Trojaner-Board - GVU-Trojaner schon wieder...

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - GVU-Trojaner schon wieder... (https://www.trojaner-board.de/135014-gvu-trojaner-schon.html)

GVU-Trojaner schon wieder...

Guten Abend,

als ich gestern auf nicht wirklich jugendfreien Seiten unterwegs war habe ich mir den GVU-Trojaner eingefangen.
Immer wenn ich mich anmelde erscheint die bestimmt fast allen bekannte weiße Seite mit der Aufforderung 100 Euronen zu zahlen und ich kann den Pc runterfahren.

Strg+Alt+Entf funktioniert noch,also kann ich problemlos den PC runterfahren und auch der Abgesicherte Modus bereitet keine Probleme.

Gestern Abend ist es mit gelungen dank meiner riesigen Menge an Datenmüll den Virus zu schließen bevor er mit seiner Arbeit beginnen konnte.
Dabei konnte ich den Namen tiyv.exe (vlt auch tivy,konnte es nicht genau sehen) als Versteck ausfindig machen

Betriebssystem Windows Vista [32-Bit]
Medion (Akira?)
Intel(R) Core(TM)2 Duo CPU E7400@2,80GHz

Bis jetzt bin ich den Schritten hier im Einführungspost gefolgt und habe Defogger,OTl und Gmer über meinen PC laufen lassen.

Die Ergebnisse der Scans habe ich als .zip Datei angehängt
Sie enthält alle 3 Logfiles von Extra.txt,OTL.txt und Gmer.txt

Mir würde es schon reichen wenn ich die wichtigsten Dokumente auf meine externe Festplatte ziehen könnte und dann den PC neu aufsetzten.
Wenn möglich wäre es natürlich besser nur gezielt den GVU-Trojaner auszumerzen.

Sonstige Programme habe ich bis jetzt noch keine zur Hand.

Danke für eure Hilfe!

Edit: habe natüröich versucht die gesehene Datei ausfindig zu machen und zu löschen.
Hab sie zwar gelöscht,geholfen hat es aber nicht

Hi,

otl fix

Fixen mit OTL

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:

:OTL

O4 - HKCU..\Run: [ctfmon.exe] C:\ProgramData\lbzdo.dat (Microsoft Corporation)

[2013.05.14 17:14:55 | 000,147,456 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\lbzdo.dat

[2013.05.14 17:14:55 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\rundll32.exe

[2013.05.14 17:14:54 | 000,147,456 | ---- | C] (Microsoft Corporation) -- C:\Users\Sabine\1719529.dll

[2013.05.15 13:45:26 | 095,023,320 | ---- | M] () -- C:\ProgramData\odzbl.pad

[2013.05.15 10:15:35 | 000,002,609 | ---- | M] () -- C:\ProgramData\odzbl.js

:files

:Commands

[emptytemp]

Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
Schließe bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.

Öffne dein Systemlaufwerk ( meistens C: )
Suche nun
folgenden Ordner: _OTL und öffne diesen.
Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
Dies wird eine Movedfiles.zip Datei in _OTL erstellen
Lade diese bitte in unseren Uploadchannel
hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

hier der _OTL\Moved Files FILELOG

Code:

All processes killed

========== OTL ==========

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ctfmon.exe deleted successfully.

C:\ProgramData\lbzdo.dat moved successfully.

File C:\ProgramData\lbzdo.dat not found.

C:\ProgramData\rundll32.exe moved successfully.

C:\Users\Sabine\1719529.dll moved successfully.

C:\ProgramData\odzbl.pad moved successfully.

C:\ProgramData\odzbl.js moved successfully.

========== FILES ==========

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56478 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: FH

->Temp folder emptied: 31832 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56478 bytes

 

User: Manuel

 

User: Public

 

User: Sabine

->Temp folder emptied: 497442637 bytes

->Temporary Internet Files folder emptied: 2581519971 bytes

->Java cache emptied: 236706 bytes

->Google Chrome cache emptied: 65392145 bytes

->Flash cache emptied: 57446 bytes

 

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56478 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 356352 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 7650254 bytes

RecycleBin emptied: 2351028808 bytes

 

Total Files Cleaned = 5.249,00 mb

 

 

OTL by OldTimer - Version 3.2.69.0 log created on 05162013_010457
 

Files\Folders moved on Reboot...
 

PendingFileRenameOperations files...
 

Registry entries deleted on Reboot...

EDIT: Upload hat auch problemlos geklappt. Hatte zu Beginn vergessen Avira zu deaktivieren (jetzt will das Programm endlich seine ARbeit machen-.-)

thx fürs hochladen.
Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Eine Frage zur Anleitung:Soll ich den PC jetzt neustarten vor dem nächsten Schritt,also vor dem nächsten Scan?

Hier der Filelog für den TDSSKiller:

Code:

01:46:14.0515 1328  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42

01:46:14.0984 1328  ============================================================

01:46:14.0984 1328  Current date / time: 2013/05/16 01:46:14.0984

01:46:14.0984 1328  SystemInfo:

01:46:14.0984 1328  

01:46:14.0984 1328  OS Version: 6.0.6002 ServicePack: 2.0

01:46:14.0984 1328  Product type: Workstation

01:46:14.0984 1328  ComputerName: SABINE-PC

01:46:14.0984 1328  UserName: Sabine

01:46:14.0984 1328  Windows directory: C:\Windows

01:46:14.0984 1328  System windows directory: C:\Windows

01:46:14.0984 1328  Processor architecture: Intel x86

01:46:14.0984 1328  Number of processors: 2

01:46:14.0984 1328  Page size: 0x1000

01:46:14.0984 1328  Boot type: Normal boot

01:46:14.0984 1328  ============================================================

01:46:16.0031 1328  Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050

01:46:16.0046 1328  Drive \Device\Harddisk4\DR42 - Size: 0x0 (0.00 Gb), SectorSize: 0x200, Cylinders: 0x0, SectorsPerTrack: 0x0, TracksPerCylinder: 0x0, Type 'W'

01:46:16.0046 1328  ============================================================

01:46:16.0046 1328  \Device\Harddisk0\DR0:

01:46:16.0046 1328  MBR partitions:

01:46:16.0046 1328  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x74705800

01:46:16.0046 1328  ============================================================

01:46:16.0062 1328  C: <-> \Device\Harddisk0\DR0\Partition1

01:46:16.0062 1328  ============================================================

01:46:16.0062 1328  Initialize success

01:46:16.0062 1328  ============================================================

01:46:33.0999 5340  ============================================================

01:46:33.0999 5340  Scan started

01:46:33.0999 5340  Mode: Manual; SigCheck; TDLFS; 

01:46:33.0999 5340  ============================================================

01:46:34.0218 5340  ================ Scan system memory ========================

01:46:34.0218 5340  System memory - ok

01:46:34.0218 5340  ================ Scan services =============================

01:46:34.0328 5340  [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI            C:\Windows\system32\drivers\acpi.sys

01:46:34.0421 5340  ACPI - ok

01:46:34.0484 5340  [ E850B0A94E8703CCBC980B31594DC408 ] acsint          C:\Windows\system32\DRIVERS\acsint.sys

01:46:34.0499 5340  acsint - ok

01:46:34.0531 5340  [ EA2429C90AEAB09D7F3A99B16DA23CED ] acsmux          C:\Windows\system32\DRIVERS\acsmux.sys

01:46:34.0546 5340  acsmux - ok

01:46:34.0593 5340  [ F040037B149FD0F5A5044AE563390FA7 ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

01:46:34.0593 5340  AdobeFlashPlayerUpdateSvc - ok

01:46:34.0640 5340  [ 04F0FCAC69C7C71A3AC4EB97FAFC8303 ] adp94xx         C:\Windows\system32\drivers\adp94xx.sys

01:46:34.0671 5340  adp94xx - ok

01:46:34.0734 5340  [ 60505E0041F7751BDBB80F88BF45C2CE ] adpahci         C:\Windows\system32\drivers\adpahci.sys

01:46:34.0749 5340  adpahci - ok

01:46:34.0765 5340  [ 8A42779B02AEC986EAB64ECFC98F8BD7 ] adpu160m        C:\Windows\system32\drivers\adpu160m.sys

01:46:34.0781 5340  adpu160m - ok

01:46:34.0796 5340  [ 241C9E37F8CE45EF51C3DE27515CA4E5 ] adpu320         C:\Windows\system32\drivers\adpu320.sys

01:46:34.0812 5340  adpu320 - ok

01:46:34.0843 5340  [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll

01:46:34.0874 5340  AeLookupSvc - ok

01:46:34.0906 5340  [ 3911B972B55FEA0478476B2E777B29FA ] AFD             C:\Windows\system32\drivers\afd.sys

01:46:34.0937 5340  AFD - ok

01:46:34.0953 5340  [ 13F9E33747E6B41A3FF305C37DB0D360 ] agp440          C:\Windows\system32\drivers\agp440.sys

01:46:35.0015 5340  agp440 - ok

01:46:35.0031 5340  [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx         C:\Windows\system32\drivers\djsvs.sys

01:46:35.0031 5340  aic78xx - ok

01:46:35.0062 5340  [ A1545B731579895D8CC44FC0481C1192 ] ALG             C:\Windows\System32\alg.exe

01:46:35.0109 5340  ALG - ok

01:46:35.0140 5340  [ 9EAEF5FC9B8E351AFA7E78A6FAE91F91 ] aliide          C:\Windows\system32\drivers\aliide.sys

01:46:35.0156 5340  aliide - ok

01:46:35.0171 5340  [ C47344BC706E5F0B9DCE369516661578 ] amdagp          C:\Windows\system32\drivers\amdagp.sys

01:46:35.0171 5340  amdagp - ok

01:46:35.0203 5340  [ 9B78A39A4C173FDBC1321E0DD659B34C ] amdide          C:\Windows\system32\drivers\amdide.sys

01:46:35.0203 5340  amdide - ok

01:46:35.0265 5340  [ 18F29B49AD23ECEE3D2A826C725C8D48 ] AmdK7           C:\Windows\system32\drivers\amdk7.sys

01:46:35.0312 5340  AmdK7 - ok

01:46:35.0312 5340  [ 93AE7F7DD54AB986A6F1A1B37BE7442D ] AmdK8           C:\Windows\system32\drivers\amdk8.sys

01:46:35.0359 5340  AmdK8 - ok

01:46:35.0406 5340  [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe

01:46:35.0421 5340  AntiVirSchedulerService - ok

01:46:35.0437 5340  [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService  C:\Program Files\Avira\AntiVir Desktop\avguard.exe

01:46:35.0437 5340  AntiVirService - ok

01:46:35.0468 5340  [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo         C:\Windows\System32\appinfo.dll

01:46:35.0515 5340  Appinfo - ok

01:46:35.0531 5340  [ 5D2888182FB46632511ACEE92FDAD522 ] arc             C:\Windows\system32\drivers\arc.sys

01:46:35.0531 5340  arc - ok

01:46:35.0546 5340  [ 5E2A321BD7C8B3624E41FDEC3E244945 ] arcsas          C:\Windows\system32\drivers\arcsas.sys

01:46:35.0562 5340  arcsas - ok

01:46:35.0656 5340  [ 776ACEFA0CA9DF0FAA51A5FB2F435705 ] aspnet_state    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe

01:46:35.0656 5340  aspnet_state - ok

01:46:35.0687 5340  AsrCDDrv - ok

01:46:35.0703 5340  [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys

01:46:35.0734 5340  AsyncMac - ok

01:46:35.0749 5340  [ 1F05B78AB91C9075565A9D8A4B880BC4 ] atapi           C:\Windows\system32\drivers\atapi.sys

01:46:35.0749 5340  atapi - ok

01:46:35.0781 5340  [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll

01:46:35.0796 5340  AudioEndpointBuilder - ok

01:46:35.0796 5340  [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv        C:\Windows\System32\Audiosrv.dll

01:46:35.0812 5340  Audiosrv - ok

01:46:35.0828 5340  [ D5541F0AFB767E85FC412FC609D96A74 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys

01:46:35.0828 5340  avgntflt - ok

01:46:35.0843 5340  [ 7D967A682D4694DF7FA57D63A2DB01FE ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys

01:46:35.0859 5340  avipbb - ok

01:46:35.0874 5340  [ 53E56450DA16A1A7F0D002F511113F67 ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys

01:46:35.0874 5340  avkmgr - ok

01:46:35.0890 5340  [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep            C:\Windows\system32\drivers\Beep.sys

01:46:35.0937 5340  Beep - ok

01:46:35.0968 5340  [ C789AF0F724FDA5852FB9A7D3A432381 ] BFE             C:\Windows\System32\bfe.dll

01:46:35.0984 5340  BFE - ok

01:46:36.0015 5340  [ 93952506C6D67330367F7E7934B6A02F ] BITS            C:\Windows\System32\qmgr.dll

01:46:36.0062 5340  BITS - ok

01:46:36.0078 5340  [ D4DF28447741FD3D953526E33A617397 ] blbdrive        C:\Windows\system32\drivers\blbdrive.sys

01:46:36.0109 5340  blbdrive - ok

01:46:36.0124 5340  [ 35F376253F687BDE63976CCB3F2108CA ] bowser          C:\Windows\system32\DRIVERS\bowser.sys

01:46:36.0140 5340  bowser - ok

01:46:36.0171 5340  [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo        C:\Windows\system32\drivers\brfiltlo.sys

01:46:36.0187 5340  BrFiltLo - ok

01:46:36.0203 5340  [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp        C:\Windows\system32\drivers\brfiltup.sys

01:46:36.0265 5340  BrFiltUp - ok

01:46:36.0312 5340  [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser         C:\Windows\System32\browser.dll

01:46:36.0406 5340  Browser - ok

01:46:36.0624 5340  [ D9C8DC2D7EC28E3FF25C99EF17C8631A ] BrowserProtect  C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe

01:46:36.0624 5340  Suspicious file (NoAccess): C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe. md5: D9C8DC2D7EC28E3FF25C99EF17C8631A

01:46:36.0640 5340  BrowserProtect ( LockedFile.Multi.Generic ) - warning

01:46:36.0640 5340  BrowserProtect - detected LockedFile.Multi.Generic (1)

01:46:36.0656 5340  [ B304E75CFF293029EDDF094246747113 ] Brserid         C:\Windows\system32\drivers\brserid.sys

01:46:36.0703 5340  Brserid - ok

01:46:36.0734 5340  [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm        C:\Windows\system32\drivers\brserwdm.sys

01:46:36.0796 5340  BrSerWdm - ok

01:46:36.0812 5340  [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm        C:\Windows\system32\drivers\brusbmdm.sys

01:46:36.0874 5340  BrUsbMdm - ok

01:46:36.0906 5340  [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer        C:\Windows\system32\drivers\brusbser.sys

01:46:36.0937 5340  BrUsbSer - ok

01:46:36.0953 5340  [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys

01:46:37.0015 5340  BTHMODEM - ok

01:46:37.0031 5340  [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys

01:46:37.0046 5340  cdfs - ok

01:46:37.0078 5340  [ 6B4BFFB9BECD728097024276430DB314 ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys

01:46:37.0093 5340  cdrom - ok

01:46:37.0109 5340  [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc     C:\Windows\System32\certprop.dll

01:46:37.0124 5340  CertPropSvc - ok

01:46:37.0156 5340  [ E5D4133F37219DBCFE102BC61072589D ] circlass        C:\Windows\system32\drivers\circlass.sys

01:46:37.0171 5340  circlass - ok

01:46:37.0218 5340  [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS            C:\Windows\system32\CLFS.sys

01:46:37.0234 5340  CLFS - ok

01:46:37.0281 5340  [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

01:46:37.0281 5340  clr_optimization_v2.0.50727_32 - ok

01:46:37.0328 5340  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

01:46:37.0343 5340  clr_optimization_v4.0.30319_32 - ok

01:46:37.0374 5340  [ 0CA25E686A4928484E9FDABD168AB629 ] cmdide          C:\Windows\system32\drivers\cmdide.sys

01:46:37.0390 5340  cmdide - ok

01:46:37.0406 5340  [ 6AFEF0B60FA25DE07C0968983EE4F60A ] Compbatt        C:\Windows\system32\drivers\compbatt.sys

01:46:37.0421 5340  Compbatt - ok

01:46:37.0421 5340  COMSysApp - ok

01:46:37.0421 5340  [ 741E9DFF4F42D2D8477D0FC1DC0DF871 ] crcdisk         C:\Windows\system32\drivers\crcdisk.sys

01:46:37.0437 5340  crcdisk - ok

01:46:37.0453 5340  [ 1F07BECDCA750766A96CDA811BA86410 ] Crusoe          C:\Windows\system32\drivers\crusoe.sys

01:46:37.0484 5340  Crusoe - ok

01:46:37.0515 5340  [ F1E8C34892336D33EDDCDFE44E474F64 ] CryptSvc        C:\Windows\system32\cryptsvc.dll

01:46:37.0562 5340  CryptSvc - ok

01:46:37.0609 5340  [ A979E61C7A92D22F324817CDB6C1DBED ] cusrvc          C:\Program Files\Novell\Client\cusrvc.exe

01:46:37.0624 5340  cusrvc - ok

01:46:37.0656 5340  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch      C:\Windows\system32\rpcss.dll

01:46:37.0734 5340  DcomLaunch - ok

01:46:37.0749 5340  [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC            C:\Windows\system32\Drivers\dfsc.sys

01:46:37.0796 5340  DfsC - ok

01:46:37.0859 5340  [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR            C:\Windows\system32\DFSR.exe

01:46:37.0968 5340  DFSR - ok

01:46:38.0046 5340  [ 9028559C132146FB75EB7ACF384B086A ] Dhcp            C:\Windows\System32\dhcpcsvc.dll

01:46:38.0093 5340  Dhcp - ok

01:46:38.0109 5340  [ 5D4AEFC3386920236A548271F8F1AF6A ] disk            C:\Windows\system32\drivers\disk.sys

01:46:38.0109 5340  disk - ok

01:46:38.0156 5340  [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache        C:\Windows\System32\dnsrslvr.dll

01:46:38.0187 5340  Dnscache - ok

01:46:38.0203 5340  [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc         C:\Windows\System32\dot3svc.dll

01:46:38.0234 5340  dot3svc - ok

01:46:38.0249 5340  [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS             C:\Windows\system32\dps.dll

01:46:38.0281 5340  DPS - ok

01:46:38.0312 5340  [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys

01:46:38.0343 5340  drmkaud - ok

01:46:38.0374 5340  [ C68AC676B0EF30CFBB1080ADCE49EB1F ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys

01:46:38.0406 5340  DXGKrnl - ok

01:46:38.0437 5340  [ 5425F74AC0C1DBD96A1E04F17D63F94C ] E1G60           C:\Windows\system32\DRIVERS\E1G60I32.sys

01:46:38.0484 5340  E1G60 - ok

01:46:38.0499 5340  [ C0B95E40D85CD807D614E264248A45B9 ] EapHost         C:\Windows\System32\eapsvc.dll

01:46:38.0515 5340  EapHost - ok

01:46:38.0546 5340  [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache          C:\Windows\system32\drivers\ecache.sys

01:46:38.0562 5340  Ecache - ok

01:46:38.0609 5340  [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe

01:46:38.0640 5340  ehRecvr - ok

01:46:38.0671 5340  [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched         C:\Windows\ehome\ehsched.exe

01:46:38.0718 5340  ehSched - ok

01:46:38.0734 5340  [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart         C:\Windows\ehome\ehstart.dll

01:46:38.0749 5340  ehstart - ok

01:46:38.0781 5340  [ 23B62471681A124889978F6295B3F4C6 ] elxstor         C:\Windows\system32\drivers\elxstor.sys

01:46:38.0796 5340  elxstor - ok

01:46:38.0874 5340  [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt         C:\Windows\system32\emdmgmt.dll

01:46:38.0921 5340  EMDMgmt - ok

01:46:38.0937 5340  [ 3DB974F3935483555D7148663F726C61 ] ErrDev          C:\Windows\system32\drivers\errdev.sys

01:46:38.0968 5340  ErrDev - ok

01:46:38.0999 5340  [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem     C:\Windows\system32\es.dll

01:46:39.0031 5340  EventSystem - ok

01:46:39.0046 5340  [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat           C:\Windows\system32\drivers\exfat.sys

01:46:39.0062 5340  exfat - ok

01:46:39.0078 5340  [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat         C:\Windows\system32\drivers\fastfat.sys

01:46:39.0093 5340  fastfat - ok

01:46:39.0109 5340  [ AFE1E8B9782A0DD7FB46BBD88E43F89A ] fdc             C:\Windows\system32\DRIVERS\fdc.sys

01:46:39.0156 5340  fdc - ok

01:46:39.0156 5340  [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost         C:\Windows\system32\fdPHost.dll

01:46:39.0171 5340  fdPHost - ok

01:46:39.0187 5340  [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub        C:\Windows\system32\fdrespub.dll

01:46:39.0234 5340  FDResPub - ok

01:46:39.0265 5340  [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys

01:46:39.0281 5340  FileInfo - ok

01:46:39.0296 5340  [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace       C:\Windows\system32\drivers\filetrace.sys

01:46:39.0328 5340  Filetrace - ok

01:46:39.0343 5340  [ 85B7CF99D532820495D68D747FDA9EBD ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys

01:46:39.0374 5340  flpydisk - ok

01:46:39.0390 5340  [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys

01:46:39.0406 5340  FltMgr - ok

01:46:39.0453 5340  [ 8CE364388C8ECA59B14B539179276D44 ] FontCache       C:\Windows\system32\FntCache.dll

01:46:39.0499 5340  FontCache - ok

01:46:39.0562 5340  [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

01:46:39.0562 5340  FontCache3.0.0.0 - ok

01:46:39.0593 5340  [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys

01:46:39.0609 5340  Fs_Rec - ok

01:46:39.0624 5340  [ 34582A6E6573D54A07ECE5FE24A126B5 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys

01:46:39.0640 5340  gagp30kx - ok

01:46:39.0718 5340  Giraffic - ok

01:46:39.0734 5340  [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc           C:\Windows\System32\gpsvc.dll

01:46:39.0781 5340  gpsvc - ok

01:46:39.0921 5340  [ F02A533F517EB38333CB12A9E8963773 ] gupdate         C:\Program Files\Google\Update\GoogleUpdate.exe

01:46:39.0921 5340  gupdate - ok

01:46:39.0937 5340  [ F02A533F517EB38333CB12A9E8963773 ] gupdatem        C:\Program Files\Google\Update\GoogleUpdate.exe

01:46:39.0937 5340  gupdatem - ok

01:46:39.0953 5340  [ 833051C6C6C42117191935F734CFBD97 ] hamachi         C:\Windows\system32\DRIVERS\hamachi.sys

01:46:39.0968 5340  hamachi - ok

01:46:40.0281 5340  [ 616399E27A55C97AE859230EB13984D8 ] Hamachi2Svc     C:\Program Files\LogMeIn Hamachi\hamachi-2.exe

01:46:40.0484 5340  Hamachi2Svc - ok

01:46:40.0562 5340  [ 3F90E001369A07243763BD5A523D8722 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys

01:46:40.0578 5340  HdAudAddService - ok

01:46:40.0656 5340  [ 062452B7FFD68C8C042A6261FE8DFF4A ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys

01:46:40.0749 5340  HDAudBus - ok

01:46:40.0796 5340  [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth          C:\Windows\system32\drivers\hidbth.sys

01:46:40.0843 5340  HidBth - ok

01:46:40.0874 5340  [ FF3160C3A2445128C5A6D9B076DA519E ] HidIr           C:\Windows\system32\drivers\hidir.sys

01:46:40.0906 5340  HidIr - ok

01:46:40.0937 5340  [ 84067081F3318162797385E11A8F0582 ] hidserv         C:\Windows\system32\hidserv.dll

01:46:40.0953 5340  hidserv - ok

01:46:40.0953 5340  [ CCA4B519B17E23A00B826C55716809CC ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys

01:46:40.0968 5340  HidUsb - ok

01:46:41.0062 5340  [ 9D2C35E06CE117355ABADCEEE1558D21 ] HiPatchService  C:\Program Files\Hi-Rez Studios\HiPatchService.exe

01:46:41.0093 5340  HiPatchService ( UnsignedFile.Multi.Generic ) - warning

01:46:41.0093 5340  HiPatchService - detected UnsignedFile.Multi.Generic (1)

01:46:41.0124 5340  [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc          C:\Windows\system32\kmsvc.dll

01:46:41.0140 5340  hkmsvc - ok

01:46:41.0171 5340  [ 16EE7B23A009E00D835CDB79574A91A6 ] HpCISSs         C:\Windows\system32\drivers\hpcisss.sys

01:46:41.0171 5340  HpCISSs - ok

01:46:41.0218 5340  [ F870AA3E254628EBEAFE754108D664DE ] HTTP            C:\Windows\system32\drivers\HTTP.sys

01:46:41.0249 5340  HTTP - ok

01:46:41.0281 5340  [ C6B032D69650985468160FC9937CF5B4 ] i2omp           C:\Windows\system32\drivers\i2omp.sys

01:46:41.0281 5340  i2omp - ok

01:46:41.0328 5340  [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys

01:46:41.0359 5340  i8042prt - ok

01:46:41.0390 5340  [ 54155EA1B0DF185878E0FC9EC3AC3A14 ] iaStorV         C:\Windows\system32\drivers\iastorv.sys

01:46:41.0390 5340  iaStorV - ok

01:46:41.0453 5340  [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc           C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

01:46:41.0703 5340  idsvc - ok

01:46:41.0734 5340  [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp           C:\Windows\system32\drivers\iirsp.sys

01:46:41.0765 5340  iirsp - ok

01:46:41.0859 5340  [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT          C:\Windows\System32\ikeext.dll

01:46:41.0906 5340  IKEEXT - ok

01:46:41.0921 5340  IntcAzAudAddService - ok

01:46:41.0921 5340  [ 83AA759F3189E6370C30DE5DC5590718 ] intelide        C:\Windows\system32\drivers\intelide.sys

01:46:41.0937 5340  intelide - ok

01:46:41.0953 5340  [ 224191001E78C89DFA78924C3EA595FF ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys

01:46:41.0968 5340  intelppm - ok

01:46:41.0999 5340  [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum       C:\Windows\system32\ipbusenum.dll

01:46:42.0031 5340  IPBusEnum - ok

01:46:42.0046 5340  [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys

01:46:42.0093 5340  IpFilterDriver - ok

01:46:42.0124 5340  [ 1998BD97F950680BB55F55A7244679C2 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll

01:46:42.0124 5340  iphlpsvc - ok

01:46:42.0140 5340  IpInIp - ok

01:46:42.0156 5340  [ B25AAF203552B7B3491139D582B39AD1 ] IPMIDRV         C:\Windows\system32\drivers\ipmidrv.sys

01:46:42.0171 5340  IPMIDRV - ok

01:46:42.0203 5340  [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT           C:\Windows\system32\DRIVERS\ipnat.sys

01:46:42.0218 5340  IPNAT - ok

01:46:42.0281 5340  [ 572A08A06C6BA5080EE80F170B0E627C ] iprntsrv        C:\Windows\system32\iprntsrv.exe

01:46:42.0296 5340  iprntsrv ( UnsignedFile.Multi.Generic ) - warning

01:46:42.0296 5340  iprntsrv - detected UnsignedFile.Multi.Generic (1)

01:46:42.0328 5340  [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys

01:46:42.0359 5340  IRENUM - ok

01:46:42.0374 5340  [ 6C70698A3E5C4376C6AB5C7C17FB0614 ] isapnp          C:\Windows\system32\drivers\isapnp.sys

01:46:42.0390 5340  isapnp - ok

01:46:42.0421 5340  [ 232FA340531D940AAC623B121A595034 ] iScsiPrt        C:\Windows\system32\DRIVERS\msiscsi.sys

01:46:42.0437 5340  iScsiPrt - ok

01:46:42.0453 5340  [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi        C:\Windows\system32\drivers\iteatapi.sys

01:46:42.0468 5340  iteatapi - ok

01:46:42.0484 5340  [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid         C:\Windows\system32\drivers\iteraid.sys

01:46:42.0484 5340  iteraid - ok

01:46:42.0515 5340  [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys

01:46:42.0531 5340  kbdclass - ok

01:46:42.0546 5340  [ EDE59EC70E25C24581ADD1FBEC7325F7 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys

01:46:42.0593 5340  kbdhid - ok

01:46:42.0609 5340  [ A3E186B4B935905B829219502557314E ] KeyIso          C:\Windows\system32\lsass.exe

01:46:42.0671 5340  KeyIso - ok

01:46:55.0281 5340  [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys

01:46:55.0296 5340  KSecDD - ok

01:46:55.0328 5340  [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm           C:\Windows\system32\msdtckrm.dll

01:46:55.0374 5340  KtmRm - ok

01:46:55.0406 5340  [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer    C:\Windows\system32\srvsvc.dll

01:46:55.0453 5340  LanmanServer - ok

01:46:55.0484 5340  [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\Windows\System32\wkssvc.dll

01:46:55.0531 5340  LanmanWorkstation - ok

01:46:55.0562 5340  [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys

01:46:55.0593 5340  lltdio - ok

01:46:55.0624 5340  [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc         C:\Windows\System32\lltdsvc.dll

01:46:55.0656 5340  lltdsvc - ok

01:46:55.0671 5340  [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts         C:\Windows\System32\lmhsvc.dll

01:46:55.0703 5340  lmhosts - ok

01:46:55.0734 5340  [ C7E15E82879BF3235B559563D4185365 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys

01:46:55.0749 5340  LSI_FC - ok

01:46:55.0749 5340  [ EE01EBAE8C9BF0FA072E0FF68718920A ] LSI_SAS         C:\Windows\system32\drivers\lsi_sas.sys

01:46:55.0765 5340  LSI_SAS - ok

01:46:55.0781 5340  [ 912A04696E9CA30146A62AFA1463DD5C ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys

01:46:55.0796 5340  LSI_SCSI - ok

01:46:55.0812 5340  [ 8F5C7426567798E62A3B3614965D62CC ] luafv           C:\Windows\system32\drivers\luafv.sys

01:46:55.0843 5340  luafv - ok

01:46:55.0874 5340  [ DDCC236009C707761D60E5C76D639176 ] McComponentHostService C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe

01:46:55.0890 5340  McComponentHostService - ok

01:46:55.0906 5340  [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll

01:46:55.0921 5340  Mcx2Svc - ok

01:46:55.0968 5340  [ 0001CE609D66632FA17B84705F658879 ] megasas         C:\Windows\system32\drivers\megasas.sys

01:46:56.0015 5340  megasas - ok

01:46:56.0062 5340  [ C252F32CD9A49DBFC25ECF26EBD51A99 ] MegaSR          C:\Windows\system32\drivers\megasr.sys

01:46:56.0078 5340  MegaSR - ok

01:46:56.0109 5340  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS           C:\Windows\system32\mmcss.dll

01:46:56.0171 5340  MMCSS - ok

01:46:56.0203 5340  [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem           C:\Windows\system32\drivers\modem.sys

01:46:56.0234 5340  Modem - ok

01:46:56.0234 5340  [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys

01:46:56.0296 5340  monitor - ok

01:46:56.0296 5340  [ 5BF6A1326A335C5298477754A506D263 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys

01:46:56.0312 5340  mouclass - ok

01:46:56.0343 5340  [ 93B8D4869E12CFBE663915502900876F ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys

01:46:56.0390 5340  mouhid - ok

01:46:56.0406 5340  [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr        C:\Windows\system32\drivers\mountmgr.sys

01:46:56.0421 5340  MountMgr - ok

01:46:56.0453 5340  [ 511D011289755DD9F9A7579FB0B064E6 ] mpio            C:\Windows\system32\drivers\mpio.sys

01:46:56.0468 5340  mpio - ok

01:46:56.0484 5340  [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys

01:46:56.0515 5340  mpsdrv - ok

01:46:56.0562 5340  [ 5DE62C6E9108F14F6794060A9BDECAEC ] MpsSvc          C:\Windows\system32\mpssvc.dll

01:46:56.0593 5340  MpsSvc - ok

01:46:56.0609 5340  [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x        C:\Windows\system32\drivers\mraid35x.sys

01:46:56.0624 5340  Mraid35x - ok

01:46:56.0671 5340  [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys

01:46:56.0703 5340  MRxDAV - ok

01:46:56.0749 5340  [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys

01:46:56.0765 5340  mrxsmb - ok

01:46:56.0781 5340  [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys

01:46:56.0796 5340  mrxsmb10 - ok

01:46:56.0796 5340  [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys

01:46:56.0812 5340  mrxsmb20 - ok

01:46:56.0843 5340  [ 28023E86F17001F7CD9B15A5BC9AE07D ] msahci          C:\Windows\system32\drivers\msahci.sys

01:46:56.0843 5340  msahci - ok

01:46:56.0859 5340  [ 4468B0F385A86ECDDAF8D3CA662EC0E7 ] msdsm           C:\Windows\system32\drivers\msdsm.sys

01:46:56.0874 5340  msdsm - ok

01:46:56.0890 5340  [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC           C:\Windows\System32\msdtc.exe

01:46:56.0921 5340  MSDTC - ok

01:46:56.0953 5340  [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs            C:\Windows\system32\drivers\Msfs.sys

01:46:57.0015 5340  Msfs - ok

01:46:57.0093 5340  [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys

01:46:57.0109 5340  msisadrv - ok

01:46:57.0140 5340  [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll

01:46:57.0171 5340  MSiSCSI - ok

01:46:57.0171 5340  msiserver - ok

01:46:57.0218 5340  [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys

01:46:57.0249 5340  MSKSSRV - ok

01:46:57.0281 5340  [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys

01:46:57.0296 5340  MSPCLOCK - ok

01:46:57.0312 5340  [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys

01:46:57.0343 5340  MSPQM - ok

01:46:57.0374 5340  [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys

01:46:57.0390 5340  MsRPC - ok

01:46:57.0406 5340  [ E384487CB84BE41D09711C30CA79646C ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys

01:46:57.0406 5340  mssmbios - ok

01:46:57.0437 5340  [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys

01:46:57.0453 5340  MSTEE - ok

01:46:57.0468 5340  [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup             C:\Windows\system32\Drivers\mup.sys

01:46:57.0484 5340  Mup - ok

01:46:57.0499 5340  [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent        C:\Windows\system32\qagentRT.dll

01:46:57.0531 5340  napagent - ok

01:46:57.0562 5340  [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys

01:46:57.0562 5340  NativeWifiP - ok

01:46:57.0593 5340  [ 157E98B2DD9139C7D55049FE635BD39F ] NCFilter        C:\Windows\system32\DRIVERS\NCFilter.sys

01:46:57.0609 5340  NCFilter - ok

01:46:57.0624 5340  [ DF04002FB1F6C9DCB438B9324640CCDB ] NCFSD           C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys

01:46:57.0640 5340  NCFSD - ok

01:46:57.0640 5340  [ 54ADEC9108C5A0BF9D21E4A6EF062DB1 ] NCIOCTL         C:\Program Files\Novell\Client\XTier\Drivers\ncioctl.sys

01:46:57.0656 5340  NCIOCTL - ok

01:46:57.0656 5340  [ 450B8C689B73C39816FB872404805517 ] NCRecognizer    C:\Windows\system32\DRIVERS\NCRecognizer.sys

01:46:57.0671 5340  NCRecognizer - ok

01:46:57.0687 5340  [ D28874F3CE6BADD9884C62391B39133F ] NCUncFilter     C:\Windows\system32\DRIVERS\NCUncFilter.sys

01:46:57.0687 5340  NCUncFilter - ok

01:46:57.0718 5340  [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS            C:\Windows\system32\drivers\ndis.sys

01:46:57.0734 5340  NDIS - ok

01:46:57.0765 5340  [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys

01:46:57.0781 5340  NdisTapi - ok

01:46:57.0796 5340  [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys

01:46:57.0812 5340  Ndisuio - ok

01:46:57.0828 5340  [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys

01:46:57.0843 5340  NdisWan - ok

01:46:57.0843 5340  [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys

01:46:57.0859 5340  NDProxy - ok

01:46:57.0874 5340  [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys

01:46:57.0890 5340  NetBIOS - ok

01:46:57.0921 5340  [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt           C:\Windows\system32\DRIVERS\netbt.sys

01:46:57.0953 5340  netbt - ok

01:46:57.0984 5340  [ A3E186B4B935905B829219502557314E ] Netlogon        C:\Windows\system32\lsass.exe

01:46:57.0984 5340  Netlogon - ok

01:46:57.0999 5340  [ C8052711DAECC48B982434C5116CA401 ] Netman          C:\Windows\System32\netman.dll

01:46:58.0031 5340  Netman - ok

01:46:58.0046 5340  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator c:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

01:46:58.0078 5340  NetMsmqActivator - ok

01:46:58.0078 5340  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator c:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

01:46:58.0093 5340  NetPipeActivator - ok

01:46:58.0109 5340  [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm        C:\Windows\System32\netprofm.dll

01:46:58.0140 5340  netprofm - ok

01:46:58.0171 5340  [ 9BA2F93E4F01EC58E722B36639E0CE5D ] netr28u         C:\Windows\system32\DRIVERS\netr28u.sys

01:46:58.0249 5340  netr28u - ok

01:46:58.0249 5340  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator c:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

01:46:58.0265 5340  NetTcpActivator - ok

01:46:58.0265 5340  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing c:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

01:46:58.0281 5340  NetTcpPortSharing - ok

01:46:58.0296 5340  [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960         C:\Windows\system32\drivers\nfrd960.sys

01:46:58.0296 5340  nfrd960 - ok

01:46:58.0312 5340  [ A1EF820415ED5BBE0DBB3F67866BD2E1 ] NICM            C:\Program Files\Novell\Client\XTier\Drivers\nicm.sys

01:46:58.0312 5340  NICM - ok

01:46:58.0390 5340  [ 2D2F2428012C4468B1D48939ACAF056F ] nipplpt2        C:\Windows\system32\drivers\nipplpt.sys

01:46:58.0390 5340  nipplpt2 - ok

01:46:58.0406 5340  [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc          C:\Windows\System32\nlasvc.dll

01:46:58.0437 5340  NlaSvc - ok

01:46:58.0437 5340  [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs            C:\Windows\system32\drivers\Npfs.sys

01:46:58.0468 5340  Npfs - ok

01:46:58.0499 5340  [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi             C:\Windows\system32\nsisvc.dll

01:46:58.0546 5340  nsi - ok

01:46:58.0578 5340  [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys

01:46:58.0609 5340  nsiproxy - ok

01:46:58.0656 5340  [ 2C1121F2B87E9A6B12485DF53CD848C7 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys

01:46:58.0718 5340  Ntfs - ok

01:46:58.0749 5340  [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi       C:\Windows\system32\drivers\ntrigdigi.sys

01:46:58.0781 5340  ntrigdigi - ok

01:46:58.0812 5340  [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null            C:\Windows\system32\drivers\Null.sys

01:46:58.0828 5340  Null - ok

01:46:58.0874 5340  [ 6FF4A2805E7092B8162462C03AE426E8 ] NuTCRACKERService C:\Windows\system32\nutsrv4.exe

01:46:58.0890 5340  NuTCRACKERService - ok

01:46:59.0093 5340  [ B69E6F70CE1151C8D62ABC9DEF64DFBE ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys

01:46:59.0421 5340  nvlddmkm - ok

01:46:59.0453 5340  [ 2EDF9E7751554B42CBB60116DE727101 ] nvraid          C:\Windows\system32\drivers\nvraid.sys

01:46:59.0468 5340  nvraid - ok

01:46:59.0484 5340  [ ABED0C09758D1D97DB0042DBB2688177 ] nvstor          C:\Windows\system32\drivers\nvstor.sys

01:46:59.0484 5340  nvstor - ok

01:46:59.0531 5340  [ E4284FCF99FEA13A7E1836F87AE356F6 ] nvsvc           C:\Windows\system32\nvvsvc.exe

01:46:59.0562 5340  nvsvc - ok

01:46:59.0624 5340  [ 03E60E0BFA53ED15DC984FA34B44BB0F ] nvUpdatusService C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

01:46:59.0671 5340  nvUpdatusService - ok

01:46:59.0703 5340  [ 18BBDF913916B71BD54575BDB6EEAC0B ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys

01:46:59.0718 5340  nv_agp - ok

01:46:59.0718 5340  NwlnkFlt - ok

01:46:59.0734 5340  NwlnkFwd - ok

01:46:59.0781 5340  [ BE32DA025A0BE1878F0EE8D6D9386CD5 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys

01:46:59.0828 5340  ohci1394 - ok

01:46:59.0859 5340  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc        C:\Windows\system32\p2psvc.dll

01:46:59.0921 5340  p2pimsvc - ok

01:46:59.0953 5340  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc          C:\Windows\system32\p2psvc.dll

01:46:59.0984 5340  p2psvc - ok

01:47:00.0031 5340  [ 8A79FDF04A73428597E2CAF9D0D67850 ] Parport         C:\Windows\system32\DRIVERS\parport.sys

01:47:00.0046 5340  Parport - ok

01:47:00.0062 5340  [ B9C2B89F08670E159F7181891E449CD9 ] partmgr         C:\Windows\system32\drivers\partmgr.sys

01:47:00.0078 5340  partmgr - ok

01:47:00.0093 5340  [ 6C580025C81CAF3AE9E3617C22CAD00E ] Parvdm          C:\Windows\system32\DRIVERS\parvdm.sys

01:47:00.0109 5340  Parvdm - ok

01:47:00.0140 5340  [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc          C:\Windows\System32\pcasvc.dll

01:47:00.0156 5340  PcaSvc - ok

01:47:00.0187 5340  [ 941DC1D19E7E8620F40BBC206981EFDB ] pci             C:\Windows\system32\drivers\pci.sys

01:47:00.0203 5340  pci - ok

01:47:00.0203 5340  [ FC175F5DDAB666D7F4D17449A547626F ] pciide          C:\Windows\system32\drivers\pciide.sys

01:47:00.0218 5340  pciide - ok

01:47:00.0249 5340  [ E6F3FB1B86AA519E7698AD05E58B04E5 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys

01:47:00.0265 5340  pcmcia - ok

01:47:00.0296 5340  [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys

01:47:00.0359 5340  PEAUTH - ok

01:47:00.0406 5340  [ B1689DF169143F57053F795390C99DB3 ] pla             C:\Windows\system32\pla.dll

01:47:00.0531 5340  pla - ok

01:47:00.0562 5340  [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay        C:\Windows\system32\umpnpmgr.dll

01:47:00.0609 5340  PlugPlay - ok

01:47:00.0640 5340  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg     C:\Windows\system32\p2psvc.dll

01:47:00.0656 5340  PNRPAutoReg - ok

01:47:00.0718 5340  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc         C:\Windows\system32\p2psvc.dll

01:47:00.0796 5340  PNRPsvc - ok

01:47:00.0828 5340  [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll

01:47:00.0843 5340  PolicyAgent - ok

01:47:01.0031 5340  [ F0ACCA9C2A3897CE9AC38820AD319093 ] PortmapperService C:\Program Files\PTC/PTC Portmapper/i486_nt/obj/portmap.exe

01:47:01.0031 5340  Suspicious file (Hidden): C:\Program Files\PTC/PTC Portmapper/i486_nt/obj/portmap.exe. md5: F0ACCA9C2A3897CE9AC38820AD319093

01:47:01.0031 5340  PortmapperService ( HiddenFile.Multi.Generic ) - warning

01:47:01.0031 5340  PortmapperService - detected HiddenFile.Multi.Generic (1)

01:47:01.0031 5340  [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys

01:47:01.0093 5340  PptpMiniport - ok

01:47:01.0124 5340  [ 2027293619DD0F047C584CF2E7DF4FFD ] Processor       C:\Windows\system32\drivers\processr.sys

01:47:01.0156 5340  Processor - ok

01:47:01.0171 5340  [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc         C:\Windows\system32\profsvc.dll

01:47:01.0187 5340  ProfSvc - ok

01:47:01.0203 5340  [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\Windows\system32\lsass.exe

01:47:01.0218 5340  ProtectedStorage - ok

01:47:01.0218 5340  [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched          C:\Windows\system32\DRIVERS\pacer.sys

01:47:01.0249 5340  PSched - ok

01:47:01.0281 5340  [ 0A6DB55AFB7820C99AA1F3A1D270F4F6 ] ql2300          C:\Windows\system32\drivers\ql2300.sys

01:47:01.0343 5340  ql2300 - ok

01:47:01.0374 5340  [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys

01:47:01.0390 5340  ql40xx - ok

01:47:01.0421 5340  [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE           C:\Windows\system32\qwave.dll

01:47:01.0437 5340  QWAVE - ok

01:47:01.0437 5340  [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys

01:47:01.0468 5340  QWAVEdrv - ok

01:47:01.0468 5340  [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys

01:47:01.0499 5340  RasAcd - ok

01:47:01.0515 5340  [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto         C:\Windows\System32\rasauto.dll

01:47:01.0531 5340  RasAuto - ok

01:47:01.0546 5340  [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys

01:47:01.0562 5340  Rasl2tp - ok

01:47:01.0578 5340  [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan          C:\Windows\System32\rasmans.dll

01:47:01.0609 5340  RasMan - ok

01:47:01.0624 5340  [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys

01:47:01.0640 5340  RasPppoe - ok

01:47:01.0656 5340  [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys

01:47:01.0656 5340  RasSstp - ok

01:47:01.0671 5340  [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys

01:47:01.0687 5340  rdbss - ok

01:47:01.0703 5340  [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys

01:47:01.0718 5340  RDPCDD - ok

01:47:01.0749 5340  [ FBC0BACD9C3D7F6956853F64A66E252D ] rdpdr           C:\Windows\system32\drivers\rdpdr.sys

01:47:01.0765 5340  rdpdr - ok

01:47:01.0765 5340  [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys

01:47:01.0812 5340  RDPENCDD - ok

01:47:01.0843 5340  [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys

01:47:01.0874 5340  RDPWD - ok

01:47:01.0906 5340  [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess    C:\Windows\System32\mprdim.dll

01:47:01.0937 5340  RemoteAccess - ok

01:47:01.0953 5340  [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry  C:\Windows\system32\regsvc.dll

01:47:01.0968 5340  RemoteRegistry - ok

01:47:01.0984 5340  [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator      C:\Windows\system32\locator.exe

01:47:02.0015 5340  RpcLocator - ok

01:47:02.0031 5340  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs           C:\Windows\system32\rpcss.dll

01:47:02.0062 5340  RpcSs - ok

01:47:02.0109 5340  [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys

01:47:02.0171 5340  rspndr - ok

01:47:02.0265 5340  [ 174B9514CD1A0C33CE4BBC02A3C81A62 ] RTL8169         C:\Windows\system32\DRIVERS\Rtlh86.sys

01:47:02.0406 5340  RTL8169 - ok

01:47:02.0484 5340  [ 3E322976D9414490DF552D63A0DBE288 ] RTL8192su       C:\Windows\system32\DRIVERS\RTL8192su.sys

01:47:02.0499 5340  RTL8192su - ok

01:47:02.0562 5340  [ 93E699215095CAE67E2631468A45F750 ] SaiKA50A        C:\Windows\system32\DRIVERS\SaiKA50A.sys

01:47:02.0578 5340  SaiKA50A - ok

01:47:02.0624 5340  [ F8591353036D0D7B28FFAC373DF95D22 ] SaiMini         C:\Windows\system32\DRIVERS\SaiMini.sys

01:47:02.0624 5340  SaiMini - ok

01:47:02.0640 5340  [ B6BA8F537D63FDF425C9245699AE2565 ] SaiNtBus        C:\Windows\system32\drivers\SaiBus.sys

01:47:02.0656 5340  SaiNtBus - ok

01:47:02.0687 5340  [ 3BF2B0FA7A45A7AC0141B737765BAE9D ] SaiUA50A        C:\Windows\system32\DRIVERS\SaiUA50A.sys

01:47:02.0703 5340  SaiUA50A - ok

01:47:02.0703 5340  [ A3E186B4B935905B829219502557314E ] SamSs           C:\Windows\system32\lsass.exe

01:47:02.0703 5340  SamSs - ok

01:47:02.0718 5340  [ 3CE8F073A557E172B330109436984E30 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys

01:47:02.0734 5340  sbp2port - ok

01:47:02.0765 5340  [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr        C:\Windows\System32\SCardSvr.dll

01:47:02.0781 5340  SCardSvr - ok

01:47:02.0812 5340  [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule        C:\Windows\system32\schedsvc.dll

01:47:02.0921 5340  Schedule - ok

01:47:02.0937 5340  [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc     C:\Windows\System32\certprop.dll

01:47:02.0953 5340  SCPolicySvc - ok

01:47:02.0999 5340  [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC          C:\Windows\System32\SDRSVC.dll

01:47:03.0046 5340  SDRSVC - ok

01:47:03.0078 5340  [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv          C:\Windows\system32\drivers\secdrv.sys

01:47:03.0124 5340  secdrv - ok

01:47:03.0140 5340  [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon        C:\Windows\system32\seclogon.dll

01:47:03.0156 5340  seclogon - ok

01:47:03.0171 5340  [ A9BBAB5759771E523F55563D6CBE140F ] SENS            C:\Windows\System32\sens.dll

01:47:03.0203 5340  SENS - ok

01:47:03.0234 5340  [ CE9EC966638EF0B10B864DDEDF62A099 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys

01:47:03.0249 5340  Serenum - ok

01:47:03.0265 5340  [ 6D663022DB3E7058907784AE14B69898 ] Serial          C:\Windows\system32\DRIVERS\serial.sys

01:47:03.0281 5340  Serial - ok

01:47:03.0296 5340  [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse        C:\Windows\system32\drivers\sermouse.sys

01:47:03.0312 5340  sermouse - ok

01:47:03.0343 5340  [ D2193326F729B163125610DBF3E17D57 ] SessionEnv      C:\Windows\system32\sessenv.dll

01:47:03.0374 5340  SessionEnv - ok

01:47:03.0390 5340  [ 3EFA810BDCA87F6ECC24F9832243FE86 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys

01:47:03.0406 5340  sffdisk - ok

01:47:03.0437 5340  [ E95D451F7EA3E583AEC75F3B3EE42DC5 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys

01:47:03.0468 5340  sffp_mmc - ok

01:47:03.0499 5340  [ 3D0EA348784B7AC9EA9BD9F317980979 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys

01:47:03.0562 5340  sffp_sd - ok

01:47:03.0593 5340  [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy         C:\Windows\system32\drivers\sfloppy.sys

01:47:03.0640 5340  sfloppy - ok

01:47:03.0671 5340  [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess    C:\Windows\System32\ipnathlp.dll

01:47:03.0687 5340  SharedAccess - ok

01:47:03.0703 5340  [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\Windows\System32\shsvcs.dll

01:47:03.0734 5340  ShellHWDetection - ok

01:47:03.0749 5340  [ 1D76624A09A054F682D746B924E2DBC3 ] sisagp          C:\Windows\system32\drivers\sisagp.sys

01:47:03.0765 5340  sisagp - ok

01:47:03.0781 5340  [ 43CB7AA756C7DB280D01DA9B676CFDE2 ] SiSRaid2        C:\Windows\system32\drivers\sisraid2.sys

01:47:03.0796 5340  SiSRaid2 - ok

01:47:03.0812 5340  [ A99C6C8B0BAA970D8AA59DDC50B57F94 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys

01:47:03.0812 5340  SiSRaid4 - ok

01:47:03.0890 5340  [ 7C15061CD0372487903B07B9BB03AFAD ] SkypeUpdate     C:\Program Files\Skype\Updater\Updater.exe

01:47:03.0890 5340  SkypeUpdate - ok

01:47:03.0968 5340  [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc           C:\Windows\system32\SLsvc.exe

01:47:04.0218 5340  slsvc - ok

01:47:04.0265 5340  [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify      C:\Windows\system32\SLUINotify.dll

01:47:04.0312 5340  SLUINotify - ok

01:47:04.0343 5340  [ 7B75299A4D201D6A6533603D6914AB04 ] Smb             C:\Windows\system32\DRIVERS\smb.sys

01:47:04.0374 5340  Smb - ok

01:47:04.0390 5340  [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe

01:47:04.0406 5340  SNMPTRAP - ok

01:47:04.0437 5340  [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr           C:\Windows\system32\drivers\spldr.sys

01:47:04.0437 5340  spldr - ok

01:47:04.0468 5340  [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler         C:\Windows\System32\spoolsv.exe

01:47:04.0499 5340  Spooler - ok

01:47:04.0531 5340  [ 41987F9FC0E61ADF54F581E15029AD91 ] srv             C:\Windows\system32\DRIVERS\srv.sys

01:47:04.0546 5340  srv - ok

01:47:04.0578 5340  [ FF33AFF99564B1AA534F58868CBE41EF ] srv2            C:\Windows\system32\DRIVERS\srv2.sys

01:47:04.0578 5340  srv2 - ok

01:47:04.0609 5340  [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys

01:47:04.0640 5340  srvnet - ok

01:47:04.0671 5340  [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll

01:47:04.0703 5340  SSDPSRV - ok

01:47:04.0718 5340  [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv          C:\Windows\system32\DRIVERS\ssmdrv.sys

01:47:04.0734 5340  ssmdrv - ok

01:47:04.0749 5340  [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc         C:\Windows\system32\sstpsvc.dll

01:47:04.0796 5340  SstpSvc - ok

01:47:04.0843 5340  Steam Client Service - ok

01:47:04.0906 5340  [ E4EBF293D1F612BDA19B646C36715B20 ] STEC3           C:\Windows\system32\STEC3.sys

01:47:04.0921 5340  STEC3 ( UnsignedFile.Multi.Generic ) - warning

01:47:04.0921 5340  STEC3 - detected UnsignedFile.Multi.Generic (1)

01:47:04.0999 5340  [ 5A19667A580B1CE886EAF968B9743F45 ] Stereo Service  C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

01:47:05.0046 5340  Stereo Service - ok

01:47:05.0140 5340  [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc          C:\Windows\System32\wiaservc.dll

01:47:05.0171 5340  stisvc - ok

01:47:05.0187 5340  [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys

01:47:05.0203 5340  swenum - ok

01:47:05.0218 5340  [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv           C:\Windows\System32\swprv.dll

01:47:05.0249 5340  swprv - ok

01:47:05.0265 5340  [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx         C:\Windows\system32\drivers\symc8xx.sys

01:47:05.0281 5340  Symc8xx - ok

01:47:05.0296 5340  [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi          C:\Windows\system32\drivers\sym_hi.sys

01:47:05.0296 5340  Sym_hi - ok

01:47:05.0312 5340  [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3          C:\Windows\system32\drivers\sym_u3.sys

01:47:05.0328 5340  Sym_u3 - ok

01:47:05.0359 5340  [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain         C:\Windows\system32\sysmain.dll

01:47:05.0390 5340  SysMain - ok

01:47:05.0421 5340  [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll

01:47:05.0437 5340  TabletInputService - ok

01:47:05.0453 5340  [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv         C:\Windows\System32\tapisrv.dll

01:47:05.0484 5340  TapiSrv - ok

01:47:05.0515 5340  [ CB05822CD9CC6C688168E113C603DBE7 ] TBS             C:\Windows\System32\tbssvc.dll

01:47:05.0531 5340  TBS - ok

01:47:05.0562 5340  [ 74E2D020C47BB2B2FCCBA29A518A7EB4 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys

01:47:05.0593 5340  Tcpip - ok

01:47:05.0640 5340  [ 74E2D020C47BB2B2FCCBA29A518A7EB4 ] Tcpip6          C:\Windows\system32\DRIVERS\tcpip.sys

01:47:05.0671 5340  Tcpip6 - ok

01:47:05.0718 5340  [ 608C345A255D82A6289C2D468EB41FD7 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys

01:47:05.0734 5340  tcpipreg - ok

01:47:05.0765 5340  [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys

01:47:05.0796 5340  TDPIPE - ok

01:47:05.0796 5340  [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys

01:47:05.0812 5340  TDTCP - ok

01:47:05.0843 5340  [ 76B06EB8A01FC8624D699E7045303E54 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys

01:47:05.0859 5340  tdx - ok

01:47:05.0874 5340  [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys

01:47:05.0874 5340  TermDD - ok

01:47:05.0890 5340  [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService     C:\Windows\System32\termsrv.dll

01:47:05.0968 5340  TermService - ok

01:47:06.0031 5340  [ C7230FBEE14437716701C15BE02C27B8 ] Themes          C:\Windows\system32\shsvcs.dll

01:47:06.0031 5340  Themes - ok

01:47:06.0046 5340  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER     C:\Windows\system32\mmcss.dll

01:47:06.0062 5340  THREADORDER - ok

01:47:06.0078 5340  [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks          C:\Windows\System32\trkwks.dll

01:47:06.0093 5340  TrkWks - ok

01:47:06.0140 5340  [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe

01:47:06.0156 5340  TrustedInstaller - ok

01:47:06.0171 5340  [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys

01:47:06.0203 5340  tssecsrv - ok

01:47:06.0265 5340  [ FC740E4FF236B72CA59B8F762D30C7F3 ] TuneUp.UtilitiesSvc C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exe

01:47:06.0374 5340  TuneUp.UtilitiesSvc - ok

01:47:06.0453 5340  [ 94C4CD2D19B8C4137A46261F229FEC24 ] TuneUpUtilitiesDrv C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesDriver32.sys

01:47:06.0453 5340  TuneUpUtilitiesDrv - ok

01:47:06.0546 5340  [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp           C:\Windows\system32\DRIVERS\tunmp.sys

01:47:06.0562 5340  tunmp - ok

01:47:06.0593 5340  [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys

01:47:06.0593 5340  tunnel - ok

01:47:06.0624 5340  [ 7D33C4DB2CE363C8518D2DFCF533941F ] uagp35          C:\Windows\system32\drivers\uagp35.sys

01:47:06.0640 5340  uagp35 - ok

01:47:06.0671 5340  [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys

01:47:06.0687 5340  udfs - ok

01:47:06.0687 5340  [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect       C:\Windows\system32\UI0Detect.exe

01:47:06.0718 5340  UI0Detect - ok

01:47:06.0734 5340  [ B0ACFDC9E4AF279E9116C03E014B2B27 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys

01:47:06.0749 5340  uliagpkx - ok

01:47:06.0765 5340  [ 9224BB254F591DE4CA8D572A5F0D635C ] uliahci         C:\Windows\system32\drivers\uliahci.sys

01:47:06.0781 5340  uliahci - ok

01:47:06.0796 5340  [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata          C:\Windows\system32\drivers\ulsata.sys

01:47:06.0812 5340  UlSata - ok

01:47:06.0828 5340  [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2         C:\Windows\system32\drivers\ulsata2.sys

01:47:06.0843 5340  ulsata2 - ok

01:47:06.0859 5340  [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus           C:\Windows\system32\DRIVERS\umbus.sys

01:47:06.0890 5340  umbus - ok

01:47:06.0906 5340  [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost        C:\Windows\System32\upnphost.dll

01:47:06.0937 5340  upnphost - ok

01:47:06.0953 5340  [ 32DB9517628FF0D070682AAB61E688F0 ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys

01:47:06.0984 5340  usbaudio - ok

01:47:07.0015 5340  [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys

01:47:07.0046 5340  usbccgp - ok

01:47:07.0062 5340  [ E9476E6C486E76BC4898074768FB7131 ] usbcir          C:\Windows\system32\drivers\usbcir.sys

01:47:07.0093 5340  usbcir - ok

01:47:07.0124 5340  [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys

01:47:07.0140 5340  usbehci - ok

01:47:07.0156 5340  [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys

01:47:07.0203 5340  usbhub - ok

01:47:07.0218 5340  [ 38DBC7DD6CC5A72011F187425384388B ] usbohci         C:\Windows\system32\drivers\usbohci.sys

01:47:07.0249 5340  usbohci - ok

01:47:07.0281 5340  [ E75C4B5269091D15A2E7DC0B6D35F2F5 ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys

01:47:07.0296 5340  usbprint - ok

01:47:07.0312 5340  [ A508C9BD8724980512136B039BBA65E9 ] usbscan         C:\Windows\system32\DRIVERS\usbscan.sys

01:47:07.0343 5340  usbscan - ok

01:47:07.0374 5340  [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS

01:47:07.0390 5340  USBSTOR - ok

01:47:07.0406 5340  [ 814D653EFC4D48BE3B04A307ECEFF56F ] usbuhci         C:\Windows\system32\DRIVERS\usbuhci.sys

01:47:07.0437 5340  usbuhci - ok

01:47:07.0453 5340  [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms           C:\Windows\System32\uxsms.dll

01:47:07.0515 5340  UxSms - ok

01:47:07.0562 5340  [ 57324E62405EC114C6C1A6F1C9704E8F ] UxTuneUp        C:\Windows\System32\uxtuneup.dll

01:47:07.0562 5340  UxTuneUp - ok

01:47:07.0609 5340  [ CD88D1B7776DC17A119049742EC07EB4 ] vds             C:\Windows\System32\vds.exe

01:47:07.0703 5340  vds - ok

01:47:07.0749 5340  [ 87B06E1F30B749A114F74622D013F8D4 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys

01:47:07.0765 5340  vga - ok

01:47:07.0796 5340  [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave         C:\Windows\System32\drivers\vga.sys

01:47:07.0812 5340  VgaSave - ok

01:47:07.0843 5340  [ 5D7159DEF58A800D5781BA3A879627BC ] viaagp          C:\Windows\system32\drivers\viaagp.sys

01:47:07.0859 5340  viaagp - ok

01:47:07.0874 5340  [ C4F3A691B5BAD343E6249BD8C2D45DEE ] ViaC7           C:\Windows\system32\drivers\viac7.sys

01:47:07.0890 5340  ViaC7 - ok

01:47:07.0906 5340  [ AADF5587A4063F52C2C3FED7887426FC ] viaide          C:\Windows\system32\drivers\viaide.sys

01:47:07.0906 5340  viaide - ok

01:47:07.0921 5340  [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr          C:\Windows\system32\drivers\volmgr.sys

01:47:07.0921 5340  volmgr - ok

01:47:07.0968 5340  [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys

01:47:07.0968 5340  volmgrx - ok

01:47:08.0031 5340  [ 786DB5771F05EF300390399F626BF30A ] volsnap         C:\Windows\system32\drivers\volsnap.sys

01:47:08.0046 5340  volsnap - ok

01:47:08.0109 5340  [ 8CA9793CBEE993660FF7FC2769A4E252 ] vpnagent        C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe

01:47:08.0124 5340  vpnagent - ok

01:47:08.0171 5340  [ FDDAFA1C89B0B07494AF5879F7ECE857 ] vpnva           C:\Windows\system32\DRIVERS\vpnva.sys

01:47:08.0171 5340  vpnva - ok

01:47:08.0187 5340  [ 587253E09325E6BF226B299774B728A9 ] vsmraid         C:\Windows\system32\drivers\vsmraid.sys

01:47:08.0203 5340  vsmraid - ok

01:47:08.0234 5340  [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS             C:\Windows\system32\vssvc.exe

01:47:08.0281 5340  VSS - ok

01:47:08.0296 5340  [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time         C:\Windows\system32\w32time.dll

01:47:08.0328 5340  W32Time - ok

01:47:08.0359 5340  [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys

01:47:08.0406 5340  WacomPen - ok

01:47:08.0406 5340  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp          C:\Windows\system32\DRIVERS\wanarp.sys

01:47:08.0421 5340  Wanarp - ok

01:47:08.0421 5340  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys

01:47:08.0437 5340  Wanarpv6 - ok

01:47:08.0468 5340  [ A3CD60FD826381B49F03832590E069AF ] wcncsvc         C:\Windows\System32\wcncsvc.dll

01:47:08.0515 5340  wcncsvc - ok

01:47:08.0531 5340  [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll

01:47:08.0562 5340  WcsPlugInService - ok

01:47:08.0578 5340  [ 78FE9542363F297B18C027B2D7E7C07F ] Wd              C:\Windows\system32\drivers\wd.sys

01:47:08.0593 5340  Wd - ok

01:47:08.0640 5340  [ A840213F1ACDCC175B4D1D5AAEAC0D7A ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys

01:47:08.0671 5340  Wdf01000 - ok

01:47:08.0687 5340  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost  C:\Windows\system32\wdi.dll

01:47:08.0718 5340  WdiServiceHost - ok

01:47:08.0718 5340  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost   C:\Windows\system32\wdi.dll

01:47:08.0734 5340  WdiSystemHost - ok

01:47:08.0765 5340  [ 04C37D8107320312FBAE09926103D5E2 ] WebClient       C:\Windows\System32\webclnt.dll

01:47:08.0781 5340  WebClient - ok

01:47:08.0812 5340  [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc          C:\Windows\system32\wecsvc.dll

01:47:08.0843 5340  Wecsvc - ok

01:47:08.0874 5340  [ 670FF720071ED741206D69BD995EA453 ] wercplsupport   C:\Windows\System32\wercplsupport.dll

01:47:08.0890 5340  wercplsupport - ok

01:47:08.0921 5340  [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc          C:\Windows\System32\WerSvc.dll

01:47:08.0937 5340  WerSvc - ok

01:47:08.0968 5340  [ 4575AA12561C5648483403541D0D7F2B ] WinDefend       C:\Program Files\Windows Defender\mpsvc.dll

01:47:08.0984 5340  WinDefend - ok

01:47:08.0984 5340  WinHttpAutoProxySvc - ok

01:47:09.0015 5340  Winmgmt - ok

01:47:09.0046 5340  [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM           C:\Windows\system32\WsmSvc.dll

01:47:09.0093 5340  WinRM - ok

01:47:09.0124 5340  [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc         C:\Windows\System32\wlansvc.dll

01:47:09.0171 5340  Wlansvc - ok

01:47:09.0281 5340  [ 5144AE67D60EC653F97DDF3FEED29E77 ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

01:47:09.0453 5340  wlidsvc - ok

01:47:09.0468 5340  [ 2E7255D172DF0B8283CDFB7B433B864E ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys

01:47:09.0515 5340  WmiAcpi - ok

01:47:09.0593 5340  [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe

01:47:09.0640 5340  wmiApSrv - ok

01:47:09.0671 5340  [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc   C:\Program Files\Windows Media Player\wmpnetwk.exe

01:47:09.0765 5340  WMPNetworkSvc - ok

01:47:09.0843 5340  [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc          C:\Windows\System32\wpcsvc.dll

01:47:09.0968 5340  WPCSvc - ok

01:47:09.0999 5340  [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll

01:47:10.0031 5340  WPDBusEnum - ok

01:47:10.0078 5340  [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

01:47:10.0140 5340  WPFFontCache_v0400 - ok

01:47:10.0171 5340  [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys

01:47:10.0234 5340  ws2ifsl - ok

01:47:10.0234 5340  [ 1CA6C40261DDC0425987980D0CD2AAAB ] wscsvc          C:\Windows\System32\wscsvc.dll

01:47:10.0265 5340  wscsvc - ok

01:47:10.0265 5340  WSearch - ok

01:47:10.0312 5340  [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv        C:\Windows\system32\wuaueng.dll

01:47:10.0406 5340  wuauserv - ok

01:47:10.0437 5340  [ 06E6F32C8D0A3F66D956F57B43A2E070 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys

01:47:10.0499 5340  WudfPf - ok

01:47:10.0515 5340  [ 867C301E8B790040AE9CF6486E8041DF ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys

01:47:10.0531 5340  WUDFRd - ok

01:47:10.0562 5340  [ FE47B7BC8EA320C2D9B5E5BF6E303765 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll

01:47:10.0578 5340  wudfsvc - ok

01:47:10.0593 5340  [ 3D130383A56DB5DE539AA6BB269E1A6C ] XTSvcMgr        C:\Program Files\Novell\Client\XTier\Services\XTSvcMgr.exe

01:47:10.0609 5340  XTSvcMgr - ok

01:47:10.0624 5340  ================ Scan global ===============================

01:47:10.0640 5340  [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll

01:47:10.0687 5340  [ A508314231C49AEE86987CEA3EAECAD1 ] C:\Windows\system32\winsrv.dll

01:47:10.0703 5340  [ A508314231C49AEE86987CEA3EAECAD1 ] C:\Windows\system32\winsrv.dll

01:47:10.0718 5340  [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\system32\services.exe

01:47:10.0734 5340  [Global] - ok

01:47:10.0734 5340  ================ Scan MBR ==================================

01:47:10.0734 5340  [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk0\DR0

01:47:11.0109 5340  \Device\Harddisk0\DR0 - ok

01:47:11.0109 5340  ================ Scan VBR ==================================

01:47:11.0124 5340  [ B6DFDB9B4F02D57757EC3ABAFB56DC56 ] \Device\Harddisk0\DR0\Partition1

01:47:11.0124 5340  \Device\Harddisk0\DR0\Partition1 - ok

01:47:11.0124 5340  ============================================================

01:47:11.0124 5340  Scan finished

01:47:11.0124 5340  ============================================================

01:47:11.0124 4960  Detected object count: 5

01:47:11.0124 4960  Actual detected object count: 5

01:47:37.0359 4960  BrowserProtect ( LockedFile.Multi.Generic ) - skipped by user

01:47:37.0359 4960  BrowserProtect ( LockedFile.Multi.Generic ) - User select action: Skip 

01:47:37.0359 4960  HiPatchService ( UnsignedFile.Multi.Generic ) - skipped by user

01:47:37.0359 4960  HiPatchService ( UnsignedFile.Multi.Generic ) - User select action: Skip 

01:47:37.0359 4960  iprntsrv ( UnsignedFile.Multi.Generic ) - skipped by user

01:47:37.0359 4960  iprntsrv ( UnsignedFile.Multi.Generic ) - User select action: Skip 

01:47:37.0359 4960  PortmapperService ( HiddenFile.Multi.Generic ) - skipped by user

01:47:37.0359 4960  PortmapperService ( HiddenFile.Multi.Generic ) - User select action: Skip 

01:47:37.0374 4960  STEC3 ( UnsignedFile.Multi.Generic ) - skipped by user

01:47:37.0374 4960  STEC3 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

01:47:49.0421 5764  Deinitialize success

hier nochmal den TDSSKiller Log als zip-Anhang

sieht bis jetzt ganz gut aus ,der Trojaner wird nicht mehr gestartet und alles andere funktioniert wieder

Hi,
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hier der Log von Combofix:

Code:

ComboFix 13-05-16.02 - Sabine 17.05.2013  14:26:39.1.2 - x86

Running from: c:\users\Sabine\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\DealPly

c:\program files\DealPly\DealPly.crx

c:\program files\DealPly\DealPlyTune.dll

c:\program files\DealPly\DealPlyUpdate.exe

c:\program files\DealPly\DealPlyUpdate.log

c:\program files\DealPly\DealPlyUpdateRun.exe

c:\program files\DealPly\icon.ico

c:\program files\DealPly\uninst.exe

c:\program files\Incredibar.com

c:\program files\Incredibar.com\incredibar\1.5.11.14\bh\inCRedibar.dll

c:\program files\Incredibar.com\incredibar\1.5.11.14\incredibarApp.dll

c:\program files\Incredibar.com\incredibar\1.5.11.14\incredibarEng.dll

c:\program files\Incredibar.com\incredibar\1.5.11.14\incredibarsrv.exe

c:\program files\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll

c:\program files\Incredibar.com\incredibar\1.5.11.14\uninstall.exe

c:\program files\smartdl

c:\program files\smartdl\cc

c:\program files\smartdl\gunzip.exe

c:\program files\smartdl\installid

c:\program files\smartdl\status-o

c:\program files\smartdl\status

c:\program files\smartdl\TorrentSearch.exe

c:\program files\TSearch

c:\program files\TSearch\client.py

c:\program files\TSearch\easydownload.exe

c:\program files\TSearch\header.bmp

c:\program files\TSearch\libtorrent.pyd

c:\program files\TSearch\python25.dll

c:\program files\TSearch\results

c:\programdata\dsgsdgdsgdsgw.pad

c:\users\Sabine\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe

c:\users\Sabine\AppData\Roaming\ie_util.exe

c:\users\Sabine\AppData\Roaming\Uriwik

c:\users\Sabine\AppData\Roaming\Uriwik\anup.exe

.

.

(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_STEC3

-------\Service_STEC3

.

.

(((((((((((((((((((((((((   Files Created from 2013-04-17 to 2013-05-17  )))))))))))))))))))))))))))))))

.

.

2013-05-17 12:38 . 2013-05-17 12:42        --------        d-----w-        c:\users\Sabine\AppData\Local\temp

2013-05-17 12:38 . 2013-05-17 12:38        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp

2013-05-17 12:38 . 2013-05-17 12:38        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-05-16 19:09 . 2013-05-16 19:09        --------        d-----w-        C:\TDSSKiller Log

2013-05-16 18:48 . 2013-05-13 06:19        7016152        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{16E03CF5-5251-4223-AB02-D7C3EA81F93E}\mpengine.dll

2013-05-16 15:18 . 2013-05-05 19:12        2382848        ----a-w-        c:\windows\system32\mshtml.tlb

2013-05-16 00:12 . 2013-04-15 14:20        638328        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys

2013-05-16 00:12 . 2013-04-13 10:56        37376        ----a-w-        c:\windows\system32\cdd.dll

2013-05-16 00:12 . 2013-04-09 01:36        2049024        ----a-w-        c:\windows\system32\win32k.sys

2013-05-16 00:07 . 2013-05-16 21:34        --------        d-----w-        c:\users\Sabine\AppData\Roaming\Tayv

2013-05-16 00:07 . 2013-05-16 00:07        --------        d-----w-        c:\users\Sabine\AppData\Roaming\Wuqao

2013-05-15 23:04 . 2013-05-15 23:34        --------        d-----w-        C:\_OTL

2013-05-15 12:11 . 2013-05-15 12:11        --------        d-----w-        c:\users\FH

2013-05-12 12:11 . 2013-05-12 12:11        --------        d-----w-        c:\users\Sabine\AppData\Local\Program Files

2013-05-05 21:32 . 2013-05-05 21:32        --------        d-----w-        c:\users\Sabine\AppData\Local\Game Dev Tycoon

2013-05-05 16:54 . 2013-05-05 16:56        --------        d-----w-        c:\users\Sabine\AppData\Roaming\mysearchdial

2013-05-05 16:54 . 2013-05-05 16:56        --------        d-----w-        c:\program files\Mysearchdial

2013-05-04 16:13 . 2013-05-04 16:13        --------        d-----w-        c:\users\Public\Games

2013-05-03 09:51 . 2013-05-03 17:05        --------        d-----w-        c:\program files\Common Files\PTC

2013-05-03 09:45 . 2013-05-03 09:48        --------        d-----w-        c:\users\Sabine\AppData\Local\PTC

2013-05-03 07:37 . 2013-05-03 17:07        --------        d-----w-        c:\program files\PTC

2013-05-03 07:22 . 2013-05-03 07:38        --------        d-----w-        c:\programdata\PTC

2013-05-03 07:15 . 2013-05-03 07:15        --------        d-----w-        c:\progra~2\02517~1

2013-05-02 12:25 . 2013-05-02 12:25        --------        d-----w-        c:\progra~2\04113~1

2013-05-01 19:01 . 2013-05-01 19:01        --------        d-----w-        c:\program files\mixiedj

2013-05-01 19:01 . 2013-05-01 19:01        --------        d-----w-        c:\program files\mixidj

2013-05-01 18:35 . 2013-05-01 19:01        --------        d-----w-        c:\users\Sabine\AppData\Roaming\Download Manager

2013-04-30 06:40 . 2013-04-30 06:40        --------        d-----w-        c:\progra~2\0A41F~1

2013-04-28 10:25 . 2013-04-28 10:25        --------        d-----w-        c:\program files\DomaIQ Uninstaller

2013-04-28 10:24 . 2013-04-28 10:24        --------        d-----w-        c:\users\Sabine\AppData\Roaming\player

2013-04-28 10:24 . 2013-04-28 10:24        --------        d-----w-        c:\program files\Tuguu SL

2013-04-28 10:23 . 2013-04-28 10:23        --------        d-----w-        c:\users\Sabine\AppData\Roaming\Driver Pro

2013-04-28 10:23 . 2013-04-28 10:23        --------        d-----w-        c:\program files\Driver Pro

2013-04-28 09:33 . 2013-04-28 09:33        --------        d-----w-0        c:\progra~2\WW0~1

2013-04-27 09:49 . 2013-04-27 09:49        --------        d-----w-        c:\progra~2\0321F~1

2013-04-25 10:04 . 2013-04-25 10:04        --------        d-----w-        c:\progra~2\0241B~1

2013-04-24 14:30 . 2013-04-24 14:30        --------        d-----w-        c:\progra~2\08517~1

2013-04-22 15:24 . 2013-04-22 15:24        --------        d-----w-        c:\progra~2\0DF0B~1

2013-04-22 06:05 . 2013-04-22 06:05        --------        d-----w-        c:\progra~2\0811B~1

2013-04-21 07:57 . 2013-04-21 07:57        --------        d-----w-        c:\progra~2\0601B~1

2013-04-20 16:38 . 2013-04-20 16:38        --------        d-----w-        c:\progra~2\UU0~2

2013-04-19 11:09 . 2013-04-19 11:09        --------        d-----w-        c:\program files\Common Files\Skype

2013-04-18 15:04 . 2013-04-18 15:04        --------        d-----w-0        c:\progra~2\220B~1.0

.

.

.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-05-16 19:10 . 2013-05-16 19:10        23832        ----a-w-        C:\TDSSKiller Log.zip

2013-05-15 23:35 . 2012-08-11 14:39        71048        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2013-05-15 23:35 . 2012-08-11 14:39        692104        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2013-05-02 00:06 . 2012-08-10 14:45        238872        ------w-        c:\windows\system32\MpSigStub.exe

2013-03-15 15:21 . 2013-03-15 15:21        94112        ----a-w-        c:\windows\system32\WindowsAccessBridge.dll

2013-03-15 15:21 . 2012-08-12 21:06        861088        ----a-w-        c:\windows\system32\npDeployJava1.dll

2013-03-15 15:21 . 2012-08-12 21:06        782240        ----a-w-        c:\windows\system32\deployJava1.dll

2013-03-11 13:25 . 2013-04-10 14:52        3603816        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2013-03-11 13:25 . 2013-04-10 14:52        3551080        ----a-w-        c:\windows\system32\ntoskrnl.exe

2013-03-09 03:45 . 2013-04-10 14:52        49152        ----a-w-        c:\windows\system32\csrsrv.dll

2013-03-09 01:28 . 2013-04-10 14:52        64000        ----a-w-        c:\windows\system32\smss.exe

2013-03-08 03:53 . 2013-04-10 14:52        376320        ----a-w-        c:\windows\system32\winsrv.dll

2013-03-08 03:52 . 2013-04-10 14:52        2067968        ----a-w-        c:\windows\system32\mstscax.dll

2013-03-03 19:07 . 2013-04-10 14:52        1082232        ----a-w-        c:\windows\system32\drivers\ntfs.sys

2013-02-25 22:22 . 2013-02-25 22:22        1985824        ----a-w-        c:\windows\system32\nvcuvenc.dll

2013-02-25 22:22 . 2012-02-09 20:43        1017120        ----a-w-        c:\windows\system32\nvdispco32.dll

2013-02-25 22:22 . 2013-02-25 22:22        6262608        ----a-w-        c:\windows\system32\nvopencl.dll

2013-02-25 22:22 . 2012-08-25 09:37        892704        ----a-w-        c:\windows\system32\nvdispgenco32.dll

2013-02-25 22:22 . 2012-08-13 13:34        12641992        ----a-w-        c:\windows\system32\nvwgf2um.dll

2013-02-25 22:22 . 2012-08-13 13:34        2505144        ----a-w-        c:\windows\system32\nvapi.dll

2013-02-25 22:22 . 2012-02-09 20:43        15129960        ----a-w-        c:\windows\system32\nvd3dum.dll

2013-02-25 22:22 . 2013-02-25 22:22        7932256        ----a-w-        c:\windows\system32\nvcuda.dll

2013-02-25 22:22 . 2013-02-25 22:22        17560352        ----a-w-        c:\windows\system32\nvcompiler.dll

2013-02-25 22:22 . 2013-02-25 22:22        20449056        ----a-w-        c:\windows\system32\nvoglv32.dll

2013-02-25 22:22 . 2013-02-25 22:22        8939296        ----a-w-        c:\windows\system32\drivers\nvlddmkm.sys

2013-02-25 22:22 . 2013-02-25 22:22        2720544        ----a-w-        c:\windows\system32\nvcuvid.dll

.

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2013-02-08 1520776]

"{cd90bf73-20f6-44ef-993d-bb920303bd2e}"= "c:\program files\Veoh_Web_Player\prxtbVeoh.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

.

[HKEY_CLASSES_ROOT\clsid\{cd90bf73-20f6-44ef-993d-bb920303bd2e}]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{cd90bf73-20f6-44ef-993d-bb920303bd2e}]

2011-05-09 09:49        176936        ----a-w-        c:\program files\Veoh_Web_Player\prxtbVeoh.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{cd90bf73-20f6-44ef-993d-bb920303bd2e}"= "c:\program files\Veoh_Web_Player\prxtbVeoh.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{cd90bf73-20f6-44ef-993d-bb920303bd2e}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CD90BF73-20F6-44EF-993D-BB920303BD2E}"= "c:\program files\Veoh_Web_Player\prxtbVeoh.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{cd90bf73-20f6-44ef-993d-bb920303bd2e}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Steam"="c:\program files\Steam\Steam.exe" [2013-05-03 1635752]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"SpeedUpMyPC"="c:\program files\Uniblue\SpeedUpMyPC\launcher.exe" [2012-04-16 67960]

"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2012-06-11 4692840]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-02-28 18642024]

"Driver Pro"="c:\program files\Driver Pro\DPLauncher.exe" [2012-10-30 340512]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-07-18 348664]

"EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2008-12-04 665424]

"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2012-05-29 115032]

"NWTRAY"="NWTRAY.EXE" [2011-11-27 34904]

"iPrint Tray"="c:\windows\system32\iprntctl.exe" [2012-04-25 68184]

"iPrint Event Monitor"="c:\windows\system32\iprntlgn.exe" [2012-04-25 72280]

"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2013-02-08 1644680]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-12-19 41208]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-12-10 2254768]

"Cisco AnyConnect Secure Mobility Agent for Windows"="c:\program files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" [2012-09-26 522232]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

"NuTCSetupEnviron"="c:\progra~1\PTC\MKSTOO~1\bin\ncoeenv.exe" [2009-11-23 37160]

.

c:\users\Sabine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

msconfig.lnk - c:\windows\System32\rundll32.exe [2006-11-2 44544]

OpenOffice.org 3.4.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

LOLRecorder.lnk - c:\program files\LOLReplay\LOLRecorder.exe [2013-2-14 523264]

McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-5 272248]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Notification Packages        REG_MULTI_SZ           scecli iPrntWinCredMan

Authentication Packages        REG_MULTI_SZ           msv1_0 ncv1_0

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"

.

R3 acsint;acsint;c:\windows\system32\DRIVERS\acsint.sys [x]

R3 acsmux;acsmux;c:\windows\system32\DRIVERS\acsmux.sys [x]

.

.

--- Other Services/Drivers In Memory ---

.

*Deregistered* - nciom

*Deregistered* - ncp

*Deregistered* - ncpl

*Deregistered* - ndm

*Deregistered* - ndmndap

*Deregistered* - niam

*Deregistered* - nipctl

*Deregistered* - nscm

*Deregistered* - nsns

*Deregistered* - nsvccost

*Deregistered* - xtxplat

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-04-10 21:29        1642448        ----a-w-        c:\program files\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-05-17 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-11 23:35]

.

2013-05-17 c:\windows\Tasks\FinalTorrent Update Checker.job

- c:\program files\FinalTorrent\FTCheckForUpdates.exe [2012-08-11 12:24]

.

2013-05-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-11-07 13:12]

.

2013-05-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-11-07 13:12]

.

2013-05-17 c:\windows\Tasks\OptimizerProUpdaterTask{2CE03A48-B8B3-4E05-A2FF-7C30D795730E}.job

- c:\programdata\Premium\OptimizerPro\OptimizerPro.exe [2012-12-24 14:50]

.

2013-05-17 c:\windows\Tasks\SpeedUpMyPC.job

- c:\program files\Uniblue\SpeedUpMyPC\spmonitor.exe [2012-09-04 12:27]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://start.mysearchdial.com/?f=1&a=tugumsd&cd=2XzuyEtN2Y1L1Qzu0B0CyD0F0FyEtD0D0A0FyD0E0AtDzzyDtN0D0Tzu0CyEzytCtN1L2XzutBtFtBtFtCtFyCtCzztN1L1Czu2Z2Y1N2Y1H1B1Q&cr=1207875316&ir=

mStart Page = hxxp://start.mysearchdial.com/?f=1&a=tugumsd&cd=2XzuyEtN2Y1L1Qzu0B0CyD0F0FyEtD0D0A0FyD0E0AtDzzyDtN0D0Tzu0CyEzytCtN1L2XzutBtFtBtFtCtFyCtCzztN1L1Czu2Z2Y1N2Y1H1B1Q&cr=1207875316&ir=

uSearchAssistant = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=33360bb7-7237-4abc-a443-f4f7cfe757f5&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms}

IE: Translate this web page with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm

IE: Translate with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm

LSP: %SystemRoot%\system32\nutafun4.dll

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: DhcpNameServer = 192.168.178.1

.

- - - - ORPHANS REMOVED - - - -

.

HKCU-Run-Optimizer Pro - c:\program files\Optimizer Pro\OptProLauncher.exe

HKCU-Run-GameCenter - c:\program files\Joyvy\GameCenter.exe

HKCU-Run-Oqsaixvivy - c:\users\Sabine\AppData\Roaming\Epmo\tiyv.exe

HKCU-Run-IExplorer Util - c:\users\Sabine\AppData\Roaming\ie_util.exe

HKCU-Run-AmazonMP3DownloaderHelper - c:\users\Sabine\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe

HKCU-Run-Kaseums - c:\users\Sabine\AppData\Roaming\Uriwik\anup.exe

SafeBoot-WudfPf

SafeBoot-WudfRd

AddRemove-incredibar - c:\program files\Incredibar.com\incredibar\1.5.11.14\uninstall.exe

AddRemove-Katawa Shoujo - c:\program files\Katawa Shoujo\Uninstall Katawa Shoujo.exe

AddRemove-Optimizer Pro_is1 - c:\program files\Optimizer Pro\unins000.exe

AddRemove-Amazon MP3-Downloader - c:\users\Sabine\AppData\Local\Program Files\Amazon\MP3 Downloader\Uninstall.exe

AddRemove-GoforFiles - c:\program files\GoforFiles\uninstall.exe

AddRemove-YourFileDownloader - c:\program files\YourFileDownloader\uninstall.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2013-05-17 14:42

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...  

.

scanning hidden autostart entries ... 

.

scanning hidden files ...  

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PortmapperService]

"ImagePath"="c:\program files\PTC/PTC Portmapper/i486_nt/obj/portmap.exe"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-338440498-2888063792-2753391560-1000\Software\relic UGP Applications\age\ﾞ0ﾖ0・・1*1*\Installation]

"strAbsolutePath"="c:\\age\\マブラヴ11\\"

"strObjectOcean"="c:\\age\\マブラヴ11\\マブラヴ11.rio"

"strIciPath"="c:\\age\\マブラヴ11\\マブラヴ11.rio.ici\00cations"

"strTTFileName"="マブラヴ11.rbt"

"strInstallSourcePath"="i:\\"

"bInstalled"=dword:00000001

"strInstallTypeSelect"="1"

"strInstallSystemType"=""

.

[HKEY_USERS\S-1-5-21-338440498-2888063792-2753391560-1000\Software\relic UGP Applications\age\ﾞ0ﾖ0・・1*1*\InstallFont]

"ＭＳ Ｐゴシック%#16%$-B"="マブラヴ11.rio\\ＭＳ Ｐゴシック16B.5RF"

"ＭＳ Ｐゴシック%#24%$-B%$-A"="マブラヴ11.rio\\ＭＳ Ｐゴシック24BA.5RF"

.

[HKEY_USERS\S-1-5-21-338440498-2888063792-2753391560-1000\Software\relic UGP Applications\age\ﾞ0ﾖ0・・1*1*\PeculiarToTheApp]

"strTheAppName"="マブラヴ1.1\0011\00E"

.

[HKEY_USERS\S-1-5-21-338440498-2888063792-2753391560-1000\Software\relic UGP Applications\age\ﾞ0ﾖ0・・1*1*\rUGPBasic]

"strRugpPluginFolder"="c:\\age\\マブラヴ11\\Plugins"

"bIsIllegalTerminateCheck"=dword:00000000

"nRugpVersion"=dword:0000157c

.

[HKEY_USERS\S-1-5-21-338440498-2888063792-2753391560-1000\Software\relic UGP Applications\age\ﾞ0ﾖ0・・1*1*\rvmmBoxSettings]

"nWndFrameLevel"=dword:00000003

"nWndBaseRatioSrc"=dword:000000c0

"nWndBaseRatioDst"=dword:00000006

"nWndBaseColor1"=dword:002020a0

"nWndBaseColor2"=dword:00c0c0ff

"nWndBaseGradation"=dword:00000001

"nFontBlank"=dword:00000002

"nMainFontColor"=dword:ffffffff

"nSelectedFontColor"=dword:ff8090c0

.

[HKEY_USERS\S-1-5-21-338440498-2888063792-2753391560-1000\Software\relic UGP Applications\age\ﾞ0ﾖ0・・1*1*\rvmmInstallation]

"strFontCachePath"="c:\\age\\マブラヴ11\\"

"strVirtuaRegistryAbsolutePath"="c:\\age\\マブラヴ11\\Vmreg\\"

.

[HKEY_USERS\S-1-5-21-338440498-2888063792-2753391560-1000\Software\relic UGP Applications\age\ﾞ0ﾖ0・・1*1*\rvmmPeculiarToTheApp]

"bCanSettingWindow"=dword:00000001

"bCanSettingFont"=dword:00000001

"bPageOverNext"=dword:00000000

"bUucAccessMasterKey"=dword:00000001

"strLowSpecFont"="ＭＳ Ｐゴシック%#16%$-B"

"strStandardFont"="ＭＳ Ｐゴシック%#24%$-B%$-A"

"bCanSettingSound"=dword:00000001

"bFullScreenMenuOff"=dword:00000000

"bWindowMenuAccessMasterKey"=dword:00000001

.

[HKEY_USERS\S-1-5-21-338440498-2888063792-2753391560-1000\Software\relic UGP Applications\age\ﾞ0ﾖ0・・1*1*\rvmmUISettings]

"bFullScreen"=dword:00000001

"dwMainFontStyle"=dword:0000000c

"nTextSpeed"=dword:00000030

"strCurrentMonitorDevice"="\\\\.\\DISPLAY1"

"dwCurrentMonitorFlag"=dword:00000001

"nWindowSize"=dword:00000003

"nFaceWindowSize"=dword:00000003

"isBgm"=dword:00000001

"isEffect"=dword:00000001

"nVoiceLevel"=dword:00000001

"nLayeredEffect"=dword:00000001

"nSeenMsgSkip"=dword:00000000

"nAutoMsgSkip"=dword:00000000

"bMouseTrace"=dword:00000001

.

[HKEY_USERS\S-1-5-21-338440498-2888063792-2753391560-1000\Software\SecuROM\License information*]

"datasecu"=hex:39,89,31,a3,ec,25,e6,40,ab,92,39,0a,71,a7,40,0c,56,b7,cb,75,68,

   69,00,d0,4c,2f,19,ad,e6,4b,50,d7,7b,28,2b,69,c2,9c,5c,bf,d1,b9,cb,9b,d7,40,\

"rkeysecu"=hex:cf,fd,36,ed,8f,83,8f,67,d5,d5,68,a4,04,da,e7,c7

.

[HKEY_USERS\S-1-5-21-338440498-2888063792-2753391560-1001\Software\relic UGP Applications\age\ﾞ0ﾖ0・・1*1*\Installation]

"strAbsolutePath"="c:\\age\\マブラヴ11\\"

"strObjectOcean"="c:\\age\\マブラヴ11\\マブラヴ11.rio"

"strIciPath"="c:\\age\\マブラヴ11\\マブラヴ11.rio.ici"

"strTTFileName"="マブラヴ11.rbt"

"strInstallSourcePath"="i:\\"

"bInstalled"=dword:00000001

"strInstallTypeSelect"="1"

"strInstallSystemType"=""

.

[HKEY_USERS\S-1-5-21-338440498-2888063792-2753391560-1001\Software\relic UGP Applications\age\ﾞ0ﾖ0・・1*1*\InstallFont]

"ＭＳ Ｐゴシック%#24%$-B%$-A"="マブラヴ11.rio\\ＭＳ Ｐゴシック24BA.5RF"

"ＭＳ Ｐゴシック%#16%$-B"="マブラヴ11.rio\\ＭＳ Ｐゴシック16B.5RF"

.

[HKEY_USERS\S-1-5-21-338440498-2888063792-2753391560-1001\Software\relic UGP Applications\age\ﾞ0ﾖ0・・1*1*\PeculiarToTheApp]

"strTheAppName"="マブラヴ1.1"

.

[HKEY_USERS\S-1-5-21-338440498-2888063792-2753391560-1001\Software\relic UGP Applications\age\ﾞ0ﾖ0・・1*1*\rUGPBasic]

"strRugpPluginFolder"="c:\\age\\マブラヴ11\\Plugins"

"bIsIllegalTerminateCheck"=dword:00000000

"nRugpVersion"=dword:0000157c

.

[HKEY_USERS\S-1-5-21-338440498-2888063792-2753391560-1001\Software\relic UGP Applications\age\ﾞ0ﾖ0・・1*1*\rvmmBoxSettings]

"nWndFrameLevel"=dword:00000003

"nWndBaseRatioSrc"=dword:000000c0

"nWndBaseRatioDst"=dword:00000006

"nWndBaseColor1"=dword:002020a0

"nWndBaseColor2"=dword:00c0c0ff

"nWndBaseGradation"=dword:00000001

"nFontBlank"=dword:00000002

"nMainFontColor"=dword:ffffffff

"nSelectedFontColor"=dword:ff8090c0

.

[HKEY_USERS\S-1-5-21-338440498-2888063792-2753391560-1001\Software\relic UGP Applications\age\ﾞ0ﾖ0・・1*1*\rvmmInstallation]

"strFontCachePath"="c:\\age\\マブラヴ11\\"

"strVirtuaRegistryAbsolutePath"="c:\\age\\マブラヴ11\\Vmreg\\"

.

[HKEY_USERS\S-1-5-21-338440498-2888063792-2753391560-1001\Software\relic UGP Applications\age\ﾞ0ﾖ0・・1*1*\rvmmPeculiarToTheApp]

"strStandardFont"="ＭＳ Ｐゴシック%#24%$-B%$-A"

"strLowSpecFont"="ＭＳ Ｐゴシック%#16%$-B"

"bCanSettingWindow"=dword:00000001

"bCanSettingFont"=dword:00000001

"bPageOverNext"=dword:00000000

"bUucAccessMasterKey"=dword:00000001

"bCanSettingSound"=dword:00000001

"bFullScreenMenuOff"=dword:00000000

"bWindowMenuAccessMasterKey"=dword:00000001

.

[HKEY_USERS\S-1-5-21-338440498-2888063792-2753391560-1001\Software\relic UGP Applications\age\ﾞ0ﾖ0・・1*1*\rvmmUISettings]

"dwMainFontStyle"=dword:00000005

"bFullScreen"=dword:00000001

"nTextSpeed"=dword:00000030

"strCurrentMonitorDevice"="\\\\.\\DISPLAY1"

"dwCurrentMonitorFlag"=dword:00000001

"nWindowSize"=dword:00000003

"nFaceWindowSize"=dword:00000003

"isBgm"=dword:00000001

"isEffect"=dword:00000001

"nVoiceLevel"=dword:00000001

"nLayeredEffect"=dword:00000001

"nSeenMsgSkip"=dword:00000001

"nAutoMsgSkip"=dword:00000000

"bMouseTrace"=dword:00000001

DUMPHIVE0.003 (REGF)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'lsass.exe'(632)

c:\windows\system32\NETWIN32.DLL

.

- - - - - - - > 'Explorer.exe'(2892)

c:\program files\SweetIM\Messenger\mgAdaptersProxy.dll

c:\windows\system32\NETWIN32.DLL

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\nvvsvc.exe

c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

c:\program files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe

c:\program files\NVIDIA Corporation\Display\nvxdsync.exe

c:\windows\system32\nvvsvc.exe

c:\program files\Avira\AntiVir Desktop\sched.exe

c:\program files\Novell\Client\XTier\Services\XTSvcMgr.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Novell\Client\cusrvc.exe

c:\program files\Giraffic\Veoh_GirafficWatchdog.exe

c:\program files\LogMeIn Hamachi\hamachi-2.exe

c:\program files\Hi-Rez Studios\HiPatchService.exe

c:\windows\system32\iprntsrv.exe

c:\windows\system32\nutsrv4.exe

c:\program files\PTC\PTC Portmapper\i486_nt\obj\portmap.exe

c:\program files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\program files\Giraffic\Veoh_Giraffic.exe

c:\windows\System32\WUDFHost.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\program files\Avira\AntiVir Desktop\avshadow.exe

c:\program files\TuneUp Utilities 2013\TuneUpUtilitiesApp32.exe

c:\windows\system32\conime.exe

c:\program files\Epson Software\Event Manager\EEventManager.exe

c:\windows\System32\nwtray.exe

c:\program files\NVIDIA Corporation\Display\nvtray.exe

c:\windows\ehome\ehmsas.exe

c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

c:\program files\Common Files\Steam\SteamService.exe

.

**************************************************************************

.

Completion time: 2013-05-17  14:52:50 - machine was rebooted

ComboFix-quarantined-files.txt  2013-05-17 12:52

.

Pre-Run: 12 Verzeichnis(se), 574.919.929.856 Bytes frei

Post-Run: 16 Verzeichnis(se), 577.036.746.752 Bytes frei

.

- - End Of File - - 68A2502FC4BD7B92984609376CB040FC

Hi
öffne mal bitte Computer, c: qoobox
rechtsklick Quarantain, dann mit winrar oder ähnlichem archivierungsprogramm packen und hochladen:
Trojaner-Board Upload Channel

danke fürs hochladen.
Nutzt du den PC für Onlinebanking, zum einkaufen, für sonstige Zahlungsabwicklungen, oder ähnlich wichtigem, wie beruflichem?

nein,nichts dergleichen,ich benutze ih nur zum im Internet surfen,zum Spielen und für das Studium um Berichte oder dergleichen zu schreiben.

ok wenn wir fertig sind, alle Passwörter ändern.
malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Ich hab jetzt ein noch größeres Problem als vorher..

Da ich das Programm zuerst in der falschen Sprache installiert hatte wollte ich es neu installieren,nach der Deinstallation war jedoch der Virus wieder aktiv und dieses mal sogar noch schlimmer als vorher.:headbang:

Ich kann auf meinem Rechner nicht einmal mehr im abgesicherten Modus arbeiten,selbst dort taucht der GVU-Bildschirm sofort auf.

Hätte vorher fragen sollen als die Installation nicht geklappt hat,ich hoffe das kann noch gerettet werden.

Ich arbeite grad von dem Laptop meines Bruders aus.
Die Programme sind alle noch auf meinen Rechner,falls man irgendwie direkt auf sie zugreifen kann.
Wenn nicht müsste ich irgendwo noch ein Paar Cds rumliegen haben.

MfG Cyph

Habe mir jetzt die Programme defogger,OTL und gmer auf eine CD gebrannt.
Wie kann ich diese direkt bei Start starten?

Ich hab mir jetzt defogger, OTL und Gmer auf eine CD gebrannt.
Wie kann ich diese abspielen ohne mich anmelden zu müssen?

Hi,

kommst du an nen pc mit brenner?
download:
http://filepony.de/download-otlpe/
und brenne es mit ISOBurner auf eine CD.
ISO Burner - Download - Filepony
isoburner anleitung:
http://www.trojaner-board.de/83208-b...ei-cd-dvd.html
• Wenn der Download fertig ist mache ein doppel Klick auf die OTLPENet.exe, was ISOBurner öffnet um es auf die CD zu brennen.
Starte dein System neu und boote von der CD die du gerade erstellt hast.
Wenn du nicht weist wie du deinen Computer dazu bringst von der CD zu booten,
http://www.trojaner-board.de/81857-c...cd-booten.html

• Dein System sollte jetzt einen REATOGO-X-PE Desktop anzeigen.
• Mache einen doppel Klick auf das OTLPE Icon.
• Wenn du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
• Wenn du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
• entferne den haken bei "Automatically Load All Remaining Users" wenn er gesetzt ist.

• OTL sollte nun starten.
Kopiere nun den Inhalt in die http://larusso.trojaner-board.de/Images/otlfix.jpg
Textbox.

Code:

activex

netsvcs

msconfig

%SYSTEMDRIVE%\*.

%PROGRAMFILES%\*.exe

%LOCALAPPDATA%\*.exe

%systemroot%\*. /mp /s

/md5start

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

explorer.exe

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\*.dll /lockedfiles

%USERPROFILE%\*.*

%USERPROFILE%\Local Settings\Temp\*.exe

%USERPROFILE%\Local Settings\Temp\*.dll

%USERPROFILE%\Application Data\*.exe

• Drücke Run Scan um den Scan zu starten.
• Wenn er fertig ist werden die Dateien in C:\otl.txt gesichert
• Kopiere diesen Ordner auf deinen USB-Stick wenn du keine Internetverbindung auf diesem System hast.
poste beide logs

kann komischerweise wieder den PC normal starten,weiß leider nicht woran das liegt aber das Programm mit dem Virus wird wieder wie zuvor gesperrt und nicht gestartet.

Habe mich auch gestern gewundert,da ich zwar den Signalton gehört habe das ein Programm gesperrt wurde aber die weiße Seite trotzdem erschienen ist.

Sol ich jetzt trotzdem zur Sicherheit wieder von vorne beginnen?
oder mit malware weiter machen.

mach mit malwarebytes weiter und arbeite nur auf den von mir genannten seiten.

ich installiere es wie beschrieben,bekomme dann aber überall ???? anstatt Text.
Das fängt an wenn ich es update und ist auch so bei der Version selbst so

du hast auch malwarebytes, müsste mbam setup heißen, geladen, kannst du am anfang keine Sprache einstellen?

habe ich auf deutsch gestellt,aber beim updaten beginnt es dann mit den Fragezeichen

vielleicht kommt es davon das ich es beim ersten mal nicht umgestellt habe,aber dann sollte es sich ändern wenn ich es nochmal instaliiere?

und ich hatte es ja deinstalliert,daher hatte ich wieder das Problem

dann versuchs erst mal ohne update

geht trotzdem nicht,installation ist zwar auf deutsch aber das Programm selbst anscheinend nicht.

bok dann erst mal:

lade den CCleaner standard:
CCleaner - Download - Filepony
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Hier die Liste meiner Programme(ist sehr langeund viel unnötiges,hab schon lange nichts mehr gelöscht)

Code:

1ClickDownloader        1ClickDownload        06.09.2012        2,97MB        2.7 Build 26473                       unnötig

7-Zip 9.25 alpha                11.08.2012        3,14MB                                                      notwendig

ABBYY FineReader 6.0 Sprint        ABBYY Software House        13.08.2012        119MB        6.00.1395.4512        unbekannt

Adobe AIR        Adobe Systems Incorporated        15.08.2012        39,3MB        3.3.0.3670                    notwendig

Adobe Flash Player 11 ActiveX        Adobe Systems Incorporated        15.05.2013                11.7.700.202  notwendig

Adobe Flash Player 11 Plugin        Adobe Systems Incorporated        16.05.2013                11.7.700.202  notwendig

Adobe Reader 9.5.5        Adobe Systems Incorporated        25.05.2013                9.5.5                 notwendig

applicationupdater        Sony Online Entertainment        23.11.2012        1,68MB                              unbekannt

Arbortext IsoView 7.3        PTC        03.05.2013        26,6MB        7.3.00.15                                     unbekannt

ARMA 2        Bohemia Interactive        22.08.2012        8,32GB                                                      unnötig

ARMA 2: Operation Arrowhead        Bohemia Interactive        27.09.2012        7,67GB                              unnötig

Ask Toolbar        Ask.com        17.02.2013        3,80MB        1.15.15.0                                             unnötig

Ask Toolbar Updater        Ask.com        02.11.2012        1,53MB        1.2.3.29495                                   unnötig

ASRock IES v2.0.8                10.08.2012        7,90MB                                                      notwendig

ASRock InstantBoot v1.23                10.08.2012        4,06MB                                              notwendig

ASRock OC Tuner v2.2.93                10.08.2012        20,7MB                                                      notwendig

Avira Free Antivirus        Avira        14.11.2012        176MB        12.1.9.1236                                   notwendig

AVM FRITZ!Box Dokumentation        AVM Berlin        22.09.2012        3,36MB                                      notwendig?

BabylonObjectInstaller        Babylon Ltd        05.09.2012        2,10MB        2.0.0.4                               unnötig

Batman: Arkham Asylum Game of the Year Edition        Square Enix Limited        15.08.2012        7,77GB        1.0.0.0   unnötig

BattlEye for OA Uninstall                27.09.2012        828KB                                                  unnötig

BCool                23.12.2011        85,9MB        1.0                                                               unbekannt

Belkin USB Wireless Adaptor        Belkin        11.08.2012                1.0.0.10                                  unnötig

Borderlands        2K Games        17.10.2012        2,88GB        1.0.295                                           unnötig

BrowserProtect        Bit89 Inc        28.04.2013        7,13MB                                                        unbekannt

Call of Duty: Modern Warfare 3        Infinity Ward - Sledgehammer Games        23.08.2012        6,61GB                notwendig

CCleaner        Piriform        24.05.2013        5,62MB        4.02                                            notwendig 

Cisco AnyConnect Secure Mobility Client        Cisco Systems, Inc.        13.02.2013                3.0.10057       unnötig

Counter-Strike        Valve        29.10.2012                                                                        notwendig

Counter-Strike: Source        Valve        27.10.2012        51,9MB                                                        notwendig

Creo Direct Version 2.0 Datecode [M030]        PTC        03.05.2013        95,6MB        2.0                             unnötig

Creo Layout Version 2.0 Datecode [M030]        PTC        03.05.2013        95,6MB        2.0                             unnötig

Creo Parametric Version 2.0 Datecode [M030]        PTC        03.05.2013        123MB        2.0                     unnötig

Creo Platform 2.11        PTC        03.05.2013        25,2MB        2.11.1                                          unnötig

Creo Simulate Version 2.0 Datecode [M030]        PTC        03.05.2013        118MB        2.0                     unnötig

Creo Thumbnail Viewer 2.0        PTC        03.05.2013        17,7MB        30.12.360                               unnötig

Creo View Express 2.0        PTC        03.05.2013        320MB        10.1.10.14                                      unnötig

Darksiders II                23.08.2012        5,50GB                                                                notwendig

DayZ Commander        Dotjosh Studios        02.09.2012        3,48MB        1.09.76                                         unnötig

Dead Space        EA Redwood Shores        28.09.2012        8,14GB                                                notwendig

Delta Chrome Toolbar                23.12.2011        2,00KB                                                        unnötig/unbkt

Delta Chrome Toolbar        Delta        11.05.2013                                                                unnötig/unbkt

Delta toolbar        Delta        28.04.2013                1.8.16.16                                               unnötig/unbkt

Dota 2                05.11.2012        4,88GB                                                                        unnötig

Dota 2 Test                05.11.2012        4,53GB                                                                unnötig

Dotfuscator Software Services - Community Edition        PreEmptive Solutions        11.10.2012        6,44MB        5.0.2300.0    unbekannt

Dotfuscator Software Services - Community Edition - DEU        PreEmptive Solutions        11.10.2012        2,84MB        5.0.2300.0    unbekannt

Driver Pro v3.0        PC Utilities Pro        28.04.2013        19,4MB        3.0                              unnötig

Epson Easy Photo Print 2        SEIKO EPSON CORPORATION        13.08.2012        98,8MB        2.1.0.0          unnötig

Epson Event Manager        SEIKO EPSON Corporation        13.08.2012        20,0MB        2.20.00                  unnötig

EPSON Scan                13.08.2012        14,0MB                                                         unnötig

Epson Stylus SX110_TX110 Handbuch                13.08.2012        7,95MB                                 unnötig

EPSON SX110 Series Printer Uninstall        SEIKO EPSON Corporation        13.08.2012                         unnötig

Fallout 3        Bethesda Softworks        13.03.2013        5,70GB        1.00.0000                        notwendig

Fast Search        Surf Canyon        11.08.2012        372KB        3.4.1                                    unbekannt

File Type Assistant        Trusted Software        11.08.2012        1,98MB                                 unbekannt

FinalTorrent 2011        Bitberry Software        11.08.2012        8,92MB                                 unnötig    

gamelauncher-ps2-psg        Sony Online Entertainment        23.11.2012                                 unnötig        

Google Chrome        Google Inc.        06.11.2012        326MB        27.0.1453.94                             unnötig

Guild Wars 2        NCsoft Corporation, Ltd.        25.08.2012        14,4GB                                 notwendig

Hi-Rez Studios Authenticate and Update Service        Hi-Rez Studios        20.03.2013        3,77GB        3.0.0.0           notwendig

Internet Explorer Toolbar 4.6 by SweetPacks        SweetIM Technologies Ltd.        06.09.2012        4,27MB        4.6.0004      unnötig

Java 7 Update 17        Oracle        14.03.2013        129MB        7.0.170                                  notwendig

JavaFX 2.1.1        Oracle Corporation        12.08.2012        20,8MB        2.1.1                            notwendig

League of Legends        Riot Games        15.08.2012        2,05GB        1.3                              notwendig

LogMeIn Hamachi        LogMeIn, Inc.        23.05.2013        3,80MB        2.1.0.362                                unnötig

LOLReplay        www.leaguereplays.com        23.02.2013        3,10MB        0.8.1.4                          unnötig

Malwarebytes Anti-Malware Version 1.75.0.1300        Malwarebytes Corporation        30.05.2013        13,3MB        1.75.0.1300   notwendig

McAfee Security Scan Plus        McAfee, Inc.        07.02.2013        10,0MB        3.0.318.3                                     unnötig

Microsoft .NET Framework 3.5 Language Pack SP1 - DEU        Microsoft Corporation        10.08.2012        36,9MB                      notwendig

Microsoft .NET Framework 3.5 SP1        Microsoft Corporation        10.08.2012        36,9MB                                      notwendig

Microsoft .NET Framework 4 Client Profile        Microsoft Corporation        10.08.2012        120MB        4.0.30319             notwendig

Microsoft .NET Framework 4 Client Profile DEU Language Pack        Microsoft Corporation        10.08.2012        24,5MB        4.0.30319   notwendig

Microsoft .NET Framework 4 Extended        Microsoft Corporation        11.10.2012        46,0MB        4.0.30319                        notwendig

Microsoft .NET Framework 4 Extended DEU Language Pack        Microsoft Corporation        11.10.2012        11,6MB        4.0.30319        notwendig

Microsoft .NET Framework 4 Multi-Targeting Pack        Microsoft Corporation        11.10.2012        83,4MB        4.0.30319             notwendig

Microsoft ASP.NET MVC 2        Microsoft Corporation        11.10.2012        481KB        2.0.50217.0                              notwendig

Microsoft ASP.NET MVC 2 - DEU        Microsoft Corporation        11.10.2012        24,0KB        2.0.50331.0                                 notwendig

Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools        Microsoft Corporation        11.10.2012        2,26MB        2.0.50217.0        unnötig

Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools - DEU        Microsoft Corporation        11.10.2012        2,07MB        2.0.50331.0     unnötig

Microsoft Games for Windows - LIVE        Microsoft Corporation        15.08.2012        8,31MB        3.1.186.0                         unnötig

Microsoft Games for Windows - LIVE Redistributable        Microsoft Corporation        16.08.2012        31,3MB        3.5.92.0          unnötig

Microsoft Help Viewer 1.0        Microsoft Corporation        11.10.2012        6,09MB        1.0.30319                                 notwendig

Microsoft Help Viewer 1.0 Language Pack - DEU        Microsoft Corporation        11.10.2012        6,09MB        1.0.30319                 notwendig

Microsoft Silverlight        Microsoft Corporation        13.03.2013                5.1.20125.0                                       unbekannt

Microsoft Silverlight 3 SDK - Deutsch        Microsoft Corporation        11.10.2012        32,7MB        3.0.40818.0                        unbekannt

Microsoft SQL Server 2008 R2 Data-Tier Application Project        Microsoft Corporation        11.10.2012        14,1MB        10.50.1447.4   unbekannt/notwendig

Microsoft SQL Server 2008 R2 Management Objects        Microsoft Corporation        11.10.2012        18,8MB        10.50.1447.4                       "

Microsoft SQL Server 2008 R2 Transact-SQL Language Service        Microsoft Corporation        11.10.2012        5,41MB        10.50.1447.4       "

Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Framework        Microsoft Corporation        11.10.2012        377KB        10.50.1447.4       "

Microsoft SQL Server Compact 3.5 SP2 DEU        Microsoft Corporation        11.10.2012        3,69MB        3.5.8080.0                         "

Microsoft SQL Server Database Publishing Wizard 1.4        Microsoft Corporation        11.10.2012        10,1MB        10.1.2512.8                "

Microsoft SQL Server System CLR Types        Microsoft Corporation        11.10.2012        2,54MB        10.50.1447.4                               "

Microsoft Sync Framework Runtime v1.0 SP1 (x86) de        Microsoft Corporation        11.10.2012        843KB        1.0.3010.0                 "

Microsoft Sync Framework SDK v1.0 SP1 de        Microsoft Corporation        11.10.2012        30,0MB        1.0.3010.0                         "

Microsoft Sync Framework Services v1.0 SP1 (x86) de        Microsoft Corporation        11.10.2012        2,06MB        1.0.3010.0                 "

Microsoft Sync Services for ADO.NET v2.0 SP1 (x86) de        Microsoft Corporation        11.10.2012        596KB        2.0.3010.0                 "

Microsoft Team Foundation Server 2010-Objektmodell - DEU        Microsoft Corporation        11.10.2012        67,9MB        10.0.30319         "

Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        17.08.2012        294KB        8.0.59193                          unnötig

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17        Microsoft Corporation        11.08.2012        590KB        9.0.30729          unnötig

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161        Microsoft Corporation        17.08.2012        594KB        9.0.30729.6161     unnötig

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219        Microsoft Corporation        11.01.2013                10.0.40219         unnötig

Microsoft Visual C++ 2010  x86 Runtime - 10.0.30319        Microsoft Corporation        13.10.2012                10.0.30319                 unnötig

Microsoft Visual F# 2.0 Runtime        Microsoft Corporation        11.10.2012        5,81MB        10.0.30319                                         notwendig

Microsoft Visual F# 2.0 Runtime Language Pack - DEU        Microsoft Corporation        11.10.2012        1,29MB        10.0.30319                 notwendig

Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools        Microsoft Corporation        11.10.2012        35,3MB        10.0.30319         unnötig

Microsoft Visual Studio 2010 Professional - DEU        Microsoft Corporation        11.10.2012        1,80GB        10.0.30319                         unnötig

Microsoft Visual Studio 2010 Tools for Office Runtime (x86)        Microsoft Corporation        11.01.2013        5,52MB        10.0.40303         unnötig

Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU        Microsoft Corporation        11.01.2013        5,52MB        10.0.40303       unnötig

Microsoft Visual Studio Macro Tools        Microsoft Corporation        11.10.2012        29,1MB        9.0.30729                                 unnötig

Microsoft Visual Studio Macro Tools - DEU Language Pack        Microsoft Corporation        11.10.2012        29,1MB        9.0.30729                 unnötig

MixiDJ Toolbar        mixidj        01.05.2013                1.8.4.1                                             unbekannt

MKS Platform Components 9.x        Mortice Kern Systems        03.05.2013        63,2MB        9.3.0000            unbekannt

Mumble 1.2.3        Thorvald Natvig        17.08.2012        32,2MB        1.2.3                                       unnötig

Muv-Luv DVD Ver. 1.0        Amaterasu Translations        03.01.2013                1.0                         notwendig

Mysearchdial        Mysearchdial        05.05.2013        3,21MB                                                    unbekannt/unnötig

Neverwinter        Cryptic Studios        04.05.2013        3,78GB                                                    notwendig

NICI (Shared) U.S./Worldwide (128 bit) (2.7.6-1)                08.10.2012        800KB                    unbekannt

NMAS Challenge Response Method        Novell, Inc.        08.10.2012        252KB        2.8.3.3                     unnötig

NMAS Client        Novell, Inc.        08.10.2012        1,01MB        3.5.0.6                                     unnötig

Novell Client für Windows        Novell, Inc.        08.10.2012        6,07MB        2 SP2                       unnötig

Novell iPrint Client v05.82.00        Novell, Inc.        14.10.2012                                            unnötig

NVIDIA 3D Vision Controller-Treiber 306.97        NVIDIA Corporation        11.10.2012        4,05MB        306.97      notwendig

NVIDIA 3D Vision Treiber 311.06        NVIDIA Corporation        13.04.2013        24,5MB        311.06                      notwendig

NVIDIA Grafiktreiber 311.06        NVIDIA Corporation        13.04.2013        115MB        311.06                      notwendig

NVIDIA PhysX-Systemsoftware 9.12.0604        NVIDIA Corporation        25.08.2012        84,6MB        9.12.0604           notwendig

NVIDIA Update 1.11.3        NVIDIA Corporation        13.04.2013        1,00MB        1.11.3                              notwendig

OpenOffice.org 3.4.1        Apache Software Foundation        05.09.2012        331MB        3.41.9593                   notwendig

OptimizerPro        Premium        23.12.2011        356KB        1.0                                                       unnötig

osu!        peppy        14.08.2012        137MB        0.0.0.0                                                           notwendig

Pando Media Booster        Pando Networks Inc.        15.08.2012        7,23MB        2.6.0.8                           notwendig

Path of Exile        Grinding Gear Games        04.02.2013        11,5MB        0.10.0.22655                              notwendig

PlanetSide 2        Sony Online Entertainment        23.11.2012        9,55GB                                          unnötig

PlanetSide 2        Sony Online Entertainment        23.11.2012                1.0.3.181                         unnötig

Project64 1.6        Project64        08.02.2013        3,46MB        1.6                                               unnötig

PTC Portmapper Version 2.0 Datecode [M030]        PTC        03.05.2013        70,8MB        2.0                       unnötig

PTC Quality Agent        PTC        03.05.2013        48,5MB        2.0.0.0                                           unnötig

Realtek 8169 8168 8101E 8102E Ethernet Driver        Realtek        10.08.2012        1,61MB        1.00.0000                 benötigt/unbekannt

Screenshot Captor 2.102.01                09.02.2013        15,1MB                                                  unnötig

Secure Download Manager        Kivuto Solutions Inc.        07.05.2013        935KB        3.1.0                             unnötig

Skype™ 6.3        Skype Technologies S.A.        23.05.2013        21,1MB        6.3.107                                   notwendig

SmartPCFixer 4.2        LionSea Software        20.08.2012        21,8MB        4.2                               unnötig

Smite        Hi-Rez Studios        21.03.2013        3,71GB        0.1.1468.0                                                notwendig

Sniper: Ghost Warrior        City Interactive S.A.        16.03.2013        7,06GB                                          unnötig

Spelling Dictionaries Support For Adobe Reader 9        Adobe Systems Incorporated        12.11.2012        29,6MB        9.0.0     unnötig

Steam        Valve Corporation        21.08.2012        35,4MB        1.0.0.0                                            notwendig

SweetIM for Messenger 3.7        SweetIM Technologies Ltd.        06.09.2012        4,94MB        3.7.0005           unbekannt

TeamSpeak 3 Client        TeamSpeak Systems GmbH        08.04.2013        52,5MB        3.0.10.1                           notwendig

The Elder Scrolls V: Skyrim        Bethesda Game Studios        21.08.2012        5,41GB                                   notwendig

TrackMania² Stadium                28.03.2013        595MB                                                           notwendig

TuneUp Utilities 2013        TuneUp Software        09.02.2013        78,5MB        13.0.3020.2                                unnötig

Uniblue SpeedUpMyPC        Uniblue Systems Ltd        05.09.2012        21,9MB        5.2.1.7                            unnötig

Unterstützungsdateien für Microsoft SQL Server 2008-Setup         Microsoft Corporation        11.10.2012        30,0MB        10.1.2731.0          unbekannt

Update Manager for SweetPacks 1.1        SweetIM Technologies Ltd.        06.09.2012        2,76MB        1.1.0008   unnötig

VAFPlayer        Tuguu SL        28.04.2013        18,0MB        1.6.8                                              unbekannt!

Veoh Giraffic Video Accelerator        Giraffic        17.05.2013        11,8MB        0.86.412.230                       unnötig

Veoh Web Player        Veoh Networks, Inc.        09.10.2012        45,9MB        1.1.2.0000                                 unnötig

Veoh Web Player Toolbar        Veoh Web Player        09.10.2012        4,87MB        6.9.0.16                                   unnötig

Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU        Microsoft Corporation        11.10.2012        11,1MB        4.0.8080.0       unnötig

VLC media player 2.0.5        VideoLAN        17.01.2013        95,8MB        2.0.5                                       notwendig

Web Deployment Tool        Microsoft Corporation        11.10.2012        4,53MB        1.1.0618                            unbekannt

Windows Live ID Sign-in Assistant        Microsoft Corporation        16.08.2012        4,68MB        6.500.3165.0        unnötig

X-Blades        Gaijin Entertainment        09.09.2012        2,31GB        1.0.35                                        notwendig

XSplit        SplitMediaLabs        29.01.2013        95,1MB        1.2.1301.2501                                                unnötig

deinstaliere:
1ClickDownloader
ABBYY
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden, instalieren.
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen
bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
Sicherheit (erweitert)
Erweiterte Sicherheit anhaken
und alle Dateien auswählen.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
ARMA : alle
Ask : alle
BabylonObjectInstaller
Batman:
BattlEye
Belkin
Borderlands
BrowserProtect
Cisco
Creo : alle
DayZ
Delta : alle
Dota : beide
Driver Pro
EPSON : alle
Fast Search
FinalTorrent
gamelauncher
Google
Internet Explorer Toolbar
Java : beide
downloade Java jre:
Java-Downloads für alle Betriebssysteme
klicke:
Download der Java-Software für Windows Offline
laden, und instalieren
deinstaliere:
McAfee
MixiDJ
Mumble
Mysearchdial
NMAS : beide
Novell : beide
OptimizerPro
PlanetSide : beide
Project64
PTC : beide
Screenshot
Secure
SmartPCFixer
Sniper:
Spelling
SweetIM
TuneUp
Uniblue
Update Manager
VAFPlayer
Veoh : alle
Windows Live ID
XSplit
Öffne CCleaner, analysieren, starten, PC neustarten.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Hier der AdwCleaner logfile:

Code:

# AdwCleaner v2.301 - Datei am 01/06/2013 um 02:43:37 erstellt

# Aktualisiert am 16/05/2013 von Xplode

# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)

# Benutzer : Sabine - SABINE-PC

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\Sabine\Desktop\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Datei Gelöscht : C:\user.js

Datei Gelöscht : C:\Users\Sabine\AppData\Local\mysearchdial.crx

Datei Gelöscht : C:\Users\Sabine\AppData\Roaming\Microsoft\Windows\Start Menu\Startfenster.lnk

Ordner Gelöscht : C:\Program Files\1ClickDownload

Ordner Gelöscht : C:\Program Files\Ask.com

Ordner Gelöscht : C:\Program Files\Conduit

Ordner Gelöscht : C:\Program Files\DomaIQ Uninstaller

Ordner Gelöscht : C:\Program Files\Free Offers from Freeze.com

Ordner Gelöscht : C:\Program Files\PriceGong

Ordner Gelöscht : C:\ProgramData\Ask

Ordner Gelöscht : C:\ProgramData\Babylon

Ordner Gelöscht : C:\ProgramData\InstallMate

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PriceGong

Ordner Gelöscht : C:\ProgramData\Tarma Installer

Ordner Gelöscht : C:\Users\Sabine\AppData\Local\APN

Ordner Gelöscht : C:\Users\Sabine\AppData\Local\Babylon

Ordner Gelöscht : C:\Users\Sabine\AppData\Local\Conduit

Ordner Gelöscht : C:\Users\Sabine\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok

Ordner Gelöscht : C:\Users\Sabine\AppData\LocalLow\AskToolbar

Ordner Gelöscht : C:\Users\Sabine\AppData\LocalLow\Conduit

Ordner Gelöscht : C:\Users\Sabine\AppData\LocalLow\PriceGong

Ordner Gelöscht : C:\Users\Sabine\AppData\Roaming\Babylon

Ordner Gelöscht : C:\Users\Sabine\AppData\Roaming\Mysearchdial

Ordner Gelöscht : C:\Users\Sabine\AppData\Roaming\OpenCandy

Ordner Gelöscht : C:\Users\Sabine\AppData\Roaming\Optimizer Pro

Ordner Gelöscht : C:\Users\Sabine\AppData\Roaming\yourfiledownloader

Ordner Gelöscht : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

Ordner Gelöscht : C:\Windows\system32\WNLT
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKCU\Software\1ClickDownload

Schlüssel Gelöscht : HKCU\Software\5c68f8be53ce444

Schlüssel Gelöscht : HKCU\Software\APN

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar

Schlüssel Gelöscht : HKCU\Software\AppDataLow\SProtector

Schlüssel Gelöscht : HKCU\Software\Ask.com

Schlüssel Gelöscht : HKCU\Software\Babylon

Schlüssel Gelöscht : HKCU\Software\BabylonToolbar

Schlüssel Gelöscht : HKCU\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar

Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\gaiilaahiahdejapggenmdmafpmbipje

Schlüssel Gelöscht : HKCU\Software\IM

Schlüssel Gelöscht : HKCU\Software\ImInstaller

Schlüssel Gelöscht : HKCU\Software\InstallCore

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Translate this web page with Babylon

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Translate with Babylon

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{177586E7-E42E-4F38-83D1-D15B4AF5B714}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Babylon

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\incredibar

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Optimizer Pro_is1

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\PriceGong

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Surf Canyon

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\WNLT

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\YourFileDownloader

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4D6A9BBF-402C-4301-B1EF-28D04F71D761}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{82E1477C-B154-48D3-9891-33D83C26BCD3}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CA9B9C89-4662-4ADC-9C23-A452BECD5D19}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F72841F0-4EF1-4DF5-BCE5-B3AC8ACF5478}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9639E4A-801B-4843-AEE3-03D9DA199E77}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F72841F0-4EF1-4DF5-BCE5-B3AC8ACF5478}

Schlüssel Gelöscht : HKCU\Software\mysearchdial

Schlüssel Gelöscht : HKCU\Software\Optimizer Pro

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKCU\Software\WNLT

Schlüssel Gelöscht : HKCU\Software\YourFileDownloader

Schlüssel Gelöscht : HKLM\SOFTWARE\5c68f8be53ce444

Schlüssel Gelöscht : HKLM\Software\APN

Schlüssel Gelöscht : HKLM\Software\AskToolbar

Schlüssel Gelöscht : HKLM\Software\Babylon

Schlüssel Gelöscht : HKLM\Software\BabylonToolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\1ClicktorrentFile

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\1ClicktorrentFile1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{835315FC-1BF6-4CA9-80CD-F6C158D40692}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B16632F1-24E0-4D99-A68D-70BFB6447C48}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C0CEA572-2978-4DFC-A672-8100FF0E276A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\BabylonIEPI.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\BabylonTC.EXE

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\PriceGongIE.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\b

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Babylon.dskBnd

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BabylonIEPI.BabylonIEBho

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BabylonIEPI.BabylonIEBho.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BabylonOfficeAddin.OfficeAddin

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BabylonOfficeAddin.OfficeAddin.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BabylonTC.GingerApplication

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BabylonTC.GingerApplication.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylnApp.appCore

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylnApp.appCore.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{291BCCC1-6890-484A-89D3-318C928DAC1B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6AC0BB10-C922-45E2-857D-2A368FE749E5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9CFACCB6-2F3F-4177-94EA-0D2B72D384C1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C01315C7-B4E2-4864-B43D-5FAFC414D179}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C1545464-C77C-4130-A572-1C619E2895FE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DF390AA1-1E65-4825-B8E7-BE6B47BD56B8}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ED0E67AD-926C-4008-87E5-03CF72AA2A7E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EF7FEC6D-451B-4452-9D26-7E10C6B5DB6E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.IncredibarESrvc

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.IncredibarESrvc.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\I

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IncredibarApp.appCore

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IncredibarApp.appCore.1

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\7E685771E24E83F4381D1DB5A45F7B41

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\7E685771E24E83F4381D1DB5A45F7B41

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0194532A-A99C-4337-937E-2A452C8957BE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5F339F0B-716F-408F-A627-DEEB5DEB4020}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{95734BDE-B702-45B9-86E5-27676729F904}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B7EA2226-F876-4BE4-B478-76EBAE2A668A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D0482C8E-BAEA-4943-911A-B661060F56A7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FD8F79A0-D2E2-4FA2-AEAF-393EAC8064F7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\oneclick

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\oneclickmg

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2653012

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{48C9C8B0-A546-46C1-A81F-47A31E623E9D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}

Schlüssel Gelöscht : HKLM\Software\Conduit

Schlüssel Gelöscht : HKLM\Software\DealPly

Schlüssel Gelöscht : HKLM\Software\DomaIQ

Schlüssel Gelöscht : HKLM\Software\Freeze.com

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\gaiilaahiahdejapggenmdmafpmbipje

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\pmlghpafmmnmmkjdhacccolfgnkiboco

Schlüssel Gelöscht : HKLM\Software\incredibar.com

Schlüssel Gelöscht : HKLM\Software\InstallCore

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{F72841F0-4EF1-4DF5-BCE5-B3AC8ACF5478}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{219046AE-358F-4CF1-B1FD-2B4DE83642A8}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{74C36554-31F0-49DD-8857-ED6A64DF45BE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4A99-B4B6-146BF802613B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CFACCB6-2F3F-4177-94EA-0D2B72D384C1}

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\120DFADEB50841F408F04D2A278F9509

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2BDF3E992C0908741B7C11F4B4E0F775

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B3BC4CF5ECE1F54BBA174C13A1AB907

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B5BAE2ED018083A4C8DA86D6E3F4B024

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BEABAA33A5E68374DBF197F2A00CD011

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB61AF52AD64B6B45930BE969F316720

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\7E685771E24E83F4381D1DB5A45F7B41

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

Schlüssel Gelöscht : HKLM\Software\SP Global

Schlüssel Gelöscht : HKLM\Software\SProtector

Schlüssel Gelöscht : HKLM\Software\Web Assistant

Schlüssel Gelöscht : HKLM\Software\YourFileDownloader

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]

Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [{8a9386b4-e958-4c4c-adf4-8f26db3e4829}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v9.0.8112.16483
 

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=33360bb7-7237-4abc-a443-f4f7cfe757f5&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms} --> hxxp://www.google.com

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=33360bb7-7237-4abc-a443-f4f7cfe757f5&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms} --> hxxp://www.google.com

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\SearchUrl - Default] = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=33360bb7-7237-4abc-a443-f4f7cfe757f5&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms} --> hxxp://www.google.com
 

-\\ Google Chrome v27.0.1453.94
 

Datei : C:\Users\Sabine\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] Die Datei ist sauber.
 

-\\ Chromium v    _signature: HmhnKz09sWG3QvDiRrY4nqzGxAJfDVCg83FAAw10gpg=
 

Datei : C:\Users\Sabine\AppData\Local\Chromium\User Data\Default\Preferences
 

[OK] Die Datei ist sauber.
 

*************************
 

AdwCleaner[S1].txt - [23348 octets] - [01/06/2013 02:43:37]
 

########## EOF - C:\AdwCleaner[S1].txt - [23409 octets] ##########

Hi,
bitte Hitmanpro laden:
Hitman Pro - Download - Filepony
doppelklick, scan, nichts löschen.
Weiter, Log speichern unter, bzw als xml exportieren.
Posten, oder packen und anhängen

Hier die Log-Textdatei im Anhang.

hitmanpro alles gefundene löschen lassen, neustart, neues otl log

hier der neue OTl log

Code:

OTL logfile created on: 03.06.2013 18:34:06 - Run 3

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Sabine\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,19 Gb Total Physical Memory | 2,16 Gb Available Physical Memory | 67,86% Memory free

6,60 Gb Paging File | 5,60 Gb Available in Paging File | 84,84% Paging File free

Paging file location(s): c:\pagefile.sys 0 0 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 931,51 Gb Total Space | 584,02 Gb Free Space | 62,70% Space Free | Partition Type: NTFS

Drive D: | 436,59 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

 

Computer Name: SABINE-PC | User Name: Sabine | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2013.06.03 17:05:25 | 000,106,280 | ---- | M] (SurfRight B.V.) -- C:\Programme\HitmanPro\hmpsched.exe

PRC - [2013.05.16 01:02:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sabine\Desktop\OTL.exe

PRC - [2013.05.15 12:08:44 | 001,435,984 | ---- | M] (LogMeIn Inc.) -- C:\Programme\LogMeIn Hamachi\hamachi-2.exe

PRC - [2013.05.13 13:56:02 | 002,245,232 | ---- | M] (Giraffic) -- C:\Programme\Giraffic\Veoh_GirafficWatchdog.exe

PRC - [2013.05.13 13:55:30 | 004,001,376 | ---- | M] (Giraffic) -- C:\Programme\Giraffic\Veoh_Giraffic.exe

PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2013.04.23 14:48:24 | 000,009,216 | ---- | M] (Hi-Rez Studios) -- C:\Programme\Hi-Rez Studios\HiPatchService.exe

PRC - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware ger\mbamservice.exe

PRC - [2013.04.04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware ger\mbamgui.exe

PRC - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware ger\mbamscheduler.exe

PRC - [2013.01.18 16:21:02 | 000,873,248 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe

PRC - [2013.01.18 16:21:00 | 001,821,984 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvtray.exe

PRC - [2013.01.18 08:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2012.07.18 18:04:42 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2012.07.18 18:04:33 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2012.07.18 18:04:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2012.07.18 18:04:22 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2009.11.10 12:09:50 | 000,414,000 | ---- | M] (MKS Software Inc.) -- C:\Windows\System32\nutsrv4.exe

PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2009.04.11 08:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe

 

 
 ========== Modules (No Company Name) ==========

 

 
 ========== Services (SafeList) ==========

 

SRV - File not found [On_Demand | Stopped] -- C:\PROGRA~2\qeto08.dat -- (Winmgmt)

SRV - [2013.06.03 17:05:25 | 000,106,280 | ---- | M] (SurfRight B.V.) [Auto | Running] -- C:\Programme\HitmanPro\hmpsched.exe -- (HitmanProScheduler)

SRV - [2013.05.31 22:58:22 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2013.05.15 12:08:44 | 001,435,984 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Programme\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)

SRV - [2013.05.13 13:56:02 | 002,245,232 | ---- | M] (Giraffic) [Auto | Running] -- C:\Programme\Giraffic\Veoh_GirafficWatchdog.exe -- (Giraffic)

SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2013.05.04 01:35:30 | 000,543,656 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2013.04.23 14:48:24 | 000,009,216 | ---- | M] (Hi-Rez Studios) [Auto | Running] -- C:\Programme\Hi-Rez Studios\HiPatchService.exe -- (HiPatchService)

SRV - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware ger\mbamservice.exe -- (MBAMService)

SRV - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware ger\mbamscheduler.exe -- (MBAMScheduler)

SRV - [2013.02.28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2013.02.26 00:22:34 | 001,260,320 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)

SRV - [2013.01.18 08:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2012.07.18 18:04:33 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012.07.18 18:04:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2009.11.10 12:09:50 | 000,414,000 | ---- | M] (MKS Software Inc.) [Auto | Running] -- C:\Windows\System32\nutsrv4.exe -- (NuTCRACKERService)

SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\vpnva.sys -- (vpnva)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\RTL8192su.sys -- (RTL8192su)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\RTKVHDA.sys -- (IntcAzAudAddService)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\Drivers\AsrCDDrv.sys -- (AsrCDDrv)

DRV - [2013.06.03 18:09:24 | 000,030,464 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hitmanpro37.sys -- (hitmanpro37)

DRV - [2013.04.04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2013.02.26 00:22:06 | 008,939,296 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2012.07.18 18:04:42 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2012.07.18 18:04:42 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2012.07.18 18:04:42 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.09.14 14:22:10 | 000,120,840 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SaiKA50A.sys -- (SaiKA50A)

DRV - [2009.09.14 14:22:10 | 000,035,336 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SaiUA50A.sys -- (SaiUA50A)

DRV - [2009.09.14 08:28:04 | 000,043,656 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SaiBus.sys -- (SaiNtBus)

DRV - [2009.09.14 08:28:04 | 000,020,744 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SaiMini.sys -- (SaiMini)

DRV - [2009.03.18 16:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)

DRV - [2008.08.06 10:26:08 | 000,124,928 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)

DRV - [2007.09.21 10:38:22 | 000,554,496 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr28u.sys -- (netr28u)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=tugumsd&cd=2XzuyEtN2Y1L1Qzu0B0CyD0F0FyEtD0D0A0FyD0E0AtDzzyDtN0D0Tzu0CyEzytCtN1L2XzutBtFtBtFtCtFyCtCzztN1L1Czu2Z2Y1N2Y1H1B1Q&cr=1207875316&ir=

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{072E35EC-1E3A-F4EA-65B0-0D7D63EAC49F}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.10011&barid={2AA40F9D-2317-4856-B88D-A0CD65219231}

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=tugumsd&cd=2XzuyEtN2Y1L1Qzu0B0CyD0F0FyEtD0D0A0FyD0E0AtDzzyDtN0D0Tzu0CyEzytCtN1L2XzutBtFtBtFtCtFyCtCzztN1L1Czu2Z2Y1N2Y1H1B1Q&cr=1207875316&ir=

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com

IE - HKCU\..\URLSearchHook: {cd90bf73-20f6-44ef-993d-bb920303bd2e} - No CLSID value found

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{072E35EC-1E3A-F4EA-65B0-0D7D63EAC49F}: "URL" = hxxp://mixidj.claro-search.com/?q={searchTerms}&affID=121139&tt=3612_3&babsrc=SP_ss&mntrId=70aba0850000000000000022436bc8dd

IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{D7A5C187-ED99-4C30-8795-5CAD44133D98}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2653012

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 
 ========== FireFox ==========

 

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Users\Sabine\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)

FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

 

 

[2013.05.05 18:55:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sabine\AppData\Roaming\mozilla\firefox\Profiles\extensions

[2013.05.31 21:49:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sabine\AppData\Roaming\mozilla\firefox\Profiles\extensions\extensions

[2012.09.06 18:36:08 | 000,000,000 | ---D | M] (OneClickDownloader) -- C:\Users\Sabine\AppData\Roaming\mozilla\firefox\Profiles\extensions\OneClickDownload@OneClickDownload.com

[2013.05.05 18:55:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sabine\AppData\Roaming\mozilla\firefox\Profiles\extensions\searchplugins

[2013.05.05 18:55:30 | 000,000,000 | ---D | M] (MySearchDial) -- C:\Users\Sabine\AppData\Roaming\mozilla\firefox\Profiles\extensions\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}

[2013.05.31 21:49:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sabine\AppData\Roaming\mozilla\firefox\Profiles\toolbar@ask.com\extensions

[2013.05.05 18:55:32 | 000,000,000 | ---D | M] (MySearchDial) -- C:\Users\Sabine\AppData\Roaming\mozilla\firefox\Profiles\toolbar@ask.com\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}

[2013.02.10 14:33:15 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

 
 ========== Chrome  ==========

 

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll

CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\pdf.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll

CHR - plugin: Java(TM) Platform SE 7 U21 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll

CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll

CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll

CHR - plugin: AmazonMP3DownloaderPlugin (Enabled) = C:\Users\Sabine\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll

CHR - plugin: Java Deployment Toolkit 7.0.210.11 (Enabled) = C:\Windows\system32\npDeployJava1.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

 

O1 HOSTS File: ([2013.05.17 14:39:16 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (WebCGMHlprObj Class) - {56B38F40-4E70-11d4-A076-0080AD86BA2F} - C:\Windows\System32\cgmopenbho.dll (CGM Open Consortium, Inc.)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CD90BF73-20F6-44EF-993D-BB920303BD2E} - No CLSID value found.

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)

O4 - HKLM..\Run: [NuTCSetupEnviron] C:\Programme\PTC\MKS Toolkit\bin\ncoeenv.exe (MKS Software Inc.)

O4 - HKCU..\Run: [Ahytovl] C:\Users\Sabine\AppData\Roaming\Poyrra\zedo.exe File not found

O4 - HKCU..\Run: [ctfmon32.exe] C:\PROGRA~2\rundll32.exe C:\PROGRA~2\qeto08.dat,XFG00 File not found

O4 - HKCU..\Run: [IExplorer Util] C:\Users\Sabine\AppData\Roaming\ie_util.exe File not found

O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)

O4 - Startup: C:\Users\Sabine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\nutafun4.dll (MKS Software Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\nutafun4.dll (MKS Software Inc.)

O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)

O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)

O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)

O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)

O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)

O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)

O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.6.2.cab (DLM Control)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B7CC0766-2E6A-42BF-8B72-7A20ED70B36A}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E0797513-0FF2-4E11-AB21-5E74FF1D48A3}: DhcpNameServer = 192.168.178.1

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\Sabine\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\Sabine\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2006.03.24 13:06:41 | 000,000,053 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.06.02 22:05:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro

[2013.06.02 22:05:38 | 000,000,000 | ---D | C] -- C:\Program Files\HitmanPro

[2013.06.02 22:05:17 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro

[2013.06.02 22:04:45 | 000,000,000 | ---D | C] -- C:\Users\Sabine\Desktop\HitmanPro_3.7.5.199

[2013.05.31 23:08:34 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe

[2013.05.31 23:03:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

[2013.05.31 22:58:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Google

[2013.05.31 21:14:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2013.05.31 21:13:31 | 000,000,000 | ---D | C] -- C:\Program Files\Java

[2013.05.31 20:14:06 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2013.05.31 00:25:03 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Roaming\pim

[2013.05.30 19:26:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2013.05.30 19:26:53 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2013.05.30 19:19:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware ger

[2013.05.30 19:19:22 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware ger

[2013.05.30 18:49:34 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2013.05.30 18:49:34 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2013.05.28 15:32:47 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Roaming\Malwarebytes

[2013.05.28 15:32:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2013.05.28 15:32:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2013.05.24 03:00:16 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\rundll32.exe

[2013.05.23 23:17:19 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Roaming\Poyrra

[2013.05.23 23:17:19 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Roaming\Cuig

[2013.05.23 23:17:19 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Roaming\Aztuup

[2013.05.23 23:02:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi

[2013.05.23 23:02:52 | 000,000,000 | ---D | C] -- C:\Program Files\LogMeIn Hamachi

[2013.05.17 14:52:53 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2013.05.17 14:41:46 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN

[2013.05.17 14:38:55 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\temp

[2013.05.17 14:23:15 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2013.05.17 14:23:15 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2013.05.17 14:23:15 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2013.05.17 14:23:11 | 000,000,000 | ---D | C] -- C:\ComboFix

[2013.05.17 14:23:06 | 000,000,000 | ---D | C] -- C:\Qoobox

[2013.05.17 13:26:08 | 000,000,000 | ---D | C] -- C:\Windows\erdnt

[2013.05.17 13:24:48 | 005,066,411 | R--- | C] (Swearware) -- C:\Users\Sabine\Desktop\ComboFix.exe

[2013.05.16 21:09:21 | 000,000,000 | ---D | C] -- C:\TDSSKiller Log

[2013.05.16 02:07:45 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Roaming\Wuqao

[2013.05.16 02:07:45 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Roaming\Tayv

[2013.05.16 01:40:06 | 002,237,968 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Sabine\Desktop\tdsskiller.exe

[2013.05.16 01:04:57 | 000,000,000 | ---D | C] -- C:\_OTL

[2013.05.15 16:05:37 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Sabine\Desktop\OTL.exe

[2013.05.12 14:11:36 | 000,000,000 | ---D | C] -- C:\Users\Sabine\Documents\Amazon MP3

[2013.05.12 14:11:36 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon

[2013.05.12 14:11:03 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\Program Files

[2013.05.05 23:32:04 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\Game Dev Tycoon

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.06.03 18:09:52 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2013.06.03 18:09:26 | 000,004,112 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2013.06.03 18:09:26 | 000,004,112 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2013.06.03 18:09:24 | 000,030,464 | ---- | M] () -- C:\Windows\System32\drivers\hitmanpro37.sys

[2013.06.03 18:09:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.06.03 18:09:11 | 3421,822,976 | -HS- | M] () -- C:\hiberfil.sys

[2013.06.03 18:08:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2013.06.03 17:40:23 | 000,000,840 | ---- | M] () -- C:\Windows\System32\.crusader

[2013.06.03 17:09:01 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2013.06.02 22:18:44 | 000,002,011 | ---- | M] () -- C:\Users\Sabine\Documents\HitmanPro_20130602_2217.zip

[2013.06.02 22:05:39 | 000,001,744 | ---- | M] () -- C:\Users\Public\Desktop\HitmanPro.lnk

[2013.05.31 23:10:40 | 000,001,971 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2013.05.31 23:09:14 | 000,001,892 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk

[2013.05.31 23:01:05 | 000,632,031 | ---- | M] () -- C:\Users\Sabine\Desktop\adwcleaner.exe

[2013.05.31 09:00:37 | 000,000,004 | ---- | M] () -- C:\Users\Sabine\AppData\Roaming\skype.ini

[2013.05.31 08:58:32 | 000,258,056 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2013.05.30 19:26:54 | 000,000,804 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2013.05.29 22:58:59 | 095,023,320 | ---- | M] () -- C:\ProgramData\80oteq.pad

[2013.05.29 22:29:48 | 000,002,669 | ---- | M] () -- C:\ProgramData\80oteq.js

[2013.05.29 17:32:57 | 000,671,212 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2013.05.29 17:32:57 | 000,631,942 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2013.05.29 17:32:57 | 000,144,380 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2013.05.29 17:32:57 | 000,118,568 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2013.05.24 03:00:16 | 000,155,648 | ---- | M] () -- C:\ProgramData\4lo9qe.dat

[2013.05.17 14:39:16 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2013.05.17 14:05:13 | 000,001,356 | ---- | M] () -- C:\Users\Sabine\AppData\Local\d3d9caps.dat

[2013.05.17 13:25:01 | 005,066,411 | R--- | M] (Swearware) -- C:\Users\Sabine\Desktop\ComboFix.exe

[2013.05.16 21:10:02 | 000,023,832 | ---- | M] () -- C:\TDSSKiller Log.zip

[2013.05.16 01:40:06 | 002,237,968 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Sabine\Desktop\tdsskiller.exe

[2013.05.16 01:02:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sabine\Desktop\OTL.exe

[2013.05.15 16:21:00 | 000,377,856 | ---- | M] () -- C:\Users\Sabine\Desktop\gmer_2.1.19163.exe

[2013.05.15 16:03:30 | 000,000,000 | ---- | M] () -- C:\Users\Sabine\defogger_reenable

[2013.05.15 16:02:35 | 000,050,477 | ---- | M] () -- C:\Users\Sabine\Desktop\Defogger.exe

 
 ========== Files Created - No Company Name ==========

 

[2013.06.03 18:09:24 | 000,030,464 | ---- | C] () -- C:\Windows\System32\drivers\hitmanpro37.sys

[2013.06.03 17:40:23 | 000,000,840 | ---- | C] () -- C:\Windows\System32\.crusader

[2013.06.02 22:18:44 | 000,002,011 | ---- | C] () -- C:\Users\Sabine\Documents\HitmanPro_20130602_2217.zip

[2013.06.02 22:05:39 | 000,001,744 | ---- | C] () -- C:\Users\Public\Desktop\HitmanPro.lnk

[2013.05.31 23:09:14 | 000,002,425 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

[2013.05.31 23:09:14 | 000,001,892 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk

[2013.05.31 23:03:35 | 000,001,971 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2013.05.31 23:01:05 | 000,632,031 | ---- | C] () -- C:\Users\Sabine\Desktop\adwcleaner.exe

[2013.05.31 22:58:42 | 000,001,098 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2013.05.31 22:58:41 | 000,001,094 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2013.05.31 22:58:26 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2013.05.31 01:14:49 | 000,000,004 | ---- | C] () -- C:\Users\Sabine\AppData\Roaming\skype.ini

[2013.05.30 19:26:54 | 000,000,804 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2013.05.30 18:31:09 | 3421,822,976 | -HS- | C] () -- C:\hiberfil.sys

[2013.05.29 22:29:48 | 000,002,669 | ---- | C] () -- C:\ProgramData\80oteq.js

[2013.05.29 22:29:46 | 095,023,320 | ---- | C] () -- C:\ProgramData\80oteq.pad

[2013.05.24 03:00:16 | 000,155,648 | ---- | C] () -- C:\ProgramData\4lo9qe.dat

[2013.05.17 14:23:15 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2013.05.17 14:23:15 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2013.05.17 14:23:15 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2013.05.17 14:23:15 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2013.05.17 14:23:15 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2013.05.16 21:10:02 | 000,023,832 | ---- | C] () -- C:\TDSSKiller Log.zip

[2013.05.15 16:21:00 | 000,377,856 | ---- | C] () -- C:\Users\Sabine\Desktop\gmer_2.1.19163.exe

[2013.05.15 16:03:30 | 000,000,000 | ---- | C] () -- C:\Users\Sabine\defogger_reenable

[2013.05.15 16:03:01 | 000,050,477 | ---- | C] () -- C:\Users\Sabine\Desktop\Defogger.exe

[2013.02.10 14:29:46 | 000,000,058 | ---- | C] () -- C:\Users\Sabine\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat

[2012.09.12 20:39:54 | 000,003,584 | ---- | C] () -- C:\Users\Sabine\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.09.09 18:13:15 | 000,000,410 | ---- | C] () -- C:\Windows\{27018D57-D152-44EF-BCE0-5E3B3445EABE}_WiseFW.ini

[2012.08.13 16:51:33 | 000,111,932 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat

[2012.08.13 16:51:33 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat

[2012.08.13 16:51:33 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat

[2012.08.13 16:51:33 | 000,026,154 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat

[2012.08.13 16:51:33 | 000,024,903 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat

[2012.08.13 16:51:33 | 000,021,390 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat

[2012.08.13 16:51:33 | 000,020,148 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat

[2012.08.13 16:51:33 | 000,011,811 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat

[2012.08.13 16:51:33 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat

[2012.08.13 16:51:33 | 000,001,146 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_DU.dat

[2012.08.13 16:51:33 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat

[2012.08.13 16:51:33 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat

[2012.08.13 16:51:33 | 000,001,136 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat

[2012.08.13 16:51:33 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat

[2012.08.13 16:51:33 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat

[2012.08.13 16:51:33 | 000,001,120 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_IT.dat

[2012.08.13 16:51:33 | 000,001,107 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_GE.dat

[2012.08.13 16:51:33 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat

[2012.08.13 16:51:33 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini

[2012.08.10 18:13:48 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2012.08.10 18:13:48 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2012.08.10 16:58:44 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2012.08.10 15:52:37 | 000,001,356 | ---- | C] () -- C:\Users\Sabine\AppData\Local\d3d9caps.dat

[2011.09.28 17:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat

 
 ========== ZeroAccess Check ==========

 

[2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 
 ========== LOP Check ==========

 

[2013.03.21 22:48:39 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\Awesomium

[2013.05.28 15:37:03 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\Aztuup

[2013.03.01 01:24:14 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\com.stoicstudio.TheBannerSagaFactions

[2013.05.23 23:17:19 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\Cuig

[2013.06.01 02:34:38 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\DAEMON Tools Lite

[2013.02.10 14:29:46 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\DonationCoder

[2012.08.14 22:51:36 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\Downloaded Installations

[2012.10.09 20:33:56 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\e-academy Inc

[2013.05.31 00:54:45 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\Epson

[2012.08.11 19:37:22 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\LolClient

[2012.08.18 18:52:37 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\Mumble

[2012.09.05 01:16:10 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\OpenOffice.org

[2013.05.31 20:45:14 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\pim

[2013.05.31 21:00:37 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\player

[2013.05.28 15:41:47 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\Poyrra

[2012.09.01 19:41:40 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\RenPy

[2012.08.11 17:58:33 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\Smart PC Cleaner

[2013.01.30 19:10:36 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\SplitMediaLabs

[2013.05.16 23:34:26 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\Tayv

[2013.06.03 00:19:01 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\TS3Client

[2013.02.10 14:36:22 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\TuneUp Software

[2013.05.16 02:07:45 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\Wuqao

 
 ========== Purity Check ==========

 

 

 
 ========== Files - Unicode (All) ==========

[2013.05.03 09:15:28 | 000,000,000 | ---D | M](C:\ProgramData\?!?!0) -- C:\ProgramData\䋠ǃ㾐ǃ0

[2013.05.03 09:15:28 | 000,000,000 | ---D | M](C:\ProgramData\?!?!0) -- C:\ProgramData\䋠ǃ㾐ǃ0

[2013.05.02 14:25:00 | 000,000,000 | ---D | M](C:\ProgramData\?U?U0) -- C:\ProgramData\䋠Ű㾐Ű0

[2013.05.02 14:25:00 | 000,000,000 | ---D | M](C:\ProgramData\?U?U0) -- C:\ProgramData\䋠Ű㾐Ű0

[2013.04.30 08:40:44 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ƹ㾐ƹ0

[2013.04.30 08:40:44 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ƹ㾐ƹ0

[2013.04.28 11:33:04 | 000,000,000 | ---D | M](C:\ProgramData\?w?w0) -- C:\ProgramData\䋠w㾐w0

[2013.04.28 11:33:04 | 000,000,000 | ---D | M](C:\ProgramData\?w?w0) -- C:\ProgramData\䋠w㾐w0

[2013.04.27 11:49:21 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ƅ㾐ƅ0

[2013.04.27 11:49:21 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ƅ㾐ƅ0

[2013.04.25 12:04:43 | 000,000,000 | ---D | M](C:\ProgramData\?T?T0) -- C:\ProgramData\䋠Ʈ㾐Ʈ0

[2013.04.25 12:04:43 | 000,000,000 | ---D | M](C:\ProgramData\?T?T0) -- C:\ProgramData\䋠Ʈ㾐Ʈ0

[2013.04.24 16:30:48 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ǋ㾐ǋ0

[2013.04.24 16:30:48 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ǋ㾐ǋ0

[2013.04.22 17:24:23 | 000,000,000 | ---D | M](C:\ProgramData\?Œ?Œ0) -- C:\ProgramData\䋠Œ㾐Œ0

[2013.04.22 17:24:23 | 000,000,000 | ---D | M](C:\ProgramData\?Œ?Œ0) -- C:\ProgramData\䋠Œ㾐Œ0

[2013.04.22 08:05:32 | 000,000,000 | ---D | M](C:\ProgramData\?Y?Y0) -- C:\ProgramData\䋠Ŷ㾐Ŷ0

[2013.04.22 08:05:32 | 000,000,000 | ---D | M](C:\ProgramData\?Y?Y0) -- C:\ProgramData\䋠Ŷ㾐Ŷ0

[2013.04.21 09:57:11 | 000,000,000 | ---D | M](C:\ProgramData\?S?S0) -- C:\ProgramData\䋠Ş㾐Ş0

[2013.04.21 09:57:11 | 000,000,000 | ---D | M](C:\ProgramData\?S?S0) -- C:\ProgramData\䋠Ş㾐Ş0

[2013.04.20 18:38:32 | 000,000,000 | ---D | M](C:\ProgramData\?Ú?Ú0) -- C:\ProgramData\䋠Ú㾐Ú0

[2013.04.20 18:38:32 | 000,000,000 | ---D | M](C:\ProgramData\?Ú?Ú0) -- C:\ProgramData\䋠Ú㾐Ú0

[2013.04.18 17:04:39 | 000,000,000 | ---D | M](C:\ProgramData\?.?.0) -- C:\ProgramData\䋠.㾐.0

[2013.04.18 17:04:39 | 000,000,000 | ---D | M](C:\ProgramData\?.?.0) -- C:\ProgramData\䋠.㾐.0

[2013.04.16 09:49:15 | 000,000,000 | ---D | M](C:\ProgramData\??0) -- C:\ProgramData\䋠㾐0

[2013.04.16 09:49:15 | 000,000,000 | ---D | M](C:\ProgramData\??0) -- C:\ProgramData\䋠㾐0

[2013.04.14 18:18:18 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ƨ㾐ƨ0

[2013.04.14 18:18:18 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ƨ㾐ƨ0

[2013.04.13 22:31:51 | 000,000,000 | ---D | M](C:\ProgramData\??0) -- C:\ProgramData\䋠㾐0

[2013.04.13 22:31:51 | 000,000,000 | ---D | M](C:\ProgramData\??0) -- C:\ProgramData\䋠㾐0

[2013.04.13 10:02:23 | 000,000,000 | ---D | M](C:\ProgramData\?ç?ç0) -- C:\ProgramData\䋠ç㾐ç0

[2013.04.13 10:02:23 | 000,000,000 | ---D | M](C:\ProgramData\?ç?ç0) -- C:\ProgramData\䋠ç㾐ç0

[2013.04.12 16:10:01 | 000,000,000 | ---D | M](C:\ProgramData\?5?50) -- C:\ProgramData\䋠5㾐50

[2013.04.12 16:10:01 | 000,000,000 | ---D | M](C:\ProgramData\?5?50) -- C:\ProgramData\䋠5㾐50

[2013.04.10 11:48:11 | 000,000,000 | ---D | M](C:\ProgramData\?U?U0) -- C:\ProgramData\䋠Ư㾐Ư0

[2013.04.10 11:48:11 | 000,000,000 | ---D | M](C:\ProgramData\?U?U0) -- C:\ProgramData\䋠Ư㾐Ư0

[2013.04.09 18:19:19 | 000,000,000 | ---D | M](C:\ProgramData\?É?É0) -- C:\ProgramData\䋠É㾐É0

[2013.04.09 18:19:19 | 000,000,000 | ---D | M](C:\ProgramData\?É?É0) -- C:\ProgramData\䋠É㾐É0

[2013.04.07 05:25:55 | 000,000,000 | ---D | M](C:\ProgramData\?ø?ø0) -- C:\ProgramData\䋠ø㾐ø0

[2013.04.07 05:25:55 | 000,000,000 | ---D | M](C:\ProgramData\?ø?ø0) -- C:\ProgramData\䋠ø㾐ø0

[2013.04.05 15:12:20 | 000,000,000 | ---D | M](C:\ProgramData\?-?-0) -- C:\ProgramData\䋠-㾐-0

[2013.04.05 15:12:20 | 000,000,000 | ---D | M](C:\ProgramData\?-?-0) -- C:\ProgramData\䋠-㾐-0

[2013.04.03 10:45:42 | 000,000,000 | ---D | M](C:\ProgramData\?C?C0) -- C:\ProgramData\䋠C㾐C0

[2013.04.03 10:45:42 | 000,000,000 | ---D | M](C:\ProgramData\?C?C0) -- C:\ProgramData\䋠C㾐C0

[2013.04.01 12:17:02 | 000,000,000 | ---D | M](C:\ProgramData\?t?t0) -- C:\ProgramData\䋠ƫ㾐ƫ0

[2013.04.01 12:17:02 | 000,000,000 | ---D | M](C:\ProgramData\?t?t0) -- C:\ProgramData\䋠ƫ㾐ƫ0

[2013.03.30 12:40:00 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠–㾐–0

[2013.03.30 12:40:00 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠–㾐–0

[2013.03.25 15:07:36 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ǂ㾐ǂ0

[2013.03.25 15:07:36 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ǂ㾐ǂ0

[2013.03.24 12:01:06 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠Ǉ㾐Ǉ0

[2013.03.24 12:01:06 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠Ǉ㾐Ǉ0

[2013.03.24 06:31:25 | 000,000,000 | ---D | M](C:\ProgramData\?ü?ü0) -- C:\ProgramData\䋠ü㾐ü0

[2013.03.24 06:31:25 | 000,000,000 | ---D | M](C:\ProgramData\?ü?ü0) -- C:\ProgramData\䋠ü㾐ü0

[2013.03.23 11:54:35 | 000,000,000 | ---D | M](C:\ProgramData\?ë?ë0) -- C:\ProgramData\䋠ë㾐ë0

[2013.03.23 11:54:35 | 000,000,000 | ---D | M](C:\ProgramData\?ë?ë0) -- C:\ProgramData\䋠ë㾐ë0

[2013.03.22 08:03:13 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠˜㾐˜0

[2013.03.22 08:03:13 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠˜㾐˜0

[2013.03.21 16:33:01 | 000,000,000 | ---D | M](C:\ProgramData\?L?L0) -- C:\ProgramData\䋠L㾐L0

[2013.03.21 16:33:01 | 000,000,000 | ---D | M](C:\ProgramData\?L?L0) -- C:\ProgramData\䋠L㾐L0

[2013.03.21 15:35:42 | 000,000,000 | ---D | M](C:\ProgramData\?E?E0) -- C:\ProgramData\䋠Ē㾐Ē0

[2013.03.21 15:35:42 | 000,000,000 | ---D | M](C:\ProgramData\?E?E0) -- C:\ProgramData\䋠Ē㾐Ē0

[2013.03.19 16:23:21 | 000,000,000 | ---D | M](C:\ProgramData\?D?D0) -- C:\ProgramData\䋠Ď㾐Ď0

[2013.03.19 16:23:21 | 000,000,000 | ---D | M](C:\ProgramData\?D?D0) -- C:\ProgramData\䋠Ď㾐Ď0

[2013.03.17 12:37:57 | 000,000,000 | ---D | M](C:\ProgramData\?A?A0) -- C:\ProgramData\䋠Ǟ㾐Ǟ0

[2013.03.17 12:37:57 | 000,000,000 | ---D | M](C:\ProgramData\?A?A0) -- C:\ProgramData\䋠Ǟ㾐Ǟ0

[2013.03.16 10:44:12 | 000,000,000 | ---D | M](C:\ProgramData\?3?30) -- C:\ProgramData\䋠3㾐30

[2013.03.16 10:44:12 | 000,000,000 | ---D | M](C:\ProgramData\?3?30) -- C:\ProgramData\䋠3㾐30

[2013.03.14 17:36:03 | 000,000,000 | ---D | M](C:\ProgramData\?ª?ª0) -- C:\ProgramData\䋠ª㾐ª0

[2013.03.14 17:36:03 | 000,000,000 | ---D | M](C:\ProgramData\?ª?ª0) -- C:\ProgramData\䋠ª㾐ª0

[2013.03.14 10:52:24 | 000,000,000 | ---D | M](C:\ProgramData\?M?M0) -- C:\ProgramData\䋠M㾐M0

[2013.03.14 10:52:24 | 000,000,000 | ---D | M](C:\ProgramData\?M?M0) -- C:\ProgramData\䋠M㾐M0

[2013.03.13 18:27:51 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠Ȍ㾐Ȍ0

[2013.03.13 18:27:51 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠Ȍ㾐Ȍ0

[2013.03.13 11:16:21 | 000,000,000 | ---D | M](C:\ProgramData\??0) -- C:\ProgramData\䋠㾐0

[2013.03.13 11:16:21 | 000,000,000 | ---D | M](C:\ProgramData\??0) -- C:\ProgramData\䋠㾐0

[2013.03.11 11:02:00 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠Ƿ㾐Ƿ0

[2013.03.11 11:02:00 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠Ƿ㾐Ƿ0

[2013.03.10 13:57:27 | 000,000,000 | ---D | M](C:\ProgramData\?c?c0) -- C:\ProgramData\䋠ć㾐ć0

[2013.03.10 13:57:27 | 000,000,000 | ---D | M](C:\ProgramData\?c?c0) -- C:\ProgramData\䋠ć㾐ć0

[2013.03.09 13:21:12 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ǵ㾐ǵ0

[2013.03.09 13:21:12 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ǵ㾐ǵ0

[2013.03.08 18:27:36 | 000,000,000 | ---D | M](C:\ProgramData\?U?U0) -- C:\ProgramData\䋠Ǖ㾐Ǖ0

[2013.03.08 18:27:36 | 000,000,000 | ---D | M](C:\ProgramData\?U?U0) -- C:\ProgramData\䋠Ǖ㾐Ǖ0

[2013.03.08 11:18:28 | 000,000,000 | ---D | M](C:\ProgramData\?D?D0) -- C:\ProgramData\䋠D㾐D0

[2013.03.08 11:18:28 | 000,000,000 | ---D | M](C:\ProgramData\?D?D0) -- C:\ProgramData\䋠D㾐D0

[2013.03.07 11:06:46 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠‰㾐‰0

[2013.03.07 11:06:46 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠‰㾐‰0

[2013.03.05 11:31:02 | 000,000,000 | ---D | M](C:\ProgramData\?u?u0) -- C:\ProgramData\䋠ǜ㾐ǜ0

[2013.03.05 11:31:02 | 000,000,000 | ---D | M](C:\ProgramData\?u?u0) -- C:\ProgramData\䋠ǜ㾐ǜ0

[2013.03.04 16:57:05 | 000,000,000 | ---D | M](C:\ProgramData\?6?60) -- C:\ProgramData\䋠6㾐60

[2013.03.04 16:57:05 | 000,000,000 | ---D | M](C:\ProgramData\?6?60) -- C:\ProgramData\䋠6㾐60

[2013.03.04 11:24:25 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ǹ㾐ǹ0

[2013.03.04 11:24:25 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ǹ㾐ǹ0

[2013.03.01 18:34:20 | 000,000,000 | ---D | M](C:\ProgramData\?E?E0) -- C:\ProgramData\䋠E㾐E0

[2013.03.01 18:34:20 | 000,000,000 | ---D | M](C:\ProgramData\?E?E0) -- C:\ProgramData\䋠E㾐E0

[2013.02.28 11:19:41 | 000,000,000 | ---D | M](C:\ProgramData\?U?U0) -- C:\ProgramData\䋠Ǘ㾐Ǘ0

[2013.02.28 11:19:41 | 000,000,000 | ---D | M](C:\ProgramData\?U?U0) -- C:\ProgramData\䋠Ǘ㾐Ǘ0

[2013.02.27 16:53:30 | 000,000,000 | ---D | M](C:\ProgramData\?'?'0) -- C:\ProgramData\䋠'㾐'0

[2013.02.27 16:53:30 | 000,000,000 | ---D | M](C:\ProgramData\?'?'0) -- C:\ProgramData\䋠'㾐'0

[2013.02.25 13:04:59 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ǯ㾐ǯ0

[2013.02.25 13:04:59 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ǯ㾐ǯ0

[2013.02.25 00:18:45 | 000,000,000 | ---D | M](C:\ProgramData\?Á?Á0) -- C:\ProgramData\䋠Á㾐Á0

[2013.02.25 00:18:45 | 000,000,000 | ---D | M](C:\ProgramData\?Á?Á0) -- C:\ProgramData\䋠Á㾐Á0

[2013.02.23 12:49:22 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ǆ㾐ǆ0

[2013.02.23 12:49:22 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ǆ㾐ǆ0

[2013.02.22 22:49:04 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ǡ㾐ǡ0

[2013.02.22 22:49:04 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ǡ㾐ǡ0

[2013.02.21 12:37:18 | 000,000,000 | ---D | M](C:\ProgramData\?i?i0) -- C:\ProgramData\䋠ǐ㾐ǐ0

[2013.02.21 12:37:18 | 000,000,000 | ---D | M](C:\ProgramData\?i?i0) -- C:\ProgramData\䋠ǐ㾐ǐ0

[2013.02.19 13:58:51 | 000,000,000 | ---D | M](C:\ProgramData\?O?O0) -- C:\ProgramData\䋠Ǭ㾐Ǭ0

[2013.02.19 13:58:51 | 000,000,000 | ---D | M](C:\ProgramData\?O?O0) -- C:\ProgramData\䋠Ǭ㾐Ǭ0

[2013.02.18 15:07:39 | 000,000,000 | ---D | M](C:\ProgramData\?{?{0) -- C:\ProgramData\䋠{㾐{0

[2013.02.18 15:07:39 | 000,000,000 | ---D | M](C:\ProgramData\?{?{0) -- C:\ProgramData\䋠{㾐{0

[2013.02.17 17:18:31 | 000,000,000 | ---D | M](C:\ProgramData\?g?g0) -- C:\ProgramData\䋠ĝ㾐ĝ0

[2013.02.17 17:18:31 | 000,000,000 | ---D | M](C:\ProgramData\?g?g0) -- C:\ProgramData\䋠ĝ㾐ĝ0

[2013.02.16 06:24:05 | 000,000,000 | ---D | M](C:\ProgramData\?K?K0) -- C:\ProgramData\䋠Ǩ㾐Ǩ0

[2013.02.16 06:24:05 | 000,000,000 | ---D | M](C:\ProgramData\?K?K0) -- C:\ProgramData\䋠Ǩ㾐Ǩ0

[2013.02.15 14:15:29 | 000,000,000 | ---D | M](C:\ProgramData\?g?g0) -- C:\ProgramData\䋠ǧ㾐ǧ0

[2013.02.15 14:15:29 | 000,000,000 | ---D | M](C:\ProgramData\?g?g0) -- C:\ProgramData\䋠ǧ㾐ǧ0

[2013.02.14 13:41:36 | 000,000,000 | ---D | M](C:\ProgramData\?c?c0) -- C:\ProgramData\䋠ċ㾐ċ0

[2013.02.14 13:41:36 | 000,000,000 | ---D | M](C:\ProgramData\?c?c0) -- C:\ProgramData\䋠ċ㾐ċ0

[2013.02.13 19:52:31 | 000,000,000 | ---D | M](C:\ProgramData\?R?R0) -- C:\ProgramData\䋠Ř㾐Ř0

[2013.02.13 19:52:31 | 000,000,000 | ---D | M](C:\ProgramData\?R?R0) -- C:\ProgramData\䋠Ř㾐Ř0

[2013.02.13 12:44:11 | 000,000,000 | ---D | M](C:\ProgramData\?A?A0) -- C:\ProgramData\䋠Ă㾐Ă0

[2013.02.13 12:44:11 | 000,000,000 | ---D | M](C:\ProgramData\?A?A0) -- C:\ProgramData\䋠Ă㾐Ă0

[2013.02.12 20:45:33 | 000,000,000 | ---D | M](C:\ProgramData\?å?å0) -- C:\ProgramData\䋠å㾐å0

[2013.02.12 20:45:33 | 000,000,000 | ---D | M](C:\ProgramData\?å?å0) -- C:\ProgramData\䋠å㾐å0

[2013.02.12 12:56:50 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ǝ㾐ǝ0

[2013.02.12 12:56:50 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠ǝ㾐ǝ0

[2013.02.11 14:01:44 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠Ǳ㾐Ǳ0

[2013.02.11 14:01:44 | 000,000,000 | ---D | M](C:\ProgramData\????0) -- C:\ProgramData\䋠Ǳ㾐Ǳ0

(C:\ProgramData\?Y?Y0) -- C:\ProgramData\䋠Ŷ㾐Ŷ0

(C:\ProgramData\?w?w0) -- C:\ProgramData\䋠w㾐w0

(C:\ProgramData\?ü?ü0) -- C:\ProgramData\䋠ü㾐ü0

(C:\ProgramData\?Ú?Ú0) -- C:\ProgramData\䋠Ú㾐Ú0

(C:\ProgramData\?U?U0) -- C:\ProgramData\䋠Ư㾐Ư0

(C:\ProgramData\?U?U0) -- C:\ProgramData\䋠Ǖ㾐Ǖ0

(C:\ProgramData\?u?u0) -- C:\ProgramData\䋠ǜ㾐ǜ0

(C:\ProgramData\?U?U0) -- C:\ProgramData\䋠Ǘ㾐Ǘ0

(C:\ProgramData\?U?U0) -- C:\ProgramData\䋠Ű㾐Ű0

(C:\ProgramData\?T?T0) -- C:\ProgramData\䋠Ʈ㾐Ʈ0

(C:\ProgramData\?t?t0) -- C:\ProgramData\䋠ƫ㾐ƫ0

(C:\ProgramData\?S?S0) -- C:\ProgramData\䋠Ş㾐Ş0

(C:\ProgramData\?R?R0) -- C:\ProgramData\䋠Ř㾐Ř0

(C:\ProgramData\?Œ?Œ0) -- C:\ProgramData\䋠Œ㾐Œ0

(C:\ProgramData\?ø?ø0) -- C:\ProgramData\䋠ø㾐ø0

(C:\ProgramData\?O?O0) -- C:\ProgramData\䋠Ǭ㾐Ǭ0

(C:\ProgramData\?M?M0) -- C:\ProgramData\䋠M㾐M0

(C:\ProgramData\?L?L0) -- C:\ProgramData\䋠L㾐L0

(C:\ProgramData\?K?K0) -- C:\ProgramData\䋠Ǩ㾐Ǩ0

(C:\ProgramData\?i?i0) -- C:\ProgramData\䋠ǐ㾐ǐ0

(C:\ProgramData\?g?g0) -- C:\ProgramData\䋠ǧ㾐ǧ0

(C:\ProgramData\?g?g0) -- C:\ProgramData\䋠ĝ㾐ĝ0

(C:\ProgramData\?ë?ë0) -- C:\ProgramData\䋠ë㾐ë0

(C:\ProgramData\?É?É0) -- C:\ProgramData\䋠É㾐É0

(C:\ProgramData\?E?E0) -- C:\ProgramData\䋠Ē㾐Ē0

(C:\ProgramData\?E?E0) -- C:\ProgramData\䋠E㾐E0

(C:\ProgramData\?D?D0) -- C:\ProgramData\䋠Ď㾐Ď0

(C:\ProgramData\?D?D0) -- C:\ProgramData\䋠D㾐D0

(C:\ProgramData\?ç?ç0) -- C:\ProgramData\䋠ç㾐ç0

(C:\ProgramData\?c?c0) -- C:\ProgramData\䋠ċ㾐ċ0

(C:\ProgramData\?c?c0) -- C:\ProgramData\䋠ć㾐ć0

(C:\ProgramData\?C?C0) -- C:\ProgramData\䋠C㾐C0

(C:\ProgramData\?å?å0) -- C:\ProgramData\䋠å㾐å0

(C:\ProgramData\?Á?Á0) -- C:\ProgramData\䋠Á㾐Á0

(C:\ProgramData\?ª?ª0) -- C:\ProgramData\䋠ª㾐ª0

(C:\ProgramData\?A?A0) -- C:\ProgramData\䋠Ǟ㾐Ǟ0

(C:\ProgramData\?A?A0) -- C:\ProgramData\䋠Ă㾐Ă0

(C:\ProgramData\?6?60) -- C:\ProgramData\䋠6㾐60

(C:\ProgramData\?5?50) -- C:\ProgramData\䋠5㾐50

(C:\ProgramData\?3?30) -- C:\ProgramData\䋠3㾐30

(C:\ProgramData\??0) -- C:\ProgramData\䋠㾐0

(C:\ProgramData\??0) -- C:\ProgramData\䋠㾐0

(C:\ProgramData\??0) -- C:\ProgramData\䋠㾐0

(C:\ProgramData\?{?{0) -- C:\ProgramData\䋠{㾐{0

(C:\ProgramData\?-?-0) -- C:\ProgramData\䋠-㾐-0

(C:\ProgramData\?'?'0) -- C:\ProgramData\䋠'㾐'0

(C:\ProgramData\????0) -- C:\ProgramData\䋠ƹ㾐ƹ0

(C:\ProgramData\????0) -- C:\ProgramData\䋠ǯ㾐ǯ0

(C:\ProgramData\????0) -- C:\ProgramData\䋠ƨ㾐ƨ0

(C:\ProgramData\????0) -- C:\ProgramData\䋠Ƿ㾐Ƿ0

(C:\ProgramData\????0) -- C:\ProgramData\䋠Ȍ㾐Ȍ0

(C:\ProgramData\????0) -- C:\ProgramData\䋠ǹ㾐ǹ0

(C:\ProgramData\????0) -- C:\ProgramData\䋠ǋ㾐ǋ0

(C:\ProgramData\????0) -- C:\ProgramData\䋠Ǉ㾐Ǉ0

(C:\ProgramData\????0) -- C:\ProgramData\䋠ǵ㾐ǵ0

(C:\ProgramData\????0) -- C:\ProgramData\䋠ǝ㾐ǝ0

(C:\ProgramData\????0) -- C:\ProgramData\䋠ǆ㾐ǆ0

(C:\ProgramData\????0) -- C:\ProgramData\䋠Ǳ㾐Ǳ0

(C:\ProgramData\????0) -- C:\ProgramData\䋠ƅ㾐ƅ0

(C:\ProgramData\????0) -- C:\ProgramData\䋠ǡ㾐ǡ0

(C:\ProgramData\????0) -- C:\ProgramData\䋠˜㾐˜0

(C:\ProgramData\????0) -- C:\ProgramData\䋠–㾐–0

(C:\ProgramData\????0) -- C:\ProgramData\䋠‰㾐‰0

(C:\ProgramData\????0) -- C:\ProgramData\䋠ǂ㾐ǂ0

(C:\ProgramData\?.?.0) -- C:\ProgramData\䋠.㾐.0

(C:\ProgramData\?!?!0) -- C:\ProgramData\䋠ǃ㾐ǃ0
 

< End of report >

Hi,
bitte laden:
http://download.bleepingcomputer.com...ta/Winmgmt.reg
doppelklicken, bestätigen, neustarten.

otl fix

Fixen mit OTL

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:

:OTL

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=tugumsd&cd=2XzuyEtN2Y1L1Qzu0B0CyD0F0FyEtD0D0A0FyD0E0AtDzzyDtN0D0Tzu0CyEzytCtN1L2XzutBtFtBtFtCtFyCtCzztN1L1Czu2Z2Y1N2Y1H1B1Q&cr=1207875316&ir=

IE - HKLM\..\SearchScopes\{072E35EC-1E3A-F4EA-65B0-0D7D63EAC49F}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.10011&barid={2AA40F9D-2317-4856-B88D-A0CD65219231}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=tugumsd&cd=2XzuyEtN2Y1L1Qzu0B0CyD0F0FyEtD0D0A0FyD0E0AtDzzyDtN0D0Tzu0CyEzytCtN1L2XzutBtFtBtFtCtFyCtCzztN1L1Czu2Z2Y1N2Y1H1B1Q&cr=1207875316&ir=

IE - HKCU\..\URLSearchHook: {cd90bf73-20f6-44ef-993d-bb920303bd2e} - No CLSID value found

IE - HKCU\..\SearchScopes\{072E35EC-1E3A-F4EA-65B0-0D7D63EAC49F}: "URL" = hxxp://mixidj.claro-search.com/?q={searchTerms}&affID=121139&tt=3612_3&babsrc=SP_ss&mntrId=70aba0850000000000000022436bc8dd

IE - HKCU\..\SearchScopes\{D7A5C187-ED99-4C30-8795-5CAD44133D98}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2653012

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CD90BF73-20F6-44EF-993D-BB920303BD2E} - No CLSID value found.

O4 - HKCU..\Run: [Ahytovl] C:\Users\Sabine\AppData\Roaming\Poyrra\zedo.exe File not found

O4 - HKCU..\Run: [ctfmon32.exe] C:\PROGRA~2\rundll32.exe C:\PROGRA~2\qeto08.dat,XFG00 File not found

:files

:Commands

[emptytemp]

Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
Schließe bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

bitte teste, ob es im Firefox, internet explorer, und sonstigen
evtl. instalierte Browser, irgendwelche ungewollten toolbars, umleitungen oder sonstigen Probleme gibt.
Teste wie pc und programme allgemein laufen.
b

ersten Link angepasst

Hier der Logfile nach dem Fix

Code:

All processes killed

========== OTL ==========

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{072E35EC-1E3A-F4EA-65B0-0D7D63EAC49F}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{072E35EC-1E3A-F4EA-65B0-0D7D63EAC49F}\ not found.

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{cd90bf73-20f6-44ef-993d-bb920303bd2e} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd90bf73-20f6-44ef-993d-bb920303bd2e}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{072E35EC-1E3A-F4EA-65B0-0D7D63EAC49F}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{072E35EC-1E3A-F4EA-65B0-0D7D63EAC49F}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D7A5C187-ED99-4C30-8795-5CAD44133D98}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7A5C187-ED99-4C30-8795-5CAD44133D98}\ not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CD90BF73-20F6-44EF-993D-BB920303BD2E} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CD90BF73-20F6-44EF-993D-BB920303BD2E}\ not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Ahytovl deleted successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ctfmon32.exe deleted successfully.

========== FILES ==========

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: FH

->Temp folder emptied: 33990 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 0 bytes

 

User: Manuel

->Temp folder emptied: 0 bytes

 

User: Public

->Temp folder emptied: 0 bytes

 

User: Sabine

->Temp folder emptied: 10268181 bytes

->Temporary Internet Files folder emptied: 254718427 bytes

->Java cache emptied: 275801 bytes

->Google Chrome cache emptied: 15608557 bytes

->Flash cache emptied: 13840 bytes

 

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 14292 bytes

RecycleBin emptied: 12215108 bytes

 

Total Files Cleaned = 280,00 mb

 

 

OTL by OldTimer - Version 3.2.69.0 log created on 06042013_114304
 

Files\Folders moved on Reboot...
 

PendingFileRenameOperations files...
 

Registry entries deleted on Reboot...

der Test fehlt noch :-)

läuft alles in Ordnung,Toolbars finde ich keine aber java hat anscheinend manchmal Probleme Bilder im Browser zu laden,liegt aber vielleicht an der Seite da es nur dort passiert.
Malware reagiert auch immer wenn ich den IE starte,bekomme da immer eine Meldung.

Konte den Malware jetzt auf deutsch stellen,kann man nach der Installation einfach unter Einstellungen machen.

Andere Programme machen keine Probleme oder ich habe bis jetzt einfach keine gefunden.

verstehe ich nich, in wie fern reagiert was?