Trojaner-Board - Windows 7: Interpol Meldung Rechner gesprerrt!

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Windows 7: Interpol Meldung Rechner gesprerrt! (https://www.trojaner-board.de/139493-windows-7-interpol-meldung-rechner-gesprerrt.html)

Windows 7: Interpol Meldung Rechner gesprerrt!

Hallo Helfer,

meine Tochter hat auf ihrem Laptop den Interpol Trojener / Virus eingefangen.
Der Rechner ist gesperrt und kann nicht genutzt werden.

Beim Hochfahren sieht es erst so aus, als wenn Windows läd und dann kommt
der weiße Bildschirm und anschließend die Interpol Meldung mit der
Aufforderung 100€ Strafe zu bezahlen...

Bitte um Hilfe!
Wie soll ich vorgehen?

Besten Dank im Voraus und viele Grüße
Frady

Hi,
Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

Starte den Rechner neu.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu und starte von der CD.

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.

Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

Hi,

danke für die schnelle Antwort.

bin nach deiner Anleitung vorgegangen. Unten das Ergebnis.

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-08-2013 04

Ran by SYSTEM on 07-08-2013 21:05:17

Running from H:\

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 10

Boot Mode: Recovery
 

The current controlset is ControlSet001
 ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)

Winlogon\Notify\klogon: %SystemRoot%\System32\klogon.dll (Kaspersky Lab ZAO)

HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\avp.exe [387696 2011-04-13] (Kaspersky Lab ZAO)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)

HKU\Default\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-15] (TOSHIBA)

HKU\Default User\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-15] (TOSHIBA)

HKU\Samy\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-20] (Skype Technologies S.A.)

HKU\Samy\...\Winlogon: [Shell] explorer.exe,C:\Users\Samy\AppData\Roaming\cache.dat [90624 2011-11-16] () <==== ATTENTION 

AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll,C:\PROGRA~2\KASPER~1\KASPER~1\x64\sbhook64.dll [31120 2011-04-13] (Kaspersky Lab ZAO)

AppInit_DLLs-x32: c:\progra~3\browse~1\261519~1.190\{c16c1~1\browse~1.dll c:\progra~2\kasper~1\kasper~1\mzvkbd3.dll c:\progra~2\kasper~1\kasper~1\sbhook.dll [110992 2011-04-13] (Kaspersky Lab ZAO)

Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk

ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk

ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

Startup: C:\Users\Samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk ->  (No File)
 

==================== Services (Whitelisted) =================
 

S2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\avp.exe [387696 2011-04-13] (Kaspersky Lab ZAO)

S2 BrowserDefendert; C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe [2847696 2013-07-26] ()

S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)

S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-09] (Toshiba Europe GmbH)
 

==================== Drivers (Whitelisted) ====================
 

S0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2010-06-09] (Kaspersky Lab ZAO)

S1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2010-06-09] (Kaspersky Lab ZAO)

S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [556120 2012-05-12] (Kaspersky Lab)

S1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [27736 2010-04-22] (Kaspersky Lab ZAO)

S3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [22544 2009-11-02] (Kaspersky Lab)

S3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv_x64.sys [44928 2012-10-10] (ManyCam LLC)

S3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [29696 2012-10-10] (ManyCam LLC)

S3 Tosrfcom; No ImagePath
 

========================== Drivers MD5 =======================
 

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit

C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit

C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit

C:\Windows\system32\drivers\adp94xx.sys ==> MD5 is legit

C:\Windows\system32\drivers\adpahci.sys ==> MD5 is legit

C:\Windows\system32\drivers\adpu320.sys ==> MD5 is legit

C:\Windows\system32\drivers\afd.sys 1C7857B62DE5994A75B054A9FD4C3825

C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit

C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit

C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit

C:\Windows\system32\drivers\amdk8.sys ==> MD5 is legit

C:\Windows\system32\drivers\amdppm.sys ==> MD5 is legit

C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49

C:\Windows\system32\drivers\amdsbs.sys ==> MD5 is legit

C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048

C:\Windows\system32\drivers\appid.sys ==> MD5 is legit

C:\Windows\system32\drivers\arc.sys ==> MD5 is legit

C:\Windows\system32\drivers\arcsas.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit

C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\athrx.sys B2931C83CFB12A3223A47B180473AE1A

C:\Windows\system32\drivers\bxvbda.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit

C:\Windows\system32\drivers\blbdrive.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit

C:\Windows\system32\drivers\BrFiltLo.sys ==> MD5 is legit

C:\Windows\system32\drivers\BrFiltUp.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit

C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit

C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit

C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\btfilter.sys 2347ABBD13BADA65826FDAB4CAAFE357

C:\Windows\system32\drivers\bthmodem.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit

C:\Windows\system32\drivers\circlass.sys ==> MD5 is legit

C:\Windows\System32\CLFS.sys ==> MD5 is legit

C:\Windows\system32\drivers\CmBatt.sys ==> MD5 is legit

C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit

C:\Windows\System32\Drivers\cng.sys 9AC4F97C2D3E93367E2148EA940CD2CD

C:\Windows\System32\drivers\CHDRT64.sys 66847C979893A11CFCC2280E772D7EA1

C:\Windows\System32\drivers\compbatt.sys ==> MD5 is legit

C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit

C:\Windows\system32\drivers\crcdisk.sys ==> MD5 is legit

C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit

C:\Windows\System32\drivers\discache.sys ==> MD5 is legit

C:\Windows\System32\drivers\disk.sys ==> MD5 is legit

C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit

C:\Windows\System32\drivers\dxgkrnl.sys AF2E16242AA723F68F461B6EAE2EAD3D

C:\Windows\system32\drivers\evbda.sys ==> MD5 is legit

C:\Windows\system32\drivers\elxstor.sys ==> MD5 is legit

C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit

C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit

C:\Windows\system32\drivers\fdc.sys ==> MD5 is legit

C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit

C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit

C:\Windows\system32\drivers\flpydisk.sys ==> MD5 is legit

C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit

C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\fssfltr.sys B3EB502D2C3F47C47415F85387DFAEF1

C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B

C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0

C:\Windows\system32\drivers\gagp30kx.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\GEARAspiWDM.sys ==> MD5 is legit

C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit

C:\Windows\System32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A

C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit

C:\Windows\system32\drivers\HidBatt.sys ==> MD5 is legit

C:\Windows\system32\drivers\hidbth.sys ==> MD5 is legit

C:\Windows\system32\drivers\hidir.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit

C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit

C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit

C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit

C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\iaStor.sys D469B77687E12FE43E344806740B624D

C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366

C:\Windows\System32\DRIVERS\igdkmd64.sys 370C2A8629B30F910F740387795DDC6F

C:\Windows\system32\drivers\iirsp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\IntcDAud.sys FC727061C0F47C8059E88E05D5C8E381

C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit

C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit

C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit

C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit

C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit

C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\kl1.sys 8D7120743A0973CEAB548B475C9D4289

C:\Windows\System32\DRIVERS\kl2.sys CD146D8E525D6EEBDCAF24120A8AB9CE

C:\Windows\System32\DRIVERS\klif.sys C1786C2F8DE0F62E076F7EF8DEA4E87A

C:\Windows\System32\DRIVERS\klim6.sys 2A64B3A9EED93A2E96537B67C079FC96

C:\Windows\System32\DRIVERS\klmouflt.sys 9468D07E91BA136D82415F5DFC1FE168

C:\Windows\System32\Drivers\ksecdd.sys 97A7070AEA4C058B6418519E869A63B4

C:\Windows\System32\Drivers\ksecpkg.sys 26C43A7C2862447EC59DEDA188D1DA07

C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\L1C62x64.sys EBED8B3FF4A823C1A6EEBEED7B29353F

C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit

C:\Windows\system32\drivers\lsi_fc.sys ==> MD5 is legit

C:\Windows\system32\drivers\lsi_sas.sys ==> MD5 is legit

C:\Windows\system32\drivers\lsi_sas2.sys ==> MD5 is legit

C:\Windows\system32\drivers\lsi_scsi.sys ==> MD5 is legit

C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\mcvidrv_x64.sys DE585D1D266805E5EEDAE911FDD16F38

C:\Windows\System32\drivers\mcaudrv_x64.sys 2E7FFDEF8BAFD04CBB517507B821E878

C:\Windows\system32\drivers\megasas.sys ==> MD5 is legit

C:\Windows\system32\drivers\MegaSR.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\HECIx64.sys A6518DCC42F7A6E999BB3BEA8FD87567

C:\Windows\System32\drivers\modem.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit

C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit

C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit

C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit

C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC

C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163

C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C

C:\Windows\System32\DRIVERS\msahci.sys ==> MD5 is legit

C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit

C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit

C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit

C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit

C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit

C:\Windows\system32\drivers\MTConfig.sys ==> MD5 is legit

C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit

C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88

C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit

C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit

C:\Windows\system32\drivers\nfrd960.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit

C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Ntfs.sys B98F8C6E31CD07B2E6F71F7F648E38C0

C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit

C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD

C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A

C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit

C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit

C:\Windows\system32\drivers\parport.sys ==> MD5 is legit

C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C

C:\Windows\System32\drivers\pci.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\pciide.sys ==> MD5 is legit

C:\Windows\system32\drivers\pcmcia.sys ==> MD5 is legit

C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit

C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\pgeffect.sys 91111CEBBDE8015E822C46120ED9537C

C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit

C:\Windows\system32\drivers\processr.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit

C:\Windows\system32\drivers\QIOMem.sys C8FCB4899F8B70CC34E0D9876A80963C

C:\Windows\system32\drivers\ql2300.sys ==> MD5 is legit

C:\Windows\system32\drivers\ql40xx.sys ==> MD5 is legit

C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit

C:\Windows\system32\drivers\rdpbus.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit

C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit

C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit

C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A

C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit

C:\Windows\System32\Drivers\RtsUStor.sys 135A64530D7699AD48F29D73A658DD11

C:\Windows\System32\Drivers\RTSUVSTOR.sys E5DC911D0FEB72CAFF2BBDD6E7C3672F

C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit

C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit

C:\Windows\system32\drivers\serenum.sys ==> MD5 is legit

C:\Windows\system32\drivers\serial.sys ==> MD5 is legit

C:\Windows\system32\drivers\sermouse.sys ==> MD5 is legit

C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit

C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit

C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit

C:\Windows\system32\drivers\sfloppy.sys ==> MD5 is legit

C:\Windows\system32\drivers\SiSRaid2.sys ==> MD5 is legit

C:\Windows\system32\drivers\sisraid4.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit

C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B

C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28

C:\Windows\System32\DRIVERS\VSTAZL6.SYS 0C4540311E11664B245A263E1154CEF8

C:\Windows\System32\DRIVERS\VSTDPV6.SYS 02071D207A9858FBE3A48CBFD59C4A04

C:\Windows\System32\DRIVERS\VSTCNXT6.SYS 18E40C245DBFAF36FD0134A7EF2DF396

C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3

C:\Windows\system32\drivers\stexstor.sys ==> MD5 is legit

C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\SynTP.sys F5B46DF59FEAA48A442AED7EEB754D4B

C:\Windows\System32\drivers\tcpip.sys 9849EA3843A2ADBDD1497E97A85D8CAE

C:\Windows\System32\DRIVERS\tcpip.sys 9849EA3843A2ADBDD1497E97A85D8CAE

C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC

C:\Windows\System32\DRIVERS\tdcmdpst.sys FD542B661BD22FA69CA789AD0AC58C29

C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit

C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8

C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit

C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\tosrfec.sys F5E3AC4CBCD154EE80849B21887FD0B0

C:\Windows\System32\DRIVERS\tosrfusb.sys 7A0048693F98460FF537BE31C741B927

C:\Windows\System32\DRIVERS\tssecsrv.sys ==> MD5 is legit

C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit

C:\Windows\system32\drivers\TsUsbGD.sys 9CC2CCAE8A84820EAECB886D477CBCB8

C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\TVALZ_O.SYS ==> MD5 is legit

C:\Windows\System32\DRIVERS\TVALZFL.sys 9C7191F4B2E49BFF47A6C1144B5923FA

C:\Windows\system32\drivers\uagp35.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit

C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit

C:\Windows\system32\drivers\umpass.sys ==> MD5 is legit

C:\Windows\System32\Drivers\usbaapl64.sys FB251567F41BC61988B26731DEC19E4B

C:\Windows\System32\drivers\usbaudio.sys 82E8F44688E6FAC57B5B7C6FC7ADBC2A

C:\Windows\System32\DRIVERS\usbccgp.sys 6F1A3157A1C89435352CEB543CDB359C

C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit

C:\Windows\system32\drivers\usbehci.sys C025055FE7B87701EB042095DF1A2D7B

C:\Windows\system32\drivers\usbhub.sys 287C6C9410B111B68B52CA298F7B8C24

C:\Windows\system32\drivers\usbohci.sys 9840FC418B4CBD632D3D0A667A725C31

C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\usbscan.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6

C:\Windows\system32\drivers\usbuhci.sys 62069A34518BCF9C1FD9E74B3F6DB7CD

C:\Windows\System32\Drivers\usbvideo.sys 454800C2BC7F3927CE030141EE4F4C50

C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit

C:\Windows\System32\drivers\vga.sys ==> MD5 is legit

C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit

C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit

C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit

C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit

C:\Windows\System32\drivers\volsnap.sys DF8126BD41180351A093A3AD2FC8903B

C:\Windows\system32\drivers\vsmraid.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit

C:\Windows\system32\drivers\wacompen.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit

C:\Windows\System32\drivers\wd.sys ==> MD5 is legit

C:\Windows\System32\drivers\Wdf01000.sys 442783E2CB0DA19873B7A63833FF4CB4

C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit

C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit

C:\Windows\SysWow64\drivers\wimmount.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\WinUsb.sys FE88B288356E7B47B74B13372ADD906D

C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit

C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit

C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F

C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-05 12:26 - 2013-08-07 11:00 - 00003436 _____ C:\Windows\System32\Tasks\BrowserDefendert

2013-08-05 11:23 - 2013-08-05 11:23 - 00000000 ____D C:\FRST

2013-08-04 04:27 - 2013-08-04 04:27 - 00001614 _____ C:\Windows\PFRO.log

2013-07-31 06:46 - 2013-08-07 11:00 - 00000004 _____ C:\Users\Samy\AppData\Roaming\cache.ini

2013-07-31 04:05 - 2013-08-07 10:23 - 00001469 _____ C:\Windows\setupact.log

2013-07-31 04:05 - 2013-07-31 04:05 - 00000000 _____ C:\Windows\setuperr.log

2013-07-30 12:40 - 2013-07-30 13:13 - 00015543 _____ C:\Users\Samy\Desktop\architekt.odt

2013-07-28 08:37 - 2013-07-28 08:51 - 00000000 ____D C:\Users\Samy\Desktop\Urlaub Eltern 2013

2013-07-18 07:25 - 2013-07-18 07:25 - 00003072 ____H C:\Users\Samy\photothumb.db

2013-07-18 07:24 - 2013-07-18 07:24 - 00024576 ____H C:\Users\Samy\Desktop\photothumb.db

2013-07-14 01:17 - 2013-06-11 15:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-14 01:17 - 2013-06-11 15:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-14 01:17 - 2013-06-11 15:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-14 01:17 - 2013-06-11 15:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-14 01:17 - 2013-06-11 15:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-14 01:17 - 2013-06-11 15:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-07-14 01:17 - 2013-06-11 15:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-07-14 01:17 - 2013-06-11 15:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-07-14 01:17 - 2013-06-11 15:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-07-14 01:17 - 2013-06-11 15:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2013-07-14 01:17 - 2013-06-11 15:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe

2013-07-14 01:17 - 2013-06-11 15:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2013-07-14 01:17 - 2013-06-11 15:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2013-07-14 01:17 - 2013-06-11 15:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll

2013-07-14 01:17 - 2013-06-11 15:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2013-07-14 01:17 - 2013-06-11 15:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll

2013-07-14 01:17 - 2013-06-11 15:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll

2013-07-14 01:17 - 2013-06-11 15:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll

2013-07-14 01:17 - 2013-06-11 15:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll

2013-07-14 01:17 - 2013-06-11 14:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-14 01:17 - 2013-06-11 14:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe

2013-07-14 01:17 - 2013-06-06 19:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2013-07-14 01:17 - 2013-06-06 18:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-07-14 01:16 - 2013-06-11 15:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-14 01:16 - 2013-06-11 15:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-14 01:16 - 2013-06-11 15:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-07-14 01:16 - 2013-06-11 15:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-14 01:16 - 2013-06-11 15:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll

2013-07-14 01:16 - 2013-06-11 15:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-07-14 01:16 - 2013-06-11 15:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2013-07-14 01:16 - 2013-06-11 15:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2013-07-11 22:43 - 2013-06-04 19:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys

2013-07-11 22:43 - 2013-06-03 22:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll

2013-07-11 22:43 - 2013-06-03 20:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2013-07-11 22:43 - 2013-05-05 22:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL

2013-07-11 22:43 - 2013-05-05 20:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-07-11 22:43 - 2013-04-09 15:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-07-11 22:43 - 2013-04-02 14:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll
 

==================== One Month Modified Files and Folders =======
 

2013-08-07 11:00 - 2013-08-05 12:26 - 00003436 _____ C:\Windows\System32\Tasks\BrowserDefendert

2013-08-07 11:00 - 2013-07-31 06:46 - 00000004 _____ C:\Users\Samy\AppData\Roaming\cache.ini

2013-08-07 11:00 - 2013-07-04 11:59 - 01574933 _____ C:\Windows\WindowsUpdate.log

2013-08-07 10:31 - 2009-07-13 20:45 - 00024912 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-07 10:31 - 2009-07-13 20:45 - 00024912 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-07 10:29 - 2011-02-11 00:21 - 00669012 _____ C:\Windows\System32\perfh007.dat

2013-08-07 10:29 - 2011-02-11 00:21 - 00134796 _____ C:\Windows\System32\perfc007.dat

2013-08-07 10:29 - 2009-07-13 21:13 - 01527002 _____ C:\Windows\System32\PerfStringBackup.INI

2013-08-07 10:25 - 2012-05-12 07:49 - 00000000 ____D C:\ProgramData\Kaspersky Lab

2013-08-07 10:24 - 2013-03-06 04:07 - 00000000 ___RD C:\Users\Samy\Dropbox

2013-08-07 10:24 - 2013-03-06 04:02 - 00000000 ____D C:\Users\Samy\AppData\Roaming\Dropbox

2013-08-07 10:23 - 2013-07-31 04:05 - 00001469 _____ C:\Windows\setupact.log

2013-08-07 10:23 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-05 11:23 - 2013-08-05 11:23 - 00000000 ____D C:\FRST

2013-08-04 04:27 - 2013-08-04 04:27 - 00001614 _____ C:\Windows\PFRO.log

2013-08-04 04:27 - 2013-07-05 05:54 - 00000000 ____D C:\ProgramData\BrowserDefender

2013-08-04 01:12 - 2012-02-11 12:28 - 00000000 ____D C:\Users\Samy\AppData\Roaming\Skype

2013-07-31 04:05 - 2013-07-31 04:05 - 00000000 _____ C:\Windows\setuperr.log

2013-07-30 14:04 - 2011-08-03 00:55 - 00000000 ____D C:\Windows\Panther

2013-07-30 13:13 - 2013-07-30 12:40 - 00015543 _____ C:\Users\Samy\Desktop\architekt.odt

2013-07-29 13:18 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF

2013-07-28 08:51 - 2013-07-28 08:37 - 00000000 ____D C:\Users\Samy\Desktop\Urlaub Eltern 2013

2013-07-18 07:25 - 2013-07-18 07:25 - 00003072 ____H C:\Users\Samy\photothumb.db

2013-07-18 07:25 - 2012-02-11 12:22 - 00000000 ____D C:\users\Samy

2013-07-18 07:24 - 2013-07-18 07:24 - 00024576 ____H C:\Users\Samy\Desktop\photothumb.db

2013-07-15 05:49 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache

2013-07-14 09:53 - 2009-07-13 20:45 - 00530648 _____ C:\Windows\System32\FNTCACHE.DAT

2013-07-14 09:51 - 2013-03-14 02:31 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-14 09:51 - 2013-03-14 02:31 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-07-14 09:48 - 2011-02-11 00:20 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer

2013-07-14 09:48 - 2010-11-20 23:17 - 00000000 ____D C:\Program Files\Windows Journal

2013-07-14 09:48 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\SysWOW64\winrm

2013-07-14 09:48 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\SysWOW64\WCN

2013-07-14 09:48 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\SysWOW64\sysprep

2013-07-14 09:48 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\SysWOW64\slmgr

2013-07-14 09:48 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\SysWOW64\Printing_Admin_Scripts

2013-07-14 09:48 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\System32\winrm

2013-07-14 09:48 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\System32\WCN

2013-07-14 09:48 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\System32\slmgr

2013-07-14 09:48 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\System32\Printing_Admin_Scripts

2013-07-14 09:48 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Sidebar

2013-07-14 09:48 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer

2013-07-14 09:48 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Defender

2013-07-14 09:48 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar

2013-07-14 09:48 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer

2013-07-14 09:48 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\Setup

2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\oobe

2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\MUI

2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\migwiz

2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\Dism

2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\com

2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\sysprep

2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\Setup

2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\oobe

2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\MUI

2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\migwiz

2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\Dism

2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\com

2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\servicing

2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Program Files\Common Files\System

2013-07-14 09:45 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\DVD Maker

2013-07-14 01:27 - 2012-04-24 09:04 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-07-14 01:18 - 2012-06-08 01:50 - 78185248 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe

2013-07-12 10:01 - 2013-01-27 04:57 - 00000000 ___RD C:\Program Files (x86)\Skype

2013-07-12 10:01 - 2011-08-03 02:05 - 00000000 ____D C:\ProgramData\Skype

2013-07-11 13:14 - 2013-05-23 08:43 - 00000000 ____D C:\Users\Samy\Desktop\dom

2013-07-11 04:28 - 2013-07-02 08:53 - 00000000 ____D C:\Users\Samy\Desktop\steckbrief
 

Files to move or delete:

====================

C:\Users\Samy\AppData\Roaming\cache.dat

C:\Users\Samy\AppData\Roaming\cache.ini
 

==================== Known DLLs (Whitelisted) ================
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== EXE ASSOCIATION =====================
 

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK
 

==================== Restore Points  =========================
 

Restore point made on: 2013-07-14 01:07:12

Restore point made on: 2013-07-14 08:08:43

Restore point made on: 2013-07-16 01:26:33

Restore point made on: 2013-07-19 03:43:42

Restore point made on: 2013-07-23 23:06:03

Restore point made on: 2013-07-29 15:45:49

Restore point made on: 2013-08-04 04:40:48

Restore point made on: 2013-08-07 10:29:33
 

==================== BCD ================================
 

Windows-Start-Manager

---------------------

Bezeichner              {bootmgr}

device                  partition=E:

description             Windows Boot Manager

locale                  de-DE

inherit                 {globalsettings}

default                 {default}

resumeobject            {5123a86a-bdae-11e0-afe4-60eb699c533a}

displayorder            {default}

toolsdisplayorder       {memdiag}

timeout                 30
 

Windows-Startladeprogramm

-------------------------

Bezeichner              {default}

device                  partition=C:

path                    \Windows\system32\winload.exe

description             Windows 7

locale                  de-DE

inherit                 {bootloadersettings}

recoverysequence        {current}

recoveryenabled         Yes

osdevice                partition=C:

systemroot              \Windows

resumeobject            {5123a86a-bdae-11e0-afe4-60eb699c533a}

nx                      OptIn
 

Windows-Startladeprogramm

-------------------------

Bezeichner              {current}

device                  ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{5123a86d-bdae-11e0-afe4-60eb699c533a}

path                    \windows\system32\winload.exe

description             Windows Recovery Environment

inherit                 {bootloadersettings}

osdevice                ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{5123a86d-bdae-11e0-afe4-60eb699c533a}

systemroot              \windows

nx                      OptIn

winpe                   Yes
 

Wiederaufnahme aus dem Ruhezustand

----------------------------------

Bezeichner              {5123a86a-bdae-11e0-afe4-60eb699c533a}

device                  partition=C:

path                    \Windows\system32\winresume.exe

description             Windows Resume Application

locale                  de-DE

inherit                 {resumeloadersettings}

filedevice              partition=C:

filepath                \hiberfil.sys

debugoptionenabled      No
 

Windows-Speichertestprogramm

----------------------------

Bezeichner              {memdiag}

device                  partition=E:

path                    \boot\memtest.exe

description             Windows Memory Diagnostic

locale                  de-DE

inherit                 {globalsettings}

badmemoryaccess         Yes
 

EMS-Einstellungen

-----------------

Bezeichner              {emssettings}

bootems                 Yes
 

Debuggereinstellungen

---------------------

Bezeichner              {dbgsettings}

debugtype               Serial

debugport               1

baudrate                115200
 

RAM-Defekte

-----------

Bezeichner              {badmemory}
 

Globale Einstellungen

---------------------

Bezeichner              {globalsettings}

inherit                 {dbgsettings}

                        {emssettings}

                        {badmemory}
 

Startladeprogramm-Einstellungen

-------------------------------

Bezeichner              {bootloadersettings}

inherit                 {globalsettings}

                        {hypervisorsettings}
 

Hypervisoreinstellungen

-------------------

Bezeichner              {hypervisorsettings}

hypervisordebugtype     Serial

hypervisordebugport     1

hypervisorbaudrate      115200
 

Einstellungen zur Ladeprogrammfortsetzung

-----------------------------------------

Bezeichner              {resumeloadersettings}

inherit                 {globalsettings}
 

Ger„teoptionen

--------------

Bezeichner              {5123a86d-bdae-11e0-afe4-60eb699c533a}

description             Ramdisk Options

ramdisksdidevice        partition=E:

ramdisksdipath          \Recovery\WindowsRE\boot.sdi
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 15%

Total physical RAM: 4043.86 MB

Available physical RAM: 3399.86 MB

Total Pagefile: 4042.06 MB

Available Pagefile: 3385.79 MB

Total Virtual: 8192 MB

Available Virtual: 8191.86 MB
 

==================== Drives ================================
 

Drive c: (WINDOWS) (Fixed) (Total:232.34 GB) (Free:167.65 GB) NTFS (Disk=0 Partition=2)

Drive d: (Data) (Fixed) (Total:233.03 GB) (Free:198.55 GB) NTFS (Disk=0 Partition=3)

Drive e: (SYSTEM) (Fixed) (Total:0.39 GB) (Free:0.15 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]

Drive f: (KNOPPIX) (CDROM) (Total:0.67 GB) (Free:0 GB) CDFS

Drive h: (KINGSTON) (Removable) (Total:0.47 GB) (Free:0.41 GB) FAT (Disk=2 Partition=1)

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 3C96D6C9)

Partition 1: (Active) - (Size=399 MB) - (Type=27)

Partition 2: (Not Active) - (Size=232 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=233 GB) - (Type=07 NTFS)
 

========================================================

Disk: 2 (Size: 478 MB) (Disk ID: 6F20736B)

No partition Table on disk 2.

Disk 2 is a removable device.
 
 

LastRegBack: 2013-07-14 07:58
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Wie geht es weiter?

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

HKU\Samy\...\Winlogon: [Shell] explorer.exe,C:\Users\Samy\AppData\Roaming\cache.dat [90624 2011-11-16] () <==== ATTENTION 

C:\Users\Samy\AppData\Roaming\cache.dat

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

sollte der PC wieder normal starten:

Navigiere bitte zu:
C:\FRST\Quarantine
Rechtsklick, mit Winrar oder einem anderen Archvierer packen und im Uploadchannel hochladen.
Trojaner-Board Upload Channel

folgend die Fixlog...

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-08-2013 04

Ran by SYSTEM at 2013-08-07 21:33:22 Run:3

Running from H:\

Boot Mode: Recovery

==============================================
 

HKU\Samy\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.

C:\Users\Samy\AppData\Roaming\cache.dat => Moved successfully.
 

==== End of Fixlog ====

Sehr gut, danke fürs hochladen.
gleich kommt eine Anleitung für FRST.
mir würde hier aber vorerst die Liste der Programme, info folgt gleich, aus der Additions.txt reichen, bearbeite die bitte mit deiner Tochter

Empfehlungen fürs Deinstallieren
Bitte kopiere die Liste der installierten Programme aus der additions.txt hier in deinen Thread. Notiere mir bitte
hinter jede Zeile, ob folgendes Kategorie zutrifft: Unbekannt, Nötig, Unnötig

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

ok, ich hab's

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-08-2013 06

Ran by Samy (administrator) on 07-08-2013 22:00:02

Running from C:\Users\Samy\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

() C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe

() C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe

(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe

(Dropbox, Inc.) C:\Users\Samy\AppData\Roaming\Dropbox\bin\Dropbox.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe

(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe

(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe

(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)

HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)

HKCU\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10l_ActiveX.exe -update activex [233936 2011-09-24] (Adobe Systems, Inc.)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)

HKU\Default\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)

HKU\Default User\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)

AppInit_DLLs-x32: c:\progra~3\browse~1\261519~1.190\{c16c1~1\browse~1.dll [2691536 2013-07-26] ()

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)

Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk

ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk

ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

Startup: C:\Users\Samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Samy\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP&dt=071213

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA

HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://search.babylon.com/?babsrc=HP_ss_din2g&mntrId=E24974DE2B1D9015&affID=121563&tt=040713_ifrmful&tsp=4934

SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}

SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.yhs.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=E24974DE2B1D9015&affID=121563&tt=040713_ifrmful&tsp=4934

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

SearchScopes: HKCU - {DED82C22-F7A9-4C6D-BB8F-D26E10652D83} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=MYC2&o=APN10416&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AIT&apn_dtid=^zzz000^YY^DE&apn_uid=68585a97-976e-4f85-836a-7ff40e5333f0&apn_sauid=30B398E5-8BF8-4577-9DF2-3BB57A44E25C

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)

BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll (Delta-search.com)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)

Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaTlbr.dll (Delta-search.com)

Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default

FF user.js: detected! => C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\user.js

FF NewTab: hxxp://www.yhs.delta-search.com/?babsrc=NT_ss&mntrId=E24974DE2B1D9015&affID=121563&tt=040713_ifrmful&tsp=4934

FF SelectedSearchEngine: Delta Search

FF Homepage: www.google.de

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_171.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_171.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.7.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll ()

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\11-suche.xml

FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\askcom.xml

FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\babylon.xml

FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\delta.xml

FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\englische-ergebnisse.xml

FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\gmx-suche.xml

FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\lastminute.xml

FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\webde-suche.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

FF Extension: Delta Toolbar - C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\Extensions\ffxtlbr@delta.com

FF Extension: gophoto - C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\Extensions\gophoto@gophoto.it.xpi

FF Extension: movie2kdownloader - C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\Extensions\movie2kdownloader@movie2kdownloader.com.xpi

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKLM-x32\...\Firefox\Extensions: [webbooster@iminent.com] C:\Program Files (x86)\Iminent\webbooster@iminent.com

FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\

FF Extension: No Name - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
 

Chrome: 

=======

CHR Extension: () - C:\Users\Samy\AppData\Local\Google\Chrome\User Data\Default\Extensions\2.0.0.0_0\manifest.json

CHR HKLM-x32\...\Chrome\Extension: [blaofbhgbmeikidhlkmjhbkbfohpgekf] - C:\Program Files (x86)\Movie2KDownloader.com\Movie2KDownloader10.crx

CHR HKLM-x32\...\Chrome\Extension: [nkgfcicgjhneabbbfhddfcgifljdhhpl] - C:\Users\Samy\AppData\Roaming\BabSolution\CR\Delta.crx

CHR HKLM-x32\...\Chrome\Extension: [pfmopbbadnfoelckkcmjjeaaegjpjjbk] - C:\Program Files (x86)\Gophoto.it\gophotoit14.crx
 

==================== Services (Whitelisted) =================
 

R2 BrowserDefendert; C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe [2847696 2013-07-26] ()

S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)

S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
 

==================== Drivers (Whitelisted) ====================
 

R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv_x64.sys [44928 2012-10-11] (ManyCam LLC)

R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [29696 2012-10-11] (ManyCam LLC)

S3 Tosrfcom; No ImagePath
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-07 21:56 - 2013-08-07 21:59 - 01789861 _____ (Farbar) C:\Users\Samy\Desktop\FRST64.exe

2013-08-07 21:50 - 2013-08-07 21:50 - 00003436 _____ C:\Windows\System32\Tasks\BrowserDefendert

2013-08-05 21:23 - 2013-08-05 21:23 - 00000000 ____D C:\FRST

2013-08-04 14:27 - 2013-08-04 14:27 - 00001614 _____ C:\Windows\PFRO.log

2013-07-31 16:46 - 2013-08-07 21:00 - 00000004 _____ C:\Users\Samy\AppData\Roaming\cache.ini

2013-07-31 14:05 - 2013-08-07 21:50 - 00001581 _____ C:\Windows\setupact.log

2013-07-31 14:05 - 2013-07-31 14:05 - 00000000 _____ C:\Windows\setuperr.log

2013-07-30 22:40 - 2013-07-30 23:13 - 00015543 _____ C:\Users\Samy\Desktop\architekt.odt

2013-07-28 18:37 - 2013-07-28 18:51 - 00000000 ____D C:\Users\Samy\Desktop\Urlaub Eltern 2013

2013-07-18 17:25 - 2013-07-18 17:25 - 00003072 ____H C:\Users\Samy\photothumb.db

2013-07-18 17:24 - 2013-07-18 17:24 - 00024576 ____H C:\Users\Samy\Desktop\photothumb.db

2013-07-14 11:17 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-14 11:17 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-14 11:17 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-14 11:17 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-14 11:17 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-14 11:17 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-07-14 11:17 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-07-14 11:17 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-07-14 11:17 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-07-14 11:17 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-14 11:17 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-07-14 11:17 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-14 11:17 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-14 11:17 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-14 11:17 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-14 11:17 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-07-14 11:17 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-07-14 11:17 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-07-14 11:17 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-07-14 11:17 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-14 11:17 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-07-14 11:17 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-07-14 11:17 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-07-14 11:16 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-14 11:16 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-14 11:16 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-07-14 11:16 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-14 11:16 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-14 11:16 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-14 11:16 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-14 11:16 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-07-12 08:43 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-07-12 08:43 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2013-07-12 08:43 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2013-07-12 08:43 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-07-12 08:43 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-07-12 08:43 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-07-12 08:43 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
 

==================== One Month Modified Files and Folders =======
 

2013-08-07 22:00 - 2009-07-14 06:45 - 00024912 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-07 22:00 - 2009-07-14 06:45 - 00024912 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-07 21:59 - 2013-08-07 21:56 - 01789861 _____ (Farbar) C:\Users\Samy\Desktop\FRST64.exe

2013-08-07 21:58 - 2011-02-11 10:21 - 00669012 _____ C:\Windows\system32\perfh007.dat

2013-08-07 21:58 - 2011-02-11 10:21 - 00134796 _____ C:\Windows\system32\perfc007.dat

2013-08-07 21:58 - 2009-07-14 07:13 - 01527002 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-07 21:54 - 2012-02-11 22:28 - 00000000 ____D C:\Users\Samy\AppData\Roaming\Skype

2013-08-07 21:50 - 2013-08-07 21:50 - 00003436 _____ C:\Windows\System32\Tasks\BrowserDefendert

2013-08-07 21:50 - 2013-07-31 14:05 - 00001581 _____ C:\Windows\setupact.log

2013-08-07 21:50 - 2013-03-06 14:07 - 00000000 ___RD C:\Users\Samy\Dropbox

2013-08-07 21:50 - 2013-03-06 14:02 - 00000000 ____D C:\Users\Samy\AppData\Roaming\Dropbox

2013-08-07 21:50 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-07 21:48 - 2013-07-04 21:59 - 01610807 _____ C:\Windows\WindowsUpdate.log

2013-08-07 21:00 - 2013-07-31 16:46 - 00000004 _____ C:\Users\Samy\AppData\Roaming\cache.ini

2013-08-05 21:23 - 2013-08-05 21:23 - 00000000 ____D C:\FRST

2013-08-04 14:27 - 2013-08-04 14:27 - 00001614 _____ C:\Windows\PFRO.log

2013-08-04 14:27 - 2013-07-05 15:54 - 00000000 ____D C:\ProgramData\BrowserDefender

2013-07-31 14:05 - 2013-07-31 14:05 - 00000000 _____ C:\Windows\setuperr.log

2013-07-31 00:04 - 2011-08-03 10:55 - 00000000 ____D C:\Windows\Panther

2013-07-30 23:13 - 2013-07-30 22:40 - 00015543 _____ C:\Users\Samy\Desktop\architekt.odt

2013-07-29 23:18 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF

2013-07-28 18:51 - 2013-07-28 18:37 - 00000000 ____D C:\Users\Samy\Desktop\Urlaub Eltern 2013

2013-07-18 17:25 - 2013-07-18 17:25 - 00003072 ____H C:\Users\Samy\photothumb.db

2013-07-18 17:25 - 2012-02-11 22:22 - 00000000 ____D C:\Users\Samy

2013-07-18 17:24 - 2013-07-18 17:24 - 00024576 ____H C:\Users\Samy\Desktop\photothumb.db

2013-07-15 15:49 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache

2013-07-14 19:53 - 2009-07-14 06:45 - 00530648 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-14 19:51 - 2013-03-14 12:31 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-14 19:51 - 2013-03-14 12:31 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-07-14 19:48 - 2011-02-11 10:20 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer

2013-07-14 19:48 - 2010-11-21 09:17 - 00000000 ____D C:\Program Files\Windows Journal

2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\SysWOW64\winrm

2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\SysWOW64\WCN

2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\SysWOW64\sysprep

2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\SysWOW64\slmgr

2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\SysWOW64\Printing_Admin_Scripts

2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\system32\winrm

2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\system32\WCN

2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\system32\slmgr

2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\system32\Printing_Admin_Scripts

2013-07-14 19:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Sidebar

2013-07-14 19:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer

2013-07-14 19:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender

2013-07-14 19:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar

2013-07-14 19:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer

2013-07-14 19:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\Setup

2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\oobe

2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\MUI

2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\migwiz

2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\Dism

2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\com

2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\sysprep

2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\Setup

2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\oobe

2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\MUI

2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\migwiz

2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\Dism

2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\com

2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\servicing

2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\System

2013-07-14 19:45 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\DVD Maker

2013-07-14 11:27 - 2012-04-24 19:04 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-07-14 11:18 - 2012-06-08 11:50 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2013-07-12 20:01 - 2013-01-27 14:57 - 00000000 ___RD C:\Program Files (x86)\Skype

2013-07-12 20:01 - 2011-08-03 12:05 - 00000000 ____D C:\ProgramData\Skype

2013-07-11 23:14 - 2013-05-23 18:43 - 00000000 ____D C:\Users\Samy\Desktop\dom

2013-07-11 14:28 - 2013-07-02 18:53 - 00000000 ____D C:\Users\Samy\Desktop\steckbrief

2013-07-08 08:59 - 2012-06-03 20:58 - 00000000 ____D C:\Users\Samy\Desktop\FH Meschede

2013-07-08 08:58 - 2013-03-13 23:40 - 00000000 ____D C:\Users\Samy\Desktop\Rezepte
 

Files to move or delete:

====================

C:\Users\Samy\AppData\Roaming\cache.ini
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-07-14 17:58
 

==================== End Of Log ============================

--- --- ---

--- --- ---
Als nächstes gehe ich nun diese Addition.txt an.

hi, poste logs immmer gleichzeitig, sonst muss ich hier immer umsonst reingucken da neue Logs angehangen werden an den vorherigen post.
Also nächster Post bitte mit der bearbeiteten TXT :-)

sorry :-)

hat nun doch einige Zeit gedauer die TXT durchzugehen..

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-08-2013 06

Ran by Samy at 2013-08-07 22:05:05

Running from C:\Users\Samy\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Installed Programs =======================
 

   

Adobe Flash Player 10 ActiveX (x32 Version: 10.1.102.64): nötig

Adobe Flash Player 11 Plugin (x32 Version: 11.6.602.171): nötig

Adobe Reader X (10.1.7) MUI (x32 Version: 10.1.7)       : nötig    

Apple Application Support (x32 Version: 2.1.9)          : nötig

Apple Mobile Device Support (Version: 5.2.0.6)                : nötig

Apple Software Update (x32 Version: 2.1.3.127)                : nötig

Atheros Bluetooth Filter Driver Package (Version: 1.00.007)        : nötig

Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.36)        : nötig

Atheros Driver Installation Program (x32 Version: 9.2)                : nötig

AviSynth 2.6 (x32 Version: 2.6.0.2)                                : unbekannt

AvsP (x32)                                                        : unbekannt

Bejeweled 2 Deluxe (x32 Version: 2.2.0.95)                        : unbekannt

Bejeweled 3 (x32 Version: 2.2.0.97)                                : unbekannt

Bluetooth Stack for Windows by Toshiba (Version: v8.00.04(T))        : unbekannt

Bonjour (Version: 3.0.0.10)                                        : nötig

BrowserDefender (x32)                                                : unbekannt

Canon MP550 series MP Drivers                                        : nötig

Chicken Invaders 3 - Revenge of the Yolk (x32 Version: 2.2.0.95) : unnötig 

Chuzzle Deluxe (x32 Version: 2.2.0.95)                                : unbekannt

Conexant HD Audio (Version: 8.51.1.0)                                : unbekannt

D3DX10 (x32 Version: 15.4.2368.0902)                                : unbekannt

Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32):nötig 

Delta Chrome Toolbar (x32)                                        : unnötig

Delta toolbar   (x32 Version: 1.8.21.5)                                : unnötig

Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95)                : unnötig

Dropbox (HKCU Version: 2.0.22)                                        : unbekannt

DVD slideshow GUI 0.9.5.4 (x32 Version: DVD slideshow GUI 0.9.5.4) : unbekannt

eaner (Version: 3.19)                                                : unbekannt

FATE (x32 Version: 2.2.0.97)                                        : unbekantt

Final Drive: Nitro (x32 Version: 2.2.0.95)                        : unnötig

Firebird SQL Server - MAGIX Edition (x32 Version: 2.1.31.0)        : unbekannt

FMS (x32)                                                        : unbekannt

Fotogalerie (x32 Version: 16.4.3508.0205)                        : nötig

Free YouTube to MP3 Converter version 3.12.5.628 (x32 Version: 3.12.5.628) : nötig

Galerie de photos (x32 Version: 16.4.3508.0205)                        : nötig

GUI for dvdauthor 1.07 (x32 Version: 1.07)                        : unbekannt

Haali Media Splitter (x32)                                        : unbekannt

Helix YUV Codecs (remove only) (x32)                                : unbekannt

High-Definition Video Playback (x32 Version: 7.3.10900.8.0)        : nötig

ImgBurn (x32 Version: 2.5.5.0)                                        : nötig

Insaniquarium Deluxe (x32 Version: 2.2.0.97)                        : unbekannt

Intel(R) Management Engine Components (x32 Version: 7.0.0.1144) : nötig

Intel(R) Processor Graphics (x32 Version: 8.15.10.2353)                : nötig

Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004)        : nötig

iTunes (Version: 10.6.3.25)                                        : nötig

Java 7 Update 9 (x32 Version: 7.0.90)                                : nötig

Java Auto Updater (x32 Version: 2.1.9.0)                        : nötig

Java(TM) 6 Update 20 (x32 Version: 6.0.200)                        : nötig

JavaFX 2.1.1 (x32 Version: 2.1.1)                                : nötig

Junk Mail filter update (x32 Version: 16.4.3508.0205)                : nötig

Kurvenprofi 5.1.1 (x32)                                                : nötig

MAGIX Speed burnR (MSI) (Version: 7.0.2.6)                        : unbekannt

MAGIX Speed burnR (MSI) (x32 Version: 7.0.2.6)                        : unbekannt

MAGIX Video deluxe 2013 (Version: 12.0.0.32)                        : unbekannt

MAGIX Video deluxe 2013 (x32 Version: 12.0.0.32)                : unbekannt

ManyCam 3.1.21 (x32 Version: 3.1.21)                                : unbekannt

McAfee Security Scan Plus (x32 Version: 3.0.318.3)                : unnötig

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)        : nötig

Microsoft Application Error Reporting (Version: 12.0.6015.5000)        : nötig

Microsoft Office 2010 Service Pack 1 (SP1) (x32)                : nötig

Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig

Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig

Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)        : nötig

Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig

Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig

Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)                        : nötig

Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)        : nötig

Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig

Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig

Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig

Microsoft Office Professional Plus 2010 (x32 Version: 14.0.6029.1000)        : nötig

Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)        : nötig

Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)        : nötig

Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig

Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)        : nötig

Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig

Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig

Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)        : nötig

Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)                : nötig

Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)                : nötig

Microsoft Primary Interoperability Assemblies 2005 (x32 Version: 9.0.21022)        : unbekannt

Microsoft Silverlight (Version: 5.1.20513.0)                                        : unbekannt

Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)                : unnötig

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)                : unnötig

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)                : unnötig

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)                : unnötig

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)        : unnötig

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)        : unnötig

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)        : unnötig

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)        : unnötig

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (x32 Version: 10.0.30319)        : unnötig

Movie Maker (x32 Version: 16.4.3508.0205)                : nötig

Movie2KDownloader (x32 Version: 2.1 Build 26473)        : nötig

Mozilla Firefox 13.0.1 (x86 de) (x32 Version: 13.0.1)        : nötig

Mozilla Maintenance Service (x32 Version: 13.0.1)        : nötig

MSVCRT (x32 Version: 15.4.2862.0708)                        : unbekannt

MSVCRT_amd64 (x32 Version: 15.4.2862.0708)                : unbekannt

MSVCRT110 (x32 Version: 16.4.1108.0727)                        : unbekannt

MSVCRT110_amd64 (Version: 16.4.1109.0912)                : unbekannt

MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)        : unbekannt

MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)        : unbekannt

MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)        : unbekannt

MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)                        : unbekannt

Nero 10 Movie ThemePack Basic (x32 Version: 10.6.10000.1.0)        : unnötig

Nero BackItUp 10 Help (CHM) (x32 Version: 10.6.10700)                : unnötig

Nero BurnRights 10 Help (CHM) (x32 Version: 10.6.10700)                : unnötig

Nero Control Center 10 (x32 Version: 10.6.12700.0.7)                : unnötig

Nero ControlCenter 10 Help (CHM) (x32 Version: 10.6.10800)        : unnötig

Nero Core Components 10 (x32 Version: 2.0.20000.9.12)                : unnötig

Nero Express 10 Help (CHM) (x32 Version: 10.6.10700)                : unnötig

Nero InfoTool 10 Help (CHM) (x32 Version: 10.6.10700)                : unnötig

Nero Multimedia Suite 10 Essentials (x32 Version: 10.6.10300)        : unnötig

Nero RescueAgent 10 Help (CHM) (x32 Version: 10.6.10800)        : unnötig

Nero StartSmart 10 Help (CHM) (x32 Version: 10.6.10700)                : unnötig

NeroKwikMedia Help (CHM) (x32 Version: 10.6.10900)                : unnötig

PDFCreator (x32 Version: 1.7.0)                                        : nötig

Penguins! (x32 Version: 2.2.0.95)                                : unbekannt

Photo Common (x32 Version: 16.4.3508.0205)                        : nötig

Photo Gallery (x32 Version: 16.4.3508.0205)                        : nötig

PhotoScape (x32)                                                : nötig

Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95)        : unnötig

PlayReady PC Runtime amd64 (Version: 1.3.0)                        : unnötig

Polar Bowler (x32 Version: 2.2.0.97)                                : unnötig

Raccolta foto (x32 Version: 16.4.3508.0205)                        : nötig

Realtek USB 2.0 Reader Driver (x32 Version: 1.0.0.15)                : unbekannt

Screenshot Captor 3.26.01 (x32)                                        : nötig

SketchUp 8 (x32 Version: 3.0.16944)                                : unnötig

Skype™ 6.6 (x32 Version: 6.6.106)                                : nötig

Slingo Deluxe (x32 Version: 2.2.0.95)                                : unbekannt

Synaptics Pointing Device Driver (Version: 15.2.11.1)                : unbekannt

TOSHIBA Assist (x32 Version: 4.02.02)                                : unbekannt

TOSHIBA Bulletin Board (Version: 2.1.10.64)                        : unbekannt

TOSHIBA Bulletin Board (x32 Version: 2.1.10.64)                        : unbekannt

TOSHIBA ConfigFree (x32 Version: 8.0.37)                        : unbekannt

TOSHIBA Disc Creator (Version: 2.1.0.6 for x64)                        : unbekannt

TOSHIBA eco Utility (Version: 1.2.25.64)                        : unbekannt

TOSHIBA Face Recognition (Version: 3.1.8.64)                        : unbekannt

TOSHIBA Face Recognition (x32 Version: 3.1.8.64)                : unbekannt

TOSHIBA Hardware Setup (Version: 4.08.06.00)                        : unbekannt

TOSHIBA Hardware Setup (x32 Version: 4.08.06.00)                : unbekannt

TOSHIBA HDD/SSD Alert (Version: 3.1.64.7)                        : unbekannt

TOSHIBA HDD/SSD Alert (x32 Version: 3.1.64.7)                        : unbekannt

Toshiba Manuals (x32 Version: 10.02)                                : unbekannt

TOSHIBA Online Product Information (x32 Version: 4.01.0000)        : unbekannt

TOSHIBA PC Health Monitor (Version: 1.7.9.64M)                        : unbekannt

TOSHIBA Places Icon Utility (x32 Version: 1.1.1.4)                : unbekannt

TOSHIBA Recovery Media Creator (x32 Version: 2.1.3.10010)        : unbekannt

TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.00.0019): unbekannt

TOSHIBA ReelTime (Version: 1.7.17.64)                                : unbekannt

TOSHIBA ReelTime (x32 Version: 1.7.17.64)                        : unbekannt

TOSHIBA Service Station (x32 Version: 2.2.9)                        : unbekannt

TOSHIBA Sleep Utility (x32 Version: 1.4.2.7)                        : unbekannt

TOSHIBA Supervisor Password (Version: 4.08.06.00)                : unbekannt

TOSHIBA Supervisor Password (x32 Version: 4.08.06.00)                : unbekannt

TOSHIBA TEMPRO (x32 Version: 3.35)                                : unbekannt

TOSHIBA Value Added Package (Version: 1.5.4.64)                        : unbekannt

TOSHIBA Value Added Package (x32 Version: 1.5.4.64)                : unbekannt

TOSHIBA Web Camera Application (x32 Version: 2.0.0.19)                : unbekannt

TOSHIBA Wireless LAN Indicator (x32 Version: 1.0.3)                : unbekannt

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)        : unbekannt

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)        : unbekannt

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)        : unbekannt

Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)        : unbekannt

Update for Microsoft Office 2010 (KB2553065) (x32)

Update for Microsoft Office 2010 (KB2553092) (x32)

Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2566458) (x32)

Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)

Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)

Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)

Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition (x32)

Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)

Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)

Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition (x32)

Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)

Update Installer for WildTangent Games App (x32)                        : unnötig

Wedding Dash 2 - Rings Around the World (x32 Version: 2.2.0.95)                : unnötig

WildTangent Games (x32 Version: 1.0.2.5)                                : unnötig

WildTangent Games App (Toshiba Games) (x32 Version: 4.0.5.36)                : unnötig

Windows Live (x32 Version: 16.4.3508.0205)                                : unnötig

Windows Live Communications Platform (x32 Version: 16.4.3508.0205)        : unnötig

Windows Live Essentials (x32 Version: 16.4.3508.0205)                        : unnötig

Windows Live Family Safety (Version: 16.4.3508.0205)                        : unnötig

Windows Live Family Safety (x32 Version: 16.4.3508.0205)                : unnötig

Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)                : unnötig

Windows Live Installer (x32 Version: 16.4.3508.0205)                        : unnötig

Windows Live Mail (x32 Version: 16.4.3508.0205)                                : unnötig

Windows Live Messenger (x32 Version: 16.4.3508.0205)                        : unnötig

Windows Live MIME IFilter (Version: 16.4.3508.0205)                        : unnötig

Windows Live Photo Common (x32 Version: 16.4.3508.0205)                        : unnötig

Windows Live PIMT Platform (x32 Version: 16.4.3508.0205)                : unnötig

Windows Live SOXE (x32 Version: 16.4.3508.0205)                                : unnötig

Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205)                : unnötig

Windows Live UX Platform (x32 Version: 16.4.3508.0205)                        : unnötig

Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205)        : unnötig

Windows Live Writer (x32 Version: 16.4.3508.0205)                        : unnötig

Windows Live Writer Resources (x32 Version: 16.4.3508.0205)                : unnötig

WXTide32 (x32)                                                                : unnötig

Zuma Deluxe (x32 Version: 2.2.0.95)                                        : unnötig
 

==================== Restore Points  =========================
 

14-07-2013 09:06:33 Windows Modules Installer

14-07-2013 16:08:04 Sprachpaketdeinstallation

16-07-2013 09:25:55 Windows Update

19-07-2013 11:43:16 Windows Update

24-07-2013 07:05:31 Windows Update

29-07-2013 23:45:30 Windows Update

04-08-2013 12:40:23 Windows Update

07-08-2013 18:29:07 Windows Update
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {1651C67A-3E2C-4D17-AF36-DE63DF4B032D} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)

Task: {58F48707-CB3C-4010-8BEC-4381EC4BA1ED} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2010-12-03] (TOSHIBA CORPORATION)

Task: {5A66AE0F-5A92-4E47-AE46-EAAEA6A63047} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task

Task: {63E93C93-6AC2-4E1E-831C-D36613B655C8} - System32\Tasks\EPUpdater => C:\Users\Samy\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe [2013-06-06] ()

Task: {94671AFF-6192-4FE5-8680-474AE2104F6D} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)

Task: {B731B22E-FC7D-49BC-8183-0F2DC551D28A} - System32\Tasks\File Helper => C:\Program Files (x86)\File Helper\File Helper.lnk No File

Task: {E279A6E4-A01A-45D8-A3E9-644ED470BAE4} - System32\Tasks\BrowserDefendert => C:\Windows\system32\sc.exe [2009-07-14] (Microsoft Corporation)

Task: {E8F0C63D-1010-4D45-AB5F-5309F9A8A328} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2214768358-217717142-1947330960-1000

Task: {F366CFC1-9543-4161-BABC-83C641F42AA5} - System32\Tasks\Microsoft\Windows Defender\MpIdleTask => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)

Task: C:\Windows\Tasks\File Helper.job => ?
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (08/07/2013 09:51:17 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/07/2013 09:36:06 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/07/2013 08:25:37 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/05/2013 10:27:32 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/05/2013 10:26:33 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4

Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000000000005124a

ID des fehlerhaften Prozesses: 0x6e0

Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0

Pfad der fehlerhaften Anwendung: Explorer.EXE1

Pfad des fehlerhaften Moduls: Explorer.EXE2

Berichtskennung: Explorer.EXE3
 

Error: (08/05/2013 09:20:04 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/05/2013 09:10:50 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/05/2013 09:07:11 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/05/2013 08:53:45 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/04/2013 02:55:59 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

System errors:

=============

Error: (08/07/2013 09:50:53 PM) (Source: WMPNetworkSvc) (User: )

Description: WMPNetworkSvc0x80004005
 

Error: (08/07/2013 08:24:34 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Kaspersky Security Suite CBE 11 Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (08/07/2013 08:24:34 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Kaspersky Security Suite CBE 11 Service erreicht.
 

Error: (08/05/2013 09:23:32 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/05/2013 09:23:32 PM) (Source: DCOM) (User: )

Description: 1068netprofm{A47979D2-C419-11D9-A5B4-001185AD2B89}
 

Error: (08/05/2013 09:20:07 PM) (Source: DCOM) (User: )

Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
 

Error: (08/05/2013 09:18:37 PM) (Source: Service Control Manager) (User: )

Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

AFD

DfsC

discache

kl2

KLIF

KLIM6

NetBIOS

NetBT

nsiproxy

Psched

rdbss

spldr

tdx

vwififlt

Wanarpv6

WfpLwf
 

Error: (08/05/2013 09:18:23 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "NLA (Network Location Awareness)" ist vom Dienst "Netzwerkspeicher-Schnittstellendienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/05/2013 09:18:23 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "SMB 2.0-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 

Error: (08/05/2013 09:18:23 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "SMB 1.x-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1068
 
 

Microsoft Office Sessions:

=========================

Error: (08/07/2013 09:51:17 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/07/2013 09:36:06 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/07/2013 08:25:37 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/05/2013 10:27:32 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/05/2013 10:26:33 PM) (Source: Application Error)(User: )

Description: Explorer.EXE6.1.7601.175674d672ee4ntdll.dll6.1.7601.177254ec4aa8ec0000005000000000005124a6e001ce9219ff2fb177C:\Windows\Explorer.EXEC:\Windows\SYSTEM32\ntdll.dll5136fe3e-fe0d-11e2-9734-e89a8fdfbf9b
 

Error: (08/05/2013 09:20:04 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/05/2013 09:10:50 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/05/2013 09:07:11 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/05/2013 08:53:45 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/04/2013 02:55:59 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 31%

Total physical RAM: 4043.86 MB

Available physical RAM: 2777.06 MB

Total Pagefile: 8085.9 MB

Available Pagefile: 6740.68 MB

Total Virtual: 8192 MB

Available Virtual: 8191.85 MB
 

==================== Drives ================================
 

Drive c: (WINDOWS) (Fixed) (Total:232.34 GB) (Free:170.7 GB) NTFS (Disk=0 Partition=2)

Drive d: (Data) (Fixed) (Total:233.03 GB) (Free:198.55 GB) NTFS (Disk=0 Partition=3)
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 3C96D6C9)

Partition 1: (Active) - (Size=399 MB) - (Type=27)

Partition 2: (Not Active) - (Size=232 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=233 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Hi,
bitte beachtet beide bei instalationen:
- instaliert Software nur von der Herstellerseite.
- Googled die jeweilige Software und das Stichwort Adware, um Instalationen die Toolbars mitbringen auszufiltern.
- Lest die Lizenzverträge (AGB's) und sucht nach Drittanbietersoftware.
- instaliert immer Benutzerdefiniert, und wählt evtl. Toolbars ab.
Diese Plage wird immer schlimmer im Moment und da seit ihr als nutzer gefragt.
es sind 2 Logs zu erstellen, möglichst gleichzeitig posten!
Falls es Probleme beim deinstalieren gibt, nutzt Rewo:
Revo Uninstaller - Download - Filepony

1.
deinstaliere:
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden, instalieren.
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen
bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
Sicherheit (erweitert)
Erweiterte Sicherheit anhaken
und alle Dateien auswählen.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
AviSynth
AvsP
Bejeweled : beide
BrowserDefender
Chicken
Chuzzle
Delta : beide
Diner
Dropbox
DVD
Final
Insaniquarium
Java 7
Java(TM)
downloade Java jre:
Java-Downloads für alle Betriebssysteme
klicke:
Download der Java-Software für Windows Offline
laden, und instalieren
deinstaliere:
MAGIX : alle
McAfee
Movie2KDownloader : weg damit, hau deiner Tochter gleich mal auf die Finger, movie2k und andere Streamingseiten sind illegal, dass dem so ist, kann man schon rausfinden, in dem dort Kinofilme gezeigt werden, da kann schon was nicht stimmen, die Leute geben das Zeug nich kostenlos raus da wird ordendlich Malware verteilt, + natürlich der Werbung.
Mozilla Firefox : öffnen, Hilfe, Update, Version 23 ist aktuell.

deinstaliere:
Nero: alle
Penguins
Plants vs
Polar Bowler
SketchUp
Slingo Deluxe
Wedding
WildTangent : beide
Windows Live : alle für dich unnötigen.
Zuma

Neustarten.
2.
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

3.
Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Hi,
folgend Ergebnis Combofix:

Code:

Combofix Logfile:
 

        Code:


        
ComboFix 13-08-11.01 - Samy 11.08.2013  13:25:12.1.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4044.2578 [GMT 2:00]

ausgeführt von:: c:\users\Samy\Desktop\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\Samy\AppData\Roaming\Avisynth.exe

c:\users\Samy\AppData\Roaming\AvsP.exe

c:\users\Samy\AppData\Roaming\ImgBurn.exe

c:\users\Samy\AppData\Roaming\MatroskaSplitter.exe

c:\users\Samy\AppData\Roaming\SetupGFD.exe

c:\users\Samy\AppData\Roaming\yuvcodecs-1.3.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-07-11 bis 2013-08-11  ))))))))))))))))))))))))))))))

.

.

2013-08-11 11:30 . 2013-08-11 11:30        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-08-11 10:40 . 2013-08-11 10:40        --------        d-----w-        c:\program files (x86)\VS Revo Group

2013-08-11 10:25 . 2013-08-11 10:25        74136        ----a-w-        c:\program files (x86)\Mozilla Firefox\breakpadinjector.dll

2013-08-11 10:25 . 2013-08-11 10:25        262552        ----a-w-        c:\program files (x86)\Mozilla Firefox\browser\components\browsercomps.dll

2013-08-11 10:25 . 2013-08-11 10:25        92056        ----a-w-        c:\program files (x86)\Mozilla Firefox\webapprt-stub.exe

2013-08-11 10:25 . 2013-08-11 10:25        26520        ----a-w-        c:\program files (x86)\Mozilla Firefox\plugin-hang-ui.exe

2013-08-11 10:25 . 2013-08-11 10:25        170232        ----a-w-        c:\program files (x86)\Mozilla Firefox\webapp-uninstaller.exe

2013-08-11 10:20 . 2013-08-11 10:20        972712        ----a-w-        c:\windows\system32\deployJava1.dll

2013-08-11 10:20 . 2013-08-11 10:20        312232        ----a-w-        c:\windows\system32\javaws.exe

2013-08-11 10:20 . 2013-08-11 10:20        1093032        ----a-w-        c:\windows\system32\npDeployJava1.dll

2013-08-11 10:20 . 2013-08-11 10:20        108968        ----a-w-        c:\windows\system32\WindowsAccessBridge-64.dll

2013-08-11 10:20 . 2013-08-11 10:20        189352        ----a-w-        c:\windows\system32\javaw.exe

2013-08-11 10:20 . 2013-08-11 10:20        188840        ----a-w-        c:\windows\system32\java.exe

2013-08-11 10:20 . 2013-08-11 10:20        --------        d-----w-        c:\program files\Java

2013-08-11 10:00 . 2013-07-02 08:34        9460976        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{DB12DF67-631B-4DBB-B1A2-6E91A9CF749F}\mpengine.dll

2013-08-07 21:29 . 2013-08-07 21:29        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-08-07 21:29 . 2013-08-07 21:29        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-08-05 19:23 . 2013-08-05 19:23        --------        d-----w-        C:\FRST

2013-07-14 09:16 . 2013-06-11 23:43        817664        ----a-w-        c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll

2013-07-14 09:16 . 2013-06-11 23:43        108032        ----a-w-        c:\program files (x86)\Internet Explorer\jsdebuggeride.dll

2013-07-14 09:16 . 2013-06-11 23:26        1084928        ----a-w-        c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll

2013-07-14 09:16 . 2013-06-11 23:43        1767936        ----a-w-        c:\windows\SysWow64\wininet.dll

2013-07-14 09:16 . 2013-06-11 23:25        53248        ----a-w-        c:\windows\system32\jsproxy.dll

2013-07-14 09:16 . 2013-06-11 23:26        2241024        ----a-w-        c:\windows\system32\wininet.dll

2013-07-14 09:16 . 2013-06-11 23:25        15404032        ----a-w-        c:\windows\system32\ieframe.dll

2013-07-14 09:16 . 2013-06-11 23:25        19238912        ----a-w-        c:\windows\system32\mshtml.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-07-14 09:18 . 2012-06-08 09:50        78185248        ----a-w-        c:\windows\system32\MRT.exe

2013-07-02 20:26 . 2013-07-02 20:26        34936        ----a-w-        c:\windows\SysWow64\uninstHelixYUV.exe

2013-07-02 19:46 . 2007-04-27 08:43        120200        ----a-w-        c:\windows\SysWow64\DLLDEV32i.dll

2013-06-08 06:17 . 2013-06-08 06:17        719360        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll

2013-06-08 06:17 . 2013-06-08 06:17        226304        ----a-w-        c:\windows\system32\elshyph.dll

2013-06-08 06:17 . 2013-06-08 06:17        185344        ----a-w-        c:\windows\SysWow64\elshyph.dll

2013-06-08 06:17 . 2013-06-08 06:17        158720        ----a-w-        c:\windows\SysWow64\msls31.dll

2013-06-08 06:17 . 2013-06-08 06:17        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe

2013-06-08 06:17 . 2013-06-08 06:17        138752        ----a-w-        c:\windows\SysWow64\wextract.exe

2013-06-08 06:17 . 2013-06-08 06:17        1054720        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe

2013-06-08 06:17 . 2013-06-08 06:17        73728        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe

2013-06-08 06:17 . 2013-06-08 06:17        61952        ----a-w-        c:\windows\SysWow64\tdc.ocx

2013-06-08 06:17 . 2013-06-08 06:17        523264        ----a-w-        c:\windows\SysWow64\vbscript.dll

2013-06-08 06:17 . 2013-06-08 06:17        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll

2013-06-08 06:17 . 2013-06-08 06:17        38400        ----a-w-        c:\windows\SysWow64\imgutil.dll

2013-06-08 06:17 . 2013-06-08 06:17        361984        ----a-w-        c:\windows\SysWow64\html.iec

2013-06-08 06:17 . 2013-06-08 06:17        23040        ----a-w-        c:\windows\SysWow64\licmgr10.dll

2013-06-08 06:17 . 2013-06-08 06:17        1441280        ----a-w-        c:\windows\SysWow64\inetcpl.cpl

2013-06-08 06:17 . 2013-06-08 06:17        137216        ----a-w-        c:\windows\SysWow64\ieUnatt.exe

2013-06-08 06:17 . 2013-06-08 06:17        12800        ----a-w-        c:\windows\SysWow64\mshta.exe

2013-06-08 06:17 . 2013-06-08 06:17        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll

2013-06-08 06:17 . 2013-06-08 06:17        905728        ----a-w-        c:\windows\system32\mshtmlmedia.dll

2013-06-08 06:17 . 2013-06-08 06:17        81408        ----a-w-        c:\windows\system32\icardie.dll

2013-06-08 06:17 . 2013-06-08 06:17        762368        ----a-w-        c:\windows\system32\ieapfltr.dll

2013-06-08 06:17 . 2013-06-08 06:17        452096        ----a-w-        c:\windows\system32\dxtmsft.dll

2013-06-08 06:17 . 2013-06-08 06:17        441856        ----a-w-        c:\windows\system32\html.iec

2013-06-08 06:17 . 2013-06-08 06:17        281600        ----a-w-        c:\windows\system32\dxtrans.dll

2013-06-08 06:17 . 2013-06-08 06:17        235008        ----a-w-        c:\windows\system32\url.dll

2013-06-08 06:17 . 2013-06-08 06:17        216064        ----a-w-        c:\windows\system32\msls31.dll

2013-06-08 06:17 . 2013-06-08 06:17        197120        ----a-w-        c:\windows\system32\msrating.dll

2013-06-08 06:17 . 2013-06-08 06:17        1400416        ----a-w-        c:\windows\system32\ieapfltr.dat

2013-06-08 06:17 . 2013-06-08 06:17        97280        ----a-w-        c:\windows\system32\mshtmled.dll

2013-06-08 06:17 . 2013-06-08 06:17        92160        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2013-06-08 06:17 . 2013-06-08 06:17        77312        ----a-w-        c:\windows\system32\tdc.ocx

2013-06-08 06:17 . 2013-06-08 06:17        62976        ----a-w-        c:\windows\system32\pngfilt.dll

2013-06-08 06:17 . 2013-06-08 06:17        599552        ----a-w-        c:\windows\system32\vbscript.dll

2013-06-08 06:17 . 2013-06-08 06:17        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll

2013-06-08 06:17 . 2013-06-08 06:17        51200        ----a-w-        c:\windows\system32\imgutil.dll

2013-06-08 06:17 . 2013-06-08 06:17        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2013-06-08 06:17 . 2013-06-08 06:17        27648        ----a-w-        c:\windows\system32\licmgr10.dll

2013-06-08 06:17 . 2013-06-08 06:17        270848        ----a-w-        c:\windows\system32\iedkcs32.dll

2013-06-08 06:17 . 2013-06-08 06:17        247296        ----a-w-        c:\windows\system32\webcheck.dll

2013-06-08 06:17 . 2013-06-08 06:17        173568        ----a-w-        c:\windows\system32\ieUnatt.exe

2013-06-08 06:17 . 2013-06-08 06:17        167424        ----a-w-        c:\windows\system32\iexpress.exe

2013-06-08 06:17 . 2013-06-08 06:17        1509376        ----a-w-        c:\windows\system32\inetcpl.cpl

2013-06-08 06:17 . 2013-06-08 06:17        149504        ----a-w-        c:\windows\system32\occache.dll

2013-06-08 06:17 . 2013-06-08 06:17        144896        ----a-w-        c:\windows\system32\wextract.exe

2013-06-08 06:17 . 2013-06-08 06:17        13824        ----a-w-        c:\windows\system32\mshta.exe

2013-06-08 06:17 . 2013-06-08 06:17        136192        ----a-w-        c:\windows\system32\iepeers.dll

2013-06-08 06:17 . 2013-06-08 06:17        135680        ----a-w-        c:\windows\system32\IEAdvpack.dll

2013-06-08 06:17 . 2013-06-08 06:17        12800        ----a-w-        c:\windows\system32\msfeedssync.exe

2013-06-08 06:17 . 2013-06-08 06:17        102912        ----a-w-        c:\windows\system32\inseng.dll

2013-06-05 03:34 . 2013-07-12 06:43        3153920        ----a-w-        c:\windows\system32\win32k.sys

2013-06-04 06:00 . 2013-07-12 06:43        624128        ----a-w-        c:\windows\system32\qedit.dll

2013-06-04 04:53 . 2013-07-12 06:43        509440        ----a-w-        c:\windows\SysWow64\qedit.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]

2013-06-28 14:56        279552        ----a-w-        c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"TOPI.EXE"="c:\program files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe" [2011-05-16 846936]

.

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

TRDCReminder.lnk - c:\program files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe [2009-9-1 481184]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 BtFilter;Bluetooth LowerFilter Class Filter Driver;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]

R3 RSUSBVSTOR;RTSUVSTOR.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTSUVSTOR.sys;c:\windows\SYSNATIVE\Drivers\RTSUVSTOR.sys [x]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]

R3 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe;c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe [x]

R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x]

R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [x]

R3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [x]

S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [x]

S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe;c:\program files\TOSHIBA\TECO\TecoService.exe [x]

S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys;c:\windows\SYSNATIVE\DRIVERS\TVALZFL.sys [x]

S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]

S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]

S3 ManyCam;ManyCam Virtual Webcam;c:\windows\system32\DRIVERS\mcvidrv_x64.sys;c:\windows\SYSNATIVE\DRIVERS\mcvidrv_x64.sys [x]

S3 mcaudrv_simple;ManyCam Virtual Microphone;c:\windows\system32\drivers\mcaudrv_x64.sys;c:\windows\SYSNATIVE\drivers\mcaudrv_x64.sys [x]

S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys;c:\windows\SYSNATIVE\DRIVERS\pgeffect.sys [x]

S3 QIOMem;Generic IO & Memory Access;c:\windows\system32\drivers\QIOMem.sys;c:\windows\SYSNATIVE\drivers\QIOMem.sys [x]

.

.

Inhalt des "geplante Tasks" Ordners

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]

2013-06-28 14:56        339456        ----a-w-        c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-07 167256]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-07 391000]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-07 418136]

"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-12-14 316032]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm

IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html

IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: Zu TOSHIBA Bulletin Board hinzufügen - c:\program files\TOSHIBA\BulletinBoard\TosBBCom.dll/1000

IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\

FF - prefs.js: browser.startup.homepage - www.google.de

FF - ExtSQL: 2013-07-05 15:53; {ACAA314B-EEBA-48e4-AD47-84E31C44796C}; c:\program files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF - user.js: extensions.delta.tlbrSrchUrl - 

FF - user.js: extensions.delta.id - e249378800000000000074de2b1d9015

FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}

FF - user.js: extensions.delta.instlDay - 15891

FF - user.js: extensions.delta.vrsn - 1.8.21.5

FF - user.js: extensions.delta.vrsni - 1.8.21.5

FF - user.js: extensions.delta.vrsnTs - 1.8.21.515:54

FF - user.js: extensions.delta.prtnrId - delta

FF - user.js: extensions.delta.prdct - delta

FF - user.js: extensions.delta.aflt - babsst

FF - user.js: extensions.delta.smplGrp - none

FF - user.js: extensions.delta.tlbrId - base

FF - user.js: extensions.delta.instlRef - sst

FF - user.js: extensions.delta.dfltLng - de

FF - user.js: extensions.delta.excTlbr - false

FF - user.js: extensions.delta.ffxUnstlRst - true

FF - user.js: extensions.delta.admin - false

FF - user.js: extensions.delta_i.babTrack - affID=121563&tt=040713_ifrmful&tsp=4934

FF - user.js: extensions.delta_i.babExt - 

FF - user.js: extensions.delta_i.srcExt - ss

FF - user.js: extensions.delta.autoRvrt - false

FF - user.js: extensions.delta.rvrt - false

FF - user.js: extensions.delta.newTab - false

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

Toolbar-Locked - (no file)

AddRemove-HelixYUVCodecs - c:\windows\system32\uninstHelixYUV.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-08-11  13:33:06

ComboFix-quarantined-files.txt  2013-08-11 11:33

.

Vor Suchlauf: 11 Verzeichnis(se), 188.010.033.152 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 187.641.143.296 Bytes frei

.

- - End Of File - - 3756892BF8D868DAB31D5F146B58F3DB

 
--- --- ---

D41D8CD98F00B204E9800998ECF8427E

und hier noch das Ergebnis TDDSKiller:

Code:

13:40:24.0611 3472  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42

13:40:24.0807 3472  ============================================================

13:40:24.0807 3472  Current date / time: 2013/08/11 13:40:24.0807

13:40:24.0807 3472  SystemInfo:

13:40:24.0807 3472  

13:40:24.0807 3472  OS Version: 6.1.7601 ServicePack: 1.0

13:40:24.0807 3472  Product type: Workstation

13:40:24.0807 3472  ComputerName: SAMY-TOSH

13:40:24.0807 3472  UserName: Samy

13:40:24.0807 3472  Windows directory: C:\Windows

13:40:24.0807 3472  System windows directory: C:\Windows

13:40:24.0807 3472  Running under WOW64

13:40:24.0807 3472  Processor architecture: Intel x64

13:40:24.0807 3472  Number of processors: 4

13:40:24.0807 3472  Page size: 0x1000

13:40:24.0807 3472  Boot type: Normal boot

13:40:24.0807 3472  ============================================================

13:40:25.0140 3472  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

13:40:25.0144 3472  ============================================================

13:40:25.0144 3472  \Device\Harddisk0\DR0:

13:40:25.0145 3472  MBR partitions:

13:40:25.0145 3472  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0xC8000, BlocksNum 0x1D0AE800

13:40:25.0145 3472  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1D176800, BlocksNum 0x1D20F800

13:40:25.0145 3472  ============================================================

13:40:25.0165 3472  C: <-> \Device\Harddisk0\DR0\Partition1

13:40:25.0205 3472  D: <-> \Device\Harddisk0\DR0\Partition2

13:40:25.0205 3472  ============================================================

13:40:25.0205 3472  Initialize success

13:40:25.0205 3472  ============================================================

13:43:05.0438 3048  ============================================================

13:43:05.0438 3048  Scan started

13:43:05.0438 3048  Mode: Manual; SigCheck; TDLFS; 

13:43:05.0438 3048  ============================================================

13:43:05.0742 3048  ================ Scan system memory ========================

13:43:05.0743 3048  System memory - ok

13:43:05.0743 3048  ================ Scan services =============================

13:43:06.0202 3048  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys

13:43:06.0254 3048  1394ohci - ok

13:43:06.0289 3048  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys

13:43:06.0302 3048  ACPI - ok

13:43:06.0326 3048  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys

13:43:06.0396 3048  AcpiPmi - ok

13:43:06.0529 3048  [ ADDA5E1951B90D3D23C56D3CF0622ADC ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

13:43:06.0538 3048  AdobeARMservice - ok

13:43:06.0592 3048  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx         C:\Windows\system32\drivers\adp94xx.sys

13:43:06.0607 3048  adp94xx - ok

13:43:06.0676 3048  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci         C:\Windows\system32\drivers\adpahci.sys

13:43:06.0689 3048  adpahci - ok

13:43:06.0695 3048  [ E109549C90F62FB570B9540C4B148E54 ] adpu320         C:\Windows\system32\drivers\adpu320.sys

13:43:06.0705 3048  adpu320 - ok

13:43:06.0728 3048  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll

13:43:06.0778 3048  AeLookupSvc - ok

13:43:06.0824 3048  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD             C:\Windows\system32\drivers\afd.sys

13:43:06.0864 3048  AFD - ok

13:43:06.0906 3048  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys

13:43:06.0915 3048  agp440 - ok

13:43:06.0957 3048  [ 3290D6946B5E30E70414990574883DDB ] ALG             C:\Windows\System32\alg.exe

13:43:06.0981 3048  ALG - ok

13:43:07.0029 3048  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys

13:43:07.0037 3048  aliide - ok

13:43:07.0040 3048  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys

13:43:07.0048 3048  amdide - ok

13:43:07.0061 3048  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8           C:\Windows\system32\drivers\amdk8.sys

13:43:07.0071 3048  AmdK8 - ok

13:43:07.0075 3048  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys

13:43:07.0106 3048  AmdPPM - ok

13:43:07.0125 3048  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata         C:\Windows\system32\drivers\amdsata.sys

13:43:07.0135 3048  amdsata - ok

13:43:07.0152 3048  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys

13:43:07.0166 3048  amdsbs - ok

13:43:07.0182 3048  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata         C:\Windows\system32\drivers\amdxata.sys

13:43:07.0191 3048  amdxata - ok

13:43:07.0205 3048  [ 89A69C3F2F319B43379399547526D952 ] AppID           C:\Windows\system32\drivers\appid.sys

13:43:07.0265 3048  AppID - ok

13:43:07.0286 3048  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll

13:43:07.0319 3048  AppIDSvc - ok

13:43:07.0344 3048  [ 9D2A2369AB4B08A4905FE72DB104498F ] Appinfo         C:\Windows\System32\appinfo.dll

13:43:07.0356 3048  Appinfo - ok

13:43:07.0495 3048  [ F401929EE0CC92BFE7F15161CA535383 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

13:43:07.0502 3048  Apple Mobile Device - ok

13:43:07.0567 3048  [ C484F8CEB1717C540242531DB7845C4E ] arc             C:\Windows\system32\drivers\arc.sys

13:43:07.0576 3048  arc - ok

13:43:07.0581 3048  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\drivers\arcsas.sys

13:43:07.0590 3048  arcsas - ok

13:43:07.0601 3048  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys

13:43:07.0635 3048  AsyncMac - ok

13:43:07.0643 3048  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi           C:\Windows\system32\drivers\atapi.sys

13:43:07.0653 3048  atapi - ok

13:43:07.0743 3048  [ B2931C83CFB12A3223A47B180473AE1A ] athr            C:\Windows\system32\DRIVERS\athrx.sys

13:43:07.0794 3048  athr - ok

13:43:07.0847 3048  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll

13:43:07.0908 3048  AudioEndpointBuilder - ok

13:43:07.0918 3048  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll

13:43:07.0958 3048  AudioSrv - ok

13:43:07.0987 3048  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll

13:43:08.0051 3048  AxInstSV - ok

13:43:08.0101 3048  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv         C:\Windows\system32\drivers\bxvbda.sys

13:43:08.0133 3048  b06bdrv - ok

13:43:08.0171 3048  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys

13:43:08.0203 3048  b57nd60a - ok

13:43:08.0247 3048  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll

13:43:08.0268 3048  BDESVC - ok

13:43:08.0282 3048  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys

13:43:08.0330 3048  Beep - ok

13:43:08.0381 3048  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE             C:\Windows\System32\bfe.dll

13:43:08.0440 3048  BFE - ok

13:43:08.0487 3048  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\system32\qmgr.dll

13:43:08.0529 3048  BITS - ok

13:43:08.0571 3048  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\drivers\blbdrive.sys

13:43:08.0605 3048  blbdrive - ok

13:43:08.0701 3048  [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe

13:43:08.0719 3048  Bonjour Service - ok

13:43:08.0764 3048  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys

13:43:08.0800 3048  bowser - ok

13:43:08.0817 3048  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys

13:43:08.0831 3048  BrFiltLo - ok

13:43:08.0849 3048  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys

13:43:08.0863 3048  BrFiltUp - ok

13:43:08.0926 3048  [ 5C2F352A4E961D72518261257AAE204B ] BridgeMP        C:\Windows\system32\DRIVERS\bridge.sys

13:43:08.0971 3048  BridgeMP - ok

13:43:09.0006 3048  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser         C:\Windows\System32\browser.dll

13:43:09.0016 3048  Browser - ok

13:43:09.0040 3048  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid         C:\Windows\System32\Drivers\Brserid.sys

13:43:09.0069 3048  Brserid - ok

13:43:09.0074 3048  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys

13:43:09.0098 3048  BrSerWdm - ok

13:43:09.0116 3048  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys

13:43:09.0145 3048  BrUsbMdm - ok

13:43:09.0149 3048  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys

13:43:09.0166 3048  BrUsbSer - ok

13:43:09.0211 3048  [ 2347ABBD13BADA65826FDAB4CAAFE357 ] BtFilter        C:\Windows\system32\DRIVERS\btfilter.sys

13:43:09.0228 3048  BtFilter - ok

13:43:09.0242 3048  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys

13:43:09.0279 3048  BTHMODEM - ok

13:43:09.0319 3048  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv         C:\Windows\system32\bthserv.dll

13:43:09.0366 3048  bthserv - ok

13:43:09.0424 3048  catchme - ok

13:43:09.0447 3048  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys

13:43:09.0500 3048  cdfs - ok

13:43:09.0522 3048  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys

13:43:09.0546 3048  cdrom - ok

13:43:09.0592 3048  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc     C:\Windows\System32\certprop.dll

13:43:09.0642 3048  CertPropSvc - ok

13:43:09.0755 3048  [ 41E7C4FA6491747402CFCA77CC1C7AAB ] cfWiMAXService  C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe

13:43:09.0765 3048  cfWiMAXService - ok

13:43:09.0807 3048  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\drivers\circlass.sys

13:43:09.0832 3048  circlass - ok

13:43:09.0867 3048  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys

13:43:09.0880 3048  CLFS - ok

13:43:10.0019 3048  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

13:43:10.0026 3048  clr_optimization_v2.0.50727_32 - ok

13:43:10.0125 3048  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

13:43:10.0133 3048  clr_optimization_v2.0.50727_64 - ok

13:43:10.0293 3048  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

13:43:10.0305 3048  clr_optimization_v4.0.30319_32 - ok

13:43:10.0474 3048  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

13:43:10.0488 3048  clr_optimization_v4.0.30319_64 - ok

13:43:10.0531 3048  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\drivers\CmBatt.sys

13:43:10.0564 3048  CmBatt - ok

13:43:10.0569 3048  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys

13:43:10.0578 3048  cmdide - ok

13:43:10.0625 3048  [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG             C:\Windows\system32\Drivers\cng.sys

13:43:10.0652 3048  CNG - ok

13:43:10.0756 3048  [ 66847C979893A11CFCC2280E772D7EA1 ] CnxtHdAudService C:\Windows\system32\drivers\CHDRT64.sys

13:43:10.0792 3048  CnxtHdAudService - ok

13:43:10.0822 3048  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys

13:43:10.0832 3048  Compbatt - ok

13:43:10.0849 3048  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys

13:43:10.0882 3048  CompositeBus - ok

13:43:10.0902 3048  COMSysApp - ok

13:43:10.0927 3048  [ CAB0EEAF5295FC96DDD3E19DCE27E131 ] ConfigFree Service C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

13:43:10.0936 3048  ConfigFree Service - ok

13:43:10.0940 3048  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk         C:\Windows\system32\drivers\crcdisk.sys

13:43:10.0950 3048  crcdisk - ok

13:43:10.0997 3048  [ D8129C49798CBBFB2E4351D4B7B8EF9C ] CryptSvc        C:\Windows\system32\cryptsvc.dll

13:43:11.0009 3048  CryptSvc - ok

13:43:11.0048 3048  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll

13:43:11.0093 3048  DcomLaunch - ok

13:43:11.0127 3048  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc       C:\Windows\System32\defragsvc.dll

13:43:11.0189 3048  defragsvc - ok

13:43:11.0227 3048  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys

13:43:11.0271 3048  DfsC - ok

13:43:11.0313 3048  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll

13:43:11.0345 3048  Dhcp - ok

13:43:11.0350 3048  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys

13:43:11.0398 3048  discache - ok

13:43:11.0442 3048  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\drivers\disk.sys

13:43:11.0451 3048  Disk - ok

13:43:11.0475 3048  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll

13:43:11.0504 3048  Dnscache - ok

13:43:11.0523 3048  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc         C:\Windows\System32\dot3svc.dll

13:43:11.0582 3048  dot3svc - ok

13:43:11.0607 3048  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS             C:\Windows\system32\dps.dll

13:43:11.0663 3048  DPS - ok

13:43:11.0700 3048  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys

13:43:11.0728 3048  drmkaud - ok

13:43:11.0783 3048  [ AF2E16242AA723F68F461B6EAE2EAD3D ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys

13:43:11.0808 3048  DXGKrnl - ok

13:43:11.0860 3048  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost         C:\Windows\System32\eapsvc.dll

13:43:11.0899 3048  EapHost - ok

13:43:12.0026 3048  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv           C:\Windows\system32\drivers\evbda.sys

13:43:12.0076 3048  ebdrv - ok

13:43:12.0115 3048  [ C118A82CD78818C29AB228366EBF81C3 ] EFS             C:\Windows\System32\lsass.exe

13:43:12.0128 3048  EFS - ok

13:43:12.0267 3048  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe

13:43:12.0318 3048  ehRecvr - ok

13:43:12.0359 3048  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched         C:\Windows\ehome\ehsched.exe

13:43:12.0407 3048  ehSched - ok

13:43:12.0500 3048  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor         C:\Windows\system32\drivers\elxstor.sys

13:43:12.0521 3048  elxstor - ok

13:43:12.0525 3048  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys

13:43:12.0552 3048  ErrDev - ok

13:43:12.0605 3048  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem     C:\Windows\system32\es.dll

13:43:12.0644 3048  EventSystem - ok

13:43:12.0657 3048  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat           C:\Windows\system32\drivers\exfat.sys

13:43:12.0691 3048  exfat - ok

13:43:12.0707 3048  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat         C:\Windows\system32\drivers\fastfat.sys

13:43:12.0757 3048  fastfat - ok

13:43:12.0797 3048  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax             C:\Windows\system32\fxssvc.exe

13:43:12.0837 3048  Fax - ok

13:43:12.0841 3048  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc             C:\Windows\system32\drivers\fdc.sys

13:43:12.0867 3048  fdc - ok

13:43:12.0908 3048  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost         C:\Windows\system32\fdPHost.dll

13:43:12.0953 3048  fdPHost - ok

13:43:12.0959 3048  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll

13:43:13.0014 3048  FDResPub - ok

13:43:13.0054 3048  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys

13:43:13.0066 3048  FileInfo - ok

13:43:13.0071 3048  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys

13:43:13.0119 3048  Filetrace - ok

13:43:13.0123 3048  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys

13:43:13.0145 3048  flpydisk - ok

13:43:13.0185 3048  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys

13:43:13.0199 3048  FltMgr - ok

13:43:13.0257 3048  [ C4C183E6551084039EC862DA1C945E3D ] FontCache       C:\Windows\system32\FntCache.dll

13:43:13.0284 3048  FontCache - ok

13:43:13.0320 3048  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

13:43:13.0327 3048  FontCache3.0.0.0 - ok

13:43:13.0342 3048  [ D43703496149971890703B4B1B723EAC ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys

13:43:13.0352 3048  FsDepends - ok

13:43:13.0382 3048  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys

13:43:13.0390 3048  Fs_Rec - ok

13:43:13.0427 3048  [ 8F6322049018354F45F05A2FD2D4E5E0 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys

13:43:13.0442 3048  fvevol - ok

13:43:13.0488 3048  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys

13:43:13.0497 3048  gagp30kx - ok

13:43:13.0531 3048  [ E403AACF8C7BB11375122D2464560311 ] GEARAspiWDM     C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

13:43:13.0538 3048  GEARAspiWDM - ok

13:43:13.0586 3048  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc           C:\Windows\System32\gpsvc.dll

13:43:13.0628 3048  gpsvc - ok

13:43:13.0641 3048  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys

13:43:13.0670 3048  hcw85cir - ok

13:43:13.0699 3048  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys

13:43:13.0734 3048  HdAudAddService - ok

13:43:13.0754 3048  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys

13:43:13.0792 3048  HDAudBus - ok

13:43:13.0796 3048  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt         C:\Windows\system32\drivers\HidBatt.sys

13:43:13.0817 3048  HidBatt - ok

13:43:13.0821 3048  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\drivers\hidbth.sys

13:43:13.0848 3048  HidBth - ok

13:43:13.0883 3048  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr           C:\Windows\system32\drivers\hidir.sys

13:43:13.0895 3048  HidIr - ok

13:43:13.0929 3048  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv         C:\Windows\System32\hidserv.dll

13:43:13.0982 3048  hidserv - ok

13:43:14.0012 3048  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys

13:43:14.0023 3048  HidUsb - ok

13:43:14.0044 3048  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll

13:43:14.0101 3048  hkmsvc - ok

13:43:14.0134 3048  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll

13:43:14.0171 3048  HomeGroupListener - ok

13:43:14.0203 3048  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll

13:43:14.0230 3048  HomeGroupProvider - ok

13:43:14.0253 3048  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys

13:43:14.0262 3048  HpSAMD - ok

13:43:14.0288 3048  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys

13:43:14.0342 3048  HTTP - ok

13:43:14.0361 3048  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys

13:43:14.0369 3048  hwpolicy - ok

13:43:14.0382 3048  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys

13:43:14.0392 3048  i8042prt - ok

13:43:14.0435 3048  [ D469B77687E12FE43E344806740B624D ] iaStor          C:\Windows\system32\DRIVERS\iaStor.sys

13:43:14.0448 3048  iaStor - ok

13:43:14.0482 3048  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys

13:43:14.0497 3048  iaStorV - ok

13:43:14.0569 3048  [ DAF66902F08796F9C694901660E5A64A ] IDriverT        C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

13:43:14.0606 3048  IDriverT ( UnsignedFile.Multi.Generic ) - warning

13:43:14.0606 3048  IDriverT - detected UnsignedFile.Multi.Generic (1)

13:43:14.0681 3048  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

13:43:14.0702 3048  idsvc - ok

13:43:15.0010 3048  [ 370C2A8629B30F910F740387795DDC6F ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys

13:43:15.0194 3048  igfx - ok

13:43:15.0225 3048  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp           C:\Windows\system32\drivers\iirsp.sys

13:43:15.0236 3048  iirsp - ok

13:43:15.0274 3048  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll

13:43:15.0315 3048  IKEEXT - ok

13:43:15.0363 3048  [ FC727061C0F47C8059E88E05D5C8E381 ] IntcDAud        C:\Windows\system32\DRIVERS\IntcDAud.sys

13:43:15.0388 3048  IntcDAud - ok

13:43:15.0415 3048  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys

13:43:15.0426 3048  intelide - ok

13:43:15.0441 3048  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys

13:43:15.0466 3048  intelppm - ok

13:43:15.0488 3048  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum       C:\Windows\system32\ipbusenum.dll

13:43:15.0547 3048  IPBusEnum - ok

13:43:15.0551 3048  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys

13:43:15.0590 3048  IpFilterDriver - ok

13:43:15.0636 3048  [ 08C2957BB30058E663720C5606885653 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll

13:43:15.0670 3048  iphlpsvc - ok

13:43:15.0697 3048  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys

13:43:15.0722 3048  IPMIDRV - ok

13:43:15.0731 3048  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT           C:\Windows\system32\drivers\ipnat.sys

13:43:15.0781 3048  IPNAT - ok

13:43:15.0837 3048  [ A9AB99EE7D39725EAFEC82732D2B3271 ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe

13:43:15.0859 3048  iPod Service - ok

13:43:15.0890 3048  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys

13:43:15.0918 3048  IRENUM - ok

13:43:15.0924 3048  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys

13:43:15.0935 3048  isapnp - ok

13:43:15.0976 3048  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys

13:43:15.0991 3048  iScsiPrt - ok

13:43:16.0009 3048  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys

13:43:16.0022 3048  kbdclass - ok

13:43:16.0033 3048  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys

13:43:16.0057 3048  kbdhid - ok

13:43:16.0081 3048  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe

13:43:16.0091 3048  KeyIso - ok

13:43:16.0123 3048  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys

13:43:16.0132 3048  KSecDD - ok

13:43:16.0145 3048  [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys

13:43:16.0155 3048  KSecPkg - ok

13:43:16.0195 3048  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys

13:43:16.0242 3048  ksthunk - ok

13:43:16.0277 3048  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm           C:\Windows\system32\msdtckrm.dll

13:43:16.0335 3048  KtmRm - ok

13:43:16.0393 3048  [ EBED8B3FF4A823C1A6EEBEED7B29353F ] L1C             C:\Windows\system32\DRIVERS\L1C62x64.sys

13:43:16.0401 3048  L1C - ok

13:43:16.0450 3048  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\System32\srvsvc.dll

13:43:16.0497 3048  LanmanServer - ok

13:43:16.0515 3048  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll

13:43:16.0564 3048  LanmanWorkstation - ok

13:43:16.0607 3048  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys

13:43:16.0658 3048  lltdio - ok

13:43:16.0688 3048  [ C1185803384AB3FEED115F79F109427F ] lltdsvc         C:\Windows\System32\lltdsvc.dll

13:43:16.0741 3048  lltdsvc - ok

13:43:16.0747 3048  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts         C:\Windows\System32\lmhsvc.dll

13:43:16.0797 3048  lmhosts - ok

13:43:16.0879 3048  [ 2ED1786B7542CDA261029F6B526EDF44 ] LMS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

13:43:16.0891 3048  LMS - ok

13:43:16.0921 3048  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys

13:43:16.0930 3048  LSI_FC - ok

13:43:16.0951 3048  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS         C:\Windows\system32\drivers\lsi_sas.sys

13:43:16.0965 3048  LSI_SAS - ok

13:43:16.0970 3048  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys

13:43:16.0979 3048  LSI_SAS2 - ok

13:43:16.0997 3048  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys

13:43:17.0006 3048  LSI_SCSI - ok

13:43:17.0020 3048  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv           C:\Windows\system32\drivers\luafv.sys

13:43:17.0057 3048  luafv - ok

13:43:17.0118 3048  [ DE585D1D266805E5EEDAE911FDD16F38 ] ManyCam         C:\Windows\system32\DRIVERS\mcvidrv_x64.sys

13:43:17.0144 3048  ManyCam - ok

13:43:17.0183 3048  [ 2E7FFDEF8BAFD04CBB517507B821E878 ] mcaudrv_simple  C:\Windows\system32\drivers\mcaudrv_x64.sys

13:43:17.0209 3048  mcaudrv_simple - ok

13:43:17.0248 3048  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll

13:43:17.0301 3048  Mcx2Svc - ok

13:43:17.0333 3048  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas         C:\Windows\system32\drivers\megasas.sys

13:43:17.0343 3048  megasas - ok

13:43:17.0354 3048  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys

13:43:17.0368 3048  MegaSR - ok

13:43:17.0408 3048  [ A6518DCC42F7A6E999BB3BEA8FD87567 ] MEIx64          C:\Windows\system32\DRIVERS\HECIx64.sys

13:43:17.0416 3048  MEIx64 - ok

13:43:17.0587 3048  Microsoft SharePoint Workspace Audit Service - ok

13:43:17.0614 3048  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS           C:\Windows\system32\mmcss.dll

13:43:17.0684 3048  MMCSS - ok

13:43:17.0720 3048  [ 800BA92F7010378B09F9ED9270F07137 ] Modem           C:\Windows\system32\drivers\modem.sys

13:43:17.0764 3048  Modem - ok

13:43:17.0778 3048  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor         C:\Windows\system32\DRIVERS\monitor.sys

13:43:17.0810 3048  monitor - ok

13:43:17.0828 3048  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys

13:43:17.0836 3048  mouclass - ok

13:43:17.0842 3048  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys

13:43:17.0872 3048  mouhid - ok

13:43:17.0914 3048  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys

13:43:17.0924 3048  mountmgr - ok

13:43:18.0019 3048  [ E6DB6C61739E18906DC2C4191F6EDEA2 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

13:43:18.0029 3048  MozillaMaintenance - ok

13:43:18.0051 3048  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys

13:43:18.0062 3048  mpio - ok

13:43:18.0075 3048  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys

13:43:18.0125 3048  mpsdrv - ok

13:43:18.0172 3048  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll

13:43:18.0231 3048  MpsSvc - ok

13:43:18.0256 3048  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys

13:43:18.0294 3048  MRxDAV - ok

13:43:18.0320 3048  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys

13:43:18.0368 3048  mrxsmb - ok

13:43:18.0401 3048  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys

13:43:18.0419 3048  mrxsmb10 - ok

13:43:18.0442 3048  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys

13:43:18.0452 3048  mrxsmb20 - ok

13:43:18.0463 3048  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\DRIVERS\msahci.sys

13:43:18.0472 3048  msahci - ok

13:43:18.0477 3048  [ DB801A638D011B9633829EB6F663C900 ] msdsm           C:\Windows\system32\drivers\msdsm.sys

13:43:18.0487 3048  msdsm - ok

13:43:18.0506 3048  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC           C:\Windows\System32\msdtc.exe

13:43:18.0518 3048  MSDTC - ok

13:43:18.0537 3048  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys

13:43:18.0585 3048  Msfs - ok

13:43:18.0589 3048  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys

13:43:18.0633 3048  mshidkmdf - ok

13:43:18.0637 3048  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys

13:43:18.0645 3048  msisadrv - ok

13:43:18.0685 3048  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll

13:43:18.0734 3048  MSiSCSI - ok

13:43:18.0737 3048  msiserver - ok

13:43:18.0787 3048  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys

13:43:18.0836 3048  MSKSSRV - ok

13:43:18.0840 3048  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys

13:43:18.0874 3048  MSPCLOCK - ok

13:43:18.0878 3048  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys

13:43:18.0917 3048  MSPQM - ok

13:43:18.0944 3048  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys

13:43:18.0957 3048  MsRPC - ok

13:43:18.0966 3048  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys

13:43:18.0975 3048  mssmbios - ok

13:43:18.0995 3048  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys

13:43:19.0050 3048  MSTEE - ok

13:43:19.0074 3048  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys

13:43:19.0105 3048  MTConfig - ok

13:43:19.0111 3048  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup             C:\Windows\system32\Drivers\mup.sys

13:43:19.0123 3048  Mup - ok

13:43:19.0163 3048  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll

13:43:19.0217 3048  napagent - ok

13:43:19.0269 3048  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys

13:43:19.0304 3048  NativeWifiP - ok

13:43:19.0364 3048  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\Windows\system32\drivers\ndis.sys

13:43:19.0387 3048  NDIS - ok

13:43:19.0426 3048  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys

13:43:19.0476 3048  NdisCap - ok

13:43:19.0494 3048  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys

13:43:19.0526 3048  NdisTapi - ok

13:43:19.0541 3048  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys

13:43:19.0572 3048  Ndisuio - ok

13:43:19.0577 3048  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys

13:43:19.0631 3048  NdisWan - ok

13:43:19.0656 3048  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys

13:43:19.0706 3048  NDProxy - ok

13:43:19.0724 3048  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys

13:43:19.0772 3048  NetBIOS - ok

13:43:19.0808 3048  [ 09594D1089C523423B32A4229263F068 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys

13:43:19.0841 3048  NetBT - ok

13:43:19.0860 3048  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe

13:43:19.0870 3048  Netlogon - ok

13:43:19.0925 3048  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll

13:43:19.0961 3048  Netman - ok

13:43:19.0985 3048  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll

13:43:20.0044 3048  netprofm - ok

13:43:20.0082 3048  [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

13:43:20.0090 3048  NetTcpPortSharing - ok

13:43:20.0129 3048  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960         C:\Windows\system32\drivers\nfrd960.sys

13:43:20.0138 3048  nfrd960 - ok

13:43:20.0174 3048  [ 8AD77806D336673F270DB31645267293 ] NlaSvc          C:\Windows\System32\nlasvc.dll

13:43:20.0209 3048  NlaSvc - ok

13:43:20.0214 3048  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys

13:43:20.0250 3048  Npfs - ok

13:43:20.0281 3048  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi             C:\Windows\system32\nsisvc.dll

13:43:20.0334 3048  nsi - ok

13:43:20.0364 3048  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys

13:43:20.0399 3048  nsiproxy - ok

13:43:20.0466 3048  [ B98F8C6E31CD07B2E6F71F7F648E38C0 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys

13:43:20.0501 3048  Ntfs - ok

13:43:20.0519 3048  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys

13:43:20.0551 3048  Null - ok

13:43:20.0568 3048  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys

13:43:20.0578 3048  nvraid - ok

13:43:20.0593 3048  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys

13:43:20.0603 3048  nvstor - ok

13:43:20.0608 3048  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys

13:43:20.0618 3048  nv_agp - ok

13:43:20.0631 3048  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys

13:43:20.0642 3048  ohci1394 - ok

13:43:20.0743 3048  [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

13:43:20.0752 3048  ose - ok

13:43:20.0924 3048  [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc         C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

13:43:21.0007 3048  osppsvc - ok

13:43:21.0060 3048  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll

13:43:21.0089 3048  p2pimsvc - ok

13:43:21.0114 3048  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll

13:43:21.0141 3048  p2psvc - ok

13:43:21.0174 3048  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport         C:\Windows\system32\drivers\parport.sys

13:43:21.0185 3048  Parport - ok

13:43:21.0218 3048  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr         C:\Windows\system32\drivers\partmgr.sys

13:43:21.0227 3048  partmgr - ok

13:43:21.0239 3048  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll

13:43:21.0272 3048  PcaSvc - ok

13:43:21.0279 3048  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci             C:\Windows\system32\drivers\pci.sys

13:43:21.0290 3048  pci - ok

13:43:21.0315 3048  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\DRIVERS\pciide.sys

13:43:21.0324 3048  pciide - ok

13:43:21.0344 3048  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys

13:43:21.0356 3048  pcmcia - ok

13:43:21.0380 3048  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw             C:\Windows\system32\drivers\pcw.sys

13:43:21.0388 3048  pcw - ok

13:43:21.0400 3048  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys

13:43:21.0460 3048  PEAUTH - ok

13:43:21.0659 3048  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe

13:43:21.0689 3048  PerfHost - ok

13:43:21.0732 3048  [ 91111CEBBDE8015E822C46120ED9537C ] PGEffect        C:\Windows\system32\DRIVERS\pgeffect.sys

13:43:21.0739 3048  PGEffect - ok

13:43:21.0804 3048  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla             C:\Windows\system32\pla.dll

13:43:21.0858 3048  pla - ok

13:43:21.0906 3048  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll

13:43:21.0936 3048  PlugPlay - ok

13:43:21.0975 3048  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll

13:43:22.0009 3048  PNRPAutoReg - ok

13:43:22.0018 3048  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll

13:43:22.0031 3048  PNRPsvc - ok

13:43:22.0068 3048  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll

13:43:22.0122 3048  PolicyAgent - ok

13:43:22.0160 3048  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power           C:\Windows\system32\umpo.dll

13:43:22.0206 3048  Power - ok

13:43:22.0258 3048  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys

13:43:22.0307 3048  PptpMiniport - ok

13:43:22.0328 3048  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor       C:\Windows\system32\drivers\processr.sys

13:43:22.0352 3048  Processor - ok

13:43:22.0389 3048  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc         C:\Windows\system32\profsvc.dll

13:43:22.0419 3048  ProfSvc - ok

13:43:22.0438 3048  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe

13:43:22.0447 3048  ProtectedStorage - ok

13:43:22.0483 3048  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys

13:43:22.0534 3048  Psched - ok

13:43:22.0576 3048  [ C8FCB4899F8B70CC34E0D9876A80963C ] QIOMem          C:\Windows\system32\drivers\QIOMem.sys

13:43:22.0615 3048  QIOMem - ok

13:43:22.0686 3048  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\drivers\ql2300.sys

13:43:22.0717 3048  ql2300 - ok

13:43:22.0723 3048  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys

13:43:22.0733 3048  ql40xx - ok

13:43:22.0764 3048  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE           C:\Windows\system32\qwave.dll

13:43:22.0781 3048  QWAVE - ok

13:43:22.0786 3048  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys

13:43:22.0813 3048  QWAVEdrv - ok

13:43:22.0831 3048  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys

13:43:22.0882 3048  RasAcd - ok

13:43:22.0928 3048  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys

13:43:22.0968 3048  RasAgileVpn - ok

13:43:22.0999 3048  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto         C:\Windows\System32\rasauto.dll

13:43:23.0058 3048  RasAuto - ok

13:43:23.0085 3048  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys

13:43:23.0136 3048  Rasl2tp - ok

13:43:23.0160 3048  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll

13:43:23.0199 3048  RasMan - ok

13:43:23.0218 3048  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys

13:43:23.0267 3048  RasPppoe - ok

13:43:23.0287 3048  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys

13:43:23.0323 3048  RasSstp - ok

13:43:23.0344 3048  [ 77F665941019A1594D887A74F301FA2F ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys

13:43:23.0437 3048  rdbss - ok

13:43:23.0443 3048  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\drivers\rdpbus.sys

13:43:23.0461 3048  rdpbus - ok

13:43:23.0467 3048  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys

13:43:23.0499 3048  RDPCDD - ok

13:43:23.0522 3048  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys

13:43:23.0555 3048  RDPENCDD - ok

13:43:23.0561 3048  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys

13:43:23.0618 3048  RDPREFMP - ok

13:43:23.0655 3048  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys

13:43:23.0679 3048  RDPWD - ok

13:43:23.0718 3048  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys

13:43:23.0729 3048  rdyboost - ok

13:43:23.0752 3048  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll

13:43:23.0798 3048  RemoteAccess - ok

13:43:23.0837 3048  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll

13:43:23.0871 3048  RemoteRegistry - ok

13:43:23.0886 3048  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll

13:43:23.0942 3048  RpcEptMapper - ok

13:43:23.0971 3048  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe

13:43:23.0981 3048  RpcLocator - ok

13:43:24.0003 3048  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs           C:\Windows\system32\rpcss.dll

13:43:24.0042 3048  RpcSs - ok

13:43:24.0066 3048  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys

13:43:24.0120 3048  rspndr - ok

13:43:24.0190 3048  [ 135A64530D7699AD48F29D73A658DD11 ] RSUSBSTOR       C:\Windows\system32\Drivers\RtsUStor.sys

13:43:24.0200 3048  RSUSBSTOR - ok

13:43:24.0223 3048  [ E5DC911D0FEB72CAFF2BBDD6E7C3672F ] RSUSBVSTOR      C:\Windows\system32\Drivers\RTSUVSTOR.sys

13:43:24.0235 3048  RSUSBVSTOR - ok

13:43:24.0260 3048  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs           C:\Windows\system32\lsass.exe

13:43:24.0269 3048  SamSs - ok

13:43:24.0304 3048  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys

13:43:24.0314 3048  sbp2port - ok

13:43:24.0345 3048  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll

13:43:24.0395 3048  SCardSvr - ok

13:43:24.0400 3048  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys

13:43:24.0448 3048  scfilter - ok

13:43:24.0492 3048  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll

13:43:24.0543 3048  Schedule - ok

13:43:24.0570 3048  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc     C:\Windows\System32\certprop.dll

13:43:24.0604 3048  SCPolicySvc - ok

13:43:24.0638 3048  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll

13:43:24.0650 3048  SDRSVC - ok

13:43:24.0687 3048  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys

13:43:24.0719 3048  secdrv - ok

13:43:24.0732 3048  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll

13:43:24.0765 3048  seclogon - ok

13:43:24.0774 3048  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\system32\sens.dll

13:43:24.0822 3048  SENS - ok

13:43:24.0852 3048  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll

13:43:24.0884 3048  SensrSvc - ok

13:43:24.0920 3048  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum         C:\Windows\system32\drivers\serenum.sys

13:43:24.0953 3048  Serenum - ok

13:43:24.0981 3048  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\drivers\serial.sys

13:43:25.0016 3048  Serial - ok

13:43:25.0020 3048  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\drivers\sermouse.sys

13:43:25.0043 3048  sermouse - ok

13:43:25.0079 3048  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll

13:43:25.0115 3048  SessionEnv - ok

13:43:25.0120 3048  [ A554811BCD09279536440C964AE35BBF ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys

13:43:25.0133 3048  sffdisk - ok

13:43:25.0168 3048  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys

13:43:25.0183 3048  sffp_mmc - ok

13:43:25.0188 3048  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys

13:43:25.0217 3048  sffp_sd - ok

13:43:25.0223 3048  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy         C:\Windows\system32\drivers\sfloppy.sys

13:43:25.0237 3048  sfloppy - ok

13:43:25.0281 3048  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll

13:43:25.0319 3048  SharedAccess - ok

13:43:25.0353 3048  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll

13:43:25.0390 3048  ShellHWDetection - ok

13:43:25.0415 3048  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys

13:43:25.0424 3048  SiSRaid2 - ok

13:43:25.0443 3048  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys

13:43:25.0452 3048  SiSRaid4 - ok

13:43:25.0528 3048  [ 3E587DBBDFF938DDE5D4CE4047BE9041 ] SkypeUpdate     C:\Program Files (x86)\Skype\Updater\Updater.exe

13:43:25.0540 3048  SkypeUpdate - ok

13:43:25.0546 3048  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb             C:\Windows\system32\DRIVERS\smb.sys

13:43:25.0602 3048  Smb - ok

13:43:25.0646 3048  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe

13:43:25.0674 3048  SNMPTRAP - ok

13:43:25.0710 3048  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr           C:\Windows\system32\drivers\spldr.sys

13:43:25.0718 3048  spldr - ok

13:43:25.0752 3048  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler         C:\Windows\System32\spoolsv.exe

13:43:25.0769 3048  Spooler - ok

13:43:25.0860 3048  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe

13:43:25.0953 3048  sppsvc - ok

13:43:25.0958 3048  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify     C:\Windows\system32\sppuinotify.dll

13:43:26.0006 3048  sppuinotify - ok

13:43:26.0051 3048  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv             C:\Windows\system32\DRIVERS\srv.sys

13:43:26.0101 3048  srv - ok

13:43:26.0109 3048  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys

13:43:26.0123 3048  srv2 - ok

13:43:26.0151 3048  [ 0C4540311E11664B245A263E1154CEF8 ] SrvHsfHDA       C:\Windows\system32\DRIVERS\VSTAZL6.SYS

13:43:26.0163 3048  SrvHsfHDA - ok

13:43:26.0213 3048  [ 02071D207A9858FBE3A48CBFD59C4A04 ] SrvHsfV92       C:\Windows\system32\DRIVERS\VSTDPV6.SYS

13:43:26.0258 3048  SrvHsfV92 - ok

13:43:26.0293 3048  [ 18E40C245DBFAF36FD0134A7EF2DF396 ] SrvHsfWinac     C:\Windows\system32\DRIVERS\VSTCNXT6.SYS

13:43:26.0311 3048  SrvHsfWinac - ok

13:43:26.0324 3048  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys

13:43:26.0347 3048  srvnet - ok

13:43:26.0389 3048  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll

13:43:26.0439 3048  SSDPSRV - ok

13:43:26.0456 3048  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc         C:\Windows\system32\sstpsvc.dll

13:43:26.0491 3048  SstpSvc - ok

13:43:26.0524 3048  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\drivers\stexstor.sys

13:43:26.0533 3048  stexstor - ok

13:43:26.0572 3048  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll

13:43:26.0593 3048  stisvc - ok

13:43:26.0598 3048  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\drivers\swenum.sys

13:43:26.0606 3048  swenum - ok

13:43:26.0641 3048  [ E08E46FDD841B7184194011CA1955A0B ] swprv           C:\Windows\System32\swprv.dll

13:43:26.0702 3048  swprv - ok

13:43:26.0763 3048  [ F5B46DF59FEAA48A442AED7EEB754D4B ] SynTP           C:\Windows\system32\DRIVERS\SynTP.sys

13:43:26.0792 3048  SynTP - ok

13:43:26.0861 3048  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain         C:\Windows\system32\sysmain.dll

13:43:26.0910 3048  SysMain - ok

13:43:26.0942 3048  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll

13:43:26.0958 3048  TabletInputService - ok

13:43:27.0008 3048  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv         C:\Windows\System32\tapisrv.dll

13:43:27.0052 3048  TapiSrv - ok

13:43:27.0067 3048  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS             C:\Windows\System32\tbssvc.dll

13:43:27.0102 3048  TBS - ok

13:43:27.0163 3048  [ 9849EA3843A2ADBDD1497E97A85D8CAE ] Tcpip           C:\Windows\system32\drivers\tcpip.sys

13:43:27.0200 3048  Tcpip - ok

13:43:27.0241 3048  [ 9849EA3843A2ADBDD1497E97A85D8CAE ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys

13:43:27.0278 3048  TCPIP6 - ok

13:43:27.0308 3048  [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys

13:43:27.0329 3048  tcpipreg - ok

13:43:27.0381 3048  [ FD542B661BD22FA69CA789AD0AC58C29 ] tdcmdpst        C:\Windows\system32\DRIVERS\tdcmdpst.sys

13:43:27.0387 3048  tdcmdpst - ok

13:43:27.0427 3048  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys

13:43:27.0451 3048  TDPIPE - ok

13:43:27.0489 3048  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys

13:43:27.0499 3048  TDTCP - ok

13:43:27.0505 3048  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys

13:43:27.0540 3048  tdx - ok

13:43:27.0591 3048  [ 1B709733A04DCC41A63F9CD1F76A4EBE ] TemproMonitoringService C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe

13:43:27.0599 3048  TemproMonitoringService - ok

13:43:27.0616 3048  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\drivers\termdd.sys

13:43:27.0627 3048  TermDD - ok

13:43:27.0665 3048  [ 2E648163254233755035B46DD7B89123 ] TermService     C:\Windows\System32\termsrv.dll

13:43:27.0705 3048  TermService - ok

13:43:27.0716 3048  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll

13:43:27.0732 3048  Themes - ok

13:43:27.0747 3048  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER     C:\Windows\system32\mmcss.dll

13:43:27.0784 3048  THREADORDER - ok

13:43:27.0885 3048  [ F120967184A27E927052E8DDBB727851 ] TMachInfo       C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

13:43:27.0892 3048  TMachInfo - ok

13:43:27.0939 3048  [ 8E2C799D3476EAC32C3BA0DF7CE6AF19 ] TODDSrv         C:\Windows\system32\TODDSrv.exe

13:43:27.0949 3048  TODDSrv - ok

13:43:28.0023 3048  [ CDC97FA5C42B07FB0D4600E17C32F582 ] TosCoSrv        C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

13:43:28.0036 3048  TosCoSrv - ok

13:43:28.0117 3048  [ 8F099BE5DB17D025E19652851399B9F1 ] TOSHIBA Bluetooth Service C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

13:43:28.0126 3048  TOSHIBA Bluetooth Service - ok

13:43:28.0199 3048  [ D0F868A67CB4D817A3F7ABEF8C42F49C ] TOSHIBA eco Utility Service C:\Program Files\TOSHIBA\TECO\TecoService.exe

13:43:28.0209 3048  TOSHIBA eco Utility Service - ok

13:43:28.0295 3048  [ EDB4B432DB13EA3D1EB2356310D33263 ] TOSHIBA HDD SSD Alert Service C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe

13:43:28.0303 3048  TOSHIBA HDD SSD Alert Service - ok

13:43:28.0319 3048  Tosrfcom - ok

13:43:28.0359 3048  [ F5E3AC4CBCD154EE80849B21887FD0B0 ] tosrfec         C:\Windows\system32\DRIVERS\tosrfec.sys

13:43:28.0365 3048  tosrfec - ok

13:43:28.0382 3048  [ 7A0048693F98460FF537BE31C741B927 ] Tosrfusb        C:\Windows\system32\DRIVERS\tosrfusb.sys

13:43:28.0389 3048  Tosrfusb - ok

13:43:28.0449 3048  [ 098B8A408C17E125A3D9A8E1166780C8 ] TPCHSrv         C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

13:43:28.0468 3048  TPCHSrv - ok

13:43:28.0491 3048  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll

13:43:28.0543 3048  TrkWks - ok

13:43:28.0598 3048  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe

13:43:28.0631 3048  TrustedInstaller - ok

13:43:28.0650 3048  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys

13:43:28.0688 3048  tssecsrv - ok

13:43:28.0710 3048  [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys

13:43:28.0740 3048  TsUsbFlt - ok

13:43:28.0743 3048  [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD         C:\Windows\system32\drivers\TsUsbGD.sys

13:43:28.0761 3048  TsUsbGD - ok

13:43:28.0789 3048  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys

13:43:28.0838 3048  tunnel - ok

13:43:28.0873 3048  [ 550B567F9364D8F7684C3FB3EA665A72 ] TVALZ           C:\Windows\system32\DRIVERS\TVALZ_O.SYS

13:43:28.0880 3048  TVALZ - ok

13:43:28.0931 3048  [ 9C7191F4B2E49BFF47A6C1144B5923FA ] TVALZFL         C:\Windows\system32\DRIVERS\TVALZFL.sys

13:43:28.0937 3048  TVALZFL - ok

13:43:28.0958 3048  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\drivers\uagp35.sys

13:43:28.0967 3048  uagp35 - ok

13:43:29.0001 3048  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys

13:43:29.0050 3048  udfs - ok

13:43:29.0094 3048  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect       C:\Windows\system32\UI0Detect.exe

13:43:29.0125 3048  UI0Detect - ok

13:43:29.0129 3048  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys

13:43:29.0139 3048  uliagpkx - ok

13:43:29.0191 3048  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus           C:\Windows\system32\DRIVERS\umbus.sys

13:43:29.0201 3048  umbus - ok

13:43:29.0205 3048  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\drivers\umpass.sys

13:43:29.0233 3048  UmPass - ok

13:43:29.0373 3048  [ 7E5E1603D0FF2D240AE70295C5C3FEFC ] UNS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

13:43:29.0418 3048  UNS - ok

13:43:29.0455 3048  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll

13:43:29.0514 3048  upnphost - ok

13:43:29.0562 3048  [ FB251567F41BC61988B26731DEC19E4B ] USBAAPL64       C:\Windows\system32\Drivers\usbaapl64.sys

13:43:29.0578 3048  USBAAPL64 - ok

13:43:29.0629 3048  [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys

13:43:29.0641 3048  usbaudio - ok

13:43:29.0661 3048  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys

13:43:29.0674 3048  usbccgp - ok

13:43:29.0679 3048  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys

13:43:29.0704 3048  usbcir - ok

13:43:29.0708 3048  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci         C:\Windows\system32\drivers\usbehci.sys

13:43:29.0717 3048  usbehci - ok

13:43:29.0746 3048  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\drivers\usbhub.sys

13:43:29.0774 3048  usbhub - ok

13:43:29.0778 3048  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci         C:\Windows\system32\drivers\usbohci.sys

13:43:29.0787 3048  usbohci - ok

13:43:29.0810 3048  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys

13:43:29.0824 3048  usbprint - ok

13:43:29.0853 3048  [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan         C:\Windows\system32\DRIVERS\usbscan.sys

13:43:29.0881 3048  usbscan - ok

13:43:29.0899 3048  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS

13:43:29.0927 3048  USBSTOR - ok

13:43:29.0933 3048  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys

13:43:29.0969 3048  usbuhci - ok

13:43:30.0009 3048  [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys

13:43:30.0036 3048  usbvideo - ok

13:43:30.0072 3048  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms           C:\Windows\System32\uxsms.dll

13:43:30.0119 3048  UxSms - ok

13:43:30.0137 3048  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe

13:43:30.0149 3048  VaultSvc - ok

13:43:30.0176 3048  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys

13:43:30.0184 3048  vdrvroot - ok

13:43:30.0208 3048  [ 8D6B481601D01A456E75C3210F1830BE ] vds             C:\Windows\System32\vds.exe

13:43:30.0250 3048  vds - ok

13:43:30.0265 3048  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys

13:43:30.0277 3048  vga - ok

13:43:30.0281 3048  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave         C:\Windows\System32\drivers\vga.sys

13:43:30.0326 3048  VgaSave - ok

13:43:30.0349 3048  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys

13:43:30.0360 3048  vhdmp - ok

13:43:30.0364 3048  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys

13:43:30.0372 3048  viaide - ok

13:43:30.0377 3048  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys

13:43:30.0386 3048  volmgr - ok

13:43:30.0400 3048  [ A255814907C89BE58B79EF2F189B843B ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys

13:43:30.0413 3048  volmgrx - ok

13:43:30.0428 3048  [ DF8126BD41180351A093A3AD2FC8903B ] volsnap         C:\Windows\system32\drivers\volsnap.sys

13:43:30.0441 3048  volsnap - ok

13:43:30.0460 3048  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid         C:\Windows\system32\drivers\vsmraid.sys

13:43:30.0471 3048  vsmraid - ok

13:43:30.0523 3048  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS             C:\Windows\system32\vssvc.exe

13:43:30.0593 3048  VSS - ok

13:43:30.0633 3048  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys

13:43:30.0645 3048  vwifibus - ok

13:43:30.0663 3048  [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys

13:43:30.0698 3048  vwififlt - ok

13:43:30.0727 3048  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time         C:\Windows\system32\w32time.dll

13:43:30.0777 3048  W32Time - ok

13:43:30.0812 3048  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\drivers\wacompen.sys

13:43:30.0836 3048  WacomPen - ok

13:43:30.0857 3048  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys

13:43:30.0890 3048  WANARP - ok

13:43:30.0905 3048  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys

13:43:30.0937 3048  Wanarpv6 - ok

13:43:30.0983 3048  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe

13:43:31.0021 3048  wbengine - ok

13:43:31.0030 3048  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll

13:43:31.0049 3048  WbioSrvc - ok

13:43:31.0078 3048  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc         C:\Windows\System32\wcncsvc.dll

13:43:31.0118 3048  wcncsvc - ok

13:43:31.0147 3048  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll

13:43:31.0158 3048  WcsPlugInService - ok

13:43:31.0194 3048  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\drivers\wd.sys

13:43:31.0202 3048  Wd - ok

13:43:31.0243 3048  [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys

13:43:31.0265 3048  Wdf01000 - ok

13:43:31.0290 3048  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll

13:43:31.0321 3048  WdiServiceHost - ok

13:43:31.0325 3048  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost   C:\Windows\system32\wdi.dll

13:43:31.0349 3048  WdiSystemHost - ok

13:43:31.0387 3048  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient       C:\Windows\System32\webclnt.dll

13:43:31.0419 3048  WebClient - ok

13:43:31.0436 3048  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll

13:43:31.0491 3048  Wecsvc - ok

13:43:31.0510 3048  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport   C:\Windows\System32\wercplsupport.dll

13:43:31.0558 3048  wercplsupport - ok

13:43:31.0598 3048  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll

13:43:31.0650 3048  WerSvc - ok

13:43:31.0703 3048  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys

13:43:31.0736 3048  WfpLwf - ok

13:43:31.0741 3048  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys

13:43:31.0749 3048  WIMMount - ok

13:43:31.0772 3048  WinDefend - ok

13:43:31.0777 3048  WinHttpAutoProxySvc - ok

13:43:31.0921 3048  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll

13:43:31.0956 3048  Winmgmt - ok

13:43:32.0022 3048  [ BCB1310604AA415C4508708975B3931E ] WinRM           C:\Windows\system32\WsmSvc.dll

13:43:32.0079 3048  WinRM - ok

13:43:32.0135 3048  [ FE88B288356E7B47B74B13372ADD906D ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys

13:43:32.0162 3048  WinUsb - ok

13:43:32.0213 3048  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc         C:\Windows\System32\wlansvc.dll

13:43:32.0255 3048  Wlansvc - ok

13:43:32.0304 3048  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys

13:43:32.0313 3048  WmiAcpi - ok

13:43:32.0338 3048  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe

13:43:32.0367 3048  wmiApSrv - ok

13:43:32.0408 3048  WMPNetworkSvc - ok

13:43:32.0439 3048  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll

13:43:32.0450 3048  WPCSvc - ok

13:43:32.0457 3048  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll

13:43:32.0471 3048  WPDBusEnum - ok

13:43:32.0505 3048  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys

13:43:32.0538 3048  ws2ifsl - ok

13:43:32.0565 3048  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\system32\wscsvc.dll

13:43:32.0581 3048  wscsvc - ok

13:43:32.0585 3048  WSearch - ok

13:43:32.0671 3048  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll

13:43:32.0716 3048  wuauserv - ok

13:43:32.0750 3048  [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys

13:43:32.0772 3048  WudfPf - ok

13:43:32.0800 3048  [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys

13:43:32.0814 3048  WUDFRd - ok

13:43:32.0844 3048  [ B20F051B03A966392364C83F009F7D17 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll

13:43:32.0875 3048  wudfsvc - ok

13:43:32.0919 3048  [ FE90B750AB808FB9DD8FBB428B5FF83B ] WwanSvc         C:\Windows\System32\wwansvc.dll

13:43:32.0943 3048  WwanSvc - ok

13:43:32.0949 3048  ================ Scan global ===============================

13:43:32.0979 3048  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll

13:43:33.0023 3048  [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll

13:43:33.0032 3048  [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll

13:43:33.0072 3048  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll

13:43:33.0107 3048  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe

13:43:33.0110 3048  [Global] - ok

13:43:33.0111 3048  ================ Scan MBR ==================================

13:43:33.0126 3048  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0

13:43:33.0306 3048  \Device\Harddisk0\DR0 - ok

13:43:33.0307 3048  ================ Scan VBR ==================================

13:43:33.0339 3048  [ 815FA055A33A49FF54F714B2377BFCD3 ] \Device\Harddisk0\DR0\Partition1

13:43:33.0340 3048  \Device\Harddisk0\DR0\Partition1 - ok

13:43:33.0369 3048  [ 7C10470F15227438B3B7BB9E81412B53 ] \Device\Harddisk0\DR0\Partition2

13:43:33.0370 3048  \Device\Harddisk0\DR0\Partition2 - ok

13:43:33.0373 3048  ============================================================

13:43:33.0373 3048  Scan finished

13:43:33.0373 3048  ============================================================

13:43:33.0383 3696  Detected object count: 1

13:43:33.0383 3696  Actual detected object count: 1

13:45:36.0499 3696  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

13:45:36.0499 3696  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip

Wie geht es nun weiter?

Danke und Gruß
Frady

Hi,
es sind 4 Logs zu erstellen, poste diese möglichst gleichzeitig.
1.

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Neustarten.
2.
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Neustarten.
3.

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

neustarten.
4.
HitmanPro - Download - Filepony
Hitmanpro laden, doppelklicken, Scan klicken.
Log speichern und posten, bzw als XML exportieren, packen und anhängen.
Hitmanpro schließen.

Hi,
nun die vier Logs:

Code:

Malwarebytes Anti-Malware (Test) 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.08.12.05
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16635

Samy :: SAMY-TOSH [Administrator]
 

Schutz: Aktiviert
 

12.08.2013 19:37:16

mbam-log-2013-08-12 (19-37-16).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 223752

Laufzeit: 2 Minute(n), 48 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 4

C:\Users\Samy\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\Tarma Installer (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504} (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Cache (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateien: 6

C:\Users\Samy\AppData\Roaming\OpenCandy\18323F7F663A47E3A984377B142E508B\DeltaTB.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Samy\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

AdwCleaner Logfile:

Code:

# AdwCleaner v2.306 - Datei am 12/08/2013 um 19:49:47 erstellt

# Aktualisiert am 19/07/2013 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzer : Samy - SAMY-TOSH

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\Samy\Desktop\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Datei Gelöscht : C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\extensions\gophoto@gophoto.it.xpi

Datei Gelöscht : C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\extensions\movie2kdownloader@movie2kdownloader.com.xpi

Datei Gelöscht : C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\11-suche.xml

Datei Gelöscht : C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\Askcom.xml

Datei Gelöscht : C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\Babylon.xml

Datei Gelöscht : C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\delta.xml

Ordner Gelöscht : C:\Program Files (x86)\Gophoto.it

Ordner Gelöscht : C:\ProgramData\Ask

Ordner Gelöscht : C:\ProgramData\Babylon

Ordner Gelöscht : C:\ProgramData\Partner

Ordner Gelöscht : C:\Users\Samy\AppData\Local\PutLockerDownloader

Ordner Gelöscht : C:\Users\Samy\AppData\Roaming\dvdvideosoftiehelpers

Ordner Gelöscht : C:\Users\Samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Movie2KDownloader.com

Ordner Gelöscht : C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\jetpack

Ordner Gelöscht : C:\Users\Samy\AppData\Roaming\OpenCandy

Ordner Gelöscht : C:\Users\Samy\AppData\Roaming\pdfforge
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKCU\Software\1ClickDownload

Schlüssel Gelöscht : HKCU\Software\APN PIP

Schlüssel Gelöscht : HKCU\Software\BabSolution

Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar

Schlüssel Gelöscht : HKCU\Software\InstallCore

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKCU\Software\e4dad0b73be449

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Movie2KDownloader

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}

Schlüssel Gelöscht : HKLM\Software\DataMngr

Schlüssel Gelöscht : HKLM\Software\Iminent

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASMANCS

Schlüssel Gelöscht : HKLM\Software\PIP

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\e4dad0b73be449

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\blaofbhgbmeikidhlkmjhbkbfohpgekf

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pfmopbbadnfoelckkcmjjeaaegjpjjbk

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4BD8E034-E0F4-4509-A753-467A8E854CD8}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4BD8E034-E0F4-4509-A753-467A8E854CD8}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A76AA284-E52D-47E6-9E4F-B85DBF8E35C3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP

Schlüssel Gelöscht : HKLM\SOFTWARE\Software

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{acaa314b-eeba-48e4-ad47-84e31c44796c}]

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [webbooster@iminent.com]
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v10.0.9200.16635
 

[OK] Die Registrierungsdatenbank ist sauber.
 

-\\ Mozilla Firefox v23.0 (de)
 

Datei : C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\prefs.js
 

C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\user.js ... Gelöscht !
 

Gelöscht : user_pref("extensions.delta.admin", false);

Gelöscht : user_pref("extensions.delta.aflt", "babsst");

Gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");

Gelöscht : user_pref("extensions.delta.autoRvrt", "false");

Gelöscht : user_pref("extensions.delta.dfltLng", "de");

Gelöscht : user_pref("extensions.delta.excTlbr", false);

Gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);

Gelöscht : user_pref("extensions.delta.id", "e249378800000000000074de2b1d9015");

Gelöscht : user_pref("extensions.delta.instlDay", "15891");

Gelöscht : user_pref("extensions.delta.instlRef", "sst");

Gelöscht : user_pref("extensions.delta.newTab", false);

Gelöscht : user_pref("extensions.delta.prdct", "delta");

Gelöscht : user_pref("extensions.delta.prtnrId", "delta");

Gelöscht : user_pref("extensions.delta.rvrt", "false");

Gelöscht : user_pref("extensions.delta.smplGrp", "none");

Gelöscht : user_pref("extensions.delta.tlbrId", "base");

Gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");

Gelöscht : user_pref("extensions.delta.vrsn", "1.8.21.5");

Gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.21.515:54:04");

Gelöscht : user_pref("extensions.delta.vrsni", "1.8.21.5");

Gelöscht : user_pref("extensions.delta_i.babExt", "");

Gelöscht : user_pref("extensions.delta_i.babTrack", "affID=121563&tt=040713_ifrmful&tsp=4934");

Gelöscht : user_pref("extensions.delta_i.srcExt", "ss");
 

-\\ Google Chrome v [Version kann nicht ermittelt werden]
 

Datei : C:\Users\Samy\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] Die Datei ist sauber.
 

*************************
 

AdwCleaner[S1].txt - [17388 octets] - [12/08/2013 19:49:47]
 

########## EOF - C:\AdwCleaner[S1].txt - [17449 octets] ##########

--- --- ---

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 5.4.4 (08.12.2013:1)

OS: Windows 7 Home Premium x64

Ran by Samy on 12.08.2013 at 20:04:03,43

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\sweetim

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\sweetim

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{DED82C22-F7A9-4C6D-BB8F-D26E10652D83}
 
 
 

~~~ Files
 

Successfully deleted: [File] C:\Windows\syswow64\sho13FC.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho1BCB.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho26A7.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho272A.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho31FD.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho402C.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho44D3.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho50FD.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho5CD5.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho708E.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho7697.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho7849.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho7A1F.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho7B57.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho7F5C.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho83FF.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho8A8D.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho8B30.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho937B.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho9915.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoA43B.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoA516.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoA7C9.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoAAA.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoAFCB.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoB59B.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoBF4C.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoC1E9.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoC9C6.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoCE95.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoD0C8.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoDABB.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoF7F6.tmp
 
 
 

~~~ Folders
 
 
 

~~~ FireFox
 

Successfully deleted: [File] C:\Users\Samy\AppData\Roaming\mozilla\firefox\profiles\9tgy6iv2.default\invalidprefs.js

Successfully deleted the following from C:\Users\Samy\AppData\Roaming\mozilla\firefox\profiles\9tgy6iv2.default\prefs.js
 

user_pref("id_imbooster4web_v6.bubble_src", "hxxp%3A//toolbar.iminent.com/SocialNetworking/%3FvToolbar%3DIminent");

user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent109", "1357486120960");

user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent110", "1357549297552");

user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent111", "1357486120954");

user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent112", "1357486120966");

user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent122", "1357486120969");

user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent134", "1360070700901");

user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent140", "1358863245623");

user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent109", "1357568470518");

user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent110", "1357568471821");

user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent111", "1357568470514");

user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent112", "1357568470522");

user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent122", "1357568470524");

user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent134", "1359656510935");

Emptied folder: C:\Users\Samy\AppData\Roaming\mozilla\firefox\profiles\9tgy6iv2.default\minidumps [142 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 12.08.2013 at 20:17:49,39

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Code:



        Code:


        
HitmanPro 3.7.7.203

www.hitmanpro.com
 

   Computer name . . . . : SAMY-TOSH

   Windows . . . . . . . : 6.1.1.7601.X64/4

   User name . . . . . . : Samy-TOSH\Samy

   UAC . . . . . . . . . : Enabled

   License . . . . . . . : Free
 

   Scan date . . . . . . : 2013-08-12 20:26:35

   Scan mode . . . . . . : Normal

   Scan duration . . . . : 4m 4s

   Disk access mode  . . : Direct disk access (SRB)

   Cloud . . . . . . . . : Internet

   Reboot  . . . . . . . : No
 

   Threats . . . . . . . : 0

   Traces  . . . . . . . : 57
 

   Objects scanned . . . : 1.659.596

   Files scanned . . . . : 12.144

   Remnants scanned  . . : 417.902 files / 1.229.550 keys
 

Potential Unwanted Programs _________________________________________________
 

   HKU\S-1-5-21-2214768358-217717142-1947330960-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{4D2D3B0F-69BE-477A-90F5-FDDB05357975} (Claro)

   HKU\S-1-5-21-2214768358-217717142-1947330960-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{98889811-442D-49DD-99D7-DC866BE87DBC} (Claro)
 

Cookies _____________________________________________________________________
 

   C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\cookies.sqlite:ad.yieldmanager.com

   C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\cookies.sqlite:ad.zanox.com

   C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\cookies.sqlite:apmebf.com

   C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\cookies.sqlite:doubleclick.net

   C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\cookies.sqlite:track.adform.net

kommt noch was? hab lansam das Gefühl dass der Rechner total befallen war :-)
Welche AntiVir Software kannst du empfehlen?

Gruß
Frady

Kommt noch kommt noch, immer mit der Ruhe :-)
Das was wir jetzt gelöscht haben, war adware.
nichts weiter tragisches, nur nerfig :-(
bitte schließe alle Browser, nutze Hitmanpro, lösche Funde.
Starte neu, frisches frst Logb

... na dann bin ich schon gespannt :-)

Code:



        Code:


        
HitmanPro 3.7.7.203

www.hitmanpro.com
 

   Computer name . . . . : SAMY-TOSH

   Windows . . . . . . . : 6.1.1.7601.X64/4

   User name . . . . . . : Samy-TOSH\Samy

   UAC . . . . . . . . . : Enabled

   License . . . . . . . : Trial (30 days left)
 

   Scan date . . . . . . : 2013-08-12 20:51:22

   Scan mode . . . . . . : Normal

   Scan duration . . . . : 1m 58s

   Disk access mode  . . : Direct disk access (SRB)

   Cloud . . . . . . . . : Internet

   Reboot  . . . . . . . : No
 

   Threats . . . . . . . : 0

   Traces  . . . . . . . : 22
 

   Objects scanned . . . : 1.437.832

   Files scanned . . . . : 12.110

   Remnants scanned  . . : 417.942 files / 1.007.780 keys
 

Potential Unwanted Programs _________________________________________________
 

   HKU\S-1-5-21-2214768358-217717142-1947330960-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{4D2D3B0F-69BE-477A-90F5-FDDB05357975} (Claro) -> Deleted

   HKU\S-1-5-21-2214768358-217717142-1947330960-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{98889811-442D-49DD-99D7-DC866BE87DBC} (Claro) -> Deleted
 

Cookies _____________________________________________________________________
 

   C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\cookies.sqlite:doubleclick.net