Trojaner-Board - Firewall Fehlercode 0x80070424 / Echzeitschutz von z.b. MSE funktioniert nicht mehr

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Firewall Fehlercode 0x80070424 / Echzeitschutz von z.b. MSE funktioniert nicht mehr (https://www.trojaner-board.de/115914-firewall-fehlercode-0x80070424-echzeitschutz-z-b-mse-funktioniert-mehr.html)

Firewall Fehlercode 0x80070424 / Echzeitschutz von z.b. MSE funktioniert nicht mehr

Hey TROJANER-BOARD Team,

mir ist vor c.a. 2 Tagen aufgefallen, dass mein Windows Defender ausssetzt, meine Firewall nicht fuktioniert und auch zum Beispiel die Echtzeit-Scanner von Avira und MSE nicht funktionieren. Über solche Probleme hab ich schon über Google informiert, doch nichts passendes und hilfreiches gefunden.
Ich wäre euch sehr dankbar, wenn ich mir helfen würdet.
Ich stehe euch natürlich für weitere Informationen zur Verfügung.

Gruß Cuba

...oder könnt ihr mich auf eine Beitrag verweisen, der sich mit dem Thema befasst?
- bitte:heilig:

Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Hey Arne,

danke erstmal für die Antwort die Logs folgen...bin gerade dabei.

Gruß Cuba

So erstmal ältere Logs von MalwareBytes:

Code:

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.05.29.03
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Valentino :: VALENTINO-PC [Administrator]
 

29.05.2012 11:31:43

mbam-log-2012-05-29 (11-31-43).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 488623

Laufzeit: 1 Stunde(n), 3 Minute(n), 5 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 2

C:\Users\Valentino\Downloads\SoftonicDownloader_for_ea-download-manager.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Valentino\Downloads\SoftonicDownloader_fuer_pivot-stickfigure-animator.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Code:

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.05.29.04
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Valentino :: VALENTINO-PC [Administrator]
 

29.05.2012 18:01:08

mbam-log-2012-05-29 (18-01-08).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 489135

Laufzeit: 1 Stunde(n), 9 Minute(n), 40 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

...und der neuste:

Code:

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.05.31.03
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Valentino :: VALENTINO-PC [Administrator]
 

31.05.2012 16:49:54

mbam-log-2012-05-31 (16-49-54).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 495346

Laufzeit: 1 Stunde(n), 22 Minute(n), 7 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

.... Eset folgt.

Gruß Cuba

... SO hier der log von Eset:

Code:

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=d1a20cd2faf992409cdf7b26863b8afb

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-05-31 06:56:13

# local_time=2012-05-31 08:56:13 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=5893 16776574 66 94 529315 90109933 0 0

# compatibility_mode=8192 67108863 100 0 139 139 0 0

# scanned=278652

# found=4

# cleaned=0

# scan_time=10489

C:\Users\Valentino\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\7da554dc-3570381a        Java/Exploit.Agent.NBH trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Valentino\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\37db3fe2-1773a77c        Java/TrojanDownloader.Agent.ME trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows\Installer\{48bb494d-4e97-6edd-2dbd-5caf7f846375}\n        Win64/Sirefef.W trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows\Installer\{48bb494d-4e97-6edd-2dbd-5caf7f846375}\U\80000000.@        Win64/Sirefef.AE trojan (unable to clean)        00000000000000000000000000000000        I

Will ja nicht aufdringlich sein aber ist echt dringend und wichtig ;)

Zitat:

C:\Users\Valentino\Downloads\SoftonicDownloader_for_ea-download-manager.exe

Finger weg von Softonic!!

Softonic ist eine Toolbar- und Adwareschleuder! Finger weg! Software lädt man sich mit oberster Priorität direkt vom Hersteller und nicht von solchen Toolbarklitschen wie Softonic! Im Notfall würde natürlich chip.de gehen

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Ouh man...oke dann weiß ich bescheid:headbang:.

1.Wenn du damit den normalen Start meinst, dann funktionierts mit den Sicherheitseinstellungen immer noch nicht.

2.Mir ist gerade aufgefallen,dass mir der Intel Matrix Storage Manager fehlt.
Sonst ist alles noch vorhanden.Außerdem ist mir aufgefallen, dass die Desktop-Icons immer auf "mittelgroß" sind obwohl ich sie immer auf klein hatte und das die Anordnung in Ordner b.z.w. die Ansicht auf "Details" steht, obwohl ich die ANsicht immer auf "Kacheln" hatt.

Hoffe das bring dich weiter.

Gruß Cuba

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Hey danke Arne...

...hier der Log:

Code:

OTL logfile created on: 06.06.2012 16:51:03 - Run 2

OTL by OldTimer - Version 3.2.46.1     Folder = C:\Users\Valentino\Desktop\Office

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,35 Gb Available Physical Memory | 58,72% Memory free

7,99 Gb Paging File | 6,33 Gb Available in Paging File | 79,21% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 450,44 Gb Total Space | 364,84 Gb Free Space | 81,00% Space Free | Partition Type: NTFS

 

Computer Name: VALENTINO-PC | User Name: Valentino | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.06.06 16:46:22 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Valentino\Desktop\Office\OTL.exe

PRC - [2012.05.15 12:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.05.24 11:33:30 | 001,840,128 | ---- | M] (MAGIX AG) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe

PRC - [2011.01.28 14:08:56 | 000,419,112 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe

PRC - [2009.10.30 12:16:42 | 000,200,704 | ---- | M] () -- C:\Windows\PLFSetI.exe

PRC - [2009.08.27 22:47:18 | 001,200,136 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe

PRC - [2009.08.21 02:25:50 | 000,062,720 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

PRC - [2009.08.07 11:18:54 | 000,311,592 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe

PRC - [2009.08.06 07:21:04 | 003,564,544 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\Acer Bio Protection\PdtWzd.exe

PRC - [2009.08.06 07:21:04 | 003,450,368 | ---- | M] (Egis Technology Inc.) -- c:\Program Files (x86)\Acer Bio Protection\BASVC.exe

PRC - [2009.08.06 07:21:00 | 004,187,136 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\Acer Bio Protection\PwdBank.exe

PRC - [2009.08.06 07:20:50 | 003,351,552 | ---- | M] (Egis Technology Inc.) -- c:\Program Files (x86)\Acer Bio Protection\CompPtcVUI.exe

PRC - [2009.07.10 16:18:18 | 000,708,608 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe

PRC - [2009.07.10 03:54:44 | 000,253,952 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe

PRC - [2009.07.04 03:47:12 | 000,240,160 | ---- | M] (Acer) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe

PRC - [2009.06.05 04:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

PRC - [2009.06.04 15:04:50 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2009.10.30 12:16:42 | 000,200,704 | ---- | M] () -- C:\Windows\PLFSetI.exe

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2010.11.20 15:26:50 | 000,084,992 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\Mcx2Svc.dll -- (Mcx2Svc)

SRV:64bit: - [2009.07.14 03:41:27 | 000,097,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\mprdim.dll -- (RemoteAccess)

SRV - [2012.06.06 14:58:13 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.05.26 09:54:53 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.05.15 12:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)

SRV - [2012.05.03 08:31:10 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.03.26 18:49:56 | 000,291,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv)

SRV - [2012.03.26 18:49:56 | 000,012,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

SRV - [2012.02.28 17:38:54 | 002,343,816 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.05.24 11:33:30 | 001,840,128 | ---- | M] (MAGIX AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs)

SRV - [2011.04.26 14:54:12 | 002,702,848 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)

SRV - [2011.01.28 19:44:12 | 000,241,648 | ---- | M] (CyberLink) [Auto | Stopped] -- C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\NavFilter\kmsvc.exe -- (CLKMSVC10_DB37F995)

SRV - [2010.09.22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)

SRV - [2010.09.21 14:49:00 | 002,286,976 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010.01.04 21:55:00 | 003,404,560 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)

SRV - [2009.09.20 11:55:20 | 001,037,824 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)

SRV - [2009.08.21 02:25:50 | 000,062,720 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)

SRV - [2009.08.18 23:40:12 | 000,796,192 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer PowerSmart Manager\ePowerSvc.exe -- (ePowerSvc)

SRV - [2009.08.07 11:18:54 | 000,311,592 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService)

SRV - [2009.08.06 07:21:04 | 003,450,368 | ---- | M] (Egis Technology Inc.) [Auto | Running] -- c:\Program Files (x86)\Acer Bio Protection\BASVC.exe -- (IGBASVC)

SRV - [2009.07.14 03:15:41 | 000,075,264 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysWOW64\mprdim.dll -- (RemoteAccess)

SRV - [2009.07.10 03:54:44 | 000,253,952 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe -- (RS_Service)

SRV - [2009.07.04 03:47:12 | 000,240,160 | ---- | M] (Acer) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009.06.10 22:39:58 | 000,089,920 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_64)

SRV - [2009.06.05 04:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)

SRV - [2009.06.04 15:04:50 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)

SRV - [2009.03.28 04:10:16 | 000,016,896 | ---- | M] (LSI Corporation) [Auto | Running] -- C:\Programme\LSI SoftModem\agr64svc.exe -- (AgereModemAudio)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012.04.18 19:08:03 | 000,188,736 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)

DRV:64bit: - [2012.03.20 20:44:12 | 000,098,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] () [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011.08.02 18:38:56 | 000,051,712 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\usbaapl64.sys -- (USBAAPL64)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2011.02.14 02:42:36 | 000,028,160 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\lgx64diag.sys -- (UsbDiag)

DRV:64bit: - [2011.02.14 02:42:30 | 000,034,816 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\lgx64modem.sys -- (USBModem)

DRV:64bit: - [2011.02.14 02:42:28 | 000,017,920 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\lgx64bus.sys -- (usbbus)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tsusbflt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.20 11:26:11 | 000,328,192 | ---- | M] () [File_System | Disabled | Stopped] -- C:\Windows\SysNative\DRIVERS\udfs.sys -- (udfs)

DRV:64bit: - [2010.09.23 00:36:48 | 000,048,488 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\fssfltr.sys -- (fssfltr)

DRV:64bit: - [2010.07.14 13:42:56 | 007,821,312 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\NETwNs64.sys -- (NETwNs64) ___ Intel(R)

DRV:64bit: - [2010.06.10 18:45:50 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\atksgt.sys -- (atksgt)

DRV:64bit: - [2010.06.10 18:45:50 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\lirsgt.sys -- (lirsgt)

DRV:64bit: - [2009.10.30 12:17:07 | 000,029,184 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\Drivers\FPSensor.sys -- (FPSensor) EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys)

DRV:64bit: - [2009.09.29 08:15:02 | 000,016,384 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\lgbtpt64.sys -- (LgBttPort)

DRV:64bit: - [2009.09.29 08:15:00 | 000,017,408 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\lgvmdm64.sys -- (LGVMODEM)

DRV:64bit: - [2009.09.29 08:15:00 | 000,014,848 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\lgbtbs64.sys -- (lgbusenum)

DRV:64bit: - [2009.09.15 19:40:42 | 006,952,960 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\NETw5s64.sys -- (NETw5s64) Intel(R)

DRV:64bit: - [2009.08.13 22:10:18 | 000,073,984 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\xusb21.sys -- (xusb21)

DRV:64bit: - [2009.07.22 00:03:34 | 001,208,320 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\agrsm64.sys -- (AgereSoftModem)

DRV:64bit: - [2009.07.21 08:13:12 | 000,006,656 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\hidshim.sys -- (hidshim)

DRV:64bit: - [2009.07.21 08:13:10 | 000,025,088 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\nuvotonhidgeneric.sys -- (nuvotonhidgeneric)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:47:48 | 000,024,144 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\DRIVERS\crcdisk.sys -- (crcdisk)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 02:10:33 | 000,021,504 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\ws2ifsl.sys -- (ws2ifsl)

DRV:64bit: - [2009.07.14 01:19:47 | 000,092,160 | ---- | M] () [File_System | Disabled | Stopped] -- C:\Windows\SysNative\DRIVERS\cdfs.sys -- (cdfs)

DRV:64bit: - [2009.06.20 13:35:00 | 000,317,480 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\k57nd60a.sys -- (k57nd60a) Broadcom NetLink (TM)

DRV:64bit: - [2009.06.20 04:09:57 | 000,054,272 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\L1E62x64.sys -- (L1E) NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20)

DRV:64bit: - [2009.06.19 06:12:32 | 000,272,432 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\SynTP.sys -- (SynTP)

DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\igdkmd64.sys -- (igfx)

DRV:64bit: - [2009.06.10 22:35:38 | 000,707,072 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\netr7364.sys -- (netr7364)

DRV:64bit: - [2009.06.10 22:34:38 | 001,311,232 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\bcmwl664.sys -- (BCM43XX)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.06.05 03:54:36 | 000,408,600 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\iaStor.sys -- (iaStor)

DRV:64bit: - [2009.06.05 02:46:50 | 000,216,064 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\RtsUStor.sys -- (RSUSBSTOR)

DRV:64bit: - [2009.06.03 05:15:30 | 000,060,464 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\mwlPSDVDisk.sys -- (mwlPSDVDisk)

DRV:64bit: - [2009.06.03 05:15:30 | 000,022,576 | ---- | M] () [File_System | System | Running] -- C:\Windows\SysNative\DRIVERS\mwlPSDFilter.sys -- (mwlPSDFilter)

DRV:64bit: - [2009.06.03 05:15:30 | 000,020,016 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\mwlPSDNServ.sys -- (mwlPSDNServ)

DRV:64bit: - [2009.05.18 14:17:08 | 000,034,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM)

DRV:64bit: - [2009.05.14 18:51:40 | 005,435,904 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\netw5v64.sys -- (netw5v64) Intel(R)

DRV:64bit: - [2009.05.06 02:46:08 | 000,018,432 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)

DRV:64bit: - [2009.05.06 02:46:08 | 000,016,896 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)

DRV:64bit: - [2009.04.29 17:28:30 | 000,030,208 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\KMWDFILTER.sys -- (KMWDFILTER)

DRV:64bit: - [2009.03.18 16:35:42 | 000,033,856 | -H-- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\hamachi.sys -- (hamachi)

DRV:64bit: - [2009.01.19 20:32:22 | 000,334,344 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\acedrv11.sys -- (acedrv11)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

DRV - [2005.01.04 11:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\npptNT2.sys -- (NPPTNT2)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7738&r=27361209z636l0398z115t6801w25p

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7738&r=27361209z636l0398z115t6801w25p

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7738&r=27361209z636l0398z115t6801w25p

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7738&r=27361209z636l0398z115t6801w25p

IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 

 

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\Valentino\Desktop\Spiele!

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7738&r=27361209z636l0398z115t6801w25p

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\..\URLSearchHook:  - No CLSID value found

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&AF=100888&tt=090212_ctrl&babsrc=SP_ss&mntrId=c46f7d1f0000000000000026c619f514

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SUNC_de

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredibar.com/mb119/?search={searchTerms}&loc=IB_DS&a=6PQov0neqq&i=26

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "MyStart Search"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/ig"

FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.90

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..keyword.URL: "hxxp://mystart.incredibar.com/mb119/?loc=IB_DS&a=6PQov0neqq&&i=26&search="

 

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_32: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found

FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: c:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Creative Software Inc)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Valentino\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.06 14:58:13 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.05.26 12:27:51 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.06 14:58:13 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.05.26 12:27:51 | 000,000,000 | ---D | M]

 

[2011.02.12 21:12:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Valentino\AppData\Roaming\mozilla\Extensions

[2011.02.12 21:12:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Valentino\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2012.06.06 14:58:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Valentino\AppData\Roaming\mozilla\Firefox\Profiles\ulkvod3r.default\extensions

[2011.01.16 13:46:48 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\Valentino\AppData\Roaming\mozilla\Firefox\Profiles\ulkvod3r.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

[2012.03.05 17:29:28 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Valentino\AppData\Roaming\mozilla\Firefox\Profiles\ulkvod3r.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2011.12.29 20:24:34 | 000,000,000 | ---D | M] (Battlefield Play4Free) -- C:\Users\Valentino\AppData\Roaming\mozilla\Firefox\Profiles\ulkvod3r.default\extensions\battlefieldplay4free@ea.com

[2011.03.02 15:33:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Valentino\AppData\Roaming\mozilla\Firefox\Profiles\ulkvod3r.default\extensions\nostmp

[2012.02.15 18:46:22 | 000,002,203 | ---- | M] () -- C:\Users\Valentino\AppData\Roaming\Mozilla\Firefox\Profiles\ulkvod3r.default\searchplugins\MyStart Search.xml

[2011.06.29 12:09:43 | 000,005,508 | ---- | M] () -- C:\Users\Valentino\AppData\Roaming\Mozilla\Firefox\Profiles\ulkvod3r.default\searchplugins\webde-suche.xml

[2012.06.06 14:58:13 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

[2012.06.06 14:58:14 | 000,057,439 | ---- | M] () (No name found) -- C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\EXTENSIONS\TABSCOPE@XULDEV.ORG.XPI

[2012.06.06 14:58:13 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.03.13 07:23:34 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.02.15 18:45:16 | 000,002,351 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml

[2012.03.13 07:06:36 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.03.13 07:23:34 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.03.13 07:23:34 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.03.13 07:23:34 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.03.13 07:23:34 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Valentino\AppData\Local\Google\Chrome\Application\9.0.597.98\pdf.dll

CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\Valentino\AppData\Local\Google\Chrome\Application\9.0.597.98\gears.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Valentino\AppData\Local\Google\Chrome\Application\9.0.597.98\gcswf32.dll

CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll

CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

CHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll

CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)  (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll

CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll

CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll

CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit)  (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60129.0\npctrl.dll

CHR - plugin: Media Go Detector (Enabled) = c:\Program Files (x86)\Sony\Media Go\npmediago.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: Brushed = C:\Users\Valentino\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfjgbcjfpbbfepcccpaffkjofcmglifg\1.0_0\

CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Valentino\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.1_0\

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.

O2 - BHO: (HistoryTriggerBHO Class) - {21A88CB9-84D2-4020-A2D1-B25A21034884} - C:\Program Files (x86)\LG Electronics\LG PC Suite IV\LinkAir\LinkAirBrowserHelper.dll (LG Electronics)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.

O3:64bit: - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe (Acer Incorporated)

O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()

O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)

O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)

O4 - HKLM..\Run: [VitaKeyPdtWzd] c:\Program Files (x86)\Acer Bio Protection\PdtWzd.exe (Egis Technology Inc.)

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-3799775492-1617133738-1545146542-1009..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-21-3799775492-1617133738-1545146542-1009..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-21-3799775492-1617133738-1545146542-1009..\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found

O8:64bit: - Extra context menu item: Free YouTube to DVD Converter - C:\Users\Valentino\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetodvdconverter.htm ()

O8:64bit: - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Valentino\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm ()

O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Valentino\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: Free YouTube to DVD Converter - C:\Users\Valentino\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetodvdconverter.htm ()

O8 - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Valentino\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm ()

O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Valentino\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O9:64bit: - Extra Button: Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\Program Files (x86)\Acer Bio Protection\PwdBank.exe (Egis Technology Inc.)

O9:64bit: - Extra 'Tools' menuitem : Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\Program Files (x86)\Acer Bio Protection\PwdBank.exe (Egis Technology Inc.)

O9 - Extra Button: Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\Program Files (x86)\Acer Bio Protection\PwdBank.exe (Egis Technology Inc.)

O9 - Extra 'Tools' menuitem : Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\Program Files (x86)\Acer Bio Protection\PwdBank.exe (Egis Technology Inc.)

O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)

O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{49433CE4-9712-4E8E-AD05-0FC9E0C43D95}: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8F59D9C8-F90A-49CB-9906-39B65689FEC7}: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C6EDCF52-21A6-4A0C-BF79-81437EA28021}: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F429723B-49DD-4D96-8AF3-3567B0E6914D}: DhcpNameServer = 10.57.1.1

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{33a16769-91c4-11e0-99f3-00262d6044ad}\Shell - "" = AutoRun

O33 - MountPoints2\{33a16769-91c4-11e0-99f3-00262d6044ad}\Shell\AutoRun\command - "" = E:\NPSAI.exe

O33 - MountPoints2\{7f86954e-b689-11e0-916f-00262d6044ad}\Shell - "" = AutoRun

O33 - MountPoints2\{7f86954e-b689-11e0-916f-00262d6044ad}\Shell\AutoRun\command - "" = E:\LGAutoRun.exe

O33 - MountPoints2\{949a1249-2eba-11df-bbd7-0026c619f514}\Shell - "" = AutoRun

O33 - MountPoints2\{949a1249-2eba-11df-bbd7-0026c619f514}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{9eb5524b-0eda-11e1-911c-0026c619f514}\Shell - "" = AutoRun

O33 - MountPoints2\{9eb5524b-0eda-11e1-911c-0026c619f514}\Shell\AutoRun\command - "" = E:\AutoRun.exe

O33 - MountPoints2\{9eb55258-0eda-11e1-911c-0026c619f514}\Shell - "" = AutoRun

O33 - MountPoints2\{9eb55258-0eda-11e1-911c-0026c619f514}\Shell\AutoRun\command - "" = E:\AutoRun.exe

O33 - MountPoints2\{a5405344-2c42-11df-b8a7-00262d6044ad}\Shell - "" = AutoRun

O33 - MountPoints2\{a5405344-2c42-11df-b8a7-00262d6044ad}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{b0ea324a-29e5-11df-acfb-00262d6044ad}\Shell - "" = AutoRun

O33 - MountPoints2\{b0ea324a-29e5-11df-acfb-00262d6044ad}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{d835dd5a-29dd-11df-bba3-00262d6044ad}\Shell - "" = AutoRun

O33 - MountPoints2\{d835dd5a-29dd-11df-bba3-00262d6044ad}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{d835dd6a-29dd-11df-bba3-00262d6044ad}\Shell - "" = AutoRun

O33 - MountPoints2\{d835dd6a-29dd-11df-bba3-00262d6044ad}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{f4a9be5b-0fa9-11e1-a78d-0026c619f514}\Shell - "" = AutoRun

O33 - MountPoints2\{f4a9be5b-0fa9-11e1-a78d-0026c619f514}\Shell\AutoRun\command - "" = E:\AutoRun.exe

O33 - MountPoints2\{f4a9be6c-0fa9-11e1-a78d-0026c619f514}\Shell - "" = AutoRun

O33 - MountPoints2\{f4a9be6c-0fa9-11e1-a78d-0026c619f514}\Shell\AutoRun\command - "" = E:\AutoRun.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

 

MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk -  - File not found

MsConfig:64bit - StartUpFolder: C:^Users^Valentino^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Game Alarm.lnk -  - File not found

MsConfig:64bit - StartUpFolder: C:^Users^Valentino^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe - ()

MsConfig:64bit - StartUpFolder: C:^Users^Valentino^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Update GreenWebPlayer.lnk -  - File not found

MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: AmIcoSinglun64 - hkey= - key= - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (AlcorMicro Co., Ltd.)

MsConfig:64bit - StartUpReg: APSDaemon - hkey= - key= - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

MsConfig:64bit - StartUpReg: BackupManagerTray - hkey= - key= - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)

MsConfig:64bit - StartUpReg: EgisTecLiveUpdate - hkey= - key= - C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)

MsConfig:64bit - StartUpReg: Facebook Update - hkey= - key= - C:\Users\Valentino\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)

MsConfig:64bit - StartUpReg: HP Software Update - hkey= - key= - C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)

MsConfig:64bit - StartUpReg: hpqSRMon - hkey= - key= - C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe (Hewlett-Packard)

MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)

MsConfig:64bit - StartUpReg: LogMeIn Hamachi Ui - hkey= - key= - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)

MsConfig:64bit - StartUpReg: mwlDaemon - hkey= - key= - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)

MsConfig:64bit - StartUpReg: PlayMovie - hkey= - key= - C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)

MsConfig:64bit - StartUpReg: Regedit32 - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: Skype - hkey= - key= - C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)

MsConfig:64bit - StartUpReg: Steam - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: swg - hkey= - key= - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)

MsConfig:64bit - StartUpReg: TkBellExe - hkey= - key= -  File not found

MsConfig:64bit - State: "startup" - Reg Error: Key error.

MsConfig:64bit - State: "services" - Reg Error: Key error.

 

SafeBootMin:64bit: AppMgmt - Service

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: mcmscsvc - Service

SafeBootMin:64bit: MCODS - Service

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: WinDefend - Service

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: mcmscsvc - Service

SafeBootMin: MCODS - Service

SafeBootMin: MsMpSvc - c:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: WinDefend - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: AppMgmt - Service

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: BFE - Service

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: mcmscsvc - Service

SafeBootNet:64bit: MCODS - Service

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: MpfService - Service

SafeBootNet:64bit: MPSSvc - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WinDefend - Service

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: BFE - Service

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: Hamachi2Svc - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)

SafeBootNet: HelpSvc - Service

SafeBootNet: mcmscsvc - Service

SafeBootNet: MCODS - Service

SafeBootNet: Messenger - Service

SafeBootNet: MpfService - Service

SafeBootNet: MPSSvc - Service

SafeBootNet: MsMpSvc - c:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WinDefend - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

Drivers32: VIDC.MKVC - C:\Windows\SysWow64\KMVIDC32.DLL ()

Drivers32: vidc.VP60 - C:\Windows\SysWOW64\vp6vfw.dll (On2.com)

Drivers32: vidc.VP61 - C:\Windows\SysWOW64\vp6vfw.dll (On2.com)

 

CREATERESTOREPOINT

System Restore Service not available.

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.05.31 17:59:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET

[2012.05.29 11:24:20 | 000,000,000 | ---D | C] -- C:\Users\Valentino\AppData\Roaming\Malwarebytes

[2012.05.29 11:24:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.05.29 11:24:16 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.05.29 11:24:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.05.29 11:24:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.05.28 14:54:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client

[2012.05.28 14:54:27 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client

[2012.05.28 14:47:15 | 000,000,000 | ---D | C] -- C:\Users\Valentino\AppData\Local\Apps

[2012.05.26 12:28:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java

[2012.05.26 10:11:21 | 000,068,928 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll

[2012.05.26 10:11:21 | 000,061,248 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll

[2012.05.26 10:11:14 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation

[2012.05.20 17:26:14 | 000,000,000 | ---D | C] -- C:\Users\Valentino\Documents\TrackMania

[2012.05.18 12:07:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM

[2012.05.18 12:07:14 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek

[2012.05.18 12:06:34 | 002,605,400 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\WavesGUILib.dll

[2012.05.18 12:06:31 | 000,518,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll

[2012.05.18 12:06:31 | 000,211,184 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll

[2012.05.18 12:06:31 | 000,198,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll

[2012.05.18 12:06:31 | 000,155,888 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll

[2012.05.18 12:06:24 | 000,221,024 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SFNHK64.dll

[2012.05.18 12:06:22 | 000,081,248 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SFCOM64.dll

[2012.05.18 12:06:22 | 000,074,064 | ---- | C] (Virage Logic Corporation / Sonic Focus) -- C:\Windows\SysWow64\SFCOM.dll

[2012.05.18 12:06:21 | 000,078,688 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SFAPO64.dll

[2012.05.18 12:06:12 | 000,375,128 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll

[2012.05.18 12:06:12 | 000,101,208 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll

[2012.05.18 12:06:11 | 000,204,120 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll

[2012.05.18 12:06:11 | 000,078,680 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll

[2012.05.18 12:06:09 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll

[2012.05.18 12:06:09 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll

[2012.05.18 12:06:06 | 007,163,744 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEP64A.dll

[2012.05.18 12:06:05 | 000,433,504 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EED64A.dll

[2012.05.18 12:06:05 | 000,137,056 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEL64A.dll

[2012.05.18 12:06:05 | 000,120,160 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEA64A.dll

[2012.05.18 12:06:05 | 000,075,104 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEG64A.dll

[2012.05.18 12:06:04 | 001,247,576 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioRealtek264.dll

[2012.05.18 12:06:04 | 000,396,632 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxVolumeSDAPO.dll

[2012.05.18 12:06:03 | 008,363,864 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioRealtek.dll

[2012.05.18 12:06:02 | 002,131,288 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioEQ.dll

[2012.05.18 12:06:01 | 000,978,776 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPOShell64.dll

[2012.05.18 12:06:01 | 000,603,984 | ---- | C] (Knowles Acoustics ) -- C:\Windows\SysNative\KAAPORT64.dll

[2012.05.18 12:06:01 | 000,341,336 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO30.dll

[2012.05.18 12:06:01 | 000,318,808 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll

[2012.05.18 12:05:46 | 002,528,832 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll

[2012.05.18 12:05:45 | 000,693,352 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSVoiceClarityDLL64.dll

[2012.05.18 12:05:45 | 000,537,456 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSU2PLFX64.dll

[2012.05.18 12:05:45 | 000,449,392 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSU2PREC64.dll

[2012.05.18 12:05:44 | 000,712,296 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSSymmetryDLL64.dll

[2012.05.18 12:05:44 | 000,524,656 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSU2PGFX64.dll

[2012.05.18 12:05:43 | 001,756,264 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSS2SpeakerDLL64.dll

[2012.05.18 12:05:43 | 001,568,360 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSS2HeadphoneDLL64.dll

[2012.05.18 12:05:43 | 000,491,112 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSNeoPCDLL64.dll

[2012.05.18 12:05:42 | 000,432,744 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSLimiterDLL64.dll

[2012.05.18 12:05:42 | 000,242,792 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSLFXAPO64.dll

[2012.05.18 12:05:42 | 000,242,792 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGFXAPO64.dll

[2012.05.18 12:05:42 | 000,241,768 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGFXAPONS64.dll

[2012.05.18 12:05:41 | 000,428,648 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGainCompensatorDLL64.dll

[2012.05.18 12:05:40 | 001,486,952 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSBoostDLL64.dll

[2012.05.18 12:05:40 | 000,728,680 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSBassEnhancementDLL64.dll

[2012.05.18 11:51:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Game Booster 3

[2012.05.18 11:51:49 | 000,000,000 | ---D | C] -- C:\ProgramData\IObit

[2012.05.18 11:51:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\IObit

[2012.05.16 18:27:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2012.05.16 18:27:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2012.05.11 20:49:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

[2012.05.11 20:48:11 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight

[2012.05.11 20:48:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight

[2012.05.10 19:22:16 | 000,000,000 | ---D | C] -- C:\Users\Valentino\AppData\Local\LogMeIn Hamachi

[2012.05.10 19:21:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi

[2012.05.10 19:21:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi

[2012.05.10 18:31:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service

[2012.05.10 18:31:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla

[3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.06.06 16:44:36 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.06.06 16:44:36 | 000,000,944 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3799775492-1617133738-1545146542-1000UA.job

[2012.06.06 16:44:35 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.06.06 16:44:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.06.06 14:24:11 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.06.06 13:48:47 | 000,017,376 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.06.06 13:48:47 | 000,017,376 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.06.06 13:45:45 | 001,505,390 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.06.06 13:45:45 | 000,656,528 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.06.06 13:45:45 | 000,618,370 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.06.06 13:45:45 | 000,131,268 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.06.06 13:45:45 | 000,107,650 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.06.06 13:43:03 | 000,052,224 | ---- | M] () -- C:\Users\Valentino\3cel21f1px.exe

[2012.06.06 13:41:08 | 3217,235,968 | -HS- | M] () -- C:\hiberfil.sys

[2012.06.03 20:56:47 | 000,000,922 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3799775492-1617133738-1545146542-1000Core.job

[2012.06.02 17:58:05 | 000,000,032 | ---- | M] () -- C:\Users\Valentino\geonext.ini

[2012.06.01 17:04:19 | 000,004,608 | ---- | M] () -- C:\Users\Valentino\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.05.30 21:13:31 | 000,000,863 | ---- | M] () -- C:\Users\Valentino\.recently-used.xbel

[2012.05.28 14:54:51 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif

[2012.05.28 14:54:32 | 001,527,912 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2012.05.27 16:53:14 | 000,078,792 | ---- | M] () -- C:\Windows\SysNative\drivers\10ac98cb6b0d6f96.sys

[2012.05.17 19:33:54 | 000,293,282 | ---- | M] () -- C:\Users\Valentino\Documents\ts3_clientui-win64-1334913258-2012-05-17 19_33_52.909921.dmp

[2012.05.16 18:27:24 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2012.05.15 12:48:00 | 000,068,928 | ---- | M] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll

[2012.05.15 12:48:00 | 000,061,248 | ---- | M] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll

[2012.05.15 12:48:00 | 000,014,324 | ---- | M] () -- C:\Windows\SysNative\nvinfo.pb

[2012.05.10 06:51:40 | 000,465,232 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.05.09 15:04:02 | 000,132,832 | ---- | M] () -- C:\Windows\SysNative\drivers\avipbb.sys

[3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.05.30 21:13:31 | 000,000,863 | ---- | C] () -- C:\Users\Valentino\.recently-used.xbel

[2012.05.28 14:57:36 | 000,001,782 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk

[2012.05.28 14:54:51 | 000,001,912 | ---- | C] () -- C:\Windows\epplauncher.mif

[2012.05.28 14:54:34 | 000,001,919 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk

[2012.05.28 14:54:32 | 001,527,912 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2012.05.27 16:53:14 | 000,078,792 | ---- | C] () -- C:\Windows\SysNative\drivers\10ac98cb6b0d6f96.sys

[2012.05.26 10:09:57 | 000,188,736 | ---- | C] () -- C:\Windows\SysNative\drivers\nvhda64v.sys

[2012.05.26 10:09:56 | 014,298,944 | ---- | C] () -- C:\Windows\SysNative\drivers\nvlddmkm.sys

[2012.05.26 10:09:56 | 000,014,324 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb

[2012.05.26 09:53:45 | 000,052,224 | ---- | C] () -- C:\Users\Valentino\3cel21f1px.exe

[2012.05.18 12:06:18 | 004,015,592 | ---- | C] () -- C:\Windows\SysNative\drivers\RTKVHD64.sys

[2012.05.18 12:06:09 | 000,272,629 | ---- | C] () -- C:\Windows\SysNative\drivers\RTAIODAT.DAT

[2012.05.17 19:33:52 | 000,293,282 | ---- | C] () -- C:\Users\Valentino\Documents\ts3_clientui-win64-1334913258-2012-05-17 19_33_52.909921.dmp

[2012.05.16 18:27:24 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk

[2012.05.09 13:27:43 | 005,559,664 | ---- | C] () -- C:\Windows\SysNative\ntoskrnl.exe

[2012.05.09 13:27:43 | 003,146,240 | ---- | C] () -- C:\Windows\SysNative\win32k.sys

[2012.05.09 13:26:56 | 000,075,120 | ---- | C] () -- C:\Windows\SysNative\drivers\partmgr.sys

[2012.05.09 13:26:38 | 001,918,320 | ---- | C] () -- C:\Windows\SysNative\drivers\tcpip.sys

[2011.12.24 11:04:26 | 000,000,028 | ---- | C] () -- C:\Windows\Robota.INI

[2011.09.28 17:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat

[2011.03.02 18:32:06 | 000,311,296 | ---- | C] () -- C:\Windows\SysWow64\EMRegSys.dll

[2011.02.17 16:36:21 | 000,004,608 | ---- | C] () -- C:\Users\Valentino\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.02.12 21:12:17 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

[2010.12.03 16:22:29 | 001,589,248 | ---- | C] () -- C:\Windows\SysWow64\libmysql_d.dll

[2010.11.16 17:34:35 | 000,000,000 | ---- | C] () -- C:\Windows\JCMKR32.INI

[2010.10.05 01:59:32 | 000,005,632 | ---- | C] () -- C:\Windows\SysWow64\StarOpen.sys

[2010.07.28 10:35:33 | 000,226,764 | ---- | C] () -- C:\Windows\hpoins18.dat

[2010.07.28 10:35:33 | 000,005,355 | ---- | C] () -- C:\Windows\hpomdl18.dat

 
 ========== LOP Check ==========

 

[2012.05.31 16:42:18 | 000,000,000 | -HSD | M] -- C:\Users\Valentino\AppData\Roaming\.#

[2012.05.27 17:53:42 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\.minecraft

[2012.02.15 18:45:09 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Babylon

[2011.07.24 21:27:17 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant

[2010.06.05 20:22:39 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Command and Conquer 3 Tiberium Wars

[2012.05.05 12:29:32 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\DVDVideoSoft

[2012.03.06 16:54:50 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.10.29 12:49:45 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Electronic Arts

[2011.12.16 21:25:57 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Engelmann Media

[2010.02.05 14:56:27 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\eSobi

[2010.10.27 18:10:57 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\flightgear.org

[2010.11.02 21:27:29 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\fltk.org

[2009.12.24 21:45:28 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\GameConsole

[2012.05.27 17:14:43 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\gtk-2.0

[2012.06.03 17:44:50 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\ICQ

[2010.09.30 14:04:19 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Leadertech

[2011.12.24 10:42:13 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\MAGIX

[2011.02.18 19:51:29 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\NCH Swift Sound

[2010.10.09 11:38:26 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Need for Speed World

[2010.11.21 16:36:35 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\OpenOffice.org

[2010.09.18 15:09:36 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\PCFix

[2011.03.04 21:17:26 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\PhotoScape

[2009.12.24 22:18:19 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\PowerCinema

[2011.01.21 20:41:36 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\ProtectDisc

[2011.02.18 16:47:15 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Recordpad

[2011.06.08 14:21:02 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Samsung

[2010.11.02 21:26:43 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Scribus

[2011.06.24 14:44:26 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\SoftDMA

[2010.02.05 21:22:55 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Sony

[2010.02.05 21:17:32 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Sony Setup

[2011.07.03 21:14:08 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\StreamTorrent

[2010.10.28 14:35:03 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Subversion

[2011.11.14 18:28:05 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\T-Mobile

[2011.11.14 18:44:34 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\T-Mobile Internet Manager

[2010.08.31 14:36:17 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\TeamViewer

[2009.12.25 10:04:27 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Template

[2011.02.12 21:12:17 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Thunderbird

[2011.06.23 20:41:45 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Unity

[2010.03.07 13:50:55 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Vodafone

[2010.10.11 20:00:17 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Wildlife Park 2

[2010.10.11 20:03:30 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Wildlife Park 2 - Crazy Zoo

[2010.10.11 21:14:08 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Wildlife Park 2 - Marine World

[2012.06.03 20:56:47 | 000,000,922 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3799775492-1617133738-1545146542-1000Core.job

[2012.06.06 16:44:36 | 000,000,944 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3799775492-1617133738-1545146542-1000UA.job

[2012.04.12 11:23:09 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2012.05.31 16:42:18 | 000,000,000 | -HSD | M] -- C:\Users\Valentino\AppData\Roaming\.#

[2012.05.27 17:53:42 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\.minecraft

[2011.06.14 21:53:09 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Adobe

[2012.02.11 13:34:26 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Apple Computer

[2012.02.15 18:45:09 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Babylon

[2011.07.24 21:27:17 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant

[2010.06.05 20:22:39 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Command and Conquer 3 Tiberium Wars

[2010.07.20 12:40:52 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\CyberLink

[2012.05.05 12:29:32 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\DVDVideoSoft

[2012.03.06 16:54:50 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.10.29 12:49:45 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Electronic Arts

[2011.12.16 21:25:57 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Engelmann Media

[2010.02.05 14:56:27 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\eSobi

[2010.03.07 14:47:09 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\FLEXnet

[2010.10.27 18:10:57 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\flightgear.org

[2010.11.02 21:27:29 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\fltk.org

[2009.12.24 21:45:28 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\GameConsole

[2009.12.24 21:28:44 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Google

[2012.05.27 17:14:43 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\gtk-2.0

[2010.07.28 10:44:18 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\HP

[2012.06.03 17:44:50 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\ICQ

[2009.12.24 21:15:51 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Identities

[2010.09.30 14:04:19 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Leadertech

[2009.12.24 21:16:11 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Macromedia

[2011.12.24 10:42:13 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\MAGIX

[2012.05.29 11:24:20 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Malwarebytes

[2009.08.22 08:06:24 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Media Center Programs

[2012.05.28 14:52:58 | 000,000,000 | --SD | M] -- C:\Users\Valentino\AppData\Roaming\Microsoft

[2010.09.26 15:12:04 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Mozilla

[2011.02.18 19:51:29 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\NCH Swift Sound

[2010.10.09 11:38:26 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Need for Speed World

[2011.10.30 15:38:23 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\NVIDIA

[2010.11.21 16:36:35 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\OpenOffice.org

[2010.09.18 15:09:36 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\PCFix

[2011.03.04 21:17:26 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\PhotoScape

[2009.12.24 22:18:19 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\PowerCinema

[2011.01.21 20:41:36 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\ProtectDisc

[2011.05.08 11:00:22 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Real

[2010.11.06 14:07:16 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Real Park

[2011.02.18 16:47:15 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Recordpad

[2011.06.08 14:21:02 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Samsung

[2010.11.02 21:26:43 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Scribus

[2010.05.11 16:06:05 | 000,000,000 | RH-D | M] -- C:\Users\Valentino\AppData\Roaming\SecuROM

[2012.05.28 15:06:58 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Skype

[2011.06.24 14:44:26 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\SoftDMA

[2010.02.05 21:22:55 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Sony

[2010.02.05 21:17:32 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Sony Setup

[2011.07.03 21:14:08 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\StreamTorrent

[2010.10.28 14:35:03 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Subversion

[2011.11.14 18:28:05 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\T-Mobile

[2011.11.14 18:44:34 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\T-Mobile Internet Manager

[2010.08.31 14:36:17 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\TeamViewer

[2009.12.25 10:04:27 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Template

[2011.02.12 21:12:17 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Thunderbird

[2011.06.23 20:41:45 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Unity

[2010.03.07 13:50:55 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Vodafone

[2010.10.11 20:00:17 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Wildlife Park 2

[2010.10.11 20:03:30 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Wildlife Park 2 - Crazy Zoo

[2010.10.11 21:14:08 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Wildlife Park 2 - Marine World

[2012.05.01 15:35:10 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\WinRAR

[2010.07.28 10:40:21 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Yahoo!

 
 < %APPDATA%\*.exe /s >

[2011.11.15 21:27:16 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Valentino\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

[2010.10.22 16:53:33 | 002,788,816 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Valentino\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe

[2011.09.23 14:07:18 | 001,005,512 | ---- | M] (EA Digital Illusions CE AB) -- C:\Users\Valentino\AppData\Roaming\Mozilla\Firefox\Profiles\ulkvod3r.default\extensions\battlefieldplay4free@ea.com\plugins\BP4FUpdater.exe

[2010.08.13 09:13:32 | 000,032,032 | ---- | M] (NOS Microsystems Ltd.) -- C:\Users\Valentino\AppData\Roaming\Mozilla\Firefox\Profiles\ulkvod3r.default\extensions\nostmp\content\getPlusPlus_Adobe_reg.exe

[2010.02.05 21:19:52 | 032,494,896 | ---- | M] (Apple Inc.) -- C:\Users\Valentino\AppData\Roaming\Sony Setup\9234765D-29DF-48d0-93FB-284B7B6009B9\QuickTimeInstaller.exe

[2010.01.07 15:35:18 | 001,007,616 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Users\Valentino\AppData\Roaming\T-Mobile Internet Manager\LiveUpdate.exe

[2009.12.31 15:13:52 | 000,110,592 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Users\Valentino\AppData\Roaming\T-Mobile Internet Manager\ouc.exe

 
 < %SYSTEMDRIVE%\*.exe >

[2007.11.07 09:44:20 | 000,855,040 | ---- | M] (Microsoft Corporation) -- C:\install.exe

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] () Unable to obtain MD5 -- C:\Windows\SysNative\drivers\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] () Unable to obtain MD5 -- C:\Windows\SysNative\drivers\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2009.06.05 03:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Program Files (x86)\Phyxion.net\Driver Sweeper\Backup\12-04-01-14-26-21\Intel - Chipset\Directories\Intel287929548\Intel Matrix Storage Manager\driver64\IaStor.sys

[2009.06.05 03:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_7fb62b08f6b7117a\iaStor.sys

[2009.06.05 03:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Program Files (x86)\Phyxion.net\Driver Sweeper\Backup\12-04-01-14-26-21\Intel - Chipset\Directories\Intel287929548\Intel Matrix Storage Manager\driver\IaStor.sys

[2009.06.05 03:54:36 | 000,408,600 | ---- | M] () Unable to obtain MD5 -- C:\Windows\SysNative\drivers\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] () Unable to obtain MD5 -- C:\Windows\SysNative\drivers\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] () Unable to obtain MD5 -- C:\Windows\SysNative\drivers\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] () Unable to obtain MD5 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

[2009.03.26 21:16:08 | 000,025,608 | ---- | M] () Unable to obtain MD5 -- C:\Windows\system32\drivers\DKbFltr.sys

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[3 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:4D066AD2

@Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:AB689DEA

@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:1D32EC29

@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:93DE1838

@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:E1F04E8D
 

< End of report >

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&AF=100888&tt=090212_ctrl&babsrc=SP_ss&mntrId=c46f7d1f0000000000000026c619f514

IE - HKU\S-1-5-21-3799775492-1617133738-1545146542-1000\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredibar.com/mb119/?search={searchTerms}&loc=IB_DS&a=6PQov0neqq&i=26

FF - prefs.js..browser.search.defaultenginename: "MyStart Search"

FF - prefs.js..keyword.URL: "http://mystart.incredibar.com/mb119/?loc=IB_DS&a=6PQov0neqq&&i=26&search="

[2011.03.02 15:33:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Valentino\AppData\Roaming\mozilla\Firefox\Profiles\ulkvod3r.default\extensions\nostmp

[2012.02.15 18:46:22 | 000,002,203 | ---- | M] () -- C:\Users\Valentino\AppData\Roaming\Mozilla\Firefox\Profiles\ulkvod3r.default\searchplugins\MyStart Search.xml

[2011.06.29 12:09:43 | 000,005,508 | ---- | M] () -- C:\Users\Valentino\AppData\Roaming\Mozilla\Firefox\Profiles\ulkvod3r.default\searchplugins\webde-suche.xml

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-21-3799775492-1617133738-1545146542-1009..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-21-3799775492-1617133738-1545146542-1009..\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{33a16769-91c4-11e0-99f3-00262d6044ad}\Shell - "" = AutoRun

O33 - MountPoints2\{33a16769-91c4-11e0-99f3-00262d6044ad}\Shell\AutoRun\command - "" = E:\NPSAI.exe

O33 - MountPoints2\{7f86954e-b689-11e0-916f-00262d6044ad}\Shell - "" = AutoRun

O33 - MountPoints2\{7f86954e-b689-11e0-916f-00262d6044ad}\Shell\AutoRun\command - "" = E:\LGAutoRun.exe

O33 - MountPoints2\{949a1249-2eba-11df-bbd7-0026c619f514}\Shell - "" = AutoRun

O33 - MountPoints2\{949a1249-2eba-11df-bbd7-0026c619f514}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{9eb5524b-0eda-11e1-911c-0026c619f514}\Shell - "" = AutoRun

O33 - MountPoints2\{9eb5524b-0eda-11e1-911c-0026c619f514}\Shell\AutoRun\command - "" = E:\AutoRun.exe

O33 - MountPoints2\{9eb55258-0eda-11e1-911c-0026c619f514}\Shell - "" = AutoRun

O33 - MountPoints2\{9eb55258-0eda-11e1-911c-0026c619f514}\Shell\AutoRun\command - "" = E:\AutoRun.exe

O33 - MountPoints2\{a5405344-2c42-11df-b8a7-00262d6044ad}\Shell - "" = AutoRun

O33 - MountPoints2\{a5405344-2c42-11df-b8a7-00262d6044ad}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{b0ea324a-29e5-11df-acfb-00262d6044ad}\Shell - "" = AutoRun

O33 - MountPoints2\{b0ea324a-29e5-11df-acfb-00262d6044ad}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{d835dd5a-29dd-11df-bba3-00262d6044ad}\Shell - "" = AutoRun

O33 - MountPoints2\{d835dd5a-29dd-11df-bba3-00262d6044ad}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{d835dd6a-29dd-11df-bba3-00262d6044ad}\Shell - "" = AutoRun

O33 - MountPoints2\{d835dd6a-29dd-11df-bba3-00262d6044ad}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{f4a9be5b-0fa9-11e1-a78d-0026c619f514}\Shell - "" = AutoRun

O33 - MountPoints2\{f4a9be5b-0fa9-11e1-a78d-0026c619f514}\Shell\AutoRun\command - "" = E:\AutoRun.exe

O33 - MountPoints2\{f4a9be6c-0fa9-11e1-a78d-0026c619f514}\Shell - "" = AutoRun

O33 - MountPoints2\{f4a9be6c-0fa9-11e1-a78d-0026c619f514}\Shell\AutoRun\command - "" = E:\AutoRun.exe

[2012.05.31 16:42:18 | 000,000,000 | -HSD | M] -- C:\Users\Valentino\AppData\Roaming\.#

[2012.02.15 18:45:09 | 000,000,000 | ---D | M] -- C:\Users\Valentino\AppData\Roaming\Babylon

@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:4D066AD2

@Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:AB689DEA

@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:1D32EC29

@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:93DE1838

@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:E1F04E8D

:Files

C:\Windows\SysNative\drivers\10ac98cb6b0d6f96.sys

:Commands

[purity]

[emptytemp]

[emptyflash]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Du danke Arne,

habs erst jetzt gelesen, da wir durch einen
Internetwechsel momentan kein Internetzugriff haben.
Antworte ich die notgedrungen über den PC eines Freundes.
Werden die OTL datei b.z.w. dessen Log sobald wie möglich
posten.

Gruß Cuba

Hey Arne,

bin wieder da :D
Der Internet Wechsel hat länger gedauert als geplant;
hbae erst seit gestern wieder Internet.
Werde dir den Log heute noch schicken.

Danke fürs Geduld haben :rolleyes:

Hier das LOG:

Code:

All processes killed

========== OTL ==========

Registry key HKEY_USERS\S-1-5-21-3799775492-1617133738-1545146542-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.

Registry key HKEY_USERS\S-1-5-21-3799775492-1617133738-1545146542-1000\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}\ not found.

Prefs.js: "MyStart Search" removed from browser.search.defaultenginename

Prefs.js: "hxxp://mystart.incredibar.com/mb119/?loc=IB_DS&a=6PQov0neqq&&i=26&search=" removed from keyword.URL

C:\Users\Valentino\AppData\Roaming\mozilla\Firefox\Profiles\ulkvod3r.default\extensions\nostmp\plugins folder moved successfully.

C:\Users\Valentino\AppData\Roaming\mozilla\Firefox\Profiles\ulkvod3r.default\extensions\nostmp\content folder moved successfully.

C:\Users\Valentino\AppData\Roaming\mozilla\Firefox\Profiles\ulkvod3r.default\extensions\nostmp folder moved successfully.

C:\Users\Valentino\AppData\Roaming\Mozilla\Firefox\Profiles\ulkvod3r.default\searchplugins\MyStart Search.xml moved successfully.

C:\Users\Valentino\AppData\Roaming\Mozilla\Firefox\Profiles\ulkvod3r.default\searchplugins\webde-suche.xml moved successfully.

Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3799775492-1617133738-1545146542-1009\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3799775492-1617133738-1545146542-1009\Software\Microsoft\Windows\CurrentVersion\RunOnce\\ScrSav deleted successfully.

C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\livecall\ deleted successfully.

File Protocol\Handler\livecall - No CLSID value found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ deleted successfully.

File Protocol\Handler\ms-help - No CLSID value found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-itss\ deleted successfully.

File Protocol\Handler\ms-itss - No CLSID value found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msnim\ deleted successfully.

File Protocol\Handler\msnim - No CLSID value found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype4com\ deleted successfully.

File Protocol\Handler\skype4com - No CLSID value found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlmailhtml\ deleted successfully.

File Protocol\Handler\wlmailhtml - No CLSID value found not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlpg\ deleted successfully.

File Protocol\Handler\wlpg - No CLSID value found not found.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33a16769-91c4-11e0-99f3-00262d6044ad}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33a16769-91c4-11e0-99f3-00262d6044ad}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33a16769-91c4-11e0-99f3-00262d6044ad}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33a16769-91c4-11e0-99f3-00262d6044ad}\ not found.

File E:\NPSAI.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7f86954e-b689-11e0-916f-00262d6044ad}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7f86954e-b689-11e0-916f-00262d6044ad}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7f86954e-b689-11e0-916f-00262d6044ad}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7f86954e-b689-11e0-916f-00262d6044ad}\ not found.

File E:\LGAutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{949a1249-2eba-11df-bbd7-0026c619f514}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{949a1249-2eba-11df-bbd7-0026c619f514}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{949a1249-2eba-11df-bbd7-0026c619f514}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{949a1249-2eba-11df-bbd7-0026c619f514}\ not found.

File E:\setup_vmc_lite.exe /checkApplicationPresence not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9eb5524b-0eda-11e1-911c-0026c619f514}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9eb5524b-0eda-11e1-911c-0026c619f514}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9eb5524b-0eda-11e1-911c-0026c619f514}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9eb5524b-0eda-11e1-911c-0026c619f514}\ not found.

File E:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9eb55258-0eda-11e1-911c-0026c619f514}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9eb55258-0eda-11e1-911c-0026c619f514}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9eb55258-0eda-11e1-911c-0026c619f514}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9eb55258-0eda-11e1-911c-0026c619f514}\ not found.

File E:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5405344-2c42-11df-b8a7-00262d6044ad}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5405344-2c42-11df-b8a7-00262d6044ad}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5405344-2c42-11df-b8a7-00262d6044ad}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5405344-2c42-11df-b8a7-00262d6044ad}\ not found.

File E:\setup_vmc_lite.exe /checkApplicationPresence not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b0ea324a-29e5-11df-acfb-00262d6044ad}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b0ea324a-29e5-11df-acfb-00262d6044ad}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b0ea324a-29e5-11df-acfb-00262d6044ad}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b0ea324a-29e5-11df-acfb-00262d6044ad}\ not found.

File E:\setup_vmc_lite.exe /checkApplicationPresence not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d835dd5a-29dd-11df-bba3-00262d6044ad}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d835dd5a-29dd-11df-bba3-00262d6044ad}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d835dd5a-29dd-11df-bba3-00262d6044ad}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d835dd5a-29dd-11df-bba3-00262d6044ad}\ not found.

File E:\setup_vmc_lite.exe /checkApplicationPresence not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d835dd6a-29dd-11df-bba3-00262d6044ad}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d835dd6a-29dd-11df-bba3-00262d6044ad}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d835dd6a-29dd-11df-bba3-00262d6044ad}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d835dd6a-29dd-11df-bba3-00262d6044ad}\ not found.

File F:\setup_vmc_lite.exe /checkApplicationPresence not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f4a9be5b-0fa9-11e1-a78d-0026c619f514}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f4a9be5b-0fa9-11e1-a78d-0026c619f514}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f4a9be5b-0fa9-11e1-a78d-0026c619f514}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f4a9be5b-0fa9-11e1-a78d-0026c619f514}\ not found.

File E:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f4a9be6c-0fa9-11e1-a78d-0026c619f514}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f4a9be6c-0fa9-11e1-a78d-0026c619f514}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f4a9be6c-0fa9-11e1-a78d-0026c619f514}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f4a9be6c-0fa9-11e1-a78d-0026c619f514}\ not found.

File E:\AutoRun.exe not found.

C:\Users\Valentino\AppData\Roaming\.# folder moved successfully.

C:\Users\Valentino\AppData\Roaming\Babylon folder moved successfully.

ADS C:\ProgramData\Temp:4D066AD2 deleted successfully.

ADS C:\ProgramData\Temp:AB689DEA deleted successfully.

ADS C:\ProgramData\Temp:1D32EC29 deleted successfully.

ADS C:\ProgramData\Temp:93DE1838 deleted successfully.

ADS C:\ProgramData\Temp:E1F04E8D deleted successfully.

========== FILES ==========

File move failed. C:\Windows\SysNative\drivers\10ac98cb6b0d6f96.sys scheduled to be moved on reboot.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: .BackupManager

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56475 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Public

 

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56475 bytes

 

User: Valentino

->Temp folder emptied: 8951266 bytes

->Temporary Internet Files folder emptied: 4724685 bytes

->Java cache emptied: 18137057 bytes

->FireFox cache emptied: 334652289 bytes

->Google Chrome cache emptied: 0 bytes

->Flash cache emptied: 2849602 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 2428680 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 419710 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 118161427 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 468,00 mb

 

 

[EMPTYFLASH]

 

User: .BackupManager

 

User: All Users

 

User: Default

->Flash cache emptied: 0 bytes

 

User: Default User

->Flash cache emptied: 0 bytes

 

User: Public

 

User: UpdatusUser

->Flash cache emptied: 0 bytes

 

User: Valentino

->Flash cache emptied: 0 bytes

 

Total Flash Files Cleaned = 0,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.46.1 log created on 07072012_085054
 

Files\Folders moved on Reboot...

File\Folder C:\Windows\SysNative\drivers\10ac98cb6b0d6f96.sys not found!

C:\Users\Valentino\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

File\Folder C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U0QUY724\results[3].htm not found!
 

Registry entries deleted on Reboot...

Hm, vier Wochen sind vergangen - nach so langer Zeit bitte einen neuen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

So fertig...

Code:

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.07.09.05
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Valentino :: VALENTINO-PC [Administrator]
 

09.07.2012 13:13:35

mbam-log-2012-07-09 (13-13-35).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 493194

Laufzeit: 1 Stunde(n), 2 Minute(n), 10 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 3

C:\Users\Valentino\3cel21f1px.exe (Rootkit.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Windows\Installer\{48bb494d-4e97-6edd-2dbd-5caf7f846375}\n (Trojan.Sirefef) -> Löschen bei Neustart.

C:\Windows\Installer\{48bb494d-4e97-6edd-2dbd-5caf7f846375}\U\800000cb.@ (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Log ist zu groß :D??

zippen und hier anhängen

Code:

15:56:54.0178 4392 10ac98cb6b0d6f96 ( LockedService.Multi.Generic ) - skipped by user

Diesen Eintrag => 10ac98cb6b0d6f96 <= bitte mit dem TDSS-Killer fixen. Aber bitte nur diesen Eintrag!
Starte Windows danach neu und mach wieder ein komplett neues Log mit dem TDSS-Killer. Wie immer wieder in CODE-Tags posten.

Wie fixt man denn etwas mit dem TDSS?

...oder meinst du damit einfach löschen?:D

So...
Log:

Code:

17:16:38.0571 0608        TDSS rootkit removing tool 2.7.45.0 Jul  9 2012 12:46:35

17:16:38.0743 0608        ============================================================

17:16:38.0743 0608        Current date / time: 2012/07/11 17:16:38.0743

17:16:38.0743 0608        SystemInfo:

17:16:38.0743 0608        

17:16:38.0743 0608        OS Version: 6.1.7601 ServicePack: 1.0

17:16:38.0743 0608        Product type: Workstation

17:16:38.0743 0608        ComputerName: VALENTINO-PC

17:16:38.0743 0608        UserName: Valentino

17:16:38.0743 0608        Windows directory: C:\Windows

17:16:38.0743 0608        System windows directory: C:\Windows

17:16:38.0743 0608        Running under WOW64

17:16:38.0743 0608        Processor architecture: Intel x64

17:16:38.0743 0608        Number of processors: 2

17:16:38.0743 0608        Page size: 0x1000

17:16:38.0743 0608        Boot type: Normal boot

17:16:38.0758 0608        ============================================================

17:16:40.0318 0608        Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

17:16:40.0318 0608        ============================================================

17:16:40.0318 0608        \Device\Harddisk0\DR0:

17:16:40.0318 0608        MBR partitions:

17:16:40.0318 0608        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1E70800, BlocksNum 0x32000

17:16:40.0334 0608        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1EA3000, BlocksNum 0x384E2830

17:16:40.0334 0608        ============================================================

17:16:40.0365 0608        C: <-> \Device\Harddisk0\DR0\Partition1

17:16:40.0365 0608        ============================================================

17:16:40.0365 0608        Initialize success

17:16:40.0365 0608        ============================================================

17:16:44.0873 1824        ============================================================

17:16:44.0873 1824        Scan started

17:16:44.0873 1824        Mode: Manual; SigCheck; TDLFS; 

17:16:44.0873 1824        ============================================================

17:16:45.0419 1824        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys

17:16:45.0544 1824        1394ohci - ok

17:16:45.0607 1824        acedrv11        (6ce02d42183cdf31315f208ae35f153f) C:\Windows\system32\drivers\acedrv11.sys

17:16:45.0685 1824        acedrv11 - ok

17:16:45.0747 1824        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys

17:16:45.0778 1824        ACPI - ok

17:16:45.0825 1824        AcpiPmi         (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys

17:16:45.0887 1824        AcpiPmi - ok

17:16:46.0012 1824        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

17:16:46.0028 1824        AdobeARMservice - ok

17:16:46.0184 1824        AdobeFlashPlayerUpdateSvc (990dc6edc9f933194d7cd4e65146bc94) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

17:16:46.0324 1824        AdobeFlashPlayerUpdateSvc - ok

17:16:46.0418 1824        adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys

17:16:46.0449 1824        adp94xx - ok

17:16:46.0511 1824        adpahci         (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys

17:16:46.0543 1824        adpahci - ok

17:16:46.0589 1824        adpu320         (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys

17:16:46.0621 1824        adpu320 - ok

17:16:46.0652 1824        AeLookupSvc     (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll

17:16:46.0777 1824        AeLookupSvc - ok

17:16:46.0855 1824        AFD             (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys

17:16:46.0948 1824        AFD - ok

17:16:47.0011 1824        AgereModemAudio (b65f8dba54f251906bbe8611b5a0e7ab) C:\Program Files\LSI SoftModem\agr64svc.exe

17:16:47.0057 1824        AgereModemAudio - ok

17:16:47.0151 1824        AgereSoftModem  (c98356d813b581e9c425b42a5d146ce0) C:\Windows\system32\DRIVERS\agrsm64.sys

17:16:47.0229 1824        AgereSoftModem - ok

17:16:47.0276 1824        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys

17:16:47.0291 1824        agp440 - ok

17:16:47.0338 1824        ALG             (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe

17:16:47.0385 1824        ALG - ok

17:16:47.0432 1824        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys

17:16:47.0432 1824        aliide - ok

17:16:47.0479 1824        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys

17:16:47.0494 1824        amdide - ok

17:16:47.0541 1824        AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys

17:16:47.0572 1824        AmdK8 - ok

17:16:47.0603 1824        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys

17:16:47.0635 1824        AmdPPM - ok

17:16:47.0697 1824        amdsata         (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys

17:16:47.0713 1824        amdsata - ok

17:16:47.0759 1824        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys

17:16:47.0791 1824        amdsbs - ok

17:16:47.0822 1824        amdxata         (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys

17:16:47.0837 1824        amdxata - ok

17:16:47.0900 1824        AppID           (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys

17:16:48.0056 1824        AppID - ok

17:16:48.0103 1824        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll

17:16:48.0149 1824        AppIDSvc - ok

17:16:48.0196 1824        Appinfo         (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll

17:16:48.0243 1824        Appinfo - ok

17:16:48.0399 1824        Apple Mobile Device (3debbecf665dcdde3a95d9b902010817) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

17:16:48.0415 1824        Apple Mobile Device - ok

17:16:48.0446 1824        arc             (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys

17:16:48.0461 1824        arc - ok

17:16:48.0477 1824        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys

17:16:48.0493 1824        arcsas - ok

17:16:48.0508 1824        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

17:16:48.0555 1824        AsyncMac - ok

17:16:48.0602 1824        atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys

17:16:48.0602 1824        atapi - ok

17:16:48.0664 1824        atksgt          (fc0e8778c000291caf60eb88c011e931) C:\Windows\system32\DRIVERS\atksgt.sys

17:16:48.0680 1824        atksgt - ok

17:16:48.0758 1824        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll

17:16:48.0836 1824        AudioEndpointBuilder - ok

17:16:48.0851 1824        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll

17:16:48.0883 1824        AudioSrv - ok

17:16:48.0929 1824        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll

17:16:49.0023 1824        AxInstSV - ok

17:16:49.0085 1824        b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys

17:16:49.0132 1824        b06bdrv - ok

17:16:49.0163 1824        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

17:16:49.0195 1824        b57nd60a - ok

17:16:49.0288 1824        BCM43XX         (9e84a931dbee0292e38ed672f6293a99) C:\Windows\system32\DRIVERS\bcmwl664.sys

17:16:49.0351 1824        BCM43XX - ok

17:16:49.0382 1824        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll

17:16:49.0444 1824        BDESVC - ok

17:16:49.0475 1824        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

17:16:49.0522 1824        Beep - ok

17:16:49.0616 1824        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll

17:16:49.0709 1824        BITS - ok

17:16:49.0741 1824        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys

17:16:49.0772 1824        blbdrive - ok

17:16:49.0850 1824        Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe

17:16:49.0881 1824        Bonjour Service - ok

17:16:49.0912 1824        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys

17:16:49.0943 1824        bowser - ok

17:16:49.0959 1824        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys

17:16:49.0990 1824        BrFiltLo - ok

17:16:49.0990 1824        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys

17:16:50.0021 1824        BrFiltUp - ok

17:16:50.0053 1824        Browser         (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll

17:16:50.0115 1824        Browser - ok

17:16:50.0146 1824        Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

17:16:50.0209 1824        Brserid - ok

17:16:50.0209 1824        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

17:16:50.0240 1824        BrSerWdm - ok

17:16:50.0271 1824        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

17:16:50.0302 1824        BrUsbMdm - ok

17:16:50.0318 1824        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

17:16:50.0349 1824        BrUsbSer - ok

17:16:50.0365 1824        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys

17:16:50.0411 1824        BTHMODEM - ok

17:16:50.0458 1824        bthserv         (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll

17:16:50.0505 1824        bthserv - ok

17:16:50.0536 1824        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

17:16:50.0583 1824        cdfs - ok

17:16:50.0630 1824        cdrom           (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys

17:16:50.0661 1824        cdrom - ok

17:16:50.0708 1824        CertPropSvc     (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll

17:16:50.0755 1824        CertPropSvc - ok

17:16:50.0786 1824        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys

17:16:50.0801 1824        circlass - ok

17:16:50.0848 1824        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

17:16:50.0864 1824        CLFS - ok

17:16:51.0004 1824        CLKMSVC10_DB37F995 (524dc3807cb1746225f9d26add19c319) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\NavFilter\kmsvc.exe

17:16:51.0020 1824        CLKMSVC10_DB37F995 - ok

17:16:51.0098 1824        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

17:16:51.0160 1824        clr_optimization_v2.0.50727_32 - ok

17:16:51.0207 1824        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

17:16:51.0254 1824        clr_optimization_v2.0.50727_64 - ok

17:16:51.0363 1824        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

17:16:51.0441 1824        clr_optimization_v4.0.30319_32 - ok

17:16:51.0488 1824        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

17:16:51.0535 1824        clr_optimization_v4.0.30319_64 - ok

17:16:51.0628 1824        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys

17:16:51.0644 1824        CmBatt - ok

17:16:51.0675 1824        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys

17:16:51.0691 1824        cmdide - ok

17:16:51.0737 1824        CNG             (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys

17:16:51.0784 1824        CNG - ok

17:16:51.0800 1824        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys

17:16:51.0815 1824        Compbatt - ok

17:16:51.0862 1824        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys

17:16:51.0909 1824        CompositeBus - ok

17:16:51.0925 1824        COMSysApp - ok

17:16:52.0018 1824        cpuz135 - ok

17:16:52.0049 1824        crcdisk         (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys

17:16:52.0065 1824        crcdisk - ok

17:16:52.0143 1824        CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll

17:16:52.0205 1824        CryptSvc - ok

17:16:52.0268 1824        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll

17:16:52.0330 1824        DcomLaunch - ok

17:16:52.0393 1824        defragsvc       (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll

17:16:52.0455 1824        defragsvc - ok

17:16:52.0517 1824        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys

17:16:52.0564 1824        DfsC - ok

17:16:52.0658 1824        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll

17:16:52.0720 1824        Dhcp - ok

17:16:52.0736 1824        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

17:16:52.0783 1824        discache - ok

17:16:52.0829 1824        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys

17:16:52.0845 1824        Disk - ok

17:16:52.0923 1824        DKbFltr         (d5bcb77be83cf99f508943945d46343d) C:\Windows\syswow64\Drivers\DKbFltr.sys

17:16:52.0939 1824        DKbFltr - ok

17:16:53.0001 1824        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll

17:16:53.0063 1824        Dnscache - ok

17:16:53.0110 1824        dot3svc         (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll

17:16:53.0157 1824        dot3svc - ok

17:16:53.0219 1824        Dot4            (b42ed0320c6e41102fde0005154849bb) C:\Windows\system32\DRIVERS\Dot4.sys

17:16:53.0251 1824        Dot4 - ok

17:16:53.0313 1824        Dot4Print       (e9f5969233c5d89f3c35e3a66a52a361) C:\Windows\system32\drivers\Dot4Prt.sys

17:16:53.0344 1824        Dot4Print - ok

17:16:53.0375 1824        dot4usb         (fd05a02b0370bc3000f402e543ca5814) C:\Windows\system32\DRIVERS\dot4usb.sys

17:16:53.0407 1824        dot4usb - ok

17:16:53.0453 1824        DPS             (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll

17:16:53.0500 1824        DPS - ok

17:16:53.0531 1824        drmkaud         (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

17:16:53.0563 1824        drmkaud - ok

17:16:53.0625 1824        dump_wmimmc - ok

17:16:53.0719 1824        DXGKrnl         (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys

17:16:53.0750 1824        DXGKrnl - ok

17:16:53.0781 1824        EagleX64 - ok

17:16:53.0828 1824        EapHost         (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll

17:16:53.0875 1824        EapHost - ok

17:16:54.0077 1824        ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys

17:16:54.0140 1824        ebdrv - ok

17:16:54.0265 1824        EFS             (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe

17:16:54.0296 1824        EFS - ok

17:16:54.0421 1824        ehRecvr         (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe

17:16:54.0514 1824        ehRecvr - ok

17:16:54.0545 1824        ehSched         (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe

17:16:54.0623 1824        ehSched - ok

17:16:54.0701 1824        elxstor         (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys

17:16:54.0733 1824        elxstor - ok

17:16:54.0857 1824        ePowerSvc       (c75ce2e262fee152f43c230d59f92dae) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe

17:16:54.0889 1824        ePowerSvc - ok

17:16:55.0029 1824        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys

17:16:55.0060 1824        ErrDev - ok

17:16:55.0107 1824        EventSystem     (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll

17:16:55.0185 1824        EventSystem - ok

17:16:55.0201 1824        ewusbnet - ok

17:16:55.0232 1824        exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

17:16:55.0294 1824        exfat - ok

17:16:55.0325 1824        fastfat         (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

17:16:55.0388 1824        fastfat - ok

17:16:55.0466 1824        Fax             (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe

17:16:55.0513 1824        Fax - ok

17:16:55.0528 1824        fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys

17:16:55.0544 1824        fdc - ok

17:16:55.0559 1824        fdPHost         (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll

17:16:55.0606 1824        fdPHost - ok

17:16:55.0622 1824        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll

17:16:55.0669 1824        FDResPub - ok

17:16:55.0700 1824        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

17:16:55.0715 1824        FileInfo - ok

17:16:55.0731 1824        Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

17:16:55.0778 1824        Filetrace - ok

17:16:55.0809 1824        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys

17:16:55.0825 1824        flpydisk - ok

17:16:55.0871 1824        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys

17:16:55.0918 1824        FltMgr - ok

17:16:56.0059 1824        FontCache       (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll

17:16:56.0137 1824        FontCache - ok

17:16:56.0183 1824        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

17:16:56.0215 1824        FontCache3.0.0.0 - ok

17:16:56.0277 1824        FPSensor        (44c86363d4673688e61f3c096b511811) C:\Windows\system32\Drivers\FPSensor.sys

17:16:56.0308 1824        FPSensor - ok

17:16:56.0324 1824        FsDepends       (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

17:16:56.0339 1824        FsDepends - ok

17:16:56.0402 1824        fssfltr         (6c06701bf1db05405804d7eb610991ce) C:\Windows\system32\DRIVERS\fssfltr.sys

17:16:56.0402 1824        fssfltr - ok

17:16:56.0573 1824        fsssvc          (4ce9dac1518ff7e77bd213e6394b9d77) C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe

17:16:56.0620 1824        fsssvc - ok

17:16:56.0745 1824        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys

17:16:56.0761 1824        Fs_Rec - ok

17:16:56.0807 1824        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys

17:16:56.0839 1824        fvevol - ok

17:16:56.0885 1824        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys

17:16:56.0901 1824        gagp30kx - ok

17:16:56.0948 1824        GEARAspiWDM     (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

17:16:56.0948 1824        GEARAspiWDM - ok

17:16:57.0026 1824        gpsvc           (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll

17:16:57.0119 1824        gpsvc - ok

17:16:57.0260 1824        Greg_Service    (816fd5a6f3c2f3d600900096632fc60e) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

17:16:57.0322 1824        Greg_Service - ok

17:16:57.0416 1824        gupdate         (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

17:16:57.0431 1824        gupdate - ok

17:16:57.0478 1824        gupdatem        (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

17:16:57.0478 1824        gupdatem - ok

17:16:57.0572 1824        gusvc           (cc839e8d766cc31a7710c9f38cf3e375) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe

17:16:57.0603 1824        gusvc - ok

17:16:57.0728 1824        hamachi         (1e6438d4ea6e1174a3b3b1edc4de660b) C:\Windows\system32\DRIVERS\hamachi.sys

17:16:57.0743 1824        hamachi - ok

17:16:57.0915 1824        Hamachi2Svc     (21d24138b736983f6e23823e092e9428) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe

17:16:57.0962 1824        Hamachi2Svc - ok

17:16:58.0087 1824        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

17:16:58.0102 1824        hcw85cir - ok

17:16:58.0180 1824        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys

17:16:58.0211 1824        HdAudAddService - ok

17:16:58.0274 1824        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys

17:16:58.0305 1824        HDAudBus - ok

17:16:58.0352 1824        HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys

17:16:58.0367 1824        HidBatt - ok

17:16:58.0399 1824        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys

17:16:58.0414 1824        HidBth - ok

17:16:58.0445 1824        HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys

17:16:58.0492 1824        HidIr - ok

17:16:58.0523 1824        hidserv         (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll

17:16:58.0570 1824        hidserv - ok

17:16:58.0601 1824        hidshim         (93a55379cf5fbee665467f7216e23282) C:\Windows\system32\DRIVERS\hidshim.sys

17:16:58.0648 1824        hidshim - ok

17:16:58.0711 1824        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys

17:16:58.0726 1824        HidUsb - ok

17:16:58.0757 1824        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll

17:16:58.0820 1824        hkmsvc - ok

17:16:58.0851 1824        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll

17:16:58.0929 1824        HomeGroupListener - ok

17:16:58.0960 1824        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll

17:16:59.0007 1824        HomeGroupProvider - ok

17:16:59.0163 1824        hpqcxs08        (1dae5c46d42b02a6d5862e1482efb390) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll

17:16:59.0179 1824        hpqcxs08 ( UnsignedFile.Multi.Generic ) - warning

17:16:59.0179 1824        hpqcxs08 - detected UnsignedFile.Multi.Generic (1)

17:16:59.0225 1824        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys

17:16:59.0241 1824        HpSAMD - ok

17:16:59.0366 1824        HPSLPSVC        (7f57926169c1b8aba9274ea7d4b70f18) C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL

17:16:59.0381 1824        HPSLPSVC ( UnsignedFile.Multi.Generic ) - warning

17:16:59.0381 1824        HPSLPSVC - detected UnsignedFile.Multi.Generic (1)

17:16:59.0475 1824        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys

17:16:59.0522 1824        HTTP - ok

17:16:59.0569 1824        hwdatacard - ok

17:16:59.0600 1824        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys

17:16:59.0615 1824        hwpolicy - ok

17:16:59.0662 1824        hwusbdev - ok

17:16:59.0678 1824        hwusbfake - ok

17:16:59.0709 1824        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys

17:16:59.0725 1824        i8042prt - ok

17:16:59.0818 1824        IAANTMON        (7548066df68a8a1a56b043359f915f37) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

17:16:59.0849 1824        IAANTMON - ok

17:16:59.0881 1824        iaStor          (1d004cb1da6323b1f55caef7f94b61d9) C:\Windows\system32\DRIVERS\iaStor.sys

17:16:59.0896 1824        iaStor - ok

17:16:59.0943 1824        iaStorV         (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys

17:16:59.0974 1824        iaStorV - ok

17:17:00.0068 1824        IDriverT        (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

17:17:00.0115 1824        IDriverT ( UnsignedFile.Multi.Generic ) - warning

17:17:00.0115 1824        IDriverT - detected UnsignedFile.Multi.Generic (1)

17:17:00.0239 1824        idsvc           (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

17:17:00.0286 1824        idsvc - ok

17:17:00.0520 1824        IGBASVC         (8adb361c0931dca9a146698e628615fa) c:\Program Files (x86)\Acer Bio Protection\BASVC.exe

17:17:00.0567 1824        IGBASVC ( UnsignedFile.Multi.Generic ) - warning

17:17:00.0567 1824        IGBASVC - detected UnsignedFile.Multi.Generic (1)

17:17:00.0895 1824        igfx            (a87261ef1546325b559374f5689cf5bc) C:\Windows\system32\DRIVERS\igdkmd64.sys

17:17:01.0066 1824        igfx - ok

17:17:01.0160 1824        iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys

17:17:01.0175 1824        iirsp - ok

17:17:01.0269 1824        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll

17:17:01.0347 1824        IKEEXT - ok

17:17:01.0612 1824        IntcAzAudAddService (5f6a3ea5bd7ca861863a3a06cecc115c) C:\Windows\system32\drivers\RTKVHD64.sys

17:17:01.0675 1824        IntcAzAudAddService - ok

17:17:01.0799 1824        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys

17:17:01.0815 1824        intelide - ok

17:17:01.0846 1824        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys

17:17:01.0862 1824        intelppm - ok

17:17:01.0893 1824        IPBusEnum       (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll

17:17:01.0940 1824        IPBusEnum - ok

17:17:01.0987 1824        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys

17:17:02.0033 1824        IpFilterDriver - ok

17:17:02.0065 1824        IPMIDRV         (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys

17:17:02.0096 1824        IPMIDRV - ok

17:17:02.0158 1824        IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

17:17:02.0189 1824        IPNAT - ok

17:17:02.0314 1824        iPod Service    (ee4c2a137c7088911a8919effc9812e7) C:\Program Files\iPod\bin\iPodService.exe

17:17:02.0345 1824        iPod Service - ok

17:17:02.0392 1824        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

17:17:02.0423 1824        IRENUM - ok

17:17:02.0439 1824        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys

17:17:02.0455 1824        isapnp - ok

17:17:02.0501 1824        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys

17:17:02.0533 1824        iScsiPrt - ok

17:17:02.0564 1824        k57nd60a        (249ee2d26cb1530f3bede0ac8b9e3099) C:\Windows\system32\DRIVERS\k57nd60a.sys

17:17:02.0579 1824        k57nd60a - ok

17:17:02.0611 1824        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys

17:17:02.0611 1824        kbdclass - ok

17:17:02.0657 1824        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys

17:17:02.0673 1824        kbdhid - ok

17:17:02.0689 1824        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

17:17:02.0704 1824        KeyIso - ok

17:17:02.0767 1824        KMWDFILTER      (07071c1e3cd8f0f9114aac8b072ca1e5) C:\Windows\system32\DRIVERS\KMWDFILTER.sys

17:17:02.0782 1824        KMWDFILTER - ok

17:17:02.0813 1824        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys

17:17:02.0813 1824        KSecDD - ok

17:17:02.0860 1824        KSecPkg         (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys

17:17:02.0923 1824        KSecPkg - ok

17:17:02.0969 1824        ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

17:17:03.0016 1824        ksthunk - ok

17:17:03.0203 1824        KtmRm           (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll

17:17:03.0313 1824        KtmRm - ok

17:17:03.0860 1824        L1E             (2ac603c3188c704cfce353659aa7ad71) C:\Windows\system32\DRIVERS\L1E62x64.sys

17:17:03.0984 1824        L1E - ok

17:17:04.0031 1824        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll

17:17:04.0109 1824        LanmanServer - ok

17:17:04.0172 1824        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll

17:17:04.0234 1824        LanmanWorkstation - ok

17:17:04.0296 1824        LgBttPort       (174803f2eea3b22165dfe0e5a1f20685) C:\Windows\system32\DRIVERS\lgbtpt64.sys

17:17:04.0359 1824        LgBttPort - ok

17:17:04.0390 1824        lgbusenum       (565f93bb7c0361e61b3daea670c354d6) C:\Windows\system32\DRIVERS\lgbtbs64.sys

17:17:04.0406 1824        lgbusenum - ok

17:17:04.0452 1824        LGVMODEM        (abf477857b7ced873362ec92c6ce10a7) C:\Windows\system32\DRIVERS\lgvmdm64.sys

17:17:04.0484 1824        LGVMODEM - ok

17:17:04.0764 1824        lirsgt          (156ab2e56dc3ca0b582e3362e07cded7) C:\Windows\system32\DRIVERS\lirsgt.sys

17:17:04.0764 1824        lirsgt - ok

17:17:04.0827 1824        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

17:17:04.0858 1824        lltdio - ok

17:17:04.0952 1824        lltdsvc         (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll

17:17:05.0030 1824        lltdsvc - ok

17:17:05.0076 1824        lmhosts         (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll

17:17:05.0108 1824        lmhosts - ok

17:17:05.0186 1824        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys

17:17:05.0217 1824        LSI_FC - ok

17:17:05.0264 1824        LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys

17:17:05.0279 1824        LSI_SAS - ok

17:17:05.0310 1824        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys

17:17:05.0326 1824        LSI_SAS2 - ok

17:17:05.0342 1824        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys

17:17:05.0357 1824        LSI_SCSI - ok

17:17:05.0388 1824        luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

17:17:05.0435 1824        luafv - ok

17:17:05.0451 1824        lzneknns - ok

17:17:05.0482 1824        Mcx2Svc         (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll

17:17:05.0513 1824        Mcx2Svc - ok

17:17:05.0529 1824        megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys

17:17:05.0544 1824        megasas - ok

17:17:05.0576 1824        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys

17:17:05.0607 1824        MegaSR - ok

17:17:05.0638 1824        MMCSS           (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

17:17:05.0700 1824        MMCSS - ok

17:17:05.0732 1824        Modem           (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

17:17:05.0763 1824        Modem - ok

17:17:05.0794 1824        monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

17:17:05.0825 1824        monitor - ok

17:17:05.0888 1824        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys

17:17:05.0888 1824        mouclass - ok

17:17:05.0934 1824        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys

17:17:05.0981 1824        mouhid - ok

17:17:06.0137 1824        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys

17:17:06.0153 1824        mountmgr - ok

17:17:06.0449 1824        MozillaMaintenance (15d5398eed42c2504bb3d4fc875c15d1) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

17:17:06.0590 1824        MozillaMaintenance - ok

17:17:06.0668 1824        MpFilter        (94c66ededcdb6a126880472f9a704d8e) C:\Windows\system32\DRIVERS\MpFilter.sys

17:17:06.0699 1824        MpFilter - ok

17:17:06.0777 1824        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys

17:17:06.0839 1824        mpio - ok

17:17:06.0917 1824        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

17:17:06.0948 1824        mpsdrv - ok

17:17:06.0980 1824        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys

17:17:07.0026 1824        MRxDAV - ok

17:17:07.0042 1824        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys

17:17:07.0120 1824        mrxsmb - ok

17:17:07.0182 1824        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys

17:17:07.0245 1824        mrxsmb10 - ok

17:17:07.0292 1824        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

17:17:07.0307 1824        mrxsmb20 - ok

17:17:07.0354 1824        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys

17:17:07.0370 1824        msahci - ok

17:17:07.0416 1824        msdsm           (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys

17:17:07.0432 1824        msdsm - ok

17:17:07.0479 1824        MSDTC           (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe

17:17:07.0526 1824        MSDTC - ok

17:17:07.0557 1824        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

17:17:07.0604 1824        Msfs - ok

17:17:07.0604 1824        mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

17:17:07.0650 1824        mshidkmdf - ok

17:17:07.0682 1824        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys

17:17:07.0697 1824        msisadrv - ok

17:17:07.0760 1824        MSiSCSI         (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll

17:17:07.0853 1824        MSiSCSI - ok

17:17:07.0853 1824        msiserver - ok

17:17:07.0900 1824        MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

17:17:07.0931 1824        MSKSSRV - ok

17:17:08.0040 1824        MsMpSvc         (59faaf2c83c8169ea20f9e335e418907) c:\Program Files\Microsoft Security Client\MsMpEng.exe

17:17:08.0056 1824        MsMpSvc - ok

17:17:08.0087 1824        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

17:17:08.0134 1824        MSPCLOCK - ok

17:17:08.0165 1824        MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

17:17:08.0212 1824        MSPQM - ok

17:17:08.0274 1824        MsRPC           (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys

17:17:08.0306 1824        MsRPC - ok

17:17:08.0399 1824        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys

17:17:08.0524 1824        mssmbios - ok

17:17:08.0586 1824        MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

17:17:08.0930 1824        MSTEE - ok

17:17:08.0976 1824        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys

17:17:09.0070 1824        MTConfig - ok

17:17:09.0132 1824        Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

17:17:09.0148 1824        Mup - ok

17:17:09.0179 1824        mwlPSDFilter    (6ffecc25b39dc7652a0cec0ada9db589) C:\Windows\system32\DRIVERS\mwlPSDFilter.sys

17:17:09.0179 1824        mwlPSDFilter - ok

17:17:09.0210 1824        mwlPSDNServ     (0befe32ca56d6ee89d58175725596a85) C:\Windows\system32\DRIVERS\mwlPSDNServ.sys

17:17:09.0210 1824        mwlPSDNServ - ok

17:17:09.0242 1824        mwlPSDVDisk     (d43bc633b8660463e446e28e14a51262) C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys

17:17:09.0242 1824        mwlPSDVDisk - ok

17:17:09.0366 1824        MWLService      (0f5faac852db4c340b7a2f187e3358b8) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe

17:17:09.0413 1824        MWLService - ok

17:17:09.0491 1824        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll

17:17:09.0569 1824        napagent - ok

17:17:09.0647 1824        NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

17:17:09.0678 1824        NativeWifiP - ok

17:17:09.0772 1824        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys

17:17:09.0819 1824        NDIS - ok

17:17:09.0850 1824        NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

17:17:09.0912 1824        NdisCap - ok

17:17:09.0928 1824        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

17:17:09.0975 1824        NdisTapi - ok

17:17:10.0022 1824        Ndisuio         (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys

17:17:10.0068 1824        Ndisuio - ok

17:17:10.0100 1824        NdisWan         (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys

17:17:10.0162 1824        NdisWan - ok

17:17:10.0193 1824        NDProxy         (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys

17:17:10.0224 1824        NDProxy - ok

17:17:10.0256 1824        NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

17:17:10.0302 1824        NetBIOS - ok

17:17:10.0349 1824        NetBT           (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys

17:17:10.0443 1824        NetBT - ok

17:17:10.0458 1824        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

17:17:10.0474 1824        Netlogon - ok

17:17:10.0536 1824        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll

17:17:10.0646 1824        Netman - ok

17:17:10.0677 1824        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll

17:17:10.0755 1824        netprofm - ok

17:17:10.0989 1824        netr7364        (81b8d0c1ce44a7fdbd596b693783950c) C:\Windows\system32\DRIVERS\netr7364.sys

17:17:11.0051 1824        netr7364 - ok

17:17:11.0207 1824        NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

17:17:11.0238 1824        NetTcpPortSharing - ok

17:17:11.0925 1824        NETw5s64        (4d85a450edef10c38882182753a49aae) C:\Windows\system32\DRIVERS\NETw5s64.sys

17:17:12.0159 1824        NETw5s64 - ok

17:17:12.0627 1824        netw5v64        (705283c02177809ca9fa7cc58a4f1e77) C:\Windows\system32\DRIVERS\netw5v64.sys

17:17:12.0814 1824        netw5v64 - ok

17:17:13.0516 1824        NETwNs64        (eb43840babf5589e33186d094de7381d) C:\Windows\system32\DRIVERS\NETwNs64.sys

17:17:13.0766 1824        NETwNs64 - ok

17:17:14.0031 1824        nfrd960         (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys

17:17:14.0046 1824        nfrd960 - ok

17:17:14.0140 1824        NisDrv          (91b4e0273d2f6c24ef845f2b41311289) C:\Windows\system32\DRIVERS\NisDrvWFP.sys

17:17:14.0156 1824        NisDrv - ok

17:17:14.0234 1824        NisSrv          (10a43829a9e606af3eef25a1c1665923) c:\Program Files\Microsoft Security Client\NisSrv.exe

17:17:14.0265 1824        NisSrv - ok

17:17:14.0343 1824        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll

17:17:14.0390 1824        NlaSvc - ok

17:17:14.0483 1824        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

17:17:14.0514 1824        Npfs - ok

17:17:14.0546 1824        npggsvc - ok

17:17:14.0546 1824        NPPTNT2 - ok

17:17:14.0577 1824        nsi             (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll

17:17:14.0624 1824        nsi - ok

17:17:14.0639 1824        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

17:17:14.0702 1824        nsiproxy - ok

17:17:14.0842 1824        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys

17:17:14.0889 1824        Ntfs - ok

17:17:15.0060 1824        NTI IScheduleSvc (70e3eb0cef795d348f05e5a9b115f491) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

17:17:15.0060 1824        NTI IScheduleSvc - ok

17:17:15.0107 1824        NTIBackupSvc    (fd324cce1d4d5bb5af65f8e55b462c7e) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

17:17:15.0123 1824        NTIBackupSvc - ok

17:17:15.0310 1824        NTIDrvr         (64ddd0dee976302f4bd93e5efcc2f013) C:\Windows\system32\drivers\NTIDrvr.sys

17:17:15.0310 1824        NTIDrvr - ok

17:17:15.0372 1824        NTISchedulerSvc (3f6268a2ec33cd38cf75c880af8ded42) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

17:17:15.0419 1824        NTISchedulerSvc - ok

17:17:15.0450 1824        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

17:17:15.0482 1824        Null - ok

17:17:15.0513 1824        nuvotonhidgeneric (d46faa5d102b065610c7cd5855e9c08b) C:\Windows\system32\DRIVERS\nuvotonhidgeneric.sys

17:17:15.0528 1824        nuvotonhidgeneric - ok

17:17:15.0591 1824        NVHDA           (102806b360d0e6bc6e55bf47ef655d43) C:\Windows\system32\drivers\nvhda64v.sys

17:17:15.0606 1824        NVHDA - ok

17:17:16.0589 1824        nvlddmkm        (ba0b4889c40380a01ecdf84c227a89c9) C:\Windows\system32\DRIVERS\nvlddmkm.sys

17:17:16.0823 1824        nvlddmkm - ok

17:17:16.0995 1824        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys

17:17:17.0010 1824        nvraid - ok

17:17:17.0073 1824        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys

17:17:17.0166 1824        nvstor - ok

17:17:17.0369 1824        nvsvc           (06633cf95bea62164c3bfca24bce6b11) C:\Windows\system32\nvvsvc.exe

17:17:17.0400 1824        nvsvc - ok

17:17:17.0525 1824        nvUpdatusService (53b629ce436b110c5689c2f6439e567b) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

17:17:17.0572 1824        nvUpdatusService - ok

17:17:17.0697 1824        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys

17:17:17.0712 1824        nv_agp - ok

17:17:17.0822 1824        odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

17:17:17.0900 1824        odserv - ok

17:17:17.0931 1824        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys

17:17:17.0962 1824        ohci1394 - ok

17:17:18.0009 1824        opfgjtvx - ok

17:17:18.0071 1824        ose             (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

17:17:18.0118 1824        ose - ok

17:17:18.0165 1824        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

17:17:18.0212 1824        p2pimsvc - ok

17:17:18.0258 1824        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll

17:17:18.0290 1824        p2psvc - ok

17:17:18.0321 1824        Parport         (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys

17:17:18.0336 1824        Parport - ok

17:17:18.0383 1824        partmgr         (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys

17:17:18.0399 1824        partmgr - ok

17:17:18.0430 1824        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll

17:17:18.0477 1824        PcaSvc - ok

17:17:18.0602 1824        PCDSRVC{2368CD8C-09CFBB81-06020101}_0 - ok

17:17:18.0617 1824        PCDSRVC{9368CD8C-1594248D-06020101}_0 - ok

17:17:18.0648 1824        PCDSRVC{A368CD8C-38F7D064-06020101}_0 - ok

17:17:18.0695 1824        pci             (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys

17:17:18.0726 1824        pci - ok

17:17:18.0758 1824        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys

17:17:18.0773 1824        pciide - ok

17:17:18.0820 1824        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys

17:17:18.0851 1824        pcmcia - ok

17:17:18.0867 1824        pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

17:17:18.0882 1824        pcw - ok

17:17:18.0945 1824        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

17:17:19.0038 1824        PEAUTH - ok

17:17:19.0101 1824        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe

17:17:19.0179 1824        PerfHost - ok

17:17:19.0366 1824        pla             (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll

17:17:19.0428 1824        pla - ok

17:17:19.0491 1824        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll

17:17:19.0522 1824        PlugPlay - ok

17:17:19.0553 1824        PNRPAutoReg     (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll

17:17:19.0569 1824        PNRPAutoReg - ok

17:17:19.0600 1824        PNRPsvc         (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

17:17:19.0616 1824        PNRPsvc - ok

17:17:19.0694 1824        PolicyAgent     (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll

17:17:19.0740 1824        PolicyAgent - ok

17:17:19.0787 1824        Power           (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll

17:17:19.0834 1824        Power - ok

17:17:19.0896 1824        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys

17:17:19.0943 1824        PptpMiniport - ok

17:17:19.0990 1824        Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys

17:17:20.0006 1824        Processor - ok

17:17:20.0037 1824        ProfSvc         (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll

17:17:20.0099 1824        ProfSvc - ok

17:17:20.0130 1824        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

17:17:20.0146 1824        ProtectedStorage - ok

17:17:20.0177 1824        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys

17:17:20.0240 1824        Psched - ok

17:17:20.0349 1824        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys

17:17:20.0396 1824        ql2300 - ok

17:17:20.0505 1824        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys

17:17:20.0536 1824        ql40xx - ok

17:17:20.0567 1824        QWAVE           (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll

17:17:20.0614 1824        QWAVE - ok

17:17:20.0614 1824        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

17:17:20.0661 1824        QWAVEdrv - ok

17:17:20.0676 1824        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

17:17:20.0723 1824        RasAcd - ok

17:17:20.0754 1824        RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

17:17:20.0786 1824        RasAgileVpn - ok

17:17:20.0801 1824        RasAuto         (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll

17:17:20.0848 1824        RasAuto - ok

17:17:20.0879 1824        Rasl2tp         (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys

17:17:20.0926 1824        Rasl2tp - ok

17:17:20.0973 1824        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll

17:17:21.0035 1824        RasMan - ok

17:17:21.0082 1824        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

17:17:21.0113 1824        RasPppoe - ok

17:17:21.0160 1824        RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

17:17:21.0207 1824        RasSstp - ok

17:17:21.0254 1824        rdbss           (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys

17:17:21.0316 1824        rdbss - ok

17:17:21.0332 1824        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys

17:17:21.0347 1824        rdpbus - ok

17:17:21.0363 1824        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

17:17:21.0410 1824        RDPCDD - ok

17:17:21.0441 1824        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

17:17:21.0488 1824        RDPENCDD - ok

17:17:21.0488 1824        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

17:17:21.0534 1824        RDPREFMP - ok

17:17:21.0550 1824        RDPWD           (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys

17:17:21.0628 1824        RDPWD - ok

17:17:21.0675 1824        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys

17:17:21.0706 1824        rdyboost - ok

17:17:21.0737 1824        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll

17:17:21.0784 1824        RemoteAccess - ok

17:17:21.0831 1824        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll

17:17:21.0893 1824        RemoteRegistry - ok

17:17:21.0909 1824        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll

17:17:21.0971 1824        RpcEptMapper - ok

17:17:21.0987 1824        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe

17:17:22.0002 1824        RpcLocator - ok

17:17:22.0049 1824        RpcSs           (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll

17:17:22.0096 1824        RpcSs - ok

17:17:22.0127 1824        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

17:17:22.0174 1824        rspndr - ok

17:17:22.0221 1824        RSUSBSTOR       (2db8116d52b19216812c4e6d5d837810) C:\Windows\System32\Drivers\RtsUStor.sys

17:17:22.0252 1824        RSUSBSTOR - ok

17:17:22.0346 1824        RS_Service      (b5a4b7d779cf4070df408de18bd33b02) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe

17:17:22.0361 1824        RS_Service ( UnsignedFile.Multi.Generic ) - warning

17:17:22.0377 1824        RS_Service - detected UnsignedFile.Multi.Generic (1)

17:17:22.0392 1824        RtsUIR - ok

17:17:22.0408 1824        SamSs           (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

17:17:22.0424 1824        SamSs - ok

17:17:22.0455 1824        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys

17:17:22.0470 1824        sbp2port - ok

17:17:22.0502 1824        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll

17:17:22.0564 1824        SCardSvr - ok

17:17:22.0595 1824        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys

17:17:22.0642 1824        scfilter - ok

17:17:22.0720 1824        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll

17:17:22.0798 1824        Schedule - ok

17:17:22.0829 1824        SCPolicySvc     (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll

17:17:22.0860 1824        SCPolicySvc - ok

17:17:22.0907 1824        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll

17:17:22.0954 1824        SDRSVC - ok

17:17:23.0063 1824        SeaPort         (16a252022535b680046f6e34e136d378) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

17:17:23.0094 1824        SeaPort - ok

17:17:23.0141 1824        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

17:17:23.0188 1824        secdrv - ok

17:17:23.0219 1824        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll

17:17:23.0266 1824        seclogon - ok

17:17:23.0297 1824        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll

17:17:23.0360 1824        SENS - ok

17:17:23.0375 1824        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll

17:17:23.0422 1824        SensrSvc - ok

17:17:23.0438 1824        Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys

17:17:23.0453 1824        Serenum - ok

17:17:23.0484 1824        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys

17:17:23.0516 1824        Serial - ok

17:17:23.0547 1824        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys

17:17:23.0562 1824        sermouse - ok

17:17:23.0609 1824        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll

17:17:23.0656 1824        SessionEnv - ok

17:17:23.0687 1824        sffdisk         (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys

17:17:23.0718 1824        sffdisk - ok

17:17:23.0718 1824        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys

17:17:23.0765 1824        sffp_mmc - ok

17:17:23.0781 1824        sffp_sd         (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys

17:17:23.0812 1824        sffp_sd - ok

17:17:23.0828 1824        sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys

17:17:23.0859 1824        sfloppy - ok

17:17:23.0906 1824        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll

17:17:23.0952 1824        ShellHWDetection - ok

17:17:23.0999 1824        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys

17:17:24.0015 1824        SiSRaid2 - ok

17:17:24.0015 1824        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys

17:17:24.0030 1824        SiSRaid4 - ok

17:17:24.0108 1824        SkypeUpdate     (579ba0a911ff5ea70cb604cd3b744b0a) C:\Program Files (x86)\Skype\Updater\Updater.exe

17:17:24.0124 1824        SkypeUpdate - ok

17:17:24.0155 1824        Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

17:17:24.0186 1824        Smb - ok

17:17:24.0218 1824        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe

17:17:24.0249 1824        SNMPTRAP - ok

17:17:24.0280 1824        spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

17:17:24.0296 1824        spldr - ok

17:17:24.0342 1824        Spooler         (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe

17:17:24.0389 1824        Spooler - ok

17:17:24.0608 1824        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe

17:17:24.0701 1824        sppsvc - ok

17:17:24.0810 1824        sppuinotify     (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll

17:17:24.0857 1824        sppuinotify - ok

17:17:24.0920 1824        srv             (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys

17:17:24.0998 1824        srv - ok

17:17:25.0044 1824        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys

17:17:25.0060 1824        srv2 - ok

17:17:25.0091 1824        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys

17:17:25.0138 1824        srvnet - ok

17:17:25.0169 1824        SSDPSRV         (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll

17:17:25.0247 1824        SSDPSRV - ok

17:17:25.0263 1824        SstpSvc         (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll

17:17:25.0310 1824        SstpSvc - ok

17:17:25.0341 1824        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys

17:17:25.0341 1824        stexstor - ok

17:17:25.0403 1824        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll

17:17:25.0434 1824        stisvc - ok

17:17:25.0466 1824        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys

17:17:25.0481 1824        swenum - ok

17:17:25.0544 1824        swprv           (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll

17:17:25.0606 1824        swprv - ok

17:17:25.0668 1824        SynTP           (bcf305959b53b200ceb2ad25ad22f8a7) C:\Windows\system32\DRIVERS\SynTP.sys

17:17:25.0684 1824        SynTP - ok

17:17:25.0824 1824        SysMain         (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll

17:17:25.0887 1824        SysMain - ok

17:17:26.0012 1824        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll

17:17:26.0043 1824        TabletInputService - ok

17:17:26.0090 1824        TapiSrv         (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll

17:17:26.0152 1824        TapiSrv - ok

17:17:26.0183 1824        TBS             (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll

17:17:26.0230 1824        TBS - ok

17:17:26.0370 1824        Tcpip           (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys

17:17:26.0417 1824        Tcpip - ok

17:17:26.0636 1824        TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys

17:17:26.0667 1824        TCPIP6 - ok

17:17:26.0760 1824        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys

17:17:26.0807 1824        tcpipreg - ok

17:17:26.0854 1824        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

17:17:26.0885 1824        TDPIPE - ok

17:17:26.0916 1824        TDTCP           (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys

17:17:26.0948 1824        TDTCP - ok

17:17:26.0994 1824        tdx             (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys

17:17:27.0041 1824        tdx - ok

17:17:27.0072 1824        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys

17:17:27.0088 1824        TermDD - ok

17:17:27.0150 1824        TermService     (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll

17:17:27.0228 1824        TermService - ok

17:17:27.0260 1824        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll

17:17:27.0291 1824        Themes - ok

17:17:27.0322 1824        THREADORDER     (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

17:17:27.0353 1824        THREADORDER - ok

17:17:27.0384 1824        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll

17:17:27.0431 1824        TrkWks - ok

17:17:27.0509 1824        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe

17:17:27.0603 1824        TrustedInstaller - ok

17:17:27.0650 1824        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys

17:17:27.0681 1824        tssecsrv - ok

17:17:27.0712 1824        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys

17:17:27.0759 1824        TsUsbFlt - ok

17:17:27.0806 1824        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys

17:17:27.0852 1824        tunnel - ok

17:17:27.0884 1824        txljuzky - ok

17:17:27.0899 1824        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys

17:17:27.0915 1824        uagp35 - ok

17:17:27.0946 1824        UBHelper        (2e22c1fd397a5a9ffef55e9d1fc96c00) C:\Windows\system32\drivers\UBHelper.sys

17:17:27.0962 1824        UBHelper - ok

17:17:28.0008 1824        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys

17:17:28.0055 1824        udfs - ok

17:17:28.0071 1824        UI0Detect       (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe

17:17:28.0102 1824        UI0Detect - ok

17:17:28.0133 1824        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys

17:17:28.0149 1824        uliagpkx - ok

17:17:28.0196 1824        umbus           (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys

17:17:28.0211 1824        umbus - ok

17:17:28.0242 1824        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys

17:17:28.0258 1824        UmPass - ok

17:17:28.0383 1824        Updater Service (70dde3a86dbeb1d6c3c30ad687b1877a) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

17:17:28.0414 1824        Updater Service - ok

17:17:28.0461 1824        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll

17:17:28.0523 1824        upnphost - ok

17:17:28.0601 1824        USBAAPL64       (aa33fc47ed58c34e6e9261e4f850b7eb) C:\Windows\system32\Drivers\usbaapl64.sys

17:17:28.0632 1824        USBAAPL64 - ok

17:17:28.0695 1824        usbaudio        (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys

17:17:28.0710 1824        usbaudio - ok

17:17:28.0742 1824        usbbus          (c85b8247fadd432fa54fe11667c8d97d) C:\Windows\system32\DRIVERS\lgx64bus.sys

17:17:28.0788 1824        usbbus - ok

17:17:28.0820 1824        usbccgp         (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys

17:17:28.0851 1824        usbccgp - ok

17:17:28.0851 1824        USBCCID - ok

17:17:28.0898 1824        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys

17:17:28.0913 1824        usbcir - ok

17:17:28.0944 1824        UsbDiag         (d8cdc12f5429878f23ddb3785a0fdf95) C:\Windows\system32\DRIVERS\lgx64diag.sys

17:17:28.0960 1824        UsbDiag - ok

17:17:28.0976 1824        usbehci         (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys

17:17:29.0007 1824        usbehci - ok

17:17:29.0054 1824        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys

17:17:29.0085 1824        usbhub - ok

17:17:29.0132 1824        USBModem        (79fa7a22b0f6f0082f640cbc82a00fce) C:\Windows\system32\DRIVERS\lgx64modem.sys

17:17:29.0163 1824        USBModem - ok

17:17:29.0178 1824        usbohci         (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys

17:17:29.0225 1824        usbohci - ok

17:17:29.0256 1824        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys

17:17:29.0288 1824        usbprint - ok

17:17:29.0319 1824        usbscan         (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys

17:17:29.0350 1824        usbscan - ok

17:17:29.0366 1824        USBSTOR         (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS

17:17:29.0412 1824        USBSTOR - ok

17:17:29.0459 1824        usbuhci         (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys

17:17:29.0475 1824        usbuhci - ok

17:17:29.0522 1824        usbvideo        (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys

17:17:29.0553 1824        usbvideo - ok

17:17:29.0568 1824        UxSms           (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll

17:17:29.0615 1824        UxSms - ok

17:17:29.0631 1824        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

17:17:29.0646 1824        VaultSvc - ok

17:17:29.0693 1824        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys

17:17:29.0693 1824        vdrvroot - ok

17:17:29.0756 1824        vds             (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe

17:17:29.0818 1824        vds - ok

17:17:29.0865 1824        vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

17:17:29.0880 1824        vga - ok

17:17:29.0896 1824        VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

17:17:29.0958 1824        VgaSave - ok

17:17:29.0990 1824        vhdmp           (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys

17:17:30.0021 1824        vhdmp - ok

17:17:30.0052 1824        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys

17:17:30.0068 1824        viaide - ok

17:17:30.0099 1824        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys

17:17:30.0114 1824        volmgr - ok

17:17:30.0161 1824        volmgrx         (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys

17:17:30.0192 1824        volmgrx - ok

17:17:30.0239 1824        volsnap         (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys

17:17:30.0255 1824        volsnap - ok

17:17:30.0302 1824        vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys

17:17:30.0333 1824        vsmraid - ok

17:17:30.0426 1824        VSS             (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe

17:17:30.0520 1824        VSS - ok

17:17:30.0645 1824        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys

17:17:30.0676 1824        vwifibus - ok

17:17:30.0692 1824        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys

17:17:30.0707 1824        vwififlt - ok

17:17:30.0754 1824        W32Time         (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll

17:17:30.0801 1824        W32Time - ok

17:17:30.0816 1824        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys

17:17:30.0848 1824        WacomPen - ok

17:17:30.0894 1824        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

17:17:30.0941 1824        WANARP - ok

17:17:30.0957 1824        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

17:17:30.0988 1824        Wanarpv6 - ok

17:17:31.0097 1824        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe

17:17:31.0175 1824        wbengine - ok

17:17:31.0300 1824        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll

17:17:31.0331 1824        WbioSrvc - ok

17:17:31.0378 1824        wcncsvc         (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll

17:17:31.0409 1824        wcncsvc - ok

17:17:31.0425 1824        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll

17:17:31.0456 1824        WcsPlugInService - ok

17:17:31.0503 1824        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys

17:17:31.0518 1824        Wd - ok

17:17:31.0565 1824        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

17:17:31.0596 1824        Wdf01000 - ok

17:17:31.0612 1824        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

17:17:31.0706 1824        WdiServiceHost - ok

17:17:31.0706 1824        WdiSystemHost   (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

17:17:31.0721 1824        WdiSystemHost - ok

17:17:31.0768 1824        WebClient       (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll

17:17:31.0815 1824        WebClient - ok

17:17:31.0862 1824        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll

17:17:31.0908 1824        Wecsvc - ok

17:17:31.0924 1824        wercplsupport   (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll

17:17:31.0986 1824        wercplsupport - ok

17:17:32.0018 1824        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll

17:17:32.0064 1824        WerSvc - ok

17:17:32.0127 1824        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

17:17:32.0158 1824        WfpLwf - ok

17:17:32.0174 1824        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

17:17:32.0189 1824        WIMMount - ok

17:17:32.0189 1824        WinHttpAutoProxySvc - ok

17:17:32.0267 1824        Winmgmt         (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll

17:17:32.0314 1824        Winmgmt - ok

17:17:32.0470 1824        WinRing0_1_2_0  (0c0195c48b6b8582fa6f6373032118da) C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys

17:17:32.0501 1824        WinRing0_1_2_0 - ok

17:17:32.0642 1824        WinRM           (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll

17:17:32.0735 1824        WinRM - ok

17:17:32.0876 1824        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys

17:17:32.0891 1824        WinUsb - ok

17:17:32.0969 1824        Wlansvc         (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll

17:17:33.0016 1824        Wlansvc - ok

17:17:33.0141 1824        wlcrasvc        (06c8fa1cf39de6a735b54d906ba791c6) C:\Program Files\Windows Live\Mesh\wlcrasvc.exe

17:17:33.0172 1824        wlcrasvc - ok

17:17:33.0344 1824        wlidsvc         (7e47c328fc4768cb8beafbcfafa70362) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

17:17:33.0406 1824        wlidsvc - ok

17:17:33.0546 1824        WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys

17:17:33.0562 1824        WmiAcpi - ok

17:17:33.0624 1824        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe

17:17:33.0687 1824        wmiApSrv - ok

17:17:33.0734 1824        WMPNetworkSvc - ok

17:17:33.0765 1824        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll

17:17:33.0780 1824        WPCSvc - ok

17:17:33.0812 1824        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll

17:17:33.0827 1824        WPDBusEnum - ok

17:17:33.0843 1824        ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

17:17:33.0905 1824        ws2ifsl - ok

17:17:33.0905 1824        WSearch - ok

17:17:34.0061 1824        wuauserv        (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll

17:17:34.0155 1824        wuauserv - ok

17:17:34.0280 1824        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys

17:17:34.0342 1824        WudfPf - ok

17:17:34.0389 1824        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys

17:17:34.0436 1824        WUDFRd - ok

17:17:34.0467 1824        wudfsvc         (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll

17:17:34.0514 1824        wudfsvc - ok

17:17:34.0545 1824        WwanSvc         (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll

17:17:34.0592 1824        WwanSvc - ok

17:17:34.0592 1824        xoswsodj - ok

17:17:34.0654 1824        xusb21          (2ee48cfce7ca8e0db4c44c7476c0943b) C:\Windows\system32\DRIVERS\xusb21.sys

17:17:34.0685 1824        xusb21 - ok

17:17:34.0779 1824        {49DE1C67-83F8-4102-99E0-C16DCC7EEC796} (74983addca2d9618512c088d856d6615) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl

17:17:34.0794 1824        {49DE1C67-83F8-4102-99E0-C16DCC7EEC796} - ok

17:17:34.0841 1824        MBR (0x1B8)     (9c51d3fd2697bd2ae931be1d6f1e6ffa) \Device\Harddisk0\DR0

17:17:35.0309 1824        \Device\Harddisk0\DR0 - ok

17:17:35.0309 1824        Boot (0x1200)   (7998124544346b9505a0842f82219fd9) \Device\Harddisk0\DR0\Partition0

17:17:35.0309 1824        \Device\Harddisk0\DR0\Partition0 - ok

17:17:35.0309 1824        Boot (0x1200)   (11bac5135706683c62b87d185a10adc2) \Device\Harddisk0\DR0\Partition1

17:17:35.0325 1824        \Device\Harddisk0\DR0\Partition1 - ok

17:17:35.0325 1824        ============================================================

17:17:35.0325 1824        Scan finished

17:17:35.0325 1824        ============================================================

17:17:35.0340 0688        Detected object count: 5

17:17:35.0340 0688        Actual detected object count: 5

17:17:40.0691 0688        hpqcxs08 ( UnsignedFile.Multi.Generic ) - skipped by user

17:17:40.0691 0688        hpqcxs08 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

17:17:40.0691 0688        HPSLPSVC ( UnsignedFile.Multi.Generic ) - skipped by user

17:17:40.0691 0688        HPSLPSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip 

17:17:40.0691 0688        IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

17:17:40.0691 0688        IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 

17:17:40.0691 0688        IGBASVC ( UnsignedFile.Multi.Generic ) - skipped by user

17:17:40.0691 0688        IGBASVC ( UnsignedFile.Multi.Generic ) - User select action: Skip 

17:17:40.0691 0688        RS_Service ( UnsignedFile.Multi.Generic ) - skipped by user

17:17:40.0691 0688        RS_Service ( UnsignedFile.Multi.Generic ) - User select action: Skip

So Echzeitschutz von MSE funtkioniert wieder ! (Danke!)
Die Firewall und der Defender melden immer noch Fehlermeldung...

Ja damit wird gemeint löschen (delete) oder cure (heilen) - je nachdem was davon zur Auswahl steht
Aber du hast es ja richtig gemacht :)

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Bitte...

Code:

# AdwCleaner v1.701 - Logfile created 07/11/2012 at 22:48:52

# Updated 02/07/2012 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Valentino - VALENTINO-PC

# Running from : C:\Users\Valentino\Desktop\adwcleaner.exe

# Option [Search]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 

Folder Found : C:\Users\Valentino\AppData\Local\Babylon

Folder Found : C:\ProgramData\Babylon

File Found : C:\Users\Public\Desktop\eBay.lnk

File Found : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
 

***** [Registry] *****
 

Key Found : HKCU\Software\Conduit

Key Found : HKCU\Software\IM

Key Found : HKCU\Software\ImInstaller

Key Found : HKCU\Software\Softonic

Key Found : HKLM\SOFTWARE\Babylon

Key Found : HKLM\SOFTWARE\Conduit

[x64] Key Found : HKCU\Software\Conduit

[x64] Key Found : HKCU\Software\IM

[x64] Key Found : HKCU\Software\ImInstaller

[x64] Key Found : HKCU\Software\Softonic
 

***** [Registre - GUID] *****
 

Key Found : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}

Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}

[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

[OK] Registry is clean.
 

-\\ Mozilla Firefox v13.0.1 (de)
 

Profile name : default 

File : C:\Users\Valentino\AppData\Roaming\Mozilla\Firefox\Profiles\ulkvod3r.default\prefs.js
 

Found : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");

Found : user_pref("extensions.BabylonToolbar_i.babExt", "");

Found : user_pref("extensions.BabylonToolbar_i.babTrack", "tt=090212_ctrl");

Found : user_pref("extensions.BabylonToolbar_i.hardId", "c46f7d1f0000000000000026c619f514");

Found : user_pref("extensions.BabylonToolbar_i.id", "c46f7d1f0000000000000026c619f514");

Found : user_pref("extensions.BabylonToolbar_i.instlDay", "15385");

Found : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");

Found : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");

Found : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");

Found : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");

Found : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");

Found : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");

Found : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");

Found : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1717:45:20");

Found : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");

Found : user_pref("extensions.efwbjkbewre83sfr3.scode", "(function(){var bdomains={\"search.babylon.com\":1,[...]

Found : user_pref("extensions.incredibar_i.aflt", "orgnl");

Found : user_pref("extensions.incredibar_i.dfltLng", "");

Found : user_pref("extensions.incredibar_i.did", "10606");

Found : user_pref("extensions.incredibar_i.excTlbr", "false");

Found : user_pref("extensions.incredibar_i.hardId", "c46f7d1f0000000000000026c619f514");

Found : user_pref("extensions.incredibar_i.id", "c46f7d1f0000000000000026c619f514");

Found : user_pref("extensions.incredibar_i.installerproductid", "26");

Found : user_pref("extensions.incredibar_i.instlDay", "15385");

Found : user_pref("extensions.incredibar_i.instlRef", "");

Found : user_pref("extensions.incredibar_i.ms_url_id", "");

Found : user_pref("extensions.incredibar_i.newTab", false);

Found : user_pref("extensions.incredibar_i.ppd", "20");

Found : user_pref("extensions.incredibar_i.prdct", "incredibar");

Found : user_pref("extensions.incredibar_i.productid", "26");

Found : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");

Found : user_pref("extensions.incredibar_i.smplGrp", "none");

Found : user_pref("extensions.incredibar_i.tlbrId", "base");

Found : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6PQov0neqq&loc=IB[...]

Found : user_pref("extensions.incredibar_i.upn2", "6PQov0neqq");

Found : user_pref("extensions.incredibar_i.upn2n", "92542380233242630");

Found : user_pref("extensions.incredibar_i.vrsn", "1.5.3.27");

Found : user_pref("extensions.incredibar_i.vrsnTs", "1.5.3.2717:46:28");

Found : user_pref("extensions.incredibar_i.vrsni", "1.5.3.27");
 

-\\ Google Chrome v [Unable to get version]
 

File : C:\Users\Valentino\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] File is clean.
 

*************************
 

AdwCleaner[R1].txt - [4572 octets] - [11/07/2012 22:48:52]
 

########## EOF - C:\AdwCleaner[R1].txt - [4700 octets] ##########

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Fertig :

Code:

# AdwCleaner v1.701 - Logfile created 07/12/2012 at 11:26:42

# Updated 02/07/2012 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Valentino - VALENTINO-PC

# Running from : C:\Users\Valentino\Desktop\Office\adwcleaner.exe

# Option [Delete]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 

Folder Deleted : C:\Users\Valentino\AppData\Local\Babylon

Folder Deleted : C:\ProgramData\Babylon

File Deleted : C:\Users\Public\Desktop\eBay.lnk

File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
 

***** [Registry] *****
 

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\IM

Key Deleted : HKCU\Software\ImInstaller

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKLM\SOFTWARE\Babylon

Key Deleted : HKLM\SOFTWARE\Conduit
 

***** [Registre - GUID] *****
 

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

[OK] Registry is clean.
 

-\\ Mozilla Firefox v13.0.1 (de)
 

Profile name : default 

File : C:\Users\Valentino\AppData\Roaming\Mozilla\Firefox\Profiles\ulkvod3r.default\prefs.js
 

C:\Users\Valentino\AppData\Roaming\Mozilla\Firefox\Profiles\ulkvod3r.default\user.js ... Deleted !
 

Deleted : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");

Deleted : user_pref("extensions.BabylonToolbar_i.babExt", "");

Deleted : user_pref("extensions.BabylonToolbar_i.babTrack", "tt=090212_ctrl");

Deleted : user_pref("extensions.BabylonToolbar_i.hardId", "c46f7d1f0000000000000026c619f514");

Deleted : user_pref("extensions.BabylonToolbar_i.id", "c46f7d1f0000000000000026c619f514");

Deleted : user_pref("extensions.BabylonToolbar_i.instlDay", "15385");

Deleted : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");

Deleted : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");

Deleted : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");

Deleted : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");

Deleted : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");

Deleted : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");

Deleted : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");

Deleted : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1717:45:20");

Deleted : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");

Deleted : user_pref("extensions.efwbjkbewre83sfr3.scode", "(function(){var bdomains={\"search.babylon.com\":1,[...]

Deleted : user_pref("extensions.incredibar_i.aflt", "orgnl");

Deleted : user_pref("extensions.incredibar_i.dfltLng", "");

Deleted : user_pref("extensions.incredibar_i.did", "10606");

Deleted : user_pref("extensions.incredibar_i.excTlbr", "false");

Deleted : user_pref("extensions.incredibar_i.hardId", "c46f7d1f0000000000000026c619f514");

Deleted : user_pref("extensions.incredibar_i.id", "c46f7d1f0000000000000026c619f514");

Deleted : user_pref("extensions.incredibar_i.installerproductid", "26");

Deleted : user_pref("extensions.incredibar_i.instlDay", "15385");

Deleted : user_pref("extensions.incredibar_i.instlRef", "");

Deleted : user_pref("extensions.incredibar_i.ms_url_id", "");

Deleted : user_pref("extensions.incredibar_i.newTab", false);

Deleted : user_pref("extensions.incredibar_i.ppd", "20");

Deleted : user_pref("extensions.incredibar_i.prdct", "incredibar");

Deleted : user_pref("extensions.incredibar_i.productid", "26");

Deleted : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");

Deleted : user_pref("extensions.incredibar_i.smplGrp", "none");

Deleted : user_pref("extensions.incredibar_i.tlbrId", "base");

Deleted : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6PQov0neqq&loc=IB[...]

Deleted : user_pref("extensions.incredibar_i.upn2", "6PQov0neqq");

Deleted : user_pref("extensions.incredibar_i.upn2n", "92542380233242630");

Deleted : user_pref("extensions.incredibar_i.vrsn", "1.5.3.27");

Deleted : user_pref("extensions.incredibar_i.vrsnTs", "1.5.3.2717:46:28");

Deleted : user_pref("extensions.incredibar_i.vrsni", "1.5.3.27");
 

-\\ Google Chrome v [Unable to get version]
 

File : C:\Users\Valentino\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] File is clean.
 

*************************
 

AdwCleaner[R1].txt - [4689 octets] - [11/07/2012 22:48:52]

AdwCleaner[S1].txt - [4495 octets] - [12/07/2012 11:26:42]
 

########## EOF - C:\AdwCleaner[S1].txt - [4623 octets] ##########

Gruß Cuba

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Schreck Firefox ging nicht :D
...läuft wieder:

Code:

ComboFix 12-07-12.02 - Valentino 12.07.2012  15:25:28.1.2 - x64

ausgeführt von:: c:\users\Valentino\Desktop\ComboFix.exe

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\Install.exe

c:\program files (x86)\Acer Bio Protection\PwdFilterV64.dll

c:\program files (x86)\Common Files\Acer GameZone online.ico

c:\programdata\100

c:\users\Valentino\AppData\Roaming\PCFix

c:\users\Valentino\AppData\Roaming\PCFix\log.dat

c:\users\Valentino\AppData\Roaming\PCFix\unresolvederrors.dat

c:\windows\Installer\{48bb494d-4e97-6edd-2dbd-5caf7f846375}\@

c:\windows\Installer\{48bb494d-4e97-6edd-2dbd-5caf7f846375}\U\00000001.@

c:\windows\Installer\{48bb494d-4e97-6edd-2dbd-5caf7f846375}\U\80000000.@

c:\windows\IsUn0407.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-06-12 bis 2012-07-12  ))))))))))))))))))))))))))))))

.

.

2012-07-12 13:40 . 2012-07-12 13:40        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp

2012-07-12 13:40 . 2012-07-12 13:40        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-07-11 21:20 . 2012-06-12 03:08        3148800        ----a-w-        c:\windows\system32\win32k.sys

2012-07-11 15:27 . 2012-06-06 06:06        2004480        ----a-w-        c:\windows\system32\msxml6.dll

2012-07-11 15:22 . 2012-05-31 04:04        9013136        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8FAC2E99-0DA4-40DD-80A1-DB5EE6272495}\mpengine.dll

2012-07-11 15:19 . 2012-06-02 22:19        2428952        ----a-w-        c:\windows\system32\wuaueng.dll

2012-07-11 15:19 . 2012-06-02 22:19        57880        ----a-w-        c:\windows\system32\wuauclt.exe

2012-07-11 15:19 . 2012-06-02 22:19        44056        ----a-w-        c:\windows\system32\wups2.dll

2012-07-11 15:19 . 2012-06-02 22:15        2622464        ----a-w-        c:\windows\system32\wucltux.dll

2012-07-11 15:19 . 2012-06-02 22:19        38424        ----a-w-        c:\windows\system32\wups.dll

2012-07-11 15:19 . 2012-06-02 22:19        701976        ----a-w-        c:\windows\system32\wuapi.dll

2012-07-11 15:19 . 2012-06-02 22:15        99840        ----a-w-        c:\windows\system32\wudriver.dll

2012-07-11 15:19 . 2012-06-02 13:19        186752        ----a-w-        c:\windows\system32\wuwebv.dll

2012-07-11 15:19 . 2012-06-02 13:15        36864        ----a-w-        c:\windows\system32\wuapp.exe

2012-07-11 15:13 . 2012-07-11 15:13        --------        d-----w-        C:\TDSSKiller_Quarantine

2012-07-07 06:50 . 2012-07-07 06:50        --------        d-----w-        C:\_OTL

2012-07-04 20:20 . 2012-02-09 11:17        927800        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4D3F7DB2-6724-40EE-94B8-C210800011BA}\gapaengine.dll

2012-07-04 20:09 . 2012-07-04 20:09        --------        d-----w-        c:\program files (x86)\LogMeIn Hamachi

2012-07-04 19:28 . 2012-07-04 19:28        --------        d-----w-        c:\users\Valentino\AppData\Local\Macromedia

2012-06-25 14:04 . 2012-06-25 14:04        1394248        ----a-w-        c:\windows\SysWow64\msxml4.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-07-12 12:22 . 2012-03-31 10:26        426184        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2012-07-12 12:22 . 2011-05-13 19:37        70344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-05-15 10:48 . 2012-05-26 08:11        68928        ----a-w-        c:\windows\system32\OpenCL.dll

2012-05-15 10:48 . 2012-05-26 08:11        61248        ----a-w-        c:\windows\SysWow64\OpenCL.dll

2012-05-15 10:48 . 2012-05-26 08:09        8105280        ----a-w-        c:\windows\SysWow64\nvwgf2um.dll

2012-05-15 10:48 . 2012-05-26 08:09        25743168        ----a-w-        c:\windows\system32\nvoglv64.dll

2012-05-15 10:48 . 2012-05-26 08:09        19607872        ----a-w-        c:\windows\SysWow64\nvoglv32.dll

2012-05-15 10:48 . 2012-05-26 08:09        1468224        ----a-w-        c:\windows\system32\nvgenco64.dll

2012-05-15 10:48 . 2012-05-26 08:09        14298944        ----a-w-        c:\windows\system32\drivers\nvlddmkm.sys

2012-05-15 10:48 . 2012-05-26 08:09        10194752        ----a-w-        c:\windows\system32\nvwgf2umx.dll

2012-05-15 10:48 . 2012-05-26 08:09        8139072        ----a-w-        c:\windows\system32\nvcuda.dll

2012-05-15 10:48 . 2012-05-26 08:09        5982528        ----a-w-        c:\windows\SysWow64\nvcuda.dll

2012-05-15 10:48 . 2012-05-26 08:09        2881856        ----a-w-        c:\windows\system32\nvcuvenc.dll

2012-05-15 10:48 . 2012-05-26 08:09        2681664        ----a-w-        c:\windows\system32\nvcuvid.dll

2012-05-15 10:48 . 2012-05-26 08:09        2524992        ----a-w-        c:\windows\SysWow64\nvcuvid.dll

2012-05-15 10:48 . 2012-05-26 08:09        2445120        ----a-w-        c:\windows\SysWow64\nvcuvenc.dll

2012-05-15 10:48 . 2012-05-26 08:09        18044224        ----a-w-        c:\windows\system32\nvd3dumx.dll

2012-05-15 10:48 . 2012-05-26 08:09        1738048        ----a-w-        c:\windows\system32\nvdispco64.dll

2012-05-15 10:48 . 2012-05-26 08:09        15322432        ----a-w-        c:\windows\SysWow64\nvd3dum.dll

2012-05-15 10:48 . 2012-05-26 08:09        2741568        ----a-w-        c:\windows\system32\nvapi64.dll

2012-05-15 10:48 . 2012-05-26 08:09        25248064        ----a-w-        c:\windows\system32\nvcompiler.dll

2012-05-15 10:48 . 2012-05-26 08:09        2368832        ----a-w-        c:\windows\SysWow64\nvapi.dll

2012-05-15 10:48 . 2012-05-26 08:09        17551680        ----a-w-        c:\windows\SysWow64\nvcompiler.dll

2012-05-15 09:29 . 2012-05-26 08:11        889664        ----a-w-        c:\windows\system32\nvvsvc.exe

2012-05-15 09:29 . 2012-05-26 08:11        63296        ----a-w-        c:\windows\system32\nvshext.dll

2012-05-15 09:29 . 2012-05-26 08:11        2561856        ----a-w-        c:\windows\system32\nvsvcr.dll

2012-05-15 09:29 . 2012-05-26 08:11        118080        ----a-w-        c:\windows\system32\nvmctray.dll

2012-05-15 09:29 . 2012-05-26 08:11        3149632        ----a-w-        c:\windows\system32\nvsvc64.dll

2012-05-15 09:28 . 2012-05-26 08:11        6151488        ----a-w-        c:\windows\system32\nvcpl.dll

2012-05-14 23:41 . 2012-06-03 10:41        8955792        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-05-09 13:04 . 2011-10-21 16:41        132832        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2012-05-09 10:21 . 2012-05-26 10:27        476936        ----a-w-        c:\windows\SysWow64\npdeployJava1.dll

2012-05-09 10:21 . 2010-05-13 21:03        472840        ----a-w-        c:\windows\SysWow64\deployJava1.dll

2012-05-08 17:02 . 2012-05-25 12:59        8955792        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{1D5277B7-7C80-4DB4-B734-1F0DF241C5F6}\mpengine.dll

2012-04-18 17:08 . 2012-05-26 08:09        31040        ----a-w-        c:\windows\system32\nvhdap64.dll

2012-04-18 17:08 . 2012-05-26 08:09        188736        ----a-w-        c:\windows\system32\drivers\nvhda64v.sys

2012-04-18 17:08 . 2012-03-07 16:50        1451840        ----a-w-        c:\windows\system32\nvhdagenco6420103.dll

2012-04-18 11:49 . 2012-05-05 10:29        405176        ----a-w-        c:\windows\SysWow64\Newtonsoft.Json.Net20.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2009-08-07 09:18        120104        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Facebook Update"="c:\users\Valentino\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"VitaKeyPdtWzd"="c:\program files (x86)\Acer Bio Protection\PdtWzd.exe" [2009-08-06 3564544]

"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-08-27 1200136]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2011-01-28 419112]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-06-27 1996200]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Acer VCM.lnk - c:\program files (x86)\Acer\Acer VCM\AcerVCM.exe [2009-10-30 708608]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R1 lzneknns;lzneknns;c:\windows\system32\drivers\lzneknns.sys [x]

R1 opfgjtvx;opfgjtvx;c:\windows\system32\drivers\opfgjtvx.sys [x]

R1 txljuzky;txljuzky;c:\windows\system32\drivers\txljuzky.sys [x]

R1 xoswsodj;xoswsodj;c:\windows\system32\drivers\xoswsodj.sys [x]

R2 CLKMSVC10_DB37F995;CyberLink Product - 2011/06/24 14:43;c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\NavFilter\kmsvc.exe [2011-01-28 241648]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-12-30 135664]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-05-03 158856]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 250056]

R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]

R3 dump_wmimmc;dump_wmimmc;c:\program files (x86)\gPotato.eu\FLYFF\GameGuard\dump_wmimmc.sys [x]

R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]

R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-12-30 135664]

R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]

R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [x]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-07 113120]

R3 netr7364;RT73 USB-Drahtlos-LAN-Kartentreiber für Vista;c:\windows\system32\DRIVERS\netr7364.sys [2009-06-10 707072]

R3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2009-09-15 6952960]

R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-05-14 5435904]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 98688]

R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]

R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]

R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-06-18 50432]

R3 PCDSRVC{2368CD8C-09CFBB81-06020101}_0;PCDSRVC{2368CD8C-09CFBB81-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\users\valent~1\appdata\local\temp\3sik2ckhhwpu\pcdrdiag\bin\pcdsrvc_x64.pkms [x]

R3 PCDSRVC{9368CD8C-1594248D-06020101}_0;PCDSRVC{9368CD8C-1594248D-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\users\valent~1\appdata\local\temp\.wxkevqymrwo\pcdrdiag\bin\pcdsrvc_x64.pkms [x]

R3 PCDSRVC{A368CD8C-38F7D064-06020101}_0;PCDSRVC{A368CD8C-38F7D064-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\users\valent~1\appdata\local\temp\hoizcqu2rueh\pcdrdiag\bin\pcdsrvc_x64.pkms [x]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [2009-06-05 216064]

R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-08-02 51712]

R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [2010-11-01 14544]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-03 22576]

S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-03 20016]

S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-03 60464]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};Power Control [2009/10/30 11:23];c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl [2009-08-04 20:45 146928]

S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2009-01-19 334344]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2009-08-18 796192]

S2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\Drivers\FPSensor.sys [2009-10-30 29184]

S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-06-04 1150496]

S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-06-27 2369960]

S2 IGBASVC;EgisTec Service;c:\program files (x86)\Acer Bio Protection\BASVC.exe [2009-08-06 3450368]

S2 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-08-07 311592]

S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-08-21 62720]

S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-06-18 144640]

S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-05-15 1262400]

S2 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [2009-07-10 253952]

S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]

S3 hidshim;Service for HID-KMDF Shim layer;c:\windows\system32\DRIVERS\hidshim.sys [2009-07-21 6656]

S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2009-06-20 317480]

S3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\DRIVERS\lgbtpt64.sys [2009-09-29 16384]

S3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbs64.sys [2009-09-29 14848]

S3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\DRIVERS\lgvmdm64.sys [2009-09-29 17408]

S3 NETwNs64;___ Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [2010-07-14 7821312]

S3 nuvotonhidgeneric;Nuvoton EC Generic HID;c:\windows\system32\DRIVERS\nuvotonhidgeneric.sys [2009-07-21 25088]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2012-04-18 188736]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

*Deregistered* - CLKMDRV10_DB37F995

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

hpdevmgmt        REG_MULTI_SZ           hpqcxs08

.

Inhalt des "geplante Tasks" Ordners

.

2012-07-12 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 12:22]

.

2012-07-12 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3799775492-1617133738-1545146542-1000Core.job

- c:\users\Valentino\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-03 11:23]

.

2012-07-12 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3799775492-1617133738-1545146542-1000UA.job

- c:\users\Valentino\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-03 11:23]

.

2012-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-12-30 20:28]

.

2012-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-12-30 20:28]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2009-08-07 09:19        137512        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"PLFSetI"="c:\windows\PLFSetI.exe" [2009-10-30 200704]

"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2009-08-18 496160]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-03-27 12459112]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]

"combofix"="c:\combofix\CF11889.3XE" [2010-11-20 345088]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

uLocal Page = c:\windows\system32\blank.htm

uDefault_Search_URL = hxxp://www.google.com/ie

mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7738&r=27361209z636l0398z115t6801w25p

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000

IE: Free YouTube to DVD Converter - c:\users\Valentino\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetodvdconverter.htm

IE: Free YouTube to iPod Converter - c:\users\Valentino\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm

IE: Free YouTube to Mp3 Converter - c:\users\Valentino\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files (x86)\ICQ7.6\ICQ.exe

FF - ProfilePath - c:\users\Valentino\AppData\Roaming\Mozilla\Firefox\Profiles\ulkvod3r.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/ig

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

SafeBoot-84448457.sys

SafeBoot-mcmscsvc

SafeBoot-MCODS

Toolbar-Locked - (no file)

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

.

.

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{2368CD8C-09CFBB81-06020101}_0]

"ImagePath"="\??\c:\users\valent~1\appdata\local\temp\3sik2ckhhwpu\pcdrdiag\bin\pcdsrvc_x64.pkms"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{9368CD8C-1594248D-06020101}_0]

"ImagePath"="\??\c:\users\valent~1\appdata\local\temp\.wxkevqymrwo\pcdrdiag\bin\pcdsrvc_x64.pkms"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{A368CD8C-38F7D064-06020101}_0]

"ImagePath"="\??\c:\users\valent~1\appdata\local\temp\hoizcqu2rueh\pcdrdiag\bin\pcdsrvc_x64.pkms"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]

"ImagePath"="\??\c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-3799775492-1617133738-1545146542-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:00,48,58,99,2c,b2,e1,09,c4,f5,00,fa,81,98,43,84,dd,91,71,16,3b,58,92,

   fc,1d,b7,9c,d0,a4,f0,49,e5,e4,c3,71,9f,8e,a9,5f,a4,26,e4,1e,dc,58,57,78,8f,\

"??"=hex:be,64,63,41,03,d7,80,ca,09,27,ae,25,89,33,20,48

.

[HKEY_USERS\S-1-5-21-3799775492-1617133738-1545146542-1000\Software\SecuROM\License information*]

"datasecu"=hex:3f,2a,ae,02,1e,33,aa,fd,0b,32,31,1b,84,4f,0b,56,43,55,d6,fb,96,

   b4,b7,43,7e,47,a5,90,10,a0,fe,e4,c4,70,20,20,cc,b7,31,b5,75,50,1f,8f,cc,d1,\

"rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Nico Mak Computing\WinZip]

"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Acer Bio Protection\CompPtcVUI.exe

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe

c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-07-12  15:59:13 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-07-12 13:59

.

Vor Suchlauf: 13 Verzeichnis(se), 397.176.696.832 Bytes frei

Nach Suchlauf: 23 Verzeichnis(se), 396.398.100.480 Bytes frei

.

- - End Of File - - 169FE5E164A0CBDE05E55252B53192D7

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

Driver::

c:\windows\system32\drivers\lzneknns.sys

c:\windows\system32\drivers\opfgjtvx.sys

c:\windows\system32\drivers\txljuzky.sys

c:\windows\system32\drivers\xoswsodj.sys
 

Driver::

lzneknns

opfgjtvx

txljuzky

xoswsodj

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

MSE Guard ist ausgestellt nur ComboFix meldet immer noch, dass er aktiviert sei?

Wenn der nicht aktiv ist kannst du diese Meldung ignorieren

So fertig:

Code:

ComboFix 12-07-12.02 - Valentino 12.07.2012  22:52:32.2.2 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4091.2829 [GMT 2:00]

ausgeführt von:: c:\users\Valentino\Documents\ComboFix.exe

Benutzte Befehlsschalter :: c:\users\Valentino\Desktop\CFScript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}

SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Service_lzneknns

-------\Service_opfgjtvx

-------\Service_txljuzky

-------\Service_xoswsodj

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-06-12 bis 2012-07-12  ))))))))))))))))))))))))))))))

.

.

2012-07-12 21:03 . 2012-07-12 21:03        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp

2012-07-12 21:03 . 2012-07-12 21:03        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-07-12 19:34 . 2012-05-31 04:04        9013136        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{59D666D6-A88D-4106-A92B-B7D04A84F195}\mpengine.dll

2012-07-11 21:20 . 2012-06-12 03:08        3148800        ----a-w-        c:\windows\system32\win32k.sys

2012-07-11 15:27 . 2012-06-06 06:06        2004480        ----a-w-        c:\windows\system32\msxml6.dll

2012-07-11 15:22 . 2012-05-31 04:04        9013136        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-07-11 15:19 . 2012-06-02 22:19        2428952        ----a-w-        c:\windows\system32\wuaueng.dll

2012-07-11 15:19 . 2012-06-02 22:19        57880        ----a-w-        c:\windows\system32\wuauclt.exe

2012-07-11 15:19 . 2012-06-02 22:19        44056        ----a-w-        c:\windows\system32\wups2.dll

2012-07-11 15:19 . 2012-06-02 22:15        2622464        ----a-w-        c:\windows\system32\wucltux.dll

2012-07-11 15:19 . 2012-06-02 22:19        38424        ----a-w-        c:\windows\system32\wups.dll

2012-07-11 15:19 . 2012-06-02 22:19        701976        ----a-w-        c:\windows\system32\wuapi.dll

2012-07-11 15:19 . 2012-06-02 22:15        99840        ----a-w-        c:\windows\system32\wudriver.dll

2012-07-11 15:19 . 2012-06-02 13:19        186752        ----a-w-        c:\windows\system32\wuwebv.dll

2012-07-11 15:19 . 2012-06-02 13:15        36864        ----a-w-        c:\windows\system32\wuapp.exe

2012-07-11 15:13 . 2012-07-11 15:13        --------        d-----w-        C:\TDSSKiller_Quarantine

2012-07-07 06:50 . 2012-07-07 06:50        --------        d-----w-        C:\_OTL

2012-07-04 20:20 . 2012-02-09 11:17        927800        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4D3F7DB2-6724-40EE-94B8-C210800011BA}\gapaengine.dll

2012-07-04 20:09 . 2012-07-04 20:09        --------        d-----w-        c:\program files (x86)\LogMeIn Hamachi

2012-07-04 19:28 . 2012-07-04 19:28        --------        d-----w-        c:\users\Valentino\AppData\Local\Macromedia

2012-06-25 14:04 . 2012-06-25 14:04        1394248        ----a-w-        c:\windows\SysWow64\msxml4.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-07-12 12:22 . 2012-03-31 10:26        426184        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2012-07-12 12:22 . 2011-05-13 19:37        70344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-05-15 10:48 . 2012-05-26 08:11        68928        ----a-w-        c:\windows\system32\OpenCL.dll

2012-05-15 10:48 . 2012-05-26 08:11        61248        ----a-w-        c:\windows\SysWow64\OpenCL.dll

2012-05-15 10:48 . 2012-05-26 08:09        8105280        ----a-w-        c:\windows\SysWow64\nvwgf2um.dll

2012-05-15 10:48 . 2012-05-26 08:09        25743168        ----a-w-        c:\windows\system32\nvoglv64.dll

2012-05-15 10:48 . 2012-05-26 08:09        19607872        ----a-w-        c:\windows\SysWow64\nvoglv32.dll

2012-05-15 10:48 . 2012-05-26 08:09        1468224        ----a-w-        c:\windows\system32\nvgenco64.dll

2012-05-15 10:48 . 2012-05-26 08:09        14298944        ----a-w-        c:\windows\system32\drivers\nvlddmkm.sys

2012-05-15 10:48 . 2012-05-26 08:09        10194752        ----a-w-        c:\windows\system32\nvwgf2umx.dll

2012-05-15 10:48 . 2012-05-26 08:09        8139072        ----a-w-        c:\windows\system32\nvcuda.dll

2012-05-15 10:48 . 2012-05-26 08:09        5982528        ----a-w-        c:\windows\SysWow64\nvcuda.dll

2012-05-15 10:48 . 2012-05-26 08:09        2881856        ----a-w-        c:\windows\system32\nvcuvenc.dll

2012-05-15 10:48 . 2012-05-26 08:09        2681664        ----a-w-        c:\windows\system32\nvcuvid.dll

2012-05-15 10:48 . 2012-05-26 08:09        2524992        ----a-w-        c:\windows\SysWow64\nvcuvid.dll

2012-05-15 10:48 . 2012-05-26 08:09        2445120        ----a-w-        c:\windows\SysWow64\nvcuvenc.dll

2012-05-15 10:48 . 2012-05-26 08:09        18044224        ----a-w-        c:\windows\system32\nvd3dumx.dll

2012-05-15 10:48 . 2012-05-26 08:09        1738048        ----a-w-        c:\windows\system32\nvdispco64.dll

2012-05-15 10:48 . 2012-05-26 08:09        15322432        ----a-w-        c:\windows\SysWow64\nvd3dum.dll

2012-05-15 10:48 . 2012-05-26 08:09        2741568        ----a-w-        c:\windows\system32\nvapi64.dll

2012-05-15 10:48 . 2012-05-26 08:09        25248064        ----a-w-        c:\windows\system32\nvcompiler.dll

2012-05-15 10:48 . 2012-05-26 08:09        2368832        ----a-w-        c:\windows\SysWow64\nvapi.dll

2012-05-15 10:48 . 2012-05-26 08:09        17551680        ----a-w-        c:\windows\SysWow64\nvcompiler.dll

2012-05-15 09:29 . 2012-05-26 08:11        889664        ----a-w-        c:\windows\system32\nvvsvc.exe

2012-05-15 09:29 . 2012-05-26 08:11        63296        ----a-w-        c:\windows\system32\nvshext.dll

2012-05-15 09:29 . 2012-05-26 08:11        2561856        ----a-w-        c:\windows\system32\nvsvcr.dll

2012-05-15 09:29 . 2012-05-26 08:11        118080        ----a-w-        c:\windows\system32\nvmctray.dll

2012-05-15 09:29 . 2012-05-26 08:11        3149632        ----a-w-        c:\windows\system32\nvsvc64.dll

2012-05-15 09:28 . 2012-05-26 08:11        6151488        ----a-w-        c:\windows\system32\nvcpl.dll

2012-05-09 13:04 . 2011-10-21 16:41        132832        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2012-05-09 10:21 . 2012-05-26 10:27        476936        ----a-w-        c:\windows\SysWow64\npdeployJava1.dll

2012-05-09 10:21 . 2010-05-13 21:03        472840        ----a-w-        c:\windows\SysWow64\deployJava1.dll

2012-05-08 17:02 . 2012-05-25 12:59        8955792        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{1D5277B7-7C80-4DB4-B734-1F0DF241C5F6}\mpengine.dll

2012-04-18 17:08 . 2012-05-26 08:09        31040        ----a-w-        c:\windows\system32\nvhdap64.dll

2012-04-18 17:08 . 2012-05-26 08:09        188736        ----a-w-        c:\windows\system32\drivers\nvhda64v.sys

2012-04-18 17:08 . 2012-03-07 16:50        1451840        ----a-w-        c:\windows\system32\nvhdagenco6420103.dll

2012-04-18 11:49 . 2012-05-05 10:29        405176        ----a-w-        c:\windows\SysWow64\Newtonsoft.Json.Net20.dll

.

.

(((((((((((((((((((((((((((((   SnapShot@2012-07-12_13.43.32   )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-08-22 05:15 . 2012-07-12 20:44        85934              c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin

+ 2009-07-14 05:10 . 2012-07-12 21:07        54006              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin

+ 2009-12-25 07:55 . 2012-07-12 21:07        29880              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3799775492-1617133738-1545146542-1000_UserData.bin

+ 2010-01-22 16:40 . 2012-07-12 15:16        3612              c:\windows\system32\wdi\ERCQueuedResolutions.dat

+ 2012-07-12 21:05 . 2012-07-12 21:05        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

- 2012-07-12 13:42 . 2012-07-12 13:42        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

+ 2012-07-12 21:05 . 2012-07-12 21:05        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

- 2012-07-12 13:42 . 2012-07-12 13:42        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

+ 2009-12-24 19:36 . 2012-07-12 18:47        343552              c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin

- 2009-07-14 02:36 . 2012-07-11 21:18        618370              c:\windows\system32\perfh009.dat

+ 2009-07-14 02:36 . 2012-07-12 20:46        618370              c:\windows\system32\perfh009.dat

- 2009-10-30 19:02 . 2012-07-11 21:18        656528              c:\windows\system32\perfh007.dat

+ 2009-10-30 19:02 . 2012-07-12 20:46        656528              c:\windows\system32\perfh007.dat

+ 2009-07-14 02:36 . 2012-07-12 20:46        107650              c:\windows\system32\perfc009.dat

- 2009-07-14 02:36 . 2012-07-11 21:18        107650              c:\windows\system32\perfc009.dat

- 2009-10-30 19:02 . 2012-07-11 21:18        131268              c:\windows\system32\perfc007.dat

+ 2009-10-30 19:02 . 2012-07-12 20:46        131268              c:\windows\system32\perfc007.dat

+ 2009-07-14 05:01 . 2012-07-12 21:04        417440              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

- 2009-07-14 05:01 . 2012-07-12 13:41        417440              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2010-09-17 15:07 . 2012-07-12 21:04        33173700              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3799775492-1617133738-1545146542-1000-8192.dat

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2009-08-07 09:18        120104        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Facebook Update"="c:\users\Valentino\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"VitaKeyPdtWzd"="c:\program files (x86)\Acer Bio Protection\PdtWzd.exe" [2009-08-06 3564544]

"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-08-27 1200136]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2011-01-28 419112]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-06-27 1996200]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Acer VCM.lnk - c:\program files (x86)\Acer\Acer VCM\AcerVCM.exe [2009-10-30 708608]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 CLKMSVC10_DB37F995;CyberLink Product - 2011/06/24 14:43;c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\NavFilter\kmsvc.exe [2011-01-28 241648]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-12-30 135664]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-05-03 158856]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 250056]

R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]

R3 dump_wmimmc;dump_wmimmc;c:\program files (x86)\gPotato.eu\FLYFF\GameGuard\dump_wmimmc.sys [x]

R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]

R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-12-30 135664]

R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]

R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [x]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-07 113120]

R3 netr7364;RT73 USB-Drahtlos-LAN-Kartentreiber für Vista;c:\windows\system32\DRIVERS\netr7364.sys [2009-06-10 707072]

R3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2009-09-15 6952960]

R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-05-14 5435904]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 98688]

R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]

R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]

R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-06-18 50432]

R3 PCDSRVC{2368CD8C-09CFBB81-06020101}_0;PCDSRVC{2368CD8C-09CFBB81-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\users\valent~1\appdata\local\temp\3sik2ckhhwpu\pcdrdiag\bin\pcdsrvc_x64.pkms [x]

R3 PCDSRVC{9368CD8C-1594248D-06020101}_0;PCDSRVC{9368CD8C-1594248D-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\users\valent~1\appdata\local\temp\.wxkevqymrwo\pcdrdiag\bin\pcdsrvc_x64.pkms [x]

R3 PCDSRVC{A368CD8C-38F7D064-06020101}_0;PCDSRVC{A368CD8C-38F7D064-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\users\valent~1\appdata\local\temp\hoizcqu2rueh\pcdrdiag\bin\pcdsrvc_x64.pkms [x]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [2009-06-05 216064]

R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-08-02 51712]

R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [2010-11-01 14544]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-03 22576]

S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-03 20016]

S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-03 60464]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};Power Control [2009/10/30 11:23];c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl [2009-08-04 20:45 146928]

S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2009-01-19 334344]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2009-08-18 796192]

S2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\Drivers\FPSensor.sys [2009-10-30 29184]

S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-06-04 1150496]

S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-06-27 2369960]

S2 IGBASVC;EgisTec Service;c:\program files (x86)\Acer Bio Protection\BASVC.exe [2009-08-06 3450368]

S2 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-08-07 311592]

S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-08-21 62720]

S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-06-18 144640]

S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-05-15 1262400]

S2 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [2009-07-10 253952]

S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]

S3 hidshim;Service for HID-KMDF Shim layer;c:\windows\system32\DRIVERS\hidshim.sys [2009-07-21 6656]

S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2009-06-20 317480]

S3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\DRIVERS\lgbtpt64.sys [2009-09-29 16384]

S3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbs64.sys [2009-09-29 14848]

S3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\DRIVERS\lgvmdm64.sys [2009-09-29 17408]

S3 NETwNs64;___ Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [2010-07-14 7821312]

S3 nuvotonhidgeneric;Nuvoton EC Generic HID;c:\windows\system32\DRIVERS\nuvotonhidgeneric.sys [2009-07-21 25088]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2012-04-18 188736]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*Deregistered* - CLKMDRV10_DB37F995

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

hpdevmgmt        REG_MULTI_SZ           hpqcxs08

.

Inhalt des "geplante Tasks" Ordners

.

2012-07-12 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 12:22]

.

2012-07-12 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3799775492-1617133738-1545146542-1000Core.job

- c:\users\Valentino\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-03 11:23]

.

2012-07-12 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3799775492-1617133738-1545146542-1000UA.job

- c:\users\Valentino\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-03 11:23]

.

2012-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-12-30 20:28]

.

2012-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-12-30 20:28]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2009-08-07 09:19        137512        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"PLFSetI"="c:\windows\PLFSetI.exe" [2009-10-30 200704]

"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2009-08-18 496160]

"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-03-27 12459112]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]

"combofix"="c:\combofix\CF1322.3XE" [2010-11-20 345088]

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

uLocal Page = c:\windows\system32\blank.htm

uDefault_Search_URL = hxxp://www.google.com/ie

mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7738&r=27361209z636l0398z115t6801w25p

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000

IE: Free YouTube to DVD Converter - c:\users\Valentino\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetodvdconverter.htm

IE: Free YouTube to iPod Converter - c:\users\Valentino\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm

IE: Free YouTube to Mp3 Converter - c:\users\Valentino\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files (x86)\ICQ7.6\ICQ.exe

TCP: DhcpNameServer = 192.168.178.1

FF - ProfilePath - c:\users\Valentino\AppData\Roaming\Mozilla\Firefox\Profiles\ulkvod3r.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/ig

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

.

.

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{2368CD8C-09CFBB81-06020101}_0]

"ImagePath"="\??\c:\users\valent~1\appdata\local\temp\3sik2ckhhwpu\pcdrdiag\bin\pcdsrvc_x64.pkms"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{9368CD8C-1594248D-06020101}_0]

"ImagePath"="\??\c:\users\valent~1\appdata\local\temp\.wxkevqymrwo\pcdrdiag\bin\pcdsrvc_x64.pkms"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{A368CD8C-38F7D064-06020101}_0]

"ImagePath"="\??\c:\users\valent~1\appdata\local\temp\hoizcqu2rueh\pcdrdiag\bin\pcdsrvc_x64.pkms"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]

"ImagePath"="\??\c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-3799775492-1617133738-1545146542-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:00,48,58,99,2c,b2,e1,09,c4,f5,00,fa,81,98,43,84,dd,91,71,16,3b,58,92,

   fc,1d,b7,9c,d0,a4,f0,49,e5,e4,c3,71,9f,8e,a9,5f,a4,26,e4,1e,dc,58,57,78,8f,\

"??"=hex:be,64,63,41,03,d7,80,ca,09,27,ae,25,89,33,20,48

.

[HKEY_USERS\S-1-5-21-3799775492-1617133738-1545146542-1000\Software\SecuROM\License information*]

"datasecu"=hex:3f,2a,ae,02,1e,33,aa,fd,0b,32,31,1b,84,4f,0b,56,43,55,d6,fb,96,

   b4,b7,43,7e,47,a5,90,10,a0,fe,e4,c4,70,20,20,cc,b7,31,b5,75,50,1f,8f,cc,d1,\

"rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Nico Mak Computing\WinZip]

"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Acer Bio Protection\CompPtcVUI.exe

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe

c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-07-12  23:11:58 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-07-12 21:11

ComboFix2.txt  2012-07-12 13:59

.

Vor Suchlauf: 22 Verzeichnis(se), 395.884.896.256 Bytes frei

Nach Suchlauf: 22 Verzeichnis(se), 395.577.954.304 Bytes frei

.

- - End Of File - - 85E73A777ED0092A0682EE6F968D26C8

Gruß Cuba

MSE geht wieder!!...Firewall geht wieder!!...Menüansichten gehen wieder!!...nur der Defender meldet noch den Fehlercode...
Schon mal vielen vielen vielen Dank man !! :D

Wüsste nicht was ich ohne deine Hilfe gemacht hätte...

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

GMER hat nicht wirklich funktioniert...
ABER hier die LOG-Datei von OSAM:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 22:12:03 on 13.07.2012
 

OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 64-bit

Default Browser: Mozilla Corporation Firefox 13.0.1
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"FacebookUpdateTaskUserS-1-5-21-3799775492-1617133738-1545146542-1000Core.job" - "Facebook Inc." - C:\Users\Valentino\AppData\Local\Facebook\Update\FacebookUpdate.exe

"FacebookUpdateTaskUserS-1-5-21-3799775492-1617133738-1545146542-1000UA.job" - "Facebook Inc." - C:\Users\Valentino\AppData\Local\Facebook\Update\FacebookUpdate.exe

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"acedrv11" (acedrv11) - "Protect Software GmbH" - C:\Windows\system32\drivers\acedrv11.sys

"atksgt" (atksgt) - ? - C:\Windows\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)

"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)

"cpuz135" (cpuz135) - ? - C:\Windows\TEMP\cpuz135\cpuz135_x64.sys  (File not found)

"dump_wmimmc" (dump_wmimmc) - ? - C:\Program Files (x86)\gPotato.eu\FLYFF\GameGuard\dump_wmimmc.sys  (File not found)

"EagleX64" (EagleX64) - ? - C:\Windows\system32\drivers\EagleX64.sys  (File not found)

"FssFltr" (fssfltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\fssfltr.sys

"Hamachi Network Interface" (hamachi) - "LogMeIn, Inc." - C:\Windows\System32\DRIVERS\hamachi.sys

"Huawei DataCard USB Fake" (hwusbfake) - ? - C:\Windows\System32\DRIVERS\ewusbfake.sys  (File not found)

"Huawei DataCard USB Modem and USB Serial" (hwdatacard) - ? - C:\Windows\System32\DRIVERS\ewusbmdm.sys  (File not found)

"Huawei DataCard USB PNP Device" (hwusbdev) - ? - C:\Windows\System32\DRIVERS\ewusbdev.sys  (File not found)

"HUAWEI USB-NDIS miniport" (ewusbnet) - ? - C:\Windows\System32\DRIVERS\ewusbnet.sys  (File not found)

"lirsgt" (lirsgt) - ? - C:\Windows\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)

"NPPTNT2" (NPPTNT2) - ? - C:\Windows\system32\npptNT2.sys  (File not found)

"NTIDrvr" (NTIDrvr) - "NewTech Infosystems, Inc." - C:\Windows\system32\drivers\NTIDrvr.sys

"PCDSRVC{2368CD8C-09CFBB81-06020101}_0 - PCDR Kernel Mode Service Helper Driver" (PCDSRVC{2368CD8C-09CFBB81-06020101}_0) - ? - c:\users\valent~1\appdata\local\temp\3sik2ckhhwpu\pcdrdiag\bin\pcdsrvc_x64.pkms  (File not found)

"PCDSRVC{9368CD8C-1594248D-06020101}_0 - PCDR Kernel Mode Service Helper Driver" (PCDSRVC{9368CD8C-1594248D-06020101}_0) - ? - c:\users\valent~1\appdata\local\temp\.wxkevqymrwo\pcdrdiag\bin\pcdsrvc_x64.pkms  (File not found)

"PCDSRVC{A368CD8C-38F7D064-06020101}_0 - PCDR Kernel Mode Service Helper Driver" (PCDSRVC{A368CD8C-38F7D064-06020101}_0) - ? - c:\users\valent~1\appdata\local\temp\hoizcqu2rueh\pcdrdiag\bin\pcdsrvc_x64.pkms  (File not found)

"Realtek IR Driver" (RtsUIR) - ? - C:\Windows\System32\DRIVERS\Rts516xIR.sys  (File not found)

"Realtek Smartcard Reader Driver" (USBCCID) - ? - C:\Windows\System32\DRIVERS\RtsUCcid.sys  (File not found)

"UBHelper" (UBHelper) - "NewTech Infosystems Corporation" - C:\Windows\system32\drivers\UBHelper.sys

"WinRing0_1_2_0" (WinRing0_1_2_0) - "OpenLibSys.org" - C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files (x86)\7-Zip\7-zip.dll

{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} "DragDropProtect Class" - "Egis Technology Inc." - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll

{8F9D8FBE-C5C1-4B65-986E-51235C9283E8} "FPLaunchCache" - "Egis Technology Inc." - c:\Program Files (x86)\Acer Bio Protection\FPLaunchCache.dll

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office12\ONFILTER.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{AE424E85-F6DF-4910-A6A9-438797986431} "OpenOffice.org Property Handler" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\propertyhdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll

{0563DB41-F538-4B37-A92D-4659049B7766} "WLMD Message Handler" - ? -   (File not found | COM-object registry key not found)

{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe
 

[Internet Explorer]

-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----

{555D4D79-4BD2-4094-A395-CFC534424A05} "{555D4D79-4BD2-4094-A395-CFC534424A05}" - ? -   (File not found | COM-object registry key not found)

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

ITBar7Height64 "ITBar7Height64" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout64" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

<binary data> "{21FA44EF-376D-4D53-9B0F-8A89D3229068}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_33" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab

{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} "Java Plug-in 1.6.0_33" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_33" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\npjpi160_33.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab

{233C1507-6A77-46A4-9443-F871F945D258} "Shockwave ActiveX Control" - "Adobe Systems, Inc." - C:\Windows\SysWow64\Adobe\Director\SwDir.dll / hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

{C345E174-3E87-4F41-A01C-B066A90A49B4} "{C345E174-3E87-4F41-A01C-B066A90A49B4}" - ? -   (File not found | COM-object registry key not found) / hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx

{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -   (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} "@C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "@C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

"ICQ7.6" - "ICQ, LLC." - C:\Program Files (x86)\ICQ7.6\ICQ.exe

"Quick-Launch Area" - "Egis Technology Inc." - c:\Program Files (x86)\Acer Bio Protection\PwdBank.exe

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL

{48E73304-E1D6-4330-914C-F5F514E3486C} "Send to OneNote" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

Locked "Locked" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

{21A88CB9-84D2-4020-A2D1-B25A21034884} "HistoryTriggerBHO Class" - "LG Electronics" - C:\Program Files (x86)\LG Electronics\LG PC Suite IV\LinkAir\LinkAirBrowserHelper.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID-Anmelde-Hilfsprogramm" - "Microsoft Corp." - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{9FDDE16B-836F-4806-AB1F-1455CBEFF289} "Windows Live Messenger Companion Helper" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

{02478D38-C3F9-4efb-9B51-7695ECA05670} "{02478D38-C3F9-4efb-9B51-7695ECA05670}" - ? -   (File not found | COM-object registry key not found)
 

[LSA Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----

"Security Packages" - "Microsoft Corp." - C:\Windows\system32\livessp.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Valentino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"Acer VCM.lnk" - "Acer Incorporated" - C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"Facebook Update" - "Facebook Inc." - "C:\Users\Valentino\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"ArcadeDeluxeAgent" - "CyberLink Corp." - "C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"

"LManager" - "Dritek System Inc." - C:\Program Files (x86)\Launch Manager\LManager.exe

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

"VitaKeyPdtWzd" - "Egis Technology Inc." - "c:\Program Files (x86)\Acer Bio Protection\PdtWzd.exe"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)

"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)

"@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243" (NisSrv) - "Microsoft Corporation" - c:\Program Files\Microsoft Security Client\NisSrv.exe

"Acer ePower Service" (ePowerSvc) - "Acer Incorporated" - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe

"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"CyberLink Product - 2011/06/24 14:43:43" (CLKMSVC10_DB37F995) - "CyberLink" - C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\NavFilter\kmsvc.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"EgisTec Service" (IGBASVC) - "Egis Technology Inc." - c:\Program Files (x86)\Acer Bio Protection\BASVC.exe

"Google Software Updater" (gusvc) - "Google" - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"GRegService" (Greg_Service) - "Acer Incorporated" - C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

"HP Network Devices Support" (HPSLPSVC) - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL

"hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"LogMeIn Hamachi Tunneling Engine" (Hamachi2Svc) - "LogMeIn Inc." - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe

"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Antimalware Service" (MsMpSvc) - "Microsoft Corporation" - c:\Program Files\Microsoft Security Client\MsMpEng.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"MyWinLocker Service" (MWLService) - "Egis Technology Inc." - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe

"nProtect GameGuard Service" (npggsvc) - ? - C:\Windows\system32\GameMon.des -service  (File not found)

"NTI Backup Now 5 Backup Service" (NTIBackupSvc) - "NewTech InfoSystems, Inc." - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

"NTI Backup Now 5 Scheduler Service" (NTISchedulerSvc) - "NewTech Infosystems, Inc." - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

"NTI IScheduleSvc" (NTI IScheduleSvc) - "NewTech Infosystems, Inc." - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe

"NVIDIA Update Service Daemon" (nvUpdatusService) - "NVIDIA Corporation" - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"Raw Socket Service" (RS_Service) - "Acer Incorporated" - C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe

"SeaPort" (SeaPort) - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files (x86)\Skype\Updater\Updater.exe

"Updater Service" (Updater Service) - "Acer" - C:\Program Files\Acer\Acer Updater\UpdaterService.exe

"Windows Live Family Safety Service" (fsssvc) - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe

"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files (x86)\Bonjour\mdnsNSP.dll

"WindowsLive Local NSP" - "Microsoft Corp." - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL

"WindowsLive NSP" - "Microsoft Corp." - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Und noch die LOG-Datei von Avast:

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-07-13 22:14:56

-----------------------------

22:14:56.824    OS Version: Windows x64 6.1.7601 Service Pack 1

22:14:56.839    Number of processors: 2 586 0x170A

22:14:56.839    ComputerName: VALENTINO-PC  UserName: Valentino

22:14:58.212    Initialize success

22:20:25.040    AVAST engine defs: 12071301

22:20:52.870    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

22:20:52.870    Disk 0 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 3

22:20:52.901    Disk 0 MBR read successfully

22:20:52.901    Disk 0 MBR scan

22:20:52.901    Disk 0 unknown MBR code

22:20:52.917    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS        12000 MB offset 2048

22:20:52.933    Disk 0 Partition 2 00     12  Compaq diag NTFS         3584 MB offset 24578048

22:20:52.948    Disk 0 Partition 3 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 31918080

22:20:52.948    Disk 0 Partition - 00     0F Extended LBA            461255 MB offset 32122880

22:20:52.964    Disk 0 Partition 4 00     07    HPFS/NTFS NTFS       461253 MB offset 32124928

22:20:52.979    Disk 0 scanning C:\Windows\system32\drivers

22:21:03.465    Service scanning

22:21:28.752    Modules scanning

22:21:29.267    Disk 0 trace - called modules:

22:21:29.298    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll 

22:21:29.298    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80057c1060]

22:21:29.314    3 CLASSPNP.SYS[fffff88001bd043f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80046fd050]

22:21:31.248    AVAST engine scan C:\Windows

22:21:35.101    AVAST engine scan C:\Windows\system32

22:24:37.138    AVAST engine scan C:\Windows\system32\drivers

22:24:51.256    AVAST engine scan C:\Users\Valentino

22:36:15.041    AVAST engine scan C:\ProgramData

22:37:58.625    Scan finished successfully

22:38:40.558    Disk 0 MBR has been saved successfully to "C:\Users\Valentino\Desktop\MBR.dat"

22:38:40.558    The log file has been saved successfully to "C:\Users\Valentino\Desktop\aswMBR.txt"

Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

:wtf: Was kann denn da alles gelöscht werden??

kurz: alles :)
Aber mach dir keine Sorgen, das das so schiefgeht ist äußerst selten und für den Fall der Fälle hast du ein Backup

Nochmal Hinweise zum Vollbackup:
Da gibt es mehrere Möglichkeiten. Das einfachste wäre es wohl alle Dateien und wichtigen persönlichen Ordner auf eine ext. Platte zu kopieren. Dann hast du deine Daten gesichert, zB nach einem Systemcrash kannst du Windows dann manuell sauber neu installieren und die Daten aus der einfachen manuellen Backupmethode einfach wieder zurückkopieren

Man kann aber auch Abbilder eines gesamten System (besser gesagt der gesamten Platte oder von einzelnen oder auch mehreren Partitionen erstellen), Denkanstoß hier => http://www.trojaner-board.de/115678-...r-backups.html

Wenn du eine Festplatte von WesternDigital oder Seagate hast, bekommst du ein AcronisTrueImage für lau (das aber ohne SecureZone soweit ich weiß, ich empfehle aber eh Images auf externe Platten, diese sollten nur angesteckt sein wenn man das Backup braucht bzw. ein Backup erstellen muss!)

WesternDigtal => http://filepony.de/download-acronis_...ge_wd_edition/
Seagate => http://filepony.de/download-seagate_discwizard/

Mit Windows7 hat man auch ein Bordmitteln für die Imageerstellung zB hier => [Anleitung] Komplettes Image-Backup (Systemabbild) von Windows 7 erstellen - Anleitungen / Tutorials / FAQ (Windows 7)

Gibt auch andere Programme, wie zB Drive Snapshot - Disk Image Backup leicht gemacht

Besitze leider keine Ext. Festplatte :D

Mir fällt gerade auf , dass der Defender den Fehlercode 0x80070005 meldet:O

Ist dein letzter Schritt zwingend notwendig, da wie bereits erwähnt keine externe Festplatte vorhanden ist?

Zitat:

Ist dein letzter Schritt zwingend notwendig, da wie bereits erwähnt keine externe Festplatte vorhanden ist?

Heißt also du hälst es nicht für notwendig Backups zu machen und hast es vorher auch noch nie für notwendig gehalten :balla:
Sry aber wenn du mal einen Dateisystem- oder Plattencrash hast sind solche Leute wie du die ja nie Backups machen die ersten die rumschreien und :heulen:

War nur noch nie erforderlich und ist mir noch nie passiert und noch nie in meinem Umfeld...
Klar ist so ein Backup äußerst nützlich, aber ehrlich gesagt habe ich noch nie über solch einen Crash nachgedacht.

Tja, wenn es mal passiert bist du angeschmiert
Es ist wirklich töricht keine backups zu machen, meist kommen Ausreden wie du sie gerade gepostet hast ("war noch nie notwendig" oder so)
Oft gelesen auch: "Ich pass schon auf" :stirn:

Es kann aber immer mal passieren, dass man versehentlich etwas löscht oder überschreibt oder Platten einfach kaputtgehen

Und dann ist das Geschrei groß, wie man die Daten wiederherstellt und so :headbang:

Ja stimmt ja, stimme Dir voll und ganz zu...habs gecheckt?
...Nur soll ich mir jetzt eine ext. Festplatte kaufen, denn am nächsten Sonntag bin ich für vier Wochen weg?

Ja wie willst du denn sonst große Datenmengen sichern?
Alles auf Sticks packen oder DVDs brennen? :balla: :confused:

Was ist dies denn für ein HILFStool, wenn unter Umständen einem geschadet wird?

Naja hilft ja nichts...wenn ich mir dann eine Festplatte zulege, bekommen wir den Virus bis Sonntag behoben?

Du willst es nicht verstehen, kann das sein? :balla:

Es geht darum, dass du für den Fall der Fälle deiner Daten sicherst! Es steht nirgendwo, dass der MBR-Fix auf jedem Fall schiefgeht :stirn:
Wenn dem so wäre hätte ich ein Plattmachen wohl schon in meiner ersten Antwort gepostet :headbang:

Ein einfaches Ja oder Nein hätte genügt und selbst wen Schäden enstehen ist dann ganz klar meine Schuld!

So hier gefixed:

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-07-16 18:34:26

-----------------------------

18:34:26.495    OS Version: Windows x64 6.1.7601 Service Pack 1

18:34:26.495    Number of processors: 2 586 0x170A

18:34:26.495    ComputerName: VALENTINO-PC  UserName: Valentino

18:34:28.492    Initialize success

18:36:36.423    AVAST engine defs: 12071600

18:37:13.311    Verifying

18:37:23.358    Disk 0 Windows 601 MBR fixed successfully

18:38:24.869    Disk 0 MBR has been saved successfully to "C:\Users\Valentino\Desktop\MBR.dat"

18:38:24.869    The log file has been saved successfully to "C:\Users\Valentino\Desktop\aswMBR.txt"

Und ein einfaches "ja ich mach eben schnell ein Backup" von dir wäre noch besser gewesen
Wenn nämlich die heißgeliebten Daten weg sind, artet das erfahrungsgemäß eher aus aber nun gut :pfeiff:

Du hast nur das FIxlog gepostet, ich wollte auch ein komplett neues Log von aswMBR sehen nachdem der MBR gefixt wurde

Hab ich in der ganzen Diskussion vergessen:crazy:

Kommt warscheinlich später.

P.S.: Hab nichts gegen Backups, die Frage war halt nur ob ich mir jetzt extra eine ext. Festplatte holen wollte, denn mein PC/Laptop ist nicht gerade der mit Daten vollgepackteste.

...hier noch die LOG-Datei:

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-07-17 14:53:03

-----------------------------

14:53:03.430    OS Version: Windows x64 6.1.7601 Service Pack 1

14:53:03.430    Number of processors: 2 586 0x170A

14:53:03.430    ComputerName: VALENTINO-PC  UserName: Valentino

14:53:05.239    Initialize success

14:53:12.696    AVAST engine defs: 12071600

14:53:21.089    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

14:53:21.104    Disk 0 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 3

14:53:21.120    Disk 0 MBR read successfully

14:53:21.120    Disk 0 MBR scan

14:53:21.120    Disk 0 Windows 7 default MBR code

14:53:21.136    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS        12000 MB offset 2048

14:53:21.151    Disk 0 Partition 2 00     12  Compaq diag NTFS         3584 MB offset 24578048

14:53:21.182    Disk 0 Partition 3 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 31918080

14:53:21.198    Disk 0 Partition - 00     0F Extended LBA            461255 MB offset 32122880

14:53:21.214    Disk 0 Partition 4 00     07    HPFS/NTFS NTFS       461253 MB offset 32124928

14:53:21.229    Disk 0 scanning C:\Windows\system32\drivers

14:53:36.050    Service scanning

14:54:06.487    Modules scanning

14:54:06.502    Disk 0 trace - called modules:

14:54:06.518    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll 

14:54:06.534    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80057e1060]

14:54:06.549    3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800473d050]

14:54:09.123    AVAST engine scan C:\Windows

14:54:18.047    AVAST engine scan C:\Windows\system32

14:57:55.421    AVAST engine scan C:\Windows\system32\drivers

14:58:09.851    AVAST engine scan C:\Users\Valentino

15:09:19.096    AVAST engine scan C:\ProgramData

15:10:57.907    Scan finished successfully

15:15:15.994    Disk 0 MBR has been saved successfully to "C:\Users\Valentino\Desktop\MBR.dat"

15:15:16.009    The log file has been saved successfully to "C:\Users\Valentino\Desktop\aswMBR.txt"

Gruß Cuba

Zitat:

denn mein PC/Laptop ist nicht gerade der mit Daten vollgepackteste.

Backups macht man sinnigerweise auf physikalisch andere Medien!

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Das ist mir schon klar...nur meinte ich damit, dass bei Datenverlusten ein nicht allzu großer Schaden enstehen würde.

1. MalwareBytes:

Code:

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org
 

Datenbank Version: v2012.07.17.08
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Valentino :: VALENTINO-PC [Administrator]
 

17.07.2012 16:25:20

mbam-log-2012-07-17 (16-25-20).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 510439

Laufzeit: 1 Stunde(n), 5 Minute(n), 4 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

2. Log kommt noch

so 2. auch fertig *puhh*

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 07/17/2012 at 07:58 PM
 

Application Version : 5.5.1006
 

Core Rules Database Version : 8912

Trace Rules Database Version: 6724
 

Scan type       : Complete Scan

Total Scan Time : 02:16:47
 

Operating System Information

Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Limited User
 

Memory items scanned      : 567

Memory threats detected   : 0

Registry items scanned    : 71452

Registry threats detected : 0

File items scanned        : 274845

File threats detected     : 147
 

Adware.Tracking Cookie

        accounts.youtube.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        accounts.google.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        accounts.google.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .eaeacom.112.2o7.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .amazon-adsystem.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .amazon-adsystem.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .rambler.ru [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        www.usenext.de [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .fastclick.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        track.zalando.de [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .specificclick.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adviva.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        media3.acmilan.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        media.gan-online.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .olympiaverlag.122.2o7.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .e-2dj6whmicgajibp.stats.esomniture.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .stats.paypal.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        track.adform.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .c1.atdmt.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        ad1.adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .yadro.ru [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .a.revenuemax.de [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .tracking.mindshare.de [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .zanox-affiliate.de [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .zanox.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        tomtailor.dyntracker.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        statse.webtrendslive.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .tracking.crealytics.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        ww251.smartadserver.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .fastclick.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .rambler.ru [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        ad4.adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        ad2.adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .guj.122.2o7.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        ad3.adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .unitymedia.de [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .unitymedia.de [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        track.adform.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

        .adform.net [ C:\USERS\VALENTINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ULKVOD3R.DEFAULT\COOKIES.SQLITE ]

Zitat:

dass bei Datenverlusten ein nicht allzu großer Schaden enstehen würde.

Wenn die Platte ausfällt und du hast ein "Backup" gemacht auf dieselbe physikalische Platte, wie soll da der Datenverlust nicht allzu groß sein :rofl:
Die Daten mitsamt dem Backup sind dann weg!

Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Man das ist mir klar, dass man andere Speichergeräte nimmt (Ext. Festplatte, USB-Sticks, DvD´s...) :DD

Naja nicht so wichtig ist ja nichts passiert.
Wollt mich nur recht herzlich bedanken, unter anderem für deine Geduld :D...denke über Spende nach, denn ihr leistet echt gute Arbeit ;)

Hab nur noch ein Problem mein Windows Defender meldet den Fehlercode 0x8007005?

und meine Computer läuft noch im Testmodus wie stellt man den aus?

Was ist ein Testmodus?
Was hindert dich daran nach diesem Fehlercode zu googlen?

Hat sich erledigt, der Testmodus ist für nicht digital signierte Software.Lag wahrscheinlich an den Scanner.

Entschuldigung das ich gefragt habe - bin ja schon dabei.

Dann sind wir ja soweit fertig...

Wollt dir nur nochmal ein großes Lob aussprechen ;)

Naja auch wenn der Fehler nicht normal ist, auf den Windows-Defender kann man wirklich verzichten

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.