 3916  [ 1023EE888C9B47178C5293ED5336AB69 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
17:53:43.0477 3916  WUDFRd - ok
17:53:43.0524 3916  [ 8D1E1E529A2C9E9B6A85B55A345F7629 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
17:53:43.0555 3916  wudfsvc - ok
17:53:43.0571 3916  [ FF2D745B560F7C71B31F30F4D49F73D2 ] WwanSvc        C:\Windows\System32\wwansvc.dll
17:53:43.0602 3916  WwanSvc - ok
17:53:43.0633 3916  ================ Scan global ===============================
17:53:43.0664 3916  [ DAB748AE0439955ED2FA22357533DDDB ] C:\Windows\system32\basesrv.dll
17:53:43.0711 3916  [ 183B4188D5D91B271613EC3EFD1B3CEF ] C:\Windows\system32\winsrv.dll
17:53:43.0711 3916  [ 183B4188D5D91B271613EC3EFD1B3CEF ] C:\Windows\system32\winsrv.dll
17:53:43.0742 3916  [ 364455805E64882844EE9ACB72522830 ] C:\Windows\system32\sxssrv.dll
17:53:43.0774 3916  [ 5F1B6A9C35D3D5CA72D6D6FDEF9747D6 ] C:\Windows\system32\services.exe
17:53:43.0774 3916  [Global] - ok
17:53:43.0774 3916  ================ Scan MBR ==================================
17:53:43.0789 3916  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
17:53:44.0164 3916  \Device\Harddisk0\DR0 - ok
17:53:44.0164 3916  ================ Scan VBR ==================================
17:53:44.0164 3916  [ 8EAE52C7A41692F608CB061908976F0C ] \Device\Harddisk0\DR0\Partition1
17:53:44.0164 3916  \Device\Harddisk0\DR0\Partition1 - ok
17:53:44.0210 3916  [ 2F459829982B28EBDB6BD863BE38F8EC ] \Device\Harddisk0\DR0\Partition2
17:53:44.0210 3916  \Device\Harddisk0\DR0\Partition2 - ok
17:53:44.0226 3916  [ C8247B9955DA43CDFBD376F0079A6D6D ] \Device\Harddisk0\DR0\Partition3
17:53:44.0226 3916  \Device\Harddisk0\DR0\Partition3 - ok
17:53:44.0242 3916  [ 372FAA69AC1118CDC7561ED31887C690 ] \Device\Harddisk0\DR0\Partition4
17:53:44.0257 3916  \Device\Harddisk0\DR0\Partition4 - ok
17:53:44.0257 3916  ============================================================
17:53:44.0257 3916  Scan finished
17:53:44.0257 3916  ============================================================
17:53:44.0257 4560  Detected object count: 5
17:53:44.0257 4560  Actual detected object count: 5
17:53:56.0285 4560  Akamai ( HiddenFile.Multi.Generic ) - skipped by user
17:53:56.0285 4560  Akamai ( HiddenFile.Multi.Generic ) - User select action: Skip
17:53:56.0300 4560  avmeject ( UnsignedFile.Multi.Generic ) - skipped by user
17:53:56.0300 4560  avmeject ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:53:56.0300 4560  KMService ( UnsignedFile.Multi.Generic ) - skipped by user
17:53:56.0300 4560  KMService ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:53:56.0300 4560  PassThru Service ( UnsignedFile.Multi.Generic ) - skipped by user
17:53:56.0300 4560  PassThru Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:53:56.0300 4560  SwitchBoard ( UnsignedFile.Multi.Generic ) - skipped by user
17:53:56.0300 4560  SwitchBoard ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 11.09.2012 22:14
Ich würde an dieser Stelle erstmal einen Cut machen - und erstmal versuchen rauszufinden, ob das nur unter Windows so ist, oder auch mit anderen Betriebssystemen.

So kann man sehen ob sich da ein Hardwareproblem abzeichnet oder der Fehler eher in der Konfig in Windows und/oder im Dateisystem ist.

Lad dir mal sowas wie Knoppix oder Ubuntu herunter, brenn die iso Datei per Imagebrennfunktion auf eine CD und boote den Rechner davon.
Teste dann mal ausgiebig das System unter Linux und berichte ob es dort normal läuft.

Donald92 12.09.2012 17:14
okay werde ich tun! Muss ich dann jedes mal von der DVD booten oder ist das quasi ein 2tes Betriebssystem? Was genau heißt ausgiebig? Einfach mal ne Woche nur Ubuntu nutzen?

Danke für die super Hilfe!!! :)

cosinus 12.09.2012 20:18
Naja, ausgiebig heißt schon einen etwas längeren Zeitraum. Ob das eine Woche sein muss, naja - aber probier soviel wie möglich aus versuch einfach den Rechner normal wieder immer zu bedienen.

Donald92 13.09.2012 21:12
die Einrichtung für den täglichen Gebrauch dauert noch etwas, aber danach versuche ich Ubuntu für eine "eile täglich zu nutzen... bisher aber noch keine neuen Abstürze sowohl unter Windows als auch unter Linux

Donald92 17.09.2012 16:14
Da ich es im Moment zeitlich nicht hinbekomme Ubuntu komplett einzurichten muss ich gezwungenermaßen Windows weiter nutzen! Die Abstürze und Blue Screens häufen sich...
Gerade kamen diese beiden BlueScreens nacheinander (mit einem reboot dazwischen):
hxxp://www.imagebanana.com/view/9htirmie/IMG_01301.JPG
hxxp://www.imagebanana.com/view/pmiqsihb/IMG_01311.JPG
Würde es was bringen Windows 7 komplett neu aufzuziehen?
Woran erkenne ich denn das meine Hardware kaputt ist? Würde der Defekt eines einzelnen Teils das alles erklären?

Ja ich weiß Fragen über Fragen - aber ich brauche den PC für die Uni und den sonstigen täglichen Gebrauch und der sollte einwandfrei laufen :/

cosinus 17.09.2012 20:29
Du sollst Ubuntu ja auch nicht komplett einrichten!
Die Rede war eher von CD booten in den Ausprobiermodus! Da muss sich dochmal ein paar Stunden Zeit für finden lassen!

Zitat:
Würde es was bringen Windows 7 komplett neu aufzuziehen?
Vllt ja vllt auch nicht - warum meinst du wohl hab ich den Test unterLinux vorgeschlagen?

Donald92 17.09.2012 22:19
unter Ubuntu ist mir der Rechner nur einmal abgeschmiert während ich im Terminal die Treiber installiert habe...

Ab nächste Woche habe ich mehr Zeit dafür, dann sind die letzten Klausuren für dieses Semester rum! :)

cosinus 18.09.2012 11:56
Zitat:
während ich im Terminal die Treiber installiert habe...
Was zum Geier installierst du da für Treiber übers Terminal? :wtf:

Donald92 19.09.2012 14:29
die für die Grafikkarte :wtf: hab das gegoogelt weil das vorher so eine sehr niedrige Auflösung war und man kaum was erkennen und damit so fast nicht arbeiten konnte... ?!

cosinus 19.09.2012 16:21
Das musst du doch nicht über das Terminal machen....bei Ubuntu gibt es da den Menüpunkt bzw. das GUI-Tool, siehe => restricted-manager
Zitat:
Unter Ubuntu befindet sich die Verwaltung eingeschränkter Treiber unter

"System -> Systemverwaltung -> Hardware-Treiber" (bis Ubuntu 10.04)

"System -> Systemverwaltung -> Zusätzliche Treiber" (ab Ubuntu 10.10 bis Ubuntu 11.04)

"Systemeinstellungen-> Zusätzliche Treiber" (ab Ubuntu 11.10)

Donald92 20.09.2012 16:17
"Systemeinstellungen-> Zusätzliche Treiber" (ab Ubuntu 11.10) <-- konnte aufgrund einer Fehlermeldung nicht durchgeführt werden...

Donald92 23.09.2012 10:44
Hab jetzt Windows 8 aufgespielt und die ersten Tage ging alles gut - seit vorgestern kommen aber wieder ab und zu Neustarts vor... keine Bluescreens bis jetzt - "nur" Einfrieren und spontane Neustarts!

Ich sollte mir einen neuen PC kaufen oder?

cosinus 23.09.2012 17:32
Wenn du keine Lust und Zeit mehr für die Fehlersuche hast ja dann kauf dir nen neuen PC :D
Einen Speichertest mit Memtest86 hast schon gemacht? Ist auf der Ubuntu-CD drauf, einfach von der CD booten und den Arbeitsspeicher testen

Donald92 24.09.2012 10:31
ja ich gucke mich schon um nach Angeboten :D

ne habe ich noch nicht gemacht - werde ich aber in Kürze durchführen!

Donald92 28.09.2012 12:49
habe jetzt einen neuen PC und einen Verdacht woher die Abstürze kamen :glaskugel:

habe meine Festplatte in den Neuen eingebaut und bemerkt, dass diese sich ab und zu einfach so komplett abschaltet - will ich dann auf sie zugreifen fährt sie hörbar wieder hoch... naja und da das die Festplatte war über die ehemals alles lief (nun ist sie leer) ist klar das der PC abstürzt wenn sich die Platte einfach so abschaltet... :pfui:


Alle Zeitangaben in WEZ +1. Es ist jetzt 18:07 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131