Trojaner-Board - mspd Trojaner o.ä.

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - mspd Trojaner o.ä. (https://www.trojaner-board.de/119590-mspd-trojaner-o-ae.html)

mspd Trojaner o.ä.

Hallo Trojanerboard,

Nachdem t´john den Rechner von meinen Sohn so super bereinigt hat, hab ich jetzt mal auf meinen Rechner auch ein paar Scanner laufen lassen, weil er immer träger wird, im Internet manchmal richtig hängt und der Fingerscan wie von Geisterhand aufblinkt, als ob jemand eine Adminanforderung gestellt hätte und bestätigt wurde.

Hab dann mal in Autostart nachgeschaut, und eine mspd.exe gefunden, wo ich nicht weiss, was die macht. Nach Internetrecherchen hat es dann geheisen, das es eventuell ein Trojaner sein könnte.

Hab dann leider nicht widerstehen können und doch einige Scanner laufen lassen, welche auch einiges gefunden haben. Superantispyware hat mir dann unter anderem auch die mspd.exe angezeigt.

Ich hoffe ihr könnt mich bei meinen Problem auch unterstützen.

Anbei das Log von Gmer

Code:

GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2012-07-15 01:28:02

Windows 6.1.7601 Service Pack 1 Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-2 Hitachi_ rev.FB4O

Running: lwdcbtwt.exe; Driver: C:\Users\Bodo\AppData\Local\Temp\kwtdqpog.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            910D8B96                                                                                                                                          ZwCreateSection

SSDT            910D8BA0                                                                                                                                          ZwRequestWaitReplyPort

SSDT            910D8B9B                                                                                                                                          ZwSetContextThread

SSDT            910D8BA5                                                                                                                                          ZwSetSecurityObject

SSDT            910D8BAA                                                                                                                                          ZwSystemDebugControl

SSDT            910D8B37                                                                                                                                          ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 140D                                                                                                          8304A3C9 1 Byte  [06]

.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                                            83083D52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

.text           ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                                                                               8308AEAC 4 Bytes  [96, 8B, 0D, 91]

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                                                                               8308B208 4 Bytes  [A0, 8B, 0D, 91]

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                                                                               8308B24C 4 Bytes  [9B, 8B, 0D, 91]

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                                                                               8308B2C8 4 Bytes  [A5, 8B, 0D, 91]

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                                                                               8308B31C 4 Bytes  [AA, 8B, 0D, 91]

.text           ...                                                                                                                                               

.vmp2           C:\Windows\system32\drivers\acedrv11.sys                                                                                                          entry point in ".vmp2" section [0xA1A6D69D]

.text           D:\CyberLink\PowerDVD8\PowerDVD8\000.fcl                                                                                                          section is writeable [0xA1B68000, 0x2892, 0xE8000020]

.vmp2           D:\CyberLink\PowerDVD8\PowerDVD8\000.fcl                                                                                                          entry point in ".vmp2" section [0xA1B8B050]
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                                                           Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                                                           Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
 

Device          \Driver\ACPI_HAL \Device\00000053                                                                                                                 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
 

AttachedDevice  \Driver\tdx \Device\Tcp                                                                                                                           Lbd.sys (Boot Driver/Lavasoft AB)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                                                            rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                                                            hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                                                            rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                                                            hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                                                            rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                                                            hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                                                                            rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                                                                            hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume5                                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume5                                                                                                            rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume5                                                                                                            hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume6                                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume6                                                                                                            rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume6                                                                                                            hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume7                                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume7                                                                                                            rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume7                                                                                                            hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume8                                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume8                                                                                                            rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume8                                                                                                            hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

AttachedDevice  \FileSystem\fastfat \Fat                                                                                                                          fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000272b2235d                                                                       

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000272b2235d@0016b84829a2                                                          0x05 0xF2 0x21 0xB1 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000272b2235d@b0ec7109bdb9                                                          0xD4 0x5C 0x86 0x72 ...

Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000272b2235d (not active ControlSet)                                                   

Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000272b2235d@0016b84829a2                                                              0x05 0xF2 0x21 0xB1 ...

Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000272b2235d@b0ec7109bdb9                                                              0xD4 0x5C 0x86 0x72 ...

Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{91AE4577-AFD4-690D-A343-5C8E3C82B1F6}                                   

Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{91AE4577-AFD4-690D-A343-5C8E3C82B1F6}@pakejmagabfdeieggdbnmnhhpdkkkkgn  0x61 0x62 0x70 0x69 ...

Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{92C1845F-9629-E837-45B3-5CE2552BF71B}                                   

Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{92C1845F-9629-E837-45B3-5CE2552BF71B}@pahkcmcamhdadjfkagekbgbhjjogehob  0x61 0x62 0x6D 0x6F ...
 

---- EOF - GMER 1.0.15 ----

Nun das Log von Malwarebytes

Code:

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org
 

Datenbank Version: v2012.07.15.06
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 8.0.7601.17514

Bodo :: BODO-PC [Administrator]
 

15.07.2012 09:52:04

mbam-log-2012-07-15 (09-52-04).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 424065

Laufzeit: 2 Stunde(n), 23 Minute(n), 30 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Hier das log von eset

Code:

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org
 

Datenbank Version: v2012.07.15.06
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 8.0.7601.17514

Bodo :: BODO-PC [Administrator]
 

15.07.2012 09:52:04

mbam-log-2012-07-15 (09-52-04).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 424065

Laufzeit: 2 Stunde(n), 23 Minute(n), 30 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Den gefundenen Ordner von ESET hab ich schon gelöscht.

Hier die Log von adwcleaner

sorry, find das log nicht mehr

Hier das Log von Superantispyware

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 07/15/2012 at 09:31 PM
 

Application Version : 5.5.1006
 

Core Rules Database Version : 8902

Trace Rules Database Version: 6714
 

Scan type       : Complete Scan

Total Scan Time : 02:43:40
 

Operating System Information

Windows 7 Home Premium 32-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Administrator
 

Memory items scanned      : 833

Memory threats detected   : 0

Registry items scanned    : 35930

Registry threats detected : 1

File items scanned        : 185514

File threats detected     : 80
 

Adware.Tracking Cookie

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\6B4T9CWM.txt [ /fastclick.net ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\2R6DBYQ5.txt [ /tracking.quisma.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\3X96MEY5.txt [ /ad1.adfarm1.adition.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\UI45GQ7R.txt [ /mediaplex.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\Y1WC960K.txt [ /ad.zanox.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\VW01H9LA.txt [ /atdmt.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\OH10EEPB.txt [ /doubleclick.net ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\830B0ROW.txt [ /zanox-affiliate.de ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\09GKVWBL.txt [ /adfarm1.adition.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\VHRYBYRM.txt [ /track.adform.net ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\2VWOKTHE.txt [ /adbrite.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\IVEVKVXA.txt [ /apmebf.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\FK72IXFC.txt [ /zanox.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\7321EY1D.txt [ /pro-market.net ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\Y4O0SJCM.txt [ /www.zanox-affiliate.de ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\7DIEBN46.txt [ /dyntracker.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\GESDBPFI.txt [ /smartadserver.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\XX9PWKTM.txt [ /adform.net ]

        C:\USERS\BODO\AppData\Roaming\Microsoft\Windows\Cookies\Low\bodo@atdmt[2].txt [ Cookie:bodo@atdmt.com/ ]

        C:\USERS\BODO\Cookies\6B4T9CWM.txt [ Cookie:bodo@fastclick.net/ ]

        C:\USERS\BODO\Cookies\VW01H9LA.txt [ Cookie:bodo@atdmt.com/ ]

        C:\USERS\BODO\Cookies\OH10EEPB.txt [ Cookie:bodo@doubleclick.net/ ]

        C:\USERS\BODO\Cookies\2VWOKTHE.txt [ Cookie:bodo@adbrite.com/ ]

        C:\USERS\BODO\Cookies\IVEVKVXA.txt [ Cookie:bodo@apmebf.com/ ]

        C:\USERS\BODO\Cookies\FK72IXFC.txt [ Cookie:bodo@zanox.com/ ]

        C:\USERS\BODO\Cookies\7321EY1D.txt [ Cookie:bodo@pro-market.net/ ]

        C:\USERS\BODO\Cookies\Y4O0SJCM.txt [ Cookie:bodo@www.zanox-affiliate.de/ ]

        C:\USERS\BODO\Cookies\7DIEBN46.txt [ Cookie:bodo@dyntracker.com/ ]

        C:\USERS\BODO\Cookies\GESDBPFI.txt [ Cookie:bodo@smartadserver.com/ ]

        C:\USERS\BODO\Cookies\XX9PWKTM.txt [ Cookie:bodo@adform.net/ ]

        a.banner.t-online.de [ C:\USERS\BODO\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\F4GGDZES ]

        cdn1.eyewonder.com [ C:\USERS\BODO\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\F4GGDZES ]

        cdn5.specificclick.net [ C:\USERS\BODO\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\F4GGDZES ]

        piximedia.fr [ C:\USERS\BODO\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\F4GGDZES ]

        s0.2mdn.net [ C:\USERS\BODO\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\F4GGDZES ]

        serving-sys.com [ C:\USERS\BODO\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\F4GGDZES ]

        www.office-discount.de [ C:\USERS\BODO\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\F4GGDZES ]

        www.secmedia.de [ C:\USERS\BODO\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\F4GGDZES ]

        C:\USERS\BODO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\BODO@WW251.SMARTADSERVER[1].TXT [ /WW251.SMARTADSERVER ]

        .serving-sys.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .xiti.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        beacons.hottraffic.nl [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .deutschepostag.112.2o7.net [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        ww251.smartadserver.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        ad2.adfarm1.adition.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .bs.serving-sys.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]
 

Trojan.Agent/Gen-Malagent

        [mspd] C:\WINDOWS\SYSTEM32\MSPD.EXE

        C:\WINDOWS\SYSTEM32\MSPD.EXE
 

Trojan.Agent/Gen-Krpytik

        E:\SIERRA\UPBALL3\L0.DLL

        E:\SIERRA\UPBALL3\L1.DLL

        E:\SIERRA\UPBALL3\L4.DLL

        E:\SIERRA\UPBALL3\L5.DLL

        E:\SIERRA\UPBALL3\T0.DLL

        E:\SIERRA\UPBALL3\T2.DLL

        E:\SIERRA\UPBALL3\T3.DLL

        E:\SIERRA\UPBALL3\T4.DLL

        E:\SIERRA\UPBALL3\T5.DLL

        E:\SIERRA\UPBALL3\V0.DLL

        E:\SIERRA\UPBALL3\V1.DLL

        E:\SIERRA\UPBALL3\V2.DLL

        E:\SIERRA\UPBALL3\V3.DLL

        E:\SIERRA\UPBALL3\V4.DLL

        E:\SIERRA\UPBALL3\V5.DLL

Soll ich den Fund von Superantispyware jetzt erst mal so belassen, soll ich was löschen oder einfach schliessen?

Herzlichen Dank im voraus
Schöne Grüße Bodolino

Führ bitte auch ESET aus, danach sehen wir weiter.

Hinweis: ESET zeigt durchaus öfter ein paar Fehlalarme. Deswegen soll auch von ESET immer nur erst das Log gepostet und nichts entfernt werden.

ESET Online Scanner
Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.

Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt so öffnen: per Rechtsklick => als Administrator ausführen
Dein Anti-Virus-Programm während des Scans deaktivieren.

Button http://img695.imageshack.us/img695/1599/eset1l.jpg (<< klick) drücken.
- Firefox-User:
  Bitte esetsmartinstaller_enu.exe downloaden.Das Firefox-Addon auf dem Desktop speichern und dann installieren.
- IE-User:
  müssen das Installieren eines ActiveX Elements erlauben.
Setze den einen Haken bei Yes, i accept the Terms of Use.
Drücke den http://img707.imageshack.us/img707/687/starteg.jpg Button.
Warte bis die Komponenten herunter geladen wurden.
Setze einen Haken bei "Scan archives".
Gehe sicher das bei Remove Found Threats kein Hacken gesetzt ist.
http://img707.imageshack.us/img707/687/starteg.jpg drücken.
Die Signaturen werden herunter geladen.Der Scan beginnt automatisch.

Wenn der Scan beendet wurde

Klicke Finish.
Browser schließen.

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und kopiere folgenden Text in das Ausführen Fenster.

Code:

"%PROGRAMFILES%\Eset\Eset Online Scanner\log.txt"

Hinweis: Falls du ein 64-Bit-Windows einsetzt, lautet der Pfad so:

Code:

"%PROGRAMFILES(X86)%\Eset\Eset Online Scanner\log.txt"

Poste nun den Inhalt der log.txt.

Hey Arne,

danke für´s annehmen von meinen Problem.

Eset hab ich schon ausgeführt, hab gerade gesehen, das ich das falsche log gesendet habe.
Hier ist der log von gestern Nachmittag-Abend

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=2757e1de06e89f4f80ea6e0f284f8b5c

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-07-15 04:26:35

# local_time=2012-07-15 06:26:35 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1792 16777215 100 0 16644234 16644234 0 0

# compatibility_mode=5893 16776573 100 94 142712 93993317 0 0

# compatibility_mode=8192 67108863 100 0 89 89 0 0

# scanned=213642

# found=8

# cleaned=0

# scan_time=7468

D:\Bodo\Diverses\Adventskalender\OTR\tuerchen10-Dateien\a.htm        JS/Kryptik.CC trojan (unable to clean)        00000000000000000000000000000000        I

D:\Bodo\Diverses\Adventskalender\OTR\tuerchen14-Dateien\a.htm        JS/Kryptik.CC trojan (unable to clean)        00000000000000000000000000000000        I

D:\Bodo\Diverses\Adventskalender\OTR\tuerchen17-Dateien\a.htm        JS/Kryptik.CC trojan (unable to clean)        00000000000000000000000000000000        I

D:\Bodo\Diverses\Adventskalender\OTR\tuerchen18-Dateien\a.htm        JS/Kryptik.CC trojan (unable to clean)        00000000000000000000000000000000        I

D:\Bodo\Diverses\Adventskalender\OTR\tuerchen22-Dateien\a.htm        JS/Kryptik.CC trojan (unable to clean)        00000000000000000000000000000000        I

D:\Bodo\Diverses\Adventskalender\OTR\tuerchen23-Dateien\a.htm        JS/Kryptik.CC trojan (unable to clean)        00000000000000000000000000000000        I

D:\Bodo\Diverses\Adventskalender\OTR\tuerchen24-Dateien\a.htm        JS/Kryptik.CC trojan (unable to clean)        00000000000000000000000000000000        I

D:\Bodo\Diverses\Adventskalender\OTR\tuerchen9-Dateien\a.htm        JS/Kryptik.CC trojan (unable to clean)        00000000000000000000000000000000        I

Herzlichen Dank und schöne Grüße
Bodo

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Hallo Arne,

hier das log von AdwCleaner

# AdwCleaner v1.702 - Logfile created 07/17/2012 at 15:24:03
# Updated 13/07/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (32 bits)
# User : Bodo - BODO-PC
# Running from : C:\Users\Bodo\Desktop\adwcleaner.exe
# Option [Search]

***** [Services] *****

***** [Files / Folders] *****

***** [Registry] *****

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar

***** [Registre - GUID] *****

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

[OK] Registry is clean.

-\\ Mozilla Firefox v3.5 (de)

Profile name : default
File : C:\Users\Bodo\AppData\Roaming\Mozilla\Firefox\Profiles\dkvo1wf9.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [4308 octets] - [15/07/2012 18:35:35]
AdwCleaner[S1].txt - [4336 octets] - [15/07/2012 18:37:38]
AdwCleaner[R2].txt - [1065 octets] - [17/07/2012 15:22:08]
AdwCleaner[R3].txt - [997 octets] - [17/07/2012 15:24:03]

########## EOF - C:\AdwCleaner[R3].txt - [1124 octets] ##########

Ich hab übrigens gestern im Autostart die MSPD.exe deaktiviert, da ich schon fast nicht mehr arbeiten hab können. Seitdem läuft der Computer wieder zügiger und der Fingerscan hat seitdem auch nicht mehr unkontrolliert aufgeblinkt.

Soll ich die MSPD.exe im Autostart noch mal aktivieren und dann AdwCleaner durchlaufen lassen?

Danke und schöne Grüße
Bodo

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Hey Arne,

hier die log-Datei von AdwCleaner

Code:

# AdwCleaner v1.702 - Logfile created 07/18/2012 at 16:48:26

# Updated 13/07/2012 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (32 bits)

# User : Bodo - BODO-PC

# Running from : C:\Users\Bodo\Desktop\adwcleaner.exe

# Option [Delete]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 
 

***** [Registry] *****
 
 

***** [Registre - GUID] *****
 
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v8.0.7601.17514
 

[OK] Registry is clean.
 

-\\ Mozilla Firefox v3.5 (de)
 

Profile name : default 

File : C:\Users\Bodo\AppData\Roaming\Mozilla\Firefox\Profiles\dkvo1wf9.default\prefs.js
 

[OK] File is clean.
 

*************************
 

AdwCleaner[R1].txt - [4308 octets] - [15/07/2012 18:35:35]

AdwCleaner[S1].txt - [4336 octets] - [15/07/2012 18:37:38]

AdwCleaner[R2].txt - [1065 octets] - [17/07/2012 15:22:08]

AdwCleaner[R3].txt - [1125 octets] - [17/07/2012 15:24:03]

AdwCleaner[R4].txt - [1186 octets] - [17/07/2012 15:43:30]

AdwCleaner[S2].txt - [997 octets] - [18/07/2012 16:48:26]
 

########## EOF - C:\AdwCleaner[S2].txt - [1124 octets] ##########

Schöne Grüße und Danke schön
Bodo

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Hey Arne,

also ich find, das Windows wieder normal läuft, (bis auf das, das ich mal wieder meinen Computer entrümpeln müßte ) das einzige was mir auffällt wenn ich hier schreibe ist es etwas träge, sprich die Buchstaben erscheinen teilweise verspätet oder gar nicht, genauso wenn ich eine Web-Adresse eingib. Im Startmenü fällt mir jetzt nichts verdächtiges auf, müsste alles da sein. Ein Ordner ist leer (Arcade deluxe), aber ich könnt Dir jetzt gar nicht sagen, was da drin war (ich glaub Spiele) , also nichts wichtiges.

Die Funde von Superantispyware hab ich noch nicht entfernen lassen, sprich auch die MSPD.exe usw. Ich hab lediglich die MSPD im Autostart deaktiviert.

Herzlichen Dank für Deine Mühe.
Schöne Grüße und bis dann
Bodo

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Hey Arne,

log ist fertig

Code:

OTL logfile created on: 19.07.2012 18:12:22 - Run 1

OTL by OldTimer - Version 3.2.54.0     Folder = C:\Users\Bodo\Desktop

 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 2,02 Gb Available Physical Memory | 67,32% Memory free

5,99 Gb Paging File | 4,92 Gb Available in Paging File | 82,14% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 100,00 Gb Total Space | 69,44 Gb Free Space | 69,44% Space Free | Partition Type: NTFS

Drive D: | 60,00 Gb Total Space | 42,31 Gb Free Space | 70,52% Space Free | Partition Type: NTFS

Drive E: | 60,00 Gb Total Space | 58,77 Gb Free Space | 97,94% Space Free | Partition Type: NTFS

Drive F: | 77,00 Gb Total Space | 55,68 Gb Free Space | 72,31% Space Free | Partition Type: NTFS

Drive G: | 1,08 Gb Total Space | 1,07 Gb Free Space | 98,98% Space Free | Partition Type: FAT32

Drive H: | 195,00 Gb Total Space | 31,55 Gb Free Space | 16,18% Space Free | Partition Type: NTFS

Drive I: | 195,00 Gb Total Space | 51,02 Gb Free Space | 26,17% Space Free | Partition Type: NTFS

Drive J: | 75,76 Gb Total Space | 12,81 Gb Free Space | 16,90% Space Free | Partition Type: NTFS

 

Computer Name: BODO-PC | User Name: Bodo | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.07.19 18:08:43 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Bodo\Desktop\OTL.exe

PRC - [2012.05.09 06:27:45 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2012.05.09 06:27:44 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012.05.09 06:27:44 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2012.05.09 06:27:44 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2011.08.12 01:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programme\SUPERAntiSpyware\SASCore.exe

PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

PRC - [2011.03.31 16:35:56 | 000,605,344 | ---- | M] (Atheros Communications) -- D:\Bluetooth Suite\BtvStack.exe

PRC - [2011.03.31 16:35:52 | 000,519,328 | ---- | M] (Atheros Commnucations) -- D:\Bluetooth Suite\AthBtTray.exe

PRC - [2011.03.31 16:35:50 | 000,068,768 | ---- | M] (Atheros Commnucations) -- D:\Bluetooth Suite\AdminService.exe

PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2009.09.06 13:38:06 | 000,071,096 | ---- | M] () -- D:\CDBurnerXP\NMSAccessU.exe

PRC - [2009.09.05 10:16:54 | 003,452,928 | ---- | M] (Egis Technology Inc.) -- C:\Programme\Acer Bio Protection\BASVC.exe

PRC - [2009.09.05 10:16:40 | 003,407,360 | ---- | M] (Egis Technology Inc.) -- C:\Programme\Acer Bio Protection\CompPtcVUI.exe

PRC - [2009.07.28 17:07:42 | 000,073,528 | ---- | M] (AVM Berlin) -- D:\Fritzbox\FRITZ!DSL\IGDCTRL.EXE

PRC - [2009.07.20 13:30:50 | 000,813,584 | ---- | M] (Logitech, Inc.) -- D:\Maus\Logitech\SetPoint\SetPoint.exe

PRC - [2009.07.20 12:01:00 | 000,760,120 | ---- | M] (AVM Berlin) -- D:\Fritzbox\FRITZ!DSL\StCenter.exe

PRC - [2009.07.10 13:42:32 | 000,055,824 | ---- | M] (Logitech, Inc.) -- C:\Programme\Common Files\Logishrd\KHAL2\KHALMNPR.exe

PRC - [2009.06.04 20:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe

PRC - [2009.06.04 20:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe

PRC - [2009.06.03 03:12:50 | 000,599,344 | ---- | M] (Validity Sensors, Inc.) -- C:\Windows\System32\vfsFPService.exe

PRC - [2009.04.09 13:45:26 | 001,061,688 | ---- | M] (AVM Berlin) -- D:\Fritzbox\FRITZ!DSL\FwebProt.exe

PRC - [2008.10.24 16:35:44 | 000,128,296 | ---- | M] () -- D:\Homebanking\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe

PRC - [2008.06.30 18:56:32 | 000,200,704 | ---- | M] () -- C:\Windows\PLFSetI.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011.05.19 07:21:36 | 000,163,728 | ---- | M] () -- C:\Programme\Lavasoft\Ad-Aware\ShellExt.dll

MOD - [2009.07.20 13:27:14 | 000,017,936 | ---- | M] () -- D:\Maus\Logitech\SetPoint\khalwrapper.dll

MOD - [2009.04.27 13:55:12 | 000,678,400 | ---- | M] () -- D:\IZArc (Packen)\IZArcCM.dll

MOD - [2009.02.23 16:44:18 | 001,347,584 | ---- | M] () -- D:\Foto Film und Audio\XnView\ShellEx\XnViewShellExt.dll

MOD - [2008.06.30 18:56:32 | 000,200,704 | ---- | M] () -- C:\Windows\PLFSetI.exe

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2012.07.12 16:23:18 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.05.09 06:27:45 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012.05.09 06:27:44 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2012.03.10 03:51:12 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)

SRV - [2011.08.12 01:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programme\SUPERAntiSpyware\SASCore.exe -- (!SASCORE)

SRV - [2011.05.19 07:21:30 | 001,181,328 | ---- | M] (Lavasoft) [Auto | Stopped] -- C:\Programme\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)

SRV - [2011.03.31 16:35:50 | 000,068,768 | ---- | M] (Atheros Commnucations) [Auto | Running] -- D:\Bluetooth Suite\AdminService.exe -- (AtherosSvc)

SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - [2009.10.27 12:20:28 | 000,109,072 | ---- | M] (Paragon Software Group) [On_Demand | Stopped] -- D:\Paragon Software\Paragon Backup and Recovery 10 Suite\program\dbhservice.exe -- (Paragon System Backup Dienst)

SRV - [2009.09.06 13:38:06 | 000,071,096 | ---- | M] () [Auto | Running] -- D:\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)

SRV - [2009.09.05 10:16:54 | 003,452,928 | ---- | M] (Egis Technology Inc.) [Auto | Running] -- C:\Programme\Acer Bio Protection\BASVC.exe -- (IGBASVC)

SRV - [2009.07.28 17:07:42 | 000,073,528 | ---- | M] (AVM Berlin) [Auto | Running] -- D:\Fritzbox\FRITZ!DSL\IGDCTRL.EXE -- (IGDCTRL)

SRV - [2009.07.20 13:28:10 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)

SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2009.06.04 20:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)

SRV - [2009.06.03 03:12:50 | 000,599,344 | ---- | M] (Validity Sensors, Inc.) [Auto | Running] -- C:\Windows\System32\vfsFPService.exe -- (vfsFPService)

SRV - [2008.10.24 16:35:44 | 000,128,296 | ---- | M] () [Auto | Running] -- D:\Homebanking\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe -- (AAV UpdateService)

SRV - [2007.11.06 22:22:26 | 000,092,792 | ---- | M] (CACE Technologies) [On_Demand | Stopped] -- C:\Programme\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lgusbmodem.sys -- (USBModem)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lgusbdiag.sys -- (UsbDiag)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lgusbbus.sys -- (usbbus)

DRV - File not found [Kernel | System | Stopped] -- system32\drivers\archlp.sys -- (archlp)

DRV - [2012.05.09 06:27:45 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2012.05.09 06:27:45 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.12.15 16:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2011.07.22 18:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)

DRV - [2011.07.12 23:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2011.03.31 16:36:04 | 000,247,968 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btfilter.sys -- (BtFilter)

DRV - [2011.03.31 16:36:02 | 000,266,272 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_rcp.sys -- (BTATH_RCP)

DRV - [2011.03.31 16:36:02 | 000,226,976 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_a2dp.sys -- (BTATH_A2DP)

DRV - [2011.03.31 16:36:02 | 000,147,104 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_hcrp.sys -- (BTATH_HCRP)

DRV - [2011.03.31 16:36:02 | 000,097,440 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_avdt.sys -- (btath_avdt)

DRV - [2011.03.31 16:36:02 | 000,052,384 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_lwflt.sys -- (BTATH_LWFLT)

DRV - [2011.03.31 16:36:02 | 000,043,680 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AthDfu.sys -- (ATHDFU)

DRV - [2011.03.31 16:36:02 | 000,035,488 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_flt.sys -- (AthBTPort)

DRV - [2011.03.31 16:36:02 | 000,024,736 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btath_bus.sys -- (BTATH_BUS)

DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\winusb.sys -- (WinUSB)

DRV - [2010.11.08 07:06:31 | 000,101,248 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avmaudio.sys -- (avmaudio)

DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2010.02.24 12:22:10 | 000,185,472 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\acedrv11.sys -- (acedrv11)

DRV - [2009.11.21 04:34:54 | 011,515,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2009.11.18 22:32:33 | 000,101,248 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avmaura.sys -- (avmaura)

DRV - [2009.11.12 06:14:28 | 000,066,664 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)

DRV - [2009.10.27 12:20:26 | 000,040,560 | ---- | M] (Paragon Software Group) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\hotcore3.sys -- (hotcore3)

DRV - [2009.09.28 21:57:28 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen)

DRV - [2009.09.23 14:55:23 | 000,064,288 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\System32\drivers\Lbd.sys -- (Lbd)

DRV - [2009.09.15 20:40:18 | 006,114,816 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5s32.sys -- (NETw5s32) Intel(R)

DRV - [2009.08.23 06:06:38 | 000,048,640 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1E62x86.sys -- (L1E)

DRV - [2009.08.13 23:53:26 | 000,087,536 | ---- | M] (CyberLink Corp.) [2010/01/06 23:51:18] [Kernel | Auto | Running] -- D:\CyberLink\PowerDVD8\PowerDVD8\000.fcl -- ({FE4C91E7-22C2-4D0C-9F6B-82F1B7742054})

DRV - [2009.08.07 12:18:28 | 000,212,528 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)

DRV - [2009.07.14 02:18:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV - [2009.07.14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)

DRV - [2009.07.14 00:13:48 | 001,035,776 | ---- | M] (LSI Corp) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) Intel(R)

DRV - [2009.06.17 18:56:16 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)

DRV - [2009.06.17 18:56:06 | 000,035,472 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)

DRV - [2009.03.09 17:58:00 | 000,056,320 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)

DRV - [2009.02.20 20:09:16 | 000,044,032 | ---- | M] (Siemens Home and Office Communication Devices GmbH & Co. KG) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\GigasetGenericUSB.sys -- (GigasetGenericUSB)

DRV - [2008.11.08 10:55:24 | 000,101,760 | R--- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)

DRV - [2008.03.12 13:52:34 | 000,069,632 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\int15.sys -- (int15)

DRV - [2007.11.06 22:22:06 | 000,034,064 | ---- | M] (CACE Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\npf.sys -- (NPF)

DRV - [2007.04.27 11:13:34 | 000,044,800 | R--- | M] (Intel Corporation (UK)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CE6230StandaloneDriver.sys -- (ce6230)

DRV - [2007.04.27 05:29:10 | 000,019,328 | R--- | M] (Intel Corporation (UK)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CE6230BDA.sys -- (ce6230BDACAP)

DRV - [2007.02.08 15:45:14 | 000,029,184 | ---- | M] (Thesycon GmbH, Germany) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dsiarhwprog.sys -- (dsiarhwprog)

DRV - [2006.11.02 15:27:34 | 000,020,112 | ---- | M] (Dritek System Inc.) [Kernel | System | Running] -- C:\Programme\Launch Manager\DPortIO.sys -- (DritekPortIO)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-1501325428-669346799-357816155-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie

IE - HKU\S-1-5-21-1501325428-669346799-357816155-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie

IE - HKU\S-1-5-21-1501325428-669346799-357816155-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com

IE - HKU\S-1-5-21-1501325428-669346799-357816155-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.online-translator.com/Default.aspx?prmtlang=de

IE - HKU\S-1-5-21-1501325428-669346799-357816155-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie

IE - HKU\S-1-5-21-1501325428-669346799-357816155-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie

IE - HKU\S-1-5-21-1501325428-669346799-357816155-1001\..\URLSearchHook:  - No CLSID value found

IE - HKU\S-1-5-21-1501325428-669346799-357816155-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-1501325428-669346799-357816155-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-1501325428-669346799-357816155-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searcerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-1501325428-669346799-357816155-1001\..\SearchScopes\{FE42AB68-3E01-415E-A715-2DE640DAED20}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

IE - HKU\S-1-5-21-1501325428-669346799-357816155-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.selectedEngine: "ICQ Search"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://www.t-online.de"

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll ()

FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: D:\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: D:\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: D:\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)

FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: D:\PDF XChange Viewer\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Foto Film und Audio\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.3: D:\VLC\npvlc.dll File not found

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: D:\Foto Film und Audio\VLC\npvlc.dll (VideoLAN)

FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: D:\PDF XChange Viewer\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF - HKCU\Software\MozillaPlugins\@protectdisc.com/NPPDLicenseHelper: C:\Users\Bodo\AppData\Roaming\ProtectDisc\License Helper v2\NPPDLicenseHelper.dll ( )

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5\extensions\\Components: D:\Firefox\components [2012.07.12 23:08:00 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5\extensions\\Plugins: D:\Firefox\plugins [2012.07.09 22:56:16 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0\extensions\\Components: D:\Thunderbird\components [2012.04.26 22:53:04 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0\extensions\\Plugins: D:\Thunderbird\plugins [2008.02.22 17:24:06 | 000,095,832 | ---- | M] ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{857610fe-b36c-47f2-b4fa-6b7affe0cf5a}: D:\Mobile Master (Handy)\ext\1\ [2012.03.10 18:47:36 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: D:\Firefox\components [2012.07.12 23:08:00 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: D:\Firefox\plugins [2012.07.09 22:56:16 | 000,000,000 | ---D | M]

 

[2010.09.27 17:18:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bodo\AppData\Roaming\mozilla\Extensions

[2010.09.27 17:18:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bodo\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2012.07.14 23:58:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bodo\AppData\Roaming\mozilla\Firefox\Profiles\dkvo1wf9.default\extensions

[2012.07.12 23:39:45 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Bodo\AppData\Roaming\mozilla\Firefox\Profiles\dkvo1wf9.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

[2009.11.27 22:19:19 | 000,000,694 | ---- | M] () -- C:\Users\Bodo\AppData\Roaming\Mozilla\Firefox\Profiles\dkvo1wf9.default\searchplugins\icq-search.xml

[2010.01.06 23:26:11 | 000,000,961 | ---- | M] () -- C:\Users\Bodo\AppData\Roaming\Mozilla\Firefox\Profiles\dkvo1wf9.default\searchplugins\icqplugin-1.xml

[2010.02.19 00:12:15 | 000,000,961 | ---- | M] () -- C:\Users\Bodo\AppData\Roaming\Mozilla\Firefox\Profiles\dkvo1wf9.default\searchplugins\icqplugin-2.xml

[2009.12.17 23:52:43 | 000,000,961 | ---- | M] () -- C:\Users\Bodo\AppData\Roaming\Mozilla\Firefox\Profiles\dkvo1wf9.default\searchplugins\icqplugin.xml

[2012.04.01 17:21:51 | 000,128,837 | ---- | M] () (No name found) -- C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\EXTENSIONS\TOOLBAR-FF@PAYBACK.DE.XPI

 

O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Programme\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - D:\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)

O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)

O3 - HKU\S-1-5-21-1501325428-669346799-357816155-1001\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)

O4 - HKLM..\Run: [AthBtTray] D:\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)

O4 - HKLM..\Run: [AtherosBtStack] D:\Bluetooth Suite\BtvStack.exe (Atheros Communications)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)

O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)

O4 - HKLM..\Run: [PDFPrint] D:\pdf24 (PDF kreieren)\pdf24.exe (Geek Software GmbH)

O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()

O4 - HKU\.DEFAULT..\Run: [FRITZ!protect] FwebProt.exe File not found

O4 - HKU\S-1-5-18..\Run: [FRITZ!protect] FwebProt.exe File not found

O4 - HKU\S-1-5-21-1501325428-669346799-357816155-1001..\Run: [AVMUSBFernanschluss] C:\Users\Bodo\AppData\Local\Apps\2.0\8C4DLC30.M1O\BW4CZV7Q.50A\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\AVMAutoStart.exe (AVM Berlin)

O4 - HKU\S-1-5-21-1501325428-669346799-357816155-1001..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-1501325428-669346799-357816155-1001..\RunOnce: [AutoLaunch] C:\Program Files\Lavasoft\Ad-Aware\AutoLaunch.exe ()

O4 - Startup: C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Protect.lnk = D:\Fritzbox\FRITZ!DSL\FwebProt.exe (AVM Berlin)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)

O9 - Extra Button: Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Programme\Acer Bio Protection\PwdBank.exe (Egis Technology Inc.)

O9 - Extra 'Tools' menuitem : Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Programme\Acer Bio Protection\PwdBank.exe (Egis Technology Inc.)

O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - D:\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - D:\Fritzbox\FRITZ!DSL\\sarah.dll ()

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - D:\Fritzbox\FRITZ!DSL\sarah.dll (AVM Berlin)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - D:\Fritzbox\FRITZ!DSL\sarah.dll (AVM Berlin)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - D:\Fritzbox\FRITZ!DSL\sarah.dll (AVM Berlin)

O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - D:\Fritzbox\FRITZ!DSL\sarah.dll (AVM Berlin)

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{98C369BD-5DCE-4C71-BA76-FF03134D8D81}: DhcpNameServer = 192.168.178.1

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)

O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{13bbb2b3-ec8b-11e0-a831-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{13bbb2b3-ec8b-11e0-a831-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{349505e5-c539-11e0-ade8-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{349505e5-c539-11e0-ade8-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{3a3c5cb1-acf6-11e1-9ac4-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{3a3c5cb1-acf6-11e1-9ac4-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{3a3c5cd4-acf6-11e1-9ac4-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{3a3c5cd4-acf6-11e1-9ac4-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{5f296395-9d27-11e0-bddb-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{5f296395-9d27-11e0-bddb-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{6a5d05a8-6b35-11df-80f5-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{6a5d05a8-6b35-11df-80f5-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{6a5d05c8-6b35-11df-80f5-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{6a5d05c8-6b35-11df-80f5-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{8364e88c-5ea4-11df-b609-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{8364e88c-5ea4-11df-b609-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{8364e8a4-5ea4-11df-b609-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{8364e8a4-5ea4-11df-b609-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{bd0a82fa-c535-11e0-b1e8-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{bd0a82fa-c535-11e0-b1e8-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{bd0a830e-c535-11e0-b1e8-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{bd0a830e-c535-11e0-b1e8-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{dba17bc3-9c62-11e0-9ab7-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{dba17bc3-9c62-11e0-9ab7-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O34 - HKLM BootExecute: (lsdelete)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk - D:\Microsoft Office\Office\OSA9.EXE - (Microsoft Corporation)

MsConfig - StartUpFolder: C:^Users^Bodo^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Produktregistrierung.lnk - C:\Programme\Common Files\Logishrd\eReg\SetPoint\eReg.exe - (Leader Technologies/Logitech)

MsConfig - StartUpReg: AVMUSBFernanschluss - hkey= - key= - Reg Error: Value error. File not found

MsConfig - StartUpReg: BDRegion - hkey= - key= - C:\Programme\Cyberlink\Shared files\brs.exe (cyberlink)

MsConfig - StartUpReg: LManager - hkey= - key= - C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)

MsConfig - StartUpReg: mspd - hkey= - key= -  File not found

MsConfig - StartUpReg: PDVD8LanguageShortcut - hkey= - key= - D:\CyberLink\PowerDVD8\PowerDVD8\Language\Language.exe (CyberLink Corp.)

MsConfig - StartUpReg: RemoteControl8 - hkey= - key= - D:\CyberLink\PowerDVD8\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)

MsConfig - StartUpReg: VirtualCloneDrive - hkey= - key= - D:\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)

MsConfig - StartUpReg: VitaKeyPdtWzd - hkey= - key= - C:\Program Files\Acer Bio Protection\PdtWzd.exe (Egis Technology Inc.)

MsConfig - State: "startup" - 2

 

SafeBootMin: !SASCORE - C:\Programme\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: Lavasoft Ad-Aware Service - C:\Programme\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: !SASCORE - C:\Programme\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Lavasoft Ad-Aware Service - C:\Programme\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.voxacm160 - C:\Windows\System32\vct3216.acm (Voxware, Inc.)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.07.19 18:08:37 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Bodo\Desktop\OTL.exe

[2012.07.15 18:45:07 | 000,000,000 | ---D | C] -- C:\Users\Bodo\AppData\Roaming\SUPERAntiSpyware.com

[2012.07.15 18:44:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

[2012.07.15 18:44:21 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com

[2012.07.15 18:44:21 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware

[2012.07.15 18:40:04 | 000,000,000 | R--D | C] -- C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 8

[2012.07.15 16:20:37 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.07.14 23:19:29 | 018,101,376 | ---- | C] (SUPERAntiSpyware.com) -- C:\Users\Bodo\Desktop\SUPERAntiSpyware.exe

[2012.07.14 23:11:02 | 010,652,120 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Bodo\Desktop\mbam-setup-1.62.0.1300.exe

[2012.07.14 23:10:08 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Bodo\Desktop\esetsmartinstaller_enu.exe

[2012.07.12 23:02:40 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2012.07.12 23:02:10 | 000,000,000 | ---D | C] -- C:\Program Files\Oracle

[2012.07.11 13:52:00 | 000,000,000 | ---D | C] -- C:\Users\Bodo\Documents\GTA San Andreas User Files

[2012.07.09 23:11:56 | 000,000,000 | ---D | C] -- C:\Users\Bodo\AppData\Roaming\Malwarebytes

[2012.07.09 23:11:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.07.09 23:11:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.07.09 23:11:48 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.07.09 23:11:48 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.07.09 22:56:05 | 000,000,000 | ---D | C] -- C:\Program Files\Java

[2012.06.24 00:16:13 | 000,000,000 | ---D | C] -- C:\Users\Bodo\AppData\Local\Macromedia

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.07.19 18:08:43 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Bodo\Desktop\OTL.exe

[2012.07.19 18:04:58 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.07.19 18:04:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.07.18 16:58:29 | 000,019,904 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.07.18 16:58:29 | 000,019,904 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.07.18 16:53:59 | 000,000,324 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job

[2012.07.18 16:50:42 | 2413,522,944 | -HS- | M] () -- C:\hiberfil.sys

[2012.07.17 16:46:03 | 000,654,194 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.07.17 16:46:03 | 000,616,036 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.07.17 16:46:03 | 000,130,034 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.07.17 16:46:03 | 000,106,416 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.07.17 15:43:12 | 000,624,883 | ---- | M] () -- C:\Users\Bodo\Desktop\adwcleaner.exe

[2012.07.16 16:31:57 | 000,007,596 | ---- | M] () -- C:\Users\Bodo\AppData\Local\Resmon.ResmonCfg

[2012.07.15 18:44:27 | 000,001,967 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2012.07.15 09:50:08 | 000,001,073 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.07.14 23:19:38 | 018,101,376 | ---- | M] (SUPERAntiSpyware.com) -- C:\Users\Bodo\Desktop\SUPERAntiSpyware.exe

[2012.07.14 23:11:08 | 010,652,120 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Bodo\Desktop\mbam-setup-1.62.0.1300.exe

[2012.07.14 23:10:09 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Bodo\Desktop\esetsmartinstaller_enu.exe

[2012.07.14 22:59:47 | 000,302,592 | ---- | M] () -- C:\Users\Bodo\Desktop\lwdcbtwt.exe

[2012.07.12 06:04:28 | 000,493,072 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

 
 ========== Files Created - No Company Name ==========

 

[2012.07.17 15:43:01 | 000,624,883 | ---- | C] () -- C:\Users\Bodo\Desktop\adwcleaner.exe

[2012.07.16 16:31:57 | 000,007,596 | ---- | C] () -- C:\Users\Bodo\AppData\Local\Resmon.ResmonCfg

[2012.07.15 18:44:27 | 000,001,967 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2012.07.14 22:59:46 | 000,302,592 | ---- | C] () -- C:\Users\Bodo\Desktop\lwdcbtwt.exe

[2012.07.09 23:11:50 | 000,001,073 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2011.07.26 12:48:46 | 000,000,218 | ---- | C] () -- C:\Users\Bodo\.recently-used.xbel

[2011.07.17 03:00:53 | 000,000,681 | ---- | C] () -- C:\Windows\RUMMY500.INI

[2011.06.20 02:24:51 | 000,001,078 | ---- | C] () -- C:\Windows\wschk.ini

[2011.05.06 23:47:55 | 000,017,408 | ---- | C] () -- C:\Users\Bodo\AppData\Local\WebpageIcons.db

[2011.03.31 16:32:04 | 000,246,804 | ---- | C] () -- C:\Windows\System32\drivers\AtherosBt.bin

[2011.02.24 13:22:16 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib

[2010.12.30 16:11:15 | 000,389,632 | ---- | C] () -- C:\Windows\System32\mspd.exe

[2010.01.08 12:49:57 | 000,010,752 | ---- | C] () -- C:\Users\Bodo\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

 
 ========== LOP Check ==========

 

[2010.07.06 20:22:45 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Akademische Arbeitsgemeinschaft

[2011.02.24 13:06:19 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\AnvSoft

[2010.01.08 13:58:35 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Audacity

[2009.11.18 20:45:18 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Auslogics

[2010.02.08 23:52:20 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Autodesk

[2011.02.24 13:54:31 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\avidemux

[2009.11.18 21:19:11 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Canneverbe_Limited

[2010.02.05 22:18:23 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Canon

[2010.03.04 19:29:28 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\CasaPortale.de

[2010.04.21 21:33:31 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\CD-LabelPrint

[2012.06.16 00:12:36 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\DVDVideoSoft

[2011.10.10 17:50:00 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\elsterformular

[2012.07.16 23:25:22 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\FRITZ!

[2009.11.19 00:12:54 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\FRITZ!fax für FRITZ!Box

[2010.01.09 17:08:38 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\GlarySoft

[2010.03.04 20:13:07 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\gtk-2.0

[2011.03.24 01:16:58 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Haenlein-Software

[2010.02.06 21:02:25 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\inkscape

[2009.12.11 23:59:05 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\jpg-Illuminator

[2012.03.10 16:21:38 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Jumping Bytes

[2009.11.18 01:32:48 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Leadertech

[2012.02.04 21:42:39 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\LG Electronics

[2012.02.04 21:48:10 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\LGAAS

[2012.03.10 22:44:32 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Mobile Master

[2009.11.20 00:40:19 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\OpenOffice.org

[2011.02.23 13:59:02 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\ProtectDisc

[2010.09.27 17:18:28 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Thunderbird

[2009.11.17 23:56:46 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Validity

[2011.07.29 12:38:32 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\XnView

[2012.07.18 16:53:59 | 000,000,324 | ---- | M] () -- C:\Windows\Tasks\GlaryInitialize.job

[2012.05.16 19:33:09 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2009.11.18 02:46:43 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Adobe

[2010.07.06 20:22:45 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Akademische Arbeitsgemeinschaft

[2011.02.24 13:06:19 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\AnvSoft

[2010.01.07 01:34:54 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\ArcSoft

[2012.03.10 12:59:30 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Atheros

[2010.01.08 13:58:35 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Audacity

[2009.11.18 20:45:18 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Auslogics

[2010.02.08 23:52:20 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Autodesk

[2011.02.24 13:54:31 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\avidemux

[2012.01.05 02:03:48 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Avira

[2009.11.18 21:19:11 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Canneverbe_Limited

[2010.02.05 22:18:23 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Canon

[2010.03.04 19:29:28 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\CasaPortale.de

[2010.04.21 21:33:31 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\CD-LabelPrint

[2011.02.19 17:28:45 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\CyberLink

[2009.12.12 00:37:48 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\DivX

[2011.02.26 10:44:24 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\dvdcss

[2012.06.16 00:12:36 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\DVDVideoSoft

[2011.10.10 17:50:00 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\elsterformular

[2012.07.16 23:25:22 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\FRITZ!

[2009.11.19 00:12:54 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\FRITZ!fax für FRITZ!Box

[2010.01.09 17:08:38 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\GlarySoft

[2010.03.04 20:13:07 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\gtk-2.0

[2011.03.24 01:16:58 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Haenlein-Software

[2009.11.17 23:33:24 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Identities

[2010.02.06 21:02:25 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\inkscape

[2009.11.17 23:51:27 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\InstallShield

[2009.12.11 23:59:05 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\jpg-Illuminator

[2012.03.10 16:21:38 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Jumping Bytes

[2009.11.18 01:32:48 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Leadertech

[2012.02.04 21:42:39 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\LG Electronics

[2012.02.04 21:48:10 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\LGAAS

[2009.11.18 01:32:51 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Logitech

[2009.11.18 02:46:43 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Macromedia

[2012.07.09 23:11:56 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Malwarebytes

[2009.07.14 10:56:41 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Media Center Programs

[2012.06.24 00:16:13 | 000,000,000 | --SD | M] -- C:\Users\Bodo\AppData\Roaming\Microsoft

[2009.12.19 02:22:12 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Microsoft Web Folders

[2012.03.10 22:44:32 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Mobile Master

[2011.05.07 00:33:31 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Mozilla

[2010.02.13 23:32:03 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Nero

[2009.11.20 00:40:19 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\OpenOffice.org

[2011.02.23 13:59:02 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\ProtectDisc

[2012.07.15 18:45:07 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\SUPERAntiSpyware.com

[2009.11.19 23:25:21 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Talkback

[2010.09.27 17:18:28 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Thunderbird

[2009.11.17 23:56:46 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Validity

[2012.07.12 17:11:44 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\vlc

[2009.12.09 00:04:25 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\Winamp

[2011.07.29 12:38:32 | 000,000,000 | ---D | M] -- C:\Users\Bodo\AppData\Roaming\XnView

 
 < %APPDATA%\*.exe /s >

[2012.03.12 23:29:23 | 005,199,808 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\install_dfv12.exe

[2012.02.10 21:22:09 | 008,843,080 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\install_est11.exe

[2012.03.12 23:28:43 | 006,232,560 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\install_eur11.exe

[2012.03.12 23:29:04 | 005,933,208 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\install_gst11.exe

[2012.03.12 23:28:54 | 005,861,416 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\install_gstz11.exe

[2012.03.12 23:29:31 | 005,268,208 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\install_lsta12.exe

[2012.03.12 23:29:39 | 005,430,712 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\install_lstb12.exe

[2012.03.12 23:29:13 | 005,836,248 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\install_par34a11.exe

[2012.02.10 21:22:18 | 005,026,376 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\install_ust11.exe

[2012.02.06 19:46:50 | 004,939,152 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\install_ustva12.exe

[2012.01.05 01:20:26 | 004,051,632 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_10_7094_7699.exe

[2012.02.06 08:00:36 | 004,388,112 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_10_7699_8086.exe

[2012.03.04 20:05:36 | 004,643,176 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_10_8086_8394.exe

[2012.05.07 18:50:46 | 004,277,888 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_10_8394_8623.exe

[2012.01.05 01:21:00 | 004,048,168 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_11_7094_7699.exe

[2012.02.06 08:01:26 | 004,390,768 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_11_7699_8086.exe

[2012.03.04 20:05:51 | 004,642,088 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_11_8086_8394.exe

[2012.05.07 18:51:04 | 004,277,648 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_11_8394_8623.exe

[2012.05.07 18:51:19 | 004,264,240 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_12_8479_8623.exe

[2012.03.04 20:06:05 | 006,913,240 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_est_11_8086_8394.exe

[2012.03.12 23:29:48 | 004,492,672 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_est_11_8394_8479.exe

[2012.04.04 20:12:38 | 004,180,528 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_est_11_8479_8531.exe

[2012.05.07 18:51:34 | 005,933,016 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_est_11_8531_8623.exe

[2012.01.05 01:21:26 | 004,067,576 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_09_7094_7699.exe

[2012.02.06 08:02:13 | 004,502,176 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_09_7699_8086.exe

[2012.03.04 20:06:20 | 004,691,768 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_09_8086_8394.exe

[2012.05.07 18:51:51 | 004,322,312 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_09_8394_8623.exe

[2012.02.06 08:03:02 | 004,501,512 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_10_7094_8086.exe

[2012.03.04 20:06:32 | 004,700,176 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_10_8086_8394.exe

[2012.05.07 18:52:06 | 004,324,088 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_10_8394_8623.exe

[2012.05.07 18:52:22 | 004,591,856 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_11_8479_8623.exe

[2012.02.06 08:05:24 | 004,448,056 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_09_7094_8086.exe

[2012.03.04 20:07:10 | 004,630,968 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_09_8086_8394.exe

[2012.05.07 18:53:25 | 004,279,840 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_09_8394_8623.exe

[2012.02.06 08:06:10 | 004,447,056 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_10_7094_8086.exe

[2012.03.04 20:07:23 | 004,631,456 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_10_8086_8394.exe

[2012.05.07 18:53:41 | 004,280,832 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_10_8394_8623.exe

[2012.05.07 18:53:57 | 004,506,672 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_11_8479_8623.exe

[2012.02.06 08:03:49 | 004,454,760 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_09_7094_8086.exe

[2012.03.04 20:06:44 | 004,637,496 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_09_8086_8394.exe

[2012.05.07 18:52:38 | 004,284,600 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_09_8394_8623.exe

[2012.02.06 08:04:36 | 004,453,216 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_10_7094_8086.exe

[2012.03.04 20:06:57 | 004,637,352 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_10_8086_8394.exe

[2012.05.07 18:52:54 | 004,283,088 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_10_8394_8623.exe

[2012.05.07 18:53:09 | 004,504,904 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_11_8479_8623.exe

[2012.01.05 01:21:53 | 004,058,240 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_10_7094_7699.exe

[2012.02.06 08:06:57 | 004,415,296 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_10_7699_8086.exe

[2012.03.04 20:07:36 | 004,646,376 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_10_8086_8394.exe

[2012.05.07 18:54:13 | 004,275,104 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_10_8394_8623.exe

[2012.01.05 01:22:19 | 004,052,104 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_11_7094_7699.exe

[2012.02.06 08:07:45 | 004,418,776 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_11_7699_8086.exe

[2012.03.04 20:07:48 | 004,648,632 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_11_8086_8394.exe

[2012.05.07 18:54:30 | 004,285,872 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_11_8394_8623.exe

[2012.05.07 18:54:47 | 004,267,496 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_12_8479_8623.exe

[2012.02.06 08:08:37 | 004,473,376 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_10_7094_8086.exe

[2012.03.04 20:08:02 | 004,697,488 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_10_8086_8394.exe

[2012.05.07 18:55:03 | 004,308,312 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_10_8394_8623.exe

[2012.02.06 08:09:26 | 004,482,440 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_11_7094_8086.exe

[2012.03.04 20:08:16 | 004,694,976 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_11_8086_8394.exe

[2012.05.07 18:55:20 | 004,313,696 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_11_8394_8623.exe

[2012.05.07 18:55:38 | 004,318,152 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_12_8479_8623.exe

[2012.02.06 08:10:16 | 004,842,576 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_09_7094_8086.exe

[2012.03.04 20:08:30 | 004,766,648 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_09_8086_8394.exe

[2012.05.07 18:55:55 | 004,285,984 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_09_8394_8623.exe

[2012.02.06 08:11:09 | 004,851,968 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_10_7094_8086.exe

[2012.03.04 20:08:43 | 004,766,752 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_10_8086_8394.exe

[2012.05.07 18:56:13 | 004,295,704 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_10_8394_8623.exe

[2012.05.07 18:56:31 | 004,282,328 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_11_8479_8623.exe

[2012.02.06 07:59:30 | 012,718,200 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_pica_0_7094_8086.exe

[2012.03.04 20:05:11 | 007,447,064 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_pica_0_8086_8394.exe

[2012.03.12 23:28:24 | 003,841,320 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_pica_0_8394_8479.exe

[2012.05.07 18:50:19 | 005,576,392 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_pica_0_8479_8623.exe

[2012.01.05 01:22:45 | 004,049,248 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_10_7094_7699.exe

[2012.02.06 08:13:19 | 004,416,640 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_10_7699_8086.exe

[2012.03.04 20:09:41 | 004,673,152 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_10_8086_8394.exe

[2012.05.07 18:57:44 | 004,278,392 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_10_8394_8623.exe

[2012.01.05 01:23:10 | 004,051,088 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_11_7094_7699.exe

[2012.02.06 08:14:01 | 004,450,656 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_11_7699_8086.exe

[2012.03.04 20:09:54 | 004,658,456 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_11_8086_8394.exe

[2012.05.07 18:58:03 | 004,279,440 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_11_8394_8623.exe

[2012.03.04 20:10:09 | 004,715,656 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_12_8086_8394.exe

[2012.05.07 18:58:22 | 004,292,672 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_12_8394_8623.exe

[2012.02.06 08:11:54 | 004,473,720 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_09_7094_8086.exe

[2012.03.04 20:08:57 | 004,644,168 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_09_8086_8394.exe

[2012.05.07 18:56:49 | 004,288,728 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_09_8394_8623.exe

[2012.02.06 08:12:36 | 004,490,080 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_10_7094_8086.exe

[2012.03.04 20:09:10 | 004,646,104 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_10_8086_8394.exe

[2012.05.07 18:57:07 | 004,292,008 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_10_8394_8623.exe

[2012.03.04 20:09:27 | 004,729,840 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_11_8086_8394.exe

[2012.05.07 18:57:25 | 004,298,704 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_11_8394_8623.exe

[2011.10.10 17:44:23 | 011,250,312 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Bodo\AppData\Roaming\elsterformular\update\ElsterFormular_update-12_3_2_6814u.exe

[2011.03.24 01:18:45 | 006,235,620 | ---- | M] () -- C:\Users\Bodo\AppData\Roaming\Haenlein-Software\DVR-Studio Pro 2\temp\DVR-Studio Pro 2 Setup220ger.exe

[2011.03.26 01:09:53 | 000,094,208 | R--- | M] () -- C:\Users\Bodo\AppData\Roaming\Microsoft\Installer\{20C31435-2A0A-4580-BE8B-AC06FC243CA4}\python_icon.exe

[2009.07.22 17:28:36 | 000,477,976 | ---- | M] (Protect GmbH) -- C:\Users\Bodo\AppData\Roaming\ProtectDisc\License Helper v2\PDLicenseHelperBroker.exe

[2010.12.30 16:58:42 | 000,059,043 | ---- | M] () -- C:\Users\Bodo\AppData\Roaming\ProtectDisc\License Helper v2\uninst.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2009.06.04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys

[2009.06.04 19:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys

[2009.06.04 12:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\drivers\iaStor.sys

[2009.06.04 19:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_4f144d6467fc7c22\iaStor.sys

[2009.06.04 12:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_x86_neutral_10aa509d6843c6fc\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys

[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys

[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys

[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys

[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys

[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys

[2011.03.11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys

[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys

[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys

[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys

[2011.03.11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys

[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys

[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll

[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll

[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe

[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe

[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe

[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe

[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:FB1B13D8
 

< End of report >

Danke und bis gleich
Gruß Bodo

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.selectedEngine: "ICQ Search"

FF - prefs.js..browser.search.useDBForOrder: true

FF - user.js - File not found

[2009.11.27 22:19:19 | 000,000,694 | ---- | M] () -- C:\Users\Bodo\AppData\Roaming\Mozilla\Firefox\Profiles\dkvo1wf9.default\searchplugins\icq-search.xml

[2010.01.06 23:26:11 | 000,000,961 | ---- | M] () -- C:\Users\Bodo\AppData\Roaming\Mozilla\Firefox\Profiles\dkvo1wf9.default\searchplugins\icqplugin-1.xml

[2010.02.19 00:12:15 | 000,000,961 | ---- | M] () -- C:\Users\Bodo\AppData\Roaming\Mozilla\Firefox\Profiles\dkvo1wf9.default\searchplugins\icqplugin-2.xml

[2009.12.17 23:52:43 | 000,000,961 | ---- | M] () -- C:\Users\Bodo\AppData\Roaming\Mozilla\Firefox\Profiles\dkvo1wf9.default\searchplugins\icqplugin.xml

O4 - HKU\.DEFAULT..\Run: [FRITZ!protect] FwebProt.exe File not found

O4 - HKU\S-1-5-18..\Run: [FRITZ!protect] FwebProt.exe File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{13bbb2b3-ec8b-11e0-a831-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{13bbb2b3-ec8b-11e0-a831-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{349505e5-c539-11e0-ade8-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{349505e5-c539-11e0-ade8-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{3a3c5cb1-acf6-11e1-9ac4-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{3a3c5cb1-acf6-11e1-9ac4-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{3a3c5cd4-acf6-11e1-9ac4-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{3a3c5cd4-acf6-11e1-9ac4-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{5f296395-9d27-11e0-bddb-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{5f296395-9d27-11e0-bddb-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{6a5d05a8-6b35-11df-80f5-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{6a5d05a8-6b35-11df-80f5-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{6a5d05c8-6b35-11df-80f5-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{6a5d05c8-6b35-11df-80f5-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{8364e88c-5ea4-11df-b609-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{8364e88c-5ea4-11df-b609-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{8364e8a4-5ea4-11df-b609-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{8364e8a4-5ea4-11df-b609-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{bd0a82fa-c535-11e0-b1e8-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{bd0a82fa-c535-11e0-b1e8-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{bd0a830e-c535-11e0-b1e8-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{bd0a830e-c535-11e0-b1e8-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{dba17bc3-9c62-11e0-9ab7-0022fa1fa41e}\Shell - "" = AutoRun

O33 - MountPoints2\{dba17bc3-9c62-11e0-9ab7-0022fa1fa41e}\Shell\AutoRun\command - "" = N:\AutoRun.exe

@Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:FB1B13D8

:Commands

[purity]

[emptytemp]

[emptyflash]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Hey Arne,

hat nicht funktioniert.
Ich hab auch wirklich alle Programme was ich schließen konnte, geschlossen.
Es kam der berühmte blaue Bildschirm mit Konflikt (weiss ich nicht mehr, ging alles zu schnell) und dann hat der Computer wieder neu gestartet.
Soll ich den fix nochmal machen?

Danke und schönen Gruß
Bodo

Starte Windows neu im abgesicherten Modus (mit Netzwerktreibern nach Möglichkeit), manchmal hakt das Fixen mit OTL im normalen Modus aber sehr oft funktioniert der Fix im abgesicherte Modus.

Guten morgen Arne,

hat geklappt.

hier die log-Datei

Code:

All processes killed

========== OTL ==========

Prefs.js: "ICQ Search" removed from browser.search.defaultenginename

Prefs.js: "ICQ Search" removed from browser.search.selectedEngine

Prefs.js: true removed from browser.search.useDBForOrder

C:\Users\Bodo\AppData\Roaming\Mozilla\Firefox\Profiles\dkvo1wf9.default\searchplugins\icq-search.xml moved successfully.

C:\Users\Bodo\AppData\Roaming\Mozilla\Firefox\Profiles\dkvo1wf9.default\searchplugins\icqplugin-1.xml moved successfully.

C:\Users\Bodo\AppData\Roaming\Mozilla\Firefox\Profiles\dkvo1wf9.default\searchplugins\icqplugin-2.xml moved successfully.

C:\Users\Bodo\AppData\Roaming\Mozilla\Firefox\Profiles\dkvo1wf9.default\searchplugins\icqplugin.xml moved successfully.

Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\\FRITZ!protect deleted successfully.

Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run\\FRITZ!protect not found.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\autoexec.bat moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{13bbb2b3-ec8b-11e0-a831-0022fa1fa41e}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13bbb2b3-ec8b-11e0-a831-0022fa1fa41e}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{13bbb2b3-ec8b-11e0-a831-0022fa1fa41e}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13bbb2b3-ec8b-11e0-a831-0022fa1fa41e}\ not found.

File N:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{349505e5-c539-11e0-ade8-0022fa1fa41e}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{349505e5-c539-11e0-ade8-0022fa1fa41e}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{349505e5-c539-11e0-ade8-0022fa1fa41e}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{349505e5-c539-11e0-ade8-0022fa1fa41e}\ not found.

File N:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3a3c5cb1-acf6-11e1-9ac4-0022fa1fa41e}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3a3c5cb1-acf6-11e1-9ac4-0022fa1fa41e}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3a3c5cb1-acf6-11e1-9ac4-0022fa1fa41e}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3a3c5cb1-acf6-11e1-9ac4-0022fa1fa41e}\ not found.

File N:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3a3c5cd4-acf6-11e1-9ac4-0022fa1fa41e}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3a3c5cd4-acf6-11e1-9ac4-0022fa1fa41e}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3a3c5cd4-acf6-11e1-9ac4-0022fa1fa41e}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3a3c5cd4-acf6-11e1-9ac4-0022fa1fa41e}\ not found.

File N:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5f296395-9d27-11e0-bddb-0022fa1fa41e}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5f296395-9d27-11e0-bddb-0022fa1fa41e}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5f296395-9d27-11e0-bddb-0022fa1fa41e}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5f296395-9d27-11e0-bddb-0022fa1fa41e}\ not found.

File N:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a5d05a8-6b35-11df-80f5-0022fa1fa41e}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a5d05a8-6b35-11df-80f5-0022fa1fa41e}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a5d05a8-6b35-11df-80f5-0022fa1fa41e}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a5d05a8-6b35-11df-80f5-0022fa1fa41e}\ not found.

File N:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a5d05c8-6b35-11df-80f5-0022fa1fa41e}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a5d05c8-6b35-11df-80f5-0022fa1fa41e}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a5d05c8-6b35-11df-80f5-0022fa1fa41e}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a5d05c8-6b35-11df-80f5-0022fa1fa41e}\ not found.

File N:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8364e88c-5ea4-11df-b609-0022fa1fa41e}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8364e88c-5ea4-11df-b609-0022fa1fa41e}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8364e88c-5ea4-11df-b609-0022fa1fa41e}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8364e88c-5ea4-11df-b609-0022fa1fa41e}\ not found.

File N:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8364e8a4-5ea4-11df-b609-0022fa1fa41e}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8364e8a4-5ea4-11df-b609-0022fa1fa41e}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8364e8a4-5ea4-11df-b609-0022fa1fa41e}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8364e8a4-5ea4-11df-b609-0022fa1fa41e}\ not found.

File N:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bd0a82fa-c535-11e0-b1e8-0022fa1fa41e}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bd0a82fa-c535-11e0-b1e8-0022fa1fa41e}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bd0a82fa-c535-11e0-b1e8-0022fa1fa41e}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bd0a82fa-c535-11e0-b1e8-0022fa1fa41e}\ not found.

File N:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bd0a830e-c535-11e0-b1e8-0022fa1fa41e}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bd0a830e-c535-11e0-b1e8-0022fa1fa41e}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bd0a830e-c535-11e0-b1e8-0022fa1fa41e}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bd0a830e-c535-11e0-b1e8-0022fa1fa41e}\ not found.

File N:\AutoRun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dba17bc3-9c62-11e0-9ab7-0022fa1fa41e}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dba17bc3-9c62-11e0-9ab7-0022fa1fa41e}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dba17bc3-9c62-11e0-9ab7-0022fa1fa41e}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dba17bc3-9c62-11e0-9ab7-0022fa1fa41e}\ not found.

File N:\AutoRun.exe not found.

ADS C:\ProgramData\Temp:FB1B13D8 deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: Administrator

 

User: All Users

 

User: Bodo

->Temp folder emptied: 352765134 bytes

->Temporary Internet Files folder emptied: 196532734 bytes

->Java cache emptied: 1 bytes

->FireFox cache emptied: 55379276 bytes

->Flash cache emptied: 23574 bytes

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

 

User: Silke

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 112472903 bytes

RecycleBin emptied: 3011367 bytes

 

Total Files Cleaned = 687,00 mb

 

 

[EMPTYFLASH]

 

User: Administrator

 

User: All Users

 

User: Bodo

->Flash cache emptied: 0 bytes

 

User: Default

 

User: Default User

 

User: Public

 

User: Silke

 

Total Flash Files Cleaned = 0,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.54.0 log created on 07202012_063605
 

Files\Folders moved on Reboot...
 

PendingFileRenameOperations files...
 

Registry entries deleted on Reboot...

Bin ab heut Nachmittag/Abend das ganze Wochenende über ein öffentliches Netzwerk on.
Bis später und Danke.
Schöne Grüße Bodo

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Hey Arne,

hier ist der log

Code:

21:10:37.0767 3504        TDSS rootkit removing tool 2.7.46.0 Jul 16 2012 22:10:11

21:10:39.0795 3504        ============================================================

21:10:39.0795 3504        Current date / time: 2012/07/20 21:10:39.0795

21:10:39.0795 3504        SystemInfo:

21:10:39.0795 3504        

21:10:39.0795 3504        OS Version: 6.1.7601 ServicePack: 1.0

21:10:39.0795 3504        Product type: Workstation

21:10:39.0795 3504        ComputerName: BODO-PC

21:10:39.0795 3504        UserName: Bodo

21:10:39.0795 3504        Windows directory: C:\Windows

21:10:39.0795 3504        System windows directory: C:\Windows

21:10:39.0795 3504        Processor architecture: Intel x86

21:10:39.0795 3504        Number of processors: 2

21:10:39.0795 3504        Page size: 0x1000

21:10:39.0795 3504        Boot type: Normal boot

21:10:39.0795 3504        ============================================================

21:10:42.0135 3504        Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050

21:10:42.0167 3504        Drive \Device\Harddisk1\DR1 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050

21:10:42.0167 3504        ============================================================

21:10:42.0167 3504        \Device\Harddisk0\DR0:

21:10:42.0167 3504        MBR partitions:

21:10:42.0167 3504        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x18600000

21:10:42.0167 3504        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x18600800, BlocksNum 0x18600000

21:10:42.0167 3504        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x30C00800, BlocksNum 0x9784800

21:10:42.0167 3504        \Device\Harddisk1\DR1:

21:10:42.0167 3504        MBR partitions:

21:10:42.0167 3504        \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xC800000

21:10:42.0167 3504        \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0xC800800, BlocksNum 0x7801800

21:10:42.0167 3504        \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x14002000, BlocksNum 0x7800000

21:10:42.0198 3504        \Device\Harddisk1\DR1\Partition3: MBR, Type 0x7, StartLBA 0x1B802800, BlocksNum 0x9A01000

21:10:42.0213 3504        \Device\Harddisk1\DR1\Partition4: MBR, Type 0xB, StartLBA 0x25204000, BlocksNum 0x22A000

21:10:42.0213 3504        ============================================================

21:10:42.0323 3504        C: <-> \Device\Harddisk1\DR1\Partition0

21:10:42.0369 3504        D: <-> \Device\Harddisk1\DR1\Partition1

21:10:42.0416 3504        F: <-> \Device\Harddisk1\DR1\Partition3

21:10:42.0479 3504        E: <-> \Device\Harddisk1\DR1\Partition2

21:10:42.0494 3504        G: <-> \Device\Harddisk1\DR1\Partition4

21:10:42.0978 3504        H: <-> \Device\Harddisk0\DR0\Partition0

21:10:43.0009 3504        I: <-> \Device\Harddisk0\DR0\Partition1

21:10:43.0056 3504        J: <-> \Device\Harddisk0\DR0\Partition2

21:10:43.0056 3504        ============================================================

21:10:43.0056 3504        Initialize success

21:10:43.0056 3504        ============================================================

21:11:06.0830 3284        ============================================================

21:11:06.0830 3284        Scan started

21:11:06.0830 3284        Mode: Manual; SigCheck; TDLFS; 

21:11:06.0830 3284        ============================================================

21:11:07.0345 3284        !SASCORE        (c0393eb99a6c72c6bef9bfc4a72b33a6) C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

21:11:07.0423 3284        !SASCORE - ok

21:11:07.0626 3284        1394ohci        (1b133875b8aa8ac48969bd3458afe9f5) C:\Windows\system32\drivers\1394ohci.sys

21:11:07.0657 3284        1394ohci - ok

21:11:07.0719 3284        AAV UpdateService (7eeb488346fbfa3731276c3ee8a8fd9e) D:\Homebanking\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe

21:11:07.0735 3284        AAV UpdateService - ok

21:11:07.0797 3284        acedrv11        (e6f53d6c0dea3d375362265e175ca638) C:\Windows\system32\drivers\acedrv11.sys

21:11:07.0829 3284        acedrv11 - ok

21:11:07.0860 3284        ACPI            (cea80c80bed809aa0da6febc04733349) C:\Windows\system32\drivers\ACPI.sys

21:11:07.0891 3284        ACPI - ok

21:11:07.0938 3284        AcpiPmi         (1efbc664abff416d1d07db115dcb264f) C:\Windows\system32\drivers\acpipmi.sys

21:11:07.0953 3284        AcpiPmi - ok

21:11:08.0063 3284        AdobeFlashPlayerUpdateSvc (5e1a953c6472e7bb644892a4d0df5e72) C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

21:11:08.0078 3284        AdobeFlashPlayerUpdateSvc - ok

21:11:08.0141 3284        adp94xx         (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys

21:11:08.0172 3284        adp94xx - ok

21:11:08.0219 3284        adpahci         (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys

21:11:08.0250 3284        adpahci - ok

21:11:08.0281 3284        adpu320         (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys

21:11:08.0312 3284        adpu320 - ok

21:11:08.0343 3284        AeLookupSvc     (8b5eefeec1e6d1a72a06c526628ad161) C:\Windows\System32\aelupsvc.dll

21:11:08.0375 3284        AeLookupSvc - ok

21:11:08.0421 3284        AFD             (9ebbba55060f786f0fcaa3893bfa2806) C:\Windows\system32\drivers\afd.sys

21:11:08.0437 3284        AFD - ok

21:11:08.0562 3284        AgereSoftModem  (7e10e3bb9b258ad8a9300f91214d67b9) C:\Windows\system32\DRIVERS\AGRSM.sys

21:11:08.0609 3284        AgereSoftModem - ok

21:11:08.0640 3284        agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\drivers\agp440.sys

21:11:08.0655 3284        agp440 - ok

21:11:08.0687 3284        aic78xx         (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys

21:11:08.0702 3284        aic78xx - ok

21:11:08.0749 3284        ALG             (18a54e132947cd98fea9accc57f98f13) C:\Windows\System32\alg.exe

21:11:08.0765 3284        ALG - ok

21:11:08.0780 3284        aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\drivers\aliide.sys

21:11:08.0796 3284        aliide - ok

21:11:08.0827 3284        amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\drivers\amdagp.sys

21:11:08.0843 3284        amdagp - ok

21:11:08.0858 3284        amdide          (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\drivers\amdide.sys

21:11:08.0874 3284        amdide - ok

21:11:08.0905 3284        AmdK8           (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys

21:11:08.0921 3284        AmdK8 - ok

21:11:08.0952 3284        AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys

21:11:08.0967 3284        AmdPPM - ok

21:11:08.0983 3284        amdsata         (d320bf87125326f996d4904fe24300fc) C:\Windows\system32\drivers\amdsata.sys

21:11:09.0014 3284        amdsata - ok

21:11:09.0045 3284        amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys

21:11:09.0077 3284        amdsbs - ok

21:11:09.0092 3284        amdxata         (46387fb17b086d16dea267d5be23a2f2) C:\Windows\system32\drivers\amdxata.sys

21:11:09.0108 3284        amdxata - ok

21:11:09.0217 3284        AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) C:\Program Files\Avira\AntiVir Desktop\sched.exe

21:11:09.0233 3284        AntiVirSchedulerService - ok

21:11:09.0279 3284        AntiVirService  (a489be6bb0aa1ff406b488b60542314b) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

21:11:09.0295 3284        AntiVirService - ok

21:11:09.0342 3284        ApfiltrService  (3477e796ed9c9aace83eab276e4a92b9) C:\Windows\system32\DRIVERS\Apfiltr.sys

21:11:09.0357 3284        ApfiltrService - ok

21:11:09.0389 3284        AppID           (aea177f783e20150ace5383ee368da19) C:\Windows\system32\drivers\appid.sys

21:11:09.0435 3284        AppID - ok

21:11:09.0467 3284        AppIDSvc        (62a9c86cb6085e20db4823e4e97826f5) C:\Windows\System32\appidsvc.dll

21:11:09.0498 3284        AppIDSvc - ok

21:11:09.0545 3284        Appinfo         (fb1959012294d6ad43e5304df65e3c26) C:\Windows\System32\appinfo.dll

21:11:09.0576 3284        Appinfo - ok

21:11:09.0607 3284        arc             (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys

21:11:09.0638 3284        arc - ok

21:11:09.0638 3284        archlp - ok

21:11:09.0669 3284        arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys

21:11:09.0701 3284        arcsas - ok

21:11:09.0716 3284        AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys

21:11:09.0763 3284        AsyncMac - ok

21:11:09.0794 3284        atapi           (338c86357871c167a96ab976519bf59e) C:\Windows\system32\drivers\atapi.sys

21:11:09.0810 3284        atapi - ok

21:11:09.0857 3284        AthBTPort       (197f4b57b4ea30661330dc8ffe0ee161) C:\Windows\system32\DRIVERS\btath_flt.sys

21:11:09.0872 3284        AthBTPort - ok

21:11:09.0888 3284        ATHDFU          (99925b8ec4fccdb3992292fbcb31069e) C:\Windows\system32\Drivers\AthDfu.sys

21:11:09.0903 3284        ATHDFU - ok

21:11:09.0997 3284        AtherosSvc      (72dd61bb00496ec94e6da09437bc8901) D:\Bluetooth Suite\adminservice.exe

21:11:09.0997 3284        AtherosSvc - ok

21:11:10.0075 3284        AudioEndpointBuilder (ce3b4e731638d2ef62fcb419be0d39f0) C:\Windows\System32\Audiosrv.dll

21:11:10.0122 3284        AudioEndpointBuilder - ok

21:11:10.0137 3284        Audiosrv        (ce3b4e731638d2ef62fcb419be0d39f0) C:\Windows\System32\Audiosrv.dll

21:11:10.0184 3284        Audiosrv - ok

21:11:10.0247 3284        avgntflt        (d5541f0afb767e85fc412fc609d96a74) C:\Windows\system32\DRIVERS\avgntflt.sys

21:11:10.0278 3284        avgntflt - ok

21:11:10.0325 3284        avipbb          (7d967a682d4694df7fa57d63a2db01fe) C:\Windows\system32\DRIVERS\avipbb.sys

21:11:10.0340 3284        avipbb - ok

21:11:10.0356 3284        avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\Windows\system32\DRIVERS\avkmgr.sys

21:11:10.0371 3284        avkmgr - ok

21:11:10.0418 3284        avmaudio        (728c4a6c722535c16d1025f51aa31e22) C:\Windows\system32\DRIVERS\avmaudio.sys

21:11:10.0449 3284        avmaudio - ok

21:11:10.0481 3284        avmaura         (728c4a6c722535c16d1025f51aa31e22) C:\Windows\system32\DRIVERS\avmaura.sys

21:11:10.0496 3284        avmaura - ok

21:11:10.0527 3284        AxInstSV        (6e30d02aac9cac84f421622e3a2f6178) C:\Windows\System32\AxInstSV.dll

21:11:10.0559 3284        AxInstSV - ok

21:11:10.0621 3284        b06bdrv         (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys

21:11:10.0652 3284        b06bdrv - ok

21:11:10.0683 3284        b57nd60x        (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys

21:11:10.0715 3284        b57nd60x - ok

21:11:10.0761 3284        BDESVC          (ee1e9c3bb8228ae423dd38db69128e71) C:\Windows\System32\bdesvc.dll

21:11:10.0777 3284        BDESVC - ok

21:11:10.0793 3284        Beep            (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys

21:11:10.0839 3284        Beep - ok

21:11:10.0917 3284        BFE             (1e2bac209d184bb851e1a187d8a29136) C:\Windows\System32\bfe.dll

21:11:10.0980 3284        BFE - ok

21:11:11.0042 3284        BITS            (e585445d5021971fae10393f0f1c3961) C:\Windows\System32\qmgr.dll

21:11:11.0105 3284        BITS - ok

21:11:11.0136 3284        blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys

21:11:11.0151 3284        blbdrive - ok

21:11:11.0183 3284        bowser          (8f2da3028d5fcbd1a060a3de64cd6506) C:\Windows\system32\DRIVERS\bowser.sys

21:11:11.0214 3284        bowser - ok

21:11:11.0229 3284        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys

21:11:11.0245 3284        BrFiltLo - ok

21:11:11.0261 3284        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys

21:11:11.0292 3284        BrFiltUp - ok

21:11:11.0339 3284        Browser         (6e11f33d14d020f58d5e02e4d67dfa19) C:\Windows\System32\browser.dll

21:11:11.0370 3284        Browser - ok

21:11:11.0417 3284        Brserid         (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys

21:11:11.0448 3284        Brserid - ok

21:11:11.0463 3284        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys

21:11:11.0495 3284        BrSerWdm - ok

21:11:11.0510 3284        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys

21:11:11.0526 3284        BrUsbMdm - ok

21:11:11.0541 3284        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys

21:11:11.0557 3284        BrUsbSer - ok

21:11:11.0619 3284        BTATH_A2DP      (ff5542b83a41eb789f87a724874e7a3a) C:\Windows\system32\drivers\btath_a2dp.sys

21:11:11.0635 3284        BTATH_A2DP - ok

21:11:11.0666 3284        btath_avdt      (5e573c8f0985b6e2ccdb765986e3cc1c) C:\Windows\system32\drivers\btath_avdt.sys

21:11:11.0682 3284        btath_avdt - ok

21:11:11.0713 3284        BTATH_BUS       (9d605dbd544dc5654cdd9274a1ff5750) C:\Windows\system32\DRIVERS\btath_bus.sys

21:11:11.0729 3284        BTATH_BUS - ok

21:11:11.0760 3284        BTATH_HCRP      (4d5f0b263c75e17b5c73fda06117e3b0) C:\Windows\system32\DRIVERS\btath_hcrp.sys

21:11:11.0775 3284        BTATH_HCRP - ok

21:11:11.0791 3284        BTATH_LWFLT     (c05318684959d8990eb64c8b8aebc8a1) C:\Windows\system32\DRIVERS\btath_lwflt.sys

21:11:11.0807 3284        BTATH_LWFLT - ok

21:11:11.0838 3284        BTATH_RCP       (cffc4ad2da60565394d191f32c4b7ef7) C:\Windows\system32\DRIVERS\btath_rcp.sys

21:11:11.0869 3284        BTATH_RCP - ok

21:11:11.0931 3284        BtFilter        (910146ea960ac76648d99ad321130014) C:\Windows\system32\DRIVERS\btfilter.sys

21:11:11.0947 3284        BtFilter - ok

21:11:11.0963 3284        BthEnum         (2865a5c8e98c70c605f417908cebb3a4) C:\Windows\system32\DRIVERS\BthEnum.sys

21:11:11.0978 3284        BthEnum - ok

21:11:12.0009 3284        BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys

21:11:12.0041 3284        BTHMODEM - ok

21:11:12.0072 3284        BthPan          (ad1872e5829e8a2c3b5b4b641c3eab0e) C:\Windows\system32\DRIVERS\bthpan.sys

21:11:12.0103 3284        BthPan - ok

21:11:12.0150 3284        BTHPORT         (c2fbf6d271d9a94d839c416bf186ead9) C:\Windows\system32\Drivers\BTHport.sys

21:11:12.0181 3284        BTHPORT - ok

21:11:12.0197 3284        bthserv         (1df19c96eef6c29d1c3e1a8678e07190) C:\Windows\system32\bthserv.dll

21:11:12.0243 3284        bthserv - ok

21:11:12.0259 3284        BTHUSB          (c81e9413a25a439f436b1d4b6a0cf9e9) C:\Windows\system32\Drivers\BTHUSB.sys

21:11:12.0290 3284        BTHUSB - ok

21:11:12.0306 3284        cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys

21:11:12.0353 3284        cdfs - ok

21:11:12.0384 3284        cdrom           (be167ed0fdb9c1fa1133953c18d5a6c9) C:\Windows\system32\DRIVERS\cdrom.sys

21:11:12.0399 3284        cdrom - ok

21:11:12.0431 3284        ce6230          (ed49c07c591298e546545ef79b529f41) C:\Windows\system32\DRIVERS\CE6230StandaloneDriver.sys

21:11:12.0446 3284        ce6230 ( UnsignedFile.Multi.Generic ) - warning

21:11:12.0446 3284        ce6230 - detected UnsignedFile.Multi.Generic (1)

21:11:12.0462 3284        ce6230BDACAP    (21bcea4a57d7818a252f51674e2605dd) C:\Windows\system32\DRIVERS\CE6230BDA.sys

21:11:12.0462 3284        ce6230BDACAP ( UnsignedFile.Multi.Generic ) - warning

21:11:12.0462 3284        ce6230BDACAP - detected UnsignedFile.Multi.Generic (1)

21:11:12.0493 3284        CertPropSvc     (319c6b309773d063541d01df8ac6f55f) C:\Windows\System32\certprop.dll

21:11:12.0540 3284        CertPropSvc - ok

21:11:12.0555 3284        circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys

21:11:12.0587 3284        circlass - ok

21:11:12.0633 3284        CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys

21:11:12.0665 3284        CLFS - ok

21:11:12.0727 3284        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

21:11:12.0758 3284        clr_optimization_v2.0.50727_32 - ok

21:11:12.0852 3284        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

21:11:12.0867 3284        clr_optimization_v4.0.30319_32 - ok

21:11:12.0899 3284        CmBatt          (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys

21:11:12.0914 3284        CmBatt - ok

21:11:12.0961 3284        cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\drivers\cmdide.sys

21:11:12.0977 3284        cmdide - ok

21:11:13.0055 3284        CNG             (247b4ce2dab1160cd422d532d5241e1f) C:\Windows\system32\Drivers\cng.sys

21:11:13.0086 3284        CNG - ok

21:11:13.0117 3284        Compbatt        (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys

21:11:13.0133 3284        Compbatt - ok

21:11:13.0164 3284        CompositeBus    (cbe8c58a8579cfe5fccf809e6f114e89) C:\Windows\system32\drivers\CompositeBus.sys

21:11:13.0195 3284        CompositeBus - ok

21:11:13.0195 3284        COMSysApp - ok

21:11:13.0226 3284        crcdisk         (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys

21:11:13.0242 3284        crcdisk - ok

21:11:13.0289 3284        CryptSvc        (06e771aa596b8761107ab57e99f128d7) C:\Windows\system32\cryptsvc.dll

21:11:13.0320 3284        CryptSvc - ok

21:11:13.0382 3284        DcomLaunch      (7660f01d3b38aca1747e397d21d790af) C:\Windows\system32\rpcss.dll

21:11:13.0445 3284        DcomLaunch - ok

21:11:13.0491 3284        defragsvc       (8d6e10a2d9a5eed59562d9b82cf804e1) C:\Windows\System32\defragsvc.dll

21:11:13.0554 3284        defragsvc - ok

21:11:13.0585 3284        DfsC            (f024449c97ec1e464aaffda18593db88) C:\Windows\system32\Drivers\dfsc.sys

21:11:13.0632 3284        DfsC - ok

21:11:13.0679 3284        Dhcp            (e9e01eb683c132f7fa27cd607b8a2b63) C:\Windows\system32\dhcpcore.dll

21:11:13.0741 3284        Dhcp - ok

21:11:13.0757 3284        discache        (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys

21:11:13.0803 3284        discache - ok

21:11:13.0819 3284        Disk            (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys

21:11:13.0850 3284        Disk - ok

21:11:13.0881 3284        DKbFltr         (c701324c9e0c25dd9d60311bd87fbc84) C:\Windows\system32\DRIVERS\DKbFltr.sys

21:11:13.0897 3284        DKbFltr - ok

21:11:13.0944 3284        Dnscache        (33ef4861f19a0736b11314aad9ae28d0) C:\Windows\System32\dnsrslvr.dll

21:11:13.0975 3284        Dnscache - ok

21:11:14.0022 3284        dot3svc         (366ba8fb4b7bb7435e3b9eacb3843f67) C:\Windows\System32\dot3svc.dll

21:11:14.0069 3284        dot3svc - ok

21:11:14.0115 3284        DPS             (8ec04ca86f1d68da9e11952eb85973d6) C:\Windows\system32\dps.dll

21:11:14.0162 3284        DPS - ok

21:11:14.0209 3284        DritekPortIO    (5c918d413f5837e67a85775c9873775e) C:\Program Files\Launch Manager\DPortIO.sys

21:11:14.0225 3284        DritekPortIO - ok

21:11:14.0256 3284        drmkaud         (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys

21:11:14.0287 3284        drmkaud - ok

21:11:14.0318 3284        dsiarhwprog     (f35b5d0cc142b87e687fc504baa69d82) C:\Windows\system32\Drivers\dsiarhwprog.sys

21:11:14.0334 3284        dsiarhwprog - ok

21:11:14.0427 3284        DXGKrnl         (23f5d28378a160352ba8f817bd8c71cb) C:\Windows\System32\drivers\dxgkrnl.sys

21:11:14.0474 3284        DXGKrnl - ok

21:11:14.0505 3284        EapHost         (8600142fa91c1b96367d3300ad0f3f3a) C:\Windows\System32\eapsvc.dll

21:11:14.0552 3284        EapHost - ok

21:11:14.0849 3284        ebdrv           (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys

21:11:14.0927 3284        ebdrv - ok

21:11:15.0067 3284        EFS             (81951f51e318aecc2d68559e47485cc4) C:\Windows\System32\lsass.exe

21:11:15.0083 3284        EFS - ok

21:11:15.0161 3284        ehRecvr         (a8c362018efc87beb013ee28f29c0863) C:\Windows\ehome\ehRecvr.exe

21:11:15.0192 3284        ehRecvr - ok

21:11:15.0239 3284        ehSched         (d389bff34f80caede417bf9d1507996a) C:\Windows\ehome\ehsched.exe

21:11:15.0254 3284        ehSched - ok

21:11:15.0317 3284        ElbyCDIO        (d71233d7ccc2e64f8715a20428d5a33b) C:\Windows\system32\Drivers\ElbyCDIO.sys

21:11:15.0332 3284        ElbyCDIO - ok

21:11:15.0395 3284        elxstor         (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys

21:11:15.0426 3284        elxstor - ok

21:11:15.0473 3284        ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\drivers\errdev.sys

21:11:15.0488 3284        ErrDev - ok

21:11:15.0566 3284        EventSystem     (f6916efc29d9953d5d0df06882ae8e16) C:\Windows\system32\es.dll

21:11:15.0613 3284        EventSystem - ok

21:11:15.0644 3284        exfat           (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys

21:11:15.0691 3284        exfat - ok

21:11:15.0722 3284        fastfat         (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys

21:11:15.0769 3284        fastfat - ok

21:11:15.0847 3284        Fax             (967ea5b213e9984cbe270205df37755b) C:\Windows\system32\fxssvc.exe

21:11:15.0878 3284        Fax - ok

21:11:15.0909 3284        fdc             (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys

21:11:15.0941 3284        fdc - ok

21:11:15.0972 3284        fdPHost         (f3222c893bd2f5821a0179e5c71e88fb) C:\Windows\system32\fdPHost.dll

21:11:16.0019 3284        fdPHost - ok

21:11:16.0034 3284        FDResPub        (7dbe8cbfe79efbdeb98c9fb08d3a9a5b) C:\Windows\system32\fdrespub.dll

21:11:16.0081 3284        FDResPub - ok

21:11:16.0097 3284        FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys

21:11:16.0112 3284        FileInfo - ok

21:11:16.0128 3284        Filetrace       (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys

21:11:16.0175 3284        Filetrace - ok

21:11:16.0190 3284        flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys

21:11:16.0221 3284        flpydisk - ok

21:11:16.0253 3284        FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys

21:11:16.0284 3284        FltMgr - ok

21:11:16.0393 3284        FontCache       (b3a5ec6b6b6673db7e87c2bcdbddc074) C:\Windows\system32\FntCache.dll

21:11:16.0424 3284        FontCache - ok

21:11:16.0502 3284        FontCache3.0.0.0 (e56f39f6b7fda0ac77a79b0fd3de1a2f) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

21:11:16.0518 3284        FontCache3.0.0.0 - ok

21:11:16.0549 3284        FsDepends       (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys

21:11:16.0580 3284        FsDepends - ok

21:11:16.0611 3284        Fs_Rec          (7dae5ebcc80e45d3253f4923dc424d05) C:\Windows\system32\drivers\Fs_Rec.sys

21:11:16.0627 3284        Fs_Rec - ok

21:11:16.0689 3284        fvevol          (8a73e79089b282100b9393b644cb853b) C:\Windows\system32\DRIVERS\fvevol.sys

21:11:16.0705 3284        fvevol - ok

21:11:16.0736 3284        gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys

21:11:16.0752 3284        gagp30kx - ok

21:11:16.0799 3284        GigasetGenericUSB (997527391dec418dc62d784d848d73be) C:\Windows\system32\DRIVERS\GigasetGenericUSB.sys

21:11:16.0814 3284        GigasetGenericUSB - ok

21:11:16.0908 3284        gpsvc           (e897eaf5ed6ba41e081060c9b447a673) C:\Windows\System32\gpsvc.dll

21:11:16.0955 3284        gpsvc - ok

21:11:17.0048 3284        gusvc           (c1b577b2169900f4cf7190c39f085794) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

21:11:17.0079 3284        gusvc - ok

21:11:17.0095 3284        hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys

21:11:17.0111 3284        hcw85cir - ok

21:11:17.0157 3284        HdAudAddService (a5ef29d5315111c80a5c1abad14c8972) C:\Windows\system32\drivers\HdAudio.sys

21:11:17.0189 3284        HdAudAddService - ok

21:11:17.0220 3284        HDAudBus        (9036377b8a6c15dc2eec53e489d159b5) C:\Windows\system32\drivers\HDAudBus.sys

21:11:17.0251 3284        HDAudBus - ok

21:11:17.0267 3284        HidBatt         (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys

21:11:17.0282 3284        HidBatt - ok

21:11:17.0329 3284        HidBth          (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys

21:11:17.0345 3284        HidBth - ok

21:11:17.0376 3284        HidIr           (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys

21:11:17.0407 3284        HidIr - ok

21:11:17.0423 3284        hidserv         (2bc6f6a1992b3a77f5f41432ca6b3b6b) C:\Windows\system32\hidserv.dll

21:11:17.0469 3284        hidserv - ok

21:11:17.0501 3284        HidUsb          (10c19f8290891af023eaec0832e1eb4d) C:\Windows\system32\drivers\hidusb.sys

21:11:17.0516 3284        HidUsb - ok

21:11:17.0563 3284        hkmsvc          (196b4e3f4cccc24af836ce58facbb699) C:\Windows\system32\kmsvc.dll

21:11:17.0610 3284        hkmsvc - ok

21:11:17.0657 3284        HomeGroupListener (6658f4404de03d75fe3ba09f7aba6a30) C:\Windows\system32\ListSvc.dll

21:11:17.0672 3284        HomeGroupListener - ok

21:11:17.0719 3284        HomeGroupProvider (dbc02d918fff1cad628acbe0c0eaa8e8) C:\Windows\system32\provsvc.dll

21:11:17.0750 3284        HomeGroupProvider - ok

21:11:17.0781 3284        hotcore3        (67e058c7c9620acb257342bb6ea26475) C:\Windows\system32\DRIVERS\hotcore3.sys

21:11:17.0797 3284        hotcore3 - ok

21:11:17.0828 3284        HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\drivers\HpSAMD.sys

21:11:17.0844 3284        HpSAMD - ok

21:11:17.0922 3284        HTTP            (871917b07a141bff43d76d8844d48106) C:\Windows\system32\drivers\HTTP.sys

21:11:17.0984 3284        HTTP - ok

21:11:18.0015 3284        hwdatacard      (1720966d9c7ea5e2d78b6db92d2f9171) C:\Windows\system32\DRIVERS\ewusbmdm.sys

21:11:18.0031 3284        hwdatacard - ok

21:11:18.0047 3284        hwpolicy        (0c4e035c7f105f1299258c90886c64c5) C:\Windows\system32\drivers\hwpolicy.sys

21:11:18.0078 3284        hwpolicy - ok

21:11:18.0093 3284        i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\drivers\i8042prt.sys

21:11:18.0125 3284        i8042prt - ok

21:11:18.0218 3284        IAANTMON        (7548066df68a8a1a56b043359f915f37) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

21:11:18.0249 3284        IAANTMON - ok

21:11:18.0312 3284        iaStor          (d483687eace0c065ee772481a96e05f5) C:\Windows\system32\DRIVERS\iaStor.sys

21:11:18.0327 3284        iaStor - ok

21:11:18.0390 3284        iaStorV         (5cd5f9a5444e6cdcb0ac89bd62d8b76e) C:\Windows\system32\drivers\iaStorV.sys

21:11:18.0421 3284        iaStorV - ok

21:11:18.0593 3284        idsvc           (c521d7eb6497bb1af6afa89e322fb43c) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

21:11:18.0624 3284        idsvc - ok

21:11:18.0983 3284        IGBASVC         (f4ae2183b7f4e69c65c20d19d5862915) C:\Program Files\Acer Bio Protection\BASVC.exe

21:11:19.0061 3284        IGBASVC ( UnsignedFile.Multi.Generic ) - warning

21:11:19.0061 3284        IGBASVC - detected UnsignedFile.Multi.Generic (1)

21:11:19.0107 3284        IGDCTRL         (506801c7d47be8cd1cf342bf28eb17ec) D:\Fritzbox\FRITZ!DSL\IGDCTRL.EXE

21:11:19.0123 3284        IGDCTRL - ok

21:11:19.0263 3284        iirsp           (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys

21:11:19.0295 3284        iirsp - ok

21:11:19.0388 3284        IKEEXT          (f95622f161474511b8d80d6b093aa610) C:\Windows\System32\ikeext.dll

21:11:19.0451 3284        IKEEXT - ok

21:11:19.0482 3284        int15           (4d8d5b1c895ea0f2a721b98a7ce198f1) C:\Windows\system32\drivers\int15.sys

21:11:19.0482 3284        int15 ( UnsignedFile.Multi.Generic ) - warning

21:11:19.0482 3284        int15 - detected UnsignedFile.Multi.Generic (1)

21:11:19.0778 3284        IntcAzAudAddService (82c6cc8ef3494884aed412c127f36ea9) C:\Windows\system32\drivers\RTKVHDA.sys

21:11:19.0856 3284        IntcAzAudAddService - ok

21:11:20.0012 3284        intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\drivers\intelide.sys

21:11:20.0028 3284        intelide - ok

21:11:20.0059 3284        intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys

21:11:20.0090 3284        intelppm - ok

21:11:20.0121 3284        IPBusEnum       (acb364b9075a45c0736e5c47be5cae19) C:\Windows\system32\ipbusenum.dll

21:11:20.0168 3284        IPBusEnum - ok

21:11:20.0184 3284        IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys

21:11:20.0231 3284        IpFilterDriver - ok

21:11:20.0309 3284        iphlpsvc        (4d65a07b795d6674312f879d09aa7663) C:\Windows\System32\iphlpsvc.dll

21:11:20.0371 3284        iphlpsvc - ok

21:11:20.0402 3284        IPMIDRV         (4bd7134618c1d2a27466a099062547bf) C:\Windows\system32\drivers\IPMIDrv.sys

21:11:20.0433 3284        IPMIDRV - ok

21:11:20.0465 3284        IPNAT           (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys

21:11:20.0511 3284        IPNAT - ok

21:11:20.0527 3284        IRENUM          (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys

21:11:20.0558 3284        IRENUM - ok

21:11:20.0574 3284        isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\drivers\isapnp.sys

21:11:20.0605 3284        isapnp - ok

21:11:20.0636 3284        iScsiPrt        (cb7a9abb12b8415bce5d74994c7ba3ae) C:\Windows\system32\drivers\msiscsi.sys

21:11:20.0667 3284        iScsiPrt - ok

21:11:20.0699 3284        itecir          (15f737ceda08fe6501c930682616db79) C:\Windows\system32\DRIVERS\itecir.sys

21:11:20.0714 3284        itecir - ok

21:11:20.0745 3284        kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys

21:11:20.0777 3284        kbdclass - ok

21:11:20.0808 3284        kbdhid          (9e3ced91863e6ee98c24794d05e27a71) C:\Windows\system32\DRIVERS\kbdhid.sys

21:11:20.0839 3284        kbdhid - ok

21:11:20.0855 3284        KeyIso          (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe

21:11:20.0886 3284        KeyIso - ok

21:11:20.0917 3284        KSecDD          (b7895b4182c0d16f6efadeb8081e8d36) C:\Windows\system32\Drivers\ksecdd.sys

21:11:20.0933 3284        KSecDD - ok

21:11:20.0979 3284        KSecPkg         (d30159ac9237519fbc62c6ec247d2d46) C:\Windows\system32\Drivers\ksecpkg.sys

21:11:21.0011 3284        KSecPkg - ok

21:11:21.0057 3284        KtmRm           (89a7b9cc98d0d80c6f31b91c0a310fcd) C:\Windows\system32\msdtckrm.dll

21:11:21.0120 3284        KtmRm - ok

21:11:21.0135 3284        L1E             (f7cdaba15c7e853f0a11af6d77fca990) C:\Windows\system32\DRIVERS\L1E62x86.sys

21:11:21.0151 3284        L1E - ok

21:11:21.0198 3284        LanmanServer    (d64af876d53eca3668bb97b51b4e70ab) C:\Windows\system32\srvsvc.dll

21:11:21.0245 3284        LanmanServer - ok

21:11:21.0291 3284        LanmanWorkstation (58405e4f68ba8e4057c6e914f326aba2) C:\Windows\System32\wkssvc.dll

21:11:21.0338 3284        LanmanWorkstation - ok

21:11:21.0541 3284        Lavasoft Ad-Aware Service (c48b0f913c944d736a455191ecd8ff45) C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

21:11:21.0603 3284        Lavasoft Ad-Aware Service - ok

21:11:21.0650 3284        Lbd             (713cd5267abfb86fe90a72e384e82a38) C:\Windows\system32\DRIVERS\Lbd.sys

21:11:21.0681 3284        Lbd - ok

21:11:21.0744 3284        LBTServ         (3af6b73a3ad1fc37c5933441f66ceb91) C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe

21:11:21.0775 3284        LBTServ - ok

21:11:21.0791 3284        LHidFilt        (7f9c7b28cf1c859e1c42619eea946dc8) C:\Windows\system32\DRIVERS\LHidFilt.Sys

21:11:21.0806 3284        LHidFilt - ok

21:11:21.0853 3284        lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys

21:11:21.0900 3284        lltdio - ok

21:11:21.0931 3284        lltdsvc         (5700673e13a2117fa3b9020c852c01e2) C:\Windows\System32\lltdsvc.dll

21:11:21.0978 3284        lltdsvc - ok

21:11:21.0993 3284        lmhosts         (55ca01ba19d0006c8f2639b6c045e08b) C:\Windows\System32\lmhsvc.dll

21:11:22.0040 3284        lmhosts - ok

21:11:22.0056 3284        LMouFilt        (ab33792a87285344f43b5ce23421bab0) C:\Windows\system32\DRIVERS\LMouFilt.Sys

21:11:22.0071 3284        LMouFilt - ok

21:11:22.0103 3284        LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys

21:11:22.0118 3284        LSI_FC - ok

21:11:22.0134 3284        LSI_SAS         (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys

21:11:22.0165 3284        LSI_SAS - ok

21:11:22.0181 3284        LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys

21:11:22.0196 3284        LSI_SAS2 - ok

21:11:22.0227 3284        LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys

21:11:22.0243 3284        LSI_SCSI - ok

21:11:22.0274 3284        luafv           (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys

21:11:22.0321 3284        luafv - ok

21:11:22.0352 3284        Mcx2Svc         (bfb9ee8ee977efe85d1a3105abef6dd1) C:\Windows\system32\Mcx2Svc.dll

21:11:22.0383 3284        Mcx2Svc - ok

21:11:22.0399 3284        megasas         (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys

21:11:22.0430 3284        megasas - ok

21:11:22.0446 3284        MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys

21:11:22.0477 3284        MegaSR - ok

21:11:22.0508 3284        MMCSS           (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll

21:11:22.0555 3284        MMCSS - ok

21:11:22.0571 3284        Modem           (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys

21:11:22.0617 3284        Modem - ok

21:11:22.0633 3284        monitor         (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys

21:11:22.0649 3284        monitor - ok

21:11:22.0680 3284        mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys

21:11:22.0695 3284        mouclass - ok

21:11:22.0727 3284        mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys

21:11:22.0758 3284        mouhid - ok

21:11:22.0805 3284        mountmgr        (fc8771f45ecccfd89684e38842539b9b) C:\Windows\system32\drivers\mountmgr.sys

21:11:22.0820 3284        mountmgr - ok

21:11:22.0867 3284        mpio            (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\Windows\system32\drivers\mpio.sys

21:11:22.0883 3284        mpio - ok

21:11:22.0898 3284        mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys

21:11:22.0945 3284        mpsdrv - ok

21:11:23.0039 3284        MpsSvc          (9835584e999d25004e1ee8e5f3e3b881) C:\Windows\system32\mpssvc.dll

21:11:23.0085 3284        MpsSvc - ok

21:11:23.0132 3284        MRxDAV          (ceb46ab7c01c9f825f8cc6babc18166a) C:\Windows\system32\drivers\mrxdav.sys

21:11:23.0148 3284        MRxDAV - ok

21:11:23.0195 3284        mrxsmb          (5d16c921e3671636c0eba3bbaac5fd25) C:\Windows\system32\DRIVERS\mrxsmb.sys

21:11:23.0226 3284        mrxsmb - ok

21:11:23.0273 3284        mrxsmb10        (6d17a4791aca19328c685d256349fefc) C:\Windows\system32\DRIVERS\mrxsmb10.sys

21:11:23.0288 3284        mrxsmb10 - ok

21:11:23.0319 3284        mrxsmb20        (b81f204d146000be76651a50670a5e9e) C:\Windows\system32\DRIVERS\mrxsmb20.sys

21:11:23.0335 3284        mrxsmb20 - ok

21:11:23.0366 3284        msahci          (012c5f4e9349e711e11e0f19a8589f0a) C:\Windows\system32\drivers\msahci.sys

21:11:23.0397 3284        msahci - ok

21:11:23.0444 3284        msdsm           (55055f8ad8be27a64c831322a780a228) C:\Windows\system32\drivers\msdsm.sys

21:11:23.0475 3284        msdsm - ok

21:11:23.0507 3284        MSDTC           (e1bce74a3bd9902b72599c0192a07e27) C:\Windows\System32\msdtc.exe

21:11:23.0538 3284        MSDTC - ok

21:11:23.0569 3284        Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys

21:11:23.0616 3284        Msfs - ok

21:11:23.0631 3284        mshidkmdf       (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys

21:11:23.0678 3284        mshidkmdf - ok

21:11:23.0694 3284        msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\drivers\msisadrv.sys

21:11:23.0725 3284        msisadrv - ok

21:11:23.0756 3284        MSiSCSI         (90f7d9e6b6f27e1a707d4a297f077828) C:\Windows\system32\iscsiexe.dll

21:11:23.0803 3284        MSiSCSI - ok

21:11:23.0819 3284        msiserver - ok

21:11:23.0834 3284        MSKSSRV         (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys

21:11:23.0881 3284        MSKSSRV - ok

21:11:23.0897 3284        MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys

21:11:23.0943 3284        MSPCLOCK - ok

21:11:23.0959 3284        MSPQM           (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys

21:11:24.0006 3284        MSPQM - ok

21:11:24.0037 3284        MsRPC           (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys

21:11:24.0053 3284        MsRPC - ok

21:11:24.0099 3284        mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\drivers\mssmbios.sys

21:11:24.0131 3284        mssmbios - ok

21:11:24.0131 3284        MSTEE           (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys

21:11:24.0177 3284        MSTEE - ok

21:11:24.0193 3284        MTConfig        (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys

21:11:24.0224 3284        MTConfig - ok

21:11:24.0240 3284        Mup             (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys

21:11:24.0271 3284        Mup - ok

21:11:24.0333 3284        napagent        (61d57a5d7c6d9afe10e77dae6e1b445e) C:\Windows\system32\qagentRT.dll

21:11:24.0380 3284        napagent - ok

21:11:24.0443 3284        NativeWifiP     (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys

21:11:24.0474 3284        NativeWifiP - ok

21:11:24.0552 3284        NDIS            (e7c54812a2aaf43316eb6930c1ffa108) C:\Windows\system32\drivers\ndis.sys

21:11:24.0583 3284        NDIS - ok

21:11:24.0599 3284        NdisCap         (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys

21:11:24.0645 3284        NdisCap - ok

21:11:24.0661 3284        NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys

21:11:24.0708 3284        NdisTapi - ok

21:11:24.0755 3284        Ndisuio         (d8a65dafb3eb41cbb622745676fcd072) C:\Windows\system32\DRIVERS\ndisuio.sys

21:11:24.0801 3284        Ndisuio - ok

21:11:24.0848 3284        NdisWan         (38fbe267e7e6983311179230facb1017) C:\Windows\system32\DRIVERS\ndiswan.sys

21:11:24.0895 3284        NdisWan - ok

21:11:24.0926 3284        NDProxy         (a4bdc541e69674fbff1a8ff00be913f2) C:\Windows\system32\drivers\NDProxy.sys

21:11:24.0973 3284        NDProxy - ok

21:11:24.0989 3284        NetBIOS         (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys

21:11:25.0035 3284        NetBIOS - ok

21:11:25.0113 3284        NetBT           (280122ddcf04b378edd1ad54d71c1e54) C:\Windows\system32\DRIVERS\netbt.sys

21:11:25.0160 3284        NetBT - ok

21:11:25.0191 3284        Netlogon        (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe

21:11:25.0223 3284        Netlogon - ok

21:11:25.0285 3284        Netman          (7cccfca7510684768da22092d1fa4db2) C:\Windows\System32\netman.dll

21:11:25.0332 3284        Netman - ok

21:11:25.0379 3284        netprofm        (8c338238c16777a802d6a9211eb2ba50) C:\Windows\System32\netprofm.dll

21:11:25.0425 3284        netprofm - ok

21:11:25.0519 3284        NetTcpPortSharing (f476ec40033cdb91efbe73eb99b8362d) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

21:11:25.0535 3284        NetTcpPortSharing - ok

21:11:26.0127 3284        NETw5s32        (ef51b405ad8acaae6f0231290d20f516) C:\Windows\system32\DRIVERS\NETw5s32.sys

21:11:26.0252 3284        NETw5s32 - ok

21:11:26.0829 3284        netw5v32        (58218ec6b61b1169cf54aab0d00f5fe2) C:\Windows\system32\DRIVERS\netw5v32.sys

21:11:26.0939 3284        netw5v32 - ok

21:11:27.0157 3284        nfrd960         (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys

21:11:27.0188 3284        nfrd960 - ok

21:11:27.0235 3284        NlaSvc          (912084381d30d8b89ec4e293053f4710) C:\Windows\System32\nlasvc.dll

21:11:27.0282 3284        NlaSvc - ok

21:11:27.0344 3284        NMSAccessU      (fd306fbcce7adb1077b709742e7148e9) D:\CDBurnerXP\NMSAccessU.exe

21:11:27.0360 3284        NMSAccessU - ok

21:11:27.0391 3284        NPF             (6623e51595c0076755c29c00846c4eb2) C:\Windows\system32\drivers\npf.sys

21:11:27.0407 3284        NPF - ok

21:11:27.0422 3284        Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys

21:11:27.0469 3284        Npfs - ok

21:11:27.0485 3284        nsi             (ba387e955e890c8a88306d9b8d06bf17) C:\Windows\system32\nsisvc.dll

21:11:27.0547 3284        nsi - ok

21:11:27.0563 3284        nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys

21:11:27.0609 3284        nsiproxy - ok

21:11:27.0750 3284        Ntfs            (81189c3d7763838e55c397759d49007a) C:\Windows\system32\drivers\Ntfs.sys

21:11:27.0812 3284        Ntfs - ok

21:11:27.0812 3284        Null            (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys

21:11:27.0859 3284        Null - ok

21:11:27.0890 3284        NVHDA           (8571011b62ce0207fa1dc95d88308f1d) C:\Windows\system32\drivers\nvhda32v.sys

21:11:27.0906 3284        NVHDA - ok

21:11:29.0013 3284        nvlddmkm        (19f5c4949b2e4cbd2e95b8ecdfc84d25) C:\Windows\system32\DRIVERS\nvlddmkm.sys

21:11:29.0325 3284        nvlddmkm - ok

21:11:29.0481 3284        nvraid          (b3e25ee28883877076e0e1ff877d02e0) C:\Windows\system32\drivers\nvraid.sys

21:11:29.0513 3284        nvraid - ok

21:11:29.0544 3284        nvstor          (4380e59a170d88c4f1022eff6719a8a4) C:\Windows\system32\drivers\nvstor.sys

21:11:29.0559 3284        nvstor - ok

21:11:29.0606 3284        nvsvc           (7a68320fa236ed0479eff93540391568) C:\Windows\system32\nvvsvc.exe

21:11:29.0622 3284        nvsvc - ok

21:11:29.0653 3284        nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\drivers\nv_agp.sys

21:11:29.0669 3284        nv_agp - ok

21:11:29.0700 3284        ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\drivers\ohci1394.sys

21:11:29.0715 3284        ohci1394 - ok

21:11:29.0778 3284        p2pimsvc        (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll

21:11:29.0809 3284        p2pimsvc - ok

21:11:29.0856 3284        p2psvc          (59c3ddd501e39e006dac31bf55150d91) C:\Windows\system32\p2psvc.dll

21:11:29.0887 3284        p2psvc - ok

21:11:29.0934 3284        Paragon System Backup Dienst (f9aeb9655b5e1440c2d8ee4b2b5eb263) D:\Paragon Software\Paragon Backup and Recovery 10 Suite\program\dbhservice.exe

21:11:29.0949 3284        Paragon System Backup Dienst - ok

21:11:29.0996 3284        Parport         (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys

21:11:30.0012 3284        Parport - ok

21:11:30.0059 3284        partmgr         (3f34a1b4c5f6475f320c275e63afce9b) C:\Windows\system32\drivers\partmgr.sys

21:11:30.0074 3284        partmgr - ok

21:11:30.0090 3284        Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys

21:11:30.0121 3284        Parvdm - ok

21:11:30.0152 3284        PcaSvc          (358ab7956d3160000726574083dfc8a6) C:\Windows\System32\pcasvc.dll

21:11:30.0183 3284        PcaSvc - ok

21:11:30.0230 3284        pci             (673e55c3498eb970088e812ea820aa8f) C:\Windows\system32\drivers\pci.sys

21:11:30.0246 3284        pci - ok

21:11:30.0261 3284        pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\drivers\pciide.sys

21:11:30.0293 3284        pciide - ok

21:11:30.0324 3284        pcmcia          (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys

21:11:30.0355 3284        pcmcia - ok

21:11:30.0371 3284        pcw             (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys

21:11:30.0386 3284        pcw - ok

21:11:30.0449 3284        PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys

21:11:30.0511 3284        PEAUTH - ok

21:11:30.0714 3284        pla             (414bba67a3ded1d28437eb66aeb8a720) C:\Windows\system32\pla.dll

21:11:30.0792 3284        pla - ok

21:11:30.0948 3284        PlugPlay        (ec7bc28d207da09e79b3e9faf8b232ca) C:\Windows\system32\umpnpmgr.dll

21:11:30.0979 3284        PlugPlay - ok

21:11:31.0010 3284        PNRPAutoReg     (63ff8572611249931eb16bb8eed6afc8) C:\Windows\system32\pnrpauto.dll

21:11:31.0026 3284        PNRPAutoReg - ok

21:11:31.0073 3284        PNRPsvc         (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll

21:11:31.0088 3284        PNRPsvc - ok

21:11:31.0166 3284        PolicyAgent     (53946b69ba0836bd95b03759530c81ec) C:\Windows\System32\ipsecsvc.dll

21:11:31.0213 3284        PolicyAgent - ok

21:11:31.0275 3284        Power           (f87d30e72e03d579a5199ccb3831d6ea) C:\Windows\system32\umpo.dll

21:11:31.0322 3284        Power - ok

21:11:31.0369 3284        PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys

21:11:31.0416 3284        PptpMiniport - ok

21:11:31.0431 3284        Processor       (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys

21:11:31.0447 3284        Processor - ok

21:11:31.0509 3284        ProfSvc         (cadefac453040e370a1bdff3973be00d) C:\Windows\system32\profsvc.dll

21:11:31.0541 3284        ProfSvc - ok

21:11:31.0572 3284        ProtectedStorage (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe

21:11:31.0603 3284        ProtectedStorage - ok

21:11:31.0619 3284        Psched          (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys

21:11:31.0665 3284        Psched - ok

21:11:31.0806 3284        ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys

21:11:31.0868 3284        ql2300 - ok

21:11:32.0009 3284        ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys

21:11:32.0040 3284        ql40xx - ok

21:11:32.0071 3284        QWAVE           (31ac809e7707eb580b2bdb760390765a) C:\Windows\system32\qwave.dll

21:11:32.0102 3284        QWAVE - ok

21:11:32.0118 3284        QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys

21:11:32.0149 3284        QWAVEdrv - ok

21:11:32.0165 3284        RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys

21:11:32.0211 3284        RasAcd - ok

21:11:32.0227 3284        RasAgileVpn     (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys

21:11:32.0274 3284        RasAgileVpn - ok

21:11:32.0305 3284        RasAuto         (a60f1839849c0c00739787fd5ec03f13) C:\Windows\System32\rasauto.dll

21:11:32.0352 3284        RasAuto - ok

21:11:32.0383 3284        Rasl2tp         (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys

21:11:32.0430 3284        Rasl2tp - ok

21:11:32.0508 3284        RasMan          (cb9e04dc05eacf5b9a36ca276d475006) C:\Windows\System32\rasmans.dll

21:11:32.0555 3284        RasMan - ok

21:11:32.0586 3284        RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys

21:11:32.0633 3284        RasPppoe - ok

21:11:32.0648 3284        RasSstp         (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys

21:11:32.0695 3284        RasSstp - ok

21:11:32.0726 3284        rdbss           (d528bc58a489409ba40334ebf96a311b) C:\Windows\system32\DRIVERS\rdbss.sys

21:11:32.0773 3284        rdbss - ok

21:11:32.0804 3284        rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys

21:11:32.0835 3284        rdpbus - ok

21:11:32.0867 3284        RDPCDD          (23dae03f29d253ae74c44f99e515f9a1) C:\Windows\system32\DRIVERS\RDPCDD.sys

21:11:32.0898 3284        RDPCDD - ok

21:11:32.0913 3284        RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys

21:11:32.0960 3284        RDPENCDD - ok

21:11:32.0976 3284        RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys

21:11:33.0023 3284        RDPREFMP - ok

21:11:33.0069 3284        RDPWD           (f031683e6d1fea157abb2ff260b51e61) C:\Windows\system32\drivers\RDPWD.sys

21:11:33.0085 3284        RDPWD - ok

21:11:33.0147 3284        rdyboost        (518395321dc96fe2c9f0e96ac743b656) C:\Windows\system32\drivers\rdyboost.sys

21:11:33.0163 3284        rdyboost - ok

21:11:33.0194 3284        RemoteAccess    (7b5e1419717fac363a31cc302895217a) C:\Windows\System32\mprdim.dll

21:11:33.0257 3284        RemoteAccess - ok

21:11:33.0288 3284        RemoteRegistry  (cb9a8683f4ef2bf99e123d79950d7935) C:\Windows\system32\regsvc.dll

21:11:33.0335 3284        RemoteRegistry - ok

21:11:33.0381 3284        RFCOMM          (cb928d9e6daf51879dd6ba8d02f01321) C:\Windows\system32\DRIVERS\rfcomm.sys

21:11:33.0413 3284        RFCOMM - ok

21:11:33.0475 3284        rpcapd          (e51a8d02b4bd33eba1f7a5b76c3766ed) C:\Program Files\WinPcap\rpcapd.exe

21:11:33.0491 3284        rpcapd - ok

21:11:33.0506 3284        RpcEptMapper    (78d072f35bc45d9e4e1b61895c152234) C:\Windows\System32\RpcEpMap.dll

21:11:33.0569 3284        RpcEptMapper - ok

21:11:33.0584 3284        RpcLocator      (94d36c0e44677dd26981d2bfeef2a29d) C:\Windows\system32\locator.exe

21:11:33.0615 3284        RpcLocator - ok

21:11:33.0678 3284        RpcSs           (7660f01d3b38aca1747e397d21d790af) C:\Windows\system32\rpcss.dll

21:11:33.0725 3284        RpcSs - ok

21:11:33.0756 3284        rspndr          (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys

21:11:33.0803 3284        rspndr - ok

21:11:33.0849 3284        SamSs           (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe

21:11:33.0881 3284        SamSs - ok

21:11:33.0959 3284        SASDIFSV        (39763504067962108505bff25f024345) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS

21:11:33.0990 3284        SASDIFSV - ok

21:11:34.0021 3284        SASKUTIL        (77b9fc20084b48408ad3e87570eb4a85) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS

21:11:34.0037 3284        SASKUTIL - ok

21:11:34.0083 3284        sbp2port        (05d860da1040f111503ac416ccef2bca) C:\Windows\system32\drivers\sbp2port.sys

21:11:34.0115 3284        sbp2port - ok

21:11:34.0146 3284        SCardSvr        (8fc518ffe9519c2631d37515a68009c4) C:\Windows\System32\SCardSvr.dll

21:11:34.0193 3284        SCardSvr - ok

21:11:34.0224 3284        scfilter        (0693b5ec673e34dc147e195779a4dcf6) C:\Windows\system32\DRIVERS\scfilter.sys

21:11:34.0271 3284        scfilter - ok

21:11:34.0380 3284        Schedule        (a04bb13f8a72f8b6e8b4071723e4e336) C:\Windows\system32\schedsvc.dll

21:11:34.0442 3284        Schedule - ok

21:11:34.0473 3284        SCPolicySvc     (319c6b309773d063541d01df8ac6f55f) C:\Windows\System32\certprop.dll

21:11:34.0520 3284        SCPolicySvc - ok

21:11:34.0551 3284        sdbus           (0328be1c7f1cba23848179f8762e391c) C:\Windows\system32\drivers\sdbus.sys

21:11:34.0583 3284        sdbus - ok

21:11:34.0614 3284        SDRSVC          (08236c4bce5edd0a0318a438af28e0f7) C:\Windows\System32\SDRSVC.dll

21:11:34.0629 3284        SDRSVC - ok

21:11:34.0676 3284        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

21:11:34.0723 3284        secdrv - ok

21:11:34.0739 3284        seclogon        (a59b3a4442c52060cc7a85293aa3546f) C:\Windows\system32\seclogon.dll

21:11:34.0785 3284        seclogon - ok

21:11:34.0817 3284        SENS            (dcb7fcdcc97f87360f75d77425b81737) C:\Windows\System32\sens.dll

21:11:34.0863 3284        SENS - ok

21:11:34.0895 3284        SensrSvc        (50087fe1ee447009c9cc2997b90de53f) C:\Windows\system32\sensrsvc.dll

21:11:34.0910 3284        SensrSvc - ok

21:11:34.0926 3284        Serenum         (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys

21:11:34.0957 3284        Serenum - ok

21:11:34.0973 3284        Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys

21:11:35.0004 3284        Serial - ok

21:11:35.0035 3284        sermouse        (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys

21:11:35.0051 3284        sermouse - ok

21:11:35.0113 3284        SessionEnv      (4ae380f39a0032eab7dd953030b26d28) C:\Windows\system32\sessenv.dll

21:11:35.0160 3284        SessionEnv - ok

21:11:35.0191 3284        sffdisk         (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys

21:11:35.0207 3284        sffdisk - ok

21:11:35.0238 3284        sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\drivers\sffp_mmc.sys

21:11:35.0253 3284        sffp_mmc - ok

21:11:35.0269 3284        sffp_sd         (6d4ccaedc018f1cf52866bbbaa235982) C:\Windows\system32\DRIVERS\sffp_sd.sys

21:11:35.0300 3284        sffp_sd - ok

21:11:35.0331 3284        sfloppy         (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys

21:11:35.0363 3284        sfloppy - ok

21:11:35.0425 3284        SharedAccess    (d1a079a0de2ea524513b6930c24527a2) C:\Windows\System32\ipnathlp.dll

21:11:35.0487 3284        SharedAccess - ok

21:11:35.0565 3284        ShellHWDetection (414da952a35bf5d50192e28263b40577) C:\Windows\System32\shsvcs.dll

21:11:35.0612 3284        ShellHWDetection - ok

21:11:35.0659 3284        sisagp          (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\drivers\sisagp.sys

21:11:35.0675 3284        sisagp - ok

21:11:35.0721 3284        SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys

21:11:35.0737 3284        SiSRaid2 - ok

21:11:35.0768 3284        SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys

21:11:35.0784 3284        SiSRaid4 - ok

21:11:35.0799 3284        Smb             (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys

21:11:35.0846 3284        Smb - ok

21:11:35.0877 3284        SNMPTRAP        (6a984831644eca1a33ffeae4126f4f37) C:\Windows\System32\snmptrap.exe

21:11:35.0909 3284        SNMPTRAP - ok

21:11:35.0909 3284        spldr           (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys

21:11:35.0940 3284        spldr - ok

21:11:36.0002 3284        Spooler         (866a43013535dc8587c258e43579c764) C:\Windows\System32\spoolsv.exe

21:11:36.0049 3284        Spooler - ok

21:11:36.0392 3284        sppsvc          (cf87a1de791347e75b98885214ced2b8) C:\Windows\system32\sppsvc.exe

21:11:36.0486 3284        sppsvc - ok

21:11:36.0642 3284        sppuinotify     (b0180b20b065d89232a78a40fe56eaa6) C:\Windows\system32\sppuinotify.dll

21:11:36.0689 3284        sppuinotify - ok

21:11:36.0767 3284        srv             (e4c2764065d66ea1d2d3ebc28fe99c46) C:\Windows\system32\DRIVERS\srv.sys

21:11:36.0782 3284        srv - ok

21:11:36.0845 3284        srv2            (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\Windows\system32\DRIVERS\srv2.sys

21:11:36.0860 3284        srv2 - ok

21:11:36.0891 3284        srvnet          (be6bd660caa6f291ae06a718a4fa8abc) C:\Windows\system32\DRIVERS\srvnet.sys

21:11:36.0907 3284        srvnet - ok

21:11:36.0969 3284        SSDPSRV         (d887c9fd02ac9fa880f6e5027a43e118) C:\Windows\System32\ssdpsrv.dll

21:11:37.0016 3284        SSDPSRV - ok

21:11:37.0063 3284        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys

21:11:37.0079 3284        ssmdrv - ok

21:11:37.0110 3284        SstpSvc         (d318f23be45d5e3a107469eb64815b50) C:\Windows\system32\sstpsvc.dll

21:11:37.0157 3284        SstpSvc - ok

21:11:37.0188 3284        StarOpen        (f92254b0bcfcd10caac7bccc7cb7f467) C:\Windows\system32\drivers\StarOpen.sys

21:11:37.0188 3284        StarOpen ( UnsignedFile.Multi.Generic ) - warning

21:11:37.0188 3284        StarOpen - detected UnsignedFile.Multi.Generic (1)

21:11:37.0219 3284        stexstor        (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys

21:11:37.0235 3284        stexstor - ok

21:11:37.0328 3284        StiSvc          (e1fb3706030fb4578a0d72c2fc3689e4) C:\Windows\System32\wiaservc.dll

21:11:37.0359 3284        StiSvc - ok

21:11:37.0406 3284        swenum          (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\drivers\swenum.sys

21:11:37.0422 3284        swenum - ok

21:11:37.0500 3284        swprv           (a28bd92df340e57b024ba433165d34d7) C:\Windows\System32\swprv.dll

21:11:37.0547 3284        swprv - ok

21:11:37.0609 3284        SynTP           (47183e3520c88fadd5b0c87d57040da5) C:\Windows\system32\DRIVERS\SynTP.sys

21:11:37.0625 3284        SynTP - ok

21:11:37.0781 3284        SysMain         (36650d618ca34c9d357dfd3d89b2c56f) C:\Windows\system32\sysmain.dll

21:11:37.0827 3284        SysMain - ok

21:11:37.0874 3284        TabletInputService (763fecdc3d30c815fe72dd57936c6cd1) C:\Windows\System32\TabSvc.dll

21:11:37.0905 3284        TabletInputService - ok

21:11:37.0968 3284        TapiSrv         (613bf4820361543956909043a265c6ac) C:\Windows\System32\tapisrv.dll

21:11:38.0015 3284        TapiSrv - ok

21:11:38.0046 3284        TBS             (b799d9fdb26111737f58288d8dc172d9) C:\Windows\System32\tbssvc.dll

21:11:38.0093 3284        TBS - ok

21:11:38.0295 3284        Tcpip           (7fa2e0f8b072bd04b77b421480b6cc22) C:\Windows\system32\drivers\tcpip.sys

21:11:38.0342 3284        Tcpip - ok

21:11:38.0373 3284        TCPIP6          (7fa2e0f8b072bd04b77b421480b6cc22) C:\Windows\system32\DRIVERS\tcpip.sys

21:11:38.0420 3284        TCPIP6 - ok

21:11:38.0514 3284        tcpipreg        (cca24162e055c3714ce5a88b100c64ed) C:\Windows\system32\drivers\tcpipreg.sys

21:11:38.0561 3284        tcpipreg - ok

21:11:38.0607 3284        TDPIPE          (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\Windows\system32\drivers\tdpipe.sys

21:11:38.0623 3284        TDPIPE - ok

21:11:38.0654 3284        TDTCP           (2c2c5afe7ee4f620d69c23c0617651a8) C:\Windows\system32\drivers\tdtcp.sys

21:11:38.0685 3284        TDTCP - ok

21:11:38.0717 3284        tdx             (b459575348c20e8121d6039da063c704) C:\Windows\system32\DRIVERS\tdx.sys

21:11:38.0763 3284        tdx - ok

21:11:38.0795 3284        TermDD          (04dbf4b01ea4bf25a9a3e84affac9b20) C:\Windows\system32\drivers\termdd.sys

21:11:38.0826 3284        TermDD - ok

21:11:38.0904 3284        TermService     (382c804c92811be57829d8e550a900e2) C:\Windows\System32\termsrv.dll

21:11:38.0966 3284        TermService - ok

21:11:38.0997 3284        Themes          (42fb6afd6b79d9fe07381609172e7ca4) C:\Windows\system32\themeservice.dll

21:11:39.0029 3284        Themes - ok

21:11:39.0060 3284        THREADORDER     (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll

21:11:39.0107 3284        THREADORDER - ok

21:11:39.0122 3284        TrkWks          (4792c0378db99a9bc2ae2de6cfff0c3a) C:\Windows\System32\trkwks.dll

21:11:39.0169 3284        TrkWks - ok

21:11:39.0247 3284        TrustedInstaller (2c49b175aee1d4364b91b531417fe583) C:\Windows\servicing\TrustedInstaller.exe

21:11:39.0294 3284        TrustedInstaller - ok

21:11:39.0309 3284        tssecsrv        (254bb140eee3c59d6114c1a86b636877) C:\Windows\system32\DRIVERS\tssecsrv.sys

21:11:39.0356 3284        tssecsrv - ok

21:11:39.0387 3284        TsUsbFlt        (fd1d6c73e6333be727cbcc6054247654) C:\Windows\system32\drivers\tsusbflt.sys

21:11:39.0419 3284        TsUsbFlt - ok

21:11:39.0450 3284        tunnel          (b2fa25d9b17a68bb93d58b0556e8c90d) C:\Windows\system32\DRIVERS\tunnel.sys

21:11:39.0497 3284        tunnel - ok

21:11:39.0528 3284        uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys

21:11:39.0543 3284        uagp35 - ok

21:11:39.0606 3284        udfs            (ee43346c7e4b5e63e54f927babbb32ff) C:\Windows\system32\DRIVERS\udfs.sys

21:11:39.0653 3284        udfs - ok

21:11:39.0699 3284        UI0Detect       (8344fd4fce927880aa1aa7681d4927e5) C:\Windows\system32\UI0Detect.exe

21:11:39.0731 3284        UI0Detect - ok

21:11:39.0762 3284        uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\drivers\uliagpkx.sys

21:11:39.0777 3284        uliagpkx - ok

21:11:39.0809 3284        umbus           (d295bed4b898f0fd999fcfa9b32b071b) C:\Windows\system32\drivers\umbus.sys

21:11:39.0824 3284        umbus - ok

21:11:39.0855 3284        UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys

21:11:39.0887 3284        UmPass - ok

21:11:39.0933 3284        upnphost        (833fbb672460efce8011d262175fad33) C:\Windows\System32\upnphost.dll

21:11:39.0980 3284        upnphost - ok

21:11:39.0996 3284        usbbus - ok

21:11:40.0011 3284        usbccgp         (bd9c55d7023c5de374507acc7a14e2ac) C:\Windows\system32\DRIVERS\usbccgp.sys

21:11:40.0043 3284        usbccgp - ok

21:11:40.0089 3284        usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\drivers\usbcir.sys

21:11:40.0105 3284        usbcir - ok

21:11:40.0121 3284        UsbDiag - ok

21:11:40.0136 3284        usbehci         (f92de757e4b7ce9c07c5e65423f3ae3b) C:\Windows\system32\DRIVERS\usbehci.sys

21:11:40.0167 3284        usbehci - ok

21:11:40.0199 3284        usbhub          (8dc94aec6a7e644a06135ae7506dc2e9) C:\Windows\system32\DRIVERS\usbhub.sys

21:11:40.0277 3284        usbhub - ok

21:11:40.0277 3284        USBModem - ok

21:11:40.0292 3284        usbohci         (e185d44fac515a18d9deddc23c2cdf44) C:\Windows\system32\drivers\usbohci.sys

21:11:40.0323 3284        usbohci - ok

21:11:40.0339 3284        usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys

21:11:40.0370 3284        usbprint - ok

21:11:40.0401 3284        usbscan         (576096ccbc07e7c4ea4f5e6686d6888f) C:\Windows\system32\DRIVERS\usbscan.sys

21:11:40.0433 3284        usbscan - ok

21:11:40.0448 3284        USBSTOR         (f991ab9cc6b908db552166768176896a) C:\Windows\system32\DRIVERS\USBSTOR.SYS

21:11:40.0479 3284        USBSTOR - ok

21:11:40.0511 3284        usbuhci         (68df884cf41cdada664beb01daf67e3d) C:\Windows\system32\DRIVERS\usbuhci.sys

21:11:40.0542 3284        usbuhci - ok

21:11:40.0557 3284        usbvideo        (45f4e7bf43db40a6c6b4d92c76cbc3f2) C:\Windows\system32\Drivers\usbvideo.sys

21:11:40.0589 3284        usbvideo - ok

21:11:40.0620 3284        UxSms           (081e6e1c91aec36758902a9f727cd23c) C:\Windows\System32\uxsms.dll

21:11:40.0667 3284        UxSms - ok

21:11:40.0698 3284        VaultSvc        (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe

21:11:40.0729 3284        VaultSvc - ok

21:11:40.0760 3284        VClone          (1cdaa48cb2f7744b8d25650e050766a5) C:\Windows\system32\DRIVERS\VClone.sys

21:11:40.0776 3284        VClone - ok

21:11:40.0823 3284        vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\drivers\vdrvroot.sys

21:11:40.0838 3284        vdrvroot - ok

21:11:40.0916 3284        vds             (c3cd30495687c2a2f66a65ca6fd89be9) C:\Windows\System32\vds.exe

21:11:40.0979 3284        vds - ok

21:11:41.0057 3284        vfsFPService    (eb611abe69d6b4086fd2d5dcdc98c8d0) C:\Windows\system32\vfsFPService.exe

21:11:41.0088 3284        vfsFPService - ok

21:11:41.0103 3284        vga             (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys

21:11:41.0135 3284        vga - ok

21:11:41.0150 3284        VgaSave         (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys

21:11:41.0197 3284        VgaSave - ok

21:11:41.0244 3284        vhdmp           (5461686cca2fda57b024547733ab42e3) C:\Windows\system32\drivers\vhdmp.sys

21:11:41.0275 3284        vhdmp - ok

21:11:41.0306 3284        viaagp          (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\drivers\viaagp.sys

21:11:41.0322 3284        viaagp - ok

21:11:41.0353 3284        ViaC7           (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys

21:11:41.0369 3284        ViaC7 - ok

21:11:41.0384 3284        viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\drivers\viaide.sys

21:11:41.0415 3284        viaide - ok

21:11:41.0431 3284        volmgr          (4c63e00f2f4b5f86ab48a58cd990f212) C:\Windows\system32\drivers\volmgr.sys

21:11:41.0462 3284        volmgr - ok

21:11:41.0509 3284        volmgrx         (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys

21:11:41.0540 3284        volmgrx - ok

21:11:41.0571 3284        volsnap         (f497f67932c6fa693d7de2780631cfe7) C:\Windows\system32\drivers\volsnap.sys

21:11:41.0603 3284        volsnap - ok

21:11:41.0634 3284        vsmraid         (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys

21:11:41.0649 3284        vsmraid - ok

21:11:41.0790 3284        VSS             (209a3b1901b83aeb8527ed211cce9e4c) C:\Windows\system32\vssvc.exe

21:11:41.0852 3284        VSS - ok

21:11:41.0868 3284        vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys

21:11:41.0899 3284        vwifibus - ok

21:11:41.0930 3284        vwififlt        (7090d3436eeb4e7da3373090a23448f7) C:\Windows\system32\DRIVERS\vwififlt.sys

21:11:41.0961 3284        vwififlt - ok

21:11:41.0961 3284        vwifimp         (a3f04cbea6c2a10e6cb01f8b47611882) C:\Windows\system32\DRIVERS\vwifimp.sys

21:11:41.0993 3284        vwifimp - ok

21:11:42.0055 3284        W32Time         (55187fd710e27d5095d10a472c8baf1c) C:\Windows\system32\w32time.dll

21:11:42.0117 3284        W32Time - ok

21:11:42.0133 3284        WacomPen        (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys

21:11:42.0149 3284        WacomPen - ok

21:11:42.0195 3284        WANARP          (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys

21:11:42.0242 3284        WANARP - ok

21:11:42.0242 3284        Wanarpv6        (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys

21:11:42.0289 3284        Wanarpv6 - ok

21:11:42.0445 3284        WatAdminSvc     (353a04c273ec58475d8633e75ccd5604) C:\Windows\system32\Wat\WatAdminSvc.exe

21:11:42.0507 3284        WatAdminSvc - ok

21:11:42.0663 3284        wbengine        (691e3285e53dca558e1a84667f13e15a) C:\Windows\system32\wbengine.exe

21:11:42.0710 3284        wbengine - ok

21:11:42.0757 3284        WbioSrvc        (9614b5d29dc76ac3c29f6d2d3aa70e67) C:\Windows\System32\wbiosrvc.dll

21:11:42.0788 3284        WbioSrvc - ok

21:11:42.0851 3284        wcncsvc         (34eee0dfaadb4f691d6d5308a51315dc) C:\Windows\System32\wcncsvc.dll

21:11:42.0882 3284        wcncsvc - ok

21:11:42.0913 3284        WcsPlugInService (5d930b6357a6d2af4d7653bdabbf352f) C:\Windows\System32\WcsPlugInService.dll

21:11:42.0929 3284        WcsPlugInService - ok

21:11:42.0975 3284        Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys

21:11:43.0007 3284        Wd - ok

21:11:43.0069 3284        Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys

21:11:43.0100 3284        Wdf01000 - ok

21:11:43.0131 3284        WdiServiceHost  (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll

21:11:43.0163 3284        WdiServiceHost - ok

21:11:43.0163 3284        WdiSystemHost   (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll

21:11:43.0194 3284        WdiSystemHost - ok

21:11:43.0256 3284        WebClient       (a9d880f97530d5b8fee278923349929d) C:\Windows\System32\webclnt.dll

21:11:43.0287 3284        WebClient - ok

21:11:43.0319 3284        Wecsvc          (760f0afe937a77cff27153206534f275) C:\Windows\system32\wecsvc.dll

21:11:43.0365 3284        Wecsvc - ok

21:11:43.0381 3284        wercplsupport   (ac804569bb2364fb6017370258a4091b) C:\Windows\System32\wercplsupport.dll

21:11:43.0443 3284        wercplsupport - ok

21:11:43.0459 3284        WerSvc          (08e420d873e4fd85241ee2421b02c4a4) C:\Windows\System32\WerSvc.dll

21:11:43.0506 3284        WerSvc - ok

21:11:43.0537 3284        WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys

21:11:43.0584 3284        WfpLwf - ok

21:11:43.0599 3284        WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys

21:11:43.0615 3284        WIMMount - ok

21:11:43.0740 3284        WinDefend       (3fae8f94296001c32eab62cd7d82e0fd) C:\Program Files\Windows Defender\mpsvc.dll

21:11:43.0771 3284        WinDefend - ok

21:11:43.0787 3284        WinHttpAutoProxySvc - ok

21:11:43.0865 3284        Winmgmt         (f62e510b6ad4c21eb9fe8668ed251826) C:\Windows\system32\wbem\WMIsvc.dll

21:11:43.0911 3284        Winmgmt - ok

21:11:44.0067 3284        WinRM           (1b91cd34ea3a90ab6a4ef0550174f4cc) C:\Windows\system32\WsmSvc.dll

21:11:44.0130 3284        WinRM - ok

21:11:44.0223 3284        WinUSB          (a67e5f9a400f3bd1be3d80613b45f708) C:\Windows\system32\DRIVERS\WinUSB.sys

21:11:44.0255 3284        WinUSB - ok

21:11:44.0348 3284        Wlansvc         (16935c98ff639d185086a3529b1f2067) C:\Windows\System32\wlansvc.dll

21:11:44.0395 3284        Wlansvc - ok

21:11:44.0395 3284        WmiAcpi         (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\drivers\wmiacpi.sys

21:11:44.0426 3284        WmiAcpi - ok

21:11:44.0504 3284        wmiApSrv        (6eb6b66517b048d87dc1856ddf1f4c3f) C:\Windows\system32\wbem\WmiApSrv.exe

21:11:44.0535 3284        wmiApSrv - ok

21:11:44.0707 3284        WMPNetworkSvc   (3b40d3a61aa8c21b88ae57c58ab3122e) C:\Program Files\Windows Media Player\wmpnetwk.exe

21:11:44.0738 3284        WMPNetworkSvc - ok

21:11:44.0769 3284        WPCSvc          (a2f0ec770a92f2b3f9de6d518e11409c) C:\Windows\System32\wpcsvc.dll

21:11:44.0801 3284        WPCSvc - ok

21:11:44.0847 3284        WPDBusEnum      (aa53356d60af47eacc85bc617a4f3f66) C:\Windows\system32\wpdbusenum.dll

21:11:44.0879 3284        WPDBusEnum - ok

21:11:44.0925 3284        ws2ifsl         (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys

21:11:44.0972 3284        ws2ifsl - ok

21:11:44.0988 3284        wscsvc          (6f5d49efe0e7164e03ae773a3fe25340) C:\Windows\System32\wscsvc.dll

21:11:45.0019 3284        wscsvc - ok

21:11:45.0050 3284        WSDPrintDevice  (553f6ccd7c58eb98d4a8fbdaf283d7a9) C:\Windows\system32\DRIVERS\WSDPrint.sys

21:11:45.0081 3284        WSDPrintDevice - ok

21:11:45.0081 3284        WSearch - ok

21:11:45.0300 3284        wuauserv        (fc3ec24fce372c89423e015a2ac1a31e) C:\Windows\system32\wuaueng.dll

21:11:45.0378 3284        wuauserv - ok

21:11:45.0534 3284        WudfPf          (e714a1c0354636837e20ccbf00888ee7) C:\Windows\system32\drivers\WudfPf.sys

21:11:45.0581 3284        WudfPf - ok

21:11:45.0612 3284        WUDFRd          (1023ee888c9b47178c5293ed5336ab69) C:\Windows\system32\DRIVERS\WUDFRd.sys

21:11:45.0659 3284        WUDFRd - ok

21:11:45.0705 3284        wudfsvc         (8d1e1e529a2c9e9b6a85b55a345f7629) C:\Windows\System32\WUDFSvc.dll

21:11:45.0752 3284        wudfsvc - ok

21:11:45.0799 3284        WwanSvc         (ff2d745b560f7c71b31f30f4d49f73d2) C:\Windows\System32\wwansvc.dll

21:11:45.0830 3284        WwanSvc - ok

21:11:45.0924 3284        {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054} (74ec37b9eaf9fca015b933a526825c7a) D:\CyberLink\PowerDVD8\PowerDVD8\000.fcl

21:11:45.0939 3284        {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054} - ok

21:11:45.0955 3284        MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0

21:11:46.0002 3284        \Device\Harddisk0\DR0 - ok

21:11:46.0017 3284        MBR (0x1B8)     (8ddf737397eb2d09985691aeeb11731b) \Device\Harddisk1\DR1

21:11:46.0127 3284        \Device\Harddisk1\DR1 - ok

21:11:46.0142 3284        Boot (0x1200)   (dc4c5d3f6ad379009f6e1c6713060f5f) \Device\Harddisk0\DR0\Partition0

21:11:46.0142 3284        \Device\Harddisk0\DR0\Partition0 - ok

21:11:46.0142 3284        Boot (0x1200)   (814ba6653bcef432bdfe29eaf4e44692) \Device\Harddisk0\DR0\Partition1

21:11:46.0158 3284        \Device\Harddisk0\DR0\Partition1 - ok

21:11:46.0173 3284        Boot (0x1200)   (b4c196ad7db3063542d0b683d282e47a) \Device\Harddisk0\DR0\Partition2

21:11:46.0173 3284        \Device\Harddisk0\DR0\Partition2 - ok

21:11:46.0205 3284        Boot (0x1200)   (0b6dce2a0372650655720edf928aacc7) \Device\Harddisk1\DR1\Partition0

21:11:46.0205 3284        \Device\Harddisk1\DR1\Partition0 - ok

21:11:46.0220 3284        Boot (0x1200)   (b6d47442ab71bbd3608f7ecec7401b7b) \Device\Harddisk1\DR1\Partition1

21:11:46.0220 3284        \Device\Harddisk1\DR1\Partition1 - ok

21:11:46.0251 3284        Boot (0x1200)   (e5ca43e037295daaa6245eb34a2bb117) \Device\Harddisk1\DR1\Partition2

21:11:46.0251 3284        \Device\Harddisk1\DR1\Partition2 - ok

21:11:46.0267 3284        Boot (0x1200)   (865d1745d9838ce9c507d6d43ce114c5) \Device\Harddisk1\DR1\Partition3

21:11:46.0267 3284        \Device\Harddisk1\DR1\Partition3 - ok

21:11:46.0298 3284        Boot (0x1200)   (aee1167a15a3bbabd6f246cea6e4409e) \Device\Harddisk1\DR1\Partition4

21:11:46.0298 3284        \Device\Harddisk1\DR1\Partition4 - ok

21:11:46.0298 3284        ============================================================

21:11:46.0298 3284        Scan finished

21:11:46.0298 3284        ============================================================

21:11:46.0314 3668        Detected object count: 5

21:11:46.0314 3668        Actual detected object count: 5

21:11:47.0811 3668        ce6230 ( UnsignedFile.Multi.Generic ) - skipped by user

21:11:47.0811 3668        ce6230 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

21:11:47.0811 3668        ce6230BDACAP ( UnsignedFile.Multi.Generic ) - skipped by user

21:11:47.0811 3668        ce6230BDACAP ( UnsignedFile.Multi.Generic ) - User select action: Skip 

21:11:47.0827 3668        IGBASVC ( UnsignedFile.Multi.Generic ) - skipped by user

21:11:47.0827 3668        IGBASVC ( UnsignedFile.Multi.Generic ) - User select action: Skip 

21:11:47.0843 3668        int15 ( UnsignedFile.Multi.Generic ) - skipped by user

21:11:47.0843 3668        int15 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

21:11:47.0843 3668        StarOpen ( UnsignedFile.Multi.Generic ) - skipped by user

21:11:47.0843 3668        StarOpen ( UnsignedFile.Multi.Generic ) - User select action: Skip

Danke schön nochmal für Deine Mühe,
bin echt froh, das es solche wie euch gibt.

Schöne Grüße und bis dann
Bodo

Hey Arne,

sag mal,
ist die Größe oder die Menge der ganzen log´s eigentlich normal, oder bin ich wirklich so arg zugemüllt?

Schönen Gruß
Bodo

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Hey Arne,

hier ist der log von Combo

Code:

ComboFix 12-07-21.01 - Bodo 21.07.2012  22:36:02.1.2 - x86

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3069.1988 [GMT 2:00]

ausgeführt von:: c:\users\Bodo\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {61CDFD9D-3CAC-9270-C6FC-52325ACB795B}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\IsUn0407.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-06-21 bis 2012-07-21  ))))))))))))))))))))))))))))))

.

.

2012-07-20 23:19 . 2012-06-29 08:44        6891424        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{FE0D253A-F7F1-4975-87A4-929AB0BF73F9}\mpengine.dll

2012-07-20 04:36 . 2012-07-20 04:36        --------        d-----w-        C:\_OTL

2012-07-15 16:45 . 2012-07-15 16:45        --------        d-----w-        c:\users\Bodo\AppData\Roaming\SUPERAntiSpyware.com

2012-07-15 16:44 . 2012-07-15 16:45        --------        d-----w-        c:\program files\SUPERAntiSpyware

2012-07-15 16:44 . 2012-07-15 16:44        --------        d-----w-        c:\programdata\SUPERAntiSpyware.com

2012-07-15 14:20 . 2012-07-15 14:20        --------        d-----w-        c:\program files\ESET

2012-07-12 21:02 . 2012-07-12 21:02        --------        d-----w-        c:\program files\Common Files\Java

2012-07-12 21:02 . 2012-07-12 21:02        --------        d-----w-        c:\program files\Oracle

2012-07-11 21:38 . 2012-06-12 02:40        2345984        ----a-w-        c:\windows\system32\win32k.sys

2012-07-09 21:11 . 2012-07-09 21:11        --------        d-----w-        c:\users\Bodo\AppData\Roaming\Malwarebytes

2012-07-09 21:11 . 2012-07-09 21:11        --------        d-----w-        c:\programdata\Malwarebytes

2012-07-09 21:11 . 2012-07-15 07:50        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2012-07-09 21:11 . 2012-07-03 11:46        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-07-09 20:56 . 2012-07-09 20:56        476936        ----a-w-        c:\windows\system32\npdeployJava1.dll

2012-07-09 20:56 . 2012-07-12 21:01        --------        d-----w-        c:\program files\Java

2012-06-23 22:16 . 2012-06-23 22:16        --------        d-----w-        c:\users\Bodo\AppData\Local\Macromedia

2012-06-23 21:05 . 2012-06-02 22:19        53784        ----a-w-        c:\windows\system32\wuauclt.exe

2012-06-23 21:05 . 2012-06-02 22:19        45080        ----a-w-        c:\windows\system32\wups2.dll

2012-06-23 21:05 . 2012-06-02 22:12        2422272        ----a-w-        c:\windows\system32\wucltux.dll

2012-06-23 21:05 . 2012-06-02 22:19        1933848        ----a-w-        c:\windows\system32\wuaueng.dll

2012-06-23 21:05 . 2012-06-02 22:19        35864        ----a-w-        c:\windows\system32\wups.dll

2012-06-23 21:05 . 2012-06-02 22:19        577048        ----a-w-        c:\windows\system32\wuapi.dll

2012-06-23 21:05 . 2012-06-02 22:12        88576        ----a-w-        c:\windows\system32\wudriver.dll

2012-06-23 21:04 . 2012-06-02 13:19        171904        ----a-w-        c:\windows\system32\wuwebv.dll

2012-06-23 21:04 . 2012-06-02 13:12        33792        ----a-w-        c:\windows\system32\wuapp.exe

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-07-12 14:23 . 2012-03-29 16:32        426184        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2012-07-12 14:23 . 2011-06-07 04:21        70344        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-07-05 20:06 . 2010-05-31 19:10        687544        ----a-w-        c:\windows\system32\deployJava1.dll

2012-05-31 10:25 . 2009-11-17 22:14        237072        ------w-        c:\windows\system32\MpSigStub.exe

2012-05-15 03:03 . 2012-06-13 20:52        981504        ----a-w-        c:\windows\system32\wininet.dll

2012-05-09 04:27 . 2012-01-04 23:58        137928        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2012-05-09 04:27 . 2009-11-17 22:11        83392        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2012-05-01 04:44 . 2012-06-13 20:52        164352        ----a-w-        c:\windows\system32\profsvc.dll

2012-04-28 03:17 . 2012-06-13 20:52        183808        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-04-26 04:45 . 2012-06-13 20:52        58880        ----a-w-        c:\windows\system32\rdpwsx.dll

2012-04-26 04:45 . 2012-06-13 20:52        129536        ----a-w-        c:\windows\system32\rdpcorekmts.dll

2012-04-26 04:41 . 2012-06-13 20:52        8192        ----a-w-        c:\windows\system32\rdrmemptylst.exe

2012-04-24 04:36 . 2012-06-13 20:52        140288        ----a-w-        c:\windows\system32\cryptsvc.dll

2012-04-24 04:36 . 2012-06-13 20:52        1158656        ----a-w-        c:\windows\system32\crypt32.dll

2012-04-24 04:36 . 2012-06-13 20:52        103936        ----a-w-        c:\windows\system32\cryptnet.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AVMUSBFernanschluss"="c:\users\Bodo\AppData\Local\Apps\2.0\8C4DLC30.M1O\BW4CZV7Q.50A\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\AVMAutoStart.exe" [2010-11-22 147456]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-06-26 3906432]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"AutoLaunch"="c:\program files\Lavasoft\Ad-Aware\AutoLaunch.exe" [2011-05-19 743584]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"PLFSetI"="c:\windows\PLFSetI.exe" [2008-06-30 200704]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]

"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2009-08-07 225280]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-06-18 1537320]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-09-04 7731744]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-05-09 348624]

"AtherosBtStack"="d:\bluetooth suite\BtvStack.exe" [2011-03-31 605344]

"AthBtTray"="d:\bluetooth suite\AthBtTray.exe" [2011-03-31 519328]

"PDFPrint"="d:\pdf24 (pdf kreieren)\pdf24.exe" [2012-05-07 160840]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]

.

c:\users\Bodo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

FRITZ!DSL Protect.lnk - d:\fritzbox\FRITZ!DSL\FwebProt.exe [2009-4-9 1061688]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Logitech SetPoint.lnk - d:\maus\Logitech\SetPoint\SetPoint.exe [2009-11-18 813584]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2011-05-04 17:54        551296        ----a-w-        c:\program files\SUPERAntiSpyware\SASWINLO.DLL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]

2009-07-20 11:28        72208        ----a-w-        c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Notification Packages        REG_MULTI_SZ           c:\program files\Acer Bio Protection\PwdFilter

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^Users^Bodo^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Produktregistrierung.lnk]

backup=c:\windows\pss\Logitech . Produktregistrierung.lnk.Startup

backupExtension=.Startup

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVMUSBFernanschluss

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]

2009-09-01 16:00        75048        ------w-        c:\program files\Cyberlink\Shared files\brs.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]

2008-06-16 09:58        809480        ----a-w-        c:\program files\Launch Manager\LManager.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mspd]

2003-08-27 22:22        389632        ----a-w-        c:\windows\System32\mspd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVD8LanguageShortcut]

2009-04-15 22:54        50472        ------w-        d:\cyberlink\PowerDVD8\PowerDVD8\Language\Language.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl8]

2009-04-15 22:52        91432        ------w-        d:\cyberlink\PowerDVD8\PowerDVD8\PDVD8Serv.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]

2009-05-26 22:31        85160        ----a-w-        d:\virtualclonedrive\VCDDaemon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VitaKeyPdtWzd]

2009-09-05 08:16        3622912        ----a-w-        c:\program files\Acer Bio Protection\PdtWzd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]

"DBHAgent"=d:\paragon software\Paragon Backup and Recovery 10 Suite\program\dbhagent.exe

.

R1 archlp;archlp;c:\windows\system32\drivers\archlp.sys [x]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]

R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [x]

R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys [x]

R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [x]

R3 btath_avdt;Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys [x]

R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [x]

R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [x]

R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [x]

R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [x]

R3 ce6230;Intel CE6230 Standalone USB Driver;c:\windows\system32\DRIVERS\CE6230StandaloneDriver.sys [x]

R3 ce6230BDACAP;Realfine CE6230 BDA Driver;c:\windows\system32\DRIVERS\CE6230BDA.sys [x]

R3 dsiarhwprog;dsiarhwprog;c:\windows\system32\Drivers\dsiarhwprog.sys [x]

R3 GigasetGenericUSB;GigasetGenericUSB;c:\windows\system32\DRIVERS\GigasetGenericUSB.sys [x]

R3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]

R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x]

R3 Paragon System Backup Dienst;Paragon System Backup Dienst;d:\paragon software\Paragon Backup and Recovery 10 Suite\program\dbhservice.exe [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]

S0 hotcore3;hc3ServiceName;c:\windows\system32\DRIVERS\hotcore3.sys [x]

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [x]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [x]

S2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};Power Control [2010/01/06 23:51];d:\cyberlink\PowerDVD8\PowerDVD8\000.fcl [x]

S2 AAV UpdateService;AAV UpdateService;d:\homebanking\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [x]

S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [x]

S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [x]

S2 AtherosSvc;AtherosSvc;d:\bluetooth suite\adminservice.exe [x]

S2 IGBASVC;EgisTec Service;c:\program files\Acer Bio Protection\BASVC.exe [x]

S2 IGDCTRL;AVM IGD CTRL Service;d:\fritzbox\FRITZ!DSL\IGDCTRL.EXE [x]

S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [x]

S2 vfsFPService;Validity Fingerprint Service;c:\windows\system32\vfsFPService.exe [x]

S3 avmaudio;AVM Audio;c:\windows\system32\DRIVERS\avmaudio.sys [x]

S3 avmaura;AVM USB-Fernanschluss;c:\windows\system32\DRIVERS\avmaura.sys [x]

S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [x]

S3 itecir;ITECIR Infrared Receiver;c:\windows\system32\DRIVERS\itecir.sys [x]

S3 NETw5s32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 32-Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [x]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [x]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

.

.

Inhalt des "geplante Tasks" Ordners

.

2012-07-21 c:\windows\Tasks\Ad-Aware Update (Daily 1).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 05:21]

.

2012-07-21 c:\windows\Tasks\Ad-Aware Update (Daily 2).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 05:21]

.

2012-07-21 c:\windows\Tasks\Ad-Aware Update (Daily 3).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 05:21]

.

2012-07-21 c:\windows\Tasks\Ad-Aware Update (Daily 4).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 05:21]

.

2012-07-21 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 05:21]

.

2012-07-21 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 14:23]

.

2012-07-21 c:\windows\Tasks\GlaryInitialize.job

- d:\glary utilities (systemoptimierung)\initialize.exe [2009-11-18 06:26]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.online-translator.com/Default.aspx?prmtlang=de

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

LSP: d:\fritzbox\FRITZ!DSL\\sarah.dll

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Bodo\AppData\Roaming\Mozilla\Firefox\Profiles\dkvo1wf9.default\

FF - prefs.js: browser.search.selectedEngine - 

FF - prefs.js: browser.startup.homepage - hxxp://www.t-online.de

FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

AddRemove-3D Ultra MiniGolf Deluxe - c:\windows\IsUn0407.exe

AddRemove-Deer Hunter - Extended Season - g:\deer hunter\Uninst.isu

AddRemove-FRITZ! 2.0 - c:\windows\IsUn0407.exe

.

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]

"ImagePath"="\??\d:\cyberlink\PowerDVD8\PowerDVD8\000.fcl"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-1501325428-669346799-357816155-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*_*2*r*a*u*m*Ç=X@**€y*ding a new MRL to recent ones: i:\album\Top 100 2010\041-mehrzad_marashi_und_mark_medlock_-_sweat_(a_la_la_la_la_long).mp3]

@Class="Shell"

.

[HKEY_USERS\S-1-5-21-1501325428-669346799-357816155-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*_*2*r*a*u*m*Ç=X@**€y*ding a new MRL to recent ones: i:\album\Top 100 2010\041-mehrzad_marashi_und_mark_medlock_-_sweat_(a_la_la_la_la_long).mp3\OpenWithList]

@Class="Shell"

"a"="vlc.exe"

"MRUList"="a"

.

[HKEY_USERS\S-1-5-21-1501325428-669346799-357816155-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*_*b*r*u*n*o*_*m*a*r*s*_*-*_*n*o*t*=X\OpenWithList]

@Class="Shell"

"a"="vlc.exe"

"MRUList"="a"

.

[HKEY_USERS\S-1-5-21-1501325428-669346799-357816155-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*_*s*n*o*o*p*_*d*o*g*g*_*-*=X\OpenWithList]

@Class="Shell"

"a"="vlc.exe"

"MRUList"="a"

.

[HKEY_USERS\S-1-5-21-1501325428-669346799-357816155-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*_*2*r*a*u*m*Ç=X@**€y*ding a new MRL to recent ones: i:\album\Top 100 2010\041-mehrzad_marashi_und_mark_medlock_-_sweat_(a_la_la_la_la_long).mp3]

"0"=hex:49,3a,5c,41,6c,62,75,6d,5c,54,6f,70,20,31,30,30,20,32,30,31,30,5c,30,

   35,31,2d,75,6e,68,65,69,6c,69,67,5f,2d,5f,66,75,65,72,5f,69,6d,6d,65,72,2e,\

"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff

.

[HKEY_USERS\S-1-5-21-1501325428-669346799-357816155-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{91AE4577-AFD4-690D-A343-5C8E3C82B1F6}*]

@Allowed: (Read) (RestrictedCode)

"pakejmagabfdeieggdbnmnhhpdkkkkgn"=hex:61,62,70,69,67,69,66,61,6a,6b,67,6f,64,

   6a,69,62,62,64,6e,6b,6b,6f,64,70,67,64,61,6f,68,69,62,66,6b,6d,00,77

.

[HKEY_USERS\S-1-5-21-1501325428-669346799-357816155-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{92C1845F-9629-E837-45B3-5CE2552BF71B}*]

@Allowed: (Read) (RestrictedCode)

"pahkcmcamhdadjfkagekbgbhjjogehob"=hex:61,62,6d,6f,69,66,6f,69,61,67,66,6d,70,

   70,6c,6a,66,61,62,65,6c,63,69,65,62,67,62,66,68,6c,70,6b,6a,6c,00,77

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'lsass.exe'(692)

c:\program files\Acer Bio Protection\PwdFilter.DLL

.

- - - - - - - > 'Explorer.exe'(6080)

d:\maus\Logitech\SetPoint\lgscroll.dll

d:\bluetooth suite\AthCopyHook.dll

d:\bluetooth suite\FolderViewImpl.dll

d:\bluetooth suite\athr_debug.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Avira\AntiVir Desktop\avshadow.exe

c:\windows\system32\conhost.exe

c:\windows\system32\nvvsvc.exe

c:\windows\system32\nvvsvc.exe

c:\program files\Acer Bio Protection\CompPtcVUI.exe

d:\cdburnerxp\NMSAccessU.exe

c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

c:\windows\system32\wbem\unsecapp.exe

c:\windows\system32\taskhost.exe

c:\windows\system32\conhost.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe

c:\program files\Synaptics\SynTP\SynTPHelper.exe

c:\program files\Lavasoft\Ad-Aware\AAWTray.exe

c:\windows\system32\NOTEPAD.EXE

c:\windows\system32\DllHost.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-07-21  22:57:27 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-07-21 20:57

.

Vor Suchlauf: 14 Verzeichnis(se), 75.843.272.704 Bytes frei

Nach Suchlauf: 22 Verzeichnis(se), 75.498.749.952 Bytes frei

.

- - End Of File - - 4F5C2A4452ED25C05E176B227EE230CE

Schönen Gruß und bis dann
Bodo

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Hey Arne,

hier das log von gmer

Code:

GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2012-07-23 17:23:09

Windows 6.1.7601 Service Pack 1 Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-2 Hitachi_ rev.FB4O

Running: ijp3ojbf.exe; Driver: C:\Users\Bodo\AppData\Local\Temp\kwtdqpog.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            915E3076                                                                                                                                          ZwCreateSection

SSDT            915E3080                                                                                                                                          ZwRequestWaitReplyPort

SSDT            915E307B                                                                                                                                          ZwSetContextThread

SSDT            915E3085                                                                                                                                          ZwSetSecurityObject

SSDT            915E308A                                                                                                                                          ZwSystemDebugControl

SSDT            915E3017                                                                                                                                          ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 140D                                                                                                          830513C9 1 Byte  [06]

.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                                            8308AD52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

.text           ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                                                                               83091EAC 4 Bytes  [76, 30, 5E, 91] {JBE 0x32; POP ESI; XCHG ECX, EAX}

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                                                                               83092208 4 Bytes  [80, 30, 5E, 91] {XOR BYTE [EAX], 0x5e; XCHG ECX, EAX}

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                                                                               8309224C 4 Bytes  [7B, 30, 5E, 91] {JNP 0x32; POP ESI; XCHG ECX, EAX}

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                                                                               830922C8 4 Bytes  [85, 30, 5E, 91] {TEST [EAX], ESI; POP ESI; XCHG ECX, EAX}

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                                                                               8309231C 4 Bytes  [8A, 30, 5E, 91] {MOV DH, [EAX]; POP ESI; XCHG ECX, EAX}

.text           ...                                                                                                                                               

.vmp2           C:\Windows\system32\drivers\acedrv11.sys                                                                                                          entry point in ".vmp2" section [0x9EC9369D]

.text           D:\CyberLink\PowerDVD8\PowerDVD8\000.fcl                                                                                                          section is writeable [0x9ED8E000, 0x2892, 0xE8000020]

.vmp2           D:\CyberLink\PowerDVD8\PowerDVD8\000.fcl                                                                                                          entry point in ".vmp2" section [0x9EDB1050]
 

---- User IAT/EAT - GMER 1.0.15 ----
 

IAT             D:\Homebanking\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe[672] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]   [758AFFF6] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             D:\Homebanking\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe[672] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]    [758AFFF6] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             D:\Homebanking\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe[672] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]      [758AFFF6] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             D:\Homebanking\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe[672] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]     [758AFFF6] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             D:\Homebanking\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe[672] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress]    [758AFFF6] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             D:\Homebanking\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe[672] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]    [758AFFF6] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                                                           Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                                                           Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)

AttachedDevice  \Driver\tdx \Device\Tcp                                                                                                                           Lbd.sys (Boot Driver/Lavasoft AB)
 

Device          \Driver\ACPI_HAL \Device\00000057                                                                                                                 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
 

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                                                            rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                                                            rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                                                            rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                                                                            rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume5                                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume5                                                                                                            rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume6                                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume6                                                                                                            rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume7                                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume7                                                                                                            rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume8                                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume8                                                                                                            rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

AttachedDevice  \FileSystem\fastfat \Fat                                                                                                                          fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000272b2235d                                                                       

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000272b2235d@0016b84829a2                                                          0x05 0xF2 0x21 0xB1 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000272b2235d@b0ec7109bdb9                                                          0xD4 0x5C 0x86 0x72 ...

Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000272b2235d (not active ControlSet)                                                   

Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000272b2235d@0016b84829a2                                                              0x05 0xF2 0x21 0xB1 ...

Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000272b2235d@b0ec7109bdb9                                                              0xD4 0x5C 0x86 0x72 ...

Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{91AE4577-AFD4-690D-A343-5C8E3C82B1F6}                                   

Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{91AE4577-AFD4-690D-A343-5C8E3C82B1F6}@pakejmagabfdeieggdbnmnhhpdkkkkgn  0x61 0x62 0x70 0x69 ...

Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{92C1845F-9629-E837-45B3-5CE2552BF71B}                                   

Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{92C1845F-9629-E837-45B3-5CE2552BF71B}@pahkcmcamhdadjfkagekbgbhjjogehob  0x61 0x62 0x6D 0x6F ...
 

---- EOF - GMER 1.0.15 ----

Osam folgt gleich

Danke und Gruß
Bodo

und hier ist das log von Osam,
den onlinescan hab ich ja nicht machen sollen?

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 18:09:12 on 23.07.2012
 

OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 32-bit

Default Browser: Mozilla Corporation Firefox 13.0.1
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Boot Execute]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----

"BootExecute" - ? - C:\Windows\system32\lsdelete.exe  (File found, but it contains no detailed information)
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GlaryInitialize.job" - "Glarysoft Ltd" - D:\Glary Utilities (Systemoptimierung)\initialize.exe

"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl

"ISUSPM.cpl" - "Macrovision Corporation" - C:\Windows\system32\ISUSPM.cpl

"PhysX.cpl" - "NVIDIA Corporation" - C:\Windows\system32\PhysX.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"acedrv11" (acedrv11) - "Protect Software GmbH" - C:\Windows\system32\drivers\acedrv11.sys

"archlp" (archlp) - ? - C:\Windows\System32\drivers\archlp.sys  (File not found)

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys

"catchme" (catchme) - ? - C:\Users\Bodo\AppData\Local\Temp\catchme.sys  (File not found)

"Dritek General Port I/O" (DritekPortIO) - "Dritek System Inc." - C:\Program Files\Launch Manager\DPortIO.sys

"ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\Windows\System32\Drivers\ElbyCDIO.sys

"hc3ServiceName" (hotcore3) - "Paragon Software Group" - C:\Windows\System32\DRIVERS\hotcore3.sys

"int15" (int15) - ? - C:\Windows\system32\drivers\int15.sys  (File found, but it contains no detailed information)

"Intel CE6230 Standalone USB Driver" (ce6230) - "Intel Corporation (UK)" - C:\Windows\System32\DRIVERS\CE6230StandaloneDriver.sys

"LGE Mobile Composite USB Device" (usbbus) - ? - C:\Windows\System32\DRIVERS\lgusbbus.sys  (File not found)

"LGE Mobile USB Modem" (USBModem) - ? - C:\Windows\System32\DRIVERS\lgusbmodem.sys  (File not found)

"LGE Mobile USB Serial Port" (UsbDiag) - ? - C:\Windows\System32\DRIVERS\lgusbdiag.sys  (File not found)

"NetGroup Packet Filter Driver" (NPF) - "CACE Technologies" - C:\Windows\System32\drivers\npf.sys

"Realfine CE6230 BDA Driver" (ce6230BDACAP) - "Intel Corporation (UK)" - C:\Windows\System32\DRIVERS\CE6230BDA.sys

"SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS

"SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

"StarOpen" (StarOpen) - ? - C:\Windows\system32\drivers\StarOpen.sys  (File found, but it contains no detailed information)
 

[Explorer]

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{B2F55D43-C7A4-4B7C-90D7-7A860DFA9F2A} "PXCInfoShlExt Class" - "Tracker Software Products Ltd." - D:\PDF XChange Viewer\Shell Extensions\XCShInfo.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "SABShellExecuteHook Class" - "SuperAdBlocker.com" - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{B8952421-0E55-400B-94A6-FA858FC0A39F} "AppShellPage Class" - "Atheros Commnucations" - D:\Bluetooth Suite\BtvAppExt.dll

{C865E0A2-40BF-4ca7-B3F3-162290A67572} "ContextMenu Class" - "Atheros Commnucations" - D:\Bluetooth Suite\BtContextMenu.dll

{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll

{D8D1CE8C-B1EB-4E95-B63B-1531BA60E992} "DivX Property Handler" - "DivX, Inc." - D:\DivX\DivX Plus Media Foundation Components\DivXPropertyHandler.dll

{83238FAE-D346-4E12-8734-D42F7554B3E6} "DivX Thumbnail Provider" - "DivX, Inc." - D:\DivX\DivX Plus Media Foundation Components\DivXThumbnailProvider.dll

{8F9D8FBE-C5C1-4B65-986E-51235C9283E8} "FPLaunchCache" - "Egis Technology Inc." - C:\Program Files\Acer Bio Protection\FPLaunchCache.dll

{AFF81F7B-6942-40c4-AADA-7214EF7B6DD1} "FTShellContext Class" - "Atheros Commnucations" - D:\Bluetooth Suite\ShellContextExt.dll

{72923739-5A47-40A3-9895-25AF0DFBB9E4} "Glary Utilities Context Menu Shell Extension" - "Glarysoft Ltd" - D:\GLARYU~1\CONTEX~1.DLL

{CA5FEE26-14C1-4B5A-86E9-233FC0EE2682} "IZArc DragDrop Menu" - ? - D:\IZARC(~1\IZArcCM.dll

{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5} "IZArc Shell Context Menu" - ? - D:\IZARC(~1\IZArcCM.dll

{DC70C4A5-2044-4c59-B806-DEFB9AE0DF7C} "KbLogiExt Class" - "Logitech, Inc." - D:\Maus\Logitech\SetPoint\kbcplext.dll

{B9B9F083-2B04-452A-8691-83694AC1037B} "LogiExt Class" - "Logitech, Inc." - D:\Maus\Logitech\SetPoint\mcplext.dll

{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll

{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll

{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - D:\MICROS~1\Office\OLKFSTUB.DLL

{CF822AB4-6DB5-4FDA-BC28-E61DF36D2583} "PDF-XChange PDF Preview Provider" - "Tracker Software Products Ltd." - D:\PDF XChange Viewer\Shell Extensions\XCShInfo.dll

{67EB453C-1BE1-48EC-AAF3-23B10277FCC1} "PDF-XChange PDF Property Handler" - "Tracker Software Products Ltd." - D:\PDF XChange Viewer\Shell Extensions\XCShInfo.dll

{EBD0B8F4-A9A0-41B7-9695-030CD264D9C8} "PDF-XChange PDF Thumbnail Provider" - "Tracker Software Products Ltd." - D:\PDF XChange Viewer\Shell Extensions\XCShInfo.dll

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{B7056B8E-4F99-44f8-8CBD-282390FE5428} "VirtualCloneDrive Shell Extension" - "Elaborate Bytes AG" - D:\VirtualCloneDrive\ElbyVCDShell.dll

{A5D35F9F-6A11-4EAA-B70B-7BB6FE32663A} "XnViewShell Class" - ? - D:\Foto Film und Audio\XnView\ShellEx\XnViewShellExt.dll

XCShInfo "{B2F55D43-C7A4-4B7C-90D7-7A860DFA9F2A}" - ? -   (File not found | COM-object registry key not found)
 

[Internet Explorer]

-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----

{21347690-EC41-4F9A-8887-1F4AEE672439} "Canon Easy-WebPrint EX" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "Canon Easy-WebPrint EX" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} "ClsidExtension" - "Atheros Commnucations" - D:\Bluetooth Suite\IEPlugIn.dll

"Quick-Launch Area" - "Egis Technology Inc." - C:\Program Files\Acer Bio Protection\PwdBank.exe

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} "Canon Easy-WebPrint EX" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{3785D0AD-BFFF-47F6-BF5B-A587C162FED9} "Canon Easy-WebPrint EX BHO" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll

{8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} "CIESpeechBHO Class" - "Atheros Commnucations" - D:\Bluetooth Suite\IEPlugIn.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Oracle Corporation" - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
 

[LSA Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----

"Notification packages" - "Egis Technology Inc." - C:\Program Files\Acer Bio Protection\PwdFilter.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"FRITZ!DSL Protect.lnk" - "AVM Berlin" - D:\Fritzbox\FRITZ!DSL\FwebProt.exe  (Shortcut exists | File exists)

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"Logitech SetPoint.lnk" - "Logitech, Inc." - D:\Maus\Logitech\SetPoint\SetPoint.exe  (Shortcut exists | File exists)

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"AVMUSBFernanschluss" - "AVM Berlin" - "C:\Users\Bodo\AppData\Local\Apps\2.0\82CB73C4.JW0\4EA2NR75.5TN\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\AVMAutoStart.exe"

"SUPERAntiSpyware" - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce )-----

"AutoLaunch" - ? - C:\Program Files\Lavasoft\Ad-Aware\AutoLaunch.exe monthly  (File found, but it contains no detailed information)

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"AthBtTray" - "Atheros Commnucations" - "D:\Bluetooth Suite\AthBtTray.exe"

"AtherosBtStack" - "Atheros Commnucations" - "D:\Bluetooth Suite\BtvStack.exe"

"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"IAAnotif" - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

"PDFPrint" - "Geek Software GmbH" - D:\pdf24 (PDF kreieren)\pdf24.exe

"PLFSetI" - ? - C:\Windows\PLFSetI.exe

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"FRITZ!fax Color Monitor" - "AVM Berlin" - C:\Windows\system32\FritzVistaColorMon.dll

"FRITZ!fax Port Monitor" - "AVM Berlin" - C:\Windows\system32\FritzVistaMon.dll

"hpf3l70v.dll" - "Hewlett-Packard Company" - C:\Windows\system32\hpf3l70v.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"AAV UpdateService" (AAV UpdateService) - ? - D:\Homebanking\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe

"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

"AtherosSvc" (AtherosSvc) - "Atheros Commnucations" - D:\Bluetooth Suite\adminservice.exe

"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"AVM IGD CTRL Service" (IGDCTRL) - "AVM Berlin" - D:\Fritzbox\FRITZ!DSL\IGDCTRL.EXE

"EgisTec Service" (IGBASVC) - "Egis Technology Inc." - C:\Program Files\Acer Bio Protection\BASVC.exe

"Google Updater Service" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

"Lavasoft Ad-Aware Service" (Lavasoft Ad-Aware Service) - "Lavasoft" - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

"Logitech Bluetooth Service" (LBTServ) - "Logitech, Inc." - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"NMSAccessU" (NMSAccessU) - ? - D:\CDBurnerXP\NMSAccessU.exe  (File found, but it contains no detailed information)

"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe

"Paragon System Backup Dienst" (Paragon System Backup Dienst) - "Paragon Software Group" - D:\Paragon Software\Paragon Backup and Recovery 10 Suite\program\dbhservice.exe

"Remote Packet Capture Protocol v.0 (experimental)" (rpcapd) - "CACE Technologies" - C:\Program Files\WinPcap\rpcapd.exe

"SAS Core Service" (!SASCORE) - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

"Validity Fingerprint Service" (vfsFPService) - "Validity Sensors, Inc." - C:\Windows\system32\vfsFPService.exe
 

[Winlogon]

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"!SASWinLogon" - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

"LBTWlgn" - "Logitech, Inc." - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"Sarah NSP" - "AVM Berlin" - D:\Fritzbox\FRITZ!DSL\sarah.dll

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----

"SARAH LSP" - "AVM Berlin" - D:\Fritzbox\FRITZ!DSL\sarah.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Jetzt lass ich noch aswMBR laufen.
Folgt dann sogleich.

Gruß Bodo

So, hier noch das log aswMBR

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-07-23 18:21:47

-----------------------------

18:21:47.309    OS Version: Windows 6.1.7601 Service Pack 1

18:21:47.309    Number of processors: 2 586 0x170A

18:21:47.324    ComputerName: BODO-PC  UserName: Bodo

18:22:17.027    Initialize success

18:24:09.221    AVAST engine defs: 12072301

18:24:33.744    Disk 0  \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

18:24:33.744    Disk 0 Vendor: SAMSUNG_ 2AC1 Size: 476940MB BusType: 3

18:24:33.744    Disk 1 (boot) \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-2

18:24:33.759    Disk 1 Vendor: Hitachi_ FB4O Size: 305245MB BusType: 3

18:24:33.775    Disk 1 MBR read successfully

18:24:33.775    Disk 1 MBR scan

18:24:33.806    Disk 1 unknown MBR code

18:24:33.822    Disk 1 Partition 1 80 (A) 07    HPFS/NTFS NTFS       102400 MB offset 2048

18:24:33.853    Disk 1 Partition 2 00     07    HPFS/NTFS NTFS        61443 MB offset 209717248

18:24:33.884    Disk 1 Partition 3 00     07    HPFS/NTFS NTFS        61440 MB offset 335552512

18:24:33.884    Disk 1 Partition - 00     0F Extended LBA             79960 MB offset 461381632

18:24:33.931    Disk 1 Partition 4 00     07    HPFS/NTFS NTFS        78850 MB offset 461383680

18:24:33.947    Disk 1 Partition - 00     05     Extended              1109 MB offset 622868480

18:24:34.493    Disk 1 Partition 5 00     0B        FAT32 MSDOS5.0     1108 MB offset 622870528

18:24:34.508    Disk 1 scanning sectors +625139712

18:24:34.571    Disk 1 scanning C:\Windows\system32\drivers

18:24:53.649    Service scanning

18:25:34.771    Modules scanning

18:25:44.521    Disk 1 trace - called modules:

18:25:44.552    ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys halmacpi.dll 

18:25:44.568    1 nt!IofCallDriver -> \Device\Harddisk1\DR1[0x86eec030]

18:25:44.568    3 CLASSPNP.SYS[8ba7559e] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-2[0x86460028]

18:25:45.582    AVAST engine scan C:\Windows

18:25:50.714    AVAST engine scan C:\Windows\system32

18:30:54.369    AVAST engine scan C:\Windows\system32\drivers

18:31:15.335    AVAST engine scan C:\Users\Bodo

18:34:47.730    AVAST engine scan C:\ProgramData

18:36:59.675    Scan finished successfully

18:37:29.814    Disk 1 MBR has been saved successfully to "C:\Users\Bodo\Desktop\MBR.dat"

18:37:29.830    The log file has been saved successfully to "C:\Users\Bodo\Desktop\aswMBR.txt"

Bis dann
Gruß Bodo

Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

Hey Arne,

sorry die Datensicherung hat etwas gedauert, ich hoff, ich hab alles.
MBR-Fix hab ich durchgeführt.

Hier einmal das log vor dem Neustart

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-07-26 18:03:18

-----------------------------

18:03:18.540    OS Version: Windows 6.1.7601 Service Pack 1

18:03:18.540    Number of processors: 2 586 0x170A

18:03:18.540    ComputerName: BODO-PC  UserName: Bodo

18:03:20.194    Initialize success

18:04:50.774    AVAST engine defs: 12072601

18:05:13.394    Verifying

18:05:23.425    Disk 1 Windows 601 MBR fixed successfully

18:12:28.073    Disk 1 MBR has been saved successfully to "C:\Users\Bodo\Desktop\MBR.dat"

18:12:28.073    The log file has been saved successfully to "C:\Users\Bodo\Desktop\aswMBR2.txt"

und nach dem Neustart

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-07-26 18:21:51

-----------------------------

18:21:51.160    OS Version: Windows 6.1.7601 Service Pack 1

18:21:51.160    Number of processors: 2 586 0x170A

18:21:51.160    ComputerName: BODO-PC  UserName: Bodo

18:21:52.081    Initialize success

18:22:05.200    AVAST engine defs: 12072601

18:23:45.633    The log file has been saved successfully to "C:\Users\Bodo\Desktop\aswMBR3.txt"

Oder hätte ich erst nochmal einen neuen Scan machen sollen und dann das Log?

Danke und bis dann
Gruß Bodo

Einen ganz neuen Scan mit aswMBR solltest du machen wie beim ersten Start des Tools

Hey Arne,

hier ist der neue Log nach dem neuen Scan

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-07-26 23:27:09

-----------------------------

23:27:09.803    OS Version: Windows 6.1.7601 Service Pack 1

23:27:09.803    Number of processors: 2 586 0x170A

23:27:09.818    ComputerName: BODO-PC  UserName: Bodo

23:27:10.723    Initialize success

23:27:22.704    AVAST engine defs: 12072601

23:27:35.278    Disk 0  \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

23:27:35.278    Disk 0 Vendor: SAMSUNG_ 2AC1 Size: 476940MB BusType: 3

23:27:35.278    Disk 1 (boot) \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-2

23:27:35.293    Disk 1 Vendor: Hitachi_ FB4O Size: 305245MB BusType: 3

23:27:35.309    Disk 1 MBR read successfully

23:27:35.309    Disk 1 MBR scan

23:27:35.324    Disk 1 Windows 7 default MBR code

23:27:35.340    Disk 1 Partition 1 80 (A) 07    HPFS/NTFS NTFS       102400 MB offset 2048

23:27:35.371    Disk 1 Partition 2 00     07    HPFS/NTFS NTFS        61443 MB offset 209717248

23:27:35.402    Disk 1 Partition 3 00     07    HPFS/NTFS NTFS        61440 MB offset 335552512

23:27:35.418    Disk 1 Partition - 00     0F Extended LBA             79960 MB offset 461381632

23:27:35.449    Disk 1 Partition 4 00     07    HPFS/NTFS NTFS        78850 MB offset 461383680

23:27:35.465    Disk 1 Partition - 00     05     Extended              1109 MB offset 622868480

23:27:36.042    Disk 1 Partition 5 00     0B        FAT32 MSDOS5.0     1108 MB offset 622870528

23:27:36.089    Disk 1 scanning sectors +625139712

23:27:36.182    Disk 1 scanning C:\Windows\system32\drivers

23:27:51.502    Service scanning

23:28:30.720    Modules scanning

23:28:40.876    Disk 1 trace - called modules:

23:28:40.907    ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys halmacpi.dll 

23:28:40.922    1 nt!IofCallDriver -> \Device\Harddisk1\DR1[0x86eed030]

23:28:40.922    3 CLASSPNP.SYS[8b98059e] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-2[0x857bd028]

23:28:41.640    AVAST engine scan C:\Windows

23:28:45.431    AVAST engine scan C:\Windows\system32

23:32:09.245    AVAST engine scan C:\Windows\system32\drivers

23:32:25.095    AVAST engine scan C:\Users\Bodo

23:34:37.898    AVAST engine scan C:\ProgramData

23:36:30.592    Scan finished successfully

23:36:46.302    Disk 1 MBR has been saved successfully to "C:\Users\Bodo\Desktop\MBR.dat"

23:36:46.317    The log file has been saved successfully to "C:\Users\Bodo\Desktop\aswMBR4.txt"

Beim ersten mal kam der blue screen mit der Meldung Drivers IRQL NOT_LESS........?????
Mehr hab ich nicht mehr mitschreiben können.
Weiss nicht ob das auch was zu sagen hat.

Danke und schöne Grüße
Bodo

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Hey Arne,

hier das Log von Malwarebytes.

Code:

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org
 

Datenbank Version: v2012.07.27.01
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 8.0.7601.17514

Bodo :: BODO-PC [Administrator]
 

27.07.2012 05:38:27

mbam-log-2012-07-27 (05-38-27).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 385438

Laufzeit: 1 Stunde(n), 55 Minute(n), 47 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 1

C:\Windows\winsxs\x86_netfx-debugging_msdia70_b03f5f7f11d50a3a_6.1.7600.16385_none_a5658c87d101b1b3\diasymreader.dll (Trojan.FakeMS) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Das andere folgt noch.

Gruß Bodo

Hm, der eine Fund scheint mir eher ein Fehlalarm zu sein :wtf:
Naja du hast ja die Qurantäne, man löscht ja nie alles endgültig über Malwarebytes

Hey Arne,

so, jetzt halt Dich fest.
Jetzt kommt der log von SuperAnti

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 07/27/2012 at 05:22 PM
 

Application Version : 5.5.1012
 

Core Rules Database Version : 8970

Trace Rules Database Version: 6782
 

Scan type       : Complete Scan

Total Scan Time : 02:34:23
 

Operating System Information

Windows 7 Home Premium 32-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Limited User
 

Memory items scanned      : 751

Memory threats detected   : 0

Registry items scanned    : 35084

Registry threats detected : 0

File items scanned        : 160972

File threats detected     : 74
 

Adware.Tracking Cookie

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\WAL1C7OF.txt [ /imrworldwide.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\0PLMWB5S.txt [ /fastclick.net ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\2R6DBYQ5.txt [ /tracking.quisma.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\Y52Z0CY5.txt [ /ad1.adfarm1.adition.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\NQ88TGZZ.txt [ /mediaplex.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\PHU12GIR.txt [ /ad.zanox.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\VW01H9LA.txt [ /atdmt.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\OH10EEPB.txt [ /doubleclick.net ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\830B0ROW.txt [ /zanox-affiliate.de ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\KM3SFH0T.txt [ /adfarm1.adition.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\A895P47F.txt [ /track.adform.net ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\2VWOKTHE.txt [ /adbrite.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\IVEVKVXA.txt [ /apmebf.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\EUBMUWQB.txt [ /zanox.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\7321EY1D.txt [ /pro-market.net ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\Y4O0SJCM.txt [ /www.zanox-affiliate.de ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\7DIEBN46.txt [ /dyntracker.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\GESDBPFI.txt [ /smartadserver.com ]

        C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Cookies\EY669TVU.txt [ /adform.net ]

        C:\USERS\BODO\AppData\Roaming\Microsoft\Windows\Cookies\Low\bodo@atdmt[2].txt [ Cookie:bodo@atdmt.com/ ]

        C:\USERS\BODO\Cookies\WAL1C7OF.txt [ Cookie:bodo@imrworldwide.com/cgi-bin ]

        C:\USERS\BODO\Cookies\0PLMWB5S.txt [ Cookie:bodo@fastclick.net/ ]

        C:\USERS\BODO\Cookies\VW01H9LA.txt [ Cookie:bodo@atdmt.com/ ]

        C:\USERS\BODO\Cookies\OH10EEPB.txt [ Cookie:bodo@doubleclick.net/ ]

        C:\USERS\BODO\Cookies\2VWOKTHE.txt [ Cookie:bodo@adbrite.com/ ]

        C:\USERS\BODO\Cookies\IVEVKVXA.txt [ Cookie:bodo@apmebf.com/ ]

        C:\USERS\BODO\Cookies\EUBMUWQB.txt [ Cookie:bodo@zanox.com/ ]

        C:\USERS\BODO\Cookies\7321EY1D.txt [ Cookie:bodo@pro-market.net/ ]

        C:\USERS\BODO\Cookies\Y4O0SJCM.txt [ Cookie:bodo@www.zanox-affiliate.de/ ]

        C:\USERS\BODO\Cookies\7DIEBN46.txt [ Cookie:bodo@dyntracker.com/ ]

        C:\USERS\BODO\Cookies\GESDBPFI.txt [ Cookie:bodo@smartadserver.com/ ]

        C:\USERS\BODO\Cookies\EY669TVU.txt [ Cookie:bodo@adform.net/ ]

        C:\USERS\BODO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\BODO@WW251.SMARTADSERVER[1].TXT [ /WW251.SMARTADSERVER ]

        .serving-sys.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .xiti.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        beacons.hottraffic.nl [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .deutschepostag.112.2o7.net [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        ww251.smartadserver.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        ad2.adfarm1.adition.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .bs.serving-sys.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\BODO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DKVO1WF9.DEFAULT\COOKIES.SQLITE ]
 

Trojan.Agent/Gen-Krpytik

        E:\SIERRA\UPBALL3\L0.DLL

        E:\SIERRA\UPBALL3\L1.DLL

        E:\SIERRA\UPBALL3\L4.DLL

        E:\SIERRA\UPBALL3\L5.DLL

        E:\SIERRA\UPBALL3\T0.DLL

        E:\SIERRA\UPBALL3\T2.DLL

        E:\SIERRA\UPBALL3\T3.DLL

        E:\SIERRA\UPBALL3\T4.DLL

        E:\SIERRA\UPBALL3\T5.DLL

        E:\SIERRA\UPBALL3\V0.DLL

        E:\SIERRA\UPBALL3\V1.DLL

        E:\SIERRA\UPBALL3\V2.DLL

        E:\SIERRA\UPBALL3\V3.DLL

        E:\SIERRA\UPBALL3\V4.DLL

        E:\SIERRA\UPBALL3\V5.DLL
 

Trojan.Agent/Gen-Malagent

        C:\WINDOWS\SYSTEM32\MSPD.EXE

Ich hab jetzt noch nichts gelöscht etc.
Und die liebe MSPD ist auch wieder dabei.

Schöne Grüße
Bodo

Code:

C:\WINDOWS\SYSTEM32\MSPD.EXE

Ach mist :stirn: die hab ich schon in den OTL-Logs übersehen :o
Lade sie mal bei uns hoch => http://www.trojaner-board.de/54791-a...ner-board.html

Der Rest besteht aber aus Cookies und Fehlalarmen

Hab ich hochgeladen.

Soll ich jetzt irgendwas in Super löschen??

Gruß Bodo

Ja ist mir irgendwie peinlich :lach:
Aber das ist ein Fehlalarm! ;)

Sieh hier => https://www.virustotal.com/file/e907...is/1343509786/

Hey Arne,

ist schon komisch.
Seitdem ich die MSPD im Autostart deaktiviert hab, läuft der Lappi eigentlich wieder recht stabil, und der Fingerscan blinkt auch nicht mehr ständig wie von Geisterhand auf.

Was soll ich jetzt von Superantispyware löschen lassen?

Danke und schönen Gruß
Bodo

Dann lkass die Datei mal aus dem Autostart, evtl auch mal umbenennen in mspd.exe.vir oder sowas. Da wurde zwra nichts drin gefunden aber die Datei scheint ja trotzdem ungewollt und nicht wichtig zu sein

Das Tool SASW hat sonst nur Cookies und Fehlalarme gemeldet

Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Hey Arne,

ich würd sagen es passt wieder.
Recht herzlichen Dank nochmal für Deine Hilfe.

Nachdem man ja immer wieder mal Programme testet und löscht,
bleibt ja auch immer Restmüll in der Registry.
Welches Programm kannst Du hier empfehlen zum entrümpeln?
Ich hab bis jetzt meistens den Ccleaner oder Glary genommen.
Sind die so in Ordnung?

Danke und Gruß
Bodo

Finger weg von Registry-Cleanern!!

Die Registry ist das Hirn des Systems. Funktioniert das Hirn nicht, funktioniert der Rest nicht mehr wirklich.
Wir lesen oft genug von Hilfesuchenden, dass deren System nach der Nutzung von Registry Cleanern nicht mehr startet.

Wie soll der Cleaner zu 100% wissen ob der Eintrag benötigt wird oder nicht ?
Es ist vollkommen egal ob ein paar verwaiste Registry Einträge am System sind oder nicht.
Auch die dauernd angepriesene Beschleunigung des Systems ist nur bedingt wahr. Du würdest es nicht merken.

Ein sogenanntes False Positive von einem Cleaner kann auch dein System unbootbar machen.
Zerstörst Du die Registry, zerstörst Du Windows.

Der CCleaner ist ok, aber lass die Finger von der Registry!

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Hey Arne,

alles klar, werd ich machen.
Dann Dank ich Dir nochmal recht herzlich.
Vielleicht brauch ich ja mal wieder Hilfe,
dann weiss ich wo ich Rat finde.
Ich wünsch Euch allen noch alles Gute, macht weiter so.

Schönen Gruß
Bodo