Trojaner-Board - Smart HDD Virus, Schwarzer Desktop / Bitte um Hilfe bei der Entfernung

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Smart HDD Virus, Schwarzer Desktop / Bitte um Hilfe bei der Entfernung (https://www.trojaner-board.de/112981-smart-hdd-virus-schwarzer-desktop-bitte-um-hilfe-entfernung.html)

Smart HDD Virus, Schwarzer Desktop / Bitte um Hilfe bei der Entfernung

Ok also mein neuer Computer ist von dem Smart HDD Virus befallen.
Ich schreibe jetzt hier notgedrungen mit meinem alten Rechner.

Kurz mal ein paar Daten des befallenen PC`s:

Betriebssystem: Win 7 64bit Edition
Virensoftware: der Zeit noch Avira

Ok also der Desktop ist schwarz und außer dem Papierkorb und dem Arbeitsplatz ist mir nichts geblieben. Ich kann aber nichts anklicken.

Das Startmenü ist komplett leergefegt.

Ich habe mir jetzt, weil das hier mehrfach stand Malwarebytes heruntergeladen. Das Internet ging zum Glück noch über die Suchfunktion zu starten, poppen halt nur gefühlte Tausend Fehlermeldungen auf, aber hat ja geklappt.

Habe einen kompletten Scan durchlaufen lassen und 8 Befunde gehabt.

Log kommt gleich, wenn er mich machen lässt.

Ok scheint ja zu klappen.

Also hier der Log:

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.04.02.08
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

PC :: BLUE-DRAGON [Administrator]
 

Schutz: Aktiviert
 

02.04.2012 20:30:26

mbam-log-2012-04-02 (20-37-24).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 335726

Laufzeit: 6 Minute(n), 32 Sekunde(n)
 

Infizierte Speicherprozesse: 2

C:\ProgramData\uWCRRCjJmKaKb.exe (Backdoor.Agent.RCGen) -> 2128 -> Keine Aktion durchgeführt.

C:\ProgramData\9fNJtb79FXYRrk.exe (Backdoor.Agent.RCGen) -> 4748 -> Keine Aktion durchgeführt.
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 1

HKLM\SYSTEM\CurrentControlSet\Services\HWCore (Trojan.Agent) -> Keine Aktion durchgeführt.
 

Infizierte Registrierungswerte: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|uWCRRCjJmKaKb.exe (Backdoor.Agent.RCGen) -> Daten: C:\ProgramData\uWCRRCjJmKaKb.exe -> Keine Aktion durchgeführt.
 

Infizierte Dateiobjekte der Registrierung: 2

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Keine Aktion durchgeführt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Keine Aktion durchgeführt.
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 4

C:\ProgramData\uWCRRCjJmKaKb.exe (Backdoor.Agent.RCGen) -> Keine Aktion durchgeführt.

C:\ProgramData\9fNJtb79FXYRrk.exe (Backdoor.Agent.RCGen) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\DriveTheLife\hwcore.sys (Trojan.Agent) -> Keine Aktion durchgeführt.

C:\Users\PC\AppData\Local\Temp\gnLta6pDARvm9N.exe.tmp (Backdoor.Agent.RCGen) -> Keine Aktion durchgeführt.
 

(Ende)

Habe jetzt nichts weiter gemacht. Sollte ich nun auf "Entferne Auswahl" klicken und danach nochmal scannen?

EDIT:
Achso, ich bin noch im normalen Windows Modus, weil Internet ja geht. Sollte ich zur Sicherheit den PC neu starten und dann für alles weitere in den abgesicherten Modus gehen?

Ok also ich habe jetzt einfach die Auswahl entfernen lassen, der neue Log sieht jetzt so aus:

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.04.02.08
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

PC :: BLUE-DRAGON [Administrator]
 

Schutz: Aktiviert
 

02.04.2012 20:30:26

mbam-log-2012-04-02 (20-30-26).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 335726

Laufzeit: 6 Minute(n), 32 Sekunde(n)
 

Infizierte Speicherprozesse: 2

C:\ProgramData\uWCRRCjJmKaKb.exe (Backdoor.Agent.RCGen) -> 2128 -> Löschen bei Neustart.

C:\ProgramData\9fNJtb79FXYRrk.exe (Backdoor.Agent.RCGen) -> 4748 -> Löschen bei Neustart.
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 1

HKLM\SYSTEM\CurrentControlSet\Services\HWCore (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|uWCRRCjJmKaKb.exe (Backdoor.Agent.RCGen) -> Daten: C:\ProgramData\uWCRRCjJmKaKb.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateiobjekte der Registrierung: 2

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 4

C:\ProgramData\uWCRRCjJmKaKb.exe (Backdoor.Agent.RCGen) -> Löschen bei Neustart.

C:\ProgramData\9fNJtb79FXYRrk.exe (Backdoor.Agent.RCGen) -> Löschen bei Neustart.

C:\Program Files (x86)\DriveTheLife\hwcore.sys (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\PC\AppData\Local\Temp\gnLta6pDARvm9N.exe.tmp (Backdoor.Agent.RCGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Sollte ich jetzt einen Neustart machen und wie geht`s dann weiter?

Hab jetzt einfach mal nen Neustart gemacht. Das Smart HDD ploppt jetzt auch nicht mehr auf. Aber es ist immer noch alles schwarz.

Habe einen erneuten Scan mit Malwarebytes durchgeführt. Er hat wieder die selben 2 Einträge bei "Dateiobjekte der Registrierung" gefunden. Habe die dann auch entfernen lasssen.

Ich habe jetzt 9 Objekte in der Quarantäne. Kann ich diese eigentlich löschen und was passiert, wenn ich Malwarebytes später wieder deinstalliere?

Ich habe nämlich jetzt nur die Testversion runterladen können, weil ich die Vollversion nicht kaufen wollte.

Was soll ich jetzt als nächstes tun?

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Ok hier der OTL.txt:

Code:

OTL logfile created on: 04.04.2012 13:55:44 - Run 1

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\PC\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

15,98 Gb Total Physical Memory | 14,86 Gb Available Physical Memory | 92,97% Memory free

31,96 Gb Paging File | 29,47 Gb Available in Paging File | 92,21% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 55,80 Gb Total Space | 12,52 Gb Free Space | 22,44% Space Free | Partition Type: NTFS

Drive D: | 1863,01 Gb Total Space | 1801,60 Gb Free Space | 96,70% Space Free | Partition Type: NTFS

 

Computer Name: BLUE-DRAGON | User Name: PC | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.04.04 13:52:25 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\PC\Desktop\OTL.exe

PRC - [2012.02.21 14:47:30 | 000,250,016 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11f_ActiveX.exe

PRC - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.01.13 14:53:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.10.11 14:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

PRC - [2011.10.11 14:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011.10.11 14:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.08.03 13:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

PRC - [2011.08.03 03:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

 

 
 ========== Modules (No Company Name) ==========

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.10.11 14:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.10.11 14:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.08.03 13:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)

SRV - [2011.08.03 03:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2010.10.22 13:08:18 | 001,039,360 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)

SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.08.18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012.02.15 14:28:28 | 000,132,320 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)

DRV:64bit: - [2011.12.10 15:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2011.10.11 15:00:01 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)

DRV:64bit: - [2011.10.11 15:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)

DRV:64bit: - [2011.06.10 06:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2011.05.10 11:41:27 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.12.08 18:17:40 | 000,369,640 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci)

DRV:64bit: - [2010.12.08 18:17:38 | 000,122,856 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.10.19 16:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R)

DRV:64bit: - [2010.05.20 07:03:11 | 000,105,312 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2008.02.15 02:00:00 | 000,442,912 | ---- | M] (Realtek) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RTL85n64.sys -- (RTL85n64)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-4121521385-2814533739-2460137988-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.gmx.net/

IE - HKU\S-1-5-21-4121521385-2814533739-2460137988-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-4121521385-2814533739-2460137988-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

IE - HKU\S-1-5-21-4121521385-2814533739-2460137988-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A0 3D E5 EA A0 26 CC 01  [binary data]

IE - HKU\S-1-5-21-4121521385-2814533739-2460137988-1000\..\SearchScopes,DefaultScope = {67E2AC4B-8462-4C1C-97C6-40F43CF5228F}

IE - HKU\S-1-5-21-4121521385-2814533739-2460137988-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-4121521385-2814533739-2460137988-1000\..\SearchScopes\{67E2AC4B-8462-4C1C-97C6-40F43CF5228F}: "URL" = hxxp://www.google.de/search?q={searchTerms}

IE - HKU\S-1-5-21-4121521385-2814533739-2460137988-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 
 ========== FireFox ==========

 

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.06.09 13:54:43 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011.07.15 10:41:01 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2011.07.15 10:41:08 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.06.09 13:54:43 | 000,000,000 | ---D | M]

 

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN Toolbar\Platform\6.3.2380.0\npwinext.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (@c:\Program Files (x86)\MSN Toolbar\Platform\6.3.2380.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\Program Files (x86)\MSN Toolbar\Platform\6.3.2380.0\npwinext.dll (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [DriveTheLife] C:\Program Files (x86)\DriveTheLife\DriveTheLife.exe (深圳市驱动人生软件技术有限公司)

O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-4121521385-2814533739-2460137988-1003..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-21-4121521385-2814533739-2460137988-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Object)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444552440000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9474FF42-99CA-4A4A-BB69-64794FEA1A00}: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F25D0551-D408-452C-A95E-B172C10EE202}: DhcpNameServer = 192.168.0.1

O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{bd2addde-7a53-11e0-9dd8-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{bd2addde-7a53-11e0-9dd8-806e6f6e6963}\Shell\AutoRun\command - "" = D:\autorun.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

 

 

SafeBootMin:64bit: AppMgmt - Service

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: AppMgmt - Service

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.04.04 13:52:25 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\PC\Desktop\OTL.exe

[2012.04.02 20:27:23 | 000,000,000 | ---D | C] -- C:\Users\PC\AppData\Roaming\Malwarebytes

[2012.04.02 20:27:16 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.04.02 20:27:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.04.02 20:27:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.04.02 20:27:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.04.02 16:53:20 | 000,000,000 | -H-D | C] -- C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SMART HDD

[2012.03.14 16:31:45 | 000,000,000 | -H-D | C] -- C:\Users\PC\AppData\Roaming\Softlink

[2012.03.06 16:47:35 | 000,000,000 | -H-D | C] -- C:\ProgramData\DriveTheLife2012

[2012.03.06 16:47:29 | 000,000,000 | -H-D | C] -- C:\Users\PC\AppData\Roaming\DriveTheLife2012

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.04.04 13:52:25 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\PC\Desktop\OTL.exe

[2012.04.04 13:50:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.04.03 12:37:43 | 000,014,800 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.04.03 12:37:43 | 000,014,800 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.04.03 12:37:31 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.04.03 12:37:31 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.04.03 12:37:31 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.04.03 12:37:31 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.04.03 12:37:31 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.04.03 12:30:18 | 4280,348,670 | -HS- | M] () -- C:\hiberfil.sys

[2012.04.02 20:27:16 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.04.02 16:53:23 | 000,000,184 | -H-- | M] () -- C:\ProgramData\-9fNJtb79FXYRrkr

[2012.04.02 16:53:23 | 000,000,000 | -H-- | M] () -- C:\ProgramData\-9fNJtb79FXYRrk

[2012.04.02 16:53:20 | 000,000,647 | -H-- | M] () -- C:\Users\PC\Desktop\SMART_HDD.lnk

[2012.04.02 16:53:18 | 000,000,256 | -H-- | M] () -- C:\ProgramData\9fNJtb79FXYRrk

[2012.03.15 15:05:54 | 000,371,208 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

 
 ========== Files Created - No Company Name ==========

 

[2012.04.02 20:27:16 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.04.02 16:53:23 | 000,000,184 | -H-- | C] () -- C:\ProgramData\-9fNJtb79FXYRrkr

[2012.04.02 16:53:23 | 000,000,000 | -H-- | C] () -- C:\ProgramData\-9fNJtb79FXYRrk

[2012.04.02 16:53:20 | 000,000,647 | -H-- | C] () -- C:\Users\PC\Desktop\SMART_HDD.lnk

[2012.04.02 16:53:17 | 000,000,256 | -H-- | C] () -- C:\ProgramData\9fNJtb79FXYRrk

[2011.08.03 03:31:54 | 000,311,912 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe

[2011.06.09 16:03:05 | 000,000,230 | -H-- | C] () -- C:\Users\PC\AppData\Roaming\wklnhst.dat

[2011.06.09 15:36:59 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI

[2011.06.09 13:48:52 | 000,238,349 | ---- | C] () -- C:\Windows\hpoins52.dat

[2011.05.09 18:36:46 | 000,035,944 | ---- | C] () -- C:\Windows\Ascd_log.ini

[2011.05.09 18:36:07 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini

[2011.05.09 18:36:01 | 000,024,353 | ---- | C] () -- C:\Windows\Ascd_tmp.ini

 
 ========== LOP Check ==========

 

[2012.03.06 16:47:29 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\DriveTheLife2012

[2011.12.24 15:48:41 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\DxO Labs

[2011.12.24 15:48:45 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\DxO_Labs

[2011.12.24 15:41:45 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\PACE Anti-Piracy

[2012.04.02 16:57:03 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\Softlink

[2011.12.07 14:43:19 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\uTorrent

[2012.01.09 15:55:09 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\XMedia Recode

[2011.11.28 19:05:20 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.11.15 15:15:04 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\Adobe

[2011.10.29 15:34:12 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\Apple Computer

[2011.10.20 13:03:07 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\Avira

[2012.03.06 16:47:29 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\DriveTheLife2012

[2011.12.24 15:48:41 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\DxO Labs

[2011.12.24 15:48:45 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\DxO_Labs

[2011.06.09 14:25:31 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\HP

[2012.01.16 17:09:04 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\HpUpdate

[2011.05.09 17:51:49 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\Identities

[2011.05.09 18:39:22 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\InstallShield

[2011.06.09 14:15:24 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\Macromedia

[2012.04.02 20:27:23 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\Malwarebytes

[2009.07.14 20:18:18 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\Media Center Programs

[2011.12.24 15:59:14 | 000,000,000 | --SD | M] -- C:\Users\PC\AppData\Roaming\Microsoft

[2011.12.24 15:41:45 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\PACE Anti-Piracy

[2012.04.02 16:57:03 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\Softlink

[2011.12.07 14:43:19 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\uTorrent

[2012.01.09 15:55:09 | 000,000,000 | -H-D | M] -- C:\Users\PC\AppData\Roaming\XMedia Recode

 
 < %APPDATA%\*.exe /s >

[2011.08.23 12:04:39 | 000,010,134 | RH-- | M] () -- C:\Users\PC\AppData\Roaming\Microsoft\Installer\{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}\ARPPRODUCTICON.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTORV.SYS  >

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 1158 bytes -> C:\ProgramData\Microsoft:oDosFFmDlRq9aLFtjbw2EMwy47Hw

@Alternate Data Stream - 1146 bytes -> C:\ProgramData\Microsoft:wXEVfxgfTte3tloffzmom

@Alternate Data Stream - 1026 bytes -> C:\Program Files (x86)\Common Files\microsoft shared:lbMEfHWpdmHe58PVAAeJh
 

< End of report >

Zitat:

EDIT:
Achso, ich bin noch im normalen Windows Modus, weil Internet ja geht. Sollte ich zur Sicherheit den PC neu starten und dann für alles weitere in den abgesicherten Modus gehen?

Hm, das hab ich ganz übersehen, mach auch bitte mal einen Durchgangmit ESET

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Hat etwas gedauert aber hier ist nun das Log, gefunden hat er allerdings nichts:

Code:

ESETSmartInstaller@High as CAB hook log:

OnlineScanner64.ocx - registred OK

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=a8455f9722ea0245998ba78165391294

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-04-04 01:04:00

# local_time=2012-04-04 03:04:00 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1792 16777215 100 0 14435321 14435321 0 0

# compatibility_mode=5893 16776574 100 94 21842249 85173748 0 0

# compatibility_mode=8192 67108863 100 0 142 142 0 0

# scanned=137801

# found=0

# cleaned=0

# scan_time=742

Kann ich die Files von ESET jetzt wieder deinstallieren, weil er fragt mich danach?

Ok, bevor wir einen OTL-Fix machen, versuch das Startmenü mit unhide wiederherzustellen:

Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Mach bitte folgendem OTL-Fix erst wenn du alles Relevante im Startmenü zurück hast!!!, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:

:OTL

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{bd2addde-7a53-11e0-9dd8-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{bd2addde-7a53-11e0-9dd8-806e6f6e6963}\Shell\AutoRun\command - "" = D:\autorun.exe

[2012.04.02 16:53:23 | 000,000,184 | -H-- | M] () -- C:\ProgramData\-9fNJtb79FXYRrkr

[2012.04.02 16:53:23 | 000,000,000 | -H-- | M] () -- C:\ProgramData\-9fNJtb79FXYRrk

[2012.04.02 16:53:20 | 000,000,647 | -H-- | M] () -- C:\Users\PC\Desktop\SMART_HDD.lnk

[2012.04.02 16:53:18 | 000,000,256 | -H-- | M] () -- C:\ProgramData\9fNJtb79FXYRrk

@Alternate Data Stream - 1158 bytes -> C:\ProgramData\Microsoft:oDosFFmDlRq9aLFtjbw2EMwy47Hw

@Alternate Data Stream - 1146 bytes -> C:\ProgramData\Microsoft:wXEVfxgfTte3tloffzmom

@Alternate Data Stream - 1026 bytes -> C:\Program Files (x86)\Common Files\microsoft shared:lbMEfHWpdmHe58PVAAeJh
 

:Commands

[purity]

[emptytemp]

[emptyflash]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Ok, also ich starte jetzt mal unhide.

Bevor ich dann OTL wieder starte, kurze Frage.
Ich will nichts falsch machen, da gelte ich lieber als doof.

Also ich habe an der OTL Log nichts verändert.
Ich habe nichts unkenntlich gemacht, war auch nicht nötig.

Was muss ich denn jetzt in deinem Script ändern wegen der Sternchen.

Sorry, wenn ich Umstände machen.

EDIT:
Ok, dass mit unhide hat geklappt die Desktopsymbole sind wieder da, meine Dateien auch und das Startmenü soweit auch. Bildschirm ist aber immer noch schwarz.

Als nächstes mache ich dann den OTL fix, sobald ich von dir Bescheid habe.

Zitat:

Also ich habe an der OTL Log nichts verändert.
Ich habe nichts unkenntlich gemacht, war auch nicht nötig.

Hab vergessen die Passage rauszunehmen, du brauchst nichts zurückeditieren weil in meinem OTL-Fixscript keine Zeile mit einer von dir unkenntlich gemachten Zeichenfolge vorkommt

Da das Startmenü nun vollstöndig ist kannst du nun den OTL-Fix machen

Hat alles geklappt, hier der Log:

Code:

All processes killed

========== OTL ==========

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bd2addde-7a53-11e0-9dd8-806e6f6e6963}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bd2addde-7a53-11e0-9dd8-806e6f6e6963}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bd2addde-7a53-11e0-9dd8-806e6f6e6963}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bd2addde-7a53-11e0-9dd8-806e6f6e6963}\ not found.

File D:\autorun.exe not found.

C:\ProgramData\-9fNJtb79FXYRrkr moved successfully.

C:\ProgramData\-9fNJtb79FXYRrk moved successfully.

C:\Users\PC\Desktop\SMART_HDD.lnk moved successfully.

C:\ProgramData\9fNJtb79FXYRrk moved successfully.

ADS C:\ProgramData\Microsoft:oDosFFmDlRq9aLFtjbw2EMwy47Hw deleted successfully.

ADS C:\ProgramData\Microsoft:wXEVfxgfTte3tloffzmom deleted successfully.

ADS C:\Program Files (x86)\Common Files\microsoft shared:lbMEfHWpdmHe58PVAAeJh deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: PC

->Temp folder emptied: 447126434 bytes

->Temporary Internet Files folder emptied: 517787664 bytes

->Java cache emptied: 100763 bytes

->Flash cache emptied: 28253 bytes

 

User: Public

 

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 144505440 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 1.058,00 mb

 

 

[EMPTYFLASH]

 

User: All Users

 

User: Default

 

User: Default User

 

User: PC

->Flash cache emptied: 0 bytes

 

User: Public

 

User: UpdatusUser

 

Total Flash Files Cleaned = 0,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.39.2 log created on 04052012_123652
 

Files\Folders moved on Reboot...

C:\Users\PC\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
 

Registry entries deleted on Reboot...

Keine Ahnung, ob das relevant ist, also der Hintergrund ist immer noch schwarz. Die Smart HDD Verknüpfung auf dem Desktop, die nach unhide.exe da war, ist nun nach dem OTL Fix weg.

Mir ist allerdings gerade aufgefallen, dass unten rechts wo die Symbole der Taskleiste zusammengefasst sind, wenn ich dort auf Anpassen klicke, dann taucht dort sowohl Smart HDD als auch ein System Error auf.
Hab dazu mal nen Screenshot gemacht.

Das Hintergrundbild kannst du doch manuell wieder zurückstellen oder nicht :wtf:

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten, Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Ja hattest recht, Hintergrund konnte ich selber wieder einstellen, Gott wie peinlich. :stirn:

Hier Log vom TDSS-Killer:

Code:

16:56:51.0733 3160        TDSS rootkit removing tool 2.7.26.0 Apr  4 2012 19:52:02

16:56:51.0858 3160        ============================================================

16:56:51.0858 3160        Current date / time: 2012/04/05 16:56:51.0858

16:56:51.0858 3160        SystemInfo:

16:56:51.0858 3160        

16:56:51.0858 3160        OS Version: 6.1.7601 ServicePack: 1.0

16:56:51.0858 3160        Product type: Workstation

16:56:51.0858 3160        ComputerName: BLUE-DRAGON

16:56:51.0873 3160        UserName: PC

16:56:51.0873 3160        Windows directory: C:\Windows

16:56:51.0873 3160        System windows directory: C:\Windows

16:56:51.0873 3160        Running under WOW64

16:56:51.0873 3160        Processor architecture: Intel x64

16:56:51.0873 3160        Number of processors: 8

16:56:51.0873 3160        Page size: 0x1000

16:56:51.0873 3160        Boot type: Normal boot

16:56:51.0873 3160        ============================================================

16:56:52.0045 3160        Drive \Device\Harddisk1\DR1 - Size: 0xDF99E6000 (55.90 Gb), SectorSize: 0x200, Cylinders: 0x1C81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

16:56:52.0061 3160        Drive \Device\Harddisk0\DR0 - Size: 0x1D1C1116000 (1863.02 Gb), SectorSize: 0x200, Cylinders: 0x3B601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

16:56:52.0061 3160        \Device\Harddisk1\DR1:

16:56:52.0061 3160        MBR used

16:56:52.0061 3160        \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000

16:56:52.0061 3160        \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x6F99800

16:56:52.0061 3160        \Device\Harddisk0\DR0:

16:56:52.0061 3160        MBR used

16:56:52.0061 3160        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xE8E07800

16:56:52.0092 3160        Initialize success

16:56:52.0092 3160        ============================================================

16:57:54.0664 3932        ============================================================

16:57:54.0664 3932        Scan started

16:57:54.0664 3932        Mode: Manual; SigCheck; TDLFS; 

16:57:54.0664 3932        ============================================================

16:57:54.0757 3932        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys

16:57:54.0788 3932        1394ohci - ok

16:57:54.0788 3932        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys

16:57:54.0804 3932        ACPI - ok

16:57:54.0804 3932        AcpiPmi         (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys

16:57:54.0820 3932        AcpiPmi - ok

16:57:54.0820 3932        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

16:57:54.0835 3932        AdobeARMservice - ok

16:57:54.0835 3932        adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys

16:57:54.0851 3932        adp94xx - ok

16:57:54.0866 3932        adpahci         (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys

16:57:54.0866 3932        adpahci - ok

16:57:54.0882 3932        adpu320         (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys

16:57:54.0882 3932        adpu320 - ok

16:57:54.0898 3932        AeLookupSvc     (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll

16:57:54.0913 3932        AeLookupSvc - ok

16:57:54.0929 3932        AFD             (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys

16:57:54.0944 3932        AFD - ok

16:57:54.0944 3932        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys

16:57:54.0960 3932        agp440 - ok

16:57:54.0960 3932        ALG             (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe

16:57:54.0976 3932        ALG - ok

16:57:54.0976 3932        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys

16:57:54.0991 3932        aliide - ok

16:57:54.0991 3932        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys

16:57:54.0991 3932        amdide - ok

16:57:55.0007 3932        AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys

16:57:55.0007 3932        AmdK8 - ok

16:57:55.0022 3932        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys

16:57:55.0022 3932        AmdPPM - ok

16:57:55.0038 3932        amdsata         (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys

16:57:55.0038 3932        amdsata - ok

16:57:55.0054 3932        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys

16:57:55.0054 3932        amdsbs - ok

16:57:55.0069 3932        amdxata         (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys

16:57:55.0069 3932        amdxata - ok

16:57:55.0085 3932        AntiVirSchedulerService (a122d68ea2541453f787f341877cb40b) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

16:57:55.0085 3932        AntiVirSchedulerService - ok

16:57:55.0085 3932        AntiVirService  (2fe359edeb34efcf42574752f8aebd3f) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

16:57:55.0100 3932        AntiVirService - ok

16:57:55.0100 3932        AppID           (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys

16:57:55.0116 3932        AppID - ok

16:57:55.0132 3932        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll

16:57:55.0147 3932        AppIDSvc - ok

16:57:55.0163 3932        Appinfo         (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll

16:57:55.0178 3932        Appinfo - ok

16:57:55.0178 3932        arc             (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys

16:57:55.0194 3932        arc - ok

16:57:55.0194 3932        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys

16:57:55.0210 3932        arcsas - ok

16:57:55.0210 3932        asmthub3        (e1e75921e9eb025009696d4837f531fb) C:\Windows\system32\DRIVERS\asmthub3.sys

16:57:55.0225 3932        asmthub3 - ok

16:57:55.0241 3932        asmtxhci        (b0cf9ab16006b61634d4f955345ca5d2) C:\Windows\system32\DRIVERS\asmtxhci.sys

16:57:55.0256 3932        asmtxhci - ok

16:57:55.0256 3932        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

16:57:55.0272 3932        AsyncMac - ok

16:57:55.0288 3932        atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys

16:57:55.0288 3932        atapi - ok

16:57:55.0303 3932        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll

16:57:55.0334 3932        AudioEndpointBuilder - ok

16:57:55.0350 3932        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll

16:57:55.0366 3932        AudioSrv - ok

16:57:55.0381 3932        avgntflt        (aa8f79a1bdfc03b3bc70c44ab00589b4) C:\Windows\system32\DRIVERS\avgntflt.sys

16:57:55.0381 3932        avgntflt - ok

16:57:55.0381 3932        avipbb          (852e3c0a60d368c487949e55ad52a47f) C:\Windows\system32\DRIVERS\avipbb.sys

16:57:55.0397 3932        avipbb - ok

16:57:55.0397 3932        avkmgr          (248db59fc86de44d2779f4c7fb1a567d) C:\Windows\system32\DRIVERS\avkmgr.sys

16:57:55.0412 3932        avkmgr - ok

16:57:55.0412 3932        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll

16:57:55.0428 3932        AxInstSV - ok

16:57:55.0444 3932        b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys

16:57:55.0459 3932        b06bdrv - ok

16:57:55.0475 3932        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

16:57:55.0475 3932        b57nd60a - ok

16:57:55.0490 3932        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll

16:57:55.0506 3932        BDESVC - ok

16:57:55.0506 3932        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

16:57:55.0522 3932        Beep - ok

16:57:55.0537 3932        BFE             (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll

16:57:55.0568 3932        BFE - ok

16:57:55.0584 3932        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll

16:57:55.0615 3932        BITS - ok

16:57:55.0615 3932        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys

16:57:55.0631 3932        blbdrive - ok

16:57:55.0631 3932        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys

16:57:55.0646 3932        bowser - ok

16:57:55.0646 3932        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys

16:57:55.0662 3932        BrFiltLo - ok

16:57:55.0662 3932        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys

16:57:55.0678 3932        BrFiltUp - ok

16:57:55.0678 3932        Browser         (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll

16:57:55.0693 3932        Browser - ok

16:57:55.0709 3932        Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

16:57:55.0724 3932        Brserid - ok

16:57:55.0724 3932        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

16:57:55.0740 3932        BrSerWdm - ok

16:57:55.0740 3932        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

16:57:55.0756 3932        BrUsbMdm - ok

16:57:55.0756 3932        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

16:57:55.0771 3932        BrUsbSer - ok

16:57:55.0771 3932        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys

16:57:55.0787 3932        BTHMODEM - ok

16:57:55.0787 3932        bthserv         (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll

16:57:55.0818 3932        bthserv - ok

16:57:55.0818 3932        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

16:57:55.0834 3932        cdfs - ok

16:57:55.0849 3932        cdrom           (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys

16:57:55.0865 3932        cdrom - ok

16:57:55.0865 3932        CertPropSvc     (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll

16:57:55.0880 3932        CertPropSvc - ok

16:57:55.0896 3932        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys

16:57:55.0896 3932        circlass - ok

16:57:55.0912 3932        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

16:57:55.0927 3932        CLFS - ok

16:57:55.0927 3932        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

16:57:55.0927 3932        clr_optimization_v2.0.50727_32 - ok

16:57:55.0943 3932        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

16:57:55.0943 3932        clr_optimization_v2.0.50727_64 - ok

16:57:55.0943 3932        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

16:57:55.0958 3932        clr_optimization_v4.0.30319_32 - ok

16:57:55.0958 3932        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

16:57:55.0958 3932        clr_optimization_v4.0.30319_64 - ok

16:57:55.0974 3932        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys

16:57:55.0974 3932        CmBatt - ok

16:57:55.0990 3932        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys

16:57:55.0990 3932        cmdide - ok

16:57:56.0005 3932        CNG             (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys

16:57:56.0021 3932        CNG - ok

16:57:56.0021 3932        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys

16:57:56.0036 3932        Compbatt - ok

16:57:56.0036 3932        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys

16:57:56.0052 3932        CompositeBus - ok

16:57:56.0052 3932        COMSysApp - ok

16:57:56.0052 3932        cpuz132 - ok

16:57:56.0068 3932        crcdisk         (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys

16:57:56.0068 3932        crcdisk - ok

16:57:56.0083 3932        CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll

16:57:56.0099 3932        CryptSvc - ok

16:57:56.0114 3932        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll

16:57:56.0146 3932        DcomLaunch - ok

16:57:56.0146 3932        defragsvc       (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll

16:57:56.0177 3932        defragsvc - ok

16:57:56.0192 3932        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys

16:57:56.0224 3932        DfsC - ok

16:57:56.0224 3932        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll

16:57:56.0255 3932        Dhcp - ok

16:57:56.0255 3932        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

16:57:56.0286 3932        discache - ok

16:57:56.0286 3932        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys

16:57:56.0286 3932        Disk - ok

16:57:56.0302 3932        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll

16:57:56.0317 3932        Dnscache - ok

16:57:56.0317 3932        dot3svc         (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll

16:57:56.0333 3932        dot3svc - ok

16:57:56.0348 3932        DPS             (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll

16:57:56.0364 3932        DPS - ok

16:57:56.0380 3932        drmkaud         (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

16:57:56.0380 3932        drmkaud - ok

16:57:56.0411 3932        DXGKrnl         (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys

16:57:56.0411 3932        DXGKrnl - ok

16:57:56.0426 3932        EapHost         (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll

16:57:56.0442 3932        EapHost - ok

16:57:56.0489 3932        ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys

16:57:56.0520 3932        ebdrv - ok

16:57:56.0536 3932        EFS             (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe

16:57:56.0536 3932        EFS - ok

16:57:56.0551 3932        ehRecvr         (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe

16:57:56.0567 3932        ehRecvr - ok

16:57:56.0567 3932        ehSched         (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe

16:57:56.0582 3932        ehSched - ok

16:57:56.0598 3932        elxstor         (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys

16:57:56.0614 3932        elxstor - ok

16:57:56.0614 3932        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys

16:57:56.0629 3932        ErrDev - ok

16:57:56.0629 3932        EventSystem     (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll

16:57:56.0660 3932        EventSystem - ok

16:57:56.0676 3932        exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

16:57:56.0692 3932        exfat - ok

16:57:56.0692 3932        fastfat         (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

16:57:56.0723 3932        fastfat - ok

16:57:56.0738 3932        Fax             (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe

16:57:56.0754 3932        Fax - ok

16:57:56.0754 3932        fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys

16:57:56.0770 3932        fdc - ok

16:57:56.0770 3932        fdPHost         (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll

16:57:56.0785 3932        fdPHost - ok

16:57:56.0801 3932        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll

16:57:56.0816 3932        FDResPub - ok

16:57:56.0816 3932        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

16:57:56.0832 3932        FileInfo - ok

16:57:56.0832 3932        Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

16:57:56.0863 3932        Filetrace - ok

16:57:56.0863 3932        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys

16:57:56.0863 3932        flpydisk - ok

16:57:56.0879 3932        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys

16:57:56.0894 3932        FltMgr - ok

16:57:56.0910 3932        FontCache       (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll

16:57:56.0926 3932        FontCache - ok

16:57:56.0926 3932        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

16:57:56.0941 3932        FontCache3.0.0.0 - ok

16:57:56.0941 3932        FsDepends       (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

16:57:56.0941 3932        FsDepends - ok

16:57:56.0957 3932        Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys

16:57:56.0957 3932        Fs_Rec - ok

16:57:56.0972 3932        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys

16:57:56.0972 3932        fvevol - ok

16:57:56.0988 3932        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys

16:57:56.0988 3932        gagp30kx - ok

16:57:57.0004 3932        gpsvc           (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll

16:57:57.0035 3932        gpsvc - ok

16:57:57.0035 3932        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

16:57:57.0050 3932        hcw85cir - ok

16:57:57.0066 3932        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys

16:57:57.0066 3932        HdAudAddService - ok

16:57:57.0082 3932        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys

16:57:57.0097 3932        HDAudBus - ok

16:57:57.0097 3932        HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys

16:57:57.0097 3932        HidBatt - ok

16:57:57.0113 3932        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys

16:57:57.0128 3932        HidBth - ok

16:57:57.0128 3932        HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys

16:57:57.0144 3932        HidIr - ok

16:57:57.0144 3932        hidserv         (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll

16:57:57.0160 3932        hidserv - ok

16:57:57.0175 3932        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys

16:57:57.0175 3932        HidUsb - ok

16:57:57.0191 3932        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll

16:57:57.0206 3932        hkmsvc - ok

16:57:57.0222 3932        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll

16:57:57.0222 3932        HomeGroupListener - ok

16:57:57.0238 3932        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll

16:57:57.0238 3932        HomeGroupProvider - ok

16:57:57.0253 3932        hpqcxs08        (5da42d24712e00728cea2342a65009b2) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll

16:57:57.0581 3932        hpqcxs08 - ok

16:57:57.0581 3932        hpqddsvc        (d86a39bf100069444d026d22d9a6e555) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll

16:57:57.0596 3932        hpqddsvc - ok

16:57:57.0596 3932        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys

16:57:57.0612 3932        HpSAMD - ok

16:57:57.0628 3932        HPSLPSVC        (f37882f128efacefe353e0bae2766909) C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL

16:57:57.0643 3932        HPSLPSVC ( UnsignedFile.Multi.Generic ) - warning

16:57:57.0643 3932        HPSLPSVC - detected UnsignedFile.Multi.Generic (1)

16:57:57.0659 3932        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys

16:57:57.0690 3932        HTTP - ok

16:57:57.0690 3932        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys

16:57:57.0706 3932        hwpolicy - ok

16:57:57.0706 3932        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys

16:57:57.0721 3932        i8042prt - ok

16:57:57.0721 3932        iaStorV         (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys

16:57:57.0737 3932        iaStorV - ok

16:57:57.0752 3932        idsvc           (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

16:57:57.0768 3932        idsvc - ok

16:57:57.0768 3932        iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys

16:57:57.0768 3932        iirsp - ok

16:57:57.0784 3932        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll

16:57:57.0815 3932        IKEEXT - ok

16:57:57.0846 3932        IntcAzAudAddService (a3c9367a02b2a1fc22536add3601b64f) C:\Windows\system32\drivers\RTKVHD64.sys

16:57:57.0877 3932        IntcAzAudAddService - ok

16:57:57.0877 3932        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys

16:57:57.0893 3932        intelide - ok

16:57:57.0893 3932        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys

16:57:57.0908 3932        intelppm - ok

16:57:57.0908 3932        IPBusEnum       (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll

16:57:57.0940 3932        IPBusEnum - ok

16:57:57.0940 3932        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys

16:57:57.0955 3932        IpFilterDriver - ok

16:57:57.0971 3932        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll

16:57:58.0002 3932        iphlpsvc - ok

16:57:58.0002 3932        IPMIDRV         (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys

16:57:58.0018 3932        IPMIDRV - ok

16:57:58.0018 3932        IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

16:57:58.0033 3932        IPNAT - ok

16:57:58.0049 3932        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

16:57:58.0064 3932        IRENUM - ok

16:57:58.0064 3932        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys

16:57:58.0064 3932        isapnp - ok

16:57:58.0080 3932        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys

16:57:58.0096 3932        iScsiPrt - ok

16:57:58.0096 3932        JRAID           (dbc83f59d9741734f9575da4e3345b2c) C:\Windows\system32\DRIVERS\jraid.sys

16:57:58.0111 3932        JRAID - ok

16:57:58.0111 3932        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys

16:57:58.0127 3932        kbdclass - ok

16:57:58.0127 3932        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys

16:57:58.0142 3932        kbdhid - ok

16:57:58.0142 3932        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

16:57:58.0142 3932        KeyIso - ok

16:57:58.0158 3932        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys

16:57:58.0158 3932        KSecDD - ok

16:57:58.0174 3932        KSecPkg         (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys

16:57:58.0174 3932        KSecPkg - ok

16:57:58.0189 3932        ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

16:57:58.0205 3932        ksthunk - ok

16:57:58.0220 3932        KtmRm           (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll

16:57:58.0236 3932        KtmRm - ok

16:57:58.0252 3932        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll

16:57:58.0267 3932        LanmanServer - ok

16:57:58.0283 3932        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll

16:57:58.0298 3932        LanmanWorkstation - ok

16:57:58.0314 3932        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

16:57:58.0330 3932        lltdio - ok

16:57:58.0345 3932        lltdsvc         (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll

16:57:58.0361 3932        lltdsvc - ok

16:57:58.0376 3932        lmhosts         (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll

16:57:58.0392 3932        lmhosts - ok

16:57:58.0392 3932        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys

16:57:58.0408 3932        LSI_FC - ok

16:57:58.0408 3932        LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys

16:57:58.0423 3932        LSI_SAS - ok

16:57:58.0423 3932        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys

16:57:58.0439 3932        LSI_SAS2 - ok

16:57:58.0439 3932        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys

16:57:58.0439 3932        LSI_SCSI - ok

16:57:58.0454 3932        luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

16:57:58.0470 3932        luafv - ok

16:57:58.0486 3932        MBAMProtector   (79da94b35371b9e7104460c7693dcb2c) C:\Windows\system32\drivers\mbam.sys

16:57:58.0486 3932        MBAMProtector - ok

16:57:58.0501 3932        MBAMService     (056b19651bd7b7ce5f89a3ac46dbdc08) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

16:57:58.0501 3932        MBAMService - ok

16:57:58.0517 3932        Mcx2Svc         (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll

16:57:58.0517 3932        Mcx2Svc - ok

16:57:58.0532 3932        megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys

16:57:58.0532 3932        megasas - ok

16:57:58.0548 3932        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys

16:57:58.0548 3932        MegaSR - ok

16:57:58.0564 3932        MEIx64          (a6518dcc42f7a6e999bb3bea8fd87567) C:\Windows\system32\DRIVERS\HECIx64.sys

16:57:58.0564 3932        MEIx64 - ok

16:57:58.0579 3932        MMCSS           (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

16:57:58.0595 3932        MMCSS - ok

16:57:58.0595 3932        Modem           (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

16:57:58.0626 3932        Modem - ok

16:57:58.0626 3932        monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

16:57:58.0642 3932        monitor - ok

16:57:58.0642 3932        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys

16:57:58.0642 3932        mouclass - ok

16:57:58.0657 3932        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys

16:57:58.0657 3932        mouhid - ok

16:57:58.0673 3932        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys

16:57:58.0673 3932        mountmgr - ok

16:57:58.0688 3932        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys

16:57:58.0688 3932        mpio - ok

16:57:58.0704 3932        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

16:57:58.0720 3932        mpsdrv - ok

16:57:58.0735 3932        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll

16:57:58.0766 3932        MpsSvc - ok

16:57:58.0766 3932        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys

16:57:58.0782 3932        MRxDAV - ok

16:57:58.0798 3932        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys

16:57:58.0798 3932        mrxsmb - ok

16:57:58.0813 3932        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys

16:57:58.0829 3932        mrxsmb10 - ok

16:57:58.0829 3932        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

16:57:58.0844 3932        mrxsmb20 - ok

16:57:58.0844 3932        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys

16:57:58.0844 3932        msahci - ok

16:57:58.0860 3932        msdsm           (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys

16:57:58.0860 3932        msdsm - ok

16:57:58.0876 3932        MSDTC           (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe

16:57:58.0876 3932        MSDTC - ok

16:57:58.0891 3932        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

16:57:58.0907 3932        Msfs - ok

16:57:58.0922 3932        mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

16:57:58.0938 3932        mshidkmdf - ok

16:57:58.0954 3932        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys

16:57:58.0954 3932        msisadrv - ok

16:57:58.0954 3932        MSiSCSI         (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll

16:57:58.0985 3932        MSiSCSI - ok

16:57:58.0985 3932        msiserver - ok

16:57:59.0000 3932        MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

16:57:59.0016 3932        MSKSSRV - ok

16:57:59.0032 3932        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

16:57:59.0047 3932        MSPCLOCK - ok

16:57:59.0047 3932        MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

16:57:59.0063 3932        MSPQM - ok

16:57:59.0078 3932        MsRPC           (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys

16:57:59.0094 3932        MsRPC - ok

16:57:59.0094 3932        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys

16:57:59.0110 3932        mssmbios - ok

16:57:59.0110 3932        MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

16:57:59.0125 3932        MSTEE - ok

16:57:59.0141 3932        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys

16:57:59.0141 3932        MTConfig - ok

16:57:59.0156 3932        Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

16:57:59.0156 3932        Mup - ok

16:57:59.0172 3932        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll

16:57:59.0203 3932        napagent - ok

16:57:59.0203 3932        NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

16:57:59.0219 3932        NativeWifiP - ok

16:57:59.0234 3932        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys

16:57:59.0250 3932        NDIS - ok

16:57:59.0266 3932        NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

16:57:59.0281 3932        NdisCap - ok

16:57:59.0297 3932        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

16:57:59.0312 3932        NdisTapi - ok

16:57:59.0312 3932        Ndisuio         (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys

16:57:59.0344 3932        Ndisuio - ok

16:57:59.0344 3932        NdisWan         (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys

16:57:59.0359 3932        NdisWan - ok

16:57:59.0375 3932        NDProxy         (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys

16:57:59.0390 3932        NDProxy - ok

16:57:59.0406 3932        Net Driver HPZ12 (2334dc48997ba203b794df3ee70521db) C:\Windows\system32\HPZinw12.dll

16:57:59.0406 3932        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning

16:57:59.0406 3932        Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)

16:57:59.0406 3932        NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

16:57:59.0437 3932        NetBIOS - ok

16:57:59.0437 3932        NetBT           (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys

16:57:59.0468 3932        NetBT - ok

16:57:59.0468 3932        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

16:57:59.0468 3932        Netlogon - ok

16:57:59.0484 3932        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll

16:57:59.0500 3932        Netman - ok

16:57:59.0515 3932        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll

16:57:59.0546 3932        netprofm - ok

16:57:59.0546 3932        NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

16:57:59.0546 3932        NetTcpPortSharing - ok

16:57:59.0562 3932        nfrd960         (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys

16:57:59.0562 3932        nfrd960 - ok

16:57:59.0578 3932        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll

16:57:59.0593 3932        NlaSvc - ok

16:57:59.0593 3932        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

16:57:59.0624 3932        Npfs - ok

16:57:59.0624 3932        nsi             (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll

16:57:59.0640 3932        nsi - ok

16:57:59.0656 3932        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

16:57:59.0671 3932        nsiproxy - ok

16:57:59.0687 3932        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys

16:57:59.0718 3932        Ntfs - ok

16:57:59.0718 3932        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

16:57:59.0749 3932        Null - ok

16:57:59.0749 3932        NVHDA           (960e39a54e525df58cb29193147dffa1) C:\Windows\system32\drivers\nvhda64v.sys

16:57:59.0765 3932        NVHDA - ok

16:57:59.0890 3932        nvlddmkm        (cc1efea1f0ab17e59bd4b5baff3e5cb0) C:\Windows\system32\DRIVERS\nvlddmkm.sys

16:57:59.0999 3932        nvlddmkm - ok

16:58:00.0014 3932        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys

16:58:00.0014 3932        nvraid - ok

16:58:00.0030 3932        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys

16:58:00.0030 3932        nvstor - ok

16:58:00.0046 3932        NVSvc           (39f933ca2798156b0b7a19d104b73b9a) C:\Windows\system32\nvvsvc.exe

16:58:00.0061 3932        NVSvc - ok

16:58:00.0092 3932        nvUpdatusService (4e5c5d88eb0a8d21824d5a3eb7327e69) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

16:58:00.0124 3932        nvUpdatusService - ok

16:58:00.0124 3932        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys

16:58:00.0139 3932        nv_agp - ok

16:58:00.0139 3932        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys

16:58:00.0155 3932        ohci1394 - ok

16:58:00.0155 3932        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

16:58:00.0170 3932        p2pimsvc - ok

16:58:00.0186 3932        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll

16:58:00.0186 3932        p2psvc - ok

16:58:00.0202 3932        Parport         (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys

16:58:00.0202 3932        Parport - ok

16:58:00.0217 3932        partmgr         (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys

16:58:00.0217 3932        partmgr - ok

16:58:00.0217 3932        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll

16:58:00.0233 3932        PcaSvc - ok

16:58:00.0248 3932        pci             (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys

16:58:00.0248 3932        pci - ok

16:58:00.0264 3932        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys

16:58:00.0264 3932        pciide - ok

16:58:00.0280 3932        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys

16:58:00.0280 3932        pcmcia - ok

16:58:00.0295 3932        pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

16:58:00.0295 3932        pcw - ok

16:58:00.0311 3932        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

16:58:00.0326 3932        PEAUTH - ok

16:58:00.0342 3932        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe

16:58:00.0342 3932        PerfHost - ok

16:58:00.0373 3932        pla             (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll

16:58:00.0404 3932        pla - ok

16:58:00.0420 3932        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll

16:58:00.0420 3932        PlugPlay - ok

16:58:00.0436 3932        Pml Driver HPZ12 (ac78df349f0e4cfb8b667c0cfff83cce) C:\Windows\system32\HPZipm12.dll

16:58:00.0436 3932        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning

16:58:00.0436 3932        Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)

16:58:00.0451 3932        PNRPAutoReg     (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll

16:58:00.0451 3932        PNRPAutoReg - ok

16:58:00.0467 3932        PNRPsvc         (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

16:58:00.0467 3932        PNRPsvc - ok

16:58:00.0482 3932        PolicyAgent     (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll

16:58:00.0498 3932        PolicyAgent - ok

16:58:00.0514 3932        Power           (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll

16:58:00.0529 3932        Power - ok

16:58:00.0545 3932        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys

16:58:00.0560 3932        PptpMiniport - ok

16:58:00.0576 3932        Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys

16:58:00.0576 3932        Processor - ok

16:58:00.0592 3932        ProfSvc         (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll

16:58:00.0607 3932        ProfSvc - ok

16:58:00.0623 3932        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

16:58:00.0623 3932        ProtectedStorage - ok

16:58:00.0638 3932        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys

16:58:00.0654 3932        Psched - ok

16:58:00.0670 3932        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys

16:58:00.0701 3932        ql2300 - ok

16:58:00.0701 3932        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys

16:58:00.0716 3932        ql40xx - ok

16:58:00.0716 3932        QWAVE           (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll

16:58:00.0732 3932        QWAVE - ok

16:58:00.0732 3932        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

16:58:00.0748 3932        QWAVEdrv - ok

16:58:00.0748 3932        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

16:58:00.0779 3932        RasAcd - ok

16:58:00.0779 3932        RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

16:58:00.0794 3932        RasAgileVpn - ok

16:58:00.0810 3932        RasAuto         (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll

16:58:00.0826 3932        RasAuto - ok

16:58:00.0841 3932        Rasl2tp         (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys

16:58:00.0857 3932        Rasl2tp - ok

16:58:00.0872 3932        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll

16:58:00.0888 3932        RasMan - ok

16:58:00.0904 3932        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

16:58:00.0919 3932        RasPppoe - ok

16:58:00.0935 3932        RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

16:58:00.0950 3932        RasSstp - ok

16:58:00.0966 3932        rdbss           (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys

16:58:00.0982 3932        rdbss - ok

16:58:00.0982 3932        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys

16:58:00.0997 3932        rdpbus - ok

16:58:00.0997 3932        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

16:58:01.0028 3932        RDPCDD - ok

16:58:01.0028 3932        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

16:58:01.0060 3932        RDPENCDD - ok

16:58:01.0060 3932        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

16:58:01.0075 3932        RDPREFMP - ok

16:58:01.0091 3932        RDPWD           (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys

16:58:01.0091 3932        RDPWD - ok

16:58:01.0106 3932        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys

16:58:01.0122 3932        rdyboost - ok

16:58:01.0122 3932        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll

16:58:01.0138 3932        RemoteAccess - ok

16:58:01.0153 3932        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll

16:58:01.0169 3932        RemoteRegistry - ok

16:58:01.0184 3932        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll

16:58:01.0200 3932        RpcEptMapper - ok

16:58:01.0200 3932        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe

16:58:01.0216 3932        RpcLocator - ok

16:58:01.0231 3932        RpcSs           (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll

16:58:01.0247 3932        RpcSs - ok

16:58:01.0262 3932        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

16:58:01.0278 3932        rspndr - ok

16:58:01.0294 3932        RTL8167         (ee082e06a82ff630351d1e0ebbd3d8d0) C:\Windows\system32\DRIVERS\Rt64win7.sys

16:58:01.0294 3932        RTL8167 - ok

16:58:01.0309 3932        RTL85n64        (e826e8c47415cafc09ec6a6ea0862edd) C:\Windows\system32\DRIVERS\RTL85n64.sys

16:58:01.0325 3932        RTL85n64 - ok

16:58:01.0325 3932        SamSs           (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

16:58:01.0325 3932        SamSs - ok

16:58:01.0340 3932        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys

16:58:01.0340 3932        sbp2port - ok

16:58:01.0356 3932        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll

16:58:01.0372 3932        SCardSvr - ok

16:58:01.0387 3932        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys

16:58:01.0403 3932        scfilter - ok

16:58:01.0418 3932        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll

16:58:01.0450 3932        Schedule - ok

16:58:01.0465 3932        SCPolicySvc     (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll

16:58:01.0481 3932        SCPolicySvc - ok

16:58:01.0481 3932        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll

16:58:01.0496 3932        SDRSVC - ok

16:58:01.0496 3932        SeaPort         (331e7bde228914574fc9ae6cd520dafa) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

16:58:01.0512 3932        SeaPort - ok

16:58:01.0512 3932        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

16:58:01.0543 3932        secdrv - ok

16:58:01.0543 3932        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll

16:58:01.0559 3932        seclogon - ok

16:58:01.0574 3932        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll

16:58:01.0590 3932        SENS - ok

16:58:01.0606 3932        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll

16:58:01.0606 3932        SensrSvc - ok

16:58:01.0621 3932        Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys

16:58:01.0621 3932        Serenum - ok

16:58:01.0637 3932        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys

16:58:01.0637 3932        Serial - ok

16:58:01.0652 3932        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys

16:58:01.0652 3932        sermouse - ok

16:58:01.0668 3932        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll

16:58:01.0684 3932        SessionEnv - ok

16:58:01.0684 3932        sffdisk         (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys

16:58:01.0699 3932        sffdisk - ok

16:58:01.0699 3932        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys

16:58:01.0715 3932        sffp_mmc - ok

16:58:01.0715 3932        sffp_sd         (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys

16:58:01.0730 3932        sffp_sd - ok

16:58:01.0730 3932        sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys

16:58:01.0746 3932        sfloppy - ok

16:58:01.0746 3932        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll

16:58:01.0777 3932        SharedAccess - ok

16:58:01.0793 3932        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll

16:58:01.0808 3932        ShellHWDetection - ok

16:58:01.0824 3932        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys

16:58:01.0824 3932        SiSRaid2 - ok

16:58:01.0840 3932        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys

16:58:01.0840 3932        SiSRaid4 - ok

16:58:01.0855 3932        Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

16:58:01.0871 3932        Smb - ok

16:58:01.0871 3932        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe

16:58:01.0886 3932        SNMPTRAP - ok

16:58:01.0886 3932        spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

16:58:01.0902 3932        spldr - ok

16:58:01.0918 3932        Spooler         (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe

16:58:01.0933 3932        Spooler - ok

16:58:01.0964 3932        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe

16:58:02.0027 3932        sppsvc - ok

16:58:02.0027 3932        sppuinotify     (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll

16:58:02.0042 3932        sppuinotify - ok

16:58:02.0058 3932        srv             (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys

16:58:02.0074 3932        srv - ok

16:58:02.0074 3932        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys

16:58:02.0089 3932        srv2 - ok

16:58:02.0105 3932        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys

16:58:02.0105 3932        srvnet - ok

16:58:02.0120 3932        SSDPSRV         (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll

16:58:02.0136 3932        SSDPSRV - ok

16:58:02.0136 3932        SstpSvc         (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll

16:58:02.0167 3932        SstpSvc - ok

16:58:02.0167 3932        Stereo Service  (9bf7e58d9113ce15cf4f1e1b18ceff83) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

16:58:02.0183 3932        Stereo Service - ok

16:58:02.0183 3932        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys

16:58:02.0183 3932        stexstor - ok

16:58:02.0198 3932        StillCam        (decacb6921ded1a38642642685d77dac) C:\Windows\system32\DRIVERS\serscan.sys

16:58:02.0214 3932        StillCam - ok

16:58:02.0214 3932        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll

16:58:02.0245 3932        stisvc - ok

16:58:02.0245 3932        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys

16:58:02.0245 3932        swenum - ok

16:58:02.0261 3932        swprv           (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll

16:58:02.0292 3932        swprv - ok

16:58:02.0308 3932        SysMain         (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll

16:58:02.0339 3932        SysMain - ok

16:58:02.0339 3932        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll

16:58:02.0354 3932        TabletInputService - ok

16:58:02.0354 3932        TapiSrv         (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll

16:58:02.0386 3932        TapiSrv - ok

16:58:02.0386 3932        TBS             (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll

16:58:02.0401 3932        TBS - ok

16:58:02.0432 3932        Tcpip           (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys

16:58:02.0464 3932        Tcpip - ok

16:58:02.0479 3932        TCPIP6          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys

16:58:02.0510 3932        TCPIP6 - ok

16:58:02.0510 3932        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys

16:58:02.0526 3932        tcpipreg - ok

16:58:02.0542 3932        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

16:58:02.0542 3932        TDPIPE - ok

16:58:02.0557 3932        TDTCP           (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys

16:58:02.0557 3932        TDTCP - ok

16:58:02.0573 3932        tdx             (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys

16:58:02.0588 3932        tdx - ok

16:58:02.0604 3932        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys

16:58:02.0604 3932        TermDD - ok

16:58:02.0620 3932        TermService     (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll

16:58:02.0651 3932        TermService - ok

16:58:02.0651 3932        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll

16:58:02.0666 3932        Themes - ok

16:58:02.0666 3932        THREADORDER     (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

16:58:02.0698 3932        THREADORDER - ok

16:58:02.0698 3932        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll

16:58:02.0713 3932        TrkWks - ok

16:58:02.0729 3932        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe

16:58:02.0744 3932        TrustedInstaller - ok

16:58:02.0760 3932        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys

16:58:02.0776 3932        tssecsrv - ok

16:58:02.0776 3932        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys

16:58:02.0791 3932        TsUsbFlt - ok

16:58:02.0791 3932        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys

16:58:02.0807 3932        tunnel - ok

16:58:02.0822 3932        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys

16:58:02.0822 3932        uagp35 - ok

16:58:02.0838 3932        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys

16:58:02.0854 3932        udfs - ok

16:58:02.0869 3932        UI0Detect       (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe

16:58:02.0869 3932        UI0Detect - ok

16:58:02.0885 3932        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys

16:58:02.0885 3932        uliagpkx - ok

16:58:02.0900 3932        umbus           (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys

16:58:02.0900 3932        umbus - ok

16:58:02.0916 3932        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys

16:58:02.0916 3932        UmPass - ok

16:58:02.0932 3932        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll

16:58:02.0947 3932        upnphost - ok

16:58:02.0963 3932        usbccgp         (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys

16:58:02.0963 3932        usbccgp - ok

16:58:02.0978 3932        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys

16:58:02.0994 3932        usbcir - ok

16:58:02.0994 3932        usbehci         (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys

16:58:03.0010 3932        usbehci - ok

16:58:03.0010 3932        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys

16:58:03.0025 3932        usbhub - ok

16:58:03.0025 3932        usbohci         (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys

16:58:03.0041 3932        usbohci - ok

16:58:03.0041 3932        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys

16:58:03.0056 3932        usbprint - ok

16:58:03.0056 3932        USBSTOR         (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS

16:58:03.0072 3932        USBSTOR - ok

16:58:03.0072 3932        usbuhci         (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys

16:58:03.0088 3932        usbuhci - ok

16:58:03.0088 3932        UxSms           (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll

16:58:03.0119 3932        UxSms - ok

16:58:03.0119 3932        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

16:58:03.0119 3932        VaultSvc - ok

16:58:03.0134 3932        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys

16:58:03.0134 3932        vdrvroot - ok

16:58:03.0150 3932        vds             (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe

16:58:03.0181 3932        vds - ok

16:58:03.0197 3932        vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

16:58:03.0197 3932        vga - ok

16:58:03.0212 3932        VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

16:58:03.0228 3932        VgaSave - ok

16:58:03.0228 3932        vhdmp           (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys

16:58:03.0244 3932        vhdmp - ok

16:58:03.0244 3932        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys

16:58:03.0259 3932        viaide - ok

16:58:03.0259 3932        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys

16:58:03.0259 3932        volmgr - ok

16:58:03.0275 3932        volmgrx         (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys

16:58:03.0290 3932        volmgrx - ok

16:58:03.0290 3932        volsnap         (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys

16:58:03.0306 3932        volsnap - ok

16:58:03.0306 3932        vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys

16:58:03.0322 3932        vsmraid - ok

16:58:03.0337 3932        VSS             (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe

16:58:03.0368 3932        VSS - ok

16:58:03.0368 3932        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys

16:58:03.0384 3932        vwifibus - ok

16:58:03.0400 3932        W32Time         (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll

16:58:03.0415 3932        W32Time - ok

16:58:03.0431 3932        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys

16:58:03.0431 3932        WacomPen - ok

16:58:03.0446 3932        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

16:58:03.0462 3932        WANARP - ok

16:58:03.0462 3932        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

16:58:03.0478 3932        Wanarpv6 - ok

16:58:03.0509 3932        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe

16:58:03.0524 3932        wbengine - ok

16:58:03.0540 3932        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll

16:58:03.0556 3932        WbioSrvc - ok

16:58:03.0556 3932        wcncsvc         (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll

16:58:03.0571 3932        wcncsvc - ok

16:58:03.0587 3932        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll

16:58:03.0587 3932        WcsPlugInService - ok

16:58:03.0602 3932        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys

16:58:03.0602 3932        Wd - ok

16:58:03.0618 3932        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

16:58:03.0634 3932        Wdf01000 - ok

16:58:03.0634 3932        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

16:58:03.0665 3932        WdiServiceHost - ok

16:58:03.0665 3932        WdiSystemHost   (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

16:58:03.0665 3932        WdiSystemHost - ok

16:58:03.0680 3932        WebClient       (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll

16:58:03.0696 3932        WebClient - ok

16:58:03.0696 3932        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll

16:58:03.0727 3932        Wecsvc - ok

16:58:03.0727 3932        wercplsupport   (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll

16:58:03.0758 3932        wercplsupport - ok

16:58:03.0758 3932        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll

16:58:03.0774 3932        WerSvc - ok

16:58:03.0790 3932        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

16:58:03.0805 3932        WfpLwf - ok

16:58:03.0821 3932        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

16:58:03.0821 3932        WIMMount - ok

16:58:03.0821 3932        WinDefend - ok

16:58:03.0821 3932        WinHttpAutoProxySvc - ok

16:58:03.0836 3932        Winmgmt         (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll

16:58:03.0852 3932        Winmgmt - ok

16:58:03.0883 3932        WinRM           (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll

16:58:03.0961 3932        WinRM - ok

16:58:03.0977 3932        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys

16:58:03.0992 3932        WinUsb - ok

16:58:04.0008 3932        Wlansvc         (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll

16:58:04.0024 3932        Wlansvc - ok

16:58:04.0039 3932        wlidsvc         (98f138897ef4246381d197cb81846d62) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

16:58:04.0070 3932        wlidsvc - ok

16:58:04.0086 3932        WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys

16:58:04.0086 3932        WmiAcpi - ok

16:58:04.0102 3932        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe

16:58:04.0117 3932        wmiApSrv - ok

16:58:04.0117 3932        WMPNetworkSvc - ok

16:58:04.0117 3932        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll

16:58:04.0133 3932        WPCSvc - ok

16:58:04.0133 3932        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll

16:58:04.0148 3932        WPDBusEnum - ok

16:58:04.0148 3932        ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

16:58:04.0164 3932        ws2ifsl - ok

16:58:04.0180 3932        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll

16:58:04.0195 3932        wscsvc - ok

16:58:04.0195 3932        WSearch - ok

16:58:04.0242 3932        wuauserv        (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll

16:58:04.0304 3932        wuauserv - ok

16:58:04.0304 3932        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys

16:58:04.0336 3932        WudfPf - ok

16:58:04.0336 3932        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys

16:58:04.0367 3932        WUDFRd - ok

16:58:04.0367 3932        wudfsvc         (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll

16:58:04.0382 3932        wudfsvc - ok

16:58:04.0398 3932        WwanSvc         (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll

16:58:04.0414 3932        WwanSvc - ok

16:58:04.0414 3932        MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk1\DR1

16:58:04.0429 3932        \Device\Harddisk1\DR1 - ok

16:58:04.0429 3932        MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0

16:58:04.0492 3932        \Device\Harddisk0\DR0 - ok

16:58:04.0492 3932        Boot (0x1200)   (0ae37a1ffdd1dd661997ada57727af4c) \Device\Harddisk1\DR1\Partition0

16:58:04.0492 3932        \Device\Harddisk1\DR1\Partition0 - ok

16:58:04.0492 3932        Boot (0x1200)   (49f0ff51db240941792530caba0f4fd2) \Device\Harddisk1\DR1\Partition1

16:58:04.0492 3932        \Device\Harddisk1\DR1\Partition1 - ok

16:58:04.0492 3932        Boot (0x1200)   (0a8b751de5140259d2de7332a6537925) \Device\Harddisk0\DR0\Partition0

16:58:04.0492 3932        \Device\Harddisk0\DR0\Partition0 - ok

16:58:04.0507 3932        ============================================================

16:58:04.0507 3932        Scan finished

16:58:04.0507 3932        ============================================================

16:58:04.0507 4996        Detected object count: 3

16:58:04.0507 4996        Actual detected object count: 3

16:58:28.0391 4996        HPSLPSVC ( UnsignedFile.Multi.Generic ) - skipped by user

16:58:28.0391 4996        HPSLPSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip 

16:58:28.0391 4996        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user

16:58:28.0391 4996        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

16:58:28.0391 4996        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user

16:58:28.0391 4996        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Ok hier der ComboFix Log:

Code:

ComboFix 12-04-05.08 - PC 06.04.2012   0:20.1.8 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.16365.14981 [GMT 2:00]

ausgeführt von:: c:\users\PC\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-03-05 bis 2012-04-05  ))))))))))))))))))))))))))))))

.

.

2012-04-05 22:21 . 2012-04-05 22:21        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp

2012-04-05 22:21 . 2012-04-05 22:21        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-04-05 10:36 . 2012-04-05 10:36        --------        d-----w-        C:\_OTL

2012-04-02 18:27 . 2012-04-02 18:27        --------        d-----w-        c:\users\PC\AppData\Roaming\Malwarebytes

2012-04-02 18:27 . 2012-04-02 18:27        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2012-04-02 18:27 . 2012-04-02 18:27        --------        d-----w-        c:\programdata\Malwarebytes

2012-04-02 18:27 . 2011-12-10 13:24        23152        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-03-14 17:10 . 2011-11-19 15:20        5559152        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-03-14 17:10 . 2011-11-19 14:50        3968368        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2012-03-14 17:10 . 2011-11-19 14:50        3913584        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2012-03-14 14:53 . 2012-02-03 04:34        3145728        ----a-w-        c:\windows\system32\win32k.sys

2012-03-14 14:53 . 2012-02-10 06:36        1544192        ----a-w-        c:\windows\system32\DWrite.dll

2012-03-14 14:53 . 2012-02-10 05:38        1077248        ----a-w-        c:\windows\SysWow64\DWrite.dll

2012-03-14 14:33 . 2012-02-17 06:38        1031680        ----a-w-        c:\windows\system32\rdpcore.dll

2012-03-14 14:33 . 2012-02-17 05:34        826880        ----a-w-        c:\windows\SysWow64\rdpcore.dll

2012-03-14 14:33 . 2012-02-17 04:58        210944        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-03-14 14:33 . 2012-02-17 04:57        23552        ----a-w-        c:\windows\system32\drivers\tdtcp.sys

2012-03-14 14:33 . 2012-01-25 06:38        77312        ----a-w-        c:\windows\system32\rdpwsx.dll

2012-03-14 14:33 . 2012-01-25 06:38        149504        ----a-w-        c:\windows\system32\rdpcorekmts.dll

2012-03-14 14:33 . 2012-01-25 06:33        9216        ----a-w-        c:\windows\system32\rdrmemptylst.exe

2012-03-14 14:31 . 2012-04-05 10:30        --------        d-----w-        c:\users\PC\AppData\Roaming\Softlink

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-02-21 12:47 . 2011-10-21 11:29        414368        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-02-15 12:28 . 2011-10-20 11:02        132320        ----a-w-        c:\windows\system32\drivers\avipbb.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-05-20 36864]

"DriveTheLife"="c:\program files (x86)\DriveTheLife\DriveTheLife.exe" [2012-02-13 1175440]

"Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]

"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]

Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

Wireless Configuration Utility HW.15.lnk - c:\program files (x86)\802.11 Wireless LAN\802.11g Wireless CardBus & PCI Adapter HW.15 V.1.00\WlanCU.exe [2007-4-13 413696]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]

R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-10-11 86224]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-08-03 379496]

S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [x]

S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [x]

S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

S3 RTL85n64;Realtek 8180/8185 Extensible 802.11 Wireless Device Driver;c:\windows\system32\DRIVERS\RTL85n64.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-05-31 11855976]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.gmx.net/

mLocal Page = c:\windows\SysWOW64\blank.htm

TCP: DhcpNameServer = 192.168.0.1

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe

c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-04-06  00:24:04 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-04-05 22:24

.

Vor Suchlauf: 13 Verzeichnis(se), 15.140.098.048 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 14.463.258.624 Bytes frei

.

- - End Of File - - 06CD71540818DFDE5674CF4EFE873F8C

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Ok hier der Log:

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-04-06 17:53:39

-----------------------------

17:53:39.608    OS Version: Windows x64 6.1.7601 Service Pack 1

17:53:39.608    Number of processors: 8 586 0x2A07

17:53:39.608    ComputerName: BLUE-DRAGON  UserName: PC

17:53:39.733    Initialize success

17:56:49.021    AVAST engine defs: 12040600

17:57:02.578    Disk 0  \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2

17:57:02.578    Disk 0 Vendor: Hitachi_HDS5C3020ALA632 ML6OA580 Size: 1907729MB BusType: 11

17:57:02.578    Disk 1 (boot) \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T0L0-1

17:57:02.578    Disk 1 Vendor: OCZ-VERTEX2 1.29 Size: 57241MB BusType: 11

17:57:02.578    Disk 1 MBR read successfully

17:57:02.593    Disk 1 MBR scan

17:57:02.593    Disk 1 Windows 7 default MBR code

17:57:02.593    Disk 1 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048

17:57:02.593    Disk 1 Partition 2 00     07    HPFS/NTFS NTFS        57139 MB offset 206848

17:57:02.609    Disk 1 scanning C:\Windows\system32\drivers

17:57:04.528    Service scanning

17:57:09.332    Modules scanning

17:57:09.332    Disk 1 trace - called modules:

17:57:09.847    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys 

17:57:09.847    1 nt!IofCallDriver -> \Device\Harddisk1\DR1[0xfffffa800ce7d060]

17:57:09.847    3 CLASSPNP.SYS[fffff8800165143f] -> nt!IofCallDriver -> [0xfffffa800c7be240]

17:57:09.863    5 ACPI.sys[fffff88000d677a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-1[0xfffffa800cc40060]

17:57:09.972    AVAST engine scan C:\Windows

17:57:10.534    AVAST engine scan C:\Windows\system32

17:57:50.454    AVAST engine scan C:\Windows\system32\drivers

17:57:52.903    AVAST engine scan C:\Users\PC

17:57:59.877    AVAST engine scan C:\ProgramData

17:58:02.591    Scan finished successfully

17:58:25.429    Disk 1 MBR has been saved successfully to "C:\Users\PC\Desktop\MBR.dat"

17:58:25.445    The log file has been saved successfully to "C:\Users\PC\Desktop\aswMBR.txt"

Hoffe ist richtig so, sieht so wenig aus.

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

So hier der Log von Malwarebytes:

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.04.06.06
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

PC :: BLUE-DRAGON [Administrator]
 

Schutz: Deaktiviert
 

06.04.2012 18:23:11

mbam-log-2012-04-06 (18-23-11).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 317738

Laufzeit: 6 Minute(n), 10 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Und hier der von SuperAntiSpyware:

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 04/06/2012 at 06:44 PM
 

Application Version : 5.0.1146
 

Core Rules Database Version : 8424

Trace Rules Database Version: 6236
 

Scan type       : Complete Scan

Total Scan Time : 00:11:28
 

Operating System Information

Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Administrator
 

Memory items scanned      : 605

Memory threats detected   : 0

Registry items scanned    : 68680

Registry threats detected : 0

File items scanned        : 128428

File threats detected     : 309
 

Adware.Tracking Cookie

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\pc@ad-plus[1].txt [ /ad-plus ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\pc@hfmcompany.122.2o7[1].txt [ /hfmcompany.122.2o7 ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\pc@imrworldwide[2].txt [ /imrworldwide ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\pc@lstat.youku[1].txt [ /lstat.youku ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\pc@msnportal.112.2o7[1].txt [ /msnportal.112.2o7 ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\TQ3RNEUQ.txt [ /track.effiliation.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\7KNDD3TS.txt [ /stat.xunlei.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\X22DNJTS.txt [ /ad.zanox.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\XR0NQPV1.txt [ /www.windowsmedia.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\O1XENJO2.txt [ /mediav.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\R7SFRZXG.txt [ /smartadserver.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\41DMPLKA.txt [ /doubleclick.net ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\AJ10DZFJ.txt [ /atdmt.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\QFCXVR9E.txt [ /webmasterplan.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\XUGAUHF8.txt [ /track.ra.icast.cn ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\GRX3QOQO.txt [ /tracking.quisma.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\EWXR8YKT.txt [ /amazon-adsystem.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\X6III6PI.txt [ /adsame.tianjimedia.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\AMWBNF6A.txt [ /studivz.adfarm1.adition.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\ETLNKZ8N.txt [ /click.trends.com.cn ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\AL0TXAS0.txt [ /adv.zllm.net ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\KW3R3IT5.txt [ /mediaplex.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\LSJ18EKC.txt [ /zanox.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\1XPP98PF.txt [ /www.zanox-affiliate.de ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\GUH9DVSB.txt [ /bsch.serving-sys.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\1Z21PLHA.txt [ /adfarm1.adition.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\RUB3DQBF.txt [ /zanox-affiliate.de ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\92P2OOTG.txt [ /ad3.adfarm1.adition.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\UWSZ6P85.txt [ /ad1.dyntracker.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\YYEZ44ZP.txt [ /partypoker.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\YXT5Y6MV.txt [ /fastclick.net ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\7YASDNZV.txt [ /serving-sys.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\19ZN10AL.txt [ /questionmarket.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\4GELZ31I.txt [ /ads2.medianord.de ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\H6C8BZ8P.txt [ /apmebf.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\H70849IV.txt [ /ad2.adfarm1.adition.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\0GHOTMCF.txt [ /ad.360yield.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\29NCX85N.txt [ /dyntracker.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\DH7M46NE.txt [ /ad.ad-srv.net ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\8RUR4N33.txt [ /ad1.adfarm1.adition.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\MM4FH5NR.txt [ /c.atdmt.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\TUU4EV8Z.txt [ /click.oyeclick.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\BHERT9RX.txt [ /ad.dyntracker.de ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\8Q54XXVR.txt [ /invitemedia.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\10MLO4FL.txt [ /track.effiliation.com ]

        C:\Users\PC\AppData\Roaming\Microsoft\Windows\Cookies\U5FWTNAV.txt [ /mmstat.com ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\91URW2JL.txt [ Cookie:pc@pconline.com.cn/newcount/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\KPLDARAG.txt [ Cookie:pc@track.effiliation.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\95OET2NW.txt [ Cookie:pc@im.banner.t-online.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\pc@livestat.derstandard[1].txt [ Cookie:pc@livestat.derstandard.at/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\Y9XZI4AW.txt [ Cookie:pc@2o7.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\pc@xiti[1].txt [ Cookie:pc@xiti.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\UXD1S29E.txt [ Cookie:pc@www.burstnet.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\ECM5P97G.txt [ Cookie:pc@ru4.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZFRR6697.txt [ Cookie:pc@beamer-discount.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\5X34L616.txt [ Cookie:pc@ad.dyntracker.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\03J7Y7US.txt [ Cookie:pc@yadro.ru/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\5XI71F4Y.txt [ Cookie:pc@doubleclick.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\F2GQX52Z.txt [ Cookie:pc@webmasterplan.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\pc@e-2dj6wgkysjc5egq.stats.esomniture[2].txt [ Cookie:pc@e-2dj6wgkysjc5egq.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\1ZZT9FTX.txt [ Cookie:pc@tracking.mindshare.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\MLRLB4DK.txt [ Cookie:pc@www.rambler.ru/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\TPPQKHWT.txt [ Cookie:pc@kontera.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\G08V42YX.txt [ Cookie:pc@liveperson.net/hc/90688962 ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\FHPW3HW9.txt [ Cookie:pc@ad1.adfarm1.adition.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\pc@sonyeurope.112.2o7[1].txt [ Cookie:pc@sonyeurope.112.2o7.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\TNGZRMHH.txt [ Cookie:pc@e-2dj6wjnygmdpmep.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\XGVQNIDH.txt [ Cookie:pc@content.yieldmanager.com/ak/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\YUEZWIXX.txt [ Cookie:pc@track.adform.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\8C4RDG20.txt [ Cookie:pc@ad.adserver01.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\HSL62CCM.txt [ Cookie:pc@ad.yieldmanager.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\XU7O58OP.txt [ Cookie:pc@bs.serving-sys.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\19HHJX7V.txt [ Cookie:pc@mediaplex.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\NTH3Z0YN.txt [ Cookie:pc@statcounter.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\pc@stats.paypal[2].txt [ Cookie:pc@stats.paypal.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\TSH4VHWR.txt [ Cookie:pc@zanox.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\22I2KMYY.txt [ Cookie:pc@invitemedia.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\AVLYX148.txt [ Cookie:pc@zbox.zanox.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\pc@discount24[1].txt [ Cookie:pc@discount24.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\pc@msnportal.112.2o7[1].txt [ Cookie:pc@msnportal.112.2o7.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\9G7TYB24.txt [ Cookie:pc@adtech.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\KSTQ27V4.txt [ Cookie:pc@revsci.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\BRAAXAVC.txt [ Cookie:pc@banner.testberichte.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\pc@s2.trafficmaxx[1].txt [ Cookie:pc@s2.trafficmaxx.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\4J2QAB9J.txt [ Cookie:pc@zanox-affiliate.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\2SQDHGF8.txt [ Cookie:pc@unitymedia.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\4ZGWCIVU.txt [ Cookie:pc@ad3.adfarm1.adition.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\YGG53MWP.txt [ Cookie:pc@eas.apm.emediate.eu/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\3APL8XIJ.txt [ Cookie:pc@viacom.adbureau.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\pc@de.sitestat[2].txt [ Cookie:pc@de.sitestat.com/is24/is24/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\7XGU8GHA.txt [ Cookie:pc@collective-media.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\2SE0VARO.txt [ Cookie:pc@traffictrack.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\BQLC3OOW.txt [ Cookie:pc@fastclick.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\LVA6NA0X.txt [ Cookie:pc@ww251.smartadserver.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\EYLNFH4W.txt [ Cookie:pc@de.sitestat.com/karstadt-de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\J0UPZBS3.txt [ Cookie:pc@serving-sys.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\YKH2KAUA.txt [ Cookie:pc@track.effiliation.com/servlet/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\SLO446AQ.txt [ Cookie:pc@adviva.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\VA7WUM1Q.txt [ Cookie:pc@banners.audioholics.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\SMGGMN3C.txt [ Cookie:pc@ad2.adfarm1.adition.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\KK9SRPA5.txt [ Cookie:pc@mm.chitika.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\917QD44K.txt [ Cookie:pc@tracking.mobile.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\pc@e-2dj6wjk4wgazmho.stats.esomniture[2].txt [ Cookie:pc@e-2dj6wjk4wgazmho.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\0YD91Z18.txt [ Cookie:pc@mediamarkt.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\OQQETBGB.txt [ Cookie:pc@statse.webtrendslive.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\EKACP6R8.txt [ Cookie:pc@autoscout24.112.2o7.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\1G8KEWX8.txt [ Cookie:pc@www.etracker.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\pc@e-2dj6wmmykkcpmdo.stats.esomniture[2].txt [ Cookie:pc@e-2dj6wmmykkcpmdo.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\GC699J9V.txt [ Cookie:pc@www.google.com/accounts ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\UURR2WUL.txt [ Cookie:pc@e-2dj6wjmyogazeap.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\K1OJBTCQ.txt [ Cookie:pc@media6degrees.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\5B9JXVAZ.txt [ Cookie:pc@legolas-media.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\SD3IA1KN.txt [ Cookie:pc@countomat.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\pc@imrworldwide[2].txt [ Cookie:pc@imrworldwide.com/cgi-bin ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\pc@dealtime[1].txt [ Cookie:pc@dealtime.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\WCF5E5F1.txt [ Cookie:pc@adxpose.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\FEM1OKQC.txt [ Cookie:pc@e-2dj6wfkogkdjwlp.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\5TV1KOYR.txt [ Cookie:pc@de.sitestat.com/karstadt-de/karstadt/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\XH4WE0U6.txt [ Cookie:pc@adserver2.clipkit.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\WMEIHKC7.txt [ Cookie:pc@de.sitestat.com/sportscheck/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\9T9PFRVK.txt [ Cookie:pc@adserver.twitpic.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\3FPNWG9S.txt [ Cookie:pc@studivz.adfarm1.adition.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\7F3UORM8.txt [ Cookie:pc@www.usenext.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\V7XUYWEP.txt [ Cookie:pc@tto2.traffictrack.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\8HD1WE5W.txt [ Cookie:pc@clicks.oxid-efire.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\0LSU729L.txt [ Cookie:pc@t.bbtrack.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\1RJ2W965.txt [ Cookie:pc@e-2dj6wflywndjskq.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\THSCPIB5.txt [ Cookie:pc@enterotracker.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\02GX3XZF.txt [ Cookie:pc@mediastar.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\PQOV53PW.txt [ Cookie:pc@www.mediamarkt.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\KCRC1D20.txt [ Cookie:pc@fl01.ct2.comclick.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z04B2Y9K.txt [ Cookie:pc@int.sitestat.com/panasonic/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\5B9OZ5KT.txt [ Cookie:pc@hearstugo.112.2o7.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\41EYHUYL.txt [ Cookie:pc@adserver.pferde-verlag.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\CD1TSYI5.txt [ Cookie:pc@frankwalder.traffective-tracking.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\pc@e-2dj6wjlosid5ogo.stats.esomniture[2].txt [ Cookie:pc@e-2dj6wjlosid5ogo.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\8HMV45RO.txt [ Cookie:pc@ad.adnet.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\X5GVOJC8.txt [ Cookie:pc@nextstat.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\pc@sonyscei.112.2o7[1].txt [ Cookie:pc@sonyscei.112.2o7.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\pc@conrad.122.2o7[1].txt [ Cookie:pc@conrad.122.2o7.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\9O36AWQF.txt [ Cookie:pc@rambler.ru/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\D6S9ZZ3J.txt [ Cookie:pc@questionmarket.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\8P9TLHYP.txt [ Cookie:pc@ads2.medianord.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\AUXM1UFZ.txt [ Cookie:pc@e-2dj6wclicmcjgfq.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\L7TFJ6L7.txt [ Cookie:pc@t.webtracker.jp/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\67FOUMTU.txt [ Cookie:pc@int.sitestat.com/panasonic/de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\RT3O62WE.txt [ Cookie:pc@accounts.google.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\QE2N1WN3.txt [ Cookie:pc@e-2dj6wnkiclajaao.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\6M6J09WX.txt [ Cookie:pc@delivery.atkmedia.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\HLTQUZTZ.txt [ Cookie:pc@bauermedia.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\LZ03F1RQ.txt [ Cookie:pc@e-2dj6wblyaoazkfp.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\LFO6E9OR.txt [ Cookie:pc@hightraffic.hugoboss.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\17HYGMD3.txt [ Cookie:pc@pornme.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\371U8ZGM.txt [ Cookie:pc@counter2.sexmoney.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\PEZSUFVQ.txt [ Cookie:pc@soundtrackcollector.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\QUSJONB6.txt [ Cookie:pc@www.soundtrackcollector.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\0G1DQ02S.txt [ Cookie:pc@www.bizrate.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\S7E0A449.txt [ Cookie:pc@247realmedia.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZWH9IFRU.txt [ Cookie:pc@e-2dj6wnl4ahazwfo.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z5D0WR3R.txt [ Cookie:pc@www.multimediaxis.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\9PIWZZVY.txt [ Cookie:pc@marktplatz.nordclick.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\PJRDQCY9.txt [ Cookie:pc@e-2dj6wfmismdpolp.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\NQHNWFM2.txt [ Cookie:pc@nikonjp.112.2o7.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\0DVUHH2A.txt [ Cookie:pc@dyntracker.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\QXXS4ZOK.txt [ Cookie:pc@de.sitestat.com/sportscheck/shop-de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\BUFJI6XQ.txt [ Cookie:pc@www.beamer-discount.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z6FRJVGI.txt [ Cookie:pc@quartermedia.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\U75D1UEU.txt [ Cookie:pc@unister-adservices.com/campaign/conversion/22 ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\1Q74JIZM.txt [ Cookie:pc@media.gan-online.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\KLVODAK5.txt [ Cookie:pc@wmedia.rotator.hadj7.adjuggler.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\H8BZ2JDK.txt [ Cookie:pc@livenation.122.2o7.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\Y6BUQTA2.txt [ Cookie:pc@callofduty.4players.de/board185-call-of-duty-modern-warfare-3/board186-allgemeines-zu-call-of-duty-modern-warfare-3/46522-elite-anmelde-probleme/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\TQGXLI1H.txt [ Cookie:pc@stepstone.112.2o7.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\PBCCQXZH.txt [ Cookie:pc@callofduty.4players.de/board202-call-of-duty-elite/board204-technische-probleme-mit-call-of-duty-elite/46699-call-of-duty-elite-keine-double-xp-ep/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\AF0E9Z13.txt [ Cookie:pc@ero-advertising.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\C3EVDRXE.txt [ Cookie:pc@de.partypoker.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\GP00V5QC.txt [ Cookie:pc@komtrack.com/tr ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z3OXUFRI.txt [ Cookie:pc@lucidmedia.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\6QDXWEW3.txt [ Cookie:pc@track.webgains.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\GCXLFRST.txt [ Cookie:pc@aok.122.2o7.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\DP29333D.txt [ Cookie:pc@rts.pgmediaserve.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\WNUEZZUR.txt [ Cookie:pc@callofduty.4players.de/board202-call-of-duty-elite/board203-allgemeines-zu-call-of-duty-elite/46360-gründer-status-bei-cod-elite-ps3/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\PC2LWPGV.txt [ Cookie:pc@teufel-media.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\PZAG5KDH.txt [ Cookie:pc@atrack.allposters.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\X0EA6G0P.txt [ Cookie:pc@paypal.112.2o7.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\WYE03FWO.txt [ Cookie:pc@at.atwola.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\J2873ZWB.txt [ Cookie:pc@ad1.dyntracker.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\7KUNPO9S.txt [ Cookie:pc@partypoker.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\56Q6YWTS.txt [ Cookie:pc@cheaptickets.122.2o7.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\1E1WB63E.txt [ Cookie:pc@zedo.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\AWSZ0Z8O.txt [ Cookie:pc@e-2dj6wfmiqpd5kbo.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\IAJSJC58.txt [ Cookie:pc@adserver.ps3m.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\QUZKD1H3.txt [ Cookie:pc@wmedia.rotator.hadj7.adjuggler.net/servlet/ajrotator/136108/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\NOFUNV0L.txt [ Cookie:pc@e-2dj6wjlygmc5wlp.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\8G4IGHU6.txt [ Cookie:pc@in.getclicky.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\9L961Z5Y.txt [ Cookie:pc@adserver.yopi.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\K9ATM67D.txt [ Cookie:pc@counter.sexsuche.tv/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\QHD88IH8.txt [ Cookie:pc@deutschepostag.112.2o7.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\FTN0HIR2.txt [ Cookie:pc@ar.atwola.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\1S5FEGT5.txt [ Cookie:pc@zieltrack.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\86S1ARK0.txt [ Cookie:pc@airfrance.front.bannerfactory.ecritel.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\V5OC6RAD.txt [ Cookie:pc@mediastar-frankfurt.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\3LJ7E02Z.txt [ Cookie:pc@e-2dj6aekyqjcjico.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\JOFR2SIY.txt [ Cookie:pc@e-2dj6wdlisjczwlo.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\KARRYTAW.txt [ Cookie:pc@elite.callofduty.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\0UQTRLY4.txt [ Cookie:pc@shop.01media.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\80AE2BNH.txt [ Cookie:pc@cityclubcasino.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\HORX3BH7.txt [ Cookie:pc@e-2dj6wjlyupd5ehq.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\RLT4L0YI.txt [ Cookie:pc@e-2dj6whmyegazago.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\AI411MOM.txt [ Cookie:pc@e-2dj6wjmiggdpsdp.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\CK0WAI31.txt [ Cookie:pc@banner.citytowercasino.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\02HHHCPQ.txt [ Cookie:pc@track.webtrekk.de/562243648792138/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\KJ3GRE2U.txt [ Cookie:pc@e-2dj6wjk4eoczceo.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\14A0WBU7.txt [ Cookie:pc@e-2dj6wfmyqgdjaeo.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\ISYIK8I4.txt [ Cookie:pc@uk.sitestat.com/future/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\M4A2AMFA.txt [ Cookie:pc@euros4click.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z56DPWW1.txt [ Cookie:pc@clickandbuy.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\UNAEIUD3.txt [ Cookie:pc@ads.247activemedia.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\EW7RZ8RD.txt [ Cookie:pc@callofduty.4players.de/board185-call-of-duty-modern-warfare-3/board186-allgemeines-zu-call-of-duty-modern-warfare-3/46442-cod-elite-clan-erstellen/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\H733053E.txt [ Cookie:pc@banner.cityclubcasino.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\1RK6ZWRB.txt [ Cookie:pc@ec-track.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\2I6PIJZK.txt [ Cookie:pc@stats.ilivid.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\4AL32WF3.txt [ Cookie:pc@lfstmedia.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\ATOXYQ7B.txt [ Cookie:pc@tacoda.at.atwola.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\IRMS1ZZ8.txt [ Cookie:pc@casalemedia.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\99XO4F8X.txt [ Cookie:pc@komtrack.com/tr/101750 ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\XHE9STTP.txt [ Cookie:pc@www.active-tracking.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\L1MNEKY4.txt [ Cookie:pc@multimediaxis.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\KZFKV4GP.txt [ Cookie:pc@adserver.seedpeer.me/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\DW8E3AWZ.txt [ Cookie:pc@mh.motorpresse-statistik.de/track/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\V81O7UF7.txt [ Cookie:pc@e-2dj6wcmykhdjaho.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\IC8S8V7F.txt [ Cookie:pc@callofduty.4players.de/board202-call-of-duty-elite/board203-allgemeines-zu-call-of-duty-elite/47971-probleme-mit-elite/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\6DSJ0K80.txt [ Cookie:pc@lokalportal24de.112.2o7.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\NW2KAM4E.txt [ Cookie:pc@hc2.humanclick.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\T94YQ8OK.txt [ Cookie:pc@e-2dj6wfk4coajakq.stats.esomniture.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\7RIIFTYJ.txt [ Cookie:pc@shop.geschenkefinden.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\PH82063N.txt [ Cookie:pc@edates.traffective-tracking.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\YQSF9BLQ.txt [ Cookie:pc@soundtrack.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\NUB1RRVI.txt [ Cookie:pc@eas4.emediate.eu/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\MEQDN31E.txt [ Cookie:pc@cnetasiapacific.122.2o7.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\V5HT4ZK1.txt [ Cookie:pc@www.googleadservices.com/pagead/conversion/1029866653/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\M50K8324.txt [ Cookie:pc@www.googleadservices.com/pagead/conversion/1060937168/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\DI05A20O.txt [ Cookie:pc@www.googleadservices.com/pagead/conversion/1044176323/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\YENAKYWO.txt [ Cookie:pc@bizrate.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\MQYYYR16.txt [ Cookie:pc@server.cpmstar.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\C4WLOAOB.txt [ Cookie:pc@mmotraffic.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\Y5CX8ZXD.txt [ Cookie:pc@callofduty.4players.de/board202-call-of-duty-elite/board203-allgemeines-zu-call-of-duty-elite/p927512-gr%C3%BCnder-status-bei-cod-elite-ps3/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZQNYZTRY.txt [ Cookie:pc@myroitracking.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\BFVVFVYT.txt [ Cookie:pc@mediashop.tv/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\29D1J16I.txt [ Cookie:pc@www.googleadservices.com/pagead/conversion/1067646656/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\PF16ZMSA.txt [ Cookie:pc@nextag.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\NQCRN43H.txt [ Cookie:pc@de.sitestat.com/idgcom-de/ow/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\Q85256U2.txt [ Cookie:pc@www.soundtrack-board.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\U6PLCUBL.txt [ Cookie:pc@adserver.ip-phone-forum.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\Q2TBJH8M.txt [ Cookie:pc@adserver.doccheck.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\X3O4L2X1.txt [ Cookie:pc@www.googleadservices.com/pagead/conversion/1042441349/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\BW5GT6P5.txt [ Cookie:pc@e2.emediate.se/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\GL3MEJJO.txt [ Cookie:pc@ads20.wwe-media.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\VS10U2VL.txt [ Cookie:pc@nextag.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\Y1MVXP6I.txt [ Cookie:pc@unister-adservices.com/services/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\5T1JJDBB.txt [ Cookie:pc@server.adform.net/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\1A3G2UCW.txt [ Cookie:pc@www.googleadservices.com/pagead/conversion/1046790072/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\X3X940E4.txt [ Cookie:pc@urbia.wwe-media.de/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\YO6D33XB.txt [ Cookie:pc@www.googleadservices.com/pagead/conversion/1032529037/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\BWQ39DXB.txt [ Cookie:pc@www.googleadservices.com/pagead/conversion/1064910062/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\5Z4TAFBR.txt [ Cookie:pc@callofduty.4players.de/board202-call-of-duty-elite/board203-allgemeines-zu-call-of-duty-elite/p947684-probleme-mit-elite/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\CEGSSTB5.txt [ Cookie:pc@hometheaterreview.advertserve.com/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\COFZ71HY.txt [ Cookie:pc@www.googleadservices.com/pagead/conversion/963609047/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\63TU8Z7D.txt [ Cookie:pc@www.googleadservices.com/pagead/conversion/1071522855/ ]

        C:\USERS\PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\814GXRR1.txt [ Cookie:pc@www.pc-forum.de/software-internet-multimedia/software/viren-trojaner-dialer-ad-und-spyware/8578-als-ich-online-war-ging-plötzlich-ein-fenster-auf-in-dem/ ]

        C:\USERS\PC\Cookies\TQ3RNEUQ.txt [ Cookie:pc@track.effiliation.com/ ]

        C:\USERS\PC\Cookies\7KNDD3TS.txt [ Cookie:pc@stat.xunlei.com/ ]

        C:\USERS\PC\Cookies\XR0NQPV1.txt [ Cookie:pc@www.windowsmedia.com/ ]

        C:\USERS\PC\Cookies\O1XENJO2.txt [ Cookie:pc@mediav.com/ ]

        C:\USERS\PC\Cookies\pc@lstat.youku[1].txt [ Cookie:pc@lstat.youku.com/ ]

        C:\USERS\PC\Cookies\41DMPLKA.txt [ Cookie:pc@doubleclick.net/ ]

        C:\USERS\PC\Cookies\QFCXVR9E.txt [ Cookie:pc@webmasterplan.com/ ]

        C:\USERS\PC\Cookies\pc@imrworldwide[2].txt [ Cookie:pc@imrworldwide.com/cgi-bin ]

        C:\USERS\PC\Cookies\AMWBNF6A.txt [ Cookie:pc@studivz.adfarm1.adition.com/ ]

        C:\USERS\PC\Cookies\KW3R3IT5.txt [ Cookie:pc@mediaplex.com/ ]

        C:\USERS\PC\Cookies\LSJ18EKC.txt [ Cookie:pc@zanox.com/ ]

        C:\USERS\PC\Cookies\pc@hfmcompany.122.2o7[1].txt [ Cookie:pc@hfmcompany.122.2o7.net/ ]

        C:\USERS\PC\Cookies\GUH9DVSB.txt [ Cookie:pc@bsch.serving-sys.com/ ]

        C:\USERS\PC\Cookies\pc@msnportal.112.2o7[1].txt [ Cookie:pc@msnportal.112.2o7.net/ ]

        C:\USERS\PC\Cookies\RUB3DQBF.txt [ Cookie:pc@zanox-affiliate.de/ ]

        C:\USERS\PC\Cookies\92P2OOTG.txt [ Cookie:pc@ad3.adfarm1.adition.com/ ]

        C:\USERS\PC\Cookies\UWSZ6P85.txt [ Cookie:pc@ad1.dyntracker.com/ ]

        C:\USERS\PC\Cookies\YYEZ44ZP.txt [ Cookie:pc@partypoker.com/ ]

        C:\USERS\PC\Cookies\YXT5Y6MV.txt [ Cookie:pc@fastclick.net/ ]

        C:\USERS\PC\Cookies\91URW2JL.txt [ Cookie:pc@pconline.com.cn/newcount/ ]

        C:\USERS\PC\Cookies\7YASDNZV.txt [ Cookie:pc@serving-sys.com/ ]

        C:\USERS\PC\Cookies\19ZN10AL.txt [ Cookie:pc@questionmarket.com/ ]

        C:\USERS\PC\Cookies\4GELZ31I.txt [ Cookie:pc@ads2.medianord.de/ ]

        C:\USERS\PC\Cookies\H70849IV.txt [ Cookie:pc@ad2.adfarm1.adition.com/ ]

        C:\USERS\PC\Cookies\29NCX85N.txt [ Cookie:pc@dyntracker.com/ ]

        C:\USERS\PC\Cookies\8RUR4N33.txt [ Cookie:pc@ad1.adfarm1.adition.com/ ]

        C:\USERS\PC\Cookies\TUU4EV8Z.txt [ Cookie:pc@click.oyeclick.com/ ]

        C:\USERS\PC\Cookies\8Q54XXVR.txt [ Cookie:pc@invitemedia.com/ ]

        C:\USERS\PC\Cookies\10MLO4FL.txt [ Cookie:pc@track.effiliation.com/servlet/ ]

        C:\USERS\PC\Cookies\U5FWTNAV.txt [ Cookie:pc@mmstat.com/ ]

        C:\USERS\PC\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\PC@ADS.NEUDESICMEDIAGROUP[1].TXT [ /ADS.NEUDESICMEDIAGROUP ]

        C:\USERS\PC\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\PC@ADS.OOMZ[1].TXT [ /ADS.OOMZ ]

        C:\USERS\PC\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\PC@AD.BOREUS[1].TXT [ /AD.BOREUS ]

        C:\USERS\PC\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\PC@ADS.IMMOBILIENSCOUT24[1].TXT [ /ADS.IMMOBILIENSCOUT24 ]

        C:\USERS\PC\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\PC@E-2DJ6WJKOOOAJIAO.STATS.ESOMNITURE[1].TXT [ /E-2DJ6WJKOOOAJIAO.STATS.ESOMNITURE ]

        C:\USERS\PC\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\PC@E-2DJ6WNKIENDJIEP.STATS.ESOMNITURE[2].TXT [ /E-2DJ6WNKIENDJIEP.STATS.ESOMNITURE ]

        C:\USERS\PC\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\PC@LIVEPERSON[1].TXT [ /LIVEPERSON ]

        C:\USERS\PC\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\PC@MICROSOFTINTERNETEXPLORER.112.2O7[1].TXT [ /MICROSOFTINTERNETEXPLORER.112.2O7 ]

        C:\USERS\PC\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\PC@SECMEDIA[1].TXT [ /SECMEDIA ]

Ehm, dazu hätte ich jetzt mal ne Frage. Diese ganzen aufgeführten Seiten dort, soll das bedeuten, dass ich diese ganzen Seiten mal besucht habe.
Denn ehrlich gesagt tauchen da einige Seiten auf, auf denen ich definitiv nie gewesen bin z.B. dieses partypoker und ich meine da auch eine S** gesehen zu haben.
Also jetzt mach ich mir Sorgen.:confused:

Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Ok, dann werde ich da mal was dran ändern.

System läuft soweit problemlos, aber 3 Fragen brennen mir noch auf der Zunge, wäre toll, wenn du das abschließend noch klären könntest.

1. Was ist mit den Dateien, die bei Malwarebytes in Quarantäne sind? Kann ich die löschen? (Screenshot im Anhang)

2. Kann ich alle Programme, die wir hier benutzt haben bedenkenlos wieder runter kloppen oder brauch ich da noch was von?

3. Im Abschnitt Infobereichsymbole der Taskleiste taucht Smart HDD und der System Error immer noch auf. (Screenshot im Anhang).

Der System Error wird verursacht von DriveTheLife, dass habe ich schon rausgefunden und werde das Programm einfach deinstallieren, aber was ist dort mit dem Eintrag von Smart HDD, kann ich den irgendwie weg bekommen?

Danke schon mal für die hervorragende Hilfe. :bussi:

Zitat:

1. Was ist mit den Dateien, die bei Malwarebytes in Quarantäne sind? Kann ich die löschen? (Screenshot im Anhang)

Überleg doch mal was eine Quarantäne ist. Ob da die schädliche Datei drinbleibt oder nicht, das hat keine Auswirkungen. Schädlinge in der Quarantäne können nichts mehr anrichten, sie sind dort isoliert. Du solltest grundsätzlich mit der Quarantäne arbeiten, denn falls der Virenscanner durch einen Fehlalarm was wichtiges löscht, kannst Du notfalls noch über die Quarantäne an die Datei ran.

Zitat:

2. Kann ich alle Programme, die wir hier benutzt haben bedenkenlos wieder runter kloppen oder brauch ich da noch was von?

Ja, dazu gleich mehr

Zitat:

3. Im Abschnitt Infobereichsymbole der Taskleiste taucht Smart HDD und der System Error immer noch auf. (Screenshot im Anhang).

Ich dneke das sollten Überreste sein - aktiv ist da doch nichts mehr? Kannst du das nicht aus der Benachrichtigung entfernen?

Tja, dass mit ich deinstallier mal schnell DriveTheLife war wohl nichts. Bekomme dann folgende Meldung:

Code:

Runtime Error (at -1:0):

Cannot Import dll:C:\Program Files (x86)\DriveTheLife\uninstall.dll.

Liegt das eventuell daran, dass das Programm infiziert war und
gibt`s noch ne andere Möglichkeit das loszuwerden?

Bezüglich Smart HDD, also das Symbol selbst taucht nicht mehr auf, steht halt nur in dieser besagten Liste drin und da bekomm ich das nicht raus.

Naja, wenn das nicht schädlich ist, muss es halt da bleiben.

Ich kann nochmal mit OTL nachsehen, vllt bekommt man die letzten Reste dann auch noch weg

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Okay hier noch mal ein neuer OTL Log:

Code:

OTL logfile created on: 06.04.2012 21:01:10 - Run 2

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\PC\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

15,98 Gb Total Physical Memory | 13,67 Gb Available Physical Memory | 85,52% Memory free

31,96 Gb Paging File | 29,72 Gb Available in Paging File | 92,98% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 55,80 Gb Total Space | 13,11 Gb Free Space | 23,49% Space Free | Partition Type: NTFS

Drive D: | 1863,01 Gb Total Space | 1801,60 Gb Free Space | 96,70% Space Free | Partition Type: NTFS

 

Computer Name: BLUE-DRAGON | User Name: PC | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.04.04 13:52:25 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\PC\Desktop\OTL.exe

PRC - [2012.02.21 14:47:30 | 000,250,016 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11f_ActiveX.exe

PRC - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.10.11 14:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

PRC - [2011.10.11 14:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011.10.11 14:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.08.03 13:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

PRC - [2011.08.03 03:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2007.04.13 16:00:50 | 000,413,696 | ---- | M] () -- C:\Program Files (x86)\802.11 Wireless LAN\802.11g Wireless CardBus & PCI Adapter HW.15 V.1.00\WlanCU.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2007.04.13 16:00:50 | 000,413,696 | ---- | M] () -- C:\Program Files (x86)\802.11 Wireless LAN\802.11g Wireless CardBus & PCI Adapter HW.15 V.1.00\WlanCU.exe

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.10.11 14:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.10.11 14:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.08.12 01:38:04 | 000,140,672 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programme\SUPERAntiSpyware\SASCore64.exe -- (!SASCORE)

SRV - [2011.08.03 13:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)

SRV - [2011.08.03 03:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2010.10.22 13:08:18 | 001,039,360 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)

SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.08.18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012.02.15 14:28:28 | 000,132,320 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)

DRV:64bit: - [2011.12.10 15:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2011.10.11 15:00:01 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)

DRV:64bit: - [2011.10.11 15:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)

DRV:64bit: - [2011.06.10 06:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2011.05.10 11:41:27 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.12.08 18:17:40 | 000,369,640 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci)

DRV:64bit: - [2010.12.08 18:17:38 | 000,122,856 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.10.19 16:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R)

DRV:64bit: - [2010.05.20 07:03:11 | 000,105,312 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2008.02.15 02:00:00 | 000,442,912 | ---- | M] (Realtek) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RTL85n64.sys -- (RTL85n64)

DRV - [2011.07.22 18:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)

DRV - [2011.07.12 23:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-4121521385-2814533739-2460137988-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.gmx.net/

IE - HKU\S-1-5-21-4121521385-2814533739-2460137988-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

IE - HKU\S-1-5-21-4121521385-2814533739-2460137988-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A0 3D E5 EA A0 26 CC 01  [binary data]

IE - HKU\S-1-5-21-4121521385-2814533739-2460137988-1000\..\SearchScopes,DefaultScope = {67E2AC4B-8462-4C1C-97C6-40F43CF5228F}

IE - HKU\S-1-5-21-4121521385-2814533739-2460137988-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-4121521385-2814533739-2460137988-1000\..\SearchScopes\{67E2AC4B-8462-4C1C-97C6-40F43CF5228F}: "URL" = hxxp://www.google.de/search?q={searchTerms}

IE - HKU\S-1-5-21-4121521385-2814533739-2460137988-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 
 ========== FireFox ==========

 

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.06.09 13:54:43 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011.07.15 10:41:01 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2011.07.15 10:41:08 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.06.09 13:54:43 | 000,000,000 | ---D | M]

 

 

O1 HOSTS File: ([2012.04.05 12:38:04 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1       localhost

O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN Toolbar\Platform\6.3.2380.0\npwinext.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (@c:\Program Files (x86)\MSN Toolbar\Platform\6.3.2380.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\Program Files (x86)\MSN Toolbar\Platform\6.3.2380.0\npwinext.dll (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [DriveTheLife] C:\Program Files (x86)\DriveTheLife\DriveTheLife.exe (深圳市驱动人生软件技术有限公司)

O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKU\S-1-5-21-4121521385-2814533739-2460137988-1000..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)

O4 - HKU\S-1-5-21-4121521385-2814533739-2460137988-1003..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-4121521385-2814533739-2460137988-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-4121521385-2814533739-2460137988-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-4121521385-2814533739-2460137988-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\S-1-5-21-4121521385-2814533739-2460137988-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Object)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444552440000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9474FF42-99CA-4A4A-BB69-64794FEA1A00}: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F25D0551-D408-452C-A95E-B172C10EE202}: DhcpNameServer = 192.168.0.1

O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

 

 

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: !SASCORE - C:\Programme\SUPERAntiSpyware\SASCore64.exe (SUPERAntiSpyware.com)

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: !SASCORE - C:\Programme\SUPERAntiSpyware\SASCore64.exe (SUPERAntiSpyware.com)

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.04.06 18:31:21 | 000,000,000 | ---D | C] -- C:\Users\PC\AppData\Roaming\SUPERAntiSpyware.com

[2012.04.06 18:30:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

[2012.04.06 18:30:56 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com

[2012.04.06 18:30:56 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware

[2012.04.06 18:15:54 | 015,770,528 | ---- | C] (SUPERAntiSpyware.com) -- C:\Users\PC\Desktop\SUPERAntiSpyware.exe

[2012.04.06 17:52:35 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\PC\Desktop\aswMBR.exe

[2012.04.06 00:23:10 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN

[2012.04.06 00:19:52 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2012.04.06 00:19:52 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2012.04.06 00:19:52 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2012.04.06 00:19:50 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2012.04.06 00:19:48 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012.04.06 00:16:24 | 004,450,834 | R--- | C] (Swearware) -- C:\Users\PC\Desktop\ComboFix.exe

[2012.04.05 16:56:12 | 002,073,136 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\PC\Desktop\tdsskiller.exe

[2012.04.05 12:36:52 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.04.04 17:02:42 | 000,397,728 | ---- | C] (Bleeping Computer, LLC) -- C:\Users\PC\Desktop\unhide.exe

[2012.04.04 13:52:25 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\PC\Desktop\OTL.exe

[2012.04.02 20:27:23 | 000,000,000 | ---D | C] -- C:\Users\PC\AppData\Roaming\Malwarebytes

[2012.04.02 20:27:16 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.04.02 20:27:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.04.02 20:27:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.04.02 20:27:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.04.02 16:53:20 | 000,000,000 | ---D | C] -- C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SMART HDD

[2012.03.14 19:10:32 | 005,559,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe

[2012.03.14 19:10:32 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe

[2012.03.14 19:10:32 | 003,913,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe

[2012.03.14 16:53:28 | 001,544,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll

[2012.03.14 16:33:47 | 001,031,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcore.dll

[2012.03.14 16:33:47 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpcore.dll

[2012.03.14 16:33:47 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll

[2012.03.14 16:33:47 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll

[2012.03.14 16:33:47 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe

[2012.03.14 16:31:45 | 000,000,000 | ---D | C] -- C:\Users\PC\AppData\Roaming\Softlink

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.04.06 19:20:15 | 000,134,560 | ---- | M] () -- C:\Users\PC\Desktop\Taskleiste Symbole.PNG

[2012.04.06 19:19:25 | 000,169,199 | ---- | M] () -- C:\Users\PC\Desktop\Quarantäne Malwarebytes.PNG

[2012.04.06 18:30:57 | 000,001,808 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2012.04.06 18:17:08 | 015,770,528 | ---- | M] (SUPERAntiSpyware.com) -- C:\Users\PC\Desktop\SUPERAntiSpyware.exe

[2012.04.06 17:58:25 | 000,000,512 | ---- | M] () -- C:\Users\PC\Desktop\MBR.dat

[2012.04.06 17:56:36 | 000,014,800 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.04.06 17:56:36 | 000,014,800 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.04.06 17:53:45 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.04.06 17:53:45 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.04.06 17:53:45 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.04.06 17:53:45 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.04.06 17:53:45 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.04.06 17:52:44 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\PC\Desktop\aswMBR.exe

[2012.04.06 17:49:28 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.04.06 17:49:11 | 4280,348,670 | -HS- | M] () -- C:\hiberfil.sys

[2012.04.06 00:16:43 | 004,450,834 | R--- | M] (Swearware) -- C:\Users\PC\Desktop\ComboFix.exe

[2012.04.05 16:56:12 | 002,073,136 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\PC\Desktop\tdsskiller.exe

[2012.04.05 13:12:47 | 000,087,628 | ---- | M] () -- C:\Users\PC\Desktop\Unbenannt.PNG

[2012.04.05 12:38:04 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts

[2012.04.04 17:02:42 | 000,397,728 | ---- | M] (Bleeping Computer, LLC) -- C:\Users\PC\Desktop\unhide.exe

[2012.04.04 13:52:25 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\PC\Desktop\OTL.exe

[2012.04.02 20:27:16 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.15 15:05:54 | 000,371,208 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

 
 ========== Files Created - No Company Name ==========

 

[2012.04.06 19:20:15 | 000,134,560 | ---- | C] () -- C:\Users\PC\Desktop\Taskleiste Symbole.PNG

[2012.04.06 19:19:25 | 000,169,199 | ---- | C] () -- C:\Users\PC\Desktop\Quarantäne Malwarebytes.PNG

[2012.04.06 18:30:57 | 000,001,808 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2012.04.06 17:58:25 | 000,000,512 | ---- | C] () -- C:\Users\PC\Desktop\MBR.dat

[2012.04.06 00:19:52 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2012.04.06 00:19:52 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2012.04.06 00:19:52 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2012.04.06 00:19:52 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2012.04.06 00:19:52 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2012.04.05 13:12:39 | 000,087,628 | ---- | C] () -- C:\Users\PC\Desktop\Unbenannt.PNG

[2012.04.04 17:04:00 | 000,002,683 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Word.lnk

[2012.04.04 17:04:00 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk

[2012.04.04 17:04:00 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

[2012.04.04 17:04:00 | 000,002,284 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Wireless Configuration Utility HW.15.lnk

[2012.04.04 17:04:00 | 000,002,266 | ---- | C] () -- C:\Users\Public\Desktop\Wireless Configuration Utility HW.15.lnk

[2012.04.04 17:04:00 | 000,002,099 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

[2012.04.04 17:04:00 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk

[2012.04.04 17:04:00 | 000,002,006 | ---- | C] () -- C:\Users\Public\Desktop\HP ePrinterCenter.lnk

[2012.04.04 17:04:00 | 000,002,003 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk

[2012.04.04 17:04:00 | 000,001,994 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2012.04.04 17:04:00 | 000,001,850 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Picture It! Foto Premium 9.lnk

[2012.04.04 17:04:00 | 000,001,808 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works-Start.lnk

[2012.04.04 17:04:00 | 000,001,547 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

[2012.04.04 17:04:00 | 000,001,380 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Default Manager.lnk

[2012.04.04 17:04:00 | 000,001,352 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk

[2012.04.04 17:04:00 | 000,001,351 | ---- | C] () -- C:\Users\Public\Desktop\HP Solution Center.lnk

[2012.04.04 17:04:00 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk

[2012.04.04 17:04:00 | 000,001,338 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live ID.lnk

[2012.04.04 17:04:00 | 000,001,330 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk

[2012.04.04 17:04:00 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk

[2012.04.04 17:04:00 | 000,001,246 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk

[2012.04.04 17:04:00 | 000,001,210 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk

[2012.04.04 17:04:00 | 000,001,189 | ---- | C] () -- C:\Users\Public\Desktop\Shop für HP Zubehör.lnk

[2012.04.04 17:04:00 | 000,001,064 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR-Registrierung.lnk

[2012.04.04 17:04:00 | 000,000,753 | ---- | C] () -- C:\Users\Public\Desktop\XMedia Recode.lnk

[2012.04.04 17:04:00 | 000,000,614 | ---- | C] () -- C:\Users\Public\Desktop\DxO Optics Pro 5.3.5.lnk

[2012.04.02 20:27:16 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2011.08.03 03:31:54 | 000,311,912 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe

[2011.06.09 16:03:05 | 000,000,230 | ---- | C] () -- C:\Users\PC\AppData\Roaming\wklnhst.dat

[2011.06.09 15:36:59 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI

[2011.06.09 13:48:52 | 000,238,349 | ---- | C] () -- C:\Windows\hpoins52.dat

[2011.05.09 18:36:46 | 000,035,944 | ---- | C] () -- C:\Windows\Ascd_log.ini

[2011.05.09 18:36:07 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini

[2011.05.09 18:36:01 | 000,024,353 | ---- | C] () -- C:\Windows\Ascd_tmp.ini

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.11.15 15:15:04 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\Adobe

[2011.10.29 15:34:12 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\Apple Computer

[2011.10.20 13:03:07 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\Avira

[2012.03.06 16:47:29 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\DriveTheLife2012

[2011.12.24 15:48:41 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\DxO Labs

[2011.12.24 15:48:45 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\DxO_Labs

[2011.06.09 14:25:31 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\HP

[2012.01.16 17:09:04 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\HpUpdate

[2011.05.09 17:51:49 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\Identities

[2011.05.09 18:39:22 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\InstallShield

[2011.06.09 14:15:24 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\Macromedia

[2012.04.02 20:27:23 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\Malwarebytes

[2009.07.14 20:18:18 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\Media Center Programs

[2011.12.24 15:59:14 | 000,000,000 | --SD | M] -- C:\Users\PC\AppData\Roaming\Microsoft

[2011.12.24 15:41:45 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\PACE Anti-Piracy

[2012.04.06 20:24:57 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\Softlink

[2012.04.06 18:31:21 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\SUPERAntiSpyware.com

[2011.12.07 14:43:19 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\uTorrent

[2012.01.09 15:55:09 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\XMedia Recode

 
 < %APPDATA%\*.exe /s >

[2011.08.23 12:04:39 | 000,010,134 | R--- | M] () -- C:\Users\PC\AppData\Roaming\Microsoft\Installer\{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}\ARPPRODUCTICON.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\ERDNT\cache64\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\ERDNT\cache86\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\ERDNT\cache64\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTORV.SYS  >

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\ERDNT\cache64\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\ERDNT\cache86\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\ERDNT\cache86\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\ERDNT\cache64\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\ERDNT\cache86\user32.dll

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\ERDNT\cache64\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\ERDNT\cache86\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\ERDNT\cache64\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\ERDNT\cache64\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\ERDNT\cache86\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\ERDNT\cache64\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >
 

< End of report >

Habe inzwischen etwas zum Infobereich herausgefunden. Offensichtlich merkt sich Win 7 alle jemals vorhanden Trayicon`s (so heißen die Dinger scheinbar), egal ob das Programm inzwischen deinstalliert oder entfernt wurde.

Angeblich soll man das mit dem CCleaner löschen können (Trayverlauf).
Soll ich das mal versuchen?

DriveTheLife weigert sich behaarlich sich deinstallieren zu lassen, könnte eine Neuinstallatation helfen?

Ja versuch mal mit dem CCleaner dein Glück, danach kann ich ja immer noch ins letzte Log schauen
Das andere probier mal hiermit zu deinstallieren => http://filepony.de/download-revo_uninstaller/

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Okay also der CCleaner hat im Trayverlauf angeblich nichts unbrauchbares gefunden, vielleicht ist das aber auch noch zu frisch und er denkt, dass wird benutzt.

Mit dem Revo Uninstaller habe ich`s versucht, während des Vorgangs kam wieder die Fehlermeldung, er hat aber weitergemacht und mir am Ende ein Fenster angezeigt mit den zu löschenden Dateien. Das scheinen mir aber Registry Einträge zu sein, deshalb habe ich erstmal nichts gemacht.

Screenshot dazu ist angehängt, das Fettgedruckte will er löschen.

Ich frage mich, ob das OK ist?

Edit: Okay das Bild ist zu klein. Ich werde das mal morgen irgendwo hochladen und dann sehen wir mal weiter.

Wünsche dir noch nen schönen Abend und Danke für deine Zeit.

So, also hier nochmal das Bild. Wie gesagt das Fettgedruckte will er löschen.

hxxp://s1.directupload.net/file/d/2853/dfz6ce4j_png.htm

(Irgenwie funktioniert das nicht so wie ich will, aus http wird immer hxxp.)

Noch mal eine andere Frage, ist es möglich, dass das Programm nicht mehr zu deinstallieren geht, weil Malwarebytes das in Quarantäne gesteckt hat?

Wegen dem Bereich Infosymbole, da habe ich noch eine Möglichkeit gefunden, wie man das bereinigen kann. Man soll die folgenden Schritte ausführen:

Code:

HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify
 

Die Keys "IconStreams" und "PastIconsStream" löschen.

 

Explorer.exe im Taskmanager beenden, Taskmanager schließen, Affengriff und "Abmelden".

Danach sollen dann nur noch die Symbole übrig bleiben, die auch gestartet werden, was ja dann bei Smart HDD nicht mehr der Fall sein dürfte.

Kann ich das mal probieren oder ist das zu riskant?

Wünsch dir dann noch ein frohes Osterfest.

Gehts jetzt nur noch um die Einträge in der Registry? Die kannst du lassen. Ob die da drin blieben oder nicht ist sowas von wumpe...

Sorry hatte leider keine Zeit vorher zu antworten.

Also ich konnte DriveTheLife nun endlich deinstallieren, nachdem ich es noch einmal neu installiert hatte. Das scheint jetzt endgültig weg zu sein.

Das Smart HDD Symbol, was noch im Infobereich war, konnte ich letztlich auch entfernen.

Um die Registry Einträge werde ich mich dann auch nicht mehr kümmern, wenn du sagst, ist eh egal.

Malwarebytes habe ich behalten, alles andere kam wieder runter.
Hat super geklappt mit OTL.

Demzufolge müsste mein System, dank deiner Hilfe wieder sauber sein.

Tausend :dankeschoen: und einen kräftigen :applaus:.

Eine letzte Frage, brennt mir noch auf der Seele, danach bist du erlöst. :heilig:

Ich weis, den perfekten Schutz gibt es nicht, aber wenn du die Wahl hättest, was würdest du als Schutzprogramm eher empfehlen Avira Free Antivirus oder Avast Free Antivirus?

Zitat:

Ich weis, den perfekten Schutz gibt es nicht, aber wenn du die Wahl hättest, was würdest du als Schutzprogramm eher empfehlen Avira Free Antivirus oder Avast Free Antivirus?

Wenn ich nur die Wahl zwischen diesen beiden hätte würde ich wohl zu Avast greifen

Die Frage - welcher Virenscanner oder ob der installierte reicht - taucht ständig auf.
Der Virenscanner - egal welcher - kann und wird niemals 100% Schutz bieten können. Neue/unbekannte Schädlinge können immer durch die Lappen gehen. Geld ausgeben muss man nicht für einen Scanner, sowas wie Avast oder Microsoft Security Essentials sind für die privaten Gebrauch völlig ausreichend.
Abgesehen davon nutzen verschiedene Virenscanner unterschiedliche Signaturen und Techniken, das führt dazu, dass zB Scanner1 Schädling X entdeckt, aber Schädling Y übersieht. Scanner2 erkennt Schädling Y, dafür aber Schädling X nicht...
Wichtiger ist, dass du dich an Regeln hälst. Der beste Virenscanner bringt nichts, wenn du dich falsch verhälst und fahrlässig/unvorsichtig bist. Airbag und Sicherheitsgurt im Auto sind ja auch keine Gründe dafür auf die Verkehrsregeln zu pfeifen.

Halte Dich am besten grob an diese Regeln:

Sei misstrauisch im Internet und v.a. bei unbekannten E-Mails, sei vorsichtig bei der Herausgabe persönlicher Daten!!
Halte Windows und alle verwendeten Programme immer aktuell - unterstützen kann dich dabei Secunia PSI
Führe regelmäßig Backups auf externe Medien durch
Arbeite mit eingeschränkten Rechten
Nutze sicherere Programme wie zB Opera oder Firefox zum Surfen statt den IE, zum Mailen Thunderbird statt Outlook Express - E-Mails nur als reinen text anzeigen lassen
automatische Wiedergabe von allen Laufwerken komplett deaktivieren, denn das ist ein unnötiges Sicherheitsrisiko
Bei der Installation von Software möglichst darauf achten, dass die Setups aus offiziellen Quellen stammen und du bei der Installation nach Möglichkeit die benutzerdefinierte Methode wählst - dann hast du die Möglichkeit etwaigen Schrott (wie Toolbars oder sowas wie RegistryBooster) abzuwählen, welcher sonst einfach mitinstalliert wird.
Bösartige bzw. ungewollte Sites von vornherein blockieren lassen mit Hilfe der MVPS Hosts File => Blocking Unwanted Parasites with a Hosts File
Finger weg von: TuneUp, Registry-Cleanern aller Art, Softonic sowie illegalen Cracks/Keygens oder anderen "Tools" um ein kommerzielles Programm ohne Lizenz nutzen zu können
dubiose Seiten bzw. Kinofilm-Streaming-Portale ebenfalls sein lassen, erstens handelt man sich dort schnell Malware ein oder kann in Abofallen geraten und zweitens bewegen sich diese Seiten in einer rechtlichen Grauzone.

Alles noch genauer erklärt steht hier => Kompromittierung unvermeidbar?