Trojaner-Board - Weiterleitung auf Werbeseiten bei Google-Recherche

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Weiterleitung auf Werbeseiten bei Google-Recherche (https://www.trojaner-board.de/123912-weiterleitung-werbeseiten-google-recherche.html)

Weiterleitung auf Werbeseiten bei Google-Recherche

Hallo,

wenn ich nach einer Google-Recherche die angezeigten Seiten aufzurufen versuche, werde ich auf unerwünschte Werbeseite weitergeleitet (z. B. "ihavenet.com").

Dann klicke ich "Rückgängig" und versuche es erneut, wiederhole diesen Vorgang, bis es irgendwann klappt.

Das Problem ist mir erstmals vor ein oder zwei Tagen aufgefallen. Es tritt nicht immer auf, aber immer öfter, und es ist unabhängig vom Browser (Firefox, IE).

Ist es ein Virus? Was soll ich machen?

Im Voraus danke!

Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Die Ergebnisse des Vollscans mit Malwarebytes kann ich schon mal posten; weiter bin ich noch nicht gekommen:

Malwarebytes Anti-Malware (Test) 1.65.0.1400
Malwarebytes : Free anti-malware download

Datenbank Version: v2012.09.13.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
XXXX:: XXXX-PC [Administrator]

Schutz: Aktiviert

13.09.2012 10:32:04
mbam-log-2012-09-13 (10-32-04).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 571725
Laufzeit: 3 Stunde(n), 28 Minute(n), 1 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

2012/09/12 22:47:08 +0200 x MESSAGE Starting protection
2012/09/12 22:47:08 +0200 x MESSAGE Protection started successfully
2012/09/12 22:47:08 +0200 x MESSAGE Starting IP protection
2012/09/12 22:47:11 +0200 x MESSAGE IP Protection started successfully
2012/09/12 22:47:28 +0200 x MESSAGE Starting database refresh
2012/09/12 22:47:28 +0200 x MESSAGE Stopping IP protection
2012/09/12 22:47:28 +0200 x MESSAGE IP Protection stopped successfully
2012/09/12 22:47:31 +0200 x MESSAGE Database refreshed successfully
2012/09/12 22:47:31 +0200 x MESSAGE Starting IP protection
2012/09/12 22:47:34 +0200 x MESSAGE IP Protection started successfully
2012/09/12 22:59:51 +0200 x MESSAGE Executing scheduled update: Daily
2012/09/12 23:00:10 +0200 x MESSAGE Database already up-to-date

2012/09/13 01:59:09 +0200 x MESSAGE Executing scheduled update: Daily
2012/09/13 01:59:18 +0200 x MESSAGE Starting database refresh
2012/09/13 01:59:18 +0200 x MESSAGE Stopping IP protection
2012/09/13 01:59:18 +0200 x MESSAGE Scheduled update executed successfully: database updated from version v2012.09.12.06 to version v2012.09.12.07
2012/09/13 01:59:19 +0200 x MESSAGE IP Protection stopped successfully
2012/09/13 01:59:22 +0200 x MESSAGE Database refreshed successfully
2012/09/13 01:59:22 +0200 x MESSAGE Starting IP protection
2012/09/13 01:59:25 +0200 x MESSAGE IP Protection started successfully
2012/09/13 10:10:31 +0200 x MESSAGE Starting protection
2012/09/13 10:10:31 +0200 x MESSAGE Protection started successfully
2012/09/13 10:10:31 +0200 x MESSAGE Starting IP protection
2012/09/13 10:10:33 +0200 x MESSAGE IP Protection started successfully
2012/09/13 10:31:38 +0200 x MESSAGE Starting database refresh
2012/09/13 10:31:38 +0200 x MESSAGE Stopping IP protection
2012/09/13 10:31:38 +0200 x MESSAGE IP Protection stopped successfully
2012/09/13 10:31:41 +0200 x MESSAGE Database refreshed successfully
2012/09/13 10:31:41 +0200 x MESSAGE Starting IP protection
2012/09/13 10:31:44 +0200 x MESSAGE IP Protection started successfully

Obwohl nichts gefunden wurde, besteht das Problem nach wie vor.

Wie genau solltest du die Logs posten?

Cosinus, was meinst du mit "Wie genau solltest du die Logs posten?"

Lies doch mal meine Anleitungen zu Ende. Da steht in welcher Form du die Logs posten sollst => in CODE-Tags umschlossen

Code:

Malwarebytes Anti-Malware (Test) 1.65.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.09.13.02
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

XXXX:: XXXX-PC [Administrator]
 

Schutz: Aktiviert
 

13.09.2012 10:32:04

mbam-log-2012-09-13 (10-32-04).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 571725

Laufzeit: 3 Stunde(n), 28 Minute(n), 1 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

2012/09/12 22:47:08 +0200        x        MESSAGE        Starting protection

2012/09/12 22:47:08 +0200        x        MESSAGE        Protection started successfully

2012/09/12 22:47:08 +0200        x        MESSAGE        Starting IP protection

2012/09/12 22:47:11 +0200        x        MESSAGE        IP Protection started successfully

2012/09/12 22:47:28 +0200        x        MESSAGE        Starting database refresh

2012/09/12 22:47:28 +0200        x        MESSAGE        Stopping IP protection

2012/09/12 22:47:28 +0200        x        MESSAGE        IP Protection stopped successfully

2012/09/12 22:47:31 +0200        x        MESSAGE        Database refreshed successfully

2012/09/12 22:47:31 +0200        x        MESSAGE        Starting IP protection

2012/09/12 22:47:34 +0200        x        MESSAGE        IP Protection started successfully

2012/09/12 22:59:51 +0200        x        MESSAGE        Executing scheduled update:  Daily

2012/09/12 23:00:10 +0200        x        MESSAGE        Database already up-to-date

Code:

2012/09/13 01:59:09 +0200        x        MESSAGE        Executing scheduled update:  Daily

2012/09/13 01:59:18 +0200        x        MESSAGE        Starting database refresh

2012/09/13 01:59:18 +0200        x        MESSAGE        Stopping IP protection

2012/09/13 01:59:18 +0200        x        MESSAGE        Scheduled update executed successfully:  database updated from version v2012.09.12.06 to version v2012.09.12.07

2012/09/13 01:59:19 +0200        x        MESSAGE        IP Protection stopped successfully

2012/09/13 01:59:22 +0200        x        MESSAGE        Database refreshed successfully

2012/09/13 01:59:22 +0200        x        MESSAGE        Starting IP protection

2012/09/13 01:59:25 +0200        x        MESSAGE        IP Protection started successfully

2012/09/13 10:10:31 +0200        x        MESSAGE        Starting protection

2012/09/13 10:10:31 +0200        x        MESSAGE        Protection started successfully

2012/09/13 10:10:31 +0200        x        MESSAGE        Starting IP protection

2012/09/13 10:10:33 +0200        x        MESSAGE        IP Protection started successfully

2012/09/13 10:31:38 +0200        x        MESSAGE        Starting database refresh

2012/09/13 10:31:38 +0200        x        MESSAGE        Stopping IP protection

2012/09/13 10:31:38 +0200        x        MESSAGE        IP Protection stopped successfully

2012/09/13 10:31:41 +0200        x        MESSAGE        Database refreshed successfully

2012/09/13 10:31:41 +0200        x        MESSAGE        Starting IP protection

2012/09/13 10:31:44 +0200        x        MESSAGE        IP Protection started successfully

2012/09/13 16:12:16 +0200        X        X        IP-BLOCK        78.41.203.120 (Type: outgoing, Port: 63046, Process: avwebgrd.exe)

2012/09/13 17:24:57 +0200        X-PC        X        MESSAGE        Starting protection

2012/09/13 17:24:57 +0200        X-PC        X        MESSAGE        Protection started successfully

2012/09/13 17:24:57 +0200        X-PC        X        MESSAGE        Starting IP protection

2012/09/13 17:24:59 +0200        X-PC        X        MESSAGE        IP Protection started successfully

Ich hoffe, ich habe das jetzt richtig gemacht. Ich bin leider ein ziemlicher Computer-Legastheniker. Viele Begriffe und Anweisungen sind mir nicht klar. Trotzdem schon mal vielen Dank für die Hilfe!

Ja so ist richtig. Was ist denn mit ESET, ist mir das Log entgangen?

Code:

C:\Windows\Temp\NOD330.tmp Variante von Win32/Kryptik.AKCO Trojaner

Oben der ESET Online Scan. Ich habe sicherlich einiges falsch gemacht, weil ich die Anweisungen nicht hinreichend beachtet habe. Zur Information:
-- Ich hatte ESET Online Scan mit dem ESET Security Virenscanner verwechselt, diesen als Testversion installiert und alles prüfen lassen. Er hatte auch zwei oder drei infizierte Programme/Dateien gefunden, die ich daraufhin aber nicht entfernt hatte.
-- Unabhängig davon habe ich später eine Systemwiederherstellung durchgeführt (Zeitpunkt 5. Sept.). Seitdem tritt die Weiterleitung nicht mehr auf. Das installierte ESET-Virenprogramm war dadurch weg :-(, so dass ich keine näheren Angaben zu den Funden machen kann.
-- Aber die Weiterleitung auf Werbeseiten tritt nicht mehr auf. Übrigens lief Safari sauber, nur Firefox und IE waren betroffen.
-- Ich weiß nicht, ob der Hijacker/Virus oder was auch immer nun weg ist.
-- Bzw.: Wie gehe ich mit dem Fund vom ESET Online Scan um?

Vielen Dank!!!

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Falls der adwCleaner schon mal in der runtergeladen wurde, bitte die alte adwcleaner.exe löschen und neu runterladen!!

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Suche.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[Rx].txt. (x=fortlaufende Nummer)

Code:

# AdwCleaner v2.002 - Datei am 09/20/2012 um 22:25:42 erstellt

# Aktualisiert am 16/09/2012 von Xplode

# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)

# Benutzer : *** - ***-PC

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\***\AppData\Local\Temp\hjt70ztf.tmp\adwcleaner.exe

# Option [Suche]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Ordner Gefunden : C:\Users\***\AppData\Local\OpenCandy

Ordner Gefunden : C:\Users\***\AppData\Roaming\OpenCandy
 

***** [Registrierungsdatenbank] *****
 

Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

[OK] Die Registrierungsdatenbank ist sauber.
 

-\\ Mozilla Firefox v15.0.1 (de)
 

Profilname : default 

Datei : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qvsktsnr.default\prefs.js
 

[OK] Die Datei ist sauber.
 

*************************
 

AdwCleaner[R1].txt - [1019 octets] - [20/09/2012 22:25:42]
 

########## EOF - C:\AdwCleaner[R1].txt - [1079 octets] ##########

Ich wurde zuletzt nicht mehr auf Werbeseiten weitergeleitet, aber wenn ich auf einen Link klicke, dauert es ewig, ehe die Seiten sich öffnet - wenn überhaupt.

Soll ich beim adwcleaner.exe nach dem Posten auf "Lösche" und/oder "Deinstallieren" klicken?

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Löschen.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[Sx].txt. (x=fortlaufende Nummer)

Code:

# AdwCleaner v2.002 - Datei am 09/21/2012 um 17:09:37 erstellt

# Aktualisiert am 16/09/2012 von Xplode

# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)

# Benutzer : *** - ***-PC

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\***\Downloads\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 
 

***** [Registrierungsdatenbank] *****
 
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

[OK] Die Registrierungsdatenbank ist sauber.
 

-\\ Mozilla Firefox v15.0.1 (de)
 

Profilname : default 

Datei : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qvsktsnr.default\prefs.js
 

[OK] Die Datei ist sauber.
 

*************************
 

AdwCleaner[R1].txt - [1148 octets] - [20/09/2012 22:25:42]

AdwCleaner[S1].txt - [1673 octets] - [20/09/2012 22:35:52]

AdwCleaner[R2].txt - [1003 octets] - [21/09/2012 17:08:58]

AdwCleaner[R3].txt - [1063 octets] - [21/09/2012 17:09:18]

AdwCleaner[S2].txt - [998 octets] - [21/09/2012 17:09:37]
 

########## EOF - C:\AdwCleaner[S2].txt - [1057 octets] ##########

Hätte da mal drei Fragen bevor es weiter geht (wir sind noch nicht fertig!)

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?
3.) Die Werbeeinblendungen bzw Weiterleitungen wie zB Incredibar oder Mystart sind nun weg?

zu 1) Ja, Windows funktioniert, allerdings gefühlt langsam(er), insbesondere IE und Firefox, während auf Safari (wo auch nie eine Weiterleitung stattfand) die Seiten schneller aufgerufen werden.

zu 2) Nein, ich vermisse nichts im Startmenü, habe auch keine leeren Ordner gefunden.

zu 3) Ich habe keine Werbeeinblendungen und Umleitungen mehr feststellen können, seitdem ich die Systemwiederherstellung durchgeführt habe (Zeitpunkt 5.9.12).

Code:

C:\Windows\Temp\NOD330.tmp Variante von Win32/Kryptik.AKCO Trojaner

Noch eine Frage: Was ist mit dem Trojaner, den ESET Online Scan gefunden hatte??? Siehe oben.

Das entfernen wir schon noch!

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Code:

OTL logfile created on: 23.09.2012 23:28:26 - Run 1

OTL by OldTimer - Version 3.2.66.0     Folder = C:\Users\***\Downloads

64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

7,86 Gb Total Physical Memory | 6,21 Gb Available Physical Memory | 79,07% Memory free

15,72 Gb Paging File | 13,81 Gb Available in Paging File | 87,89% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 465,66 Gb Total Space | 253,21 Gb Free Space | 54,38% Space Free | Partition Type: NTFS

Drive D: | 94,26 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

Drive E: | 7,60 Gb Total Space | 0,76 Gb Free Space | 10,03% Space Free | Partition Type: FAT32

Drive F: | 465,65 Gb Total Space | 29,09 Gb Free Space | 6,25% Space Free | Partition Type: FAT32

 

Computer Name: ***-PC | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.09.23 23:24:23 | 000,601,600 | ---- | M] (OldTimer Tools) -- C:\Users\***\Downloads\OTL.exe

PRC - [2012.09.20 13:09:56 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

PRC - [2012.09.20 13:09:20 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE

PRC - [2012.09.20 13:09:17 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe

PRC - [2012.09.20 13:09:16 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

PRC - [2012.09.20 13:09:15 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012.09.20 13:09:14 | 000,619,472 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe

PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2012.03.14 10:28:28 | 000,197,504 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

PRC - [2012.03.09 11:22:46 | 000,070,960 | ---- | M] (Portrait Displays, Inc) -- C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\SDKCOMServer.exe

PRC - [2012.03.09 11:22:42 | 000,117,552 | ---- | M] (Portrait Displays, Inc.) -- C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe

PRC - [2012.02.23 12:30:40 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe

PRC - [2012.02.10 11:28:06 | 000,240,408 | ---- | M] (Microsoft Corporation.) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe

PRC - [2011.09.01 22:07:18 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

PRC - [2011.09.01 22:07:18 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE

PRC - [2011.09.01 03:22:18 | 000,169,624 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe

PRC - [2011.04.29 16:44:14 | 001,687,360 | ---- | M] (QUALCOMM, Inc.) -- C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kHP.exe

PRC - [2010.04.12 09:13:08 | 000,142,336 | ---- | M] (HP) -- C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe

PRC - [2010.02.25 15:18:20 | 000,076,856 | ---- | M] ( Hewlett-Packard Development Company, L.P.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe

PRC - [2009.11.04 23:46:40 | 002,320,920 | R--- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

PRC - [2009.11.04 23:46:38 | 000,268,824 | R--- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - [2012.05.29 13:09:50 | 000,035,680 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\SysNative\uxtuneup.dll -- (UxTuneUp)

SRV:64bit: - [2011.05.13 14:58:10 | 000,030,520 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\hpservice.exe -- (hpsrv)

SRV:64bit: - [2010.02.18 14:52:30 | 002,045,232 | ---- | M] (Validity Sensors, Inc.) [Auto | Running] -- C:\Windows\SysNative\vcsFPService.exe -- (vcsFPService)

SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV - [2012.09.20 13:09:56 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012.09.20 13:09:20 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)

SRV - [2012.09.20 13:09:17 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)

SRV - [2012.09.20 13:09:16 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2012.09.20 13:09:14 | 000,619,472 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe -- (AntiVirFirewallService)

SRV - [2012.09.06 03:25:06 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.05.29 13:09:52 | 002,143,072 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe -- (TuneUp.UtilitiesSvc)

SRV - [2012.05.29 13:09:50 | 000,029,024 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\SysWOW64\uxtuneup.dll -- (UxTuneUp)

SRV - [2012.03.14 14:23:06 | 000,152,992 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programme\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe -- (HP Power Assistant Service)

SRV - [2012.03.14 10:28:28 | 000,197,504 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)

SRV - [2012.03.09 11:22:42 | 000,117,552 | ---- | M] (Portrait Displays, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe -- (PdiService)

SRV - [2012.02.10 11:28:06 | 000,240,408 | ---- | M] (Microsoft Corporation.) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe -- (BBUpdate)

SRV - [2012.02.10 11:28:06 | 000,193,816 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe -- (BBSvc)

SRV - [2011.11.17 19:27:32 | 000,271,360 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Programme\IDT\WDM\stacsv64.exe -- (STacSV)

SRV - [2011.11.17 19:27:32 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Programme\IDT\WDM\AESTSr64.exe -- (AESTFilters)

SRV - [2011.09.09 17:10:28 | 000,086,072 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe -- (HP Support Assistant Service)

SRV - [2011.09.01 22:07:18 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMON)

SRV - [2011.09.01 03:22:18 | 000,169,624 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor10.0)

SRV - [2011.04.29 16:44:14 | 001,687,360 | ---- | M] (QUALCOMM, Inc.) [Auto | Running] -- C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kHP.exe -- (QDLService2kHP)

SRV - [2010.10.26 23:24:36 | 000,403,536 | ---- | M] (Logitech, Inc.) [Auto | Running] -- C:\Programme\Logitech\SolarApp\L4301_Solar.exe -- (L4301_Solar)

SRV - [2010.07.21 15:33:00 | 000,103,992 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programme\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe -- (HP Wireless Assistant Service)

SRV - [2010.04.12 09:13:08 | 000,142,336 | ---- | M] (HP) [Auto | Running] -- C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe -- (HP LaserJet Service)

SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010.02.18 14:26:46 | 001,664,304 | ---- | M] (Validity Sensors, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vcsFPService.exe -- (vcsFPService)

SRV - [2009.11.04 23:46:40 | 002,320,920 | R--- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)

SRV - [2009.11.04 23:46:38 | 000,268,824 | R--- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)

SRV - [2009.09.04 14:35:12 | 000,873,248 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)

SRV - [2009.08.18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012.09.20 13:10:20 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)

DRV:64bit: - [2012.09.20 13:10:17 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)

DRV:64bit: - [2012.09.20 13:10:16 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)

DRV:64bit: - [2012.09.20 13:10:15 | 000,139,360 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avfwot.sys -- (avfwot)

DRV:64bit: - [2012.09.20 13:10:15 | 000,114,128 | ---- | M] (Avira GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\avfwim.sys -- (avfwim)

DRV:64bit: - [2012.06.15 09:06:26 | 001,379,376 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2012.02.15 12:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)

DRV:64bit: - [2011.11.17 19:27:32 | 000,515,584 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)

DRV:64bit: - [2011.09.01 22:07:21 | 000,409,624 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2011.05.13 14:58:16 | 000,030,008 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpdskflt.sys -- (hpdskflt)

DRV:64bit: - [2011.05.13 14:57:58 | 000,043,320 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelerometer.sys -- (Accelerometer)

DRV:64bit: - [2011.04.29 15:18:08 | 000,444,416 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\qcusbnethp2k.sys -- (qcusbnethp2k)

DRV:64bit: - [2011.04.29 15:18:08 | 000,230,784 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\qcusbserhp2k.sys -- (qcusbserhp2k)

DRV:64bit: - [2011.04.29 15:18:08 | 000,160,328 | ---- | M] (MCCI) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\qcombushp.sys -- (qcombushp)

DRV:64bit: - [2011.04.29 15:18:08 | 000,006,400 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\qcfilterhp2k.sys -- (qcfilterhp2k)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)

DRV:64bit: - [2010.10.03 05:06:58 | 000,022,040 | ---- | M] (Hewlett Packard) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hppdbulkio.sys -- (HPFXBULKLEDM)

DRV:64bit: - [2010.06.03 16:56:06 | 001,803,904 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\snp2uvc.sys -- (SNP2UVC)

DRV:64bit: - [2010.03.19 04:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)

DRV:64bit: - [2010.01.13 17:37:18 | 007,675,392 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64)

DRV:64bit: - [2009.11.12 06:14:30 | 000,084,584 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)

DRV:64bit: - [2009.11.05 18:36:26 | 000,293,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1k62x64.sys -- (e1kexpress)

DRV:64bit: - [2009.09.17 22:56:24 | 000,021,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)

DRV:64bit: - [2009.09.17 22:56:16 | 000,035,104 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)

DRV:64bit: - [2009.09.17 22:56:14 | 000,132,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)

DRV:64bit: - [2009.09.17 22:56:10 | 000,098,344 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)

DRV:64bit: - [2009.09.17 22:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)

DRV:64bit: - [2009.07.20 16:05:50 | 000,059,008 | ---- | M] (RICOH Company, Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rismcx64.sys -- (rismcx64)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV:64bit: - [2009.07.14 01:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)

DRV:64bit: - [2009.06.25 18:04:20 | 000,067,584 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimmpx64.sys -- (rimmptsk)

DRV:64bit: - [2009.06.10 23:01:06 | 001,146,880 | ---- | M] (LSI Corp) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\agrsm64.sys -- (AgereSoftModem)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)

DRV:64bit: - [2009.04.29 08:48:32 | 000,018,432 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)

DRV:64bit: - [2007.09.06 22:53:12 | 000,016,384 | ---- | M] (Silicon Laboratories) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\DSI_SiUSBXp_3_1.sys -- (DSI_SiUSBXp_3_1)

DRV - [2012.03.29 16:32:12 | 000,011,856 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys -- (TuneUpUtilitiesDrv)

DRV - [2011.06.29 23:06:19 | 000,131,336 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysWOW64\drivers\avfwot.sys -- (avfwot)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

DRV - [2004.05.17 11:21:54 | 000,017,280 | ---- | M] (Intellon, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\plcndis5.sys -- (PLCNDIS5)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

 

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

 

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

 

IE - HKU\S-1-5-21-3941852603-2146344533-209533615-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve

IE - HKU\S-1-5-21-3941852603-2146344533-209533615-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKU\S-1-5-21-3941852603-2146344533-209533615-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-3941852603-2146344533-209533615-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-3941852603-2146344533-209533615-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-3941852603-2146344533-209533615-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-3941852603-2146344533-209533615-1000\..\SearchScopes\{830F4D7D-3EDE-4CE7-A68A-C7A22686E849}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=WCR&o=&src=crm&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=&apn_uid=81AD52EA-5B84-4A2B-A8E4-3552CA4B32C2&apn_sauid=75C34C28-15A0-416A-A645-EF4EF06984ED

IE - HKU\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>

IE - HKU\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 192.168.1.18:8080

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.suggest.enabled: false

FF - prefs.js..browser.search.useDBForOrder: true

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.20 13:37:48 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.09.18 12:42:41 | 000,000,000 | ---D | M]

 

[2012.09.20 13:37:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions

[2012.09.20 13:37:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\qvsktsnr.default\extensions

[2012.09.20 13:37:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2012.09.18 12:42:41 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

[2012.09.06 03:26:03 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.09.06 04:07:37 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.09.06 04:07:37 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.09.06 04:07:37 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.09.06 04:07:37 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.09.06 04:07:37 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.09.06 04:07:37 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)

O2 - BHO: (CmjBrowserHelperObject Object) - {6FE6A929-59D1-4763-91AD-29B61CFFB35B} - C:\Program Files (x86)\Mindjet\MindManager 9\Mm8InternetExplorer.dll (Mindjet)

O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.)

O4:64bit: - HKLM..\Run: [HPPowerAssistant] C:\Program Files\Hewlett-Packard\HP Power Assistant\DelayedAppStarter.exe (Hewlett-Packard Company, L.P.)

O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-3941852603-2146344533-209533615-1000..\Run: [CAHeadless] C:\Program Files (x86)\Adobe\Elements 10 Organizer\CAHeadless\ElementsAutoAnalyzer.exe (Adobe Systems Incorporated)

O4 - HKU\S-1-5-21-3941852603-2146344533-209533615-1000..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra Button: An Mindjet MindManager senden - {2F72393D-2472-4F82-B600-ED77F354B7FF} - C:\Program Files (x86)\Mindjet\MindManager 9\Mm8InternetExplorer.dll (Mindjet)

O9 - Extra Button: IE-Spuren löschen - {6C7C0C9A-B51D-4ADB-A74D-C4E33744F866} - C:\Program Files (x86)\TraXEx\Integration\TraXEx Internet Explorer.lnk ()

O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Löschautomat - {8DA7743F-9274-4BE8-899E-C0FF6ED61B00} - C:\Program Files (x86)\TraXEx\Integration\TraXEx Löschautomat.lnk ()

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)

O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)

O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)

O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)

O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)

O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)

O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)

O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)

O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000020 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Reg Error: Key error.)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{413FE4B6-41B5-46C6-8247-E12FE65C0769}: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A9E73B37-8AE1-4BB2-A8AF-07BB1E254BB4}: DhcpNameServer = 192.168.0.1

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20:64bit: - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2011.02.04 23:56:09 | 000,000,051 | R--- | M] () - D:\autorun.inf -- [ CDFS ]

O33 - MountPoints2\{568c36b8-e77c-11e1-9df7-e02a822d5264}\Shell - "" = AutoRun

O33 - MountPoints2\{568c36b8-e77c-11e1-9df7-e02a822d5264}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a

O33 - MountPoints2\{727224f1-4fcd-11e0-b3e7-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{727224f1-4fcd-11e0-b3e7-806e6f6e6963}\Shell\AutoRun\command - "" = D:\SWSETUP\APPINSTL\hpsoftwaresetup.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

NetSvcs:64bit: UxTuneUp - C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

 

MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Nikon Monitor.lnk - C:\PROGRA~2\COMMON~1\Nikon\Monitor\NKMONI~1.EXE - (Nikon Corporation)

MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TraXEx PC-Putzer.lnk - C:\PROGRA~2\TraXEx\TraXEx.exe - (Alexander Miehlke Softwareentwicklung)

MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WISO Mein Steuer-Sparbuch heute.lnk - C:\PROGRA~2\WISO\STEUER~1\MSHAKT~1.EXE - ()

MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

MsConfig:64bit - StartUpReg: ANT Agent - hkey= - key= - C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe (GARMIN Corp.)

MsConfig:64bit - StartUpReg: AppleSyncNotifier - hkey= - key= - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)

MsConfig:64bit - StartUpReg: CanonSolutionMenuEx - hkey= - key= - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)

MsConfig:64bit - StartUpReg: IMSS - hkey= - key= - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe ()

MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)

MsConfig:64bit - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)

MsConfig:64bit - StartUpReg: Skype - hkey= - key= - C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)

MsConfig:64bit - State: "startup" - Reg Error: Key error.

 

SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.09.23 14:59:12 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

[2012.09.20 13:37:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service

[2012.09.20 13:17:40 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Avira

[2012.09.20 13:17:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2012.09.20 13:17:06 | 000,139,360 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avfwot.sys

[2012.09.20 13:17:06 | 000,132,832 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys

[2012.09.20 13:17:06 | 000,114,128 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avfwim.sys

[2012.09.20 13:17:06 | 000,098,848 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys

[2012.09.20 13:17:06 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys

[2012.09.20 13:17:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira

[2012.09.18 13:11:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2012.09.18 13:11:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2012.09.16 17:09:57 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\ESET

[2012.09.16 17:09:57 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\ESET

[2012.09.16 17:07:03 | 000,000,000 | ---D | C] -- C:\ProgramData\ESET

[2012.09.16 17:07:03 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.09.15 13:53:42 | 000,000,000 | ---D | C] -- C:\Users\***\Outlook

[2012.09.14 21:33:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy

[2012.09.14 21:33:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy

[2012.09.12 22:45:40 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2012.09.12 22:45:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.08.26 14:01:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Garmin

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.09.23 22:10:43 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.09.23 22:10:43 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.09.23 22:07:42 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.09.23 22:07:42 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.09.23 22:07:42 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.09.23 22:07:42 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.09.23 22:07:42 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.09.23 22:03:11 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl

[2012.09.23 22:03:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.09.23 22:02:53 | 2033,745,919 | -HS- | M] () -- C:\hiberfil.sys

[2012.09.22 20:59:59 | 000,000,020 | -H-- | M] () -- C:\ProgramData\PKP_DLdw.DAT

[2012.09.22 19:02:52 | 000,000,020 | -H-- | M] () -- C:\ProgramData\PKP_DLdu.DAT

[2012.09.20 13:37:51 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.09.20 13:17:26 | 000,002,066 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2012.09.20 13:10:20 | 000,027,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys

[2012.09.20 13:10:17 | 000,132,832 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys

[2012.09.20 13:10:16 | 000,098,848 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys

[2012.09.20 13:10:15 | 000,139,360 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avfwot.sys

[2012.09.20 13:10:15 | 000,114,128 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avfwim.sys

[2012.09.18 21:21:04 | 000,003,544 | ---- | M] () -- C:\bootsqm.dat

[2012.09.18 13:11:45 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2012.09.15 13:46:03 | 000,009,333 | ---- | M] () -- C:\Users\***\AppData\Roaming\Kommagetrennte Werte (Windows).EML

 
 ========== Files Created - No Company Name ==========

 

[2012.09.20 13:17:26 | 000,002,066 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2012.09.18 21:21:04 | 000,003,544 | ---- | C] () -- C:\bootsqm.dat

[2012.09.15 13:46:03 | 000,009,333 | ---- | C] () -- C:\Users\***\AppData\Roaming\Kommagetrennte Werte (Windows).EML

[2012.08.21 09:41:57 | 000,007,607 | ---- | C] () -- C:\Users\***\AppData\Local\Resmon.ResmonCfg

[2011.07.25 22:38:13 | 000,393,256 | ---- | C] () -- C:\Windows\SysWow64\CNQ4809N.DAT

[2011.06.30 18:49:53 | 000,001,854 | ---- | C] () -- C:\Users\***\AppData\Roaming\GhostObjGAFix.xml

[2011.06.18 17:24:19 | 000,000,160 | ---- | C] () -- C:\Windows\wiso.ini

[2011.04.13 22:23:11 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2011.04.11 00:35:19 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Reverb

[2011.04.11 00:35:19 | 000,000,268 | RH-- | C] () -- C:\Users\***\AppData\Roaming\Radio Sounds

[2011.04.11 00:35:19 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLck.DAT

[2011.04.11 00:35:19 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Abstract

[2011.04.11 00:35:17 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Robot

[2011.04.11 00:35:17 | 000,000,268 | RH-- | C] () -- C:\Users\***\AppData\Roaming\Receipts

[2011.04.11 00:35:17 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Action

[2011.04.10 22:16:29 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLbx.DAT

[2011.04.10 22:09:18 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Importer

[2011.04.10 22:09:18 | 000,000,268 | RH-- | C] () -- C:\Users\***\AppData\Roaming\Image Capture

[2011.04.10 22:09:18 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdw.DAT

[2011.04.10 22:06:12 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Image Units

[2011.04.10 22:06:12 | 000,000,268 | RH-- | C] () -- C:\Users\***\AppData\Roaming\Hybrid Synthesizers

[2011.04.10 22:06:12 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdu.DAT

[2011.03.16 15:53:48 | 000,256,616 | ---- | C] () -- C:\Windows\nViewSetup.exe

[2011.03.16 15:53:28 | 000,256,616 | R--- | C] () -- C:\Windows\SysWow64\nViewSetup.exe

[2011.03.16 15:43:57 | 000,255,360 | ---- | C] ( ) -- C:\Windows\SysWow64\rsnp2uvc.dll

[2011.03.16 15:43:57 | 000,025,984 | ---- | C] () -- C:\Windows\snuvcdsm.exe

[2011.03.16 15:43:57 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini

[2011.03.16 15:29:47 | 000,000,202 | ---- | C] () -- C:\Windows\SysWow64\HPWA.ini

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

[2011.06.29 14:40:54 | 000,000,000 | -HSD | M] -- C:\Users\***\AppData\Roaming\.#

[2011.04.02 15:15:40 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canneverbe Limited

[2012.09.20 13:25:29 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canon

[2012.09.23 14:59:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

[2012.09.16 17:09:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ESET

[2011.04.11 19:59:06 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\GARMIN

[2011.04.11 00:35:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Nikon

[2012.05.21 23:13:20 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software

[2012.01.04 18:58:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\WindSolutions

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.06.29 14:40:54 | 000,000,000 | -HSD | M] -- C:\Users\***\AppData\Roaming\.#

[2011.11.08 12:18:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Adobe

[2012.09.15 15:56:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Apple Computer

[2012.09.20 13:17:40 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Avira

[2011.04.02 15:15:40 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canneverbe Limited

[2012.09.20 13:25:29 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canon

[2012.09.23 14:59:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

[2012.09.16 17:09:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ESET

[2011.04.11 19:59:06 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\GARMIN

[2011.03.30 07:04:28 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Hewlett-Packard

[2011.12.29 18:05:33 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Hewlett-Packard Company

[2012.06.08 17:48:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\hpqLog

[2011.03.16 15:22:08 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Identities

[2011.03.16 15:43:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\InstallShield

[2011.10.31 14:08:26 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Logishrd

[2011.10.31 14:08:26 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Logitech

[2011.03.27 23:06:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Macromedia

[2012.09.12 22:45:40 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2009.07.14 09:45:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Media Center Programs

[2012.03.26 01:28:31 | 000,000,000 | --SD | M] -- C:\Users\***\AppData\Roaming\Microsoft

[2012.09.20 13:37:54 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Mozilla

[2011.04.11 00:35:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Nikon

[2012.04.01 17:41:50 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Skype

[2012.04.01 16:41:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\skypePM

[2012.05.21 23:13:20 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software

[2012.01.04 18:58:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\WindSolutions

 
 < %APPDATA%\*.exe /s >

[2011.04.10 22:10:57 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\***\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe

[2011.04.10 22:11:23 | 000,049,152 | R--- | M] (InstallShield Software Corp.) -- C:\Users\***\AppData\Roaming\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.20776_none_39c28c74544f69e8\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2011.09.01 22:07:21 | 000,331,288 | ---- | M] (Intel Corporation) MD5=592A0B130FF567A1725F96AD1510D551 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver\IASTOR.SYS

[2011.09.01 22:07:21 | 000,331,288 | ---- | M] (Intel Corporation) MD5=592A0B130FF567A1725F96AD1510D551 -- C:\SWSetup\sp48491\Winall\Driver\IaStor.sys

[2009.08.07 14:24:14 | 000,408,600 | ---- | M] (Intel Corporation) MD5=BBB3B6DF1ABB0FE35802EDE85CC1C011 -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_4fa22a1c88c09097\iaStor.sys

[2011.09.01 22:07:21 | 000,409,624 | ---- | M] (Intel Corporation) MD5=C50107C730C9A955F6FD7376733F2D68 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver64\IASTOR.SYS

[2011.09.01 22:07:21 | 000,409,624 | ---- | M] (Intel Corporation) MD5=C50107C730C9A955F6FD7376733F2D68 -- C:\SWSetup\sp48491\Winall\Driver64\IaStor.sys

[2011.09.01 22:07:21 | 000,409,624 | ---- | M] (Intel Corporation) MD5=C50107C730C9A955F6FD7376733F2D68 -- C:\Windows\SysNative\drivers\iaStor.sys

[2011.09.01 22:07:21 | 000,409,624 | ---- | M] (Intel Corporation) MD5=C50107C730C9A955F6FD7376733F2D68 -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_75016077b0145423\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >
 

< End of report >

Code:

Drive F: | 465,65 Gb Total Space | 29,09 Gb Free Space | 6,25% Space Free | Partition Type: FAT32

Ist das eine externe Platte? FAT32 als Dateisystem kann man schon lange nicht mehr empfehlen...

Ja, das ist eine ältere Festplatte aus dem Aldi...

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:

:OTL

FF - user.js - File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{568c36b8-e77c-11e1-9df7-e02a822d5264}\Shell - "" = AutoRun

O33 - MountPoints2\{568c36b8-e77c-11e1-9df7-e02a822d5264}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a

O33 - MountPoints2\{727224f1-4fcd-11e0-b3e7-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{727224f1-4fcd-11e0-b3e7-806e6f6e6963}\Shell\AutoRun\command - "" = D:\SWSETUP\APPINSTL\hpsoftwaresetup.exe

:Files

C:\ProgramData\*.DAT

C:\Users\***\AppData\Roaming\.#

C:\Windows\Temp\NOD330.tmp

ipconfig /flushdns /c

:Commands

[purity]

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Bevor ich weitermache, habe ich eine Frage: Was bewirkt das Script? Wie kann ich sicher sein, dass dadurch kein Trojaner o.ä. auf meinen Rechner gerät?

Hysterie? :wtf:
Wir bereinigen damit deinen Rechner und du fragst danach ob wir mit OTL weitere Schädlinge draufpacken? :balla:

Sry aber ich kann so eine "panische" Frage irgendwie echt nicht nachvollziehen

Und ich kann hier nicht jedem Zeile für Zeile erklären wie etwas bewirkt und schon garnicht wie OTL aufgebaut ist etc - das sind interne Infos!

Ich wollte dir nicht unterstellen, dass du schädliche Programme, Viren, Trojaner etc. auf meinem Rechner einschleust. Aber ich wurde gewarnt, dass dies über solche Scripte möglich sei. Da wir uns nicht kennen und ich rein gar keine Ahnung von IT habe, halte ich meine Vorsicht nicht für Hysterie. Natürlich bin ich dankbar, dass du dich darum kümmerst, meinen Comuter zu bereinigen!

Ja willst du denn jetzt weitermachen oder nicht? :wtf:

Code:

All processes killed

========== OTL ==========

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

File C:\autoexec.bat not found.

Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{568c36b8-e77c-11e1-9df7-e02a822d5264}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{568c36b8-e77c-11e1-9df7-e02a822d5264}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{568c36b8-e77c-11e1-9df7-e02a822d5264}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{568c36b8-e77c-11e1-9df7-e02a822d5264}\ not found.

File E:\LaunchU3.exe -a not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{727224f1-4fcd-11e0-b3e7-806e6f6e6963}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{727224f1-4fcd-11e0-b3e7-806e6f6e6963}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{727224f1-4fcd-11e0-b3e7-806e6f6e6963}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{727224f1-4fcd-11e0-b3e7-806e6f6e6963}\ not found.

File D:\SWSETUP\APPINSTL\hpsoftwaresetup.exe not found.

========== FILES ==========

C:\ProgramData\ezsidmv.dat moved successfully.

C:\ProgramData\PKP_DLbx.DAT moved successfully.

C:\ProgramData\PKP_DLck.DAT moved successfully.

C:\ProgramData\PKP_DLdu.DAT moved successfully.

C:\ProgramData\PKP_DLdw.DAT moved successfully.

C:\Users\***\AppData\Roaming\.# folder moved successfully.

File\Folder C:\Windows\Temp\NOD330.tmp not found.
 < ipconfig /flushdns /c >

Windows-IP-Konfiguration

Der DNS-Aufl”sungscache wurde geleert.

C:\Users\***\Downloads\cmd.bat deleted successfully.

C:\Users\***\Downloads\cmd.txt deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: ***

->Temp folder emptied: 814991 bytes

->Temporary Internet Files folder emptied: 4191262 bytes

->FireFox cache emptied: 188570771 bytes

->Apple Safari cache emptied: 6559744 bytes

->Flash cache emptied: 1216 bytes

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56466 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

Code:

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 129629 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 85529 bytes

RecycleBin emptied: 619830284 bytes

 

Total Files Cleaned = 782,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.70.2 log created on 10042012_091714
 

Files\Folders moved on Reboot...

C:\Users\***\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
 

PendingFileRenameOperations files...
 

Registry entries deleted on Reboot...

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtg4nzy0ywy5/settings_2012-09-04.png

Log ist unvollständig, die untere Zusammenfassung fehlt

Zitat:

auch nicht "Skip".

Warum? Es wurde doch etxra farblich hervorgehoben du sollst sie mit "skip" behandeln, was tust nicht das was in der Anleitung steht? :(

Code:

12:31:48.0001 5800  TDSS rootkit removing tool 2.8.10.0 Sep 17 2012 19:23:24

12:31:50.0014 5800  ============================================================

12:31:50.0014 5800  Current date / time: 2012/10/04 12:31:50.0014

12:31:50.0014 5800  SystemInfo:

12:31:50.0014 5800  

12:31:50.0014 5800  OS Version: 6.1.7601 ServicePack: 1.0

12:31:50.0014 5800  Product type: Workstation

12:31:50.0014 5800  ComputerName: ***-PC

12:31:50.0014 5800  UserName: ***

12:31:50.0014 5800  Windows directory: C:\Windows

12:31:50.0014 5800  System windows directory: C:\Windows

12:31:50.0014 5800  Running under WOW64

12:31:50.0014 5800  Processor architecture: Intel x64

12:31:50.0014 5800  Number of processors: 4

12:31:50.0014 5800  Page size: 0x1000

12:31:50.0014 5800  Boot type: Normal boot

12:31:50.0014 5800  ============================================================

12:31:51.0215 5800  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

12:31:51.0230 5800  ============================================================

12:31:51.0230 5800  \Device\Harddisk0\DR0:

12:31:51.0230 5800  MBR partitions:

12:31:51.0230 5800  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000

12:31:51.0230 5800  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x3A353000

12:31:51.0230 5800  ============================================================

12:31:51.0262 5800  C: <-> \Device\Harddisk0\DR0\Partition2

12:31:51.0262 5800  ============================================================

12:31:51.0262 5800  Initialize success

12:31:51.0262 5800  ============================================================

12:33:06.0204 5724  ============================================================

12:33:06.0204 5724  Scan started

12:33:06.0204 5724  Mode: Manual; SigCheck; TDLFS; 

12:33:06.0204 5724  ============================================================

12:33:07.0000 5724  ================ Scan system memory ========================

12:33:07.0000 5724  System memory - ok

12:33:07.0000 5724  ================ Scan services =============================

12:33:07.0203 5724  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys

12:33:07.0343 5724  1394ohci - ok

12:33:07.0390 5724  [ 5C368F4B04ED2A923E6AFCA2D37BAFF5 ] Accelerometer   C:\Windows\system32\DRIVERS\Accelerometer.sys

12:33:07.0452 5724  Accelerometer - ok

12:33:07.0499 5724  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys

12:33:07.0530 5724  ACPI - ok

12:33:07.0593 5724  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys

12:33:07.0686 5724  AcpiPmi - ok

12:33:07.0858 5724  [ C245E08EC469A52A622EFDC9787A0DCC ] AdobeActiveFileMonitor10.0 C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe

12:33:07.0889 5724  AdobeActiveFileMonitor10.0 - ok

12:33:07.0936 5724  [ D19C4EE2AC7C47B8F5F84FFF1A789D8A ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

12:33:07.0951 5724  AdobeARMservice - ok

12:33:07.0998 5724  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys

12:33:08.0045 5724  adp94xx - ok

12:33:08.0076 5724  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys

12:33:08.0107 5724  adpahci - ok

12:33:08.0154 5724  [ E109549C90F62FB570B9540C4B148E54 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys

12:33:08.0170 5724  adpu320 - ok

12:33:08.0232 5724  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll

12:33:08.0388 5724  AeLookupSvc - ok

12:33:08.0466 5724  [ A6FB9DB8F1A86861D955FD6975977AE0 ] AESTFilters     C:\Program Files\IDT\WDM\AESTSr64.exe

12:33:08.0529 5724  AESTFilters - ok

12:33:08.0575 5724  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD             C:\Windows\system32\drivers\afd.sys

12:33:08.0653 5724  AFD - ok

12:33:08.0731 5724  [ 98022774D9930ECBB292E70DB7601DF6 ] AgereSoftModem  C:\Windows\system32\DRIVERS\agrsm64.sys

12:33:08.0841 5724  AgereSoftModem - ok

12:33:08.0856 5724  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys

12:33:08.0887 5724  agp440 - ok

12:33:08.0934 5724  [ 3290D6946B5E30E70414990574883DDB ] ALG             C:\Windows\System32\alg.exe

12:33:09.0012 5724  ALG - ok

12:33:09.0028 5724  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys

12:33:09.0043 5724  aliide - ok

12:33:09.0106 5724  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys

12:33:09.0121 5724  amdide - ok

12:33:09.0153 5724  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys

12:33:09.0231 5724  AmdK8 - ok

12:33:09.0246 5724  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys

12:33:09.0293 5724  AmdPPM - ok

12:33:09.0324 5724  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata         C:\Windows\system32\drivers\amdsata.sys

12:33:09.0402 5724  amdsata - ok

12:33:09.0418 5724  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys

12:33:09.0449 5724  amdsbs - ok

12:33:09.0465 5724  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata         C:\Windows\system32\drivers\amdxata.sys

12:33:09.0480 5724  amdxata - ok

12:33:09.0558 5724  [ 6ACC11E9D2F01C88251123D26C1C5489 ] AntiVirFirewallService C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe

12:33:09.0589 5724  AntiVirFirewallService - ok

12:33:09.0652 5724  [ B7FA28AEFA586FB5A04876C7B31D03E6 ] AntiVirMailService C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe

12:33:09.0667 5724  AntiVirMailService - ok

12:33:09.0730 5724  [ 2E35310D600F4CC64624786A813A041E ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

12:33:09.0745 5724  AntiVirSchedulerService - ok

12:33:09.0777 5724  [ 984102B9E2F6513008ED4E0C5AC4151D ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

12:33:09.0792 5724  AntiVirService - ok

12:33:09.0839 5724  [ 9BC7247FD7379307BCFF92CF8EB64B87 ] AntiVirWebService C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE

12:33:09.0870 5724  AntiVirWebService - ok

12:33:09.0901 5724  [ 89A69C3F2F319B43379399547526D952 ] AppID           C:\Windows\system32\drivers\appid.sys

12:33:10.0104 5724  AppID - ok

12:33:10.0120 5724  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll

12:33:10.0213 5724  AppIDSvc - ok

12:33:10.0245 5724  [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo         C:\Windows\System32\appinfo.dll

12:33:10.0338 5724  Appinfo - ok

12:33:10.0432 5724  [ A5299D04ED225D64CF07A568A3E1BF8C ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

12:33:10.0447 5724  Apple Mobile Device - ok

12:33:10.0494 5724  [ 4ABA3E75A76195A3E38ED2766C962899 ] AppMgmt         C:\Windows\System32\appmgmts.dll

12:33:10.0557 5724  AppMgmt - ok

12:33:10.0588 5724  [ C484F8CEB1717C540242531DB7845C4E ] arc             C:\Windows\system32\DRIVERS\arc.sys

12:33:10.0603 5724  arc - ok

12:33:10.0619 5724  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys

12:33:10.0635 5724  arcsas - ok

12:33:10.0666 5724  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys

12:33:10.0759 5724  AsyncMac - ok

12:33:10.0791 5724  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi           C:\Windows\system32\drivers\atapi.sys

12:33:10.0806 5724  atapi - ok

12:33:10.0837 5724  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll

12:33:10.0962 5724  AudioEndpointBuilder - ok

12:33:10.0993 5724  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll

12:33:11.0071 5724  AudioSrv - ok

12:33:11.0118 5724  [ F3A3859D006783A0E0D40E227E52C35C ] avfwim          C:\Windows\system32\DRIVERS\avfwim.sys

12:33:11.0149 5724  avfwim - ok

12:33:11.0196 5724  [ BC06315A7BDBCAD0C7719D1C1306A4DB ] avfwot          C:\Windows\system32\DRIVERS\avfwot.sys

12:33:11.0212 5724  avfwot - ok

12:33:11.0243 5724  [ 26E38B5A58C6C55FAFBC563EEDDB0867 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys

12:33:11.0259 5724  avgntflt - ok

12:33:11.0290 5724  [ 9D1F00BEFF84CBBF46D7F052BC7E0565 ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys

12:33:11.0305 5724  avipbb - ok

12:33:11.0321 5724  [ 248DB59FC86DE44D2779F4C7FB1A567D ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys

12:33:11.0337 5724  avkmgr - ok

12:33:11.0383 5724  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll

12:33:11.0477 5724  AxInstSV - ok

12:33:11.0524 5724  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys

12:33:11.0586 5724  b06bdrv - ok

12:33:11.0617 5724  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys

12:33:11.0680 5724  b57nd60a - ok

12:33:11.0758 5724  [ A2494901E7226B356B8C1005C45F1C5F ] BBSvc           C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe

12:33:11.0773 5724  BBSvc - ok

12:33:11.0820 5724  [ 63B1CBBAE4790B5BAC98F01BF9449722 ] BBUpdate        C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe

12:33:11.0851 5724  BBUpdate - ok

12:33:11.0867 5724  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll

12:33:11.0929 5724  BDESVC - ok

12:33:11.0929 5724  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys

12:33:12.0023 5724  Beep - ok

12:33:12.0085 5724  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE             C:\Windows\System32\bfe.dll

12:33:12.0226 5724  BFE - ok

12:33:12.0273 5724  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\System32\qmgr.dll

12:33:12.0397 5724  BITS - ok

12:33:12.0429 5724  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys

12:33:12.0475 5724  blbdrive - ok

12:33:12.0553 5724  [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe

12:33:12.0585 5724  Bonjour Service - ok

12:33:12.0600 5724  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys

12:33:12.0663 5724  bowser - ok

12:33:12.0709 5724  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys

12:33:12.0819 5724  BrFiltLo - ok

12:33:12.0850 5724  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys

12:33:12.0897 5724  BrFiltUp - ok

12:33:12.0943 5724  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser         C:\Windows\System32\browser.dll

12:33:13.0006 5724  Browser - ok

12:33:13.0021 5724  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid         C:\Windows\System32\Drivers\Brserid.sys

12:33:13.0068 5724  Brserid - ok

12:33:13.0084 5724  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys

12:33:13.0131 5724  BrSerWdm - ok

12:33:13.0131 5724  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys

12:33:13.0177 5724  BrUsbMdm - ok

12:33:13.0177 5724  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys

12:33:13.0209 5724  BrUsbSer - ok

12:33:13.0240 5724  [ CF98190A94F62E405C8CB255018B2315 ] BthEnum         C:\Windows\system32\drivers\BthEnum.sys

12:33:13.0302 5724  BthEnum - ok

12:33:13.0318 5724  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys

12:33:13.0333 5724  BTHMODEM - ok

12:33:13.0365 5724  [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys

12:33:13.0411 5724  BthPan - ok

12:33:13.0458 5724  [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT         C:\Windows\System32\Drivers\BTHport.sys

12:33:13.0521 5724  BTHPORT - ok

12:33:13.0552 5724  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv         C:\Windows\system32\bthserv.dll

12:33:13.0630 5724  bthserv - ok

12:33:13.0661 5724  [ F188B7394D81010767B6DF3178519A37 ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys

12:33:13.0708 5724  BTHUSB - ok

12:33:13.0755 5724  [ 4BDBDB86ABBA924E029FB2683BE7C505 ] btwaudio        C:\Windows\system32\drivers\btwaudio.sys

12:33:13.0770 5724  btwaudio - ok

12:33:13.0786 5724  [ 5C849BD7C78791C5CEE9F4651D7FE38D ] btwavdt         C:\Windows\system32\DRIVERS\btwavdt.sys

12:33:13.0801 5724  btwavdt - ok

12:33:13.0864 5724  [ 31DA517946FFE416442E864592548F8A ] btwdins         C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

12:33:13.0911 5724  btwdins - ok

12:33:13.0942 5724  [ 6149301DC3F81D6F9667A3FBAC410975 ] btwl2cap        C:\Windows\system32\DRIVERS\btwl2cap.sys

12:33:13.0957 5724  btwl2cap - ok

12:33:13.0973 5724  [ 3E1991AFA851A36DC978B0A1B0535C8B ] btwrchid        C:\Windows\system32\DRIVERS\btwrchid.sys

12:33:13.0989 5724  btwrchid - ok

12:33:14.0004 5724  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys

12:33:14.0098 5724  cdfs - ok

12:33:14.0129 5724  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys

12:33:14.0176 5724  cdrom - ok

12:33:14.0207 5724  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc     C:\Windows\System32\certprop.dll

12:33:14.0301 5724  CertPropSvc - ok

12:33:14.0347 5724  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\DRIVERS\circlass.sys

12:33:14.0379 5724  circlass - ok

12:33:14.0425 5724  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys

12:33:14.0457 5724  CLFS - ok

12:33:14.0503 5724  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

12:33:14.0535 5724  clr_optimization_v2.0.50727_32 - ok

12:33:14.0613 5724  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

12:33:14.0628 5724  clr_optimization_v2.0.50727_64 - ok

12:33:14.0675 5724  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

12:33:14.0722 5724  clr_optimization_v4.0.30319_32 - ok

12:33:14.0737 5724  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

12:33:14.0769 5724  clr_optimization_v4.0.30319_64 - ok

12:33:14.0784 5724  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys

12:33:14.0831 5724  CmBatt - ok

12:33:14.0847 5724  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys

12:33:14.0862 5724  cmdide - ok

12:33:14.0893 5724  [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG             C:\Windows\system32\Drivers\cng.sys

12:33:14.0956 5724  CNG - ok

12:33:15.0018 5724  [ C7A0E61D5714AC20DE52D4F66EC773B8 ] Com4QLBEx       C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

12:33:15.0034 5724  Com4QLBEx - ok

12:33:15.0049 5724  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys

12:33:15.0081 5724  Compbatt - ok

12:33:15.0096 5724  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys

12:33:15.0143 5724  CompositeBus - ok

12:33:15.0159 5724  COMSysApp - ok

12:33:15.0174 5724  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys

12:33:15.0205 5724  crcdisk - ok

12:33:15.0221 5724  [ 4F5414602E2544A4554D95517948B705 ] CryptSvc        C:\Windows\system32\cryptsvc.dll

12:33:15.0283 5724  CryptSvc - ok

12:33:15.0315 5724  [ 54DA3DFD29ED9F1619B6F53F3CE55E49 ] CSC             C:\Windows\system32\drivers\csc.sys

12:33:15.0393 5724  CSC - ok

12:33:15.0424 5724  [ 3AB183AB4D2C79DCF459CD2C1266B043 ] CscService      C:\Windows\System32\cscsvc.dll

12:33:15.0502 5724  CscService - ok

12:33:15.0533 5724  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll

12:33:15.0627 5724  DcomLaunch - ok

12:33:15.0673 5724  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc       C:\Windows\System32\defragsvc.dll

12:33:15.0751 5724  defragsvc - ok

12:33:15.0767 5724  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys

12:33:15.0861 5724  DfsC - ok

12:33:15.0892 5724  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll

12:33:16.0001 5724  Dhcp - ok

12:33:16.0032 5724  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys

12:33:16.0126 5724  discache - ok

12:33:16.0157 5724  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\DRIVERS\disk.sys

12:33:16.0173 5724  Disk - ok

12:33:16.0204 5724  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll

12:33:16.0282 5724  Dnscache - ok

12:33:16.0297 5724  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc         C:\Windows\System32\dot3svc.dll

12:33:16.0391 5724  dot3svc - ok

12:33:16.0453 5724  [ B42ED0320C6E41102FDE0005154849BB ] dot4            C:\Windows\system32\DRIVERS\Dot4.sys

12:33:16.0485 5724  dot4 - ok

12:33:16.0516 5724  [ E9F5969233C5D89F3C35E3A66A52A361 ] Dot4Print       C:\Windows\system32\DRIVERS\Dot4Prt.sys

12:33:16.0563 5724  Dot4Print - ok

12:33:16.0594 5724  [ FD05A02B0370BC3000F402E543CA5814 ] dot4usb         C:\Windows\system32\DRIVERS\dot4usb.sys

12:33:16.0641 5724  dot4usb - ok

12:33:16.0672 5724  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS             C:\Windows\system32\dps.dll

12:33:16.0765 5724  DPS - ok

12:33:16.0812 5724  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys

12:33:16.0859 5724  drmkaud - ok

12:33:16.0890 5724  [ 50AAD2A07BD8B90A8CFB4F6D7A4D165A ] DSI_SiUSBXp_3_1 C:\Windows\system32\drivers\DSI_SiUSBXp_3_1.sys

12:33:16.0953 5724  DSI_SiUSBXp_3_1 - ok

12:33:16.0999 5724  [ 209F1A92CB507B2C2EB9E28A1416590E ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys

12:33:17.0046 5724  DXGKrnl - ok

12:33:17.0062 5724  [ 711405DA1FBC40B820DB5A2B4DD939F0 ] e1kexpress      C:\Windows\system32\DRIVERS\e1k62x64.sys

12:33:17.0093 5724  e1kexpress - ok

12:33:17.0140 5724  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost         C:\Windows\System32\eapsvc.dll

12:33:17.0233 5724  EapHost - ok

12:33:17.0327 5724  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys

12:33:17.0436 5724  ebdrv - ok

12:33:17.0467 5724  [ C118A82CD78818C29AB228366EBF81C3 ] EFS             C:\Windows\System32\lsass.exe

12:33:17.0499 5724  EFS - ok

12:33:17.0561 5724  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe

12:33:17.0670 5724  ehRecvr - ok

12:33:17.0686 5724  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched         C:\Windows\ehome\ehsched.exe

12:33:17.0764 5724  ehSched - ok

12:33:17.0795 5724  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys

12:33:17.0842 5724  elxstor - ok

12:33:17.0857 5724  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys

12:33:17.0873 5724  ErrDev - ok

12:33:17.0920 5724  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem     C:\Windows\system32\es.dll

12:33:18.0013 5724  EventSystem - ok

12:33:18.0045 5724  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat           C:\Windows\system32\drivers\exfat.sys

12:33:18.0123 5724  exfat - ok

12:33:18.0138 5724  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat         C:\Windows\system32\drivers\fastfat.sys

12:33:18.0232 5724  fastfat - ok

12:33:18.0294 5724  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax             C:\Windows\system32\fxssvc.exe

12:33:18.0372 5724  Fax - ok

12:33:18.0403 5724  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc             C:\Windows\system32\DRIVERS\fdc.sys

12:33:18.0435 5724  fdc - ok

12:33:18.0466 5724  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost         C:\Windows\system32\fdPHost.dll

12:33:18.0575 5724  fdPHost - ok

12:33:18.0591 5724  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll

12:33:18.0684 5724  FDResPub - ok

12:33:18.0715 5724  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys

12:33:18.0731 5724  FileInfo - ok

12:33:18.0747 5724  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys

12:33:18.0840 5724  Filetrace - ok

12:33:18.0871 5724  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys

12:33:18.0887 5724  flpydisk - ok

12:33:18.0934 5724  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys

12:33:18.0949 5724  FltMgr - ok

12:33:18.0996 5724  [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache       C:\Windows\system32\FntCache.dll

12:33:19.0090 5724  FontCache - ok

12:33:19.0137 5724  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

12:33:19.0152 5724  FontCache3.0.0.0 - ok

12:33:19.0168 5724  [ D43703496149971890703B4B1B723EAC ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys

12:33:19.0199 5724  FsDepends - ok

12:33:19.0215 5724  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys

12:33:19.0230 5724  Fs_Rec - ok

12:33:19.0246 5724  [ 1F7B25B858FA27015169FE95E54108ED ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys

12:33:19.0277 5724  fvevol - ok

12:33:19.0293 5724  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys

12:33:19.0324 5724  gagp30kx - ok

12:33:19.0371 5724  [ 8E98D21EE06192492A5671A6144D092F ] GEARAspiWDM     C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

12:33:19.0386 5724  GEARAspiWDM - ok

12:33:19.0417 5724  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc           C:\Windows\System32\gpsvc.dll

12:33:19.0542 5724  gpsvc - ok

12:33:19.0558 5724  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys

12:33:19.0620 5724  hcw85cir - ok

12:33:19.0667 5724  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys

12:33:19.0714 5724  HdAudAddService - ok

12:33:19.0745 5724  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys

12:33:19.0792 5724  HDAudBus - ok

12:33:19.0823 5724  [ B6AC71AAA2B10848F57FC49D55A651AF ] HECIx64         C:\Windows\system32\DRIVERS\HECIx64.sys

12:33:19.0839 5724  HECIx64 - ok

12:33:19.0854 5724  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys

12:33:19.0885 5724  HidBatt - ok

12:33:19.0917 5724  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys

12:33:19.0963 5724  HidBth - ok

12:33:19.0979 5724  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys

12:33:20.0026 5724  HidIr - ok

12:33:20.0057 5724  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv         C:\Windows\system32\hidserv.dll

12:33:20.0151 5724  hidserv - ok

12:33:20.0182 5724  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys

12:33:20.0197 5724  HidUsb - ok

12:33:20.0229 5724  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll

12:33:20.0322 5724  hkmsvc - ok

12:33:20.0353 5724  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll

12:33:20.0416 5724  HomeGroupListener - ok

12:33:20.0447 5724  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll

12:33:20.0478 5724  HomeGroupProvider - ok

12:33:20.0556 5724  [ 16959F84844DC9B2CEF0D5B1A412370F ] HP LaserJet Service C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe

12:33:20.0587 5724  HP LaserJet Service ( UnsignedFile.Multi.Generic ) - warning

12:33:20.0587 5724  HP LaserJet Service - detected UnsignedFile.Multi.Generic (1)

12:33:20.0665 5724  [ 44AD1D87919994161131D5FB16C5B551 ] HP Power Assistant Service C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe

12:33:20.0681 5724  HP Power Assistant Service - ok

12:33:20.0759 5724  [ 13BB1114451C63BFB41BA7DAA4D70A29 ] HP Support Assistant Service C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

12:33:20.0775 5724  HP Support Assistant Service - ok

12:33:20.0806 5724  [ C930128C8F8FF03D8F8C42B570920D56 ] HP Wireless Assistant Service C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe

12:33:20.0821 5724  HP Wireless Assistant Service - ok

12:33:20.0868 5724  [ 02CE63D8DD5E6DD5CEFF336191C0859E ] HPDrvMntSvc.exe C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

12:33:20.0884 5724  HPDrvMntSvc.exe - ok

12:33:20.0899 5724  [ 4E0BEC0F78096FFD6D3314B497FC49D3 ] hpdskflt        C:\Windows\system32\DRIVERS\hpdskflt.sys

12:33:20.0915 5724  hpdskflt - ok

12:33:20.0962 5724  [ E325F85012E793CEE74B73C4F22AE311 ] HPFXBULKLEDM    C:\Windows\system32\drivers\hppdbulkio.sys

12:33:20.0977 5724  HPFXBULKLEDM - ok

12:33:21.0009 5724  [ 9AF482D058BE59CC28BCE52E7C4B747C ] HpqKbFiltr      C:\Windows\system32\DRIVERS\HpqKbFiltr.sys

12:33:21.0055 5724  HpqKbFiltr - ok

12:33:21.0149 5724  [ E7C7829BA0395E48F8C8FE16B8832344 ] hpqwmiex        C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

12:33:21.0196 5724  hpqwmiex - ok

12:33:21.0227 5724  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys

12:33:21.0243 5724  HpSAMD - ok

12:33:21.0274 5724  [ FC7C13B5A9E9BE23B7AE72BBC7FDB278 ] hpsrv           C:\Windows\system32\Hpservice.exe

12:33:21.0289 5724  hpsrv - ok

12:33:21.0321 5724  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys

12:33:21.0430 5724  HTTP - ok

12:33:21.0461 5724  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys

12:33:21.0492 5724  hwpolicy - ok

12:33:21.0508 5724  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys

12:33:21.0539 5724  i8042prt - ok

12:33:21.0601 5724  [ 593EF9F904C8497F6D794DC6FCC59DCA ] IAANTMON        C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

12:33:21.0617 5724  IAANTMON - ok

12:33:21.0648 5724  [ C50107C730C9A955F6FD7376733F2D68 ] iaStor          C:\Windows\system32\DRIVERS\iaStor.sys

12:33:21.0664 5724  iaStor - ok

12:33:21.0695 5724  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys

12:33:21.0726 5724  iaStorV - ok

12:33:21.0773 5724  [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT        C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

12:33:21.0804 5724  IDriverT ( UnsignedFile.Multi.Generic ) - warning

12:33:21.0804 5724  IDriverT - detected UnsignedFile.Multi.Generic (1)

12:33:21.0867 5724  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

12:33:21.0929 5724  idsvc - ok

12:33:21.0960 5724  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys

12:33:21.0976 5724  iirsp - ok

12:33:22.0023 5724  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll

12:33:22.0147 5724  IKEEXT - ok

12:33:22.0179 5724  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys

12:33:22.0194 5724  intelide - ok

12:33:22.0210 5724  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys

12:33:22.0257 5724  intelppm - ok

12:33:22.0288 5724  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum       C:\Windows\system32\ipbusenum.dll

12:33:22.0381 5724  IPBusEnum - ok

12:33:22.0413 5724  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys

12:33:22.0491 5724  IpFilterDriver - ok

12:33:22.0522 5724  [ A34A587FFFD45FA649FBA6D03784D257 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll

12:33:22.0584 5724  iphlpsvc - ok

12:33:22.0600 5724  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys

12:33:22.0647 5724  IPMIDRV - ok

12:33:22.0662 5724  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT           C:\Windows\system32\drivers\ipnat.sys

12:33:22.0756 5724  IPNAT - ok

12:33:22.0818 5724  [ 6E50CFA46527B39015B750AAD161C5CC ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe

12:33:22.0881 5724  iPod Service - ok

12:33:22.0896 5724  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys

12:33:22.0990 5724  IRENUM - ok

12:33:23.0005 5724  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys

12:33:23.0021 5724  isapnp - ok

12:33:23.0052 5724  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys

12:33:23.0083 5724  iScsiPrt - ok

12:33:23.0099 5724  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys

12:33:23.0115 5724  kbdclass - ok

12:33:23.0130 5724  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys

12:33:23.0177 5724  kbdhid - ok

12:33:23.0208 5724  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe

12:33:23.0239 5724  KeyIso - ok

12:33:23.0255 5724  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys

12:33:23.0286 5724  KSecDD - ok

12:33:23.0302 5724  [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys

12:33:23.0333 5724  KSecPkg - ok

12:33:23.0349 5724  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys

12:33:23.0411 5724  ksthunk - ok

12:33:23.0442 5724  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm           C:\Windows\system32\msdtckrm.dll

12:33:23.0536 5724  KtmRm - ok

12:33:23.0598 5724  [ CAEAA16039485B2D3BB069C1107442A5 ] L4301_Solar     C:\Program Files\Logitech\SolarApp\L4301_Solar.exe

12:33:23.0614 5724  L4301_Solar - ok

12:33:23.0645 5724  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\system32\srvsvc.dll

12:33:23.0723 5724  LanmanServer - ok

12:33:23.0739 5724  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll

12:33:23.0817 5724  LanmanWorkstation - ok

12:33:23.0848 5724  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys

12:33:23.0941 5724  lltdio - ok

12:33:23.0988 5724  [ C1185803384AB3FEED115F79F109427F ] lltdsvc         C:\Windows\System32\lltdsvc.dll

12:33:24.0082 5724  lltdsvc - ok

12:33:24.0113 5724  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts         C:\Windows\System32\lmhsvc.dll

12:33:24.0175 5724  lmhosts - ok

12:33:24.0222 5724  [ 17A9C5FFA241AAAB275EE5CACEF77686 ] LMS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

12:33:24.0253 5724  LMS - ok

12:33:24.0269 5724  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys

12:33:24.0300 5724  LSI_FC - ok

12:33:24.0331 5724  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys

12:33:24.0347 5724  LSI_SAS - ok

12:33:24.0363 5724  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys

12:33:24.0378 5724  LSI_SAS2 - ok

12:33:24.0394 5724  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys

12:33:24.0425 5724  LSI_SCSI - ok

12:33:24.0441 5724  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv           C:\Windows\system32\drivers\luafv.sys

12:33:24.0534 5724  luafv - ok

12:33:24.0565 5724  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll

12:33:24.0597 5724  Mcx2Svc - ok

12:33:24.0643 5724  [ 7CF1B716372B89568AE4C0FE769F5869 ] MDM             C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

12:33:24.0659 5724  MDM ( UnsignedFile.Multi.Generic ) - warning

12:33:24.0659 5724  MDM - detected UnsignedFile.Multi.Generic (1)

12:33:24.0675 5724  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys

12:33:24.0690 5724  megasas - ok

12:33:24.0721 5724  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys

12:33:24.0753 5724  MegaSR - ok

12:33:24.0768 5724  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS           C:\Windows\system32\mmcss.dll

12:33:24.0862 5724  MMCSS - ok

12:33:24.0877 5724  [ 800BA92F7010378B09F9ED9270F07137 ] Modem           C:\Windows\system32\drivers\modem.sys

12:33:24.0971 5724  Modem - ok

12:33:25.0002 5724  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor         C:\Windows\system32\DRIVERS\monitor.sys

12:33:25.0049 5724  monitor - ok

12:33:25.0080 5724  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys

12:33:25.0096 5724  mouclass - ok

12:33:25.0127 5724  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys

12:33:25.0158 5724  mouhid - ok

12:33:25.0189 5724  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys

12:33:25.0221 5724  mountmgr - ok

12:33:25.0283 5724  [ CB8AF049AC9BE419A77ADAE288673359 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

12:33:25.0299 5724  MozillaMaintenance - ok

12:33:25.0330 5724  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys

12:33:25.0361 5724  mpio - ok

12:33:25.0377 5724  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys

12:33:25.0470 5724  mpsdrv - ok

12:33:25.0501 5724  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll

12:33:25.0626 5724  MpsSvc - ok

12:33:25.0657 5724  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys

12:33:25.0689 5724  MRxDAV - ok

12:33:25.0704 5724  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys

12:33:25.0767 5724  mrxsmb - ok

12:33:25.0782 5724  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys

12:33:25.0829 5724  mrxsmb10 - ok

12:33:25.0845 5724  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys

12:33:25.0876 5724  mrxsmb20 - ok

12:33:25.0891 5724  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys

12:33:25.0907 5724  msahci - ok

12:33:25.0923 5724  [ DB801A638D011B9633829EB6F663C900 ] msdsm           C:\Windows\system32\drivers\msdsm.sys

12:33:25.0954 5724  msdsm - ok

12:33:25.0969 5724  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC           C:\Windows\System32\msdtc.exe

12:33:26.0001 5724  MSDTC - ok

12:33:26.0016 5724  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys

12:33:26.0094 5724  Msfs - ok

12:33:26.0125 5724  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys

12:33:26.0203 5724  mshidkmdf - ok

12:33:26.0203 5724  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys

12:33:26.0235 5724  msisadrv - ok

12:33:26.0266 5724  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll

12:33:26.0359 5724  MSiSCSI - ok

12:33:26.0359 5724  msiserver - ok

12:33:26.0391 5724  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys

12:33:26.0453 5724  MSKSSRV - ok

12:33:26.0469 5724  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys

12:33:26.0547 5724  MSPCLOCK - ok

12:33:26.0578 5724  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys

12:33:26.0656 5724  MSPQM - ok

12:33:26.0687 5724  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys

12:33:26.0718 5724  MsRPC - ok

12:33:26.0749 5724  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys

12:33:26.0765 5724  mssmbios - ok

12:33:26.0781 5724  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys

12:33:26.0874 5724  MSTEE - ok

12:33:26.0890 5724  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys

12:33:26.0937 5724  MTConfig - ok

12:33:26.0952 5724  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup             C:\Windows\system32\Drivers\mup.sys

12:33:26.0983 5724  Mup - ok

12:33:26.0999 5724  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll

12:33:27.0093 5724  napagent - ok

12:33:27.0124 5724  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys

12:33:27.0186 5724  NativeWifiP - ok

12:33:27.0233 5724  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\Windows\system32\drivers\ndis.sys

12:33:27.0295 5724  NDIS - ok

12:33:27.0311 5724  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys

12:33:27.0405 5724  NdisCap - ok

12:33:27.0436 5724  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys

12:33:27.0529 5724  NdisTapi - ok

12:33:27.0561 5724  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys

12:33:27.0639 5724  Ndisuio - ok

12:33:27.0670 5724  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys

12:33:27.0763 5724  NdisWan - ok

12:33:27.0795 5724  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys

12:33:27.0888 5724  NDProxy - ok

12:33:27.0935 5724  [ D4F51E88C71BF8F06EA1BE320B0BB75B ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll

12:33:27.0951 5724  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning

12:33:27.0951 5724  Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)

12:33:27.0982 5724  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys

12:33:28.0075 5724  NetBIOS - ok

12:33:28.0107 5724  [ 09594D1089C523423B32A4229263F068 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys

12:33:28.0200 5724  NetBT - ok

12:33:28.0231 5724  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe

12:33:28.0263 5724  Netlogon - ok

12:33:28.0294 5724  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll

12:33:28.0387 5724  Netman - ok

12:33:28.0419 5724  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll

12:33:28.0528 5724  netprofm - ok

12:33:28.0559 5724  [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

12:33:28.0590 5724  NetTcpPortSharing - ok

12:33:28.0762 5724  [ 39EDE676D17F37AF4573C2B33EC28ACA ] NETw5s64        C:\Windows\system32\DRIVERS\NETw5s64.sys

12:33:29.0043 5724  NETw5s64 - ok

12:33:29.0074 5724  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys

12:33:29.0105 5724  nfrd960 - ok

12:33:29.0136 5724  [ 1EE99A89CC788ADA662441D1E9830529 ] NlaSvc          C:\Windows\System32\nlasvc.dll

12:33:29.0230 5724  NlaSvc - ok

12:33:29.0277 5724  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys

12:33:29.0339 5724  Npfs - ok

12:33:29.0355 5724  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi             C:\Windows\system32\nsisvc.dll

12:33:29.0433 5724  nsi - ok

12:33:29.0448 5724  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys

12:33:29.0526 5724  nsiproxy - ok

12:33:29.0589 5724  [ A2F74975097F52A00745F9637451FDD8 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys

12:33:29.0667 5724  Ntfs - ok

12:33:29.0682 5724  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys

12:33:29.0760 5724  Null - ok

12:33:29.0791 5724  [ 181E7FE39211E04128A30708906627D8 ] NVHDA           C:\Windows\system32\drivers\nvhda64v.sys

12:33:29.0807 5724  NVHDA - ok

12:33:30.0041 5724  [ 42AF70B12D1FFF63FE858DDB59782695 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys

12:33:30.0400 5724  nvlddmkm - ok

12:33:30.0431 5724  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys

12:33:30.0462 5724  nvraid - ok

12:33:30.0493 5724  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys

12:33:30.0525 5724  nvstor - ok

12:33:30.0556 5724  [ B80B165C9139C937B4616D8567D63ACA ] nvsvc           C:\Windows\system32\nvvsvc.exe

12:33:30.0571 5724  nvsvc - ok

12:33:30.0603 5724  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys

12:33:30.0618 5724  nv_agp - ok

12:33:30.0696 5724  [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv          C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

12:33:30.0727 5724  odserv - ok

12:33:30.0774 5724  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys

12:33:30.0837 5724  ohci1394 - ok

12:33:30.0868 5724  [ 5A432A042DAE460ABE7199B758E8606C ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

12:33:30.0883 5724  ose - ok

12:33:30.0915 5724  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll

12:33:30.0977 5724  p2pimsvc - ok

12:33:31.0008 5724  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll

12:33:31.0055 5724  p2psvc - ok

12:33:31.0086 5724  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport         C:\Windows\system32\DRIVERS\parport.sys

12:33:31.0133 5724  Parport - ok

12:33:31.0164 5724  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr         C:\Windows\system32\drivers\partmgr.sys

12:33:31.0180 5724  partmgr - ok

12:33:31.0195 5724  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll

12:33:31.0242 5724  PcaSvc - ok

12:33:31.0289 5724  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci             C:\Windows\system32\drivers\pci.sys

12:33:31.0320 5724  pci - ok

12:33:31.0320 5724  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys

12:33:31.0351 5724  pciide - ok

12:33:31.0351 5724  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys

12:33:31.0383 5724  pcmcia - ok

12:33:31.0383 5724  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw             C:\Windows\system32\drivers\pcw.sys

12:33:31.0414 5724  pcw - ok

12:33:31.0445 5724  [ BAF3216DDAA12E66EBBB31760E02BC14 ] PdiService      C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe

12:33:31.0461 5724  PdiService - ok

12:33:31.0476 5724  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys

12:33:31.0601 5724  PEAUTH - ok

12:33:31.0648 5724  [ B9B0A4299DD2D76A4243F75FD54DC680 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll

12:33:31.0741 5724  PeerDistSvc - ok

12:33:31.0819 5724  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe

12:33:31.0851 5724  PerfHost - ok

12:33:31.0913 5724  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla             C:\Windows\system32\pla.dll

12:33:32.0038 5724  pla - ok

12:33:32.0053 5724  PLCNDIS5 - ok

12:33:32.0085 5724  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll

12:33:32.0163 5724  PlugPlay - ok

12:33:32.0178 5724  [ 9A80707D8B6C1806531BFD7399B3CC76 ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll

12:33:32.0194 5724  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning

12:33:32.0194 5724  Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)

12:33:32.0209 5724  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll

12:33:32.0256 5724  PNRPAutoReg - ok

12:33:32.0287 5724  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll

12:33:32.0303 5724  PNRPsvc - ok

12:33:32.0334 5724  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll

12:33:32.0443 5724  PolicyAgent - ok

12:33:32.0475 5724  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power           C:\Windows\system32\umpo.dll

12:33:32.0553 5724  Power - ok

12:33:32.0584 5724  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys

12:33:32.0662 5724  PptpMiniport - ok

12:33:32.0693 5724  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor       C:\Windows\system32\DRIVERS\processr.sys

12:33:32.0740 5724  Processor - ok

12:33:32.0771 5724  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc         C:\Windows\system32\profsvc.dll

12:33:32.0833 5724  ProfSvc - ok

12:33:32.0849 5724  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe

12:33:32.0865 5724  ProtectedStorage - ok

12:33:32.0896 5724  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys

12:33:32.0958 5724  Psched - ok

12:33:33.0005 5724  [ 87B04878A6D59D6C79251DC960C674C1 ] PxHlpa64        C:\Windows\system32\Drivers\PxHlpa64.sys

12:33:33.0021 5724  PxHlpa64 - ok

12:33:33.0052 5724  [ 052031A92809B438683FDCF5B574234D ] qcfilterhp2k    C:\Windows\system32\DRIVERS\qcfilterhp2k.sys

12:33:33.0114 5724  qcfilterhp2k - ok

12:33:33.0130 5724  [ 9D8D8077A1B849AFEC221FDD33E9DADD ] qcombushp       C:\Windows\system32\DRIVERS\qcombushp.sys

12:33:33.0145 5724  qcombushp - ok

12:33:33.0192 5724  [ B7FB4EAE56062A732EC962BF980512FA ] qcusbnethp2k    C:\Windows\system32\DRIVERS\qcusbnethp2k.sys

12:33:33.0255 5724  qcusbnethp2k - ok

12:33:33.0286 5724  [ 4AD8CB1E096872EE7A7F6FBEAC91B54A ] qcusbserhp2k    C:\Windows\system32\DRIVERS\qcusbserhp2k.sys

12:33:33.0333 5724  qcusbserhp2k - ok

12:33:33.0395 5724  [ 6E780837D7A737E3AB258465158ECAFB ] QDLService2kHP  C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kHP.exe

12:33:33.0473 5724  QDLService2kHP - ok

12:33:33.0520 5724  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys

12:33:33.0613 5724  ql2300 - ok

12:33:33.0645 5724  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys

12:33:33.0660 5724  ql40xx - ok

12:33:33.0691 5724  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE           C:\Windows\system32\qwave.dll

12:33:33.0754 5724  QWAVE - ok

12:33:33.0769 5724  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys

12:33:33.0816 5724  QWAVEdrv - ok

12:33:33.0847 5724  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys

12:33:33.0925 5724  RasAcd - ok

12:33:33.0957 5724  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys

12:33:34.0050 5724  RasAgileVpn - ok

12:33:34.0081 5724  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto         C:\Windows\System32\rasauto.dll

12:33:34.0159 5724  RasAuto - ok

12:33:34.0191 5724  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys

12:33:34.0284 5724  Rasl2tp - ok

12:33:34.0315 5724  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll

12:33:34.0393 5724  RasMan - ok

12:33:34.0409 5724  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys

12:33:34.0503 5724  RasPppoe - ok

12:33:34.0534 5724  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys

12:33:34.0627 5724  RasSstp - ok

12:33:34.0643 5724  [ 77F665941019A1594D887A74F301FA2F ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys

12:33:34.0721 5724  rdbss - ok

12:33:34.0737 5724  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys

12:33:34.0768 5724  rdpbus - ok

12:33:34.0799 5724  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys

12:33:34.0877 5724  RDPCDD - ok

12:33:34.0893 5724  [ 1B6163C503398B23FF8B939C67747683 ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys

12:33:34.0924 5724  RDPDR - ok

12:33:34.0939 5724  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys

12:33:35.0017 5724  RDPENCDD - ok

12:33:35.0049 5724  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys

12:33:35.0142 5724  RDPREFMP - ok

12:33:35.0173 5724  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys

12:33:35.0236 5724  RDPWD - ok

12:33:35.0267 5724  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys

12:33:35.0298 5724  rdyboost - ok

12:33:35.0314 5724  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll

12:33:35.0392 5724  RemoteAccess - ok

12:33:35.0407 5724  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll

12:33:35.0517 5724  RemoteRegistry - ok

12:33:35.0548 5724  [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys

12:33:35.0595 5724  RFCOMM - ok

12:33:35.0626 5724  [ 6FAF5B04BEDC66D300D9D233B2D222F0 ] rimmptsk        C:\Windows\system32\DRIVERS\rimmpx64.sys

12:33:35.0688 5724  rimmptsk - ok

12:33:35.0704 5724  [ D018844DC53D8428410A2FEEEEE9373E ] rismcx64        C:\Windows\system32\DRIVERS\rismcx64.sys

12:33:35.0751 5724  rismcx64 - ok

12:33:35.0766 5724  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll

12:33:35.0860 5724  RpcEptMapper - ok

12:33:35.0875 5724  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe

12:33:35.0922 5724  RpcLocator - ok

12:33:35.0969 5724  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs           C:\Windows\system32\rpcss.dll

12:33:36.0047 5724  RpcSs - ok

12:33:36.0078 5724  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys

12:33:36.0172 5724  rspndr - ok

12:33:36.0219 5724  [ E60C0A09F997826C7627B244195AB581 ] s3cap           C:\Windows\system32\drivers\vms3cap.sys

12:33:36.0281 5724  s3cap - ok

12:33:36.0297 5724  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs           C:\Windows\system32\lsass.exe

12:33:36.0312 5724  SamSs - ok

12:33:36.0343 5724  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys

12:33:36.0359 5724  sbp2port - ok

12:33:36.0390 5724  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll

12:33:36.0484 5724  SCardSvr - ok

12:33:36.0531 5724  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys

12:33:36.0609 5724  scfilter - ok

12:33:36.0655 5724  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll

12:33:36.0780 5724  Schedule - ok

12:33:36.0796 5724  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc     C:\Windows\System32\certprop.dll

12:33:36.0874 5724  SCPolicySvc - ok

12:33:36.0889 5724  [ 111E0EBC0AD79CB0FA014B907B231CF0 ] sdbus           C:\Windows\system32\drivers\sdbus.sys

12:33:36.0921 5724  sdbus - ok

12:33:36.0952 5724  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll

12:33:37.0014 5724  SDRSVC - ok

12:33:37.0030 5724  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys

12:33:37.0123 5724  secdrv - ok

12:33:37.0155 5724  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll

12:33:37.0233 5724  seclogon - ok

12:33:37.0279 5724  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll

12:33:37.0357 5724  SENS - ok

12:33:37.0357 5724  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll

12:33:37.0389 5724  SensrSvc - ok

12:33:37.0404 5724  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys

12:33:37.0435 5724  Serenum - ok

12:33:37.0451 5724  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys

12:33:37.0498 5724  Serial - ok

12:33:37.0529 5724  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys

12:33:37.0560 5724  sermouse - ok

12:33:37.0623 5724  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll

12:33:37.0716 5724  SessionEnv - ok

12:33:37.0747 5724  [ A554811BCD09279536440C964AE35BBF ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys

12:33:37.0779 5724  sffdisk - ok

12:33:37.0794 5724  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys

12:33:37.0841 5724  sffp_mmc - ok

12:33:37.0872 5724  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys

12:33:37.0919 5724  sffp_sd - ok

12:33:37.0950 5724  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys

12:33:37.0981 5724  sfloppy - ok

12:33:38.0013 5724  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll

12:33:38.0106 5724  SharedAccess - ok

12:33:38.0137 5724  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll

12:33:38.0215 5724  ShellHWDetection - ok

12:33:38.0247 5724  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys

12:33:38.0262 5724  SiSRaid2 - ok

12:33:38.0278 5724  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys

12:33:38.0309 5724  SiSRaid4 - ok

12:33:38.0356 5724  [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate     C:\Program Files (x86)\Skype\Updater\Updater.exe

12:33:38.0371 5724  SkypeUpdate - ok

12:33:38.0387 5724  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb             C:\Windows\system32\DRIVERS\smb.sys

12:33:38.0465 5724  Smb - ok

12:33:38.0512 5724  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe

12:33:38.0559 5724  SNMPTRAP - ok

12:33:38.0621 5724  [ 84E347359A28E9E544FF169FBDEA5F59 ] SNP2UVC         C:\Windows\system32\DRIVERS\snp2uvc.sys

12:33:38.0699 5724  SNP2UVC - ok

12:33:38.0699 5724  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr           C:\Windows\system32\drivers\spldr.sys

12:33:38.0730 5724  spldr - ok

12:33:38.0761 5724  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler         C:\Windows\System32\spoolsv.exe

12:33:38.0824 5724  Spooler - ok

12:33:38.0902 5724  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe

12:33:39.0105 5724  sppsvc - ok

12:33:39.0151 5724  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify     C:\Windows\system32\sppuinotify.dll

12:33:39.0229 5724  sppuinotify - ok

12:33:39.0261 5724  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv             C:\Windows\system32\DRIVERS\srv.sys

12:33:39.0339 5724  srv - ok

12:33:39.0354 5724  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys

12:33:39.0417 5724  srv2 - ok

12:33:39.0432 5724  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys

12:33:39.0463 5724  srvnet - ok

12:33:39.0479 5724  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll

12:33:39.0557 5724  SSDPSRV - ok

12:33:39.0573 5724  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc         C:\Windows\system32\sstpsvc.dll

12:33:39.0651 5724  SstpSvc - ok

12:33:39.0713 5724  [ F8807AAF697E1D20C9D7716A4941E574 ] STacSV          C:\Program Files\IDT\WDM\STacSV64.exe

12:33:39.0744 5724  STacSV - ok

12:33:39.0760 5724  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys

12:33:39.0791 5724  stexstor - ok

12:33:39.0807 5724  [ 96DF19A03D37F8568141612D31F0D035 ] STHDA           C:\Windows\system32\DRIVERS\stwrt64.sys

12:33:39.0853 5724  STHDA - ok

12:33:39.0900 5724  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll

12:33:39.0978 5724  stisvc - ok

12:33:40.0009 5724  [ 7785DC213270D2FC066538DAF94087E7 ] storflt         C:\Windows\system32\drivers\vmstorfl.sys

12:33:40.0025 5724  storflt - ok

12:33:40.0041 5724  [ C40841817EF57D491F22EB103DA587CC ] StorSvc         C:\Windows\system32\storsvc.dll

12:33:40.0103 5724  StorSvc - ok

12:33:40.0119 5724  [ D34E4943D5AC096C8EDEEBFD80D76E23 ] storvsc         C:\Windows\system32\drivers\storvsc.sys

12:33:40.0134 5724  storvsc - ok

12:33:40.0150 5724  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\drivers\swenum.sys

12:33:40.0165 5724  swenum - ok

12:33:40.0197 5724  [ E08E46FDD841B7184194011CA1955A0B ] swprv           C:\Windows\System32\swprv.dll

12:33:40.0306 5724  swprv - ok

12:33:40.0399 5724  [ D268D2A0DB2A2BBE963E688D0B039267 ] SynTP           C:\Windows\system32\DRIVERS\SynTP.sys

12:33:40.0446 5724  SynTP - ok

12:33:40.0493 5724  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain         C:\Windows\system32\sysmain.dll

12:33:40.0587 5724  SysMain - ok

12:33:40.0602 5724  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll

12:33:40.0649 5724  TabletInputService - ok

12:33:40.0696 5724  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv         C:\Windows\System32\tapisrv.dll

12:33:40.0774 5724  TapiSrv - ok

12:33:40.0789 5724  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS             C:\Windows\System32\tbssvc.dll

12:33:40.0852 5724  TBS - ok

12:33:40.0914 5724  [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] Tcpip           C:\Windows\system32\drivers\tcpip.sys

12:33:41.0008 5724  Tcpip - ok

12:33:41.0070 5724  [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys

12:33:41.0148 5724  TCPIP6 - ok

12:33:41.0179 5724  [ DF687E3D8836BFB04FCC0615BF15A519 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys

12:33:41.0242 5724  tcpipreg - ok

12:33:41.0273 5724  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys

12:33:41.0304 5724  TDPIPE - ok

12:33:41.0320 5724  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys

12:33:41.0367 5724  TDTCP - ok

12:33:41.0398 5724  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys

12:33:41.0460 5724  tdx - ok

12:33:41.0476 5724  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\drivers\termdd.sys

12:33:41.0491 5724  TermDD - ok

12:33:41.0523 5724  [ 2E648163254233755035B46DD7B89123 ] TermService     C:\Windows\System32\termsrv.dll

12:33:41.0632 5724  TermService - ok

12:33:41.0663 5724  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll

12:33:41.0694 5724  Themes - ok

12:33:41.0710 5724  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER     C:\Windows\system32\mmcss.dll

12:33:41.0772 5724  THREADORDER - ok

12:33:41.0788 5724  [ DBCC20C02E8A3E43B03C304A4E40A84F ] TPM             C:\Windows\system32\drivers\tpm.sys

12:33:41.0835 5724  TPM - ok

12:33:41.0850 5724  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll

12:33:41.0944 5724  TrkWks - ok

12:33:41.0991 5724  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe

12:33:42.0069 5724  TrustedInstaller - ok

12:33:42.0115 5724  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys

12:33:42.0209 5724  tssecsrv - ok

12:33:42.0240 5724  [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys

12:33:42.0303 5724  TsUsbFlt - ok

12:33:42.0412 5724  [ 811A229718C85356BC81EB20F35EB7F6 ] TuneUp.UtilitiesSvc C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe

12:33:42.0505 5724  TuneUp.UtilitiesSvc - ok

12:33:42.0537 5724  [ DCC94C51D27C7EC0DADECA8F64C94FCF ] TuneUpUtilitiesDrv C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys

12:33:42.0552 5724  TuneUpUtilitiesDrv - ok

12:33:42.0583 5724  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys

12:33:42.0677 5724  tunnel - ok

12:33:42.0708 5724  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys

12:33:42.0724 5724  uagp35 - ok

12:33:42.0755 5724  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys

12:33:42.0849 5724  udfs - ok

12:33:42.0895 5724  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect       C:\Windows\system32\UI0Detect.exe

12:33:42.0927 5724  UI0Detect - ok

12:33:42.0973 5724  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys

12:33:42.0989 5724  uliagpkx - ok

12:33:43.0036 5724  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus           C:\Windows\system32\DRIVERS\umbus.sys

12:33:43.0051 5724  umbus - ok

12:33:43.0083 5724  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys

12:33:43.0129 5724  UmPass - ok

12:33:43.0161 5724  [ A293DCD756D04D8492A750D03B9A297C ] UmRdpService    C:\Windows\System32\umrdp.dll

12:33:43.0207 5724  UmRdpService - ok

12:33:43.0317 5724  [ 7953D636309B7F505C70667A7A2437CF ] UNS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

12:33:43.0395 5724  UNS - ok

12:33:43.0426 5724  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll

12:33:43.0504 5724  upnphost - ok

12:33:43.0535 5724  [ FB251567F41BC61988B26731DEC19E4B ] USBAAPL64       C:\Windows\system32\Drivers\usbaapl64.sys

12:33:43.0551 5724  USBAAPL64 ( UnsignedFile.Multi.Generic ) - warning

12:33:43.0551 5724  USBAAPL64 - detected UnsignedFile.Multi.Generic (1)

12:33:43.0582 5724  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys

12:33:43.0613 5724  usbccgp - ok

12:33:43.0629 5724  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys

12:33:43.0660 5724  usbcir - ok

12:33:43.0691 5724  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci         C:\Windows\system32\drivers\usbehci.sys

12:33:43.0738 5724  usbehci - ok

12:33:43.0785 5724  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys

12:33:43.0831 5724  usbhub - ok

12:33:43.0863 5724  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci         C:\Windows\system32\drivers\usbohci.sys

12:33:43.0909 5724  usbohci - ok

12:33:43.0941 5724  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys

12:33:43.0972 5724  usbprint - ok

12:33:44.0003 5724  [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan         C:\Windows\system32\DRIVERS\usbscan.sys

12:33:44.0050 5724  usbscan - ok

12:33:44.0081 5724  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS

12:33:44.0112 5724  USBSTOR - ok

12:33:44.0128 5724  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys

12:33:44.0159 5724  usbuhci - ok

12:33:44.0190 5724  [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys

12:33:44.0237 5724  usbvideo - ok

12:33:44.0284 5724  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms           C:\Windows\System32\uxsms.dll

12:33:44.0377 5724  UxSms - ok

12:33:44.0440 5724  [ 5BF180F7F7C2F68ED6D5777840270BCE ] UxTuneUp        C:\Windows\System32\uxtuneup.dll

12:33:44.0455 5724  UxTuneUp - ok

12:33:44.0471 5724  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe

12:33:44.0487 5724  VaultSvc - ok

12:33:44.0580 5724  [ BBE2B5036D2FF45458C747FB2513591D ] vcsFPService    C:\Windows\system32\vcsFPService.exe

12:33:44.0674 5724  vcsFPService - ok

12:33:44.0689 5724  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys

12:33:44.0705 5724  vdrvroot - ok

12:33:44.0752 5724  [ 8D6B481601D01A456E75C3210F1830BE ] vds             C:\Windows\System32\vds.exe

12:33:44.0861 5724  vds - ok

12:33:44.0908 5724  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys

12:33:44.0939 5724  vga - ok

12:33:44.0970 5724  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave         C:\Windows\System32\drivers\vga.sys

12:33:45.0033 5724  VgaSave - ok

12:33:45.0048 5724  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys

12:33:45.0095 5724  vhdmp - ok

12:33:45.0095 5724  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys

12:33:45.0126 5724  viaide - ok

12:33:45.0126 5724  [ 86EA3E79AE350FEA5331A1303054005F ] vmbus           C:\Windows\system32\drivers\vmbus.sys

12:33:45.0157 5724  vmbus - ok

12:33:45.0173 5724  [ 7DE90B48F210D29649380545DB45A187 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys

12:33:45.0189 5724  VMBusHID - ok

12:33:45.0204 5724  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys

12:33:45.0220 5724  volmgr - ok

12:33:45.0235 5724  [ A255814907C89BE58B79EF2F189B843B ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys

12:33:45.0267 5724  volmgrx - ok

12:33:45.0298 5724  [ DF8126BD41180351A093A3AD2FC8903B ] volsnap         C:\Windows\system32\drivers\volsnap.sys

12:33:45.0329 5724  volsnap - ok

12:33:45.0345 5724  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys

12:33:45.0376 5724  vsmraid - ok

12:33:45.0423 5724  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS             C:\Windows\system32\vssvc.exe

12:33:45.0563 5724  VSS - ok

12:33:45.0563 5724  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys

12:33:45.0594 5724  vwifibus - ok

12:33:45.0625 5724  [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys

12:33:45.0672 5724  vwififlt - ok

12:33:45.0703 5724  [ 6A638FC4BFDDC4D9B186C28C91BD1A01 ] vwifimp         C:\Windows\system32\DRIVERS\vwifimp.sys

12:33:45.0735 5724  vwifimp - ok

12:33:45.0766 5724  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time         C:\Windows\system32\w32time.dll

12:33:45.0859 5724  W32Time - ok

12:33:45.0891 5724  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys

12:33:45.0922 5724  WacomPen - ok

12:33:45.0969 5724  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys

12:33:46.0062 5724  WANARP - ok

12:33:46.0062 5724  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys

12:33:46.0140 5724  Wanarpv6 - ok

12:33:46.0203 5724  [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc     C:\Windows\system32\Wat\WatAdminSvc.exe

12:33:46.0296 5724  WatAdminSvc - ok

12:33:46.0343 5724  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe

12:33:46.0437 5724  wbengine - ok

12:33:46.0468 5724  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll

12:33:46.0515 5724  WbioSrvc - ok

12:33:46.0530 5724  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc         C:\Windows\System32\wcncsvc.dll

12:33:46.0608 5724  wcncsvc - ok

12:33:46.0624 5724  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll

12:33:46.0671 5724  WcsPlugInService - ok

12:33:46.0686 5724  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\DRIVERS\wd.sys

12:33:46.0717 5724  Wd - ok

12:33:46.0733 5724  [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys

12:33:46.0780 5724  Wdf01000 - ok

12:33:46.0811 5724  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll

12:33:46.0920 5724  WdiServiceHost - ok

12:33:46.0936 5724  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost   C:\Windows\system32\wdi.dll

12:33:46.0967 5724  WdiSystemHost - ok

12:33:46.0998 5724  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient       C:\Windows\System32\webclnt.dll

12:33:47.0061 5724  WebClient - ok

12:33:47.0092 5724  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll

12:33:47.0170 5724  Wecsvc - ok

12:33:47.0185 5724  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport   C:\Windows\System32\wercplsupport.dll

12:33:47.0279 5724  wercplsupport - ok

12:33:47.0310 5724  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll

12:33:47.0404 5724  WerSvc - ok

12:33:47.0435 5724  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys

12:33:47.0497 5724  WfpLwf - ok

12:33:47.0529 5724  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys

12:33:47.0544 5724  WIMMount - ok

12:33:47.0575 5724  WinDefend - ok

12:33:47.0575 5724  WinHttpAutoProxySvc - ok

12:33:47.0638 5724  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll

12:33:47.0716 5724  Winmgmt - ok

12:33:47.0778 5724  [ BCB1310604AA415C4508708975B3931E ] WinRM           C:\Windows\system32\WsmSvc.dll

12:33:47.0903 5724  WinRM - ok

12:33:47.0919 5724  [ FE88B288356E7B47B74B13372ADD906D ] WinUSB          C:\Windows\system32\DRIVERS\WinUSB.sys

12:33:47.0950 5724  WinUSB - ok

12:33:47.0997 5724  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc         C:\Windows\System32\wlansvc.dll

12:33:48.0059 5724  Wlansvc - ok

12:33:48.0137 5724  [ 98F138897EF4246381D197CB81846D62 ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

12:33:48.0246 5724  wlidsvc - ok

12:33:48.0262 5724  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys

12:33:48.0309 5724  WmiAcpi - ok

12:33:48.0340 5724  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe

12:33:48.0387 5724  wmiApSrv - ok

12:33:48.0418 5724  WMPNetworkSvc - ok

12:33:48.0418 5724  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll

12:33:48.0449 5724  WPCSvc - ok

12:33:48.0480 5724  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll

12:33:48.0511 5724  WPDBusEnum - ok

12:33:48.0527 5724  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys

12:33:48.0621 5724  ws2ifsl - ok

12:33:48.0636 5724  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\System32\wscsvc.dll

12:33:48.0683 5724  wscsvc - ok

12:33:48.0730 5724  [ 8D918B1DB190A4D9B1753A66FA8C96E8 ] WSDPrintDevice  C:\Windows\system32\DRIVERS\WSDPrint.sys

12:33:48.0777 5724  WSDPrintDevice - ok

12:33:48.0777 5724  WSearch - ok

12:33:48.0855 5724  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll

12:33:48.0979 5724  wuauserv - ok

12:33:49.0011 5724  [ D3381DC54C34D79B22CEE0D65BA91B7C ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys

12:33:49.0089 5724  WudfPf - ok

12:33:49.0120 5724  [ CF8D590BE3373029D57AF80914190682 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys

12:33:49.0198 5724  WUDFRd - ok

12:33:49.0245 5724  [ 7A95C95B6C4CF292D689106BCAE49543 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll

12:33:49.0307 5724  wudfsvc - ok

12:33:49.0323 5724  [ CE8CF9DE9CBFDAA318BD04D8BE3FCADA ] WwanSvc         C:\Windows\System32\wwansvc.dll

12:33:49.0385 5724  WwanSvc - ok

12:33:49.0416 5724  ================ Scan global ===============================

12:33:49.0432 5724  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll

12:33:49.0463 5724  [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll

12:33:49.0479 5724  [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll

12:33:49.0494 5724  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll

12:33:49.0510 5724  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe

12:33:49.0525 5724  [Global] - ok

12:33:49.0525 5724  ================ Scan MBR ==================================

12:33:49.0525 5724  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0

12:33:49.0900 5724  \Device\Harddisk0\DR0 - ok

12:33:49.0900 5724  ================ Scan VBR ==================================

12:33:49.0915 5724  [ A1FCCA6A5E3280B8E8371B91F7C447D3 ] \Device\Harddisk0\DR0\Partition1

12:33:49.0915 5724  \Device\Harddisk0\DR0\Partition1 - ok

12:33:49.0947 5724  [ B62B4991EA80F04F1A635E9E51BE5298 ] \Device\Harddisk0\DR0\Partition2

12:33:49.0947 5724  \Device\Harddisk0\DR0\Partition2 - ok

12:33:49.0947 5724  ============================================================

12:33:49.0947 5724  Scan finished

12:33:49.0947 5724  ============================================================

12:33:49.0962 5716  Detected object count: 6

12:33:49.0962 5716  Actual detected object count: 6

13:26:27.0859 5716  HP LaserJet Service ( UnsignedFile.Multi.Generic ) - skipped by user

13:26:27.0859 5716  HP LaserJet Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:26:27.0874 5716  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

13:26:27.0874 5716  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:26:27.0874 5716  MDM ( UnsignedFile.Multi.Generic ) - skipped by user

13:26:27.0874 5716  MDM ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:26:27.0874 5716  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user

13:26:27.0874 5716  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:26:27.0874 5716  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user

13:26:27.0874 5716  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:26:27.0874 5716  USBAAPL64 ( UnsignedFile.Multi.Generic ) - skipped by user

13:26:27.0874 5716  USBAAPL64 ( UnsignedFile.Multi.Generic ) - User select action: Skip

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Code:

ComboFix 12-10-04.01 - *** 04.10.2012  14:06:35.1.4 - x64

Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.8047.6093 [GMT 2:00]

ausgeführt von:: c:\users\***\Downloads\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

FW: FireWall *Disabled* {CE40CCC0-8ADB-6D67-25A0-C5B6438E4B57}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-09-04 bis 2012-10-04  ))))))))))))))))))))))))))))))

.

.

2012-10-04 12:14 . 2012-10-04 12:14        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-10-04 07:17 . 2012-10-04 07:17        --------        d-----w-        C:\_OTL

2012-09-26 18:00 . 2012-08-21 11:01        33240        ----a-w-        c:\windows\system32\drivers\GEARAspiWDM.sys

2012-09-26 17:59 . 2012-09-26 18:00        --------        d-----w-        c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69

2012-09-26 17:59 . 2012-09-26 18:00        --------        d-----w-        c:\program files\iTunes

2012-09-26 17:59 . 2012-09-26 17:59        --------        d-----w-        c:\program files\iPod

2012-09-26 08:03 . 2012-08-21 21:01        245760        ----a-w-        c:\windows\system32\OxpsConverter.exe

2012-09-25 12:11 . 2012-09-25 12:11        --------        d-----w-        c:\users\***\AppData\Roaming\mathegrafix

2012-09-23 12:59 . 2012-09-23 12:59        --------        d-----w-        c:\users\***\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

2012-09-20 11:37 . 2012-09-20 11:37        --------        d-----w-        c:\program files (x86)\Mozilla Maintenance Service

2012-09-20 11:37 . 2012-09-06 01:25        155104        ----a-w-        c:\program files (x86)\Mozilla Firefox\softokn3.dll

2012-09-20 11:17 . 2012-09-20 11:17        --------        d-----w-        c:\users\***\AppData\Roaming\Avira

2012-09-20 11:17 . 2012-09-20 11:10        27760        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2012-09-20 11:17 . 2012-09-20 11:10        132832        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2012-09-20 11:17 . 2012-09-20 11:10        98848        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2012-09-20 11:17 . 2012-09-20 11:10        139360        ----a-w-        c:\windows\system32\drivers\avfwot.sys

2012-09-20 11:17 . 2012-09-20 11:10        114128        ----a-w-        c:\windows\system32\drivers\avfwim.sys

2012-09-20 11:17 . 2012-09-20 11:17        --------        d-----w-        c:\program files (x86)\Avira

2012-09-18 11:11 . 2012-09-18 11:11        --------        d-----w-        c:\program files (x86)\Common Files\Skype

2012-09-18 10:53 . 2012-08-23 08:26        9310152        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{6A3698D3-27A6-4C58-8C56-D69CE788F2FB}\mpengine.dll

2012-09-18 10:52 . 2012-08-22 18:12        950128        ----a-w-        c:\windows\system32\drivers\ndis.sys

2012-09-18 10:52 . 2012-07-04 20:26        41472        ----a-w-        c:\windows\system32\drivers\RNDISMP.sys

2012-09-18 10:52 . 2012-08-02 17:58        574464        ----a-w-        c:\windows\system32\d3d10level9.dll

2012-09-18 10:52 . 2012-08-02 16:57        490496        ----a-w-        c:\windows\SysWow64\d3d10level9.dll

2012-09-18 10:52 . 2012-08-22 18:12        1913200        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2012-09-18 10:52 . 2012-08-22 18:12        376688        ----a-w-        c:\windows\system32\drivers\netio.sys

2012-09-18 10:52 . 2012-08-22 18:12        288624        ----a-w-        c:\windows\system32\drivers\FWPKCLNT.SYS

2012-09-16 15:09 . 2012-09-16 15:09        --------        d-----w-        c:\users\Beumers\AppData\Local\ESET

2012-09-16 15:07 . 2012-09-16 15:07        --------        d-----w-        c:\program files\ESET

2012-09-15 11:53 . 2012-09-15 12:13        --------        d-----w-        c:\users\***\Outlook

2012-09-14 19:33 . 2012-09-18 10:42        --------        d-----w-        c:\program files (x86)\Spybot - Search & Destroy

2012-09-14 19:33 . 2012-09-16 14:50        --------        d-----w-        c:\programdata\Spybot - Search & Destroy

2012-09-12 20:45 . 2012-09-12 20:45        --------        d-----w-        c:\users\***\AppData\Roaming\Malwarebytes

2012-09-12 20:45 . 2012-09-12 20:45        --------        d-----w-        c:\programdata\Malwarebytes

2012-09-09 19:23 . 2011-03-18 13:06        1090952        ----a-w-        c:\program files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-09-18 11:11 . 2011-04-09 13:43        64462936        ----a-w-        c:\windows\system32\MRT.exe

2012-08-21 11:01 . 2011-04-01 20:39        125872        ----a-w-        c:\windows\system32\GEARAspi64.dll

2012-08-21 11:01 . 2011-04-01 20:39        106928        ----a-w-        c:\windows\SysWow64\GEARAspi.dll

2012-07-18 18:15 . 2012-08-15 08:07        3148800        ----a-w-        c:\windows\system32\win32k.sys

2012-07-06 20:07 . 2012-08-15 13:19        552960        ----a-w-        c:\windows\system32\drivers\bthport.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CAHeadless"="c:\program files (x86)\Adobe\Elements 10 Organizer\CAHeadless\ElementsAutoAnalyzer.exe" [2011-09-01 835224]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2010-02-25 287800]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-09-20 348664]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

WISO Mein Steuer-Sparbuch heute.lnk - c:\program files (x86)\WISO\Steuersoftware 2012\mshaktuell.exe [2012-7-25 1370224]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"

"ToolboxFX"="c:\program files (x86)\HP\ToolboxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /fl:on /fr:on /appData:on /tmcp:on

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

"CanonSolutionMenuEx"=c:\program files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon

"AppleSyncNotifier"=c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

.

R2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe [2012-02-10 193816]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 PLCNDIS5;PLCNDIS5 NDIS Protocol Driver;c:\windows\system32\plcndis5.sys [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

R3 HPFXBULKLEDM;HPFXBULKLEDM;c:\windows\system32\drivers\hppdbulkio.sys [2010-10-03 22040]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-06 114144]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2011-04-17 1255736]

R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]

S1 avfwot;avfwot;c:\windows\system32\DRIVERS\avfwot.sys [2012-09-20 139360]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-09-20 27760]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

S2 AdobeActiveFileMonitor10.0;Adobe Active File Monitor V10;c:\program files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [2011-09-01 169624]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]

S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2011-11-17 89600]

S2 AntiVirFirewallService;Avira FireWall;c:\program files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [2012-09-20 619472]

S2 AntiVirMailService;Avira Email Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [2012-09-20 375760]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-09-20 86224]

S2 AntiVirWebService;Avira Browser Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [2012-09-20 465360]

S2 HP LaserJet Service;HP LaserJet Service;c:\program files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [2010-04-12 142336]

S2 HP Power Assistant Service;HP Power Assistant Service;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [2012-03-14 152992]

S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-09 86072]

S2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-07-21 103992]

S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2012-03-14 197504]

S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2011-05-13 30520]

S2 L4301_Solar;Logitech Solar Keyboard Service;c:\program files\Logitech\SolarApp\L4301_Solar.exe [2010-10-26 403536]

S2 PdiService;Portrait Displays SDK Service;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2012-03-09 117552]

S2 QDLService2kHP;Qualcomm Gobi 2000 Download Service (HP);c:\program files (x86)\QUALCOMM\QDLService2k\QDLService2kHP.exe [2011-04-29 1687360]

S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2012-05-29 2143072]

S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-04 2320920]

S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2010-02-18 2045232]

S3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys [2012-09-20 114128]

S3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe [2012-02-10 240408]

S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-09-17 35104]

S3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2010-02-25 227896]

S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys [2009-11-05 293552]

S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]

S3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2010-01-13 7675392]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2009-11-12 84584]

S3 qcfilterhp2k;HP un2420 Mobile Broadband Module USB Device Filter;c:\windows\system32\DRIVERS\qcfilterhp2k.sys [2011-04-29 6400]

S3 qcombushp;Gobi 2000 USB Composite Device Driver(03F0-251D);c:\windows\system32\DRIVERS\qcombushp.sys [2011-04-29 160328]

S3 qcusbnethp2k;Gobi 2000 USB-NDIS miniport(03F0-251D);c:\windows\system32\DRIVERS\qcusbnethp2k.sys [2011-04-29 444416]

S3 qcusbserhp2k;Gobi 2000 USB Device for Legacy Serial Communication(03F0-251D);c:\windows\system32\DRIVERS\qcusbserhp2k.sys [2011-04-29 230784]

S3 rismcx64;RICOH Smart Card Reader;c:\windows\system32\DRIVERS\rismcx64.sys [2009-07-20 59008]

S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2012-03-29 11856]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - 73713510

*Deregistered* - 73713510

.

Inhalt des "geplante Tasks" Ordners

.

2012-09-28 c:\windows\Tasks\HPCeeScheduleForBeumers.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2009-10-07 03:22]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2011-09-01 186904]

"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2010-11-03 1580368]

"HPPowerAssistant"="c:\program files\Hewlett-Packard\HP Power Assistant\DelayedAppStarter.exe" [2012-03-14 15232]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = about:blank

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local;<local>

uInternet Settings,ProxyServer = 192.168.1.18:8080

IE: {{6C7C0C9A-B51D-4ADB-A74D-C4E33744F866} - c:\program files (x86)\TraXEx\Integration\TraXEx Internet Explorer.lnk

IE: {{8DA7743F-9274-4BE8-899E-C0FF6ED61B00} - c:\program files (x86)\TraXEx\Integration\TraXEx Löschautomat.lnk

LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll

TCP: DhcpNameServer = 192.168.0.1

FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qvsktsnr.default\

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

AddRemove-{6F44AF95-3CDE-4513-AD3F-6D45F17BF324} - c:\program files (x86)\InstallShield Installation Information\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}\setup.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{01f54c06-4d8a-11e1-a91c-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{01f54c0e-4d8a-11e1-a91c-e02a822d5264}]

@DACL=(02 0000)

"_CommentFromDesktopINI"=""

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{06afac45-04d7-11e2-b7fc-68b599efcb9a}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0aa683c2-b6c9-11e1-81fd-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0af4f597-600a-11e0-80f3-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{10b82628-9009-11e0-821e-68b599efcb9a}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{134d5e7e-6862-11e0-b629-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{28ed32a9-21cc-11e1-a98f-68b599efcb9a}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{290703aa-4fd6-11e0-b325-806e6f6e6963}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{336b5ddc-27f3-11e1-9eb6-68b599efcb9a}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3740d74f-724c-11e0-99bc-68b599efcb9a}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{407b143e-02ee-11e2-bf6d-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40b6fb9b-cf5e-11e0-a761-68b599efcb9a}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{466c2ef6-c3a0-11e1-a949-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{482bccf9-8d33-11e1-8677-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{54b6d5b7-b845-11e1-87dd-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{568c36bb-e77c-11e1-9df7-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5ac69292-a79a-11e0-83ac-68b599efcb9a}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5e8e4688-df8d-11e0-bb1e-68b599efcb9a}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{615c9248-4da6-11e1-9d8f-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{66b26b26-6444-11e1-8c1c-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6aa96f04-531c-11e1-8df1-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{727224ed-4fcd-11e0-b3e7-806e6f6e6963}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{79788162-524f-11e1-b38c-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d18e940-39f6-11e1-8c59-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8fc36a4c-8901-11e0-9c10-0024d7732224}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{910ab8a7-889e-11e0-836f-0024d7732224}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{910ab8b6-889e-11e0-836f-0024d7732224}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{92f772ce-8117-11e0-9949-0024d7732224}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9937204f-8112-11e0-b780-68b599efcb9a}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9ff789b6-e397-11e1-9de0-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a6516175-401a-11e1-b3aa-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c73da417-c925-11e1-834f-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c73da419-c925-11e1-834f-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d48-0707-11e2-b694-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d4a-0707-11e2-b694-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e2cea0e1-4287-11e1-b9db-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3941852603-2146344533-209533615-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fabed94e-589d-11e0-80ed-e02a822d5264}]

@DACL=(02 0000)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OldTimer Tools\OTL\Files]

@DACL=(02 0000)

"c:\\Users\\Beumers\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt"=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2012-10-04  14:17:26

ComboFix-quarantined-files.txt  2012-10-04 12:17

.

Vor Suchlauf: 11 Verzeichnis(se), 268.276.322.304 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 268.122.361.856 Bytes frei

.

- - End Of File - - FB3BBD2C6CF877D07BCAF6C862C1F736

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Code:

GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2012-10-04 16:24:49

Windows 6.1.7601 Service Pack 1 

Running: xvqlwms0.exe
 
 

---- Registry - GMER 1.0.15 ----
 

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\e02a822d5264                                                                              

Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\e02a822d5264 (not active ControlSet)                                                          

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume                                                                          

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{01f54c06-4d8a-11e1-a91c-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{01f54c06-4d8a-11e1-a91c-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{01f54c06-4d8a-11e1-a91c-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{01f54c0e-4d8a-11e1-a91c-e02a822d5264}@_CommentFromDesktopINI                       

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{01f54c0e-4d8a-11e1-a91c-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{01f54c0e-4d8a-11e1-a91c-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{01f54c0e-4d8a-11e1-a91c-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{06afac45-04d7-11e2-b7fc-68b599efcb9a}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{06afac45-04d7-11e2-b7fc-68b599efcb9a}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{06afac45-04d7-11e2-b7fc-68b599efcb9a}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0aa683c2-b6c9-11e1-81fd-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0aa683c2-b6c9-11e1-81fd-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0aa683c2-b6c9-11e1-81fd-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0af4f597-600a-11e0-80f3-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0af4f597-600a-11e0-80f3-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0af4f597-600a-11e0-80f3-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{10b82628-9009-11e0-821e-68b599efcb9a}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{10b82628-9009-11e0-821e-68b599efcb9a}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{10b82628-9009-11e0-821e-68b599efcb9a}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{290703aa-4fd6-11e0-b325-806e6f6e6963}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{290703aa-4fd6-11e0-b325-806e6f6e6963}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{290703aa-4fd6-11e0-b325-806e6f6e6963}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{290703aa-4fd6-11e0-b325-806e6f6e6963}\shell\AutoRun                                

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{290703aa-4fd6-11e0-b325-806e6f6e6963}\shell\AutoRun@SetWorkingDirectoryFromTarget  

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{290703aa-4fd6-11e0-b325-806e6f6e6963}\shell\AutoRun\command                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{290703aa-4fd6-11e0-b325-806e6f6e6963}\_Autorun                                     

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{290703aa-4fd6-11e0-b325-806e6f6e6963}\_Autorun\DefaultIcon                         

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{336b5ddc-27f3-11e1-9eb6-68b599efcb9a}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{336b5ddc-27f3-11e1-9eb6-68b599efcb9a}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{336b5ddc-27f3-11e1-9eb6-68b599efcb9a}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3740d74f-724c-11e0-99bc-68b599efcb9a}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3740d74f-724c-11e0-99bc-68b599efcb9a}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3740d74f-724c-11e0-99bc-68b599efcb9a}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{466c2ef6-c3a0-11e1-a949-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{466c2ef6-c3a0-11e1-a949-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{466c2ef6-c3a0-11e1-a949-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{482bccf9-8d33-11e1-8677-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{482bccf9-8d33-11e1-8677-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{482bccf9-8d33-11e1-8677-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{54b6d5b7-b845-11e1-87dd-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{54b6d5b7-b845-11e1-87dd-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{54b6d5b7-b845-11e1-87dd-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{568c36bb-e77c-11e1-9df7-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{568c36bb-e77c-11e1-9df7-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{568c36bb-e77c-11e1-9df7-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5ac69292-a79a-11e0-83ac-68b599efcb9a}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5ac69292-a79a-11e0-83ac-68b599efcb9a}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5ac69292-a79a-11e0-83ac-68b599efcb9a}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{615c9248-4da6-11e1-9d8f-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{615c9248-4da6-11e1-9d8f-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{615c9248-4da6-11e1-9d8f-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{66b26b26-6444-11e1-8c1c-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{66b26b26-6444-11e1-8c1c-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{66b26b26-6444-11e1-8c1c-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6aa96f04-531c-11e1-8df1-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6aa96f04-531c-11e1-8df1-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6aa96f04-531c-11e1-8df1-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{79788162-524f-11e1-b38c-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{79788162-524f-11e1-b38c-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{79788162-524f-11e1-b38c-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d18e940-39f6-11e1-8c59-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d18e940-39f6-11e1-8c59-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d18e940-39f6-11e1-8c59-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8fc36a4c-8901-11e0-9c10-0024d7732224}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8fc36a4c-8901-11e0-9c10-0024d7732224}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8fc36a4c-8901-11e0-9c10-0024d7732224}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{910ab8a7-889e-11e0-836f-0024d7732224}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{910ab8a7-889e-11e0-836f-0024d7732224}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{910ab8a7-889e-11e0-836f-0024d7732224}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{910ab8b6-889e-11e0-836f-0024d7732224}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{910ab8b6-889e-11e0-836f-0024d7732224}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{910ab8b6-889e-11e0-836f-0024d7732224}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{92f772ce-8117-11e0-9949-0024d7732224}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{92f772ce-8117-11e0-9949-0024d7732224}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{92f772ce-8117-11e0-9949-0024d7732224}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9937204f-8112-11e0-b780-68b599efcb9a}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9937204f-8112-11e0-b780-68b599efcb9a}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9937204f-8112-11e0-b780-68b599efcb9a}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9ff789b6-e397-11e1-9de0-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9ff789b6-e397-11e1-9de0-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9ff789b6-e397-11e1-9de0-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a6516175-401a-11e1-b3aa-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a6516175-401a-11e1-b3aa-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a6516175-401a-11e1-b3aa-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c73da417-c925-11e1-834f-e02a822d5264}\_Autorun                                     

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c73da417-c925-11e1-834f-e02a822d5264}\_Autorun\Action                              

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c73da417-c925-11e1-834f-e02a822d5264}\_Autorun\DefaultIcon                         

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c73da419-c925-11e1-834f-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c73da419-c925-11e1-834f-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c73da419-c925-11e1-834f-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d48-0707-11e2-b694-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d48-0707-11e2-b694-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d48-0707-11e2-b694-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d48-0707-11e2-b694-e02a822d5264}\shell\AutoRun                                

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d48-0707-11e2-b694-e02a822d5264}\shell\AutoRun@SetWorkingDirectoryFromTarget  

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d48-0707-11e2-b694-e02a822d5264}\shell\AutoRun\command                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d48-0707-11e2-b694-e02a822d5264}\_Autorun                                     

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d48-0707-11e2-b694-e02a822d5264}\_Autorun\DefaultIcon                         

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d4a-0707-11e2-b694-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d4a-0707-11e2-b694-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d4a-0707-11e2-b694-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e2cea0e1-4287-11e1-b9db-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e2cea0e1-4287-11e1-b9db-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e2cea0e1-4287-11e1-b9db-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fabed94e-589d-11e0-80ed-e02a822d5264}\shell                                        

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fabed94e-589d-11e0-80ed-e02a822d5264}\shell\Autoplay                               

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fabed94e-589d-11e0-80ed-e02a822d5264}\shell\Autoplay\DropTarget                    

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{01f54c06-4d8a-11e1-a91c-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{01f54c0e-4d8a-11e1-a91c-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{06afac45-04d7-11e2-b7fc-68b599efcb9a}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0aa683c2-b6c9-11e1-81fd-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0af4f597-600a-11e0-80f3-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{10b82628-9009-11e0-821e-68b599efcb9a}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{290703aa-4fd6-11e0-b325-806e6f6e6963}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{336b5ddc-27f3-11e1-9eb6-68b599efcb9a}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3740d74f-724c-11e0-99bc-68b599efcb9a}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{466c2ef6-c3a0-11e1-a949-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{482bccf9-8d33-11e1-8677-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{54b6d5b7-b845-11e1-87dd-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{568c36bb-e77c-11e1-9df7-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5ac69292-a79a-11e0-83ac-68b599efcb9a}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{615c9248-4da6-11e1-9d8f-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{66b26b26-6444-11e1-8c1c-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6aa96f04-531c-11e1-8df1-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{79788162-524f-11e1-b38c-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d18e940-39f6-11e1-8c59-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8fc36a4c-8901-11e0-9c10-0024d7732224}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{910ab8a7-889e-11e0-836f-0024d7732224}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{910ab8b6-889e-11e0-836f-0024d7732224}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{92f772ce-8117-11e0-9949-0024d7732224}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9937204f-8112-11e0-b780-68b599efcb9a}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9ff789b6-e397-11e1-9de0-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a6516175-401a-11e1-b3aa-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c73da419-c925-11e1-834f-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d48-0707-11e2-b694-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d4a-0707-11e2-b694-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e2cea0e1-4287-11e1-b9db-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fabed94e-589d-11e0-80ed-e02a822d5264}\shell\Autoplay@MUIVerb                       @shell32.dll,-8507

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{290703aa-4fd6-11e0-b325-806e6f6e6963}\shell@                                       AutoRun

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d48-0707-11e2-b694-e02a822d5264}\shell@                                       AutoRun

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{290703aa-4fd6-11e0-b325-806e6f6e6963}\shell\AutoRun\command@                       C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL D:\userguide.html

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{290703aa-4fd6-11e0-b325-806e6f6e6963}\_Autorun\DefaultIcon@                        D:\icon.ico

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{290703aa-4fd6-11e0-b325-806e6f6e6963}\shell\AutoRun@ShellExecute                   D:\userguide.html

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c73da417-c925-11e1-834f-e02a822d5264}\_Autorun\DefaultIcon@                        E:\HTC_Sync_Manager_PC.exe,0

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d48-0707-11e2-b694-e02a822d5264}\shell\AutoRun\command@                       F:\LaunchU3.exe

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d48-0707-11e2-b694-e02a822d5264}\_Autorun\DefaultIcon@                        F:\LaunchU3.exe,0

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c73da417-c925-11e1-834f-e02a822d5264}\_Autorun\Action@                             HTC Sync Manager

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{01f54c06-4d8a-11e1-a91c-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{01f54c0e-4d8a-11e1-a91c-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{06afac45-04d7-11e2-b7fc-68b599efcb9a}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0aa683c2-b6c9-11e1-81fd-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0af4f597-600a-11e0-80f3-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{10b82628-9009-11e0-821e-68b599efcb9a}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{336b5ddc-27f3-11e1-9eb6-68b599efcb9a}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3740d74f-724c-11e0-99bc-68b599efcb9a}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{466c2ef6-c3a0-11e1-a949-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{482bccf9-8d33-11e1-8677-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{54b6d5b7-b845-11e1-87dd-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{568c36bb-e77c-11e1-9df7-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5ac69292-a79a-11e0-83ac-68b599efcb9a}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{615c9248-4da6-11e1-9d8f-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{66b26b26-6444-11e1-8c1c-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6aa96f04-531c-11e1-8df1-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{79788162-524f-11e1-b38c-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d18e940-39f6-11e1-8c59-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8fc36a4c-8901-11e0-9c10-0024d7732224}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{910ab8a7-889e-11e0-836f-0024d7732224}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{910ab8b6-889e-11e0-836f-0024d7732224}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{92f772ce-8117-11e0-9949-0024d7732224}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9937204f-8112-11e0-b780-68b599efcb9a}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9ff789b6-e397-11e1-9de0-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a6516175-401a-11e1-b3aa-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c73da419-c925-11e1-834f-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d4a-0707-11e2-b694-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e2cea0e1-4287-11e1-b9db-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fabed94e-589d-11e0-80ed-e02a822d5264}\shell@                                       None

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{290703aa-4fd6-11e0-b325-806e6f6e6963}\shell\AutoRun@                               Programm installieren oder ausf?hren

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d48-0707-11e2-b694-e02a822d5264}\shell\AutoRun@                               Programm installieren oder ausf?hren

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{01f54c06-4d8a-11e1-a91c-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{01f54c0e-4d8a-11e1-a91c-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{06afac45-04d7-11e2-b7fc-68b599efcb9a}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0aa683c2-b6c9-11e1-81fd-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0af4f597-600a-11e0-80f3-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{10b82628-9009-11e0-821e-68b599efcb9a}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{290703aa-4fd6-11e0-b325-806e6f6e6963}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{336b5ddc-27f3-11e1-9eb6-68b599efcb9a}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3740d74f-724c-11e0-99bc-68b599efcb9a}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{466c2ef6-c3a0-11e1-a949-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{482bccf9-8d33-11e1-8677-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{54b6d5b7-b845-11e1-87dd-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{568c36bb-e77c-11e1-9df7-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5ac69292-a79a-11e0-83ac-68b599efcb9a}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{615c9248-4da6-11e1-9d8f-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{66b26b26-6444-11e1-8c1c-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6aa96f04-531c-11e1-8df1-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{79788162-524f-11e1-b38c-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d18e940-39f6-11e1-8c59-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8fc36a4c-8901-11e0-9c10-0024d7732224}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{910ab8a7-889e-11e0-836f-0024d7732224}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{910ab8b6-889e-11e0-836f-0024d7732224}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{92f772ce-8117-11e0-9949-0024d7732224}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9937204f-8112-11e0-b780-68b599efcb9a}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9ff789b6-e397-11e1-9de0-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a6516175-401a-11e1-b3aa-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c73da419-c925-11e1-834f-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d48-0707-11e2-b694-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7b46d4a-0707-11e2-b694-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e2cea0e1-4287-11e1-b9db-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fabed94e-589d-11e0-80ed-e02a822d5264}\shell\Autoplay\DropTarget@CLSID              {F26A669A-BCBB-4E37-ABF9-7325DA15F931}
 

---- EOF - GMER 1.0.15 ----

Oben zunächst einmal GMER.

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 18:24:42 on 04.10.2012
 

OS: Windows 7  Service Pack 1 (Build 7601), 64-bit

Default Browser: Mozilla Corporation Firefox 15.0.1
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"HPCeeScheduleFor***.job" - "Hewlett-Packard" - C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"HPPA.cpl" - "Hewlett-Packard Company" - C:\Windows\system32\HPPA.cpl

"HPWA.cpl" - "Hewlett-Packard" - C:\Windows\system32\HPWA.cpl

"nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\MLCFG32.CPL

"QuickTime" - "Apple Inc." - C:\Program Files (x86)\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Apple Mobile USB Driver" (USBAAPL64) - "Apple, Inc." - C:\Windows\System32\Drivers\usbaapl64.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys

"PLCNDIS5 NDIS Protocol Driver" (PLCNDIS5) - ? - C:\Windows\system32\plcndis5.sys  (File not found)

"TuneUpUtilitiesDrv" (TuneUpUtilitiesDrv) - "TuneUp Software" - C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\MSOHEVI.DLL

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\OLKFSTUB.DLL

{7020EDF4-B454-4814-9AA4-1D604D3F1417} "TraXExCM" - "Alexander Miehlke Softwareentwicklung" - C:\PROGRA~2\TraXEx\INTEGR~1\TraXExCM.dll

{4838CD50-7E5D-4811-9B17-C47A85539F28} "TuneUp Disk Space Explorer Shell Extension" - "TuneUp Software" - C:\Program Files (x86)\TuneUp Utilities 2012\DseShExt-x86.dll

{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software" - C:\Program Files (x86)\TuneUp Utilities 2012\SDShelEx-win32.dll

{E6FB5E20-DE35-11CF-9C87-00AA005127ED} "WebCheck" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad )-----

{E6FB5E20-DE35-11CF-9C87-00AA005127ED} "WebCheck" - ? -   (File not found | COM-object registry key not found)
 

[Internet Explorer]

-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----

{21347690-EC41-4F9A-8887-1F4AEE672439} "Canon Easy-WebPrint EX" - "CANON INC." - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{7530BFB8-7293-4D34-9923-61A11451AFC5} "{7530BFB8-7293-4D34-9923-61A11451AFC5}" - ? -   (File not found | COM-object registry key not found) / hxxp://download.eset.com/special/eos/OnlineScanner.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{6FE6A929-59D1-4763-91AD-29B61CFFB35B} "An Mindjet MindManager senden" - "Mindjet" - C:\Program Files (x86)\Mindjet\MindManager 9\Mm8InternetExplorer.dll

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

"Senden an Bluetooth" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{8dcb7100-df86-4384-8842-8fa844297b3f} "Bing Bar" - "Microsoft Corporation." - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll

{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} "Canon Easy-WebPrint EX" - "CANON INC." - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{d2ce3e00-f94a-4740-988e-03dc2f38c34f} "Bing Bar Helper" - "Microsoft Corporation." - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll

{3785D0AD-BFFF-47F6-BF5B-A587C162FED9} "Canon Easy-WebPrint EX BHO" - "CANON INC." - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll

{6FE6A929-59D1-4763-91AD-29B61CFFB35B} "CmjBrowserHelperObject Object" - "Mindjet" - C:\Program Files (x86)\Mindjet\MindManager 9\Mm8InternetExplorer.dll

{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
 

[LSA Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----

"Security Packages" - "Microsoft Corporation" - C:\Windows\system32\livessp.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Beumers\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"WISO Mein Steuer-Sparbuch heute.lnk" - "Buhl Tax Service, Hannover" - C:\Program Files (x86)\WISO\Steuersoftware 2012\mshaktuell.exe  (Shortcut exists | File exists)

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"CAHeadless" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Adobe\Elements 10 Organizer\CAHeadless\ElementsAutoAnalyzer.exe

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"APSDaemon" - "Apple Inc." - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min

"QlbCtrl.exe" - " Hewlett-Packard Development Company, L.P." - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Canon BJNP Port" - "CANON INC." - C:\Windows\system32\CNMN6PPM.DLL

"HP Standard TCP/IP Port" - "Hewlett Packard" - C:\Windows\system32\HpTcpMon.dll

"PDF-XChange" - "Tracker Software" - C:\Windows\system32\pxc35pm.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)

"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)

"@%SystemRoot%\System32\uxtuneup.dll,-4096" (UxTuneUp) - "TuneUp Software" - C:\Windows\System32\uxtuneup.dll

"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

"Adobe Active File Monitor V10" (AdobeActiveFileMonitor10.0) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"Avira Browser Schutz" (AntiVirWebService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE

"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

"Avira Email Schutz" (AntiVirMailService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe

"Avira FireWall" (AntiVirFirewallService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe

"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

"BBUpdate" (BBUpdate) - "Microsoft Corporation." - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe

"BingBar Service" (BBSvc) - "Microsoft Corporation." - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe

"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

"Com4QLBEx" (Com4QLBEx) - "Hewlett-Packard Development Company, L.P." - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"HP LaserJet Service" (HP LaserJet Service) - "HP" - C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe

"HP Power Assistant Service" (HP Power Assistant Service) - "Hewlett-Packard Company" - C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe

"HP Quick Synchronization Service" (HPDrvMntSvc.exe) - "Hewlett-Packard Company" - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

"HP Software Framework Service" (hpqwmiex) - "Hewlett-Packard Company" - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

"HP Support Assistant Service" (HP Support Assistant Service) - "Hewlett-Packard Company" - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

"HP Wireless Assistant Service" (HP Wireless Assistant Service) - "Hewlett-Packard Company" - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

"Intel(R) Management & Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

"Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"Logitech Solar Keyboard Service" (L4301_Solar) - "Logitech, Inc." - C:\Program Files\Logitech\SolarApp\L4301_Solar.exe

"Machine Debug Manager" (MDM) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll

"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll

"Portrait Displays SDK Service" (PdiService) - "Portrait Displays, Inc." - C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe

"Qualcomm Gobi 2000 Download Service (HP)" (QDLService2kHP) - "QUALCOMM, Inc." - C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kHP.exe

"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files (x86)\Skype\Updater\Updater.exe

"TuneUp Utilities Service" (TuneUp.UtilitiesSvc) - "TuneUp Software" - C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe

"Validity VCS Fingerprint Service" (vcsFPService) - "Validity Sensors, Inc." - C:\Windows\system32\vcsFPService.exe

"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files (x86)\Bonjour\mdnsNSP.dll

"WindowsLive Local NSP" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL

"WindowsLive NSP" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----

"AVSDA" - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-10-04 18:29:54

-----------------------------

18:29:54.102    OS Version: Windows x64 6.1.7601 Service Pack 1

18:29:54.102    Number of processors: 4 586 0x2505

18:29:54.102    ComputerName: ***-PC  UserName: ***

18:29:59.967    Initialize success

18:33:29.831    AVAST engine defs: 12100302

18:33:46.133    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

18:33:46.133    Disk 0 Vendor: ST950042 0006 Size: 476940MB BusType: 3

18:33:46.149    Disk 0 MBR read successfully

18:33:46.149    Disk 0 MBR scan

18:33:46.165    Disk 0 Windows 7 default MBR code

18:33:46.165    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048

18:33:46.180    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS       476838 MB offset 206848

18:33:46.211    Disk 0 scanning C:\Windows\system32\drivers

18:33:58.200    Service scanning

18:34:22.318    Modules scanning

18:34:22.318    Disk 0 trace - called modules:

18:34:22.334    ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys ACPI.sys iaStor.sys hal.dll 

18:34:22.334    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800895b060]

18:34:22.349    3 CLASSPNP.SYS[fffff88001afd43f] -> nt!IofCallDriver -> [0xfffffa80087b09f0]

18:34:22.365    5 hpdskflt.sys[fffff880017f3189] -> nt!IofCallDriver -> [0xfffffa8007b32e40]

18:34:22.365    7 ACPI.sys[fffff88000f427a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8007b3c050]

18:34:24.393    AVAST engine scan C:\Windows

18:34:28.262    AVAST engine scan C:\Windows\system32

18:37:52.014    AVAST engine scan C:\Windows\system32\drivers

18:38:07.397    AVAST engine scan C:\Users\***

18:53:21.105    AVAST engine scan C:\ProgramData

18:55:41.567    Scan finished successfully

20:13:01.494    Disk 0 MBR has been saved successfully to "C:\Users\***\Desktop\MBR.dat"

20:13:01.510    The log file has been saved successfully to "C:\Users\***\Desktop\aswMBR.txt"

Eine Frage: Kannst du ungefähr sagen, wann wir fertig sein werden?

Hallo Cosinus, sind wir fertig? Ist mein Computer "bereinigt" oder muss ich noch etwas machen?

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Achso und nochmal wegen OTL, so ganz mit den internen Infos stimmt das nicht, es gibt nämlich woanders einsehbare OTL-Tutoriale zB hier => http://www.smokey-services.eu/forums...?topic=68252.0

Code:

Malwarebytes Anti-Malware 1.65.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.10.08.02
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Beumers :: ***-PC [Administrator]
 

08.10.2012 11:15:29

mbam-log-2012-10-08 (11-15-29).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|H:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 464254

Laufzeit: 1 Stunde(n), 11 Minute(n), 56 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 10/08/2012 at 08:36 PM
 

Application Version : 5.6.1008
 

Core Rules Database Version : 9357

Trace Rules Database Version: 7169
 

Scan type       : Complete Scan

Total Scan Time : 02:35:14
 

Operating System Information

Windows 7 Professional 64-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Administrator
 

Memory items scanned      : 756

Memory threats detected   : 0

Registry items scanned    : 72665

Registry threats detected : 0

File items scanned        : 263488

File threats detected     : 153
 

Adware.Tracking Cookie

        a.banner.t-online.de [ C:\USERS\***\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2K49ZYNE ]

        ia.media-imdb.com [ C:\USERS\***\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2K49ZYNE ]

        s0.2mdn.net [ C:\USERS\***\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2K49ZYNE ]

        secure-it.imrworldwide.com [ C:\USERS\***\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2K49ZYNE ]

        .doubleclick.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .zanox.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        adx2.chip.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .tracker.vinsight.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .insightexpressai.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .insightexpressai.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .insightexpressai.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .insightexpressai.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .insightexpressai.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .insightexpressai.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .insightexpressai.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .amazon-adsystem.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .amazon-adsystem.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        tomtailor.dyntracker.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .xiti.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .unister-adservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .unister-adservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        media.neodau.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .revenuemax.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .a.revenuemax.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .ad.adnet.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .traffictrack.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .ad.adnet.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .specificclick.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        track.adform.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        track.adform.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adform.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        banner.testberichte.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .collective-media.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .collective-media.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .collective-media.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .collective-media.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        statse.webtrendslive.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        ad4.adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .bs.serving-sys.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        www.moviepilot.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .moviepilot.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .moviepilot.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .moviepilot.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        www.moviepilot.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        tracking.sim-technik.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        ad3.adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        ad1.adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .zanox.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .unitymedia.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .unitymedia.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .ru4.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .lucidmedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .at.atwola.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        a.intentmedia.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .tribalfusion.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        ads2.critic.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        ad2.adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        gotacha.rotator.hadj7.adjuggler.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        gotacha.rotator.hadj7.adjuggler.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        gotacha.rotator.hadj7.adjuggler.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\EOQ9E2GF.DEFAULT\COOKIES.SQLITE ]

Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Hallo cosinus, mein System bereitet mir keine Probleme mehr! Vielen Dank für die umfangreiche Hilfe und für die Tipps!!!

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.