Trojaner-Board - Notebook jetzt vom Plagegeister befreit

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Notebook jetzt vom Plagegeister befreit - aber ist auch wirklich sauber? (https://www.trojaner-board.de/128745-notebook-plagegeister-befreit-wirklich-sauber.html)

Notebook jetzt vom Plagegeister befreit - aber ist auch wirklich sauber?

Hallo Forum,
wollte über Feiertage nicht stören, leider alleine komme ich nicht mehr weiter, so bitte ich um Hilfe.

Nachdem mein Notebook immer langsamer wurde, habe ich mich hier im Forum "quer durchgelesen" (und vieles dazugelernt - Danke!) und so über Malwarebyte Anti-Malware und ADW-Cleaner jede Menge "Plagegeister" gefunden, die meine Antivirussoftware nicht mehr gefunden hat. Mit eingelesenem "Know-How", viel "Löschereien" und auch Deinstallationen von (kaum benutzten) Programmen, habe ich scheinbar alle erwischt... wie auch "frische Scanns" von heute zeigen:

Code:

# AdwCleaner v2.103 - Datei am 28/12/2012 um 12:33:38 erstellt

# Aktualisiert am 25/12/2012 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzer : Mladen - MLADEN-HP

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\Mladen\Desktop\adwcleaner.exe

# Option [Suche]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 
 

***** [Registrierungsdatenbank] *****
 
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v9.0.8112.16457
 

[OK] Die Registrierungsdatenbank ist sauber.
 

-\\ Mozilla Firefox v17.0.1 (de)
 

Datei : C:\Users\Mladen\AppData\Roaming\Mozilla\Firefox\Profiles\081fjeqd.default\prefs.js
 

[OK] Die Datei ist sauber.
 

*************************
 

AdwCleaner[R1].txt - [33157 octets] - [17/12/2012 21:35:38]

AdwCleaner[R2].txt - [33218 octets] - [17/12/2012 21:49:55]

AdwCleaner[R3].txt - [1466 octets] - [19/12/2012 10:14:29]

AdwCleaner[R4].txt - [2121 octets] - [19/12/2012 10:25:44]

AdwCleaner[R5].txt - [1396 octets] - [19/12/2012 10:39:56]

AdwCleaner[R6].txt - [1456 octets] - [19/12/2012 10:54:48]

AdwCleaner[R7].txt - [1516 octets] - [20/12/2012 10:08:04]

AdwCleaner[R8].txt - [1576 octets] - [22/12/2012 23:19:46]

AdwCleaner[R9].txt - [1209 octets] - [28/12/2012 12:33:38]

AdwCleaner[S1].txt - [33618 octets] - [17/12/2012 21:51:10]

AdwCleaner[S2].txt - [1528 octets] - [19/12/2012 10:18:28]
 

########## EOF - C:\AdwCleaner[R9].txt - [1390 octets] ##########

Code:

Malwarebytes Anti-Malware (Test) 1.70.0.1100

www.malwarebytes.org
 

Datenbank Version: v2012.12.28.05
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Mladen :: MLADEN-HP [Administrator]
 

Schutz: Aktiviert
 

28.12.2012 12:54:11

mbam-log-2012-12-28 (12-54-11).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 343588

Laufzeit: 1 Stunde(n), 43 Minute(n), 53 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Leider, OTL-Logdatei ist so lang geworden, das hier durch "Vorschau" schon abgelehnt als "zu viel Zeichen" wird - so habe ich die Datei unter hxxp://www.copy-net.de/Forum/OTL.Txt bereit gestellt, mit Bitte diese zu analysieren.

Vielen Dank schon vorab...
(Deutsch ist leider nicht meine Muttersprache - bitte Entschuldigung für div. Fehler und meine Schreibweise)

Mfg
Mladen

Hi
was sollen wir denn mit den Berichten ohne Funde anfangen, bitte poste die Logs mit Fundmeldungen.
otl logs bitte mit Winrar packen und anhängen.

Hallo... und Danke für so schnelle Antwort.

Stimmt, jetzige Berichte haben keine Funde mehr - doch meine "Säuberungsaktion" habe ich schon am 17.12. angefangen... nach und nach sehr viele "Scanns" durchgeführt... brauchen Sie wirklich die alle obwohl ich die "kranke Dateien" nicht mehr auf dem Rechner habe?

Das "erste" ADW-Log habe ich (zum Glück?) noch da

Code:

# AdwCleaner v2.101 - Datei am 17/12/2012 um 21:35:38 erstellt

# Aktualisiert am 16/12/2012 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzer : Mladen - MLADEN-HP

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\Mladen\Desktop\NEU_adwcleaner.exe

# Option [Suche]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Datei Gefunden : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml

Datei Gefunden : C:\user.js

Datei Gefunden : C:\Users\Mladen\AppData\Roaming\Mozilla\Firefox\Profiles\081fjeqd.default\searchplugins\11-suche.xml

Datei Gefunden : C:\Users\Mladen\AppData\Roaming\Mozilla\Firefox\Profiles\081fjeqd.default\searchplugins\Web Search.xml

Ordner Gefunden : C:\Program Files (x86)\AVG Secure Search

Ordner Gefunden : C:\Program Files (x86)\Common Files\AVG Secure Search

Ordner Gefunden : C:\Program Files (x86)\Conduit

Ordner Gefunden : C:\Program Files (x86)\Giant Savings

Ordner Gefunden : C:\Program Files (x86)\Yontoo

Ordner Gefunden : C:\ProgramData\AVG Secure Search

Ordner Gefunden : C:\ProgramData\Tarma Installer

Ordner Gefunden : C:\Users\Mladen\AppData\Local\AVG Secure Search

Ordner Gefunden : C:\Users\Mladen\AppData\Local\Conduit

Ordner Gefunden : C:\Users\Mladen\AppData\Local\Giant Savings

Ordner Gefunden : C:\Users\Mladen\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndkhncnongaclekkbelchmeafffimifj

Ordner Gefunden : C:\Users\Mladen\AppData\Local\Google\Chrome\User Data\Default\Extensions\niapdbllcanepiiimjjndipklodoedlc

Ordner Gefunden : C:\Users\Mladen\AppData\LocalLow\AVG Secure Search

Ordner Gefunden : C:\Users\Mladen\AppData\LocalLow\boost_interprocess

Ordner Gefunden : C:\Users\Mladen\AppData\LocalLow\Conduit

Ordner Gefunden : C:\Users\Mladen\AppData\Roaming\Mozilla\Firefox\Profiles\081fjeqd.default\extensions\crossriderapp4479@crossrider.com

Ordner Gefunden : C:\Users\Mladen\AppData\Roaming\Mozilla\Firefox\Profiles\081fjeqd.default\extensions\plugin@yontoo.com

Ordner Gefunden : C:\Users\Mladen\AppData\Roaming\OpenCandy
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Conduit

Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Crossrider

Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Giant Savings

Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\SmartBar

Schlüssel Gefunden : HKCU\Software\AVG Secure Search

Schlüssel Gefunden : HKCU\Software\Cr_Installer

Schlüssel Gefunden : HKCU\Software\IM

Schlüssel Gefunden : HKCU\Software\ImInstaller

Schlüssel Gefunden : HKCU\Software\InstalledBrowserExtensions

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110011441179}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DFEFCDEE-CF1A-4FC8-88AD-129872198372}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110011441179}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DFEFCDEE-CF1A-4FC8-88AD-129872198372}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Schlüssel Gefunden : HKCU\Software\Softonic

Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Schlüssel Gefunden : HKLM\Software\AVG Secure Search

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escort.DLL

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\esrv.EXE

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CrossriderApp0004479.BHO

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CrossriderApp0004479.BHO.1

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CrossriderApp0004479.Sandbox

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CrossriderApp0004479.Sandbox.1

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\escort.escortIEPane

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\escort.escortIEPane.1

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440044444479}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{48C9C8B0-A546-46C1-A81F-47A31E623E9D}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\YontooIEClient.Api

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\YontooIEClient.Layers

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1

Schlüssel Gefunden : HKLM\Software\Conduit

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_installer_RASAPI32

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_installer_RASMANCS

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441179}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gefunden : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{11111111-1111-1111-1111-110011441179}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220022442279}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{55555555-5555-5555-5555-550055445579}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66666666-6666-6666-6666-660066446679}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ndkhncnongaclekkbelchmeafffimifj

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011441179}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110011441179}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110011441179}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine

Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Giant Savings

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550055445579}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660066446679}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

Schlüssel Gefunden : HKLM\SOFTWARE\Tarma Installer

Schlüssel Gefunden : HKU\S-1-5-21-965214083-3974090165-4273265489-1001\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

Schlüssel Gefunden : HKU\S-1-5-21-965214083-3974090165-4273265489-1001\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

Schlüssel Gefunden : HKU\S-1-5-21-965214083-3974090165-4273265489-1001\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{DFEFCDEE-CF1A-4FC8-88AD-129872198372}]

Wert Gefunden : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]

Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{DFEFCDEE-CF1A-4FC8-88AD-129872198372}]
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v8.0.7601.17514
 

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937

[HKCU\Software\Microsoft\Internet Explorer\Main - Search Page] = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Default_Page_URL] = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937

[HKCU\Software\Microsoft\Internet Explorer\Main - Default_Search_URL] = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=

[HKCU\Software\Microsoft\Internet Explorer\Main - Search Bar] = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=

[HKCU\Software\Microsoft\Internet Explorer\Search - Start Page] = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937

[HKCU\Software\Microsoft\Internet Explorer\Search - Start Default_Page_URL] = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937

[HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=

[HKCU\Software\Microsoft\Internet Explorer\Search - Search Bar] = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=

[HKCU\Software\Microsoft\Internet Explorer\Search - Search Page] = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - Start Page] = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - Start Default_Page_URL] = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - Search Bar] = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - Search Page] = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main - Default_Search_URL] = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main - Search Page] = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main - Start Default_Page_URL] = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main - Search Bar] = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
 

-\\ Mozilla Firefox v17.0.1 (de)
 

Profilname : default 

Datei : C:\Users\Mladen\AppData\Roaming\Mozilla\Firefox\Profiles\081fjeqd.default\prefs.js
 

Gefunden : user_pref("avg.install.installDirPath", "C:\\ProgramData\\AVG Secure Search\\FireFoxExt\\13.2.0.4");

Gefunden : user_pref("browser.search.defaultengine", "Web Search");

Gefunden : user_pref("browser.search.defaultenginename", "Web Search");

Gefunden : user_pref("browser.search.order.1", "Web Search");

Gefunden : user_pref("extensions.crossriderapp4479.4479.InstallationThankYouPage", true);

Gefunden : user_pref("extensions.crossriderapp4479.4479.InstallationTime", 1354024143);

Gefunden : user_pref("extensions.crossriderapp4479.4479.InstallationUserSettings.searchUserConifrmation", false[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.InstallationUserSettings.setHomepage", false);

Gefunden : user_pref("extensions.crossriderapp4479.4479.InstallationUserSettings.setNewTab", false);

Gefunden : user_pref("extensions.crossriderapp4479.4479.InstallationUserSettings.setSearch", false);

Gefunden : user_pref("extensions.crossriderapp4479.4479.active", true);

Gefunden : user_pref("extensions.crossriderapp4479.4479.addressbar", "");

Gefunden : user_pref("extensions.crossriderapp4479.4479.addressbarenhanced", "");

Gefunden : user_pref("extensions.crossriderapp4479.4479.backgroundjs", "\n\n\"undefined\"!=typeof _GPL_BG_NEW&&[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.backgroundver", 7);

Gefunden : user_pref("extensions.crossriderapp4479.4479.can_run_bg_code", true);

Gefunden : user_pref("extensions.crossriderapp4479.4479.certdomaininstaller", "");

Gefunden : user_pref("extensions.crossriderapp4479.4479.changeprevious", false);

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie.InstallationTime.expiration", "Fri Feb 01 2030 0[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie.InstallationTime.value", "1354024143");

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie.InstallerParams.value", "%7B%22source_id%22%3A%2[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00:00:00 [...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_aoi.value", "1354024143");

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_blocklist.expiration", "Tue Nov 27 2012 19:[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_blocklist.value", "%22nonexistantdomain.com[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_country_code.expiration", "Tue Dec 04 2012 [...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_country_code.value", "%22DE%22");

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_crr.expiration", "Fri Feb 01 2030 00:00:00 [...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_crr.value", "1354039948");

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_hotfix20111102645.expiration", "Fri Feb 01 [...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_hotfix20111102645.value", "%221%22");

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_installer_params.expiration", "Fri Feb 01 2[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_installer_params.value", "%7B%22source_id%2[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 2030[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_parent_zoneid.value", "%2258429%22");

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_pc_20120828.expiration", "Fri Feb 01 2030 0[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_pc_20120828.value", "1354026872767");

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_product_id.expiration", "Fri Feb 01 2030 00[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_product_id.value", "%221242%22");

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:00:[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie._GPL_zoneid.value", "%22112161%22");

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie.dbtest.expiration", "Fri Feb 01 2030 00:00:00 GM[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.cookie.dbtest.value", "1354026782223");

Gefunden : user_pref("extensions.crossriderapp4479.4479.description", "Save big with Giant Savings! Coupons dis[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.domain", "");

Gefunden : user_pref("extensions.crossriderapp4479.4479.enablesearch", false);

Gefunden : user_pref("extensions.crossriderapp4479.4479.fbremoteurl", "");

Gefunden : user_pref("extensions.crossriderapp4479.4479.group", 0);

Gefunden : user_pref("extensions.crossriderapp4479.4479.homepage", "");

Gefunden : user_pref("extensions.crossriderapp4479.4479.iframe", false);

Gefunden : user_pref("extensions.crossriderapp4479.4479.internaldb.InstallerIdentifiers.expiration", "Fri Feb 0[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.internaldb.InstallerIdentifiers.value", "%7B%22installe[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.internaldb.Resources_appVer.expiration", "Fri Feb 01 20[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.internaldb.Resources_appVer.value", "44");

Gefunden : user_pref("extensions.crossriderapp4479.4479.internaldb.Resources_lastVersion.expiration", "Fri Feb [...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.internaldb.Resources_lastVersion.value", "0");

Gefunden : user_pref("extensions.crossriderapp4479.4479.internaldb.Resources_meta.expiration", "Fri Feb 01 2030[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.internaldb.Resources_meta.value", "%7B%7D");

Gefunden : user_pref("extensions.crossriderapp4479.4479.internaldb.Resources_nextCheck.expiration", "Tue Nov 27[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.internaldb.Resources_nextCheck.value", "true");

Gefunden : user_pref("extensions.crossriderapp4479.4479.internaldb.Resources_queue.expiration", "Fri Feb 01 203[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.internaldb.Resources_queue.value", "%7B%7D");

Gefunden : user_pref("extensions.crossriderapp4479.4479.internaldb.SoftwareDetected.expiration", "Fri Feb 01 20[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.internaldb.SoftwareDetected.value", "%7B%22AnySoftware%[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _GP[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.manifesturl", "");

Gefunden : user_pref("extensions.crossriderapp4479.4479.name", "Giant Savings");

Gefunden : user_pref("extensions.crossriderapp4479.4479.newtab", "");

Gefunden : user_pref("extensions.crossriderapp4479.4479.opensearch", "");

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_1.code", "appAPI._cr_config={appID:funct[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_1.name", "base");

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_1.ver", 3);

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_1000014.code", "Array.prototype.indexOf|[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_1000014.name", "GPL Plugin (Loader)");

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_1000014.ver", 7);

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_1000015.code", "var _GPL_BG={vars:{},rul[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_1000015.name", "GPL Background (BG)");

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_1000015.ver", 4);

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_13.code", "(function(a){a.selectedText=f[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_13.name", "CrossriderAppUtils");

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_13.ver", 2);

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefin[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_14.name", "CrossriderUtils");

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_14.ver", 2);

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_15.code", "(function(f){var u={};var e=M[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_15.name", "FacebookFFIE");

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_15.ver", 1);

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_16.code", "if((typeof isBackground===\"u[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_16.name", "FFAppAPIWrapper");

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_16.ver", 4);

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_17.code", "if(typeof window!==\"undefine[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_17.name", "jQuery");

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_17.ver", 3);

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_21.code", "var CrossriderDebugManager=(f[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_21.name", "debug");

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_21.ver", 3);

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_22.code", "(function(a){appAPI.queueMana[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_22.name", "resources");

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_22.ver", 2);

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_28.code", "var CrossriderInitializerPlug[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_28.name", "initializer");

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_28.ver", 2);

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_4.code", "/*! jQuery v1.7.1 jquery.com |[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_4.name", "jquery_1_7_1");

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_4.ver", 3);

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_47.code", "(function(){appAPI.ready=func[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_47.name", "resources_background");

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins.plugin_47.ver", 1);

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins_lists.plugins_0", "17,14,16,47,1000015");

Gefunden : user_pref("extensions.crossriderapp4479.4479.plugins_lists.plugins_1", "17,14,13,16,15,4,1,21,22,100[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.pluginsurl", "hxxp://app-static.crossrider.com/plugin/a[...]

Gefunden : user_pref("extensions.crossriderapp4479.4479.pluginsversion", 17);

Gefunden : user_pref("extensions.crossriderapp4479.4479.publisher", "215 Apps");

Gefunden : user_pref("extensions.crossriderapp4479.4479.searchstatus", 0);

Gefunden : user_pref("extensions.crossriderapp4479.4479.setnewtab", false);

Gefunden : user_pref("extensions.crossriderapp4479.4479.settingsurl", "");

Gefunden : user_pref("extensions.crossriderapp4479.4479.thankyou", "");

Gefunden : user_pref("extensions.crossriderapp4479.4479.updateinterval", 360);

Gefunden : user_pref("extensions.crossriderapp4479.4479.ver", 44);

Gefunden : user_pref("extensions.crossriderapp4479.adsOldValue", -1);

Gefunden : user_pref("extensions.crossriderapp4479.apps", "4479");

Gefunden : user_pref("extensions.crossriderapp4479.bic", "13b4241ef7ed18ace7d0de9b4b539e49");

Gefunden : user_pref("extensions.crossriderapp4479.cid", 4479);

Gefunden : user_pref("extensions.crossriderapp4479.firstrun", false);

Gefunden : user_pref("extensions.crossriderapp4479.hadappinstalled", true);

Gefunden : user_pref("extensions.crossriderapp4479.installationdate", 1354026316);

Gefunden : user_pref("extensions.crossriderapp4479.lastcheck", 22567105);

Gefunden : user_pref("extensions.crossriderapp4479.lastcheckitem", 22567336);

Gefunden : user_pref("extensions.crossriderapp4479.modetype", "production");

Gefunden : user_pref("extensions.crossriderapp4479.reportInstall", true);

Gefunden : user_pref("keyword.URL", "hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=");
 

-\\ Google Chrome v23.0.1271.97
 

Datei : C:\Users\Mladen\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] Die Datei ist sauber.
 

*************************
 

AdwCleaner[R1].txt - [33082 octets] - [17/12/2012 21:35:38]
 

########## EOF - C:\AdwCleaner[R1].txt - [33143 octets] ##########

und die letzte OTL-Scan habe ich Anweisung entsprechend im WinRAR komprimiert, leider weis nicht wie ich die Datei jetzt hier anhängen kann...

mfg
Mladen

Hab scheinbar doch gefunden wie man die OTL.rar hochladen kann... ;-))

Hi
Ich benötige alle logs mit funden, wie soll ich sonst ne Analyse machen, wenn ich nicht mal weis, was gefunden wurde?

Zitat:

Zitat von markusg (Beitrag 979824)

Hi
Ich benötige alle logs mit funden, wie soll ich sonst ne Analyse machen, wenn ich nicht mal weis, was gefunden wurde?

Sorry... leider verstehe ich von Sache zu wenig um zu wissen was benötigt wird... bin gar nicht sicher ALLE Logs auch gespeichert zu habe, aber die "wichtigsten" (unten jeweils mit meine "Aktion"-Notitz) hoffe ich sind noch da (chronologisch gespeichert)...

Eigentlich wollte ich Dir so viel Arbeit gar nicht machen - dachte die "Reste" sind auch in OTL erkennbar..?!
Sorry...

mfg
Mladen

Softonic
bitte nie wieder nutzen!
lade software nur noch beim Hersteller, lese immer gründlich bei der Instalation und instaliere nur benutzerdefiniert
download tdss killer:
http://www.trojaner-board.de/82358-t...entfernen.html
Klicke auf Change parameters
• Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system
• Klick auf OK und anschließend auf Start scan
- bei funden erst mal immer skip wählen, log posten

Erledigt, Danke!
buuuh... doch noch was da gewesen.
Habe kürzlich (nach dem ich "sauber gemacht habe" Onlinebanking gemacht - muss ich was unternehmen?

Code:

18:32:35.0791 0480  TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35

18:32:37.0221 0480  ============================================================

18:32:37.0221 0480  Current date / time: 2012/12/28 18:32:37.0221

18:32:37.0221 0480  SystemInfo:

18:32:37.0221 0480  

18:32:37.0221 0480  OS Version: 6.1.7601 ServicePack: 1.0

18:32:37.0221 0480  Product type: Workstation

18:32:37.0221 0480  ComputerName: MLADEN-HP

18:32:37.0221 0480  UserName: Mladen

18:32:37.0221 0480  Windows directory: C:\Windows

18:32:37.0221 0480  System windows directory: C:\Windows

18:32:37.0221 0480  Running under WOW64

18:32:37.0221 0480  Processor architecture: Intel x64

18:32:37.0221 0480  Number of processors: 1

18:32:37.0221 0480  Page size: 0x1000

18:32:37.0221 0480  Boot type: Normal boot

18:32:37.0221 0480  ============================================================

18:32:39.0511 0480  Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

18:32:39.0611 0480  ============================================================

18:32:39.0611 0480  \Device\Harddisk0\DR0:

18:32:39.0611 0480  MBR partitions:

18:32:39.0611 0480  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x63800

18:32:39.0611 0480  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x64000, BlocksNum 0x1B346800

18:32:39.0611 0480  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x1B3AA800, BlocksNum 0x1DE7000

18:32:39.0611 0480  \Device\Harddisk0\DR0\Partition4: MBR, Type 0xC, StartLBA 0x1D191800, BlocksNum 0x33970

18:32:39.0611 0480  ============================================================

18:32:39.0711 0480  C: <-> \Device\Harddisk0\DR0\Partition2

18:32:39.0781 0480  D: <-> \Device\Harddisk0\DR0\Partition3

18:32:39.0831 0480  ============================================================

18:32:39.0831 0480  Initialize success

18:32:39.0831 0480  ============================================================

18:33:16.0022 4816  ============================================================

18:33:16.0022 4816  Scan started

18:33:16.0022 4816  Mode: Manual; SigCheck; TDLFS; 

18:33:16.0022 4816  ============================================================

18:33:18.0092 4816  ================ Scan system memory ========================

18:33:18.0092 4816  System memory - ok

18:33:18.0102 4816  ================ Scan services =============================

18:33:18.0552 4816  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys

18:33:19.0262 4816  1394ohci - ok

18:33:19.0312 4816  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys

18:33:19.0432 4816  ACPI - ok

18:33:19.0462 4816  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys

18:33:19.0682 4816  AcpiPmi - ok

18:33:19.0832 4816  [ B1EA9681502EE57F87DB71D726288A5B ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

18:33:19.0882 4816  AdobeARMservice - ok

18:33:20.0152 4816  [ 95CE557D16A75606CCC2D7F3B0B0BCCB ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

18:33:20.0192 4816  AdobeFlashPlayerUpdateSvc - ok

18:33:20.0262 4816  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx         C:\Windows\system32\drivers\adp94xx.sys

18:33:20.0362 4816  adp94xx - ok

18:33:20.0402 4816  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci         C:\Windows\system32\drivers\adpahci.sys

18:33:20.0462 4816  adpahci - ok

18:33:20.0502 4816  [ E109549C90F62FB570B9540C4B148E54 ] adpu320         C:\Windows\system32\drivers\adpu320.sys

18:33:20.0572 4816  adpu320 - ok

18:33:20.0612 4816  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll

18:33:20.0952 4816  AeLookupSvc - ok

18:33:21.0052 4816  [ D1E343BC00136CE03C4D403194D06A80 ] AERTFilters     C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

18:33:21.0132 4816  AERTFilters - ok

18:33:21.0202 4816  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD             C:\Windows\system32\drivers\afd.sys

18:33:21.0432 4816  AFD - ok

18:33:21.0492 4816  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys

18:33:21.0612 4816  agp440 - ok

18:33:21.0652 4816  [ 3290D6946B5E30E70414990574883DDB ] ALG             C:\Windows\System32\alg.exe

18:33:21.0822 4816  ALG - ok

18:33:21.0842 4816  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys

18:33:21.0892 4816  aliide - ok

18:33:21.0962 4816  [ F4F8D818F8BB7EAFB7B9A259D6CBFE68 ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe

18:33:22.0152 4816  AMD External Events Utility - ok

18:33:22.0192 4816  AMD FUEL Service - ok

18:33:22.0252 4816  [ DD27F6C3DE9BFE50635C721E09EDC5DD ] AMD Reservation Manager C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe

18:33:22.0322 4816  AMD Reservation Manager - ok

18:33:22.0362 4816  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys

18:33:22.0412 4816  amdide - ok

18:33:22.0462 4816  [ 6A2EEB0C4133B20773BB3DD0B7B377B4 ] amdiox64        C:\Windows\system32\DRIVERS\amdiox64.sys

18:33:22.0652 4816  amdiox64 - ok

18:33:22.0682 4816  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8           C:\Windows\system32\drivers\amdk8.sys

18:33:22.0842 4816  AmdK8 - ok

18:33:23.0072 4816  [ E93230B4214A90854BE7F27E61C1E8FD ] amdkmdag        C:\Windows\system32\DRIVERS\atikmdag.sys

18:33:23.0492 4816  amdkmdag - ok

18:33:23.0542 4816  [ 2B614A1CB27F36C5B2D96E554472A809 ] amdkmdap        C:\Windows\system32\DRIVERS\atikmpag.sys

18:33:23.0652 4816  amdkmdap - ok

18:33:23.0702 4816  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys

18:33:23.0792 4816  AmdPPM - ok

18:33:23.0852 4816  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata         C:\Windows\system32\drivers\amdsata.sys

18:33:23.0922 4816  amdsata - ok

18:33:23.0982 4816  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys

18:33:24.0072 4816  amdsbs - ok

18:33:24.0102 4816  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata         C:\Windows\system32\drivers\amdxata.sys

18:33:24.0162 4816  amdxata - ok

18:33:24.0192 4816  [ 80A508D0C7A21BC13C01D4C671541203 ] amd_sata        C:\Windows\system32\DRIVERS\amd_sata.sys

18:33:24.0222 4816  amd_sata - ok

18:33:24.0242 4816  [ 2BE940F3A632A1A301B22B096BF221F1 ] amd_xata        C:\Windows\system32\DRIVERS\amd_xata.sys

18:33:24.0312 4816  amd_xata - ok

18:33:24.0352 4816  [ 89A69C3F2F319B43379399547526D952 ] AppID           C:\Windows\system32\drivers\appid.sys

18:33:24.0682 4816  AppID - ok

18:33:24.0712 4816  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll

18:33:24.0832 4816  AppIDSvc - ok

18:33:24.0882 4816  [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo         C:\Windows\System32\appinfo.dll

18:33:25.0062 4816  Appinfo - ok

18:33:25.0082 4816  [ C484F8CEB1717C540242531DB7845C4E ] arc             C:\Windows\system32\drivers\arc.sys

18:33:25.0162 4816  arc - ok

18:33:25.0182 4816  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\drivers\arcsas.sys

18:33:25.0262 4816  arcsas - ok

18:33:25.0302 4816  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys

18:33:25.0472 4816  AsyncMac - ok

18:33:25.0512 4816  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi           C:\Windows\system32\drivers\atapi.sys

18:33:25.0582 4816  atapi - ok

18:33:25.0632 4816  [ CBE61B4494165F458BD87E37181EE934 ] AthBTPort       C:\Windows\system32\DRIVERS\btath_flt.sys

18:33:25.0672 4816  AthBTPort - ok

18:33:25.0782 4816  [ 4C4A576818EA028257C624AE36FF7A03 ] Atheros Bt&Wlan Coex Agent C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe

18:33:25.0852 4816  Atheros Bt&Wlan Coex Agent - ok

18:33:25.0882 4816  [ 684B36CA4067DA7000CF95771A3CF0E7 ] AtherosSvc      C:\Program Files (x86)\Bluetooth Suite\adminservice.exe

18:33:25.0982 4816  AtherosSvc - ok

18:33:26.0102 4816  [ 7C2D67E273E76ADC3ADB621B8404C5FB ] athr            C:\Windows\system32\DRIVERS\athrx.sys

18:33:26.0382 4816  athr - ok

18:33:26.0452 4816  [ 4BF5BCA6E2608CD8A00BC4A6673A9F47 ] AtiHDAudioService C:\Windows\system32\drivers\AtihdW76.sys

18:33:26.0522 4816  AtiHDAudioService - ok

18:33:26.0582 4816  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll

18:33:26.0782 4816  AudioEndpointBuilder - ok

18:33:26.0832 4816  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll

18:33:26.0932 4816  AudioSrv - ok

18:33:27.0242 4816  [ 56C73C5BC1656656CAC38A23B4310466 ] AVGIDSAgent     C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe

18:33:27.0562 4816  AVGIDSAgent - ok

18:33:27.0632 4816  [ 388056EBD5FE6718FE669078DBE37897 ] AVGIDSDriver    C:\Windows\system32\DRIVERS\avgidsdrivera.sys

18:33:27.0722 4816  AVGIDSDriver - ok

18:33:27.0762 4816  [ 550E981747D6A6C55078C77346FFC2C6 ] AVGIDSHA        C:\Windows\system32\DRIVERS\avgidsha.sys

18:33:27.0832 4816  AVGIDSHA - ok

18:33:27.0892 4816  [ 5989592A91A17587799792A81E1541D4 ] Avgldx64        C:\Windows\system32\DRIVERS\avgldx64.sys

18:33:27.0942 4816  Avgldx64 - ok

18:33:28.0012 4816  [ 3FC43AA02545FCDDC22817829114DEC8 ] Avgloga         C:\Windows\system32\DRIVERS\avgloga.sys

18:33:28.0072 4816  Avgloga - ok

18:33:28.0092 4816  [ 767B4A485FB22AA0FC0BF5EEF00572B9 ] Avgmfx64        C:\Windows\system32\DRIVERS\avgmfx64.sys

18:33:28.0162 4816  Avgmfx64 - ok

18:33:28.0222 4816  [ FE4F444DBE4BBBDFD8FECF49398DEFC7 ] Avgrkx64        C:\Windows\system32\DRIVERS\avgrkx64.sys

18:33:28.0272 4816  Avgrkx64 - ok

18:33:28.0302 4816  [ 6E634525613D48A1D1657FB21F21F3B2 ] Avgtdia         C:\Windows\system32\DRIVERS\avgtdia.sys

18:33:28.0392 4816  Avgtdia - ok

18:33:28.0442 4816  [ BFD698CC6E1DE2E0D23155DECC513D2F ] avgtp           C:\Windows\system32\drivers\avgtpx64.sys

18:33:28.0512 4816  avgtp - ok

18:33:28.0552 4816  [ 6B72E1E329C4E98C6B6FDD2D265E3BA3 ] avgwd           C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe

18:33:28.0642 4816  avgwd - ok

18:33:28.0692 4816  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll

18:33:28.0862 4816  AxInstSV - ok

18:33:28.0932 4816  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv         C:\Windows\system32\drivers\bxvbda.sys

18:33:29.0102 4816  b06bdrv - ok

18:33:29.0142 4816  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys

18:33:29.0242 4816  b57nd60a - ok

18:33:29.0332 4816  [ 9E84A931DBEE0292E38ED672F6293A99 ] BCM43XX         C:\Windows\system32\DRIVERS\bcmwl664.sys

18:33:29.0542 4816  BCM43XX - ok

18:33:29.0602 4816  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll

18:33:29.0762 4816  BDESVC - ok

18:33:29.0782 4816  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys

18:33:29.0952 4816  Beep - ok

18:33:30.0022 4816  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE             C:\Windows\System32\bfe.dll

18:33:30.0192 4816  BFE - ok

18:33:30.0262 4816  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\System32\qmgr.dll

18:33:30.0462 4816  BITS - ok

18:33:30.0512 4816  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\drivers\blbdrive.sys

18:33:30.0622 4816  blbdrive - ok

18:33:30.0672 4816  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys

18:33:30.0822 4816  bowser - ok

18:33:30.0852 4816  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys

18:33:30.0932 4816  BrFiltLo - ok

18:33:30.0952 4816  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys

18:33:31.0032 4816  BrFiltUp - ok

18:33:31.0082 4816  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser         C:\Windows\System32\browser.dll

18:33:31.0182 4816  Browser - ok

18:33:31.0222 4816  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid         C:\Windows\System32\Drivers\Brserid.sys

18:33:31.0362 4816  Brserid - ok

18:33:31.0382 4816  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys

18:33:31.0462 4816  BrSerWdm - ok

18:33:31.0482 4816  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys

18:33:31.0572 4816  BrUsbMdm - ok

18:33:31.0592 4816  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys

18:33:31.0672 4816  BrUsbSer - ok

18:33:31.0732 4816  [ 227C8F308DE4AF4808E587465CEAB838 ] BTATH_A2DP      C:\Windows\system32\drivers\btath_a2dp.sys

18:33:31.0842 4816  BTATH_A2DP - ok

18:33:31.0882 4816  [ A83A91D07D1FE6BBE7A9DB46CA00434B ] BTATH_BUS       C:\Windows\system32\DRIVERS\btath_bus.sys

18:33:31.0932 4816  BTATH_BUS - ok

18:33:31.0952 4816  [ C864FF85EE16D61C2BDD5EF76824625F ] BTATH_HCRP      C:\Windows\system32\DRIVERS\btath_hcrp.sys

18:33:32.0002 4816  BTATH_HCRP - ok

18:33:32.0052 4816  [ 0DEA505EFB5D771826D177EF8B8A208F ] BTATH_LWFLT     C:\Windows\system32\DRIVERS\btath_lwflt.sys

18:33:32.0102 4816  BTATH_LWFLT - ok

18:33:32.0122 4816  [ 724C8088C96EFE7A3E63FEC21D4681C0 ] BTATH_RCP       C:\Windows\system32\DRIVERS\btath_rcp.sys

18:33:32.0192 4816  BTATH_RCP - ok

18:33:32.0232 4816  [ FF8B065F96E4D9525AA7227299FBD05C ] BtFilter        C:\Windows\system32\DRIVERS\btfilter.sys

18:33:32.0332 4816  BtFilter - ok

18:33:32.0372 4816  [ CF98190A94F62E405C8CB255018B2315 ] BthEnum         C:\Windows\system32\drivers\BthEnum.sys

18:33:32.0582 4816  BthEnum - ok

18:33:32.0632 4816  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys

18:33:32.0742 4816  BTHMODEM - ok

18:33:32.0792 4816  [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys

18:33:32.0932 4816  BthPan - ok

18:33:33.0002 4816  [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT         C:\Windows\System32\Drivers\BTHport.sys

18:33:33.0102 4816  BTHPORT - ok

18:33:33.0172 4816  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv         C:\Windows\system32\bthserv.dll

18:33:33.0292 4816  bthserv - ok

18:33:33.0332 4816  [ F188B7394D81010767B6DF3178519A37 ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys

18:33:33.0462 4816  BTHUSB - ok

18:33:33.0512 4816  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys

18:33:33.0692 4816  cdfs - ok

18:33:33.0742 4816  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys

18:33:33.0882 4816  cdrom - ok

18:33:33.0932 4816  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc     C:\Windows\System32\certprop.dll

18:33:34.0082 4816  CertPropSvc - ok

18:33:34.0112 4816  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\drivers\circlass.sys

18:33:34.0222 4816  circlass - ok

18:33:34.0272 4816  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys

18:33:34.0362 4816  CLFS - ok

18:33:34.0532 4816  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

18:33:34.0612 4816  clr_optimization_v2.0.50727_32 - ok

18:33:34.0712 4816  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

18:33:34.0772 4816  clr_optimization_v2.0.50727_64 - ok

18:33:34.0992 4816  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

18:33:35.0082 4816  clr_optimization_v4.0.30319_32 - ok

18:33:35.0192 4816  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

18:33:35.0262 4816  clr_optimization_v4.0.30319_64 - ok

18:33:35.0322 4816  [ 50F92C943F18B070F166D019DFAB3D9A ] clwvd           C:\Windows\system32\DRIVERS\clwvd.sys

18:33:35.0372 4816  clwvd - ok

18:33:35.0412 4816  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\drivers\CmBatt.sys

18:33:35.0492 4816  CmBatt - ok

18:33:35.0512 4816  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys

18:33:35.0562 4816  cmdide - ok

18:33:35.0622 4816  [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG             C:\Windows\system32\Drivers\cng.sys

18:33:35.0742 4816  CNG - ok

18:33:35.0792 4816  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys

18:33:35.0842 4816  Compbatt - ok

18:33:35.0862 4816  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys

18:33:35.0952 4816  CompositeBus - ok

18:33:35.0992 4816  COMSysApp - ok

18:33:36.0012 4816  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk         C:\Windows\system32\drivers\crcdisk.sys

18:33:36.0072 4816  crcdisk - ok

18:33:36.0122 4816  [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc        C:\Windows\system32\cryptsvc.dll

18:33:36.0302 4816  CryptSvc - ok

18:33:36.0362 4816  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll

18:33:36.0492 4816  DcomLaunch - ok

18:33:36.0552 4816  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc       C:\Windows\System32\defragsvc.dll

18:33:36.0702 4816  defragsvc - ok

18:33:36.0732 4816  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys

18:33:36.0862 4816  DfsC - ok

18:33:36.0902 4816  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll

18:33:37.0092 4816  Dhcp - ok

18:33:37.0132 4816  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys

18:33:37.0332 4816  discache - ok

18:33:37.0372 4816  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\drivers\disk.sys

18:33:37.0442 4816  Disk - ok

18:33:37.0492 4816  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll

18:33:37.0632 4816  Dnscache - ok

18:33:37.0682 4816  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc         C:\Windows\System32\dot3svc.dll

18:33:37.0882 4816  dot3svc - ok

18:33:37.0922 4816  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS             C:\Windows\system32\dps.dll

18:33:38.0072 4816  DPS - ok

18:33:38.0132 4816  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys

18:33:38.0212 4816  drmkaud - ok

18:33:38.0282 4816  [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys

18:33:38.0402 4816  DXGKrnl - ok

18:33:38.0442 4816  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost         C:\Windows\System32\eapsvc.dll

18:33:38.0592 4816  EapHost - ok

18:33:38.0692 4816  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv           C:\Windows\system32\drivers\evbda.sys

18:33:38.0952 4816  ebdrv - ok

18:33:39.0002 4816  [ C118A82CD78818C29AB228366EBF81C3 ] EFS             C:\Windows\System32\lsass.exe

18:33:39.0182 4816  EFS - ok

18:33:39.0292 4816  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe

18:33:39.0462 4816  ehRecvr - ok

18:33:39.0482 4816  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched         C:\Windows\ehome\ehsched.exe

18:33:39.0592 4816  ehSched - ok

18:33:39.0652 4816  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor         C:\Windows\system32\drivers\elxstor.sys

18:33:39.0732 4816  elxstor - ok

18:33:39.0762 4816  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys

18:33:39.0852 4816  ErrDev - ok

18:33:39.0932 4816  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem     C:\Windows\system32\es.dll

18:33:40.0142 4816  EventSystem - ok

18:33:40.0182 4816  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat           C:\Windows\system32\drivers\exfat.sys

18:33:40.0322 4816  exfat - ok

18:33:40.0342 4816  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat         C:\Windows\system32\drivers\fastfat.sys

18:33:40.0512 4816  fastfat - ok

18:33:40.0572 4816  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax             C:\Windows\system32\fxssvc.exe

18:33:40.0752 4816  Fax - ok

18:33:40.0782 4816  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc             C:\Windows\system32\drivers\fdc.sys

18:33:40.0872 4816  fdc - ok

18:33:40.0922 4816  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost         C:\Windows\system32\fdPHost.dll

18:33:41.0062 4816  fdPHost - ok

18:33:41.0082 4816  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll

18:33:41.0182 4816  FDResPub - ok

18:33:41.0222 4816  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys

18:33:41.0272 4816  FileInfo - ok

18:33:41.0302 4816  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys

18:33:41.0452 4816  Filetrace - ok

18:33:41.0472 4816  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys

18:33:41.0542 4816  flpydisk - ok

18:33:41.0582 4816  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys

18:33:41.0652 4816  FltMgr - ok

18:33:41.0712 4816  [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache       C:\Windows\system32\FntCache.dll

18:33:41.0902 4816  FontCache - ok

18:33:41.0962 4816  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

18:33:42.0092 4816  FontCache3.0.0.0 - ok

18:33:42.0132 4816  [ D43703496149971890703B4B1B723EAC ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys

18:33:42.0192 4816  FsDepends - ok

18:33:42.0242 4816  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys

18:33:42.0302 4816  Fs_Rec - ok

18:33:42.0342 4816  [ 1F7B25B858FA27015169FE95E54108ED ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys

18:33:42.0432 4816  fvevol - ok

18:33:42.0472 4816  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys

18:33:42.0552 4816  gagp30kx - ok

18:33:42.0642 4816  [ C403C5DB49A0F9AAF4F2128EDC0106D8 ] GamesAppService C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe

18:33:42.0732 4816  GamesAppService - ok

18:33:42.0792 4816  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc           C:\Windows\System32\gpsvc.dll

18:33:42.0992 4816  gpsvc - ok

18:33:43.0062 4816  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys

18:33:43.0242 4816  hcw85cir - ok

18:33:43.0282 4816  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys

18:33:43.0402 4816  HdAudAddService - ok

18:33:43.0452 4816  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys

18:33:43.0542 4816  HDAudBus - ok

18:33:43.0562 4816  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt         C:\Windows\system32\drivers\HidBatt.sys

18:33:43.0632 4816  HidBatt - ok

18:33:43.0652 4816  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\drivers\hidbth.sys

18:33:43.0752 4816  HidBth - ok

18:33:43.0772 4816  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr           C:\Windows\system32\drivers\hidir.sys

18:33:43.0882 4816  HidIr - ok

18:33:43.0922 4816  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv         C:\Windows\system32\hidserv.dll

18:33:44.0062 4816  hidserv - ok

18:33:44.0112 4816  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys

18:33:44.0182 4816  HidUsb - ok

18:33:44.0212 4816  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll

18:33:44.0372 4816  hkmsvc - ok

18:33:44.0412 4816  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll

18:33:44.0562 4816  HomeGroupListener - ok

18:33:44.0592 4816  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll

18:33:44.0722 4816  HomeGroupProvider - ok

18:33:44.0792 4816  [ 7A24AD37416B91E4B5E5B46BD25C075F ] HP Health Check Service C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe

18:33:44.0842 4816  HP Health Check Service - ok

18:33:44.0952 4816  [ C930128C8F8FF03D8F8C42B570920D56 ] HP Wireless Assistant Service C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe

18:33:45.0082 4816  HP Wireless Assistant Service - ok

18:33:45.0172 4816  [ 7B8C1B09C11E8DB7C4480ABD7D17E821 ] HPAuto          C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe

18:33:45.0292 4816  HPAuto - ok

18:33:45.0372 4816  [ B19FF523B533A3F198B9239E1749C940 ] HPDrvMntSvc.exe C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

18:33:45.0452 4816  HPDrvMntSvc.exe - ok

18:33:45.0492 4816  [ 01091B900E15878B4434F9C726C4541D ] hpqwmiex        C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

18:33:45.0642 4816  hpqwmiex - ok

18:33:45.0682 4816  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys

18:33:45.0732 4816  HpSAMD - ok

18:33:45.0802 4816  [ F630DD7564EBB7248A13B1CC774D9EA6 ] HPWMISVC        C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

18:33:45.0852 4816  HPWMISVC - ok

18:33:45.0912 4816  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys

18:33:46.0072 4816  HTTP - ok

18:33:46.0092 4816  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys

18:33:46.0162 4816  hwpolicy - ok

18:33:46.0202 4816  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys

18:33:46.0282 4816  i8042prt - ok

18:33:46.0352 4816  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys

18:33:46.0432 4816  iaStorV - ok

18:33:46.0642 4816  [ E4693409D06785477A49FB34AFAE1B92 ] IconMan_R       C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

18:33:46.0852 4816  IconMan_R ( UnsignedFile.Multi.Generic ) - warning

18:33:46.0852 4816  IconMan_R - detected UnsignedFile.Multi.Generic (1)

18:33:46.0982 4816  [ 6F95324909B502E2651442C1548AB12F ] IDriverT        C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

18:33:47.0112 4816  IDriverT ( UnsignedFile.Multi.Generic ) - warning

18:33:47.0112 4816  IDriverT - detected UnsignedFile.Multi.Generic (1)

18:33:47.0192 4816  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

18:33:47.0372 4816  idsvc - ok

18:33:47.0412 4816  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp           C:\Windows\system32\drivers\iirsp.sys

18:33:47.0472 4816  iirsp - ok

18:33:47.0532 4816  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll

18:33:47.0722 4816  IKEEXT - ok

18:33:47.0852 4816  [ 336C3A6BF14D5A9AF35AF07C6B6B29CD ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys

18:33:48.0102 4816  IntcAzAudAddService - ok

18:33:48.0122 4816  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys

18:33:48.0192 4816  intelide - ok

18:33:48.0222 4816  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\drivers\intelppm.sys

18:33:48.0312 4816  intelppm - ok

18:33:48.0372 4816  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum       C:\Windows\system32\ipbusenum.dll

18:33:48.0522 4816  IPBusEnum - ok

18:33:48.0542 4816  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys

18:33:48.0642 4816  IpFilterDriver - ok

18:33:48.0712 4816  [ 08C2957BB30058E663720C5606885653 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll

18:33:48.0862 4816  iphlpsvc - ok

18:33:48.0882 4816  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys

18:33:48.0992 4816  IPMIDRV - ok

18:33:49.0012 4816  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT           C:\Windows\system32\drivers\ipnat.sys

18:33:49.0182 4816  IPNAT - ok

18:33:49.0232 4816  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys

18:33:49.0292 4816  IRENUM - ok

18:33:49.0312 4816  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys

18:33:49.0372 4816  isapnp - ok

18:33:49.0402 4816  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys

18:33:49.0492 4816  iScsiPrt - ok

18:33:49.0632 4816  [ BA8C6135E6E632139DAC5B34861FCB03 ] ISWKL           C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys

18:33:49.0692 4816  ISWKL - ok

18:33:49.0812 4816  [ EEF0D7308C247294389B566A7830B211 ] IswSvc          C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe

18:33:49.0902 4816  IswSvc - ok

18:33:49.0952 4816  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys

18:33:50.0042 4816  kbdclass - ok

18:33:50.0072 4816  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys

18:33:50.0152 4816  kbdhid - ok

18:33:50.0182 4816  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe

18:33:50.0262 4816  KeyIso - ok

18:33:50.0352 4816  [ E656FE10D6D27794AFA08136685A69E8 ] KL1             C:\Windows\system32\DRIVERS\kl1.sys

18:33:50.0472 4816  KL1 - ok

18:33:50.0512 4816  [ D865DD8B0448E3F963D68C04C532858F ] kl2             C:\Windows\system32\DRIVERS\kl2.sys

18:33:50.0592 4816  kl2 - ok

18:33:50.0652 4816  [ 055790D38D7EC73AEF03E4AA7F67BA03 ] KLIF            C:\Windows\system32\DRIVERS\klif.sys

18:33:50.0752 4816  KLIF - ok

18:33:50.0802 4816  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys

18:33:50.0852 4816  KSecDD - ok

18:33:50.0872 4816  [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys

18:33:50.0962 4816  KSecPkg - ok

18:33:51.0012 4816  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys

18:33:51.0182 4816  ksthunk - ok

18:33:51.0232 4816  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm           C:\Windows\system32\msdtckrm.dll

18:33:51.0412 4816  KtmRm - ok

18:33:51.0472 4816  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\system32\srvsvc.dll

18:33:51.0622 4816  LanmanServer - ok

18:33:51.0662 4816  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll

18:33:51.0802 4816  LanmanWorkstation - ok

18:33:51.0852 4816  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys

18:33:51.0992 4816  lltdio - ok

18:33:52.0042 4816  [ C1185803384AB3FEED115F79F109427F ] lltdsvc         C:\Windows\System32\lltdsvc.dll

18:33:52.0192 4816  lltdsvc - ok

18:33:52.0212 4816  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts         C:\Windows\System32\lmhsvc.dll

18:33:52.0322 4816  lmhosts - ok

18:33:52.0372 4816  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys

18:33:52.0422 4816  LSI_FC - ok

18:33:52.0462 4816  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS         C:\Windows\system32\drivers\lsi_sas.sys

18:33:52.0542 4816  LSI_SAS - ok

18:33:52.0572 4816  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys

18:33:52.0632 4816  LSI_SAS2 - ok

18:33:52.0652 4816  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys

18:33:52.0702 4816  LSI_SCSI - ok

18:33:52.0752 4816  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv           C:\Windows\system32\drivers\luafv.sys

18:33:52.0882 4816  luafv - ok

18:33:52.0932 4816  [ 92EB844D90615CB266F84C3202B8786E ] MBAMProtector   C:\Windows\system32\drivers\mbam.sys

18:33:53.0032 4816  MBAMProtector - ok

18:33:53.0092 4816  [ 1ACAA67676E9E7BDA5E0C41B6E0DECAF ] MBAMScheduler   C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

18:33:53.0162 4816  MBAMScheduler - ok

18:33:53.0202 4816  [ 916B8954AC3E06DC9E898AFFB41F3FB6 ] MBAMService     C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

18:33:53.0252 4816  MBAMService - ok

18:33:53.0292 4816  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll

18:33:53.0392 4816  Mcx2Svc - ok

18:33:53.0432 4816  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas         C:\Windows\system32\drivers\megasas.sys

18:33:53.0492 4816  megasas - ok

18:33:53.0532 4816  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys

18:33:53.0612 4816  MegaSR - ok

18:33:53.0662 4816  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS           C:\Windows\system32\mmcss.dll

18:33:53.0792 4816  MMCSS - ok

18:33:53.0822 4816  [ 800BA92F7010378B09F9ED9270F07137 ] Modem           C:\Windows\system32\drivers\modem.sys

18:33:53.0942 4816  Modem - ok

18:33:53.0982 4816  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor         C:\Windows\system32\DRIVERS\monitor.sys

18:33:54.0072 4816  monitor - ok

18:33:54.0112 4816  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys

18:33:54.0162 4816  mouclass - ok

18:33:54.0192 4816  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys

18:33:54.0282 4816  mouhid - ok

18:33:54.0312 4816  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys

18:33:54.0392 4816  mountmgr - ok

18:33:54.0462 4816  [ 8C7336950F1E69CDFD811CBBD9CF00A2 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

18:33:54.0552 4816  MozillaMaintenance - ok

18:33:54.0572 4816  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys

18:33:54.0652 4816  mpio - ok

18:33:54.0672 4816  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys

18:33:54.0802 4816  mpsdrv - ok

18:33:54.0852 4816  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll

18:33:55.0052 4816  MpsSvc - ok

18:33:55.0102 4816  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys

18:33:55.0202 4816  MRxDAV - ok

18:33:55.0262 4816  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys

18:33:55.0482 4816  mrxsmb - ok

18:33:55.0502 4816  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys

18:33:55.0562 4816  mrxsmb10 - ok

18:33:55.0602 4816  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys

18:33:55.0712 4816  mrxsmb20 - ok

18:33:55.0752 4816  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys

18:33:55.0842 4816  msahci - ok

18:33:55.0872 4816  [ DB801A638D011B9633829EB6F663C900 ] msdsm           C:\Windows\system32\drivers\msdsm.sys

18:33:55.0972 4816  msdsm - ok

18:33:56.0002 4816  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC           C:\Windows\System32\msdtc.exe

18:33:56.0102 4816  MSDTC - ok

18:33:56.0152 4816  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys

18:33:56.0252 4816  Msfs - ok

18:33:56.0272 4816  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys

18:33:56.0422 4816  mshidkmdf - ok

18:33:56.0442 4816  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys

18:33:56.0522 4816  msisadrv - ok

18:33:56.0572 4816  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll

18:33:56.0702 4816  MSiSCSI - ok

18:33:56.0722 4816  msiserver - ok

18:33:56.0772 4816  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys

18:33:56.0892 4816  MSKSSRV - ok

18:33:56.0922 4816  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys

18:33:57.0092 4816  MSPCLOCK - ok

18:33:57.0112 4816  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys

18:33:57.0262 4816  MSPQM - ok

18:33:57.0292 4816  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys

18:33:57.0352 4816  MsRPC - ok

18:33:57.0382 4816  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys

18:33:57.0452 4816  mssmbios - ok

18:33:57.0472 4816  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys

18:33:57.0622 4816  MSTEE - ok

18:33:57.0642 4816  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys

18:33:57.0712 4816  MTConfig - ok

18:33:57.0732 4816  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup             C:\Windows\system32\Drivers\mup.sys

18:33:57.0792 4816  Mup - ok

18:33:57.0842 4816  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll

18:33:57.0992 4816  napagent - ok

18:33:58.0032 4816  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys

18:33:58.0152 4816  NativeWifiP - ok

18:33:58.0232 4816  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\Windows\system32\drivers\ndis.sys

18:33:58.0352 4816  NDIS - ok

18:33:58.0412 4816  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys

18:33:58.0542 4816  NdisCap - ok

18:33:58.0572 4816  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys

18:33:58.0702 4816  NdisTapi - ok

18:33:58.0732 4816  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys

18:33:58.0932 4816  Ndisuio - ok

18:33:58.0952 4816  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys

18:33:59.0122 4816  NdisWan - ok

18:33:59.0142 4816  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys

18:33:59.0252 4816  NDProxy - ok

18:33:59.0272 4816  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys

18:33:59.0402 4816  NetBIOS - ok

18:33:59.0442 4816  [ 09594D1089C523423B32A4229263F068 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys

18:33:59.0562 4816  NetBT - ok

18:33:59.0612 4816  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe

18:33:59.0652 4816  Netlogon - ok

18:33:59.0712 4816  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll

18:33:59.0882 4816  Netman - ok

18:33:59.0942 4816  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll

18:34:00.0082 4816  netprofm - ok

18:34:00.0122 4816  [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

18:34:00.0172 4816  NetTcpPortSharing - ok

18:34:00.0212 4816  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960         C:\Windows\system32\drivers\nfrd960.sys

18:34:00.0262 4816  nfrd960 - ok

18:34:00.0332 4816  [ 8AD77806D336673F270DB31645267293 ] NlaSvc          C:\Windows\System32\nlasvc.dll

18:34:00.0442 4816  NlaSvc - ok

18:34:00.0472 4816  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys

18:34:00.0572 4816  Npfs - ok

18:34:00.0622 4816  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi             C:\Windows\system32\nsisvc.dll

18:34:00.0772 4816  nsi - ok

18:34:00.0792 4816  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys

18:34:00.0902 4816  nsiproxy - ok

18:34:01.0012 4816  [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys

18:34:01.0202 4816  Ntfs - ok

18:34:01.0232 4816  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys

18:34:01.0392 4816  Null - ok

18:34:01.0442 4816  [ A85B4F2EF3A7304A5399EF0526423040 ] NVENETFD        C:\Windows\system32\DRIVERS\nvm62x64.sys

18:34:01.0562 4816  NVENETFD - ok

18:34:01.0612 4816  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys

18:34:01.0662 4816  nvraid - ok

18:34:01.0692 4816  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys

18:34:01.0772 4816  nvstor - ok

18:34:01.0802 4816  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys

18:34:01.0852 4816  nv_agp - ok

18:34:01.0902 4816  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys

18:34:01.0962 4816  ohci1394 - ok

18:34:02.0002 4816  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll

18:34:02.0162 4816  p2pimsvc - ok

18:34:02.0212 4816  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll

18:34:02.0332 4816  p2psvc - ok

18:34:02.0352 4816  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport         C:\Windows\system32\drivers\parport.sys

18:34:02.0432 4816  Parport - ok

18:34:02.0482 4816  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr         C:\Windows\system32\drivers\partmgr.sys

18:34:02.0572 4816  partmgr - ok

18:34:02.0592 4816  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll

18:34:02.0672 4816  PcaSvc - ok

18:34:02.0712 4816  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci             C:\Windows\system32\drivers\pci.sys

18:34:02.0802 4816  pci - ok

18:34:02.0832 4816  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys

18:34:02.0892 4816  pciide - ok

18:34:02.0912 4816  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys

18:34:02.0992 4816  pcmcia - ok

18:34:03.0012 4816  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw             C:\Windows\system32\drivers\pcw.sys

18:34:03.0072 4816  pcw - ok

18:34:03.0112 4816  pdfcDispatcher - ok

18:34:03.0162 4816  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys

18:34:03.0332 4816  PEAUTH - ok

18:34:03.0582 4816  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe

18:34:03.0672 4816  PerfHost - ok

18:34:03.0772 4816  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla             C:\Windows\system32\pla.dll

18:34:03.0992 4816  pla - ok

18:34:04.0052 4816  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll

18:34:04.0232 4816  PlugPlay - ok

18:34:04.0272 4816  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll

18:34:04.0362 4816  PNRPAutoReg - ok

18:34:04.0392 4816  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll

18:34:04.0452 4816  PNRPsvc - ok

18:34:04.0492 4816  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll

18:34:04.0662 4816  PolicyAgent - ok

18:34:04.0712 4816  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power           C:\Windows\system32\umpo.dll

18:34:04.0852 4816  Power - ok

18:34:04.0912 4816  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys

18:34:05.0062 4816  PptpMiniport - ok

18:34:05.0102 4816  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor       C:\Windows\system32\drivers\processr.sys

18:34:05.0182 4816  Processor - ok

18:34:05.0262 4816  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc         C:\Windows\system32\profsvc.dll

18:34:05.0392 4816  ProfSvc - ok

18:34:05.0422 4816  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe

18:34:05.0502 4816  ProtectedStorage - ok

18:34:05.0552 4816  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys

18:34:05.0682 4816  Psched - ok

18:34:05.0752 4816  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\drivers\ql2300.sys

18:34:05.0932 4816  ql2300 - ok

18:34:05.0972 4816  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys

18:34:06.0052 4816  ql40xx - ok

18:34:06.0092 4816  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE           C:\Windows\system32\qwave.dll

18:34:06.0242 4816  QWAVE - ok

18:34:06.0262 4816  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys

18:34:06.0362 4816  QWAVEdrv - ok

18:34:06.0382 4816  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys

18:34:06.0532 4816  RasAcd - ok

18:34:06.0572 4816  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys

18:34:06.0702 4816  RasAgileVpn - ok

18:34:06.0742 4816  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto         C:\Windows\System32\rasauto.dll

18:34:06.0902 4816  RasAuto - ok

18:34:06.0932 4816  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys

18:34:07.0062 4816  Rasl2tp - ok

18:34:07.0102 4816  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll

18:34:07.0292 4816  RasMan - ok

18:34:07.0312 4816  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys

18:34:07.0462 4816  RasPppoe - ok

18:34:07.0512 4816  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys

18:34:07.0662 4816  RasSstp - ok

18:34:07.0702 4816  [ 77F665941019A1594D887A74F301FA2F ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys

18:34:07.0862 4816  rdbss - ok

18:34:07.0882 4816  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\drivers\rdpbus.sys

18:34:07.0942 4816  rdpbus - ok

18:34:07.0972 4816  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys

18:34:08.0112 4816  RDPCDD - ok

18:34:08.0142 4816  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys

18:34:08.0272 4816  RDPENCDD - ok

18:34:08.0302 4816  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys

18:34:08.0422 4816  RDPREFMP - ok

18:34:08.0482 4816  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys

18:34:08.0612 4816  RDPWD - ok

18:34:08.0642 4816  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys

18:34:08.0712 4816  rdyboost - ok

18:34:08.0762 4816  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll

18:34:08.0892 4816  RemoteAccess - ok

18:34:08.0932 4816  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll

18:34:09.0072 4816  RemoteRegistry - ok

18:34:09.0122 4816  [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys

18:34:09.0232 4816  RFCOMM - ok

18:34:09.0282 4816  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll

18:34:09.0432 4816  RpcEptMapper - ok

18:34:09.0472 4816  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe

18:34:09.0582 4816  RpcLocator - ok

18:34:09.0632 4816  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs           C:\Windows\system32\rpcss.dll

18:34:09.0762 4816  RpcSs - ok

18:34:09.0842 4816  [ 546D7F426776090B90EF5F195B6AE662 ] RSPCIESTOR      C:\Windows\system32\DRIVERS\RtsPStor.sys

18:34:09.0922 4816  RSPCIESTOR - ok

18:34:09.0982 4816  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys

18:34:10.0132 4816  rspndr - ok

18:34:10.0182 4816  [ 3372196F61AF48503656EF6AA3E92D1B ] RTL8167         C:\Windows\system32\DRIVERS\Rt64win7.sys

18:34:10.0282 4816  RTL8167 - ok

18:34:10.0322 4816  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs           C:\Windows\system32\lsass.exe

18:34:10.0372 4816  SamSs - ok

18:34:10.0392 4816  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys

18:34:10.0462 4816  sbp2port - ok

18:34:10.0502 4816  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll

18:34:10.0652 4816  SCardSvr - ok

18:34:10.0672 4816  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys

18:34:10.0832 4816  scfilter - ok

18:34:10.0892 4816  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll

18:34:11.0092 4816  Schedule - ok

18:34:11.0142 4816  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc     C:\Windows\System32\certprop.dll

18:34:11.0222 4816  SCPolicySvc - ok

18:34:11.0252 4816  [ 111E0EBC0AD79CB0FA014B907B231CF0 ] sdbus           C:\Windows\system32\DRIVERS\sdbus.sys

18:34:11.0362 4816  sdbus - ok

18:34:11.0402 4816  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll

18:34:11.0512 4816  SDRSVC - ok

18:34:11.0542 4816  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys

18:34:11.0672 4816  secdrv - ok

18:34:11.0722 4816  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll

18:34:11.0842 4816  seclogon - ok

18:34:11.0872 4816  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll

18:34:12.0002 4816  SENS - ok

18:34:12.0072 4816  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll

18:34:12.0202 4816  SensrSvc - ok

18:34:12.0232 4816  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum         C:\Windows\system32\drivers\serenum.sys

18:34:12.0322 4816  Serenum - ok

18:34:12.0362 4816  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\drivers\serial.sys

18:34:12.0472 4816  Serial - ok

18:34:12.0502 4816  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\drivers\sermouse.sys

18:34:12.0552 4816  sermouse - ok

18:34:12.0632 4816  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll

18:34:12.0792 4816  SessionEnv - ok

18:34:12.0812 4816  [ A554811BCD09279536440C964AE35BBF ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys

18:34:12.0882 4816  sffdisk - ok

18:34:12.0902 4816  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys

18:34:12.0982 4816  sffp_mmc - ok

18:34:13.0002 4816  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys

18:34:13.0102 4816  sffp_sd - ok

18:34:13.0122 4816  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy         C:\Windows\system32\drivers\sfloppy.sys

18:34:13.0182 4816  sfloppy - ok

18:34:13.0232 4816  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll

18:34:13.0392 4816  SharedAccess - ok

18:34:13.0442 4816  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll

18:34:13.0612 4816  ShellHWDetection - ok

18:34:13.0662 4816  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys

18:34:13.0752 4816  SiSRaid2 - ok

18:34:13.0772 4816  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys

18:34:13.0822 4816  SiSRaid4 - ok

18:34:13.0862 4816  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb             C:\Windows\system32\DRIVERS\smb.sys

18:34:14.0012 4816  Smb - ok

18:34:14.0082 4816  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe

18:34:14.0162 4816  SNMPTRAP - ok

18:34:14.0182 4816  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr           C:\Windows\system32\drivers\spldr.sys

18:34:14.0242 4816  spldr - ok

18:34:14.0282 4816  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler         C:\Windows\System32\spoolsv.exe

18:34:14.0482 4816  Spooler - ok

18:34:14.0602 4816  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe

18:34:14.0952 4816  sppsvc - ok

18:34:14.0972 4816  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify     C:\Windows\system32\sppuinotify.dll

18:34:15.0072 4816  sppuinotify - ok

18:34:15.0132 4816  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv             C:\Windows\system32\DRIVERS\srv.sys

18:34:15.0272 4816  srv - ok

18:34:15.0302 4816  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys

18:34:15.0392 4816  srv2 - ok

18:34:15.0452 4816  [ 0C4540311E11664B245A263E1154CEF8 ] SrvHsfHDA       C:\Windows\system32\DRIVERS\VSTAZL6.SYS

18:34:15.0552 4816  SrvHsfHDA - ok

18:34:15.0602 4816  [ 02071D207A9858FBE3A48CBFD59C4A04 ] SrvHsfV92       C:\Windows\system32\DRIVERS\VSTDPV6.SYS

18:34:15.0782 4816  SrvHsfV92 - ok

18:34:15.0842 4816  [ 18E40C245DBFAF36FD0134A7EF2DF396 ] SrvHsfWinac     C:\Windows\system32\DRIVERS\VSTCNXT6.SYS

18:34:15.0942 4816  SrvHsfWinac - ok

18:34:15.0982 4816  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys

18:34:16.0092 4816  srvnet - ok

18:34:16.0132 4816  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll

18:34:16.0282 4816  SSDPSRV - ok

18:34:16.0312 4816  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc         C:\Windows\system32\sstpsvc.dll

18:34:16.0422 4816  SstpSvc - ok

18:34:16.0452 4816  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\drivers\stexstor.sys

18:34:16.0512 4816  stexstor - ok

18:34:16.0572 4816  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll

18:34:16.0702 4816  stisvc - ok

18:34:16.0722 4816  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\drivers\swenum.sys

18:34:16.0772 4816  swenum - ok

18:34:16.0802 4816  [ E08E46FDD841B7184194011CA1955A0B ] swprv           C:\Windows\System32\swprv.dll

18:34:16.0992 4816  swprv - ok

18:34:17.0072 4816  [ EC4DCA6539EB97376F1A1743D209D842 ] SynTP           C:\Windows\system32\DRIVERS\SynTP.sys

18:34:17.0242 4816  SynTP - ok

18:34:17.0322 4816  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain         C:\Windows\system32\sysmain.dll

18:34:17.0482 4816  SysMain - ok

18:34:17.0522 4816  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll

18:34:17.0652 4816  TabletInputService - ok

18:34:17.0692 4816  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv         C:\Windows\System32\tapisrv.dll

18:34:17.0852 4816  TapiSrv - ok

18:34:17.0882 4816  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS             C:\Windows\System32\tbssvc.dll

18:34:18.0022 4816  TBS - ok

18:34:18.0102 4816  [ 37608401DFDB388CAF66917F6B2D6FB0 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys

18:34:18.0282 4816  Tcpip - ok

18:34:18.0382 4816  [ 37608401DFDB388CAF66917F6B2D6FB0 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys

18:34:18.0482 4816  TCPIP6 - ok

18:34:18.0532 4816  [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys

18:34:18.0582 4816  tcpipreg - ok

18:34:18.0632 4816  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys

18:34:18.0852 4816  TDPIPE - ok

18:34:18.0912 4816  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys

18:34:18.0982 4816  TDTCP - ok

18:34:19.0032 4816  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys

18:34:19.0172 4816  tdx - ok

18:34:19.0192 4816  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\drivers\termdd.sys

18:34:19.0242 4816  TermDD - ok

18:34:19.0292 4816  [ 2E648163254233755035B46DD7B89123 ] TermService     C:\Windows\System32\termsrv.dll

18:34:19.0482 4816  TermService - ok

18:34:19.0522 4816  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll

18:34:19.0612 4816  Themes - ok

18:34:19.0642 4816  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER     C:\Windows\system32\mmcss.dll

18:34:19.0732 4816  THREADORDER - ok

18:34:19.0762 4816  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll

18:34:19.0912 4816  TrkWks - ok

18:34:19.0982 4816  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe

18:34:20.0092 4816  TrustedInstaller - ok

18:34:20.0122 4816  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys

18:34:20.0252 4816  tssecsrv - ok

18:34:20.0292 4816  [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys

18:34:20.0392 4816  TsUsbFlt - ok

18:34:20.0422 4816  [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD         C:\Windows\system32\drivers\TsUsbGD.sys

18:34:20.0482 4816  TsUsbGD - ok

18:34:20.0512 4816  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys

18:34:20.0662 4816  tunnel - ok

18:34:20.0692 4816  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\drivers\uagp35.sys

18:34:20.0772 4816  uagp35 - ok

18:34:20.0822 4816  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys

18:34:20.0992 4816  udfs - ok

18:34:21.0062 4816  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect       C:\Windows\system32\UI0Detect.exe

18:34:21.0122 4816  UI0Detect - ok

18:34:21.0152 4816  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys

18:34:21.0212 4816  uliagpkx - ok

18:34:21.0232 4816  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus           C:\Windows\system32\DRIVERS\umbus.sys

18:34:21.0342 4816  umbus - ok

18:34:21.0372 4816  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys

18:34:21.0472 4816  UmPass - ok

18:34:21.0512 4816  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll

18:34:21.0712 4816  upnphost - ok

18:34:21.0762 4816  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys

18:34:21.0872 4816  usbccgp - ok

18:34:21.0892 4816  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys

18:34:21.0952 4816  usbcir - ok

18:34:22.0022 4816  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys

18:34:22.0112 4816  usbehci - ok

18:34:22.0162 4816  [ 76E2FFAD301490BA27B947C6507752FB ] usbfilter       C:\Windows\system32\DRIVERS\usbfilter.sys

18:34:22.0222 4816  usbfilter - ok

18:34:22.0292 4816  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys

18:34:22.0422 4816  usbhub - ok

18:34:22.0462 4816  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci         C:\Windows\system32\DRIVERS\usbohci.sys

18:34:22.0572 4816  usbohci - ok

18:34:22.0612 4816  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\drivers\usbprint.sys

18:34:22.0742 4816  usbprint - ok

18:34:22.0782 4816  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS

18:34:22.0932 4816  USBSTOR - ok

18:34:22.0972 4816  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys

18:34:23.0102 4816  usbuhci - ok

18:34:23.0142 4816  [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys

18:34:23.0252 4816  usbvideo - ok

18:34:23.0302 4816  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms           C:\Windows\System32\uxsms.dll

18:34:23.0432 4816  UxSms - ok

18:34:23.0462 4816  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe

18:34:23.0542 4816  VaultSvc - ok

18:34:23.0562 4816  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys

18:34:23.0612 4816  vdrvroot - ok

18:34:23.0662 4816  [ 8D6B481601D01A456E75C3210F1830BE ] vds             C:\Windows\System32\vds.exe

18:34:23.0832 4816  vds - ok

18:34:23.0872 4816  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys

18:34:23.0952 4816  vga - ok

18:34:23.0972 4816  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave         C:\Windows\System32\drivers\vga.sys

18:34:24.0112 4816  VgaSave - ok

18:34:24.0162 4816  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys

18:34:24.0222 4816  vhdmp - ok

18:34:24.0242 4816  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys

18:34:24.0292 4816  viaide - ok

18:34:24.0322 4816  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys

18:34:24.0372 4816  volmgr - ok

18:34:24.0412 4816  [ A255814907C89BE58B79EF2F189B843B ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys

18:34:24.0482 4816  volmgrx - ok

18:34:24.0512 4816  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap         C:\Windows\system32\drivers\volsnap.sys

18:34:24.0592 4816  volsnap - ok

18:34:24.0662 4816  [ 239D8D72730226CD460BDC8CA0A23D43 ] Vsdatant        C:\Windows\system32\DRIVERS\vsdatant.sys

18:34:24.0782 4816  Vsdatant - ok

18:34:24.0892 4816  vsmon - ok

18:34:24.0962 4816  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid         C:\Windows\system32\drivers\vsmraid.sys

18:34:25.0022 4816  vsmraid - ok

18:34:25.0102 4816  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS             C:\Windows\system32\vssvc.exe

18:34:25.0312 4816  VSS - ok

18:34:25.0352 4816  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys

18:34:25.0452 4816  vwifibus - ok

18:34:25.0492 4816  [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys

18:34:25.0602 4816  vwififlt - ok

18:34:25.0642 4816  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time         C:\Windows\system32\w32time.dll

18:34:25.0802 4816  W32Time - ok

18:34:25.0842 4816  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\drivers\wacompen.sys

18:34:25.0932 4816  WacomPen - ok

18:34:25.0972 4816  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys

18:34:26.0112 4816  WANARP - ok

18:34:26.0132 4816  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys

18:34:26.0242 4816  Wanarpv6 - ok

18:34:26.0342 4816  [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc     C:\Windows\system32\Wat\WatAdminSvc.exe

18:34:26.0472 4816  WatAdminSvc - ok

18:34:26.0562 4816  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe

18:34:26.0742 4816  wbengine - ok

18:34:26.0812 4816  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll

18:34:26.0872 4816  WbioSrvc - ok

18:34:26.0912 4816  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc         C:\Windows\System32\wcncsvc.dll

18:34:27.0062 4816  wcncsvc - ok

18:34:27.0102 4816  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll

18:34:27.0172 4816  WcsPlugInService - ok

18:34:27.0212 4816  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\drivers\wd.sys

18:34:27.0302 4816  Wd - ok

18:34:27.0362 4816  [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys

18:34:27.0472 4816  Wdf01000 - ok

18:34:27.0502 4816  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll

18:34:27.0672 4816  WdiServiceHost - ok

18:34:27.0702 4816  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost   C:\Windows\system32\wdi.dll

18:34:27.0772 4816  WdiSystemHost - ok

18:34:27.0812 4816  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient       C:\Windows\System32\webclnt.dll

18:34:27.0902 4816  WebClient - ok

18:34:27.0952 4816  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll

18:34:28.0112 4816  Wecsvc - ok

18:34:28.0152 4816  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport   C:\Windows\System32\wercplsupport.dll

18:34:28.0292 4816  wercplsupport - ok

18:34:28.0322 4816  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll

18:34:28.0462 4816  WerSvc - ok

18:34:28.0492 4816  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys

18:34:28.0642 4816  WfpLwf - ok

18:34:28.0672 4816  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys

18:34:28.0772 4816  WIMMount - ok

18:34:28.0812 4816  WinDefend - ok

18:34:28.0842 4816  WinHttpAutoProxySvc - ok

18:34:28.0972 4816  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll

18:34:29.0092 4816  Winmgmt - ok

18:34:29.0182 4816  [ BCB1310604AA415C4508708975B3931E ] WinRM           C:\Windows\system32\WsmSvc.dll

18:34:29.0402 4816  WinRM - ok

18:34:29.0482 4816  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc         C:\Windows\System32\wlansvc.dll

18:34:29.0662 4816  Wlansvc - ok

18:34:29.0792 4816  [ 7E47C328FC4768CB8BEAFBCFAFA70362 ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

18:34:29.0972 4816  wlidsvc - ok

18:34:30.0002 4816  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys

18:34:30.0092 4816  WmiAcpi - ok

18:34:30.0152 4816  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe

18:34:30.0262 4816  wmiApSrv - ok

18:34:30.0312 4816  WMPNetworkSvc - ok

18:34:30.0352 4816  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll

18:34:30.0452 4816  WPCSvc - ok

18:34:30.0472 4816  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll

18:34:30.0562 4816  WPDBusEnum - ok

18:34:30.0592 4816  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys

18:34:30.0712 4816  ws2ifsl - ok

18:34:30.0752 4816  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\System32\wscsvc.dll

18:34:30.0902 4816  wscsvc - ok

18:34:30.0922 4816  WSearch - ok

18:34:31.0032 4816  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll

18:34:31.0212 4816  wuauserv - ok

18:34:31.0262 4816  [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys

18:34:31.0382 4816  WudfPf - ok

18:34:31.0422 4816  [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys

18:34:31.0532 4816  WUDFRd - ok

18:34:31.0602 4816  [ B20F051B03A966392364C83F009F7D17 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll

18:34:31.0702 4816  wudfsvc - ok

18:34:31.0762 4816  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc         C:\Windows\System32\wwansvc.dll

18:34:31.0872 4816  WwanSvc - ok

18:34:31.0972 4816  [ EB71EAE3FB76758DEB8DEFC2C1EA25E9 ] XobniService    C:\Program Files (x86)\Xobni\XobniService.exe

18:34:32.0072 4816  XobniService - ok

18:34:32.0132 4816  ================ Scan global ===============================

18:34:32.0162 4816  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll

18:34:32.0272 4816  [ 72CC564BBC70DE268784BCE91EB8A28F ] C:\Windows\system32\winsrv.dll

18:34:32.0322 4816  [ 72CC564BBC70DE268784BCE91EB8A28F ] C:\Windows\system32\winsrv.dll

18:34:32.0352 4816  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll

18:34:32.0402 4816  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe

18:34:32.0422 4816  [Global] - ok

18:34:32.0422 4816  ================ Scan MBR ==================================

18:34:32.0442 4816  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0

18:34:33.0062 4816  \Device\Harddisk0\DR0 - ok

18:34:33.0062 4816  ================ Scan VBR ==================================

18:34:33.0072 4816  [ 3AB9BCF42DD1E9E2BC38D95473F9135F ] \Device\Harddisk0\DR0\Partition1

18:34:33.0072 4816  \Device\Harddisk0\DR0\Partition1 - ok

18:34:33.0122 4816  [ 6FCEDC14624FD0BD0EF273CBD187AE90 ] \Device\Harddisk0\DR0\Partition2

18:34:33.0132 4816  \Device\Harddisk0\DR0\Partition2 - ok

18:34:33.0172 4816  [ EF0F2F7DA33FFCB1EE5BD24DB8E47BD5 ] \Device\Harddisk0\DR0\Partition3

18:34:33.0182 4816  \Device\Harddisk0\DR0\Partition3 - ok

18:34:33.0212 4816  [ 80751F250873E2BF32119939247D73CA ] \Device\Harddisk0\DR0\Partition4

18:34:33.0212 4816  \Device\Harddisk0\DR0\Partition4 - ok

18:34:33.0222 4816  ============================================================

18:34:33.0222 4816  Scan finished

18:34:33.0222 4816  ============================================================

18:34:33.0242 2892  Detected object count: 2

18:34:33.0252 2892  Actual detected object count: 2

18:35:27.0312 2892  IconMan_R ( UnsignedFile.Multi.Generic ) - skipped by user

18:35:27.0312 2892  IconMan_R ( UnsignedFile.Multi.Generic ) - User select action: Skip 

18:35:27.0312 2892  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

18:35:27.0312 2892  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip

Sorry für wartezeit, war im Urlaub
combofix:

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo Markus... ein gutes Neus vorab
und Danke das Du dich meines wider annehmen willst.

Also, nach letzten TDSSKiller-Log habe ich nichts mehr gemacht - die beide "skipped" Objekte hast wahrscheinlich gesehen...

Inzwischen ist Test-Lizenz für Malwarebytes leider abgelaufen - täglich meldet das "Anti-Virus Schutz abgeschaltet ist"...
Gleiches auch bei AVG-2013... Test-Lizenz auch abgelaufen...

als Virenschutz (Scanner) ist mir nur das "ZoneAlarm Security Antivirus" geblieben, das ich jetzt für ComboFix-Lauf deaktiviert habe... Weil Du nichts vom Firewall-Abschaltung geschrieben hast habe ich zusätzlich auch WLan am Notebook deaktiviert... ich hoffe so ist OK.

Folge war, nach ComboFix Start (als Admin) das ZoneAlarm-Firewall sich mehrfach gemeldet hat mit Infos, das "irgendwelche" Programme
und Treiber gestartet/installiert werden möchten bzw. Zugriffe auf Registry abgeblockt wurden... - alles habe ich mit "Zulasen" quietiert...

Hier das Log-File (nach über 35 Minuten... und recht lange geworden)

Code:

ComboFix 13-01-03.05 - Mladen 03.01.2013  17:58:36.1.1 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.1643.555 [GMT 1:00]

ausgeführt von:: c:\users\Mladen\Desktop\ComboFix.exe

AV: AVG Anti-Virus 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

AV: ZoneAlarm Free Firewall Antivirus *Disabled/Updated* {DE038A5B-9EDD-18A9-2361-FF7D98D43730}

FW: ZoneAlarm Free Firewall Firewall *Enabled* {E6380B7E-D4B2-19F1-083E-56486607704B}

SP: AVG Anti-Virus 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: ZoneAlarm Free Firewall Anti-Spyware *Disabled/Updated* {65626BBF-B8E7-1727-19D1-C40FE3537D8D}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-12-03 bis 2013-01-03  ))))))))))))))))))))))))))))))

.

.

2013-01-03 17:17 . 2013-01-03 17:17        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-12-28 16:11 . 2012-12-28 16:11        --------        d-----w-        c:\program files\WinRAR

2012-12-23 02:03 . 2012-12-16 14:13        34304        ----a-w-        c:\windows\SysWow64\atmlib.dll

2012-12-23 02:03 . 2012-12-16 17:11        46080        ----a-w-        c:\windows\system32\atmlib.dll

2012-12-23 02:03 . 2012-12-16 14:45        367616        ----a-w-        c:\windows\system32\atmfd.dll

2012-12-23 02:03 . 2012-12-16 14:13        295424        ----a-w-        c:\windows\SysWow64\atmfd.dll

2012-12-19 12:08 . 2012-12-19 12:08        --------        d-----w-        c:\users\Mladen\AppData\Roaming\AVG

2012-12-19 12:05 . 2012-12-19 12:10        --------        d-----w-        c:\programdata\AVG

2012-12-19 12:04 . 2012-12-19 12:04        --------        d-sh--w-        c:\programdata\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}

2012-12-19 10:56 . 2012-11-29 08:26        262112        ----a-w-        c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll

2012-12-19 08:37 . 2012-12-19 08:37        --------        d-----w-        c:\windows\SysWow64\wbem\en-US

2012-12-19 08:37 . 2012-12-19 08:37        --------        d-----w-        c:\windows\system32\wbem\en-US

2012-12-18 11:32 . 2012-12-18 11:32        --------        d-----w-        c:\windows\SysWow64\Wat

2012-12-18 11:32 . 2012-12-18 11:32        --------        d-----w-        c:\windows\system32\Wat

2012-12-17 12:38 . 2012-12-17 14:07        --------        d-----w-        c:\program files (x86)\NortonInstaller

2012-12-17 11:27 . 2012-12-17 11:27        --------        d-----w-        c:\users\Mladen\AppData\Roaming\Malwarebytes

2012-12-17 11:27 . 2012-12-17 11:27        --------        d-----w-        c:\programdata\Malwarebytes

2012-12-17 11:27 . 2012-12-14 15:49        24176        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-12-17 11:27 . 2012-12-28 11:41        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2012-12-17 08:48 . 2012-12-17 08:48        --------        d-----w-        c:\users\Mladen\dwhelper

2012-12-15 20:54 . 2012-12-17 09:10        --------        d-----w-        c:\program files (x86)\Hex-Editor MX

2012-12-15 11:47 . 2012-12-15 11:47        --------        d-----w-        c:\users\Mladen\AppData\Local\Apps

2012-12-15 10:17 . 2012-12-17 09:10        --------        d-----w-        c:\program files\MediaInfo

2012-12-13 09:03 . 2012-12-19 16:24        --------        d-----w-        c:\program files (x86)\Mozilla Maintenance Service

2012-12-12 09:23 . 2012-12-12 09:24        --------        d-----w-        c:\users\Mladen\AppData\Roaming\Notepad++

2012-12-12 09:23 . 2012-12-12 09:23        --------        d-----w-        c:\program files (x86)\Notepad++

2012-12-12 08:36 . 2012-11-09 05:45        2048        ----a-w-        c:\windows\system32\tzres.dll

2012-12-12 08:36 . 2012-11-09 04:42        2048        ----a-w-        c:\windows\SysWow64\tzres.dll

2012-12-12 08:34 . 2012-11-02 05:59        478208        ----a-w-        c:\windows\system32\dpnet.dll

2012-12-12 08:34 . 2012-11-02 05:11        376832        ----a-w-        c:\windows\SysWow64\dpnet.dll

2012-12-09 14:49 . 2012-12-09 14:49        --------        d-----w-        c:\users\Default\AppData\Roaming\TuneUp Software

2012-12-09 14:19 . 2012-12-18 13:36        --------        d-----w-        c:\program files (x86)\Xaldon

2012-12-09 11:47 . 2012-12-09 22:01        --------        d-----w-        c:\users\Mladen\AppData\Roaming\MetaProducts

2012-12-09 11:43 . 2012-12-09 11:43        --------        d-----w-        c:\users\Mladen\AppData\Local\Programs

2012-12-08 17:43 . 2012-12-09 14:29        --------        d-----w-        C:\Meine Webseiten

2012-12-08 17:36 . 2012-12-08 17:37        --------        d-----w-        c:\program files\WinHTTrack

2012-12-08 10:27 . 2012-12-17 09:10        --------        d-----w-        c:\users\Mladen\AppData\Roaming\dvdcss

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-12-13 06:22 . 2012-11-24 20:01        67413224        ----a-w-        c:\windows\system32\MRT.exe

2012-12-12 10:32 . 2012-11-25 01:31        73656        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-12-12 10:32 . 2012-11-25 01:31        697272        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2012-11-25 01:06 . 2012-11-25 01:07        30568        ----a-w-        c:\windows\system32\drivers\avgtpx64.sys

2012-11-24 21:15 . 2012-11-24 21:15        477168        ----a-w-        c:\windows\SysWow64\npdeployJava1.dll

2012-11-24 21:15 . 2011-05-10 07:50        473072        ----a-w-        c:\windows\SysWow64\deployJava1.dll

2012-11-24 19:23 . 2010-06-24 09:33        19696        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2012-11-19 00:01 . 2012-11-24 19:55        9125352        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{11EFE4FB-D453-4621-B247-305E7C6D241C}\mpengine.dll

2012-11-13 20:29 . 2012-11-13 20:29        354216        ----a-w-        c:\windows\SysWow64\DivXControlPanelApplet.cpl

2012-10-22 12:02 . 2012-10-22 12:02        154464        ----a-w-        c:\windows\system32\drivers\avgidsdrivera.sys

2012-10-16 08:38 . 2012-11-28 11:48        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2012-10-16 08:38 . 2012-11-28 11:48        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll

2012-10-16 07:39 . 2012-11-28 11:48        561664        ----a-w-        c:\windows\apppatch\AcLayers.dll

2012-10-15 02:48 . 2012-10-15 02:48        63328        ----a-w-        c:\windows\system32\drivers\avgidsha.sys

2012-10-09 18:17 . 2012-11-24 19:52        55296        ----a-w-        c:\windows\system32\dhcpcsvc6.dll

2012-10-09 18:17 . 2012-11-24 19:52        226816        ----a-w-        c:\windows\system32\dhcpcore6.dll

2012-10-09 17:40 . 2012-11-24 19:52        193536        ----a-w-        c:\windows\SysWow64\dhcpcore6.dll

2012-10-09 17:40 . 2012-11-24 19:52        44032        ----a-w-        c:\windows\SysWow64\dhcpcsvc6.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-03-04 336384]

"ZoneAlarm"="c:\program files (x86)\CheckPoint\ZoneAlarm\zatray.exe" [2012-10-09 73392]

"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2010-12-13 318520]

"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-11-09 586296]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-23 926896]

"PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2011-02-01 656920]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"midi2"=wdmaud.drv

.

R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [2012-11-06 5814392]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 XobniService;XobniService;c:\program files (x86)\Xobni\XobniService.exe [2011-02-25 62184]

R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2011-01-06 36000]

R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2011-01-06 298144]

R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2011-01-06 201376]

R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2011-01-06 55456]

R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2011-01-06 154272]

R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2011-01-06 279200]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2012-12-18 1255736]

R4 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

R4 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [2012-08-30 827560]

S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys [2010-11-12 77952]

S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys [2010-11-12 37504]

S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-10-15 63328]

S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys [2012-09-21 225120]

S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2012-10-05 111456]

S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2012-09-14 40800]

S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2012-10-22 154464]

S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-10-02 185696]

S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-09-21 200032]

S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys [2012-11-25 30568]

S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2012-01-09 11864]

S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-03-04 203776]

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-03-04 354304]

S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 194496]

S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-01-06 138400]

S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2011-01-06 53920]

S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [2012-10-22 196664]

S2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-07-21 103992]

S2 HPAuto;HP Auto;c:\program files\Hewlett-Packard\HP Auto\HPAuto.exe [2011-02-16 682040]

S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-09-01 227896]

S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-11-09 26680]

S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2010-12-28 1817088]

S2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2012-08-30 33712]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 398184]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344]

S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe [2011-02-01 1127448]

S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]

S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2011-03-01 115216]

S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2011-01-06 28832]

S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2011-02-09 31088]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176]

S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2011-02-15 335464]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-03-05 436840]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2010-11-29 44672]

.

.

Inhalt des "geplante Tasks" Ordners

.

2013-01-03 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-25 10:32]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-01-11 6602856]

"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2012-08-30 1127592]

"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192]

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.com

uLocal Page = c:\windows\system32\blank.htm

uDefault_Search_URL = hxxp://www.google.com

mDefault_Search_URL = hxxp://www.google.com

mStart Page = hxxp://www.google.com

mLocal Page = c:\windows\SysWOW64\blank.htm

mSearch Page = hxxp://www.google.com

mSearch Bar = hxxp://www.google.com

TCP: DhcpNameServer = 192.168.178.1

FF - ProfilePath - c:\users\Mladen\AppData\Roaming\Mozilla\Firefox\Profiles\081fjeqd.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/|hxxp://www.haustechnikdialog.de/Forum/46/Haustechnikforum?showBookmarks=true

FF - ExtSQL: 2012-11-25 03:02; de_DE@dicts.j3e.de; c:\users\Mladen\AppData\Roaming\Mozilla\Firefox\Profiles\081fjeqd.default\extensions\de_DE@dicts.j3e.de

FF - ExtSQL: 2012-11-25 17:45; {b9db16a4-6edc-47ec-a1f4-b86292ed211d}; c:\users\Mladen\AppData\Roaming\Mozilla\Firefox\Profiles\081fjeqd.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

FF - ExtSQL: 2012-11-26 16:37; ffxtlbr@zonealarm.com; c:\users\Mladen\AppData\Roaming\Mozilla\Firefox\Profiles\081fjeqd.default\extensions\ffxtlbr@zonealarm.com

FF - ExtSQL: 2012-11-26 16:37; {FFB96CC1-7EB3-449D-B827-DB661701C6BB}; c:\program files\CheckPoint\ZAForceField\WOW64\TrustChecker

FF - ExtSQL: 2012-11-29 13:53; {5384767E-00D9-40E9-B72F-9CC39D655D6F}; c:\users\Mladen\AppData\Roaming\Mozilla\Firefox\Profiles\081fjeqd.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}

FF - ExtSQL: 2012-11-30 21:19; {23fcfd51-4958-4f00-80a3-ae97e717ed8b}; c:\program files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF - ExtSQL: 2012-12-09 12:43; {F58A62EB-38DC-43C4-A539-DC52E135208D}; c:\users\Mladen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{F58A62EB-38DC-43C4-A539-DC52E135208D}

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

URLSearchHooks-{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - (no file)

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

WebBrowser-{FC2B76FC-2132-4D80-A9A3-1F5C6E49066B} - (no file)

AddRemove-{9FEFA8C2-80EB-4B7A-BDE0-E077D94C36C4} - c:\program files (x86)\InstallShield Installation Information\{9FEFA8C2-80EB-4B7A-BDE0-E077D94C36C4}\setup.exe

.

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]

"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-01-03  18:26:56

ComboFix-quarantined-files.txt  2013-01-03 17:26

.

Vor Suchlauf: 9 Verzeichnis(se), 168.702.554.112 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 169.256.071.168 Bytes frei

.

- - End Of File - - 3C00CB0C7FB1877CCDACB1B9A4183939

ZoneAlarm ist wider zugeschaltet, WLan freigegeben aber ein Rechner-Neustart habe ich noch nicht versucht...

Mfg
Mladen

Hi
lade den CCleaner standard:
CCleaner - Download - Filepony
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools,uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

:confused:
Schwere Aufgabe... viele Microsoftprogramme wurden "mitgeliefert" aber Lizenz soll gekauft werden... wahrscheinlich alles unnötig so vorinstalliert?
Manche Programme nutze ich wirklich sehr selten... (soll das Zeug lieber erst bei Bedarf nachinstalliert werden?)

Code:

7-Zip 9.20 (x64 edition)        Igor Pavlov        24.11.2012        4,53MB        9.20.00.0                                notwendig

Adobe Flash Player 11 ActiveX        Adobe Systems Incorporated        12.12.2012        6,00MB        11.5.502.135                notwendig

Adobe Flash Player 11 Plugin        Adobe Systems Incorporated        12.12.2012        6,00MB        11.5.502.135                notwendig (wahrscheinlich?!)

Adobe Reader XI - Deutsch        Adobe Systems Incorporated        30.11.2012        128MB        11.0.00                        notwendig

Atheros Driver Installation Program        Atheros        28.08.2011                9.2                                        ?? unbekannt ?

ATI Catalyst Install Manager        ATI Technologies, Inc.        28.08.2011        22,4MB        3.0.808.0                        notwendig

Audio Converter                27.11.2012                                                                                notwendig

Audio Converter Packages                27.11.2012                                                                notwendig

AVG 2013        AVG Technologies        09.12.2012                2013.0.2805                                        ?? Testlizenz gerade abgelaufen

Bluetooth Win7 Suite (64)        Atheros Communications        28.08.2011        59,4MB        7.02.000.55                        notwendig

CCleaner        Piriform        04.12.2012                3.25                                                        notwendig

Cisco EAP-FAST Module        Cisco Systems, Inc.        28.08.2011        1,55MB        2.2.14                                        ?? kenne nicht mehr?

Cisco LEAP Module        Cisco Systems, Inc.        28.08.2011        644KB        1.0.19                                        ?? kenne nicht mehr?

Cisco PEAP Module        Cisco Systems, Inc.        28.08.2011        1,23MB        1.1.6                                        ?? kenne nicht mehr?

CyberLink YouCam        CyberLink Corp.        28.08.2011        102MB        3.2.1.3726                                        notwendig

DivX-Setup        DivX, LLC        30.11.2012                2.6.1.22                                                notwendig - habe noch nicht ausgetestet

Energy Star Digital Logo        Hewlett-Packard        28.08.2011        300KB        1.0.1                                        notwendig

eSpeak version 1.46.29                30.11.2012        6,17MB                                                                notwendig

Evernote v. 4.2.2        Evernote Corp.        10.05.2011        139MB        4.2.2.3979                                        notwendig

Hex-Editor MX        NEXT-Soft        15.12.2012                6.0                                                        notwendig - sehr selten

HP Documentation        Hewlett-Packard        10.05.2011        304MB        1.1.0.0                                                notwendig

HP Games        WildTangent        28.08.2011                1.0.2.4                                                        notwendig - sehr selten

HP On Screen Display        Hewlett-Packard Company        10.05.2011        1,43MB        1.0.7                                        notwendig

HP Power Manager        Hewlett-Packard Company        28.08.2011        3,61MB        1.2.1                                        notwendig

HP Quick Launch        Hewlett-Packard Company        10.05.2011        7,14MB        2.3.6                                                notwendig

HP Setup        Hewlett-Packard Company        10.05.2011                8.5.4526.3645                                        notwendig

HP Software Framework        Hewlett-Packard Company        08.12.2012        4,74MB        4.1.13.1                                notwendig

HP Support Assistant        Hewlett-Packard Company        10.05.2011        62,9MB        5.1.11.1                                notwendig

HP Wireless Assistant        Hewlett-Packard        20.12.2012        5,60MB        4.0.10.0                                        notwendig

IrfanView (remove only)        Irfan Skiljan        24.11.2012        1,50MB        4.32                                                notwendig

L&H TTS3000 Deutsch                29.11.2012                                                                        notwendig

Lernout & Hauspie TruVoice American English TTS Engine                29.11.2012                                        notwendig

Malwarebytes Anti-Malware Version 1.70.0.1100        Malwarebytes Corporation        28.12.2012        18,4MB        1.70.0.1100                 ?? Testlizenz gerade abgelaufen

MediaInfo 0.7.61        MediaArea.net        15.12.2012        10,9MB        0.7.61                                                                notwendig

Microsoft .NET Framework 4 Client Profile        Microsoft Corporation        25.11.2012        38,8MB        4.0.30319                        notwendig

Microsoft .NET Framework 4 Client Profile DEU Language Pack        Microsoft Corporation        25.11.2012        2,93MB        4.0.30319        notwendig

Microsoft Office 2010        Microsoft Corporation        10.05.2011        6,31MB        14.0.4763.1000                                                ?? unnötig (mitgeliefert oh. Lizenz)

Microsoft Reader                29.11.2012                                                                                        notwendig

Microsoft Reader Text-to-Speech deutsch        Microsoft Corporation        29.11.2012        2,28MB        01.00.0000                                notwendig

Microsoft Speech SDK 5.1        Microsoft        27.11.2012        83,0MB        5.1.4324.0                                                notwendig

Microsoft SQL Server 2005 Compact Edition [ENU]        Microsoft Corporation        10.05.2011        1,69MB        3.1.0000                        notwendig

Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        28.08.2011        428KB        8.0.56336                        notwendig

Microsoft Visual C++ 2005 Redistributable (x64)        Microsoft Corporation        28.08.2011        620KB        8.0.59192                        notwendig

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17        Microsoft Corporation        10.05.2011        788KB        9.0.30729        notwendig

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148        Microsoft Corporation        28.08.2011        788KB        9.0.30729.4148        notwendig

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148        Microsoft Corporation        28.08.2011        592KB        9.0.30729.4148        notwendig

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319        Microsoft Corporation        28.08.2011        13,6MB        10.0.30319        notwendig

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219        Microsoft Corporation        25.11.2012        11,1MB        10.0.40219        notwendig

Microsoft_VC90_CRT_x86        Microsoft Corporation        10.05.2011        1,37MB        1.0.0                                                        notwendig

Mozilla Firefox 17.0.1 (x86 de)        Mozilla        19.12.2012        41,5MB        17.0.1                                                notwendig

Mozilla Maintenance Service        Mozilla        19.12.2012        329KB        17.0.1                                                notwendig

Mozilla Thunderbird (8.0)        Mozilla        25.11.2012                8.0 (de)                                        notwendig

NextUp-ScanSoft Steffi German Voice        NextUp.com        30.11.2012        61,9MB        4.0.0                                notwendig

Notepad++                12.12.2012                6.2.2                                                                notwendig - habe nicht ausgetestet

OpenOffice.org 3.3        OpenOffice.org        24.11.2012        432MB        3.3.9567                                        notwendig

PDF Complete Special Edition        PDF Complete, Inc        28.08.2011                4.0.34                                notwendig

Protected Search 1.1        Protected Search        30.11.2012        2,11MB                                                ?? unbekannt ?

RealSpeak Solo fur Deutsch - Steffi        ScanSoft        27.11.2012        16,4MB        4.00.0000                        notwendig

Realtek Ethernet Controller Driver        Realtek        28.08.2011                7.42.304.2011                                notwendig

Realtek High Definition Audio Driver        Realtek Semiconductor Corp.        28.08.2011                6.0.1.6287        notwendig

Realtek PCIE Card Reader        Realtek Semiconductor Corp.        28.08.2011                6.1.7600.77                notwendig

Skype™ 5.1        Skype Technologies S.A.        10.05.2011        22,5MB        5.1.104                                                notwendig

Synaptics Pointing Device Driver        Synaptics Incorporated        28.08.2011        46,4MB        15.2.4.3                notwendig

Visual Studio 2010 x64 Redistributables        AVG Technologies        25.11.2012        12,4MB        13.0.0.1                notwendig

VLC media player 1.1.11        VideoLAN        24.11.2012                1.1.11                                                notwendig

WEB.DE MailCheck für Mozilla Firefox        1&1 Mail & Media GmbH        29.11.2012                2.1.4.1420                notwendig

Winamp        Nullsoft, Inc        30.11.2012                5.63                                                                 notwendig

Winamp Erkennungs-Plug-in        Nullsoft, Inc        30.11.2012        75,0KB        1.0.0.1                                        notwendig

Windows Live Essentials        Microsoft Corporation        10.05.2011                15.4.3508.1109                                ?? unnötig (mitgeliefert oh. Lizenz)                        

Windows Media Player Firefox Plugin        Microsoft Corp        25.11.2012        296KB        1.0.0.8                                notwendig

Windows Speech Recognition Macros        Microsoft Corporation        29.11.2012        1,25MB        1.0.6862.19                notwendig

WinHTTrack Website Copier 3.46-1 (x64)        HTTrack        08.12.2012                3.46.1                                        notwendig

WinRAR 4.20 (64-Bit)        win.rar GmbH        28.12.2012                4.20.0                                                notwendig

Xobni        Xobni Corp.        28.08.2011                1.9.5.13209                                                        notwendig

ZoneAlarm Free Firewall        Check Point        26.11.2012        307MB        10.2.081.000                                        notwendig

ZoneAlarm Security Toolbar        Check Point Software Technologies LTD        26.11.2012                                notwendig (aber nicht aktiviert)

Nach besten Wissen und Gewissen... :confused:

mfg
Mladen

deinstaliere:
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen

bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
DivX
Microsoft Office : kann weg, und alle anderen, wo es nur Testversionen gab.
Mozilla Thunderbird : öffnen, hilfe, update, version 17 einspielen.

deinstaliere:
Protected Search
WEB.DE MailCheck : wieso nötig, du hast doch thunderbird.
Windows Live : alle von dir nicht benötigten
ZoneAlarm : weg damit, ist nicht nötig!

Unter win7 hast du ne vernünftige Firewall..

Öffne CCleaner, analysieren, starten, PC neustarten.
Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Suche.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste
mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Ok, habe nacheinander (fast) alles erledigt.. bitte um Entschuldigung da ich hierzu einige Fragen habe bevor ich es voll nachvollziehe.

- Habe bei beiden Adobe-Neuinstallationen extra nach "Haken bei Mcafee" gesucht aber wirklich nicht gesehen (nur Haken bei empfohlenem Update war gesetzt, was ich akzeptiert habe...), so wurde mir beides mal das McAfee-Ding parallel mit installiert...!?? ...was ich natürlich gleich danach aber auch wider im CCleaner deinstalliert habe habe... Ist so OK?

- habe "DiviX Plus Paket" wie empfohlen deinstalliert, wollte aber in Verbindung mit unserem TV-Wlan/DivX + FritzBox-Homeserver nutzen.. - gibt es Bedenken bei diesem Programm?

- ZoneAlarm habe ich noch behalten, da mir diese jedes "verdächtigte Verhalten" wie Zugriffe auf Sichere Zone oder auch auf Internet immer stoppt und nachfragt ob das OK ist - ein Sicherheitsgefühl das ich gerne behalten möchte besonders bei Downgeladene Software aus dem Netz - falls Betrieb parallel zum Win7-Firewall nicht unbedingt zu meiden ist...

- Im aktuellen ADWCleaner-Log sind aufgelistet alte ADW-Logs die ich in zwischen gelöscht habe... - war das ein Fehler? Das aktuelle ist mit (R10) bezeichnet:

Code:

# AdwCleaner v2.104 - Datei am 03/01/2013 um 23:38:16 erstellt

# Aktualisiert am 29/12/2012 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzer : Mladen - MLADEN-HP

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\Mladen\Desktop\adwcleaner.exe

# Option [Suche]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gefunden : HKCU\Software\ProtectedSearch
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v9.0.8112.16457
 

[OK] Die Registrierungsdatenbank ist sauber.
 

-\\ Mozilla Firefox v17.0.1 (de)
 

Datei : C:\Users\Mladen\AppData\Roaming\Mozilla\Firefox\Profiles\081fjeqd.default\prefs.js
 

[OK] Die Datei ist sauber.
 

*************************
 

AdwCleaner[R10].txt - [779 octets] - [03/01/2013 23:38:16]

AdwCleaner[R1].txt - [33157 octets] - [17/12/2012 21:35:38]

AdwCleaner[R2].txt - [33218 octets] - [17/12/2012 21:49:55]

AdwCleaner[R3].txt - [1466 octets] - [19/12/2012 10:14:29]

AdwCleaner[R4].txt - [2121 octets] - [19/12/2012 10:25:44]

AdwCleaner[R5].txt - [1396 octets] - [19/12/2012 10:39:56]

AdwCleaner[R6].txt - [1456 octets] - [19/12/2012 10:54:48]

AdwCleaner[R7].txt - [1516 octets] - [20/12/2012 10:08:04]

AdwCleaner[R8].txt - [1576 octets] - [22/12/2012 23:19:46]

AdwCleaner[R9].txt - [1459 octets] - [28/12/2012 12:33:38]

AdwCleaner[S1].txt - [33618 octets] - [17/12/2012 21:51:10]

AdwCleaner[S2].txt - [1528 octets] - [19/12/2012 10:18:28]
 

########## EOF - C:\AdwCleaner[R10].txt - [1502 octets] ##########

Parallel habe ich im CCleaner auch meine Startup- und FF_Startup hier aufgelistet mit Bitte auch darauf ein Blick zu werfen und Optimierung vorschlagen... (habe selbst einige NEIN eingefügt nach gelesenen Empfehlungen aus Netz...)

Code:

Nein        HKCU:Run        Speech Recognition        Microsoft Corporation        "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup

Ja        HKLM:Run        Adobe ARM        Adobe Systems Incorporated        "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

Nein        HKLM:Run        AthBtTray        Atheros Commnucations        "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe"

Nein        HKLM:Run        AtherosBtStack        Atheros Communications        "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"

Nein        HKLM:Run        AVG_UI                "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY

Ja        HKLM:Run        HP Quick Launch        Hewlett-Packard Development Company, L.P.        C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

Ja        HKLM:Run        HPOSD        Hewlett-Packard Development Company, L.P.        C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

Ja        HKLM:Run        HPWirelessAssistant                C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe 120 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe /hidden

Ja        HKLM:Run        ISW        Check Point Software Technologies        "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"

Ja        HKLM:Run        PDF Complete        PDF Complete Inc        C:\Program Files (x86)\PDF Complete\pdfsty.exe

Ja        HKLM:Run        RTHDVCPL        Realtek Semiconductor        C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s

Ja        HKLM:Run        StartCCC        Advanced Micro Devices, Inc.        "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

Nein        HKLM:Run        SynTPEnh        Synaptics Incorporated        %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe

Nein        HKLM:Run        WinampAgent        Nullsoft, Inc.        "C:\Program Files (x86)\Winamp\winampa.exe"

Ja        HKLM:Run        ZoneAlarm        Check Point Software Technologies LTD        "C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe"

Nein        Startup User        OpenOffice.org 3.3.lnk                C:\PROGRA~2\OPENOF~1.ORG\program\QUICKS~1.EXE

Code:

Ja        Extension        DownloadHelper        4.9.12        Michel Gutierrez        default        C:\Users\Mladen\AppData\Roaming\Mozilla\Firefox\Profiles\081fjeqd.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

Nein        Extension        EPUBReader        1.4.2.1        Michael Volz        default        C:\Users\Mladen\AppData\Roaming\Mozilla\Firefox\Profiles\081fjeqd.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}

Nein        Extension        FoxyDeal        5.0.2        R&E Media        default        C:\Users\Mladen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{F58A62EB-38DC-43C4-A539-DC52E135208D}

Ja        Extension        Wörterbuch Deutsch (de-DE), Hunspell-unterstützt        20120628        Björn Jacke        default        C:\Users\Mladen\AppData\Roaming\Mozilla\Firefox\Profiles\081fjeqd.default\extensions\de_DE@dicts.j3e.de

Nein        Extension        ZoneAlarm Security Engine        1.5.396.0        www.checkpoint.com        default        C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker

Nein        Extension        zonealarm.com        1.6.0        zonealarm.com        default        C:\Users\Mladen\AppData\Roaming\Mozilla\Firefox\Profiles\081fjeqd.default\extensions\ffxtlbr@zonealarm.com

Ja        Plugin        Adobe Acrobat        11.0.0.379        Adobe Systems Inc.        default        C:\Program Files (x86)\Adobe\Reader 11.0\Reader\browser\nppdf32.dll

Nein        Plugin        Java Deployment Toolkit 6.0.370.6        6.0.370.6        Sun Microsystems, Inc.        default        C:\Windows\SysWOW64\npdeployJava1.dll

Ja        Plugin        MicrosoftÂ® Windows Media Player Firefox Plugin        1.0.0.8        Microsoft Corporation        default        C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll

Ja        Plugin        npFFApi        1.0.0.1                default        C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll

Ja        Plugin        Shockwave Flash        11.5.502.135        Adobe Systems Incorporated        default        C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll

Ja        Plugin        Winamp Application Detector        5.6.3.3234        Nullsoft, Inc.        default        C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll

Ja        Plugin        Windows Activation Technologies        7.1.7600.16395        Microsoft Corporation        default        C:\Windows\system32\Wat\npWatWeb.dll

Mfg
Mladen

Hi, ist richtig.

MCafee wurde direkt auf der Download seite zum Abhaken angeboten
DiviX
finde ich nicht in der Liste, instaliere es aber, wenn nötig.

Zonealarm.
zeigt dir nicht jede verbindung, nur die, die es erkennen kann, das ist schon ein Unterschied.
aus meiner Sicht bringt solche Software nichts.
1. gibt es sowieso kaum angriffe auf privat PC's und wenn, höchstens mal Portscans, und die sind nicht gefährlich.
2. hast du doch bestimmt einen Router + Windows firewall komplett ausreichend.
3. sind Desktop Firewalls sowieso nicht so zuverlässig.
4. wenn Software, wie Schadsoftware zb nach außen will, schafft sie das in den meisten Fällen auch an der Firewall vorbei, gemeldet wird häufig nur gutartige Software die man sich selbst instaliert, und warum man die blockieren soll, ist mir ein rätzel, zumal man die meisten internet zugriffe sowieso in der Software blockieren kann.
also, das ist kein sicherheitsgewinn, höchstens schein sicherheit.
außerdem frisst eine Firewall die extra instaliert ist nur unnötig Resourcen.
unter CCleaner, autostartliste können alle Haken raus.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Schließe
alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Löschen.
Bestätige jeweils mit Ok.
Dein
Rechner wird neu gestartet, je nach Schwere der Infektion auch mehrmals - das ist normal. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den
Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[Sx].txt. (x = fortlaufende Nummer)

neustarten, testen wie PC + Programme laufen