Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   s.m.a.r.t. hdd (https://www.trojaner-board.de/113694-s-m-a-r-t-hdd.html)

name 15.04.2012 20:46
s.m.a.r.t. hdd
 
Vorab: Ich hoffe ich habe alle Regeln beachtet.

Nuntze Windows7
Als User mit eingeschränkten Rechten hat sich dieser smart-vierus gemeldet. Die Folge war alle meine Dateien auf dem Desktop oder auf C: sind nicht mehr zu sehen. Melde ich mich als Admin an, kann ich zwar noch die Daten des Admins sehen aber nicht die Daten des Users mit eingeschränkten Rechten.

Ich habe mit malwarebytes drei Dateien entfernen lassen und stelle nun das Ergebnis von otl hier rein. Danke vorab für die Arbeit!

PHP-Code:
OTL logfile created on: 15.04.2012 21:41:13 - Run 2
OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\mmartini\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 5,98 Gb Available Physical Memory | 74,72% Memory free
16,00 Gb Paging File | 13,73 Gb Available in Paging File | 85,86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 322,83 Gb Free Space | 69,33% Space Free | Partition Type: NTFS
 
Computer Name: MMARTINI-PC | User Name: mmartini | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - C:\Users\mmartini\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11e_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:\Users\mmartini\AppData\Local\Apps\2.0\RBWWQPYX.NHH\GOOD6XGC.9EW\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\fritzbox-usb-fernanschluss.exe (AVM Berlin)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe (Adobe Systems, Inc.)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (Mozilla Messaging)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Windows\SysWOW64\wbem\WmiPrvSE.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe (DeviceVM, Inc.)
PRC - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)
PRC - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe (ASUSTeK Computer Inc.)
PRC - C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe (ASUSTeK Computer Inc.)
PRC - C:\ASUS.SYS\config\DVMExportService.exe (DeviceVM, Inc.)
PRC - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE ()
 
 
[color=#E56717]========== Modules (No Company Name) ==========[/color]
 
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\43e23da6683962ea1168aaf007bbc35d\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\262285b3d0afafc5059f3fe9be69bff5\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\8177623eac8f15cf95b587625439eac7\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\e45611cad86870a7011bb18b9e993861\System.Deployment.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\74d980e52c1791f1b8608d767a393144\PresentationCore.ni.dll ()
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\74fcc0f56435d0396f9524cd4293d3e5\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\47b9e7f070271ff50f988f75ea68fa3e\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\9866d1f6178e1cde25642f1ac293ff8d\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e620323cacb5b6bfd93fd28d263440e4\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\faf4e8730ecbd07570111bb7c3b20565\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll ()
MOD - C:\Users\mmartini\AppData\Local\Apps\2.0\RBWWQPYX.NHH\GOOD6XGC.9EW\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\managedupnp.DLL ()
MOD - C:\Program Files (x86)\Adobe\Adobe Bridge CS5\LIBMYSQLD.dll ()
MOD - C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Symlib.dll ()
MOD - C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf ()
MOD - C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll ()
MOD - C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll ()
MOD - C:\Program Files (x86)\Mozilla Thunderbird\js3250.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Adobe\Bridge CS5 Extensions\Adobe Output Module\mediagallery\resources\plugins\XSLT.dll ()
MOD - C:\Windows\SysWOW64\AsIO.dll ()
MOD - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\sqlite3.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll ()
MOD - C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll ()
MOD - C:\Program Files (x86)\ASUS\EPU-4 Engine\AiNap.dll ()
MOD - C:\Program Files (x86)\ASUS\EPU-4 Engine\vvc.dll ()
MOD - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.deu ()
MOD - C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll ()
 
 
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
 
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (BCUService) -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe (DeviceVM, Inc.)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (AsSysCtrlService) -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe (ASUSTeK Computer Inc.)
SRV - (DvmMDES) -- C:\ASUS.SYS\config\DVMExportService.exe (DeviceVM, Inc.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (IJPLMSVC) -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE ()
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV:[b]64bit:[/b] - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:[b]64bit:[/b] - (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:[b]64bit:[/b] - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:[b]64bit:[/b] - (avmaudio) -- C:\Windows\SysNative\drivers\avmaudio.sys (AVM Berlin)
DRV:[b]64bit:[/b] - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:[b]64bit:[/b] - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:[b]64bit:[/b] - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:[b]64bit:[/b] - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:[b]64bit:[/b] - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:[b]64bit:[/b] - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:[b]64bit:[/b] - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:[b]64bit:[/b] - (VIAHdAudAddService) -- C:\Windows\SysNative\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV:[b]64bit:[/b] - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV:[b]64bit:[/b] - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:[b]64bit:[/b] - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:[b]64bit:[/b] - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:[b]64bit:[/b] - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:[b]64bit:[/b] - (NVENETFD) -- C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation)
DRV:[b]64bit:[/b] - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:[b]64bit:[/b] - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:[b]64bit:[/b] - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:[b]64bit:[/b] - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.splashtop.com/asusexpressgate/mb/searchAPI.php?SE=yahoo&QS=http%3A%2F%2Fde.search.yahoo.com%2Fsearch%3Ffr%3Dfp-devicevm%26type%3DWEB01
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 90 48 A4 59 C1 59 CB 01  [binary data]
IE - HKCU\..\URLSearchHook: {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll (DeviceVM, Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{E083E8E8-FE87-4e9f-BCE0-CAA2F44E3FE6}: "URL" = hxxp://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5369970905&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=de&q={searchTerms}
IE - HKCU\..\SearchScopes\{F6ECCF0F-05D3-47e4-BF23-05E2AEFE758B}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=EGMB
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
[color=#E56717]========== FireFox ==========[/color]
 
FF - prefs.js..browser.search.selectedEngine: "Amazon.de"
FF - prefs.js..browser.startup.homepage: "hxxp://typo3.p117137.mittwaldserver.info/typo3/index.php|hxxp://www.1-liga.de/typo3/index.php|hxxp://www.auf-pfoten.de/home.html|hxxp://www.traum-projekt.com/forum/112-typo3/75384-typo3-formularfelder-und-css.html|hxxp://typo3.org/documentation/document-library/extension-manuals/powermail/1.5.3/view/1/12/|hxxp://www.heilbronn-seo.de/optimierung-oder-gleich-ein-neues-design/|hxxp://www.profi-ranking.de/suchmaschinenoptimierung/keyword-recherche/|hxxp://www.brave-hunde.de/pagerank.html|hxxp://siteexplorer.search.yahoo.com/de/siteexplorer/search?p=http%3A%2F%2Fwww.brave-hunde.de&bwm=i&bwmf=u&bwms=p&fr=yfp-t-708&fr2=seo-rd-se"
FF - prefs.js..extensions.enabledItems: {01A8CA0A-4C96-465b-A49B-65C46FAD54F9}:6.0
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.1
FF - prefs.js..extensions.enabledItems: webrank-toolbar@probcomp.com:4.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010.09.22 01:44:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.10.03 16:38:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.07.03 10:57:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.01.30 23:57:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.5\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.01.30 23:57:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.5\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.6\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.01.30 23:57:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.01.30 23:57:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2010.10.06 01:50:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mmartini\AppData\Roaming\mozilla\Extensions
[2010.10.06 01:50:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mmartini\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.07.03 13:08:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mmartini\AppData\Roaming\mozilla\Firefox\Profiles\m2gane3a.default\extensions
[2011.01.23 17:11:15 | 000,000,000 | ---D | M] (Firebug) -- C:\Users\mmartini\AppData\Roaming\mozilla\Firefox\Profiles\m2gane3a.default\extensions\firebug@software.joehewitt.com
[2011.01.23 17:11:19 | 000,000,000 | ---D | M] (WebRank Toolbar) -- C:\Users\mmartini\AppData\Roaming\mozilla\Firefox\Profiles\m2gane3a.default\extensions\webrank-toolbar@probcomp.com
[2012.04.07 12:19:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.04.07 12:19:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.01.11 13:11:43 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011.03.02 00:54:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.07.03 10:59:54 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2012.02.07 23:23:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}
[2010.09.22 01:44:49 | 000,000,000 | ---D | M] (Adobe Contribute Toolbar) -- C:\PROGRAM FILES (X86)\ADOBE\ADOBE CONTRIBUTE CS5\PLUGINS\FIREFOXPLUGIN\{01A8CA0A-4C96-465B-A49B-65C46FAD54F9}
[2011.11.10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.09.14 23:32:39 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.09.14 23:32:39 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.09.14 23:32:39 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.09.14 23:32:39 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.09.14 23:32:39 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:[b]64bit:[/b] - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:[b]64bit:[/b] - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:[b]64bit:[/b] - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:[b]64bit:[/b] - HKLM..\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BCU] C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)
O4 - HKLM..\Run: [Cpu Level Up help] C:\Program Files (x86)\ASUS\AI Suite\CpuLevelUpHelp.exe ()
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [AdobeBridge] C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe (Adobe Systems, Inc.)
O4 - HKCU..\Run: [AVMUSBFernanschluss] C:\Users\mmartini\AppData\Local\Apps\2.0\RBWWQPYX.NHH\GOOD6XGC.9EW\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\AVMAutoStart.exe (AVM Berlin)
O4 - Startup: C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mozilla Thunderbird.lnk = C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (Mozilla Messaging)
O4 - Startup: C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O8:[b]64bit:[/b] - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:[b]64bit:[/b] - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:[b]64bit:[/b] - Extra context menu item: Download with Xilisoft Download YouTube Video - C:\Program Files (x86)\Xilisoft\Download YouTube Video\upod_link.HTM ()
O8:[b]64bit:[/b] - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:[b]64bit:[/b] - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:[b]64bit:[/b] - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:[b]64bit:[/b] - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Download with Xilisoft Download YouTube Video - C:\Program Files (x86)\Xilisoft\Download YouTube Video\upod_link.HTM ()
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9:[b]64bit:[/b] - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:[b]64bit:[/b] - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:[b]64bit:[/b] - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:[b]64bit:[/b] - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13[b]64bit:[/b] - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{216E3E0C-7723-44EA-AC94-968A3EA44C15}: DhcpNameServer = 192.168.178.1
O18:[b]64bit:[/b] - Protocol\Handler\ms-help - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\wlmailhtml - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2012.04.15 21:05:31 | 000,000,000 | ---D | C] -- C:\Users\mmartini\AppData\Roaming\Malwarebytes
[2012.04.15 21:05:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.04.15 21:05:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.04.15 21:05:23 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.04.15 21:05:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.04.15 21:03:32 | 010,063,000 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\mmartini\Desktop\mbam-setup-1.61.0.1400.exe
[2012.04.15 20:59:01 | 000,000,000 | ---D | C] -- C:\Users\mmartini\AppData\Roaming\Avira
[2012.04.15 20:55:05 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\mmartini\Desktop\OTL.exe
[2012.04.12 23:56:07 | 000,096,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.04.12 23:56:07 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.04.12 23:56:06 | 002,311,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.04.12 23:56:06 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.04.12 23:56:06 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.04.12 23:56:06 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.04.12 23:56:06 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.04.12 23:56:06 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.04.12 23:56:06 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.04.12 23:56:05 | 001,493,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.04.12 23:56:05 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.04.12 23:55:53 | 005,559,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.04.12 23:55:52 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.04.12 23:55:51 | 003,913,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.04.12 23:54:16 | 000,220,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2012.04.12 23:54:16 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll
[2012.04.12 23:54:16 | 000,023,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\fs_rec.sys
[2012.04.07 12:24:16 | 000,000,000 | ---D | C] -- C:\Users\mmartini\AppData\Roaming\OpenOffice.org
[2012.04.07 12:20:35 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3
[2012.04.07 12:20:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenOffice.org 3
[2012.04.07 12:17:38 | 000,000,000 | ---D | C] -- C:\Users\mmartini\Desktop\OpenOffice.org 3.3 (de) Installation Files
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2012.04.15 21:35:33 | 000,307,962 | ---- | M] () -- C:\Users\mmartini\Desktop\malwarebytes-1.png
[2012.04.15 21:28:25 | 000,000,177 | -H-- | M] () -- C:\dvmexp.idx
[2012.04.15 21:25:58 | 000,015,008 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.04.15 21:25:58 | 000,015,008 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.04.15 21:22:34 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.04.15 21:22:34 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.04.15 21:22:34 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.04.15 21:22:34 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.04.15 21:22:34 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.04.15 21:18:16 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.04.15 21:18:12 | 2146,873,343 | -HS- | M] () -- C:\hiberfil.sys
[2012.04.15 21:05:24 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.15 21:03:47 | 010,063,000 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\mmartini\Desktop\mbam-setup-1.61.0.1400.exe
[2012.04.15 20:55:05 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\mmartini\Desktop\OTL.exe
[2012.04.15 17:34:33 | 000,000,168 | -H-- | M] () -- C:\ProgramData\-XVtZQuIthVleLIr
[2012.04.15 17:34:33 | 000,000,000 | -H-- | M] () -- C:\ProgramData\-XVtZQuIthVleLI
[2012.04.15 17:34:30 | 000,000,256 | -H-- | M] () -- C:\ProgramData\XVtZQuIthVleLI
[2012.04.08 12:12:32 | 005,008,216 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.04.07 12:25:02 | 000,001,239 | ---- | M] () -- C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
[2012.04.07 12:20:35 | 000,001,124 | ---- | M] () -- C:\Users\Public\Desktop\OpenOffice.org 3.3.lnk
[2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.03.23 12:04:45 | 000,000,432 | ---- | M] () -- C:\Windows\BRWMARK.INI
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2012.04.15 21:35:33 | 000,307,962 | ---- | C] () -- C:\Users\mmartini\Desktop\malwarebytes-1.png
[2012.04.15 21:05:24 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.15 17:34:33 | 000,000,168 | -H-- | C] () -- C:\ProgramData\-XVtZQuIthVleLIr
[2012.04.15 17:34:33 | 000,000,000 | -H-- | C] () -- C:\ProgramData\-XVtZQuIthVleLI
[2012.04.15 17:34:29 | 000,000,256 | -H-- | C] () -- C:\ProgramData\XVtZQuIthVleLI
[2012.04.07 12:25:02 | 000,001,239 | ---- | C] () -- C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
[2012.04.07 12:20:35 | 000,001,124 | ---- | C] () -- C:\Users\Public\Desktop\OpenOffice.org 3.3.lnk
[2010.12.20 15:03:09 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010.12.20 15:03:09 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\BD2030.DAT
[2010.10.21 15:18:46 | 000,303,104 | ---- | C] () -- C:\Windows\SysWow64\dnt27VC8.dll
[2010.10.21 15:16:58 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\dntvmc27VC8.dll
[2010.10.21 15:16:34 | 000,086,016 | ---- | C] () -- C:\Windows\SysWow64\dntvm27VC8.dll
[2010.10.09 01:38:12 | 000,001,456 | ---- | C] () -- C:\Users\mmartini\AppData\Local\Adobe Für Web speichern 12.0 Prefs
[2010.09.25 21:00:09 | 000,000,132 | ---- | C] () -- C:\Users\mmartini\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2010.09.21 23:11:26 | 000,024,576 | R--- | C] () -- C:\Windows\SysWow64\AsIO.dll
[2010.09.21 23:11:26 | 000,013,440 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys
[2010.09.21 23:11:22 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2010.09.21 23:11:22 | 000,010,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys
[2010.09.21 22:44:52 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2010.09.21 22:44:51 | 000,023,167 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
 
[color=#E56717]========== Alternate Data Streams ==========[/color]
 
@Alternate Data Stream - 957 bytes -> C:\Users\mmartini\AppData\Local\gbsjslU2AwboDoj:cdxtRwpCuRPLqSnP1mw2I
< End of report > 

cosinus 16.04.2012 14:41
Zitat:
Ich habe mit Malwarebytes drei Dateien entfernen lassen und stelle nun das Ergebnis von otl hier rein. Danke vorab für die Arbeit!
Ohne die Logs von Malwarebytes und Co wird das hier nichts. :glaskugel:
Alles von Malwarebytes (und evtl. anderen Scannern) muss hier gepostet werden.

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

name 16.04.2012 18:02
Danke für die Antwort!

Nachfolgend der Log von Malwarebytes:

Code:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org
Datenbank Version: v2012.04.15.06
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
mmartini :: MMARTINI-PC [Administrator]
15.04.2012 21:07:46
mbam-log-2012-04-15 (21-07-46).txt
Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 238280
Laufzeit: 3 Minute(n), 24 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateien: 3
C:\ProgramData\AlSnqDidGxPete.exe (Backdoor.Agent.RCGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\XVtZQuIthVleLI.exe (Backdoor.Agent.RCGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\markus\AppData\Local\Temp\7JXJqMypOnQwOM.exe.tmp (Backdoor.Agent.RCGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
(Ende)

Da Dateien verschwunden/unsichtbar sind habe ich noch die unhide.exe runtergeladen und ausgeführt und ich kann wieder meine Dateien sehen (freu)

cosinus 16.04.2012 20:20
Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

name 16.04.2012 23:56
So ich habe jetzt fast drei Stunden Malwarebytes mit den folgenden Ergebnis laufen lassen:

Code:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org
Datenbank Version: v2012.04.16.04
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
mmartini :: MMARTINI-PC [Administrator]
16.04.2012 22:04:01
mbam-log-2012-04-16 (22-04-01).txt
Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 847875
Laufzeit: 2 Stunde(n), 46 Minute(n), 5 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)
(Ende)
Den ESET muss ich morgen machen. Das schaffe ich heute nicht mehr. Grüße bis morgen.

Hi! Und nun der Log von ESET (leider was gefunden):

Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=4c8fc566fac5b9478bff5902a3baf91f
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-04-17 10:28:18
# local_time=2012-04-18 12:28:18 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775165 100 94 185606 71222601 194119 0
# compatibility_mode=5893 16776574 100 94 25008488 86320588 0 0
# compatibility_mode=8192 67108863 100 0 326 326 0 0
# scanned=630727
# found=4
# cleaned=0
# scan_time=10960
C:\Users\markus\AppData\Local\Temp\jar_cache6561176433506254600.tmp probably a variant of Java/Exploit.Agent.FH trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\markus\AppData\Local\Temp\jar_cache6715319405032169347.tmp a variant of J2ME/Agent.AA trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\markus\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45\1deb4ad-17be2a30 Java/TrojanDownloader.OpenStream.NBL trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\mmartini\Documents\gemeinsam\geschäft\edv etc\x-download-youtube-video2-de.exe Win32/Toolbar.Zugo application (unable to clean) 00000000000000000000000000000000 I
Habt ihr einen Tipp?

name 20.04.2012 17:48
hier noch einmal ein logfile von otl.
Braucht ihr noch mehr?

OTL Logfile:
Code:
OTL logfile created on: 20.04.2012 18:33:07 - Run 3
OTL by OldTimer - Version 3.2.39.2    Folder = C:\Users\mmartini\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,39 Gb Available Physical Memory | 79,87% Memory free
16,00 Gb Paging File | 13,82 Gb Available in Paging File | 86,39% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 321,43 Gb Free Space | 69,03% Space Free | Partition Type: NTFS
 
Computer Name: MMARTINI-PC | User Name: mmartini | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\mmartini\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11e_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Windows\SysWOW64\wbem\WmiPrvSE.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe (DeviceVM, Inc.)
PRC - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)
PRC - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe (ASUSTeK Computer Inc.)
PRC - C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe (ASUSTeK Computer Inc.)
PRC - C:\ASUS.SYS\config\DVMExportService.exe (DeviceVM, Inc.)
PRC - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\SysWOW64\AsIO.dll ()
MOD - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\sqlite3.dll ()
MOD - C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll ()
MOD - C:\Program Files (x86)\ASUS\EPU-4 Engine\AiNap.dll ()
MOD - C:\Program Files (x86)\ASUS\EPU-4 Engine\vvc.dll ()
MOD - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.deu ()
MOD - C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (BCUService) -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe (DeviceVM, Inc.)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (AsSysCtrlService) -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe (ASUSTeK Computer Inc.)
SRV - (DvmMDES) -- C:\ASUS.SYS\config\DVMExportService.exe (DeviceVM, Inc.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (IJPLMSVC) -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE ()
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (avmaudio) -- C:\Windows\SysNative\drivers\avmaudio.sys (AVM Berlin)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (VIAHdAudAddService) -- C:\Windows\SysNative\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (NVENETFD) -- C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = {searchTerms} - Bing
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = {searchTerms} - Bing
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1253508408-4126437792-2166923290-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKU\S-1-5-21-1253508408-4126437792-2166923290-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.splashtop.com/asusexpressgate/mb/searchAPI.php?SE=yahoo&QS=http%3A%2F%2Fde.search.yahoo.com%2Fsearch%3Ffr%3Dfp-devicevm%26type%3DWEB01
IE - HKU\S-1-5-21-1253508408-4126437792-2166923290-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKU\S-1-5-21-1253508408-4126437792-2166923290-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-1253508408-4126437792-2166923290-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 90 48 A4 59 C1 59 CB 01  [binary data]
IE - HKU\S-1-5-21-1253508408-4126437792-2166923290-1000\..\URLSearchHook: {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll (DeviceVM, Inc.)
IE - HKU\S-1-5-21-1253508408-4126437792-2166923290-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1253508408-4126437792-2166923290-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = {searchTerms} - Bing
IE - HKU\S-1-5-21-1253508408-4126437792-2166923290-1000\..\SearchScopes\{E083E8E8-FE87-4e9f-BCE0-CAA2F44E3FE6}: "URL" = {searchTerms - Google-Suche}
IE - HKU\S-1-5-21-1253508408-4126437792-2166923290-1000\..\SearchScopes\{F6ECCF0F-05D3-47e4-BF23-05E2AEFE758B}: "URL" = {searchTerms} - Yahoo! Suche Suchergebnisse
IE - HKU\S-1-5-21-1253508408-4126437792-2166923290-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "Amazon.de"
FF - prefs.js..browser.startup.homepage: "hxxp://typo3.p117137.mittwaldserver.info/typo3/index.php|hxxp://www.1-liga.de/typo3/index.php|hxxp://www.auf-pfoten.de/home.html|hxxp://www.traum-projekt.com/forum/112-typo3/75384-typo3-formularfelder-und-css.html|hxxp://typo3.org/documentation/document-library/extension-manuals/powermail/1.5.3/view/1/12/|hxxp://www.heilbronn-seo.de/optimierung-oder-gleich-ein-neues-design/|hxxp://www.profi-ranking.de/suchmaschinenoptimierung/keyword-recherche/|hxxp://www.brave-hunde.de/pagerank.html|hxxp://siteexplorer.search.yahoo.com/de/siteexplorer/search?p=http%3A%2F%2Fwww.brave-hunde.de&bwm=i&bwmf=u&bwms=p&fr=yfp-t-708&fr2=seo-rd-se"
FF - prefs.js..extensions.enabledItems: {01A8CA0A-4C96-465b-A49B-65C46FAD54F9}:6.0
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.1
FF - prefs.js..extensions.enabledItems: webrank-toolbar@probcomp.com:4.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}:6.0.30
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010.09.22 01:44:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.10.03 16:38:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.07.03 10:57:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.01.30 23:57:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.5\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.01.30 23:57:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.5\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.6\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.01.30 23:57:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.01.30 23:57:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2010.10.06 01:50:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mmartini\AppData\Roaming\mozilla\Extensions
[2010.10.06 01:50:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mmartini\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.04.17 21:20:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mmartini\AppData\Roaming\mozilla\Firefox\Profiles\m2gane3a.default\extensions
[2011.01.23 17:11:15 | 000,000,000 | ---D | M] (Firebug) -- C:\Users\mmartini\AppData\Roaming\mozilla\Firefox\Profiles\m2gane3a.default\extensions\firebug@software.joehewitt.com
[2011.01.23 17:11:19 | 000,000,000 | ---D | M] (WebRank Toolbar) -- C:\Users\mmartini\AppData\Roaming\mozilla\Firefox\Profiles\m2gane3a.default\extensions\webrank-toolbar@probcomp.com
[2012.04.07 12:19:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.04.07 12:19:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.01.11 13:11:43 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011.03.02 00:54:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.07.03 10:59:54 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2012.02.07 23:23:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}
[2010.09.22 01:44:49 | 000,000,000 | ---D | M] (Adobe Contribute Toolbar) -- C:\PROGRAM FILES (X86)\ADOBE\ADOBE CONTRIBUTE CS5\PLUGINS\FIREFOXPLUGIN\{01A8CA0A-4C96-465B-A49B-65C46FAD54F9}
[2011.11.10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.09.14 23:32:39 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.09.14 23:32:39 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.09.14 23:32:39 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.09.14 23:32:39 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.09.14 23:32:39 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O3 - HKU\S-1-5-21-1253508408-4126437792-2166923290-1000\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BCU] C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)
O4 - HKLM..\Run: [Cpu Level Up help] C:\Program Files (x86)\ASUS\AI Suite\CpuLevelUpHelp.exe ()
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1253508408-4126437792-2166923290-1000..\Run: [AdobeBridge] C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe (Adobe Systems, Inc.)
O4 - HKU\S-1-5-21-1253508408-4126437792-2166923290-1000..\Run: [AVMUSBFernanschluss] C:\Users\mmartini\AppData\Local\Apps\2.0\RBWWQPYX.NHH\GOOD6XGC.9EW\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\AVMAutoStart.exe (AVM Berlin)
O4 - HKU\S-1-5-21-1253508408-4126437792-2166923290-1004..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-1253508408-4126437792-2166923290-1004..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Media Player.lnk = C:\Program Files (x86)\Adobe Media Player\Adobe Media Player.exe ()
O4 - Startup: C:\Users\markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mozilla Thunderbird.lnk = C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (Mozilla Messaging)
O4 - Startup: C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Download with Xilisoft Download YouTube Video - C:\Program Files (x86)\Xilisoft\Download YouTube Video\upod_link.HTM ()
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Download with Xilisoft Download YouTube Video - C:\Program Files (x86)\Xilisoft\Download YouTube Video\upod_link.HTM ()
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{216E3E0C-7723-44EA-AC94-968A3EA44C15}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6DBC9376-DA36-630C-1321-8E58C2A0705A} - Internet Explorer
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.04.17 21:20:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.04.16 18:18:44 | 000,399,264 | ---- | C] (Bleeping Computer, LLC) -- C:\Users\mmartini\Desktop\unhide.exe
[2012.04.15 21:05:31 | 000,000,000 | ---D | C] -- C:\Users\mmartini\AppData\Roaming\Malwarebytes
[2012.04.15 21:05:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.04.15 21:05:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.04.15 21:05:23 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.04.15 21:05:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.04.15 21:03:32 | 010,063,000 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\mmartini\Desktop\mbam-setup-1.61.0.1400.exe
[2012.04.15 20:59:01 | 000,000,000 | ---D | C] -- C:\Users\mmartini\AppData\Roaming\Avira
[2012.04.15 20:55:05 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\mmartini\Desktop\OTL.exe
[2012.04.12 23:56:07 | 000,096,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.04.12 23:56:07 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.04.12 23:56:06 | 002,311,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.04.12 23:56:06 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.04.12 23:56:06 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.04.12 23:56:06 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.04.12 23:56:06 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.04.12 23:56:06 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.04.12 23:56:06 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.04.12 23:56:05 | 001,493,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.04.12 23:56:05 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.04.12 23:55:53 | 005,559,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.04.12 23:55:52 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.04.12 23:55:51 | 003,913,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.04.12 23:54:16 | 000,220,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2012.04.12 23:54:16 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll
[2012.04.12 23:54:16 | 000,023,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\fs_rec.sys
[2012.04.07 12:24:16 | 000,000,000 | ---D | C] -- C:\Users\mmartini\AppData\Roaming\OpenOffice.org
[2012.04.07 12:20:35 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3
[2012.04.07 12:20:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenOffice.org 3
[2012.04.07 12:17:38 | 000,000,000 | ---D | C] -- C:\Users\mmartini\Desktop\OpenOffice.org 3.3 (de) Installation Files
 
========== Files - Modified Within 30 Days ==========
 
[2012.04.20 18:26:37 | 000,015,008 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.04.20 18:26:37 | 000,015,008 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.04.20 17:48:38 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.04.20 16:49:38 | 000,000,177 | -H-- | M] () -- C:\dvmexp.idx
[2012.04.20 16:45:30 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.04.20 16:45:30 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.04.20 16:45:30 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.04.20 16:45:30 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.04.20 16:45:30 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.04.20 16:39:16 | 2146,873,343 | -HS- | M] () -- C:\hiberfil.sys
[2012.04.16 18:18:44 | 000,399,264 | ---- | M] (Bleeping Computer, LLC) -- C:\Users\mmartini\Desktop\unhide.exe
[2012.04.15 21:35:33 | 000,307,962 | ---- | M] () -- C:\Users\mmartini\Desktop\malwarebytes-1.png
[2012.04.15 21:05:24 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.15 21:03:47 | 010,063,000 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\mmartini\Desktop\mbam-setup-1.61.0.1400.exe
[2012.04.15 20:55:05 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\mmartini\Desktop\OTL.exe
[2012.04.15 17:34:33 | 000,000,168 | ---- | M] () -- C:\ProgramData\-XVtZQuIthVleLIr
[2012.04.15 17:34:33 | 000,000,000 | ---- | M] () -- C:\ProgramData\-XVtZQuIthVleLI
[2012.04.15 17:34:30 | 000,000,256 | ---- | M] () -- C:\ProgramData\XVtZQuIthVleLI
[2012.04.08 12:12:32 | 005,008,216 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.04.07 12:25:02 | 000,001,239 | ---- | M] () -- C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
[2012.04.07 12:20:35 | 000,001,124 | ---- | M] () -- C:\Users\Public\Desktop\OpenOffice.org 3.3.lnk
[2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.03.23 12:04:45 | 000,000,432 | ---- | M] () -- C:\Windows\BRWMARK.INI
 
========== Files Created - No Company Name ==========
 
[2012.04.15 21:35:33 | 000,307,962 | ---- | C] () -- C:\Users\mmartini\Desktop\malwarebytes-1.png
[2012.04.15 21:05:24 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.15 17:34:33 | 000,000,168 | ---- | C] () -- C:\ProgramData\-XVtZQuIthVleLIr
[2012.04.15 17:34:33 | 000,000,000 | ---- | C] () -- C:\ProgramData\-XVtZQuIthVleLI
[2012.04.15 17:34:29 | 000,000,256 | ---- | C] () -- C:\ProgramData\XVtZQuIthVleLI
[2012.04.07 12:25:02 | 000,001,239 | ---- | C] () -- C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
[2012.04.07 12:20:35 | 000,001,124 | ---- | C] () -- C:\Users\Public\Desktop\OpenOffice.org 3.3.lnk
[2010.12.20 15:03:09 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010.12.20 15:03:09 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\BD2030.DAT
[2010.10.21 15:18:46 | 000,303,104 | ---- | C] () -- C:\Windows\SysWow64\dnt27VC8.dll
[2010.10.21 15:16:58 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\dntvmc27VC8.dll
[2010.10.21 15:16:34 | 000,086,016 | ---- | C] () -- C:\Windows\SysWow64\dntvm27VC8.dll
[2010.10.09 01:38:12 | 000,001,456 | ---- | C] () -- C:\Users\mmartini\AppData\Local\Adobe Für Web speichern 12.0 Prefs
[2010.09.25 21:00:09 | 000,000,132 | ---- | C] () -- C:\Users\mmartini\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2010.09.21 23:11:26 | 000,024,576 | R--- | C] () -- C:\Windows\SysWow64\AsIO.dll
[2010.09.21 23:11:26 | 000,013,440 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys
[2010.09.21 23:11:22 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2010.09.21 23:11:22 | 000,010,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys
[2010.09.21 22:44:52 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2010.09.21 22:44:51 | 000,023,167 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2010.10.16 22:24:39 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011.12.13 18:29:27 | 000,000,000 | ---D | M] -- C:\ASUS.000
[2010.09.24 12:41:25 | 000,000,000 | ---D | M] -- C:\ASUS.SYS
[2010.12.26 18:26:26 | 000,000,000 | ---D | M] -- C:\Daten
[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2010.09.21 20:54:27 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2010.09.21 23:05:51 | 000,000,000 | -H-D | M] -- C:\dvmexp
[2012.04.07 16:44:15 | 000,000,000 | ---D | M] -- C:\he
[2011.01.23 16:01:27 | 000,000,000 | ---D | M] -- C:\lexware-mobil
[2011.01.30 23:59:20 | 000,000,000 | ---D | M] -- C:\MoTemp
[2010.10.03 11:57:48 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2010.09.24 13:03:04 | 000,000,000 | ---D | M] -- C:\NVIDIA
[2009.07.14 05:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.02.07 12:29:54 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.04.17 21:20:12 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2012.04.15 21:12:23 | 000,000,000 | ---D | M] -- C:\ProgramData
[2010.09.21 20:54:27 | 000,000,000 | -HSD | M] -- C:\Programme
[2010.09.21 20:54:28 | 000,000,000 | -HSD | M] -- C:\Recovery
[2012.04.20 18:34:25 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2010.09.21 23:05:51 | 000,000,000 | ---D | M] -- C:\temp
[2012.04.07 21:34:27 | 000,000,000 | ---D | M] -- C:\typo3
[2012.02.07 23:44:59 | 000,000,000 | R--D | M] -- C:\Users
[2011.09.04 16:10:23 | 000,000,000 | ---D | M] -- C:\vorl
[2012.02.08 09:04:45 | 000,000,000 | ---D | M] -- C:\Windows
[2009.12.20 01:00:00 | 000,000,000 | ---D | M] -- C:\xampp
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2010.11.05 19:18:26 | 000,037,520 | ---- | M] (perl.org) MD5=2852D57385C4709EAAE2F9DB01AD3672 -- C:\Users\markus\Desktop\müll\xampp-win32-1.7.3\xampp\perl\site\lib\auto\Win32\EventLog\EventLog.dll
[2010.11.05 20:33:21 | 000,037,520 | ---- | M] (perl.org) MD5=2852D57385C4709EAAE2F9DB01AD3672 -- C:\Users\mmartini\Documents\gemeinsam\homepage\xampp-win32-1.7.3\xampp\perl\site\lib\auto\Win32\EventLog\EventLog.dll
[2009.12.20 01:00:00 | 000,037,520 | ---- | M] (perl.org) MD5=2852D57385C4709EAAE2F9DB01AD3672 -- C:\xampp\perl\site\lib\auto\Win32\EventLog\EventLog.dll
 
< MD5 for: EXPLORER.EXE  >
[2011.02.26 08:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011.02.26 08:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009.08.03 08:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009.10.31 08:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009.08.03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010.11.20 15:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009.10.31 08:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009.07.14 03:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009.10.31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011.02.26 08:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009.08.03 08:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %USERPROFILE%\*.* >
[2011.01.30 23:59:20 | 000,000,159 | ---- | M] () -- C:\Users\mmartini\.imagineer_log.txt
[2012.04.20 18:36:08 | 002,621,440 | -HS- | M] () -- C:\Users\mmartini\NTUSER.DAT
[2012.04.20 18:36:08 | 000,262,144 | -HS- | M] () -- C:\Users\mmartini\ntuser.dat.LOG1
[2010.09.21 20:54:40 | 000,000,000 | -HS- | M] () -- C:\Users\mmartini\ntuser.dat.LOG2
[2010.09.21 21:10:25 | 000,065,536 | -HS- | M] () -- C:\Users\mmartini\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2010.09.21 21:10:25 | 000,524,288 | -HS- | M] () -- C:\Users\mmartini\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2010.09.21 21:10:25 | 000,524,288 | -HS- | M] () -- C:\Users\mmartini\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2010.11.17 19:05:06 | 000,065,536 | -HS- | M] () -- C:\Users\mmartini\NTUSER.DAT{40c880e0-f233-11df-acfa-485b39efcbc0}.TM.blf
[2010.11.17 19:05:06 | 000,524,288 | -HS- | M] () -- C:\Users\mmartini\NTUSER.DAT{40c880e0-f233-11df-acfa-485b39efcbc0}.TMContainer00000000000000000001.regtrans-ms
[2010.11.17 19:05:06 | 000,524,288 | -HS- | M] () -- C:\Users\mmartini\NTUSER.DAT{40c880e0-f233-11df-acfa-485b39efcbc0}.TMContainer00000000000000000002.regtrans-ms
[2010.12.30 21:19:21 | 000,065,536 | -HS- | M] () -- C:\Users\mmartini\NTUSER.DAT{8007f1e2-1448-11e0-9f69-485b39efcbc0}.TM.blf
[2010.12.30 21:19:21 | 000,524,288 | -HS- | M] () -- C:\Users\mmartini\NTUSER.DAT{8007f1e2-1448-11e0-9f69-485b39efcbc0}.TMContainer00000000000000000001.regtrans-ms
[2010.12.30 21:19:21 | 000,524,288 | -HS- | M] () -- C:\Users\mmartini\NTUSER.DAT{8007f1e2-1448-11e0-9f69-485b39efcbc0}.TMContainer00000000000000000002.regtrans-ms
[2010.09.21 20:54:40 | 000,000,020 | -HS- | M] () -- C:\Users\mmartini\ntuser.ini
[2011.08.01 22:28:11 | 000,000,000 | ---- | M] () -- C:\Users\mmartini\Sti_Trace.log
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 957 bytes -> C:\Users\mmartini\AppData\Local\gbsjslU2AwboDoj:cdxtRwpCuRPLqSnP1mw2I
< End of report >
--- --- ---

cosinus 20.04.2012 20:30
Sry hab deinen Strang übersehen

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

name 21.04.2012 00:03
Liste der Anhänge anzeigen (Anzahl: 1)
Soweit ich das beurteilen kann geht der normale Modus. Windows läuft. Da Dateien verschwunden/unsichtbar waren habe ich noch die unhide.exe runtergeladen und ausgeführt. Meine Dateien kann ich also wider sehen. Mir ist aller dings noch etwas komisches aufgefallen. Mache ich den Explorer auf, sehe ich einige Ordner, die auf dem Ordnersymbol noch ein Schlosssymbol haben. Diese Ordner lassen sich nicht öffnen (s. Anhang ordner.png).

cosinus 21.04.2012 01:02
Diese Ordner sind immer da, werden nur nich immer angezeigt, siehe http://www.trojaner-board.de/59624-a...-sichtbar.html

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

name 21.04.2012 08:23
Hi!
Danke für die Antwort. Hier der logfile von OTL
OTL Logfile:
Code:
OTL logfile created on: 21.04.2012 09:00:02 - Run 4
OTL by OldTimer - Version 3.2.39.2    Folder = C:\Users\mmartini\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,57 Gb Available Physical Memory | 82,08% Memory free
16,00 Gb Paging File | 14,50 Gb Available in Paging File | 90,64% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 323,89 Gb Free Space | 69,55% Space Free | Partition Type: NTFS
Drive E: | 931,28 Gb Total Space | 697,98 Gb Free Space | 74,95% Space Free | Partition Type: FAT32
 
Computer Name: MMARTINI-PC | User Name: mmartini | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\mmartini\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (Mozilla Messaging)
PRC - C:\Windows\SysWOW64\wbem\WmiPrvSE.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe (DeviceVM, Inc.)
PRC - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)
PRC - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe (ASUSTeK Computer Inc.)
PRC - C:\ASUS.SYS\config\DVMExportService.exe (DeviceVM, Inc.)
PRC - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll ()
MOD - C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll ()
MOD - C:\Program Files (x86)\Mozilla Thunderbird\js3250.dll ()
MOD - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\sqlite3.dll ()
MOD - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.deu ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (BCUService) -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe (DeviceVM, Inc.)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (AsSysCtrlService) -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe (ASUSTeK Computer Inc.)
SRV - (DvmMDES) -- C:\ASUS.SYS\config\DVMExportService.exe (DeviceVM, Inc.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (IJPLMSVC) -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE ()
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (avmaudio) -- C:\Windows\SysNative\drivers\avmaudio.sys (AVM Berlin)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (VIAHdAudAddService) -- C:\Windows\SysNative\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (NVENETFD) -- C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = {searchTerms} - Bing
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = {searchTerms} - Bing
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.splashtop.com/asusexpressgate/mb/searchAPI.php?SE=yahoo&QS=http%3A%2F%2Fde.search.yahoo.com%2Fsearch%3Ffr%3Dfp-devicevm%26type%3DWEB01
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 90 48 A4 59 C1 59 CB 01  [binary data]
IE - HKCU\..\URLSearchHook: {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll (DeviceVM, Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = {searchTerms} - Bing
IE - HKCU\..\SearchScopes\{E083E8E8-FE87-4e9f-BCE0-CAA2F44E3FE6}: "URL" = {searchTerms - Google-Suche}
IE - HKCU\..\SearchScopes\{F6ECCF0F-05D3-47e4-BF23-05E2AEFE758B}: "URL" = {searchTerms} - Yahoo! Suche Suchergebnisse
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "Amazon.de"
FF - prefs.js..browser.startup.homepage: "hxxp://typo3.p117137.mittwaldserver.info/typo3/index.php|hxxp://www.1-liga.de/typo3/index.php|hxxp://www.auf-pfoten.de/home.html|hxxp://www.traum-projekt.com/forum/112-typo3/75384-typo3-formularfelder-und-css.html|hxxp://typo3.org/documentation/document-library/extension-manuals/powermail/1.5.3/view/1/12/|hxxp://www.heilbronn-seo.de/optimierung-oder-gleich-ein-neues-design/|hxxp://www.profi-ranking.de/suchmaschinenoptimierung/keyword-recherche/|hxxp://www.brave-hunde.de/pagerank.html|hxxp://siteexplorer.search.yahoo.com/de/siteexplorer/search?p=http%3A%2F%2Fwww.brave-hunde.de&bwm=i&bwmf=u&bwms=p&fr=yfp-t-708&fr2=seo-rd-se"
FF - prefs.js..extensions.enabledItems: {01A8CA0A-4C96-465b-A49B-65C46FAD54F9}:6.0
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.1
FF - prefs.js..extensions.enabledItems: webrank-toolbar@probcomp.com:4.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}:6.0.30
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010.09.22 01:44:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.10.03 16:38:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.07.03 10:57:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.01.30 23:57:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.5\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.01.30 23:57:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.5\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.6\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.01.30 23:57:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.01.30 23:57:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2010.10.06 01:50:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mmartini\AppData\Roaming\mozilla\Extensions
[2010.10.06 01:50:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mmartini\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.04.20 19:20:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mmartini\AppData\Roaming\mozilla\Firefox\Profiles\m2gane3a.default\extensions
[2011.01.23 17:11:15 | 000,000,000 | ---D | M] (Firebug) -- C:\Users\mmartini\AppData\Roaming\mozilla\Firefox\Profiles\m2gane3a.default\extensions\firebug@software.joehewitt.com
[2011.01.23 17:11:19 | 000,000,000 | ---D | M] (WebRank Toolbar) -- C:\Users\mmartini\AppData\Roaming\mozilla\Firefox\Profiles\m2gane3a.default\extensions\webrank-toolbar@probcomp.com
[2012.04.07 12:19:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.04.07 12:19:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.01.11 13:11:43 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011.03.02 00:54:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.07.03 10:59:54 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2012.02.07 23:23:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}
[2010.09.22 01:44:49 | 000,000,000 | ---D | M] (Adobe Contribute Toolbar) -- C:\PROGRAM FILES (X86)\ADOBE\ADOBE CONTRIBUTE CS5\PLUGINS\FIREFOXPLUGIN\{01A8CA0A-4C96-465B-A49B-65C46FAD54F9}
[2011.11.10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.09.14 23:32:39 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.09.14 23:32:39 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.09.14 23:32:39 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.09.14 23:32:39 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.09.14 23:32:39 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BCU] C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)
O4 - HKLM..\Run: [Cpu Level Up help] C:\Program Files (x86)\ASUS\AI Suite\CpuLevelUpHelp.exe ()
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [AdobeBridge] C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe (Adobe Systems, Inc.)
O4 - HKCU..\Run: [AVMUSBFernanschluss] C:\Users\mmartini\AppData\Local\Apps\2.0\RBWWQPYX.NHH\GOOD6XGC.9EW\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\AVMAutoStart.exe (AVM Berlin)
O4 - Startup: C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mozilla Thunderbird.lnk = C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (Mozilla Messaging)
O4 - Startup: C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 [2010.10.07 10:38:52 | 000,000,000 | ---D | M]
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Download with Xilisoft Download YouTube Video - C:\Program Files (x86)\Xilisoft\Download YouTube Video\upod_link.HTM ()
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Download with Xilisoft Download YouTube Video - C:\Program Files (x86)\Xilisoft\Download YouTube Video\upod_link.HTM ()
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{216E3E0C-7723-44EA-AC94-968A3EA44C15}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
 
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6DBC9376-DA36-630C-1321-8E58C2A0705A} - Internet Explorer
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.04.17 21:20:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.04.16 18:18:44 | 000,399,264 | ---- | C] (Bleeping Computer, LLC) -- C:\Users\mmartini\Desktop\unhide.exe
[2012.04.15 21:05:31 | 000,000,000 | ---D | C] -- C:\Users\mmartini\AppData\Roaming\Malwarebytes
[2012.04.15 21:05:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.04.15 21:05:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.04.15 21:05:23 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.04.15 21:05:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.04.15 21:03:32 | 010,063,000 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\mmartini\Desktop\mbam-setup-1.61.0.1400.exe
[2012.04.15 20:59:01 | 000,000,000 | ---D | C] -- C:\Users\mmartini\AppData\Roaming\Avira
[2012.04.15 20:55:05 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\mmartini\Desktop\OTL.exe
[2012.04.07 12:24:16 | 000,000,000 | ---D | C] -- C:\Users\mmartini\AppData\Roaming\OpenOffice.org
[2012.04.07 12:20:35 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3
[2012.04.07 12:20:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenOffice.org 3
[2012.04.07 12:17:38 | 000,000,000 | ---D | C] -- C:\Users\mmartini\Desktop\OpenOffice.org 3.3 (de) Installation Files
 
========== Files - Modified Within 30 Days ==========
 
[2012.04.21 09:00:55 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.04.21 09:00:55 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.04.21 09:00:55 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.04.21 09:00:55 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.04.21 09:00:55 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.04.21 09:00:04 | 000,000,177 | -H-- | M] () -- C:\dvmexp.idx
[2012.04.21 08:57:37 | 000,015,008 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.04.21 08:57:37 | 000,015,008 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.04.21 08:49:50 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.04.21 08:49:44 | 2146,873,343 | -HS- | M] () -- C:\hiberfil.sys
[2012.04.21 01:01:06 | 000,234,009 | ---- | M] () -- C:\Users\mmartini\Desktop\ordner.png
[2012.04.20 19:20:12 | 000,006,260 | ---- | M] () -- C:\Users\mmartini\Desktop\bookmark.htm
[2012.04.16 18:18:44 | 000,399,264 | ---- | M] (Bleeping Computer, LLC) -- C:\Users\mmartini\Desktop\unhide.exe
[2012.04.15 21:35:33 | 000,307,962 | ---- | M] () -- C:\Users\mmartini\Desktop\malwarebytes-1.png
[2012.04.15 21:05:24 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.15 21:03:47 | 010,063,000 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\mmartini\Desktop\mbam-setup-1.61.0.1400.exe
[2012.04.15 20:55:05 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\mmartini\Desktop\OTL.exe
[2012.04.15 17:34:33 | 000,000,168 | ---- | M] () -- C:\ProgramData\-XVtZQuIthVleLIr
[2012.04.15 17:34:33 | 000,000,000 | ---- | M] () -- C:\ProgramData\-XVtZQuIthVleLI
[2012.04.15 17:34:30 | 000,000,256 | ---- | M] () -- C:\ProgramData\XVtZQuIthVleLI
[2012.04.08 12:12:32 | 005,008,216 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.04.07 12:25:02 | 000,001,239 | ---- | M] () -- C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
[2012.04.07 12:20:35 | 000,001,124 | ---- | M] () -- C:\Users\Public\Desktop\OpenOffice.org 3.3.lnk
[2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.03.23 12:04:45 | 000,000,432 | ---- | M] () -- C:\Windows\BRWMARK.INI
 
========== Files Created - No Company Name ==========
 
[2012.04.21 00:58:56 | 000,234,009 | ---- | C] () -- C:\Users\mmartini\Desktop\ordner.png
[2012.04.20 19:20:12 | 000,006,260 | ---- | C] () -- C:\Users\mmartini\Desktop\bookmark.htm
[2012.04.15 21:35:33 | 000,307,962 | ---- | C] () -- C:\Users\mmartini\Desktop\malwarebytes-1.png
[2012.04.15 21:05:24 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.15 17:34:33 | 000,000,168 | ---- | C] () -- C:\ProgramData\-XVtZQuIthVleLIr
[2012.04.15 17:34:33 | 000,000,000 | ---- | C] () -- C:\ProgramData\-XVtZQuIthVleLI
[2012.04.15 17:34:29 | 000,000,256 | ---- | C] () -- C:\ProgramData\XVtZQuIthVleLI
[2012.04.07 12:25:02 | 000,001,239 | ---- | C] () -- C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
[2012.04.07 12:20:35 | 000,001,124 | ---- | C] () -- C:\Users\Public\Desktop\OpenOffice.org 3.3.lnk
[2010.12.20 15:03:09 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010.12.20 15:03:09 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\BD2030.DAT
[2010.10.21 15:18:46 | 000,303,104 | ---- | C] () -- C:\Windows\SysWow64\dnt27VC8.dll
[2010.10.21 15:16:58 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\dntvmc27VC8.dll
[2010.10.21 15:16:34 | 000,086,016 | ---- | C] () -- C:\Windows\SysWow64\dntvm27VC8.dll
[2010.10.09 01:38:12 | 000,001,456 | ---- | C] () -- C:\Users\mmartini\AppData\Local\Adobe Für Web speichern 12.0 Prefs
[2010.09.25 21:00:09 | 000,000,132 | ---- | C] () -- C:\Users\mmartini\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2010.09.21 23:11:26 | 000,024,576 | R--- | C] () -- C:\Windows\SysWow64\AsIO.dll
[2010.09.21 23:11:26 | 000,013,440 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys
[2010.09.21 23:11:22 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2010.09.21 23:11:22 | 000,010,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys
[2010.09.21 22:44:52 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2010.09.21 22:44:51 | 000,023,167 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
 
========== LOP Check ==========
 
[2010.11.15 16:03:20 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\1&1
[2011.08.01 22:28:11 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\Canon
[2010.10.03 18:51:56 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010.09.24 02:45:29 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\com.adobe.ExMan
[2010.09.24 12:28:08 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\DeviceVm
[2011.03.02 00:52:53 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\elsterformular
[2010.12.05 14:00:56 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\FileZilla
[2010.12.05 02:13:43 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\Lexware
[2012.04.07 12:24:16 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\OpenOffice.org
[2010.09.24 11:42:44 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\Opera
[2011.02.06 18:36:51 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\PACE Anti-Piracy
[2010.09.24 03:21:52 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010.10.08 16:00:20 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\Thunderbird
[2010.10.11 23:57:20 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\TransMemory_Secure
[2011.02.06 17:28:39 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\Xilisoft
[2012.02.26 15:17:30 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.11.15 16:03:20 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\1&1
[2011.07.03 11:03:01 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\Adobe
[2010.09.24 16:57:18 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\Adobe Mini Bridge CS5
[2012.04.15 20:59:01 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\Avira
[2011.08.01 19:41:10 | 000,000,000 | R--D | M] -- C:\Users\mmartini\AppData\Roaming\Brother
[2011.08.01 22:28:11 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\Canon
[2010.10.03 18:51:56 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010.09.24 02:45:29 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\com.adobe.ExMan
[2010.09.24 12:28:08 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\DeviceVm
[2011.03.02 00:52:53 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\elsterformular
[2010.12.05 14:00:56 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\FileZilla
[2010.09.21 20:54:47 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\Identities
[2010.12.05 02:13:43 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\Lexware
[2010.09.22 01:25:15 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\Macromedia
[2012.04.15 21:05:31 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\Malwarebytes
[2009.07.14 20:18:18 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\Media Center Programs
[2012.02.08 00:24:31 | 000,000,000 | --SD | M] -- C:\Users\mmartini\AppData\Roaming\Microsoft
[2010.10.07 13:35:23 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\Mozilla
[2012.04.07 12:24:16 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\OpenOffice.org
[2010.09.24 11:42:44 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\Opera
[2011.02.06 18:36:51 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\PACE Anti-Piracy
[2010.09.24 03:21:52 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010.10.08 16:00:20 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\Thunderbird
[2010.10.11 23:57:20 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\TransMemory_Secure
[2012.02.08 00:40:42 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\vlc
[2011.02.06 17:28:39 | 000,000,000 | ---D | M] -- C:\Users\mmartini\AppData\Roaming\Xilisoft
 
< %APPDATA%\*.exe /s >
[2012.02.07 23:56:05 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\mmartini\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2010.09.22 01:33:34 | 000,010,134 | R--- | M] () -- C:\Users\mmartini\AppData\Roaming\Microsoft\Installer\{024521CF-C07E-4F8E-8481-0D75695E03AF}\ARPPRODUCTICON.exe
[2010.10.13 20:55:46 | 000,010,134 | R--- | M] () -- C:\Users\mmartini\AppData\Roaming\Microsoft\Installer\{20B1B020-DEAE-48D1-9960-D4C3185D758B}\Foren.exe
[2010.10.13 20:55:46 | 000,000,766 | R--- | M] () -- C:\Users\mmartini\AppData\Roaming\Microsoft\Installer\{20B1B020-DEAE-48D1-9960-D4C3185D758B}\htmledit.exe
[2007.11.28 16:48:34 | 001,679,360 | ---- | M] () -- C:\Users\mmartini\AppData\Roaming\TransMemory_Secure\TransMemory_Secure304.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2010.11.05 19:18:26 | 000,037,520 | ---- | M] (perl.org) MD5=2852D57385C4709EAAE2F9DB01AD3672 -- C:\Users\markus\Desktop\müll\xampp-win32-1.7.3\xampp\perl\site\lib\auto\Win32\EventLog\EventLog.dll
[2010.11.05 20:33:21 | 000,037,520 | ---- | M] (perl.org) MD5=2852D57385C4709EAAE2F9DB01AD3672 -- C:\Users\mmartini\Documents\gemeinsam\homepage\xampp-win32-1.7.3\xampp\perl\site\lib\auto\Win32\EventLog\EventLog.dll
[2009.12.20 01:00:00 | 000,037,520 | ---- | M] (perl.org) MD5=2852D57385C4709EAAE2F9DB01AD3672 -- C:\xampp\perl\site\lib\auto\Win32\EventLog\EventLog.dll
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<          >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 957 bytes -> C:\Users\mmartini\AppData\Local\gbsjslU2AwboDoj:cdxtRwpCuRPLqSnP1mw2I
< End of report >
--- --- ---

cosinus 21.04.2012 14:55
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
:OTL
[2012.04.15 17:34:33 | 000,000,168 | ---- | M] () -- C:\ProgramData\-XVtZQuIthVleLIr
[2012.04.15 17:34:33 | 000,000,000 | ---- | M] () -- C:\ProgramData\-XVtZQuIthVleLI
[2012.04.15 17:34:30 | 000,000,256 | ---- | M] () -- C:\ProgramData\XVtZQuIthVleLI
@Alternate Data Stream - 957 bytes -> C:\Users\mmartini\AppData\Local\gbsjslU2AwboDoj:cdxtRwpCuRPLqSnP1mw2I
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

name 21.04.2012 18:10
Danke für die Antwort! Irgendwas ist schief gegangen. otl fing an zu laufen und hörte gar nicht mehr auf. Ich habe den Rechner neu gestartet, habe otl erneut laufen lassen und nun der logfile:

Code:
All processes killed
========== OTL ==========
File C:\ProgramData\-XVtZQuIthVleLIr not found.
File C:\ProgramData\-XVtZQuIthVleLI not found.
File C:\ProgramData\XVtZQuIthVleLI not found.
Unable to delete ADS C:\Users\mmartini\AppData\Local\gbsjslU2AwboDoj:cdxtRwpCuRPLqSnP1mw2I .
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: markus
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: mmartini
->Temp folder emptied: 75633 bytes
->Temporary Internet Files folder emptied: 1524182 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 4561004559 bytes
 
Total Files Cleaned = 4.351,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: markus
->Flash cache emptied: 0 bytes
 
User: mmartini
->Flash cache emptied: 0 bytes
 
User: Public
 
User: UpdatusUser
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.39.2 log created on 04212012_185129
Files\Folders moved on Reboot...
C:\Users\mmartini\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
Registry entries deleted on Reboot...

cosinus 21.04.2012 18:15
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

name 21.04.2012 18:42
Danke für die schnelle Antwort. Hier nun das Ergebnis:
Code:
19:29:10.0834 3352 TDSS rootkit removing tool 2.7.31.0 Apr 20 2012 19:49:47
19:29:11.0154 3352 ============================================================
19:29:11.0154 3352 Current date / time: 2012/04/21 19:29:11.0154
19:29:11.0154 3352 SystemInfo:
19:29:11.0154 3352
19:29:11.0154 3352 OS Version: 6.1.7601 ServicePack: 1.0
19:29:11.0154 3352 Product type: Workstation
19:29:11.0154 3352 ComputerName: MMARTINI-PC
19:29:11.0154 3352 UserName: mmartini
19:29:11.0154 3352 Windows directory: C:\Windows
19:29:11.0154 3352 System windows directory: C:\Windows
19:29:11.0154 3352 Running under WOW64
19:29:11.0154 3352 Processor architecture: Intel x64
19:29:11.0154 3352 Number of processors: 4
19:29:11.0154 3352 Page size: 0x1000
19:29:11.0154 3352 Boot type: Normal boot
19:29:11.0154 3352 ============================================================
19:29:12.0184 3352 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0x38080, SectorsPerTrack: 0x13, TracksPerCylinder: 0xE0, Type 'K0', Flags 0x00000040
19:29:12.0194 3352 Drive \Device\Harddisk1\DR1 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
19:29:12.0194 3352 \Device\Harddisk0\DR0:
19:29:12.0194 3352 MBR partitions:
19:29:12.0194 3352 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
19:29:12.0194 3352 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x3A353000
19:29:12.0194 3352 \Device\Harddisk1\DR1:
19:29:12.0194 3352 MBR partitions:
19:29:12.0194 3352 \Device\Harddisk1\DR1\Partition0: MBR, Type 0xB, StartLBA 0x3F00, BlocksNum 0x74701AC1
19:29:12.0224 3352 C: <-> \Device\Harddisk0\DR0\Partition1
19:29:12.0224 3352 E: <-> \Device\Harddisk1\DR1\Partition0
19:29:12.0224 3352 Initialize success
19:29:12.0224 3352 ============================================================
19:29:48.0566 3112 ============================================================
19:29:48.0566 3112 Scan started
19:29:48.0566 3112 Mode: Manual;
19:29:48.0566 3112 ============================================================
19:29:49.0612 3112 1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
19:29:49.0612 3112 1394ohci - ok
19:29:49.0643 3112 ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
19:29:49.0643 3112 ACPI - ok
19:29:49.0690 3112 AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
19:29:49.0690 3112 AcpiPmi - ok
19:29:49.0752 3112 adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
19:29:49.0768 3112 adp94xx - ok
19:29:49.0783 3112 adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
19:29:49.0799 3112 adpahci - ok
19:29:49.0830 3112 adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
19:29:49.0830 3112 adpu320 - ok
19:29:49.0877 3112 AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
19:29:49.0877 3112 AeLookupSvc - ok
19:29:49.0955 3112 AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
19:29:49.0955 3112 AFD - ok
19:29:49.0970 3112 agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
19:29:49.0986 3112 agp440 - ok
19:29:50.0002 3112 ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
19:29:50.0002 3112 ALG - ok
19:29:50.0033 3112 aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
19:29:50.0033 3112 aliide - ok
19:29:50.0048 3112 amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
19:29:50.0048 3112 amdide - ok
19:29:50.0080 3112 AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
19:29:50.0080 3112 AmdK8 - ok
19:29:50.0111 3112 AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
19:29:50.0111 3112 AmdPPM - ok
19:29:50.0142 3112 amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
19:29:50.0142 3112 amdsata - ok
19:29:50.0158 3112 amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
19:29:50.0158 3112 amdsbs - ok
19:29:50.0189 3112 amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
19:29:50.0189 3112 amdxata - ok
19:29:50.0329 3112 AntiVirSchedulerService (c27d46b06d340293670450fce9dfb166) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
19:29:50.0329 3112 AntiVirSchedulerService - ok
19:29:50.0360 3112 AntiVirService  (72d90e56563165984224493069c69ed4) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
19:29:50.0376 3112 AntiVirService - ok
19:29:50.0423 3112 AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
19:29:50.0423 3112 AppID - ok
19:29:50.0470 3112 AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
19:29:50.0470 3112 AppIDSvc - ok
19:29:50.0501 3112 Appinfo        (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
19:29:50.0501 3112 Appinfo - ok
19:29:50.0532 3112 arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
19:29:50.0532 3112 arc - ok
19:29:50.0563 3112 arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
19:29:50.0563 3112 arcsas - ok
19:29:50.0657 3112 AsIO            (a82c01606dc27d05d9d3bfb6bb807e32) C:\Windows\syswow64\drivers\AsIO.sys
19:29:50.0657 3112 AsIO - ok
19:29:50.0735 3112 AsSysCtrlService (954ffbff05b0b60eb63b52af561436c4) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
19:29:50.0735 3112 AsSysCtrlService - ok
19:29:50.0813 3112 AsUpIO          (26d66e32e78d3059715b3a17bc679cd9) C:\Windows\syswow64\drivers\AsUpIO.sys
19:29:50.0813 3112 AsUpIO - ok
19:29:50.0828 3112 AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
19:29:50.0828 3112 AsyncMac - ok
19:29:50.0891 3112 atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
19:29:50.0891 3112 atapi - ok
19:29:50.0953 3112 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
19:29:50.0969 3112 AudioEndpointBuilder - ok
19:29:51.0000 3112 AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
19:29:51.0000 3112 AudioSrv - ok
19:29:51.0062 3112 avgntflt        (b1224e6b086cd6548315b04ab575a23e) C:\Windows\system32\DRIVERS\avgntflt.sys
19:29:51.0062 3112 avgntflt - ok
19:29:51.0078 3112 avipbb          (ed45f12cfa62b83765c9c1496758cc87) C:\Windows\system32\DRIVERS\avipbb.sys
19:29:51.0078 3112 avipbb - ok
19:29:51.0140 3112 avmaudio        (bd39d7cfd9d6a73396b618113a8e8d57) C:\Windows\system32\DRIVERS\avmaudio.sys
19:29:51.0140 3112 avmaudio - ok
19:29:51.0218 3112 AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
19:29:51.0218 3112 AxInstSV - ok
19:29:51.0265 3112 b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
19:29:51.0265 3112 b06bdrv - ok
19:29:51.0296 3112 b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
19:29:51.0296 3112 b57nd60a - ok
19:29:51.0374 3112 BCUService      (328e794278cc30ca7c06e346a18b1abc) C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
19:29:51.0390 3112 BCUService - ok
19:29:51.0406 3112 BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
19:29:51.0406 3112 BDESVC - ok
19:29:51.0437 3112 Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
19:29:51.0437 3112 Beep - ok
19:29:51.0515 3112 BFE            (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
19:29:51.0530 3112 BFE - ok
19:29:51.0562 3112 BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
19:29:51.0577 3112 BITS - ok
19:29:51.0593 3112 blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
19:29:51.0593 3112 blbdrive - ok
19:29:51.0640 3112 bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
19:29:51.0640 3112 bowser - ok
19:29:51.0655 3112 BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
19:29:51.0655 3112 BrFiltLo - ok
19:29:51.0671 3112 BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
19:29:51.0671 3112 BrFiltUp - ok
19:29:51.0718 3112 Browser        (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
19:29:51.0718 3112 Browser - ok
19:29:51.0733 3112 Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
19:29:51.0749 3112 Brserid - ok
19:29:51.0749 3112 BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
19:29:51.0749 3112 BrSerWdm - ok
19:29:51.0764 3112 BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
19:29:51.0764 3112 BrUsbMdm - ok
19:29:51.0780 3112 BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
19:29:51.0780 3112 BrUsbSer - ok
19:29:51.0780 3112 BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
19:29:51.0780 3112 BTHMODEM - ok
19:29:51.0796 3112 bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
19:29:51.0796 3112 bthserv - ok
19:29:51.0811 3112 cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
19:29:51.0811 3112 cdfs - ok
19:29:51.0874 3112 cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
19:29:51.0874 3112 cdrom - ok
19:29:51.0920 3112 CertPropSvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
19:29:51.0920 3112 CertPropSvc - ok
19:29:51.0952 3112 circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
19:29:51.0952 3112 circlass - ok
19:29:51.0983 3112 CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
19:29:51.0983 3112 CLFS - ok
19:29:52.0061 3112 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
19:29:52.0061 3112 clr_optimization_v2.0.50727_32 - ok
19:29:52.0076 3112 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
19:29:52.0076 3112 clr_optimization_v2.0.50727_64 - ok
19:29:52.0186 3112 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
19:29:52.0186 3112 clr_optimization_v4.0.30319_32 - ok
19:29:52.0232 3112 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
19:29:52.0248 3112 clr_optimization_v4.0.30319_64 - ok
19:29:52.0248 3112 CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
19:29:52.0248 3112 CmBatt - ok
19:29:52.0279 3112 cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
19:29:52.0279 3112 cmdide - ok
19:29:52.0342 3112 CNG            (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
19:29:52.0357 3112 CNG - ok
19:29:52.0388 3112 Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
19:29:52.0388 3112 Compbatt - ok
19:29:52.0466 3112 CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
19:29:52.0466 3112 CompositeBus - ok
19:29:52.0482 3112 COMSysApp - ok
19:29:52.0482 3112 crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
19:29:52.0498 3112 crcdisk - ok
19:29:52.0544 3112 CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
19:29:52.0544 3112 CryptSvc - ok
19:29:52.0607 3112 DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
19:29:52.0622 3112 DcomLaunch - ok
19:29:52.0654 3112 defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
19:29:52.0654 3112 defragsvc - ok
19:29:52.0685 3112 DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
19:29:52.0685 3112 DfsC - ok
19:29:52.0747 3112 dg_ssudbus      (388039f99ce8769024ee0438352aca99) C:\Windows\system32\DRIVERS\ssudbus.sys
19:29:52.0747 3112 dg_ssudbus - ok
19:29:52.0794 3112 Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
19:29:52.0794 3112 Dhcp - ok
19:29:52.0810 3112 discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
19:29:52.0825 3112 discache - ok
19:29:52.0872 3112 Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
19:29:52.0872 3112 Disk - ok
19:29:52.0919 3112 Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
19:29:52.0919 3112 Dnscache - ok
19:29:52.0981 3112 dot3svc        (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
19:29:52.0981 3112 dot3svc - ok
19:29:53.0028 3112 DPS            (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
19:29:53.0028 3112 DPS - ok
19:29:53.0075 3112 drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
19:29:53.0075 3112 drmkaud - ok
19:29:53.0184 3112 DvmMDES        (e5b95c75557120881076c45cd146d72c) C:\ASUS.SYS\config\DVMExportService.exe
19:29:53.0184 3112 DvmMDES - ok
19:29:53.0262 3112 DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
19:29:53.0278 3112 DXGKrnl - ok
19:29:53.0309 3112 EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
19:29:53.0309 3112 EapHost - ok
19:29:53.0402 3112 ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
19:29:53.0496 3112 ebdrv - ok
19:29:53.0543 3112 EFS            (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
19:29:53.0543 3112 EFS - ok
19:29:53.0590 3112 ehRecvr        (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
19:29:53.0605 3112 ehRecvr - ok
19:29:53.0652 3112 ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
19:29:53.0652 3112 ehSched - ok
19:29:53.0824 3112 elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
19:29:53.0839 3112 elxstor - ok
19:29:53.0886 3112 ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
19:29:53.0886 3112 ErrDev - ok
19:29:53.0933 3112 EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
19:29:53.0933 3112 EventSystem - ok
19:29:53.0948 3112 exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
19:29:53.0948 3112 exfat - ok
19:29:53.0995 3112 fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
19:29:53.0995 3112 fastfat - ok
19:29:54.0042 3112 Fax            (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
19:29:54.0058 3112 Fax - ok
19:29:54.0073 3112 fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
19:29:54.0073 3112 fdc - ok
19:29:54.0089 3112 fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
19:29:54.0089 3112 fdPHost - ok
19:29:54.0104 3112 FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
19:29:54.0104 3112 FDResPub - ok
19:29:54.0104 3112 FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
19:29:54.0120 3112 FileInfo - ok
19:29:54.0136 3112 Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
19:29:54.0136 3112 Filetrace - ok
19:29:54.0214 3112 FLEXnet Licensing Service (f76d04f7413b07daa029f6520b64b4e8) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
19:29:54.0229 3112 FLEXnet Licensing Service - ok
19:29:54.0245 3112 flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
19:29:54.0245 3112 flpydisk - ok
19:29:54.0292 3112 FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
19:29:54.0307 3112 FltMgr - ok
19:29:54.0370 3112 FontCache      (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
19:29:54.0401 3112 FontCache - ok
19:29:54.0479 3112 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
19:29:54.0479 3112 FontCache3.0.0.0 - ok
19:29:54.0510 3112 FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
19:29:54.0510 3112 FsDepends - ok
19:29:54.0541 3112 Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
19:29:54.0541 3112 Fs_Rec - ok
19:29:54.0604 3112 fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
19:29:54.0604 3112 fvevol - ok
19:29:54.0635 3112 gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
19:29:54.0635 3112 gagp30kx - ok
19:29:54.0697 3112 gpsvc          (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
19:29:54.0713 3112 gpsvc - ok
19:29:54.0728 3112 hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
19:29:54.0728 3112 hcw85cir - ok
19:29:54.0775 3112 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
19:29:54.0775 3112 HdAudAddService - ok
19:29:54.0822 3112 HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
19:29:54.0822 3112 HDAudBus - ok
19:29:54.0838 3112 HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
19:29:54.0853 3112 HidBatt - ok
19:29:54.0853 3112 HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
19:29:54.0853 3112 HidBth - ok
19:29:54.0869 3112 HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
19:29:54.0869 3112 HidIr - ok
19:29:54.0900 3112 hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
19:29:54.0900 3112 hidserv - ok
19:29:54.0916 3112 HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
19:29:54.0916 3112 HidUsb - ok
19:29:54.0947 3112 hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
19:29:54.0962 3112 hkmsvc - ok
19:29:55.0009 3112 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
19:29:55.0009 3112 HomeGroupListener - ok
19:29:55.0056 3112 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
19:29:55.0072 3112 HomeGroupProvider - ok
19:29:55.0087 3112 HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
19:29:55.0087 3112 HpSAMD - ok
19:29:55.0165 3112 HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
19:29:55.0181 3112 HTTP - ok
19:29:55.0228 3112 hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
19:29:55.0228 3112 hwpolicy - ok
19:29:55.0274 3112 i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
19:29:55.0290 3112 i8042prt - ok
19:29:55.0321 3112 iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
19:29:55.0321 3112 iaStorV - ok
19:29:55.0415 3112 idsvc          (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
19:29:55.0430 3112 idsvc - ok
19:29:55.0462 3112 iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
19:29:55.0462 3112 iirsp - ok
19:29:55.0571 3112 IJPLMSVC        (755519f49906b73c1fe9cbbf75e347ea) C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
19:29:55.0571 3112 IJPLMSVC - ok
19:29:55.0602 3112 IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
19:29:55.0618 3112 IKEEXT - ok
19:29:55.0633 3112 intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
19:29:55.0633 3112 intelide - ok
19:29:55.0649 3112 intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
19:29:55.0664 3112 intelppm - ok
19:29:55.0680 3112 IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
19:29:55.0680 3112 IPBusEnum - ok
19:29:55.0727 3112 IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
19:29:55.0727 3112 IpFilterDriver - ok
19:29:55.0789 3112 iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
19:29:55.0789 3112 iphlpsvc - ok
19:29:55.0836 3112 IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
19:29:55.0852 3112 IPMIDRV - ok
19:29:55.0852 3112 IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
19:29:55.0852 3112 IPNAT - ok
19:29:55.0883 3112 IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
19:29:55.0883 3112 IRENUM - ok
19:29:55.0898 3112 isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
19:29:55.0898 3112 isapnp - ok
19:29:55.0945 3112 iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
19:29:55.0945 3112 iScsiPrt - ok
19:29:55.0992 3112 kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
19:29:55.0992 3112 kbdclass - ok
19:29:56.0023 3112 kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
19:29:56.0023 3112 kbdhid - ok
19:29:56.0086 3112 KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
19:29:56.0086 3112 KeyIso - ok
19:29:56.0101 3112 KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
19:29:56.0101 3112 KSecDD - ok
19:29:56.0132 3112 KSecPkg        (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
19:29:56.0132 3112 KSecPkg - ok
19:29:56.0148 3112 ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
19:29:56.0148 3112 ksthunk - ok
19:29:56.0179 3112 KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
19:29:56.0179 3112 KtmRm - ok
19:29:56.0210 3112 LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
19:29:56.0210 3112 LanmanServer - ok
19:29:56.0257 3112 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
19:29:56.0257 3112 LanmanWorkstation - ok
19:29:56.0288 3112 lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
19:29:56.0288 3112 lltdio - ok
19:29:56.0320 3112 lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
19:29:56.0335 3112 lltdsvc - ok
19:29:56.0366 3112 lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
19:29:56.0366 3112 lmhosts - ok
19:29:56.0398 3112 LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
19:29:56.0398 3112 LSI_FC - ok
19:29:56.0429 3112 LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
19:29:56.0429 3112 LSI_SAS - ok
19:29:56.0444 3112 LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
19:29:56.0460 3112 LSI_SAS2 - ok
19:29:56.0476 3112 LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
19:29:56.0491 3112 LSI_SCSI - ok
19:29:56.0522 3112 luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
19:29:56.0522 3112 luafv - ok
19:29:56.0569 3112 Mcx2Svc        (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
19:29:56.0569 3112 Mcx2Svc - ok
19:29:56.0600 3112 megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
19:29:56.0600 3112 megasas - ok
19:29:56.0632 3112 MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
19:29:56.0647 3112 MegaSR - ok
19:29:56.0694 3112 MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
19:29:56.0694 3112 MMCSS - ok
19:29:56.0710 3112 Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
19:29:56.0710 3112 Modem - ok
19:29:56.0741 3112 monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
19:29:56.0756 3112 monitor - ok
19:29:56.0803 3112 mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
19:29:56.0803 3112 mouclass - ok
19:29:56.0819 3112 mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
19:29:56.0819 3112 mouhid - ok
19:29:56.0881 3112 mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
19:29:56.0881 3112 mountmgr - ok
19:29:56.0912 3112 mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
19:29:56.0912 3112 mpio - ok
19:29:56.0959 3112 mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
19:29:56.0959 3112 mpsdrv - ok
19:29:57.0022 3112 MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
19:29:57.0037 3112 MpsSvc - ok
19:29:57.0084 3112 MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
19:29:57.0084 3112 MRxDAV - ok
19:29:57.0131 3112 mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
19:29:57.0146 3112 mrxsmb - ok
19:29:57.0209 3112 mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
19:29:57.0209 3112 mrxsmb10 - ok
19:29:57.0224 3112 mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
19:29:57.0224 3112 mrxsmb20 - ok
19:29:57.0256 3112 msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
19:29:57.0256 3112 msahci - ok
19:29:57.0287 3112 msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
19:29:57.0287 3112 msdsm - ok
19:29:57.0334 3112 MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
19:29:57.0334 3112 MSDTC - ok
19:29:57.0380 3112 Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
19:29:57.0380 3112 Msfs - ok
19:29:57.0396 3112 mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
19:29:57.0396 3112 mshidkmdf - ok
19:29:57.0412 3112 msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
19:29:57.0412 3112 msisadrv - ok
19:29:57.0458 3112 MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
19:29:57.0458 3112 MSiSCSI - ok
19:29:57.0474 3112 msiserver - ok
19:29:57.0521 3112 MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
19:29:57.0521 3112 MSKSSRV - ok
19:29:57.0536 3112 MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
19:29:57.0536 3112 MSPCLOCK - ok
19:29:57.0552 3112 MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
19:29:57.0552 3112 MSPQM - ok
19:29:57.0599 3112 MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
19:29:57.0614 3112 MsRPC - ok
19:29:57.0630 3112 mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
19:29:57.0630 3112 mssmbios - ok
19:29:57.0646 3112 MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
19:29:57.0646 3112 MSTEE - ok
19:29:57.0646 3112 MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
19:29:57.0661 3112 MTConfig - ok
19:29:57.0692 3112 MTsensor        (19b006b181e3875fd254f7b67acf1e7c) C:\Windows\system32\DRIVERS\ASACPI.sys
19:29:57.0692 3112 MTsensor - ok
19:29:57.0724 3112 Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
19:29:57.0724 3112 Mup - ok
19:29:57.0770 3112 napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
19:29:57.0786 3112 napagent - ok
19:29:57.0833 3112 NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
19:29:57.0833 3112 NativeWifiP - ok
19:29:57.0895 3112 NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
19:29:57.0911 3112 NDIS - ok
19:29:57.0942 3112 NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
19:29:57.0942 3112 NdisCap - ok
19:29:57.0973 3112 NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
19:29:57.0989 3112 NdisTapi - ok
19:29:58.0020 3112 Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
19:29:58.0036 3112 Ndisuio - ok
19:29:58.0082 3112 NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
19:29:58.0082 3112 NdisWan - ok
19:29:58.0114 3112 NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
19:29:58.0114 3112 NDProxy - ok
19:29:58.0129 3112 NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
19:29:58.0145 3112 NetBIOS - ok
19:29:58.0192 3112 NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
19:29:58.0192 3112 NetBT - ok
19:29:58.0238 3112 Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
19:29:58.0238 3112 Netlogon - ok
19:29:58.0285 3112 Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
19:29:58.0301 3112 Netman - ok
19:29:58.0332 3112 netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
19:29:58.0348 3112 netprofm - ok
19:29:58.0426 3112 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
19:29:58.0441 3112 NetTcpPortSharing - ok
19:29:58.0488 3112 nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
19:29:58.0488 3112 nfrd960 - ok
19:29:58.0535 3112 NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
19:29:58.0535 3112 NlaSvc - ok
19:29:58.0550 3112 Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
19:29:58.0566 3112 Npfs - ok
19:29:58.0566 3112 nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
19:29:58.0566 3112 nsi - ok
19:29:58.0582 3112 nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
19:29:58.0582 3112 nsiproxy - ok
19:29:58.0675 3112 Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
19:29:58.0706 3112 Ntfs - ok
19:29:58.0738 3112 Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
19:29:58.0738 3112 Null - ok
19:29:58.0769 3112 NVENETFD        (a85b4f2ef3a7304a5399ef0526423040) C:\Windows\system32\DRIVERS\nvm62x64.sys
19:29:58.0769 3112 NVENETFD - ok
19:29:58.0847 3112 NVHDA          (cddd4478757288df4bb1494bfd084259) C:\Windows\system32\drivers\nvhda64v.sys
19:29:58.0847 3112 NVHDA - ok
19:29:59.0159 3112 nvlddmkm        (b34e9bfbd9c61048ef6281c3e7ec210a) C:\Windows\system32\DRIVERS\nvlddmkm.sys
19:29:59.0206 3112 nvlddmkm - ok
19:29:59.0221 3112 NVNET - ok
19:29:59.0268 3112 nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
19:29:59.0268 3112 nvraid - ok
19:29:59.0315 3112 nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
19:29:59.0315 3112 nvstor - ok
19:29:59.0362 3112 nvstor64        (1e45f96342429d63dc30e0d9117da3d8) C:\Windows\system32\DRIVERS\nvstor64.sys
19:29:59.0362 3112 nvstor64 - ok
19:29:59.0424 3112 nvsvc          (dfda089bb2cd0ff7e789e2ef6ba1e4ba) C:\Windows\system32\nvvsvc.exe
19:29:59.0440 3112 nvsvc - ok
19:29:59.0549 3112 nvUpdatusService (e7818cd4fb51284c948d68a7a85a69b8) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
19:29:59.0596 3112 nvUpdatusService - ok
19:29:59.0642 3112 nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
19:29:59.0642 3112 nv_agp - ok
19:29:59.0674 3112 ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
19:29:59.0674 3112 ohci1394 - ok
19:29:59.0736 3112 ose            (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
19:29:59.0736 3112 ose - ok
19:29:59.0892 3112 osppsvc        (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
19:29:59.0986 3112 osppsvc - ok
19:30:00.0032 3112 p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
19:30:00.0048 3112 p2pimsvc - ok
19:30:00.0079 3112 p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
19:30:00.0095 3112 p2psvc - ok
19:30:00.0126 3112 Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
19:30:00.0126 3112 Parport - ok
19:30:00.0173 3112 partmgr        (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
19:30:00.0173 3112 partmgr - ok
19:30:00.0204 3112 PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
19:30:00.0220 3112 PcaSvc - ok
19:30:00.0266 3112 pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
19:30:00.0282 3112 pci - ok
19:30:00.0282 3112 pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
19:30:00.0298 3112 pciide - ok
19:30:00.0313 3112 pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
19:30:00.0313 3112 pcmcia - ok
19:30:00.0344 3112 pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
19:30:00.0344 3112 pcw - ok
19:30:00.0376 3112 PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
19:30:00.0376 3112 PEAUTH - ok
19:30:00.0438 3112 PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
19:30:00.0438 3112 PerfHost - ok
19:30:00.0547 3112 pla            (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
19:30:00.0594 3112 pla - ok
19:30:00.0656 3112 PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
19:30:00.0656 3112 PlugPlay - ok
19:30:00.0688 3112 PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
19:30:00.0688 3112 PNRPAutoReg - ok
19:30:00.0719 3112 PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
19:30:00.0734 3112 PNRPsvc - ok
19:30:00.0766 3112 PolicyAgent    (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
19:30:00.0766 3112 PolicyAgent - ok
19:30:00.0797 3112 Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
19:30:00.0797 3112 Power - ok
19:30:00.0859 3112 PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
19:30:00.0859 3112 PptpMiniport - ok
19:30:00.0890 3112 Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
19:30:00.0890 3112 Processor - ok
19:30:00.0922 3112 ProfSvc        (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
19:30:00.0937 3112 ProfSvc - ok
19:30:00.0984 3112 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
19:30:00.0984 3112 ProtectedStorage - ok
19:30:01.0031 3112 Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
19:30:01.0031 3112 Psched - ok
19:30:01.0078 3112 PxHlpa64        (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys
19:30:01.0078 3112 PxHlpa64 - ok
19:30:01.0140 3112 ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
19:30:01.0171 3112 ql2300 - ok
19:30:01.0187 3112 ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
19:30:01.0187 3112 ql40xx - ok
19:30:01.0234 3112 QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
19:30:01.0234 3112 QWAVE - ok
19:30:01.0265 3112 QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
19:30:01.0265 3112 QWAVEdrv - ok
19:30:01.0296 3112 RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
19:30:01.0296 3112 RasAcd - ok
19:30:01.0327 3112 RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
19:30:01.0327 3112 RasAgileVpn - ok
19:30:01.0343 3112 RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
19:30:01.0358 3112 RasAuto - ok
19:30:01.0390 3112 Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
19:30:01.0405 3112 Rasl2tp - ok
19:30:01.0452 3112 RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
19:30:01.0468 3112 RasMan - ok
19:30:01.0483 3112 RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
19:30:01.0483 3112 RasPppoe - ok
19:30:01.0514 3112 RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
19:30:01.0514 3112 RasSstp - ok
19:30:01.0561 3112 rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
19:30:01.0561 3112 rdbss - ok
19:30:01.0592 3112 rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
19:30:01.0592 3112 rdpbus - ok
19:30:01.0592 3112 RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
19:30:01.0592 3112 RDPCDD - ok
19:30:01.0639 3112 RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
19:30:01.0639 3112 RDPENCDD - ok
19:30:01.0655 3112 RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
19:30:01.0655 3112 RDPREFMP - ok
19:30:01.0702 3112 RDPWD          (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys
19:30:01.0702 3112 RDPWD - ok
19:30:01.0780 3112 rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
19:30:01.0780 3112 rdyboost - ok
19:30:01.0811 3112 RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
19:30:01.0811 3112 RemoteAccess - ok
19:30:01.0842 3112 RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
19:30:01.0842 3112 RemoteRegistry - ok
19:30:01.0873 3112 RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
19:30:01.0889 3112 RpcEptMapper - ok
19:30:01.0920 3112 RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
19:30:01.0920 3112 RpcLocator - ok
19:30:01.0982 3112 RpcSs          (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
19:30:01.0982 3112 RpcSs - ok
19:30:02.0014 3112 rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
19:30:02.0014 3112 rspndr - ok
19:30:02.0060 3112 SamSs          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
19:30:02.0060 3112 SamSs - ok
19:30:02.0107 3112 sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
19:30:02.0107 3112 sbp2port - ok
19:30:02.0123 3112 SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
19:30:02.0123 3112 SCardSvr - ok
19:30:02.0170 3112 scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
19:30:02.0170 3112 scfilter - ok
19:30:02.0248 3112 Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
19:30:02.0263 3112 Schedule - ok
19:30:02.0310 3112 SCPolicySvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
19:30:02.0310 3112 SCPolicySvc - ok
19:30:02.0357 3112 SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
19:30:02.0372 3112 SDRSVC - ok
19:30:02.0404 3112 secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
19:30:02.0404 3112 secdrv - ok
19:30:02.0450 3112 seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
19:30:02.0450 3112 seclogon - ok
19:30:02.0466 3112 SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
19:30:02.0466 3112 SENS - ok
19:30:02.0497 3112 SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
19:30:02.0497 3112 SensrSvc - ok
19:30:02.0528 3112 Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
19:30:02.0528 3112 Serenum - ok
19:30:02.0560 3112 Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
19:30:02.0560 3112 Serial - ok
19:30:02.0575 3112 sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
19:30:02.0575 3112 sermouse - ok
19:30:02.0638 3112 SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
19:30:02.0638 3112 SessionEnv - ok
19:30:02.0700 3112 sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
19:30:02.0700 3112 sffdisk - ok
19:30:02.0716 3112 sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
19:30:02.0716 3112 sffp_mmc - ok
19:30:02.0731 3112 sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
19:30:02.0731 3112 sffp_sd - ok
19:30:02.0747 3112 sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
19:30:02.0747 3112 sfloppy - ok
19:30:02.0794 3112 SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
19:30:02.0794 3112 SharedAccess - ok
19:30:02.0856 3112 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
19:30:02.0856 3112 ShellHWDetection - ok
19:30:02.0903 3112 SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
19:30:02.0903 3112 SiSRaid2 - ok
19:30:02.0934 3112 SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
19:30:02.0934 3112 SiSRaid4 - ok
19:30:02.0950 3112 Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
19:30:02.0965 3112 Smb - ok
19:30:03.0012 3112 SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
19:30:03.0012 3112 SNMPTRAP - ok
19:30:03.0028 3112 spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
19:30:03.0043 3112 spldr - ok
19:30:03.0090 3112 Spooler        (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
19:30:03.0106 3112 Spooler - ok
19:30:03.0230 3112 sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
19:30:03.0308 3112 sppsvc - ok
19:30:03.0324 3112 sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
19:30:03.0324 3112 sppuinotify - ok
19:30:03.0340 3112 srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
19:30:03.0340 3112 srv - ok
19:30:03.0386 3112 srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
19:30:03.0402 3112 srv2 - ok
19:30:03.0418 3112 srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
19:30:03.0433 3112 srvnet - ok
19:30:03.0449 3112 SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
19:30:03.0464 3112 SSDPSRV - ok
19:30:03.0480 3112 SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
19:30:03.0480 3112 SstpSvc - ok
19:30:03.0542 3112 ssudmdm        (ad42ca614e086bcadbd53fffc404ac24) C:\Windows\system32\DRIVERS\ssudmdm.sys
19:30:03.0542 3112 ssudmdm - ok
19:30:03.0698 3112 Stereo Service  (a44c2e235ebc2e0d2bde07b5def2d42c) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
19:30:03.0698 3112 Stereo Service - ok
19:30:03.0745 3112 stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
19:30:03.0745 3112 stexstor - ok
19:30:03.0823 3112 stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
19:30:03.0823 3112 stisvc - ok
19:30:03.0886 3112 swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
19:30:03.0886 3112 swenum - ok
19:30:04.0026 3112 SwitchBoard    (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
19:30:04.0042 3112 SwitchBoard - ok
19:30:04.0088 3112 swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
19:30:04.0104 3112 swprv - ok
19:30:04.0182 3112 SysMain        (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
19:30:04.0229 3112 SysMain - ok
19:30:04.0276 3112 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
19:30:04.0291 3112 TabletInputService - ok
19:30:04.0338 3112 TapiSrv        (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
19:30:04.0338 3112 TapiSrv - ok
19:30:04.0354 3112 TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
19:30:04.0369 3112 TBS - ok
19:30:04.0447 3112 Tcpip          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
19:30:04.0494 3112 Tcpip - ok
19:30:04.0541 3112 TCPIP6          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
19:30:04.0556 3112 TCPIP6 - ok
19:30:04.0588 3112 tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
19:30:04.0588 3112 tcpipreg - ok
19:30:04.0634 3112 TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
19:30:04.0650 3112 TDPIPE - ok
19:30:04.0681 3112 TDTCP          (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
19:30:04.0681 3112 TDTCP - ok
19:30:04.0728 3112 tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
19:30:04.0744 3112 tdx - ok
19:30:04.0790 3112 TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
19:30:04.0790 3112 TermDD - ok
19:30:04.0837 3112 TermService    (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
19:30:04.0853 3112 TermService - ok
19:30:04.0868 3112 Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
19:30:04.0868 3112 Themes - ok
19:30:04.0900 3112 THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
19:30:04.0900 3112 THREADORDER - ok
19:30:04.0915 3112 TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
19:30:04.0915 3112 TrkWks - ok
19:30:04.0962 3112 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
19:30:04.0962 3112 TrustedInstaller - ok
19:30:05.0009 3112 tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
19:30:05.0009 3112 tssecsrv - ok
19:30:05.0087 3112 TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
19:30:05.0087 3112 TsUsbFlt - ok
19:30:05.0149 3112 tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
19:30:05.0149 3112 tunnel - ok
19:30:05.0165 3112 uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
19:30:05.0165 3112 uagp35 - ok
19:30:05.0212 3112 udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
19:30:05.0212 3112 udfs - ok
19:30:05.0243 3112 UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
19:30:05.0258 3112 UI0Detect - ok
19:30:05.0274 3112 uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
19:30:05.0274 3112 uliagpkx - ok
19:30:05.0321 3112 umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
19:30:05.0321 3112 umbus - ok
19:30:05.0336 3112 UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
19:30:05.0352 3112 UmPass - ok
19:30:05.0368 3112 upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
19:30:05.0383 3112 upnphost - ok
19:30:05.0399 3112 usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\drivers\usbccgp.sys
19:30:05.0399 3112 usbccgp - ok
19:30:05.0492 3112 usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
19:30:05.0492 3112 usbcir - ok
19:30:05.0524 3112 usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
19:30:05.0524 3112 usbehci - ok
19:30:05.0555 3112 usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
19:30:05.0555 3112 usbhub - ok
19:30:05.0570 3112 usbohci        (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys
19:30:05.0586 3112 usbohci - ok
19:30:05.0602 3112 usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
19:30:05.0602 3112 usbprint - ok
19:30:05.0664 3112 usbscan        (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
19:30:05.0664 3112 usbscan - ok
19:30:05.0695 3112 USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
19:30:05.0695 3112 USBSTOR - ok
19:30:05.0726 3112 usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
19:30:05.0726 3112 usbuhci - ok
19:30:05.0758 3112 UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
19:30:05.0758 3112 UxSms - ok
19:30:05.0804 3112 VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
19:30:05.0804 3112 VaultSvc - ok
19:30:05.0851 3112 vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
19:30:05.0851 3112 vdrvroot - ok
19:30:05.0914 3112 vds            (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
19:30:05.0929 3112 vds - ok
19:30:05.0960 3112 vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
19:30:05.0960 3112 vga - ok
19:30:05.0976 3112 VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
19:30:05.0976 3112 VgaSave - ok
19:30:06.0038 3112 vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
19:30:06.0038 3112 vhdmp - ok
19:30:06.0132 3112 VIAHdAudAddService (712bfd5dac2668fba4a2435fb06c3d00) C:\Windows\system32\drivers\viahduaa.sys
19:30:06.0179 3112 VIAHdAudAddService - ok
19:30:06.0194 3112 viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
19:30:06.0210 3112 viaide - ok
19:30:06.0226 3112 volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
19:30:06.0226 3112 volmgr - ok
19:30:06.0272 3112 volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
19:30:06.0288 3112 volmgrx - ok
19:30:06.0319 3112 volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
19:30:06.0319 3112 volsnap - ok
19:30:06.0366 3112 vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
19:30:06.0366 3112 vsmraid - ok
19:30:06.0460 3112 VSS            (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
19:30:06.0506 3112 VSS - ok
19:30:06.0522 3112 vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
19:30:06.0522 3112 vwifibus - ok
19:30:06.0569 3112 W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
19:30:06.0569 3112 W32Time - ok
19:30:06.0584 3112 WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
19:30:06.0584 3112 WacomPen - ok
19:30:06.0631 3112 WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
19:30:06.0631 3112 WANARP - ok
19:30:06.0631 3112 Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
19:30:06.0631 3112 Wanarpv6 - ok
19:30:06.0772 3112 WatAdminSvc    (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
19:30:06.0803 3112 WatAdminSvc - ok
19:30:06.0881 3112 wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
19:30:06.0943 3112 wbengine - ok
19:30:06.0959 3112 WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
19:30:06.0959 3112 WbioSrvc - ok
19:30:07.0006 3112 wcncsvc        (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
19:30:07.0021 3112 wcncsvc - ok
19:30:07.0037 3112 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
19:30:07.0037 3112 WcsPlugInService - ok
19:30:07.0068 3112 Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
19:30:07.0068 3112 Wd - ok
19:30:07.0115 3112 Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
19:30:07.0130 3112 Wdf01000 - ok
19:30:07.0146 3112 WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
19:30:07.0146 3112 WdiServiceHost - ok
19:30:07.0146 3112 WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
19:30:07.0146 3112 WdiSystemHost - ok
19:30:07.0208 3112 WebClient      (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
19:30:07.0208 3112 WebClient - ok
19:30:07.0240 3112 Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
19:30:07.0240 3112 Wecsvc - ok
19:30:07.0255 3112 wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
19:30:07.0271 3112 wercplsupport - ok
19:30:07.0302 3112 WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
19:30:07.0302 3112 WerSvc - ok
19:30:07.0349 3112 WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
19:30:07.0349 3112 WfpLwf - ok
19:30:07.0364 3112 WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
19:30:07.0364 3112 WIMMount - ok
19:30:07.0396 3112 WinDefend - ok
19:30:07.0411 3112 WinHttpAutoProxySvc - ok
19:30:07.0458 3112 Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
19:30:07.0474 3112 Winmgmt - ok
19:30:07.0552 3112 WinRM          (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
19:30:07.0614 3112 WinRM - ok
19:30:07.0692 3112 WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
19:30:07.0692 3112 WinUsb - ok
19:30:07.0723 3112 Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
19:30:07.0754 3112 Wlansvc - ok
19:30:07.0895 3112 wlidsvc        (7e47c328fc4768cb8beafbcfafa70362) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
19:30:07.0957 3112 wlidsvc - ok
19:30:07.0973 3112 WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
19:30:07.0973 3112 WmiAcpi - ok
19:30:08.0020 3112 wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
19:30:08.0035 3112 wmiApSrv - ok
19:30:08.0066 3112 WMPNetworkSvc - ok
19:30:08.0098 3112 WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
19:30:08.0098 3112 WPCSvc - ok
19:30:08.0144 3112 WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
19:30:08.0144 3112 WPDBusEnum - ok
19:30:08.0176 3112 ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
19:30:08.0191 3112 ws2ifsl - ok
19:30:08.0207 3112 wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
19:30:08.0222 3112 wscsvc - ok
19:30:08.0222 3112 WSearch - ok
19:30:08.0332 3112 wuauserv        (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
19:30:08.0378 3112 wuauserv - ok
19:30:08.0425 3112 WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys

name 21.04.2012 18:43
Der logfile war noch etwas länger. Darum hier der Rest:
Code:
19:30:08.0425 3112 WudfPf - ok
19:30:08.0503 3112 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
19:30:08.0503 3112 WUDFRd - ok
19:30:08.0550 3112 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
19:30:08.0550 3112 wudfsvc - ok
19:30:08.0581 3112 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
19:30:08.0597 3112 WwanSvc - ok
19:30:08.0612 3112 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
19:30:08.0690 3112 \Device\Harddisk0\DR0 - ok
19:30:08.0690 3112 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR1
19:30:08.0753 3112 \Device\Harddisk1\DR1 - ok
19:30:08.0753 3112 Boot (0x1200) (4f7a39fe2f0fe0b48ea06a075a2b16ca) \Device\Harddisk0\DR0\Partition0
19:30:08.0753 3112 \Device\Harddisk0\DR0\Partition0 - ok
19:30:08.0753 3112 Boot (0x1200) (26b37cdc3ec795dbd616a74f8e7028e8) \Device\Harddisk0\DR0\Partition1
19:30:08.0753 3112 \Device\Harddisk0\DR0\Partition1 - ok
19:30:08.0768 3112 Boot (0x1200) (efb7cbbb429f3fa74bc3e8994afbf29d) \Device\Harddisk1\DR1\Partition0
19:30:08.0768 3112 \Device\Harddisk1\DR1\Partition0 - ok
19:30:08.0768 3112 ============================================================
19:30:08.0768 3112 Scan finished
19:30:08.0768 3112 ============================================================
19:30:08.0768 0772 Detected object count: 0
19:30:08.0768 0772 Actual detected object count: 0
19:30:33.0635 4216 ============================================================
19:30:33.0635 4216 Scan started
19:30:33.0635 4216 Mode: Manual; SigCheck; TDLFS;
19:30:33.0635 4216 ============================================================
19:30:33.0962 4216 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
19:30:34.0056 4216 1394ohci - ok
19:30:34.0072 4216 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
19:30:34.0087 4216 ACPI - ok
19:30:34.0134 4216 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
19:30:34.0212 4216 AcpiPmi - ok
19:30:34.0243 4216 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
19:30:34.0274 4216 adp94xx - ok
19:30:34.0290 4216 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
19:30:34.0321 4216 adpahci - ok
19:30:34.0337 4216 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
19:30:34.0352 4216 adpu320 - ok
19:30:34.0384 4216 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
19:30:34.0524 4216 AeLookupSvc - ok
19:30:34.0571 4216 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
19:30:34.0680 4216 AFD - ok
19:30:34.0696 4216 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
19:30:34.0711 4216 agp440 - ok
19:30:34.0727 4216 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
19:30:34.0805 4216 ALG - ok
19:30:34.0836 4216 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
19:30:34.0852 4216 aliide - ok
19:30:34.0867 4216 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
19:30:34.0883 4216 amdide - ok
19:30:34.0898 4216 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
19:30:34.0976 4216 AmdK8 - ok
19:30:35.0008 4216 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
19:30:35.0054 4216 AmdPPM - ok
19:30:35.0070 4216 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
19:30:35.0101 4216 amdsata - ok
19:30:35.0132 4216 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
19:30:35.0148 4216 amdsbs - ok
19:30:35.0164 4216 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
19:30:35.0164 4216 amdxata - ok
19:30:35.0257 4216 AntiVirSchedulerService (c27d46b06d340293670450fce9dfb166) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
19:30:35.0288 4216 AntiVirSchedulerService - ok
19:30:35.0335 4216 AntiVirService (72d90e56563165984224493069c69ed4) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
19:30:35.0335 4216 AntiVirService - ok
19:30:35.0382 4216 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
19:30:35.0569 4216 AppID - ok
19:30:35.0600 4216 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
19:30:35.0632 4216 AppIDSvc - ok
19:30:35.0678 4216 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
19:30:35.0756 4216 Appinfo - ok
19:30:35.0788 4216 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
19:30:35.0788 4216 arc - ok
19:30:35.0803 4216 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
19:30:35.0819 4216 arcsas - ok
19:30:35.0897 4216 AsIO (a82c01606dc27d05d9d3bfb6bb807e32) C:\Windows\syswow64\drivers\AsIO.sys
19:30:35.0944 4216 AsIO - ok
19:30:36.0022 4216 AsSysCtrlService (954ffbff05b0b60eb63b52af561436c4) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
19:30:36.0053 4216 AsSysCtrlService - ok
19:30:36.0084 4216 AsUpIO (26d66e32e78d3059715b3a17bc679cd9) C:\Windows\syswow64\drivers\AsUpIO.sys
19:30:36.0100 4216 AsUpIO - ok
19:30:36.0115 4216 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
19:30:36.0193 4216 AsyncMac - ok
19:30:36.0240 4216 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
19:30:36.0271 4216 atapi - ok
19:30:36.0318 4216 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
19:30:36.0412 4216 AudioEndpointBuilder - ok
19:30:36.0443 4216 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
19:30:36.0458 4216 AudioSrv - ok
19:30:36.0505 4216 avgntflt (b1224e6b086cd6548315b04ab575a23e) C:\Windows\system32\DRIVERS\avgntflt.sys
19:30:36.0521 4216 avgntflt - ok
19:30:36.0552 4216 avipbb (ed45f12cfa62b83765c9c1496758cc87) C:\Windows\system32\DRIVERS\avipbb.sys
19:30:36.0552 4216 avipbb - ok
19:30:36.0599 4216 avmaudio (bd39d7cfd9d6a73396b618113a8e8d57) C:\Windows\system32\DRIVERS\avmaudio.sys
19:30:36.0630 4216 avmaudio - ok
19:30:36.0677 4216 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
19:30:36.0770 4216 AxInstSV - ok
19:30:36.0802 4216 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
19:30:36.0833 4216 b06bdrv - ok
19:30:36.0848 4216 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
19:30:36.0895 4216 b57nd60a - ok
19:30:36.0973 4216 BCUService (328e794278cc30ca7c06e346a18b1abc) C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
19:30:37.0004 4216 BCUService - ok
19:30:37.0020 4216 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
19:30:37.0051 4216 BDESVC - ok
19:30:37.0067 4216 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
19:30:37.0160 4216 Beep - ok
19:30:37.0223 4216 BFE (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
19:30:37.0285 4216 BFE - ok
19:30:37.0348 4216 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
19:30:37.0426 4216 BITS - ok
19:30:37.0441 4216 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
19:30:37.0472 4216 blbdrive - ok
19:30:37.0519 4216 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
19:30:37.0535 4216 bowser - ok
19:30:37.0566 4216 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
19:30:37.0644 4216 BrFiltLo - ok
19:30:37.0644 4216 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
19:30:37.0660 4216 BrFiltUp - ok
19:30:37.0706 4216 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
19:30:37.0800 4216 Browser - ok
19:30:37.0816 4216 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
19:30:37.0862 4216 Brserid - ok
19:30:37.0878 4216 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
19:30:37.0925 4216 BrSerWdm - ok
19:30:37.0925 4216 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
19:30:37.0956 4216 BrUsbMdm - ok
19:30:37.0972 4216 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
19:30:37.0972 4216 BrUsbSer - ok
19:30:37.0987 4216 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
19:30:37.0987 4216 BTHMODEM - ok
19:30:38.0018 4216 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
19:30:38.0096 4216 bthserv - ok
19:30:38.0128 4216 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
19:30:38.0143 4216 cdfs - ok
19:30:38.0174 4216 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
19:30:38.0221 4216 cdrom - ok
19:30:38.0284 4216 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
19:30:38.0330 4216 CertPropSvc - ok
19:30:38.0346 4216 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
19:30:38.0393 4216 circlass - ok
19:30:38.0424 4216 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
19:30:38.0440 4216 CLFS - ok
19:30:38.0518 4216 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
19:30:38.0549 4216 clr_optimization_v2.0.50727_32 - ok
19:30:38.0564 4216 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
19:30:38.0580 4216 clr_optimization_v2.0.50727_64 - ok
19:30:38.0642 4216 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
19:30:38.0658 4216 clr_optimization_v4.0.30319_32 - ok
19:30:38.0720 4216 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
19:30:38.0736 4216 clr_optimization_v4.0.30319_64 - ok
19:30:38.0752 4216 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
19:30:38.0767 4216 CmBatt - ok
19:30:38.0814 4216 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
19:30:38.0814 4216 cmdide - ok
19:30:38.0861 4216 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
19:30:38.0908 4216 CNG - ok
19:30:38.0923 4216 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
19:30:38.0939 4216 Compbatt - ok
19:30:38.0986 4216 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
19:30:39.0032 4216 CompositeBus - ok
19:30:39.0032 4216 COMSysApp - ok
19:30:39.0064 4216 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
19:30:39.0079 4216 crcdisk - ok
19:30:39.0126 4216 CryptSvc (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
19:30:39.0188 4216 CryptSvc - ok
19:30:39.0251 4216 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
19:30:39.0313 4216 DcomLaunch - ok
19:30:39.0344 4216 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
19:30:39.0376 4216 defragsvc - ok
19:30:39.0422 4216 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
19:30:39.0469 4216 DfsC - ok
19:30:39.0500 4216 dg_ssudbus (388039f99ce8769024ee0438352aca99) C:\Windows\system32\DRIVERS\ssudbus.sys
19:30:39.0516 4216 dg_ssudbus - ok
19:30:39.0547 4216 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
19:30:39.0594 4216 Dhcp - ok
19:30:39.0610 4216 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
19:30:39.0641 4216 discache - ok
19:30:39.0656 4216 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
19:30:39.0656 4216 Disk - ok
19:30:39.0703 4216 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
19:30:39.0797 4216 Dnscache - ok
19:30:39.0844 4216 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
19:30:39.0906 4216 dot3svc - ok
19:30:39.0953 4216 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
19:30:40.0015 4216 DPS - ok
19:30:40.0046 4216 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
19:30:40.0046 4216 drmkaud - ok
19:30:40.0140 4216 DvmMDES (e5b95c75557120881076c45cd146d72c) C:\ASUS.SYS\config\DVMExportService.exe
19:30:40.0156 4216 DvmMDES ( UnsignedFile.Multi.Generic ) - warning
19:30:40.0156 4216 DvmMDES - detected UnsignedFile.Multi.Generic (1)
19:30:40.0234 4216 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
19:30:40.0265 4216 DXGKrnl - ok
19:30:40.0296 4216 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
19:30:40.0327 4216 EapHost - ok
19:30:40.0421 4216 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
19:30:40.0452 4216 ebdrv - ok
19:30:40.0499 4216 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
19:30:40.0561 4216 EFS - ok
19:30:40.0592 4216 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
19:30:40.0639 4216 ehRecvr - ok
19:30:40.0686 4216 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
19:30:40.0733 4216 ehSched - ok
19:30:40.0764 4216 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
19:30:40.0780 4216 elxstor - ok
19:30:40.0811 4216 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
19:30:40.0858 4216 ErrDev - ok
19:30:40.0889 4216 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
19:30:40.0936 4216 EventSystem - ok
19:30:40.0936 4216 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
19:30:40.0967 4216 exfat - ok
19:30:40.0998 4216 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
19:30:41.0060 4216 fastfat - ok
19:30:41.0123 4216 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
19:30:41.0185 4216 Fax - ok
19:30:41.0201 4216 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
19:30:41.0248 4216 fdc - ok
19:30:41.0263 4216 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
19:30:41.0310 4216 fdPHost - ok
19:30:41.0326 4216 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
19:30:41.0388 4216 FDResPub - ok
19:30:41.0435 4216 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
19:30:41.0466 4216 FileInfo - ok
19:30:41.0466 4216 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
19:30:41.0513 4216 Filetrace - ok
19:30:41.0622 4216 FLEXnet Licensing Service (f76d04f7413b07daa029f6520b64b4e8) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
19:30:41.0716 4216 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - warning
19:30:41.0716 4216 FLEXnet Licensing Service - detected UnsignedFile.Multi.Generic (1)
19:30:41.0716 4216 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
19:30:41.0747 4216 flpydisk - ok
19:30:41.0809 4216 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
19:30:41.0840 4216 FltMgr - ok
19:30:41.0918 4216 FontCache (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
19:30:41.0981 4216 FontCache - ok
19:30:42.0043 4216 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
19:30:42.0059 4216 FontCache3.0.0.0 - ok
19:30:42.0090 4216 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
19:30:42.0090 4216 FsDepends - ok
19:30:42.0137 4216 Fs_Rec (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
19:30:42.0152 4216 Fs_Rec - ok
19:30:42.0199 4216 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
19:30:42.0215 4216 fvevol - ok
19:30:42.0230 4216 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
19:30:42.0246 4216 gagp30kx - ok
19:30:42.0293 4216 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
19:30:42.0355 4216 gpsvc - ok
19:30:42.0371 4216 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
19:30:42.0433 4216 hcw85cir - ok
19:30:42.0496 4216 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
19:30:42.0542 4216 HdAudAddService - ok
19:30:42.0558 4216 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
19:30:42.0589 4216 HDAudBus - ok
19:30:42.0605 4216 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
19:30:42.0620 4216 HidBatt - ok
19:30:42.0620 4216 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
19:30:42.0636 4216 HidBth - ok
19:30:42.0652 4216 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
19:30:42.0683 4216 HidIr - ok
19:30:42.0714 4216 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
19:30:42.0792 4216 hidserv - ok
19:30:42.0808 4216 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
19:30:42.0823 4216 HidUsb - ok
19:30:42.0854 4216 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
19:30:42.0917 4216 hkmsvc - ok
19:30:42.0964 4216 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
19:30:43.0010 4216 HomeGroupListener - ok
19:30:43.0057 4216 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
19:30:43.0104 4216 HomeGroupProvider - ok
19:30:43.0120 4216 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
19:30:43.0135 4216 HpSAMD - ok
19:30:43.0198 4216 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
19:30:43.0276 4216 HTTP - ok
19:30:43.0307 4216 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
19:30:43.0338 4216 hwpolicy - ok
19:30:43.0354 4216 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
19:30:43.0369 4216 i8042prt - ok
19:30:43.0385 4216 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
19:30:43.0400 4216 iaStorV - ok
19:30:43.0525 4216 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
19:30:43.0556 4216 idsvc - ok
19:30:43.0603 4216 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
19:30:43.0634 4216 iirsp - ok
19:30:43.0728 4216 IJPLMSVC (755519f49906b73c1fe9cbbf75e347ea) C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
19:30:43.0759 4216 IJPLMSVC - ok
19:30:43.0822 4216 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
19:30:43.0884 4216 IKEEXT - ok
19:30:43.0900 4216 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
19:30:43.0915 4216 intelide - ok
19:30:43.0931 4216 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
19:30:43.0946 4216 intelppm - ok
19:30:43.0978 4216 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
19:30:44.0040 4216 IPBusEnum - ok
19:30:44.0087 4216 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
19:30:44.0149 4216 IpFilterDriver - ok
19:30:44.0212 4216 iphlpsvc (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
19:30:44.0290 4216 iphlpsvc - ok
19:30:44.0305 4216 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
19:30:44.0321 4216 IPMIDRV - ok
19:30:44.0321 4216 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
19:30:44.0383 4216 IPNAT - ok
19:30:44.0399 4216 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
19:30:44.0477 4216 IRENUM - ok
19:30:44.0492 4216 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
19:30:44.0508 4216 isapnp - ok
19:30:44.0539 4216 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
19:30:44.0555 4216 iScsiPrt - ok
19:30:44.0570 4216 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
19:30:44.0586 4216 kbdclass - ok
19:30:44.0602 4216 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
19:30:44.0633 4216 kbdhid - ok
19:30:44.0680 4216 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
19:30:44.0711 4216 KeyIso - ok
19:30:44.0726 4216 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
19:30:44.0742 4216 KSecDD - ok
19:30:44.0758 4216 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
19:30:44.0773 4216 KSecPkg - ok
19:30:44.0789 4216 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
19:30:44.0836 4216 ksthunk - ok
19:30:44.0867 4216 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
19:30:44.0929 4216 KtmRm - ok
19:30:44.0960 4216 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
19:30:45.0023 4216 LanmanServer - ok
19:30:45.0070 4216 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
19:30:45.0148 4216 LanmanWorkstation - ok
19:30:45.0179 4216 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
19:30:45.0241 4216 lltdio - ok
19:30:45.0272 4216 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
19:30:45.0335 4216 lltdsvc - ok
19:30:45.0350 4216 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
19:30:45.0382 4216 lmhosts - ok
19:30:45.0397 4216 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
19:30:45.0413 4216 LSI_FC - ok
19:30:45.0428 4216 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
19:30:45.0444 4216 LSI_SAS - ok
19:30:45.0460 4216 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
19:30:45.0460 4216 LSI_SAS2 - ok
19:30:45.0491 4216 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
19:30:45.0491 4216 LSI_SCSI - ok
19:30:45.0522 4216 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
19:30:45.0553 4216 luafv - ok
19:30:45.0584 4216 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
19:30:45.0631 4216 Mcx2Svc - ok
19:30:45.0662 4216 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
19:30:45.0678 4216 megasas - ok
19:30:45.0709 4216 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
19:30:45.0725 4216 MegaSR - ok
19:30:45.0756 4216 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
19:30:45.0834 4216 MMCSS - ok
19:30:45.0850 4216 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
19:30:45.0881 4216 Modem - ok
19:30:45.0896 4216 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
19:30:45.0928 4216 monitor - ok
19:30:45.0959 4216 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
19:30:45.0990 4216 mouclass - ok
19:30:46.0006 4216 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
19:30:46.0021 4216 mouhid - ok
19:30:46.0068 4216 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
19:30:46.0068 4216 mountmgr - ok
19:30:46.0115 4216 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
19:30:46.0130 4216 mpio - ok
19:30:46.0146 4216 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
19:30:46.0193 4216 mpsdrv - ok
19:30:46.0255 4216 MpsSvc (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
19:30:46.0302 4216 MpsSvc - ok
19:30:46.0349 4216 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
19:30:46.0364 4216 MRxDAV - ok
19:30:46.0396 4216 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
19:30:46.0458 4216 mrxsmb - ok
19:30:46.0505 4216 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
19:30:46.0552 4216 mrxsmb10 - ok
19:30:46.0567 4216 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
19:30:46.0583 4216 mrxsmb20 - ok
19:30:46.0630 4216 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
19:30:46.0661 4216 msahci - ok
19:30:46.0692 4216 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
19:30:46.0723 4216 msdsm - ok
19:30:46.0754 4216 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
19:30:46.0801 4216 MSDTC - ok
19:30:46.0832 4216 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
19:30:46.0879 4216 Msfs - ok
19:30:46.0879 4216 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
19:30:46.0910 4216 mshidkmdf - ok
19:30:46.0957 4216 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
19:30:46.0988 4216 msisadrv - ok
19:30:47.0020 4216 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
19:30:47.0098 4216 MSiSCSI - ok
19:30:47.0098 4216 msiserver - ok
19:30:47.0113 4216 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
19:30:47.0144 4216 MSKSSRV - ok
19:30:47.0160 4216 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
19:30:47.0207 4216 MSPCLOCK - ok
19:30:47.0207 4216 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
19:30:47.0254 4216 MSPQM - ok
19:30:47.0300 4216 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
19:30:47.0347 4216 MsRPC - ok
19:30:47.0363 4216 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
19:30:47.0363 4216 mssmbios - ok
19:30:47.0378 4216 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
19:30:47.0425 4216 MSTEE - ok
19:30:47.0425 4216 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
19:30:47.0441 4216 MTConfig - ok
19:30:47.0456 4216 MTsensor (19b006b181e3875fd254f7b67acf1e7c) C:\Windows\system32\DRIVERS\ASACPI.sys
19:30:47.0488 4216 MTsensor - ok
19:30:47.0503 4216 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
19:30:47.0519 4216 Mup - ok
19:30:47.0581 4216 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
19:30:47.0628 4216 napagent - ok
19:30:47.0644 4216 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
19:30:47.0675 4216 NativeWifiP - ok
19:30:47.0706 4216 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
19:30:47.0722 4216 NDIS - ok
19:30:47.0737 4216 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
19:30:47.0768 4216 NdisCap - ok
19:30:47.0784 4216 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
19:30:47.0815 4216 NdisTapi - ok
19:30:47.0846 4216 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
19:30:47.0909 4216 Ndisuio - ok
19:30:47.0956 4216 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
19:30:48.0018 4216 NdisWan - ok
19:30:48.0034 4216 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
19:30:48.0096 4216 NDProxy - ok
19:30:48.0127 4216 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
19:30:48.0174 4216 NetBIOS - ok
19:30:48.0205 4216 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
19:30:48.0268 4216 NetBT - ok
19:30:48.0314 4216 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
19:30:48.0346 4216 Netlogon - ok
19:30:48.0377 4216 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
19:30:48.0470 4216 Netman - ok
19:30:48.0486 4216 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
19:30:48.0533 4216 netprofm - ok
19:30:48.0642 4216 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
19:30:48.0658 4216 NetTcpPortSharing - ok
19:30:48.0673 4216 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
19:30:48.0689 4216 nfrd960 - ok
19:30:48.0736 4216 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
19:30:48.0814 4216 NlaSvc - ok
19:30:48.0829 4216 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
19:30:48.0860 4216 Npfs - ok
19:30:48.0892 4216 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
19:30:48.0954 4216 nsi - ok
19:30:48.0970 4216 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
19:30:49.0001 4216 nsiproxy - ok
19:30:49.0079 4216 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
19:30:49.0126 4216 Ntfs - ok
19:30:49.0141 4216 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
19:30:49.0219 4216 Null - ok
19:30:49.0266 4216 NVENETFD (a85b4f2ef3a7304a5399ef0526423040) C:\Windows\system32\DRIVERS\nvm62x64.sys
19:30:49.0313 4216 NVENETFD - ok
19:30:49.0344 4216 NVHDA (cddd4478757288df4bb1494bfd084259) C:\Windows\system32\drivers\nvhda64v.sys
19:30:49.0375 4216 NVHDA - ok
19:30:49.0656 4216 nvlddmkm (b34e9bfbd9c61048ef6281c3e7ec210a) C:\Windows\system32\DRIVERS\nvlddmkm.sys
19:30:49.0812 4216 nvlddmkm - ok
19:30:49.0812 4216 NVNET - ok
19:30:49.0859 4216 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
19:30:49.0874 4216 nvraid - ok
19:30:49.0906 4216 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
19:30:49.0937 4216 nvstor - ok
19:30:49.0968 4216 nvstor64 (1e45f96342429d63dc30e0d9117da3d8) C:\Windows\system32\DRIVERS\nvstor64.sys
19:30:49.0984 4216 nvstor64 - ok
19:30:50.0046 4216 nvsvc (dfda089bb2cd0ff7e789e2ef6ba1e4ba) C:\Windows\system32\nvvsvc.exe
19:30:50.0077 4216 nvsvc - ok
19:30:50.0186 4216 nvUpdatusService (e7818cd4fb51284c948d68a7a85a69b8) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
19:30:50.0233 4216 nvUpdatusService - ok
19:30:50.0249 4216 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
19:30:50.0264 4216 nv_agp - ok
19:30:50.0311 4216 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
19:30:50.0342 4216 ohci1394 - ok
19:30:50.0374 4216 ose (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
19:30:50.0389 4216 ose - ok
19:30:50.0530 4216 osppsvc (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
19:30:50.0592 4216 osppsvc - ok
19:30:50.0623 4216 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
19:30:50.0670 4216 p2pimsvc - ok
19:30:50.0701 4216 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
19:30:50.0717 4216 p2psvc - ok
19:30:50.0748 4216 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
19:30:50.0779 4216 Parport - ok
19:30:50.0826 4216 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
19:30:50.0857 4216 partmgr - ok
19:30:50.0873 4216 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
19:30:50.0904 4216 PcaSvc - ok
19:30:50.0951 4216 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
19:30:50.0982 4216 pci - ok
19:30:50.0982 4216 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
19:30:50.0998 4216 pciide - ok
19:30:51.0013 4216 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
19:30:51.0029 4216 pcmcia - ok
19:30:51.0044 4216 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
19:30:51.0060 4216 pcw - ok
19:30:51.0076 4216 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
19:30:51.0122 4216 PEAUTH - ok
19:30:51.0169 4216 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
19:30:51.0216 4216 PerfHost - ok
19:30:51.0310 4216 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
19:30:51.0388 4216 pla - ok
19:30:51.0466 4216 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
19:30:51.0497 4216 PlugPlay - ok
19:30:51.0544 4216 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
19:30:51.0575 4216 PNRPAutoReg - ok
19:30:51.0622 4216 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
19:30:51.0653 4216 PNRPsvc - ok
19:30:51.0684 4216 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
19:30:51.0746 4216 PolicyAgent - ok
19:30:51.0793 4216 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
19:30:51.0871 4216 Power - ok
19:30:51.0918 4216 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
19:30:51.0996 4216 PptpMiniport - ok
19:30:52.0027 4216 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
19:30:52.0027 4216 Processor - ok
19:30:52.0058 4216 ProfSvc (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
19:30:52.0090 4216 ProfSvc - ok
19:30:52.0152 4216 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
19:30:52.0168 4216 ProtectedStorage - ok
19:30:52.0230 4216 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
19:30:52.0261 4216 Psched - ok
19:30:52.0308 4216 PxHlpa64 (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys
19:30:52.0324 4216 PxHlpa64 - ok
19:30:52.0402 4216 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
19:30:52.0433 4216 ql2300 - ok
19:30:52.0448 4216 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
19:30:52.0464 4216 ql40xx - ok
19:30:52.0480 4216 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
19:30:52.0495 4216 QWAVE - ok
19:30:52.0511 4216 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
19:30:52.0511 4216 QWAVEdrv - ok
19:30:52.0526 4216 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
19:30:52.0558 4216 RasAcd - ok
19:30:52.0573 4216 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
19:30:52.0604 4216 RasAgileVpn - ok
19:30:52.0604 4216 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
19:30:52.0651 4216 RasAuto - ok
19:30:52.0698 4216 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
19:30:52.0760 4216 Rasl2tp - ok
19:30:52.0792 4216 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
19:30:52.0854 4216 RasMan - ok
19:30:52.0870 4216 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
19:30:52.0885 4216 RasPppoe - ok
19:30:52.0916 4216 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
19:30:52.0948 4216 RasSstp - ok
19:30:52.0994 4216 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
19:30:53.0057 4216 rdbss - ok
19:30:53.0072 4216 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
19:30:53.0088 4216 rdpbus - ok
19:30:53.0119 4216 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
19:30:53.0135 4216 RDPCDD - ok
19:30:53.0150 4216 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
19:30:53.0182 4216 RDPENCDD - ok
19:30:53.0197 4216 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
19:30:53.0213 4216 RDPREFMP - ok
19:30:53.0260 4216 RDPWD (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys
19:30:53.0322 4216 RDPWD - ok
19:30:53.0369 4216 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
19:30:53.0400 4216 rdyboost - ok
19:30:53.0447 4216 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
19:30:53.0494 4216 RemoteAccess - ok
19:30:53.0525 4216 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
19:30:53.0587 4216 RemoteRegistry - ok
19:30:53.0603 4216 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
19:30:53.0650 4216 RpcEptMapper - ok
19:30:53.0696 4216 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
19:30:53.0728 4216 RpcLocator - ok
19:30:53.0790 4216 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
19:30:53.0837 4216 RpcSs - ok
19:30:53.0868 4216 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
19:30:53.0899 4216 rspndr - ok
19:30:53.0946 4216 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
19:30:53.0977 4216 SamSs - ok
19:30:54.0024 4216 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
19:30:54.0040 4216 sbp2port - ok
19:30:54.0055 4216 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
19:30:54.0133 4216 SCardSvr - ok
19:30:54.0180 4216 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
19:30:54.0242 4216 scfilter - ok
19:30:54.0305 4216 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
19:30:54.0383 4216 Schedule - ok
19:30:54.0414 4216 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
19:30:54.0430 4216 SCPolicySvc - ok
19:30:54.0476 4216 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
19:30:54.0523 4216 SDRSVC - ok
19:30:54.0570 4216 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
19:30:54.0648 4216 secdrv - ok
19:30:54.0695 4216 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
19:30:54.0757 4216 seclogon - ok
19:30:54.0773 4216 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
19:30:54.0804 4216 SENS - ok
19:30:54.0820 4216 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
19:30:54.0835 4216 SensrSvc - ok
19:30:54.0866 4216 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
19:30:54.0866 4216 Serenum - ok
19:30:54.0882 4216 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
19:30:54.0929 4216 Serial - ok
19:30:54.0976 4216 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
19:30:55.0007 4216 sermouse - ok
19:30:55.0069 4216 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
19:30:55.0147 4216 SessionEnv - ok
19:30:55.0194 4216 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
19:30:55.0241 4216 sffdisk - ok
19:30:55.0241 4216 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
19:30:55.0272 4216 sffp_mmc - ok
19:30:55.0288 4216 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
19:30:55.0319 4216 sffp_sd - ok
19:30:55.0350 4216 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
19:30:55.0397 4216 sfloppy - ok
19:30:55.0428 4216 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
19:30:55.0522 4216 SharedAccess - ok
19:30:55.0568 4216 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
19:30:55.0615 4216 ShellHWDetection - ok
19:30:55.0646 4216 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
19:30:55.0646 4216 SiSRaid2 - ok
19:30:55.0662 4216 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
19:30:55.0678 4216 SiSRaid4 - ok
19:30:55.0693 4216 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
19:30:55.0771 4216 Smb - ok
19:30:55.0818 4216 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
19:30:55.0849 4216 SNMPTRAP - ok
19:30:55.0865 4216 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
19:30:55.0880 4216 spldr - ok
19:30:55.0943 4216 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
19:30:55.0990 4216 Spooler - ok
19:30:56.0114 4216 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
19:30:56.0177 4216 sppsvc - ok
19:30:56.0192 4216 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
19:30:56.0224 4216 sppuinotify - ok
19:30:56.0286 4216 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
19:30:56.0333 4216 srv - ok
19:30:56.0380 4216 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
19:30:56.0411 4216 srv2 - ok
19:30:56.0442 4216 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
19:30:56.0473 4216 srvnet - ok
19:30:56.0504 4216 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
19:30:56.0582 4216 SSDPSRV - ok
19:30:56.0598 4216 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
19:30:56.0629 4216 SstpSvc - ok
19:30:56.0676 4216 ssudmdm (ad42ca614e086bcadbd53fffc404ac24) C:\Windows\system32\DRIVERS\ssudmdm.sys
19:30:56.0692 4216 ssudmdm - ok
19:30:56.0801 4216 Stereo Service (a44c2e235ebc2e0d2bde07b5def2d42c) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
19:30:56.0832 4216 Stereo Service - ok
19:30:56.0863 4216 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
19:30:56.0894 4216 stexstor - ok
19:30:56.0957 4216 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
19:30:56.0988 4216 stisvc - ok
19:30:57.0035 4216 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
19:30:57.0050 4216 swenum - ok
19:30:57.0206 4216 SwitchBoard (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
19:30:57.0238 4216 SwitchBoard ( UnsignedFile.Multi.Generic ) - warning
19:30:57.0238 4216 SwitchBoard - detected UnsignedFile.Multi.Generic (1)
19:30:57.0269 4216 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
19:30:57.0316 4216 swprv - ok
19:30:57.0409 4216 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
19:30:57.0456 4216 SysMain - ok
19:30:57.0487 4216 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
19:30:57.0518 4216 TabletInputService - ok
19:30:57.0565 4216 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
19:30:57.0612 4216 TapiSrv - ok
19:30:57.0643 4216 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
19:30:57.0690 4216 TBS - ok
19:30:57.0784 4216 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
19:30:57.0815 4216 Tcpip - ok
19:30:57.0862 4216 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
19:30:57.0893 4216 TCPIP6 - ok
19:30:57.0924 4216 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
19:30:57.0986 4216 tcpipreg - ok
19:30:58.0033 4216 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
19:30:58.0049 4216 TDPIPE - ok
19:30:58.0096 4216 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
19:30:58.0127 4216 TDTCP - ok
19:30:58.0174 4216 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
19:30:58.0220 4216 tdx - ok
19:30:58.0267 4216 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
19:30:58.0298 4216 TermDD - ok
19:30:58.0345 4216 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
19:30:58.0408 4216 TermService - ok
19:30:58.0423 4216 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
19:30:58.0439 4216 Themes - ok
19:30:58.0470 4216 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
19:30:58.0486 4216 THREADORDER - ok
19:30:58.0501 4216 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
19:30:58.0532 4216 TrkWks - ok
19:30:58.0610 4216 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
19:30:58.0673 4216 TrustedInstaller - ok
19:30:58.0720 4216 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
19:30:58.0766 4216 tssecsrv - ok
19:30:58.0798 4216 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
19:30:58.0860 4216 TsUsbFlt - ok
19:30:58.0907 4216 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
19:30:58.0969 4216 tunnel - ok
19:30:59.0000 4216 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
19:30:59.0000 4216 uagp35 - ok
19:30:59.0047 4216 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
19:30:59.0110 4216 udfs - ok
19:30:59.0156 4216 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
19:30:59.0188 4216 UI0Detect - ok
19:30:59.0234 4216 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
19:30:59.0266 4216 uliagpkx - ok
19:30:59.0312 4216 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
19:30:59.0344 4216 umbus - ok
19:30:59.0359 4216 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
19:30:59.0375 4216 UmPass - ok
19:30:59.0406 4216 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
19:30:59.0468 4216 upnphost - ok
19:30:59.0484 4216 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\drivers\usbccgp.sys
19:30:59.0515 4216 usbccgp - ok
19:30:59.0562 4216 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
19:30:59.0593 4216 usbcir - ok
19:30:59.0609 4216 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
19:30:59.0624 4216 usbehci - ok
19:30:59.0656 4216 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
19:30:59.0671 4216 usbhub - ok
19:30:59.0702 4216 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys
19:30:59.0718 4216 usbohci - ok
19:30:59.0734 4216 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
19:30:59.0749 4216 usbprint - ok
19:30:59.0796 4216 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
19:30:59.0827 4216 usbscan - ok
19:30:59.0858 4216 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
19:30:59.0874 4216 USBSTOR - ok
19:30:59.0905 4216 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
19:30:59.0936 4216 usbuhci - ok
19:30:59.0952 4216 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
19:30:59.0999 4216 UxSms - ok
19:31:00.0061 4216 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
19:31:00.0077 4216 VaultSvc - ok
19:31:00.0092 4216 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
19:31:00.0108 4216 vdrvroot - ok
19:31:00.0155 4216 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
19:31:00.0233 4216 vds - ok
19:31:00.0264 4216 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
19:31:00.0264 4216 vga - ok
19:31:00.0280 4216 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
19:31:00.0311 4216 VgaSave - ok
19:31:00.0358 4216 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
19:31:00.0358 4216 vhdmp - ok
19:31:00.0436 4216 VIAHdAudAddService (712bfd5dac2668fba4a2435fb06c3d00) C:\Windows\system32\drivers\viahduaa.sys
19:31:00.0498 4216 VIAHdAudAddService - ok
19:31:00.0529 4216 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
19:31:00.0529 4216 viaide - ok
19:31:00.0576 4216 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
19:31:00.0607 4216 volmgr - ok
19:31:00.0654 4216 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
19:31:00.0670 4216 volmgrx - ok
19:31:00.0701 4216 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
19:31:00.0716 4216 volsnap - ok
19:31:00.0732 4216 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
19:31:00.0748 4216 vsmraid - ok
19:31:00.0826 4216 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
19:31:00.0888 4216 VSS - ok
19:31:00.0904 4216 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
19:31:00.0935 4216 vwifibus - ok
19:31:00.0982 4216 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
19:31:01.0028 4216 W32Time - ok
19:31:01.0044 4216 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
19:31:01.0060 4216 WacomPen - ok
19:31:01.0075 4216 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
19:31:01.0122 4216 WANARP - ok
19:31:01.0122 4216 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
19:31:01.0153 4216 Wanarpv6 - ok
19:31:01.0231 4216 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
19:31:01.0262 4216 WatAdminSvc - ok
19:31:01.0340 4216 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
19:31:01.0387 4216 wbengine - ok
19:31:01.0418 4216 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
19:31:01.0434 4216 WbioSrvc - ok
19:31:01.0481 4216 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
19:31:01.0512 4216 wcncsvc - ok
19:31:01.0543 4216 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
19:31:01.0574 4216 WcsPlugInService - ok
19:31:01.0590 4216 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
19:31:01.0606 4216 Wd - ok
19:31:01.0637 4216 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
19:31:01.0652 4216 Wdf01000 - ok
19:31:01.0668 4216 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
19:31:01.0762 4216 WdiServiceHost - ok
19:31:01.0777 4216 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
19:31:01.0793 4216 WdiSystemHost - ok
19:31:01.0840 4216 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
19:31:01.0902 4216 WebClient - ok
19:31:01.0918 4216 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
19:31:01.0964 4216 Wecsvc - ok
19:31:01.0996 4216 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
19:31:02.0027 4216 wercplsupport - ok
19:31:02.0042 4216 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
19:31:02.0089 4216 WerSvc - ok
19:31:02.0105 4216 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
19:31:02.0120 4216 WfpLwf - ok
19:31:02.0152 4216 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
19:31:02.0152 4216 WIMMount - ok
19:31:02.0167 4216 WinDefend - ok
19:31:02.0183 4216 WinHttpAutoProxySvc - ok
19:31:02.0230 4216 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
19:31:02.0292 4216 Winmgmt - ok
19:31:02.0370 4216 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
19:31:02.0432 4216 WinRM - ok
19:31:02.0479 4216 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
19:31:02.0526 4216 WinUsb - ok
19:31:02.0557 4216 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
19:31:02.0604 4216 Wlansvc - ok
19:31:02.0729 4216 wlidsvc (7e47c328fc4768cb8beafbcfafa70362) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
19:31:02.0776 4216 wlidsvc - ok
19:31:02.0791 4216 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
19:31:02.0791 4216 WmiAcpi - ok
19:31:02.0822 4216 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
19:31:02.0854 4216 wmiApSrv - ok
19:31:02.0854 4216 WMPNetworkSvc - ok
19:31:02.0869 4216 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
19:31:02.0900 4216 WPCSvc - ok
19:31:02.0932 4216 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
19:31:02.0963 4216 WPDBusEnum - ok
19:31:02.0994 4216 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
19:31:03.0056 4216 ws2ifsl - ok
19:31:03.0072 4216 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
19:31:03.0088 4216 wscsvc - ok
19:31:03.0103 4216 WSearch - ok
19:31:03.0181 4216 wuauserv (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
19:31:03.0244 4216 wuauserv - ok
19:31:03.0290 4216 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
19:31:03.0337 4216 WudfPf - ok
19:31:03.0368 4216 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
19:31:03.0446 4216 WUDFRd - ok
19:31:03.0478 4216 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
19:31:03.0540 4216 wudfsvc - ok
19:31:03.0556 4216 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
19:31:03.0571 4216 WwanSvc - ok
19:31:03.0587 4216 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
19:31:03.0727 4216 \Device\Harddisk0\DR0 - ok
19:31:03.0727 4216 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR1
19:31:03.0914 4216 \Device\Harddisk1\DR1 - ok
19:31:03.0914 4216 Boot (0x1200) (4f7a39fe2f0fe0b48ea06a075a2b16ca) \Device\Harddisk0\DR0\Partition0
19:31:03.0914 4216 \Device\Harddisk0\DR0\Partition0 - ok
19:31:03.0946 4216 Boot (0x1200) (26b37cdc3ec795dbd616a74f8e7028e8) \Device\Harddisk0\DR0\Partition1
19:31:03.0946 4216 \Device\Harddisk0\DR0\Partition1 - ok
19:31:03.0946 4216 Boot (0x1200) (efb7cbbb429f3fa74bc3e8994afbf29d) \Device\Harddisk1\DR1\Partition0
19:31:03.0946 4216 \Device\Harddisk1\DR1\Partition0 - ok
19:31:03.0946 4216 ============================================================
19:31:03.0946 4216 Scan finished
19:31:03.0946 4216 ============================================================
19:31:03.0992 2376 Detected object count: 3
19:31:03.0992 2376 Actual detected object count: 3
19:33:25.0672 2376 C:\ASUS.SYS\config\DVMExportService.exe - copied to quarantine
19:33:25.0672 2376 HKLM\SYSTEM\ControlSet001\services\DvmMDES - will be deleted on reboot
19:33:25.0703 2376 HKLM\SYSTEM\ControlSet002\services\DvmMDES - will be deleted on reboot
19:33:25.0859 2376 C:\ASUS.SYS\config\DVMExportService.exe - will be deleted on reboot
19:33:25.0859 2376 DvmMDES ( UnsignedFile.Multi.Generic ) - User select action: Delete
19:33:25.0968 2376 C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe - copied to quarantine
19:33:25.0968 2376 HKLM\SYSTEM\ControlSet001\services\FLEXnet Licensing Service - will be deleted on reboot
19:33:25.0968 2376 HKLM\SYSTEM\ControlSet002\services\FLEXnet Licensing Service - will be deleted on reboot
19:33:25.0984 2376 C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe - will be deleted on reboot
19:33:25.0984 2376 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Delete
19:33:26.0124 2376 C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe - copied to quarantine
19:33:26.0124 2376 HKLM\SYSTEM\ControlSet001\services\SwitchBoard - will be deleted on reboot
19:33:26.0124 2376 HKLM\SYSTEM\ControlSet002\services\SwitchBoard - will be deleted on reboot
19:33:26.0140 2376 C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe - will be deleted on reboot
19:33:26.0140 2376 SwitchBoard ( UnsignedFile.Multi.Generic ) - User select action: Delete
19:33:33.0050 3676 Deinitialize success

cosinus 21.04.2012 20:48
Schön, dass du meinen wichtigen Hinweis nicht beachtet hast, denn lt Log hast du alles was der TDSS-Killer gefunden hat auch gelöscht! :stirn:

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

name 21.04.2012 21:20
Dumm gelaufen :-(
Ich hatte probleme, weil der tdss hängengeblieben ist. Als ich tds wieder zum laufen gebracht hatte, habe ich aus Versehen auf löschen gedrückt. Kann die Sache noch in ordnung gebracht werden?

cosinus 21.04.2012 22:54
Ich hab bisher keine Wiederherstellungsfunktion beim TDSS-Killer gefunden. Deswegen hab ich ja auch immer diesen fetten Hinweis drin, dass ja nichts ohne Absprache gelöscht werden soll!

Merkst du irgendwelche Fehlfunktionen? Du hast mit dem Tool das hier alles gelöscht

Zitat:
9:33:25.0672 2376 C:\ASUS.SYS\config\DVMExportService.exe - copied to quarantine
19:33:25.0672 2376 HKLM\SYSTEM\ControlSet001\services\DvmMDES - will be deleted on reboot
19:33:25.0703 2376 HKLM\SYSTEM\ControlSet002\services\DvmMDES - will be deleted on reboot
19:33:25.0859 2376 C:\ASUS.SYS\config\DVMExportService.exe - will be deleted on reboot
19:33:25.0859 2376 DvmMDES ( UnsignedFile.Multi.Generic ) - User select action: Delete
19:33:25.0968 2376 C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe - copied to quarantine
19:33:25.0968 2376 HKLM\SYSTEM\ControlSet001\services\FLEXnet Licensing Service - will be deleted on reboot
19:33:25.0968 2376 HKLM\SYSTEM\ControlSet002\services\FLEXnet Licensing Service - will be deleted on reboot
19:33:25.0984 2376 C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe - will be deleted on reboot
19:33:25.0984 2376 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Delete
19:33:26.0124 2376 C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe - copied to quarantine
19:33:26.0124 2376 HKLM\SYSTEM\ControlSet001\services\SwitchBoard - will be deleted on reboot
19:33:26.0124 2376 HKLM\SYSTEM\ControlSet002\services\SwitchBoard - will be deleted on reboot
19:33:26.0140 2376 C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe - will be deleted on reboot
19:33:26.0140 2376 SwitchBoard ( UnsignedFile.Multi.Generic ) - User select action: Delete
Da scheint was von ASUS (wohl Mainboard => Chipsatz) sowie Flexnet => Lizenzserver und etwas von Adobe betroffen zu sein

name 21.04.2012 23:00
Bisher läuft alles prima. Ich habe mal alle meine Dateien auf eine Externe Festplatte übertragen, damit ich den Rechner neu aufsetzen kann.

Wie riskant wäre es wenn ich die Dateien auf der externen Festplatte wieder einspiele?

cosinus 21.04.2012 23:15
Gut, dass du alle Daten gesichert hast, führ mal bitte CF aus, eine Neuinstallation könnten wir vllt noch verhindern

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

name 22.04.2012 00:25
Hi zu später Stunde und auf ein neues:
Combofix Logfile:
Code:
ComboFix 12-04-20.03 - mmartini 22.04.2012  1:03.1.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.8191.6653 [GMT 2:00]
ausgeführt von:: c:\users\mmartini\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\1&1
c:\programdata\1&1\1&1 SmartFax\Settings.xml
c:\users\markus\AppData\Roaming\1&1
c:\users\markus\AppData\Roaming\1&1\1&1 SmartFax\FaxNumberHistory.xml
c:\users\markus\AppData\Roaming\1&1\1&1 SmartFax\Settings.xml
c:\users\mmartini\AppData\Roaming\1&1
c:\users\mmartini\AppData\Roaming\1&1\1&1 SmartFax\FaxNumberHistory.xml
c:\users\mmartini\AppData\Roaming\1&1\1&1 SmartFax\Settings.xml
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-03-21 bis 2012-04-21  ))))))))))))))))))))))))))))))
.
.
2012-04-21 23:09 . 2012-04-21 23:09 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-04-21 23:09 . 2012-04-21 23:09 -------- d-----w- c:\users\markus\AppData\Local\temp
2012-04-21 23:09 . 2012-04-21 23:09 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-04-21 17:33 . 2012-04-21 17:33 -------- d-----w- C:\TDSSKiller_Quarantine
2012-04-21 14:24 . 2012-04-21 14:24 -------- d-----w- C:\_OTL
2012-04-20 17:26 . 2012-04-20 17:26 -------- d-----w- c:\users\markus\AppData\Roaming\Avira
2012-04-17 19:20 . 2012-04-17 19:20 -------- d-----w- c:\program files (x86)\ESET
2012-04-15 19:05 . 2012-04-15 19:05 -------- d-----w- c:\users\mmartini\AppData\Roaming\Malwarebytes
2012-04-15 19:05 . 2012-04-15 19:05 -------- d-----w- c:\programdata\Malwarebytes
2012-04-15 19:05 . 2012-04-15 19:05 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-04-15 19:05 . 2012-04-04 13:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-15 18:59 . 2012-04-15 18:59 -------- d-----w- c:\users\mmartini\AppData\Roaming\Avira
2012-04-12 21:55 . 2012-03-06 06:53 5559152 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-04-12 21:55 . 2012-03-06 05:59 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-04-12 21:55 . 2012-03-06 05:59 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-04-12 21:54 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-04-12 21:54 . 2012-03-01 06:38 220672 ----a-w- c:\windows\system32\wintrust.dll
2012-04-12 21:54 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll
2012-04-12 21:54 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
2012-04-12 21:54 . 2012-03-01 05:37 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
2012-04-12 21:54 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
2012-04-12 21:54 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
2012-04-07 13:26 . 2012-04-07 13:26 -------- d-----w- c:\users\markus\AppData\Local\Apple
2012-04-07 10:48 . 2012-04-07 10:48 -------- d-----w- c:\users\markus\AppData\Roaming\OpenOffice.org
2012-04-07 10:24 . 2012-04-07 10:24 -------- d-----w- c:\users\mmartini\AppData\Roaming\OpenOffice.org
2012-04-07 10:20 . 2012-04-07 10:20 -------- d-----w- c:\program files (x86)\OpenOffice.org 3
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-06 19:29 . 2012-03-06 19:29 2300696 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2012-03-06 19:29 . 2012-03-06 19:29 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2012-03-06 19:29 . 2012-03-06 19:29 1236816 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2012-02-17 06:38 . 2012-03-14 19:58 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-02-17 05:34 . 2012-03-14 19:58 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-02-17 04:58 . 2012-03-14 19:58 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-02-17 04:57 . 2012-03-14 19:58 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-02-14 10:09 . 2012-02-14 10:09 1070352 ----a-w- c:\windows\SysWow64\MSCOMCTL.OCX
2012-02-10 06:36 . 2012-03-14 19:59 1544192 ----a-w- c:\windows\system32\DWrite.dll
2012-02-10 05:38 . 2012-03-14 19:59 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-02-07 22:27 . 2012-02-07 22:27 2300696 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2012-02-07 22:26 . 2012-02-07 22:26 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2012-02-07 22:26 . 2012-02-07 22:26 1236816 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2012-02-03 04:34 . 2012-03-14 19:59 3145728 ----a-w- c:\windows\system32\win32k.sys
2012-01-25 06:38 . 2012-03-14 19:58 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-01-25 06:38 . 2012-03-14 19:58 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-01-25 06:33 . 2012-03-14 19:58 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeBridge"="c:\program files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe" [2011-06-09 12002664]
"AVMUSBFernanschluss"="c:\users\mmartini\AppData\Local\Apps\2.0\RBWWQPYX.NHH\GOOD6XGC.9EW\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\AVMAutoStart.exe" [2011-08-01 147456]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2010-02-10 2770432]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-22 402432]
"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2011-09-07 40376]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2010-09-22 640440]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-29 937920]
"BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [2010-03-05 411864]
"Cpu Level Up help"="c:\program files (x86)\ASUS\AI Suite\CpuLevelUpHelp.exe" [2009-12-28 887936]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-09-08 421888]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
c:\users\mmartini\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Mozilla Thunderbird.lnk - c:\program files (x86)\Mozilla Thunderbird\thunderbird.exe [2010-10-8 12584112]
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ    kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys [x]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [2009-12-28 96896]
S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2010-03-05 235752]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-21 2214504]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-03-10 240232]
S3 avmaudio;AVM Audio;c:\windows\system32\DRIVERS\avmaudio.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"CanonSolutionMenu"="c:\program files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-11 689488]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-12-05 170496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.splashtop.com/asusexpressgate/mb/searchAPI.php?SE=yahoo&QS=http%3A%2F%2Fde.search.yahoo.com%2Fsearch%3Ffr%3Dfp-devicevm%26type%3DWEB01
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Download with Xilisoft Download YouTube Video - c:\program files (x86)\Xilisoft\Download YouTube Video\upod_link.HTM
IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\mmartini\AppData\Roaming\Mozilla\Firefox\Profiles\m2gane3a.default\
FF - prefs.js: browser.search.selectedEngine - Amazon.de
FF - prefs.js: browser.startup.homepage - hxxp://typo3.p117137.mittwaldserver.info/typo3/index.php|hxxp://www.1-liga.de/typo3/index.php|hxxp://www.auf-pfoten.de/home.html|hxxp://www.traum-projekt.com/forum/112-typo3/75384-typo3-formularfelder-und-css.html|hxxp://typo3.org/documentation/document-library/extension-manuals/powermail/1.5.3/view/1/12/|hxxp://www.heilbronn-seo.de/optimierung-oder-gleich-ein-neues-design/|hxxp://www.profi-ranking.de/suchmaschinenoptimierung/keyword-recherche/|hxxp://www.brave-hunde.de/pagerank.html|hxxp://siteexplorer.search.yahoo.com/de/siteexplorer/search?p=http%3A%2F%2Fwww.brave-hunde.de&bwm=i&bwmf=u&bwms=p&fr=yfp-t-708&fr2=seo-rd-se
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}
FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com
FF - Ext: WebRank Toolbar: webrank-toolbar@probcomp.com - %profile%\extensions\webrank-toolbar@probcomp.com
FF - Ext: Adobe Contribute Toolbar: {01A8CA0A-4C96-465b-A49B-65C46FAD54F9} - c:\program files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-SwitchBoard - c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
SafeBoot-82233398.sys
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Canon\IJPLM\IJPLMSVC.EXE
c:\program files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-04-22  01:17:11 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-04-21 23:17
.
Vor Suchlauf: 20 Verzeichnis(se), 358.467.903.488 Bytes frei
Nach Suchlauf: 25 Verzeichnis(se), 360.785.281.024 Bytes frei
.
- - End Of File - - B5B268ABB51CC1544F86CC858F18FD16
--- --- ---


bis morgen ...

cosinus 22.04.2012 00:36
Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

name 22.04.2012 10:08
Liste der Anhänge anzeigen (Anzahl: 1)
Avast läuft leider nicht richtig (Fehlermeldung im Anhang).

Was kann ich tun?

cosinus 22.04.2012 18:56
Deswegen hatte ich ganz unten noch einen Hinweis gepostet:

Zitat:
Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

name 22.04.2012 19:15
:stirn:
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-04-22 20:10:53
-----------------------------
20:10:53.989    OS Version: Windows x64 6.1.7601 Service Pack 1
20:10:53.989    Number of processors: 4 586 0x403
20:10:54.005    ComputerName: MMARTINI-PC  UserName: mmartini
20:10:56.298    Initialize success
20:11:00.214    AVAST engine defs: 12042200
20:12:49.594    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005d
20:12:49.610    Disk 0 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 3
20:12:49.626    Disk 0 MBR read successfully
20:12:49.626    Disk 0 MBR scan
20:12:49.641    Disk 0 Windows 7 default MBR code
20:12:49.641    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
20:12:49.657    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      476838 MB offset 206848
20:12:49.688    Disk 0 scanning C:\Windows\system32\drivers
20:12:59.220    Service scanning
20:13:18.158    Modules scanning
20:13:18.158    Disk 0 trace - called modules:
20:13:18.189    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll nvstor64.sys
20:13:18.189    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007a2e060]
20:13:18.205    3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa8006aebe40]
20:13:18.205    5 ACPI.sys[fffff88000ed17a1] -> nt!IofCallDriver -> \Device\0000005d[0xfffffa8006ae9060]
20:13:18.220    Scan finished successfully
20:14:02.056    Disk 0 MBR has been saved successfully to "C:\Users\mmartini\Desktop\MBR.dat"
20:14:02.072    The log file has been saved successfully to "C:\Users\mmartini\Desktop\aswMBR.txt"

cosinus 22.04.2012 20:05
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

name 24.04.2012 16:02
Leider habe ich wider was gefunden:
Code:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org
Datenbank Version: v2012.04.22.04
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
mmartini :: MMARTINI-PC [Administrator]
22.04.2012 21:32:40
mbam-log-2012-04-22 (21-32-40).txt
Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 1516969
Laufzeit: 2 Stunde(n), 46 Minute(n), 2 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)
(Ende)
Code:
SUPERAntiSpyware Scan Log
SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!
Generated 04/24/2012 at 00:38 AM
Application Version : 5.0.1146
Core Rules Database Version : 8494
Trace Rules Database Version: 6306
Scan type      : Complete Scan
Total Scan Time : 06:07:05
Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User
Memory items scanned      : 532
Memory threats detected  : 0
Registry items scanned    : 69955
Registry threats detected : 0
File items scanned        : 1858710
File threats detected    : 204
Adware.Tracking Cookie
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\mmartini@tracking.hostgator[1].txt [ /tracking.hostgator ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\9M4M9JUR.txt [ /zanox.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\6VDKZB5L.txt [ /amazon-adsystem.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\ZDBOE4CK.txt [ /revsci.net ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\80D35FG6.txt [ /kontera.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\HSFBMWO9.txt [ /auslieferung.commindo-media-ressourcen.de ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\NUYWFCRR.txt [ /imrworldwide.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\X911VFF4.txt [ /ad.yieldmanager.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\ZAZRA05G.txt [ /apmebf.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\L2CVVWDO.txt [ /teufel-media.de ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\V0SMGKX6.txt [ /traffictrack.de ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\1954C3TC.txt [ /adfarm1.adition.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\6M9W59XB.txt [ /ad1.adfarm1.adition.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\L3INSWQ5.txt [ /mediaplex.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\HYOU5H61.txt [ /webmasterplan.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\MMZBNTBA.txt [ /invitemedia.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\E4JDTHHM.txt [ /ad2.adfarm1.adition.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\V39CR3QN.txt [ /track.adform.net ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\OG2XXLHX.txt [ /doubleclick.net ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\UF87N31I.txt [ /adtech.de ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\6IJBJIRX.txt [ /tradedoubler.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\2IAF596L.txt [ /zanox-affiliate.de ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\5WM662LI.txt [ /xiti.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\9T2B9O9G.txt [ /ads.pubmatic.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\DSA4KYEK.txt [ /ad3.adfarm1.adition.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\6GS0VX97.txt [ /serving-sys.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\APIBSXV5.txt [ /www.zanox-affiliate.de ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\JH7P4WC6.txt [ /bs.serving-sys.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\AMZE5TFT.txt [ /eset-online-scanner.softonic.de ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\7AXADA9H.txt [ /smartadserver.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\2HKAT4ME.txt [ /tracking.mlsat02.de ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\XBI9FP9N.txt [ /adform.net ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\RZO2IZKA.txt [ /ww251.smartadserver.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\ZHWT5OOK.txt [ /ad4.adfarm1.adition.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\N0GQ5I49.txt [ /de.sitestat.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\NL0NLTFE.txt [ /tracking.quisma.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\TSLCL6C2.txt [ /atdmt.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\AG9PX4DU.txt [ /adx.chip.de ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\YPC2D8JX.txt [ /dyntracker.com ]
 C:\Users\mmartini\AppData\Roaming\Microsoft\Windows\Cookies\SPHNOVYO.txt [ /collective-media.net ]
 C:\USERS\MARKUS\AppData\Roaming\Microsoft\Windows\Cookies\Low\C3GV8KZP.txt [ Cookie:markus@google.de/ads/ ]
 C:\USERS\MARKUS\AppData\Roaming\Microsoft\Windows\Cookies\Low\43X7X3HT.txt [ Cookie:markus@www.google.de/accounts ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\BKSZ4EKB.txt [ Cookie:mmartini@zanox.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\PR0JLA3J.txt [ Cookie:mmartini@revsci.net/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@adserver1.mokono[1].txt [ Cookie:mmartini@adserver1.mokono.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\EWADM3C2.txt [ Cookie:mmartini@weborama.fr/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@imrworldwide[2].txt [ Cookie:mmartini@imrworldwide.com/cgi-bin ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\LHDOT7FM.txt [ Cookie:mmartini@ad.yieldmanager.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@im.banner.t-online[1].txt [ Cookie:mmartini@im.banner.t-online.de/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\3VTCJXSU.txt [ Cookie:mmartini@bouyguestelecom.solution.weborama.fr/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\TJEG7DPW.txt [ Cookie:mmartini@questionmarket.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@webstats.pewl[1].txt [ Cookie:mmartini@webstats.pewl.de/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\7PNU3YIE.txt [ Cookie:mmartini@ad1.adfarm1.adition.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@stats.yeebase[1].txt [ Cookie:mmartini@stats.yeebase.com/piwik/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\B5Z4MFKH.txt [ Cookie:mmartini@ad.piximedia.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\URJ16Q4W.txt [ Cookie:mmartini@ad2.adfarm1.adition.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\1SSOXM67.txt [ Cookie:mmartini@track.adform.net/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@eas.apm.emediate[2].txt [ Cookie:mmartini@eas.apm.emediate.eu/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\KQI7KORP.txt [ Cookie:mmartini@doubleclick.net/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@autoscout24.112.2o7[1].txt [ Cookie:mmartini@autoscout24.112.2o7.net/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\MU4L9MUC.txt [ Cookie:mmartini@tribalfusion.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@adserver02.profiwerber[1].txt [ Cookie:mmartini@adserver02.profiwerber.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@usenext[1].txt [ Cookie:mmartini@usenext.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@content.yieldmanager[1].txt [ Cookie:mmartini@content.yieldmanager.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@adtech[1].txt [ Cookie:mmartini@adtech.de/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\BQL9OABL.txt [ Cookie:mmartini@tradedoubler.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\GREOIJ5I.txt [ Cookie:mmartini@statse.webtrendslive.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\RAZY094D.txt [ Cookie:mmartini@zanox-affiliate.de/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@stats.anonym-surfen[1].txt [ Cookie:mmartini@stats.anonym-surfen.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\KXYXCIE3.txt [ Cookie:mmartini@serving-sys.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\7317R07A.txt [ Cookie:mmartini@www.zanox-affiliate.de/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@bs.serving-sys[2].txt [ Cookie:mmartini@bs.serving-sys.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@stats.united-domains[2].txt [ Cookie:mmartini@stats.united-domains.de/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\SMH4NAOW.txt [ Cookie:mmartini@smartadserver.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@specificclick[2].txt [ Cookie:mmartini@specificclick.net/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\VHQTF8WK.txt [ Cookie:mmartini@tracking.mlsat02.de/tmobile/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@ad4.adfarm1.adition[1].txt [ Cookie:mmartini@ad4.adfarm1.adition.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@de.sitestat[1].txt [ Cookie:mmartini@de.sitestat.com/idgcom-de/pcwelt/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\KNX1ECK8.txt [ Cookie:mmartini@tracking.quisma.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@adserver5.bannerwerbung[1].txt [ Cookie:mmartini@adserver5.bannerwerbung.net/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\IF2VONAE.txt [ Cookie:mmartini@atdmt.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\X0CI6OJL.txt [ Cookie:mmartini@google.com/accounts/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\22B7IZ24.txt [ Cookie:mmartini@amazon-adsystem.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\H23HODGN.txt [ Cookie:mmartini@kontera.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\mmartini@myhammer.122.2o7[1].txt [ Cookie:mmartini@myhammer.122.2o7.net/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\IWCUHJY1.txt [ Cookie:mmartini@yieldmanager.net/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\SRHG12BI.txt [ Cookie:mmartini@microsoftsto.112.2o7.net/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZX3S6711.txt [ Cookie:mmartini@advertising.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\6UV1G00B.txt [ Cookie:mmartini@dyntracker.com/ ]
 C:\USERS\MMARTINI\AppData\Roaming\Microsoft\Windows\Cookies\Low\UTJYK5U6.txt [ Cookie:mmartini@adform.net/ ]
 C:\USERS\MMARTINI\Cookies\9M4M9JUR.txt [ Cookie:mmartini@zanox.com/ ]
 C:\USERS\MMARTINI\Cookies\6VDKZB5L.txt [ Cookie:mmartini@amazon-adsystem.com/ ]
 C:\USERS\MMARTINI\Cookies\ZDBOE4CK.txt [ Cookie:mmartini@revsci.net/ ]
 C:\USERS\MMARTINI\Cookies\80D35FG6.txt [ Cookie:mmartini@kontera.com/ ]
 C:\USERS\MMARTINI\Cookies\NUYWFCRR.txt [ Cookie:mmartini@imrworldwide.com/cgi-bin ]
 C:\USERS\MMARTINI\Cookies\X911VFF4.txt [ Cookie:mmartini@ad.yieldmanager.com/ ]
 C:\USERS\MMARTINI\Cookies\L2CVVWDO.txt [ Cookie:mmartini@teufel-media.de/ ]
 C:\USERS\MMARTINI\Cookies\6M9W59XB.txt [ Cookie:mmartini@ad1.adfarm1.adition.com/ ]
 C:\USERS\MMARTINI\Cookies\E4JDTHHM.txt [ Cookie:mmartini@ad2.adfarm1.adition.com/ ]
 C:\USERS\MMARTINI\Cookies\V39CR3QN.txt [ Cookie:mmartini@track.adform.net/ ]
 C:\USERS\MMARTINI\Cookies\OG2XXLHX.txt [ Cookie:mmartini@doubleclick.net/ ]
 C:\USERS\MMARTINI\Cookies\UF87N31I.txt [ Cookie:mmartini@adtech.de/ ]
 C:\USERS\MMARTINI\Cookies\6IJBJIRX.txt [ Cookie:mmartini@tradedoubler.com/ ]
 C:\USERS\MMARTINI\Cookies\2IAF596L.txt [ Cookie:mmartini@zanox-affiliate.de/ ]
 C:\USERS\MMARTINI\Cookies\5WM662LI.txt [ Cookie:mmartini@xiti.com/ ]
 C:\USERS\MMARTINI\Cookies\6GS0VX97.txt [ Cookie:mmartini@serving-sys.com/ ]
 C:\USERS\MMARTINI\Cookies\APIBSXV5.txt [ Cookie:mmartini@www.zanox-affiliate.de/ ]
 C:\USERS\MMARTINI\Cookies\JH7P4WC6.txt [ Cookie:mmartini@bs.serving-sys.com/ ]
 C:\USERS\MMARTINI\Cookies\AMZE5TFT.txt [ Cookie:mmartini@eset-online-scanner.softonic.de/ ]
 C:\USERS\MMARTINI\Cookies\7AXADA9H.txt [ Cookie:mmartini@smartadserver.com/ ]
 C:\USERS\MMARTINI\Cookies\2HKAT4ME.txt [ Cookie:mmartini@tracking.mlsat02.de/tmobile/ ]
 C:\USERS\MMARTINI\Cookies\XBI9FP9N.txt [ Cookie:mmartini@adform.net/ ]
 C:\USERS\MMARTINI\Cookies\ZHWT5OOK.txt [ Cookie:mmartini@ad4.adfarm1.adition.com/ ]
 C:\USERS\MMARTINI\Cookies\N0GQ5I49.txt [ Cookie:mmartini@de.sitestat.com/idgcom-de/pcwelt/ ]
 C:\USERS\MMARTINI\Cookies\NL0NLTFE.txt [ Cookie:mmartini@tracking.quisma.com/ ]
 C:\USERS\MMARTINI\Cookies\TSLCL6C2.txt [ Cookie:mmartini@atdmt.com/ ]
 C:\USERS\MMARTINI\Cookies\YPC2D8JX.txt [ Cookie:mmartini@dyntracker.com/ ]
 C:\USERS\MARKUS\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MARKUS@ADFARM1.ADITION[1].TXT [ /ADFARM1.ADITION ]
 C:\USERS\MARKUS\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MARKUS@AD4.ADFARM1.ADITION[1].TXT [ /AD4.ADFARM1.ADITION ]
 C:\USERS\MARKUS\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MARKUS@TRACK.ADFORM[2].TXT [ /TRACK.ADFORM ]
 C:\USERS\MARKUS\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MARKUS@ADFORM[1].TXT [ /ADFORM ]
 C:\USERS\MARKUS\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MARKUS@AD2.ADFARM1.ADITION[1].TXT [ /AD2.ADFARM1.ADITION ]
 C:\USERS\MARKUS\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MARKUS@ZBOX.ZANOX[2].TXT [ /ZBOX.ZANOX ]
 C:\USERS\MARKUS\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MARKUS@WEBMASTERPLAN[2].TXT [ /WEBMASTERPLAN ]
 C:\USERS\MARKUS\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MARKUS@AD.ZANOX[2].TXT [ /AD.ZANOX ]
 C:\USERS\MARKUS\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MARKUS@DOUBLECLICK[1].TXT [ /DOUBLECLICK ]
 C:\USERS\MARKUS\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MARKUS@ZBOX.ZANOX[1].TXT [ /ZBOX.ZANOX ]
 C:\USERS\MMARTINI\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MMARTINI@CREATIVES.COMMINDO-MEDIA[2].TXT [ /CREATIVES.COMMINDO-MEDIA ]
 C:\USERS\MMARTINI\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MMARTINI@WW251.SMARTADSERVER[1].TXT [ /WW251.SMARTADSERVER ]
 C:\USERS\MMARTINI\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MMARTINI@LIVEPERSON[1].TXT [ /LIVEPERSON ]
 C:\USERS\MMARTINI\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MMARTINI@ADS.SNAUTZ[2].TXT [ /ADS.SNAUTZ ]
 C:\USERS\MMARTINI\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MMARTINI@WWW.ACTIVE-TRACKING[1].TXT [ /WWW.ACTIVE-TRACKING ]
 C:\USERS\MMARTINI\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MMARTINI@UNITYMEDIA[2].TXT [ /UNITYMEDIA ]
 C:\USERS\MMARTINI\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MMARTINI@STATCOUNTER[1].TXT [ /STATCOUNTER ]
 C:\USERS\MMARTINI\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MMARTINI@ADS.INPSY[1].TXT [ /ADS.INPSY ]
 C:\USERS\MMARTINI\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MMARTINI@SALES.LIVEPERSON[1].TXT [ /SALES.LIVEPERSON ]
 C:\USERS\MMARTINI\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MMARTINI@MEDIA6DEGREES[1].TXT [ /MEDIA6DEGREES ]
 C:\USERS\MMARTINI\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MMARTINI@LIVEPERSON[3].TXT [ /LIVEPERSON ]
 C:\USERS\MMARTINI\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MMARTINI@WWW.USENEXT[2].TXT [ /WWW.USENEXT ]
 C:\USERS\MMARTINI\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MMARTINI@BANNER.TESTBERICHTE[2].TXT [ /BANNER.TESTBERICHTE ]
 C:\USERS\MMARTINI\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MMARTINI@AD3.ADFARM1.ADITION[2].TXT [ /AD3.ADFARM1.ADITION ]
 C:\USERS\MMARTINI\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MMARTINI@ADVIVA[2].TXT [ /ADVIVA ]
 .ad.yieldmanager.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .adtech.de [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .apmebf.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .atdmt.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .bs.serving-sys.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .doubleclick.net [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .fastclick.net [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .fastclick.net [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .fastclick.net [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .in.getclicky.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .interclick.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .interclick.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .interclick.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .mediaplex.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .mediaplex.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .microsoftwindows.112.2o7.net [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .msnportal.112.2o7.net [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .serving-sys.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .serving-sys.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .serving-sys.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .serving-sys.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .serving-sys.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .serving-sys.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .serving-sys.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .webmasterplan.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .xiti.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 statse.webtrendslive.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .twittercounter.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .statcounter.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .twittercounter.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .twittercounter.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .land-der-erfinder.ch [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .thomascookag.122.2o7.net [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .im.banner.t-online.de [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .smartadserver.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .smartadserver.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .smartadserver.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .smartadserver.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .inmedias.de [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .hoermann.122.2o7.net [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .compete.122.2o7.net [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .collective-media.net [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 ad.yieldmanager.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 ad.yieldmanager.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .ad.adnet.biz [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .findee.de [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 de.sitestat.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .dmtracker.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .revsci.net [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .adbrite.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .adviva.net [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .overture.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .overture.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .tradedoubler.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .tradedoubler.com [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
 .doubleclick.net [ C:\USERS\MMARTINI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M2GANE3A.DEFAULT\COOKIES.SQLITE ]
Heur.Agent/Gen-Boxes
 E:\TESTDISK-6.11.3\WIN\RECUP_DIR.5\F0047600.DLL
Trojan.Agent/Gen-BanLoad
 E:\TESTDISK-6.11.3\WIN\RECUP_DIR.412\F55631625_7ZS.SFX.EXE
Rootkit.Agent/Gen
 E:\FESTPLATTE-KOPIE\LABTOP KOPIE X\06 LAPTOP KOPIE\MARKUS\NACHHILFEVERMITTLUNG\SCHüLER\MARASKO\ARBEITSUNTERLAGEN GY 13\INVESTITIONSRECHNUNG\13-018-00 FINANZMATHEMATISCHE FORMELN.DOC
 E:\FESTPLATTE-KOPIE\LABTOP KOPIE X\005 LAPTOP KOPIE\MARKUS\NACHHILFEVERMITTLUNG\SCHüLER\MARASKO\ARBEITSUNTERLAGEN GY 13\INVESTITIONSRECHNUNG\13-018-00 FINANZMATHEMATISCHE FORMELN.DOC
 E:\FESTPLATTE-KOPIE\LABTOP KOPIE X\004 LABTOP\MARKUS\NACHHILFEVERMITTLUNG\SCHüLER\MARASKO\ARBEITSUNTERLAGEN GY 13\INVESTITIONSRECHNUNG\13-018-00 FINANZMATHEMATISCHE FORMELN.DOC
 E:\ALT\06 LAPTOP KOPIE\MARKUS\NACHHILFEVERMITTLUNG\SCHüLER\MARASKO\ARBEITSUNTERLAGEN GY 13\INVESTITIONSRECHNUNG\13-018-00 FINANZMATHEMATISCHE FORMELN.DOC
Das Programm SuperAntiSpyware habe ich auch geschlossen, ohne das ich die Entdeckungen in die "Quarantine" geschickt habe.

cosinus 24.04.2012 18:31
Sieht ok aus, da wurden nur Cookies gefunden. Rest waren Fehlalarme von SASW
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

name 24.04.2012 21:47
Ich kann im Augenblick keine Probleme feststellen. Vielen Dank für die Hilfe.

Ich bin ein bisschen vorsichtiger geworden und hab mir einen neuen, billigen Rechner bestellt. Da läuft dann wirklich nur noch drauf was laufen muss, um Bankgeschäfte, Server, etc. zu erledigen. Mit dem "alten" Rechner werde ich dann mit den empfohlenen Vorsichtsmaßnahmen arbeiten.

Ihr wollt mit eurem Auftritt doch auch bestimmt Geld verdienen. Warum empfehlt ihr mit euren Kenntnissen nicht Antivierenprogramme innerhalb eines Partnerprogramms? Ich habe bestimmt schon eine Stunde investiert, um mich zu informieren.

Grüße und Danke

cosinus 25.04.2012 10:53
Zitat:
Ich bin ein bisschen vorsichtiger geworden und hab mir einen neuen, billigen Rechner bestellt. Da läuft dann wirklich nur noch drauf was laufen muss, um Bankgeschäfte, Server, etc. zu erledigen. Mit dem "alten" Rechner werde ich dann mit den empfohlenen Vorsichtsmaßnahmen arbeiten.
Na, ein extra Rechner muss es nicht sein. Man kann auch den vorhandenen Erstrechner dafür nutzen, bootet zum Bankne aber dann zB Bankix => Sicheres Online-Banking mit Bankix | c't


Zitat:
Ihr wollt mit eurem Auftritt doch auch bestimmt Geld verdienen.
Wie kommst du darauf, nein! :wtf:
Ich bin nicht hier um Geld zu verdienen, kaum zu glauben, aber wahr, so etwas gibt es Zu Hauf im Netz, Foren wo man sich gegenseitig kostenlos hilft
Das TB finanziert sich durch Spenden und Werbeeinnahmen, denn das Betreiben dieser Domain, des Webservers und das Pflegen der Boardsoftware kostet Geld bzw. Lizenzgebühren

Zitat:
Warum empfehlt ihr mit euren Kenntnissen nicht Antivierenprogramme innerhalb eines Partnerprogramms?
Warum? Ich zumindest will helfen und Wissen vermitteln und nichts verkaufen oder irgendwelche Produkte schönreden!
Sicherheit fängt nicht damit an, einfach nur einen Virenscanner zu benutzen und erst recht nicht hört sie damit auf


LESEN!!! => http://www.malte-wetz.de/wiki/pmwiki...ngUnvermeidbar



Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:43 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131