Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Windows 7: Interpol Meldung Rechner gesprerrt! (https://www.trojaner-board.de/139493-windows-7-interpol-meldung-rechner-gesprerrt.html)

ataba 07.08.2013 19:52
Windows 7: Interpol Meldung Rechner gesprerrt!
 
Hallo Helfer,

meine Tochter hat auf ihrem Laptop den Interpol Trojener / Virus eingefangen.
Der Rechner ist gesperrt und kann nicht genutzt werden.

Beim Hochfahren sieht es erst so aus, als wenn Windows läd und dann kommt
der weiße Bildschirm und anschließend die Interpol Meldung mit der
Aufforderung 100€ Strafe zu bezahlen...

Bitte um Hilfe!
Wie soll ich vorgehen?

Besten Dank im Voraus und viele Grüße
Frady

markusg 07.08.2013 19:53
Hi,
Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)
Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
  • Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST Download FRST 32-Bit | FRST 64-Bit
  • Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
  • Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:
Über den Boot Manager:
  • Starte den Rechner neu.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD (auch bei Windows 8 möglich):
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu und starte von der CD.
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen: Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
    Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein.
    e:\frst.exe bzw. e:\frst64.exe
    Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Ja und klicke Untersuchen
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).


ataba 07.08.2013 20:20
Hi,

danke für die schnelle Antwort.

bin nach deiner Anleitung vorgegangen. Unten das Ergebnis.

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-08-2013 04
Ran by SYSTEM on 07-08-2013 21:05:17
Running from H:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
Winlogon\Notify\klogon: %SystemRoot%\System32\klogon.dll (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\avp.exe [387696 2011-04-13] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKU\Default\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-15] (TOSHIBA)
HKU\Default User\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-15] (TOSHIBA)
HKU\Samy\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-20] (Skype Technologies S.A.)
HKU\Samy\...\Winlogon: [Shell] explorer.exe,C:\Users\Samy\AppData\Roaming\cache.dat [90624 2011-11-16] () <==== ATTENTION
AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll,C:\PROGRA~2\KASPER~1\KASPER~1\x64\sbhook64.dll [31120 2011-04-13] (Kaspersky Lab ZAO)
AppInit_DLLs-x32: c:\progra~3\browse~1\261519~1.190\{c16c1~1\browse~1.dll c:\progra~2\kasper~1\kasper~1\mzvkbd3.dll c:\progra~2\kasper~1\kasper~1\sbhook.dll [110992 2011-04-13] (Kaspersky Lab ZAO)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)

==================== Services (Whitelisted) =================

S2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\avp.exe [387696 2011-04-13] (Kaspersky Lab ZAO)
S2 BrowserDefendert; C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe [2847696 2013-07-26] ()
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-09] (Toshiba Europe GmbH)

==================== Drivers (Whitelisted) ====================

S0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2010-06-09] (Kaspersky Lab ZAO)
S1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2010-06-09] (Kaspersky Lab ZAO)
S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [556120 2012-05-12] (Kaspersky Lab)
S1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [27736 2010-04-22] (Kaspersky Lab ZAO)
S3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [22544 2009-11-02] (Kaspersky Lab)
S3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv_x64.sys [44928 2012-10-10] (ManyCam LLC)
S3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [29696 2012-10-10] (ManyCam LLC)
S3 Tosrfcom; No ImagePath

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\drivers\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 1C7857B62DE5994A75B054A9FD4C3825
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdk8.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\system32\drivers\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\drivers\arc.sys ==> MD5 is legit
C:\Windows\system32\drivers\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\athrx.sys B2931C83CFB12A3223A47B180473AE1A
C:\Windows\system32\drivers\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\system32\drivers\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\btfilter.sys 2347ABBD13BADA65826FDAB4CAAFE357
C:\Windows\system32\drivers\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\drivers\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\system32\drivers\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 9AC4F97C2D3E93367E2148EA940CD2CD
C:\Windows\System32\drivers\CHDRT64.sys 66847C979893A11CFCC2280E772D7EA1
C:\Windows\System32\drivers\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\drivers\disk.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys AF2E16242AA723F68F461B6EAE2EAD3D
C:\Windows\system32\drivers\evbda.sys ==> MD5 is legit
C:\Windows\system32\drivers\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\system32\drivers\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\drivers\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\fssfltr.sys B3EB502D2C3F47C47415F85387DFAEF1
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0
C:\Windows\system32\drivers\gagp30kx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\GEARAspiWDM.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\System32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidbth.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\iaStor.sys D469B77687E12FE43E344806740B624D
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\System32\DRIVERS\igdkmd64.sys 370C2A8629B30F910F740387795DDC6F
C:\Windows\system32\drivers\iirsp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\IntcDAud.sys FC727061C0F47C8059E88E05D5C8E381
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kl1.sys 8D7120743A0973CEAB548B475C9D4289
C:\Windows\System32\DRIVERS\kl2.sys CD146D8E525D6EEBDCAF24120A8AB9CE
C:\Windows\System32\DRIVERS\klif.sys C1786C2F8DE0F62E076F7EF8DEA4E87A
C:\Windows\System32\DRIVERS\klim6.sys 2A64B3A9EED93A2E96537B67C079FC96
C:\Windows\System32\DRIVERS\klmouflt.sys 9468D07E91BA136D82415F5DFC1FE168
C:\Windows\System32\Drivers\ksecdd.sys 97A7070AEA4C058B6418519E869A63B4
C:\Windows\System32\Drivers\ksecpkg.sys 26C43A7C2862447EC59DEDA188D1DA07
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\L1C62x64.sys EBED8B3FF4A823C1A6EEBEED7B29353F
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mcvidrv_x64.sys DE585D1D266805E5EEDAE911FDD16F38
C:\Windows\System32\drivers\mcaudrv_x64.sys 2E7FFDEF8BAFD04CBB517507B821E878
C:\Windows\system32\drivers\megasas.sys ==> MD5 is legit
C:\Windows\system32\drivers\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\HECIx64.sys A6518DCC42F7A6E999BB3BEA8FD87567
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\System32\DRIVERS\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\drivers\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\system32\drivers\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys B98F8C6E31CD07B2E6F71F7F648E38C0
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\drivers\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pciide.sys ==> MD5 is legit
C:\Windows\system32\drivers\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pgeffect.sys 91111CEBBDE8015E822C46120ED9537C
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\drivers\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\drivers\QIOMem.sys C8FCB4899F8B70CC34E0D9876A80963C
C:\Windows\system32\drivers\ql2300.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\drivers\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RtsUStor.sys 135A64530D7699AD48F29D73A658DD11
C:\Windows\System32\Drivers\RTSUVSTOR.sys E5DC911D0FEB72CAFF2BBDD6E7C3672F
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\serenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\serial.sys ==> MD5 is legit
C:\Windows\system32\drivers\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\drivers\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\drivers\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\VSTAZL6.SYS 0C4540311E11664B245A263E1154CEF8
C:\Windows\System32\DRIVERS\VSTDPV6.SYS 02071D207A9858FBE3A48CBFD59C4A04
C:\Windows\System32\DRIVERS\VSTCNXT6.SYS 18E40C245DBFAF36FD0134A7EF2DF396
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\system32\drivers\stexstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SynTP.sys F5B46DF59FEAA48A442AED7EEB754D4B
C:\Windows\System32\drivers\tcpip.sys 9849EA3843A2ADBDD1497E97A85D8CAE
C:\Windows\System32\DRIVERS\tcpip.sys 9849EA3843A2ADBDD1497E97A85D8CAE
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\DRIVERS\tdcmdpst.sys FD542B661BD22FA69CA789AD0AC58C29
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tosrfec.sys F5E3AC4CBCD154EE80849B21887FD0B0
C:\Windows\System32\DRIVERS\tosrfusb.sys 7A0048693F98460FF537BE31C741B927
C:\Windows\System32\DRIVERS\tssecsrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\system32\drivers\TsUsbGD.sys 9CC2CCAE8A84820EAECB886D477CBCB8
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\TVALZ_O.SYS ==> MD5 is legit
C:\Windows\System32\DRIVERS\TVALZFL.sys 9C7191F4B2E49BFF47A6C1144B5923FA
C:\Windows\system32\drivers\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\umpass.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbaapl64.sys FB251567F41BC61988B26731DEC19E4B
C:\Windows\System32\drivers\usbaudio.sys 82E8F44688E6FAC57B5B7C6FC7ADBC2A
C:\Windows\System32\DRIVERS\usbccgp.sys 6F1A3157A1C89435352CEB543CDB359C
C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit
C:\Windows\system32\drivers\usbehci.sys C025055FE7B87701EB042095DF1A2D7B
C:\Windows\system32\drivers\usbhub.sys 287C6C9410B111B68B52CA298F7B8C24
C:\Windows\system32\drivers\usbohci.sys 9840FC418B4CBD632D3D0A667A725C31
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbscan.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\system32\drivers\usbuhci.sys 62069A34518BCF9C1FD9E74B3F6DB7CD
C:\Windows\System32\Drivers\usbvideo.sys 454800C2BC7F3927CE030141EE4F4C50
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys DF8126BD41180351A093A3AD2FC8903B
C:\Windows\system32\drivers\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit
C:\Windows\system32\drivers\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\drivers\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys 442783E2CB0DA19873B7A63833FF4CB4
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWow64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys FE88B288356E7B47B74B13372ADD906D
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-05 12:26 - 2013-08-07 11:00 - 00003436 _____ C:\Windows\System32\Tasks\BrowserDefendert
2013-08-05 11:23 - 2013-08-05 11:23 - 00000000 ____D C:\FRST
2013-08-04 04:27 - 2013-08-04 04:27 - 00001614 _____ C:\Windows\PFRO.log
2013-07-31 06:46 - 2013-08-07 11:00 - 00000004 _____ C:\Users\Samy\AppData\Roaming\cache.ini
2013-07-31 04:05 - 2013-08-07 10:23 - 00001469 _____ C:\Windows\setupact.log
2013-07-31 04:05 - 2013-07-31 04:05 - 00000000 _____ C:\Windows\setuperr.log
2013-07-30 12:40 - 2013-07-30 13:13 - 00015543 _____ C:\Users\Samy\Desktop\architekt.odt
2013-07-28 08:37 - 2013-07-28 08:51 - 00000000 ____D C:\Users\Samy\Desktop\Urlaub Eltern 2013
2013-07-18 07:25 - 2013-07-18 07:25 - 00003072 ____H C:\Users\Samy\photothumb.db
2013-07-18 07:24 - 2013-07-18 07:24 - 00024576 ____H C:\Users\Samy\Desktop\photothumb.db
2013-07-14 01:17 - 2013-06-11 15:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-14 01:17 - 2013-06-11 15:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-14 01:17 - 2013-06-11 15:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-14 01:17 - 2013-06-11 15:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-14 01:17 - 2013-06-11 15:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-14 01:17 - 2013-06-11 15:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-14 01:17 - 2013-06-11 15:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-14 01:17 - 2013-06-11 15:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-14 01:17 - 2013-06-11 15:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-14 01:17 - 2013-06-11 15:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-07-14 01:17 - 2013-06-11 15:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-07-14 01:17 - 2013-06-11 15:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-07-14 01:17 - 2013-06-11 15:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-07-14 01:17 - 2013-06-11 15:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-07-14 01:17 - 2013-06-11 15:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-07-14 01:17 - 2013-06-11 15:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-07-14 01:17 - 2013-06-11 15:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-07-14 01:17 - 2013-06-11 15:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-07-14 01:17 - 2013-06-11 15:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-07-14 01:17 - 2013-06-11 14:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-14 01:17 - 2013-06-11 14:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-07-14 01:17 - 2013-06-06 19:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-07-14 01:17 - 2013-06-06 18:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-14 01:16 - 2013-06-11 15:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-14 01:16 - 2013-06-11 15:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-14 01:16 - 2013-06-11 15:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-14 01:16 - 2013-06-11 15:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-14 01:16 - 2013-06-11 15:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-07-14 01:16 - 2013-06-11 15:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-07-14 01:16 - 2013-06-11 15:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-07-14 01:16 - 2013-06-11 15:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-07-11 22:43 - 2013-06-04 19:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-07-11 22:43 - 2013-06-03 22:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll
2013-07-11 22:43 - 2013-06-03 20:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-11 22:43 - 2013-05-05 22:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-07-11 22:43 - 2013-05-05 20:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-11 22:43 - 2013-04-09 15:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-11 22:43 - 2013-04-02 14:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll

==================== One Month Modified Files and Folders =======

2013-08-07 11:00 - 2013-08-05 12:26 - 00003436 _____ C:\Windows\System32\Tasks\BrowserDefendert
2013-08-07 11:00 - 2013-07-31 06:46 - 00000004 _____ C:\Users\Samy\AppData\Roaming\cache.ini
2013-08-07 11:00 - 2013-07-04 11:59 - 01574933 _____ C:\Windows\WindowsUpdate.log
2013-08-07 10:31 - 2009-07-13 20:45 - 00024912 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-07 10:31 - 2009-07-13 20:45 - 00024912 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-07 10:29 - 2011-02-11 00:21 - 00669012 _____ C:\Windows\System32\perfh007.dat
2013-08-07 10:29 - 2011-02-11 00:21 - 00134796 _____ C:\Windows\System32\perfc007.dat
2013-08-07 10:29 - 2009-07-13 21:13 - 01527002 _____ C:\Windows\System32\PerfStringBackup.INI
2013-08-07 10:25 - 2012-05-12 07:49 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-08-07 10:24 - 2013-03-06 04:07 - 00000000 ___RD C:\Users\Samy\Dropbox
2013-08-07 10:24 - 2013-03-06 04:02 - 00000000 ____D C:\Users\Samy\AppData\Roaming\Dropbox
2013-08-07 10:23 - 2013-07-31 04:05 - 00001469 _____ C:\Windows\setupact.log
2013-08-07 10:23 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-05 11:23 - 2013-08-05 11:23 - 00000000 ____D C:\FRST
2013-08-04 04:27 - 2013-08-04 04:27 - 00001614 _____ C:\Windows\PFRO.log
2013-08-04 04:27 - 2013-07-05 05:54 - 00000000 ____D C:\ProgramData\BrowserDefender
2013-08-04 01:12 - 2012-02-11 12:28 - 00000000 ____D C:\Users\Samy\AppData\Roaming\Skype
2013-07-31 04:05 - 2013-07-31 04:05 - 00000000 _____ C:\Windows\setuperr.log
2013-07-30 14:04 - 2011-08-03 00:55 - 00000000 ____D C:\Windows\Panther
2013-07-30 13:13 - 2013-07-30 12:40 - 00015543 _____ C:\Users\Samy\Desktop\architekt.odt
2013-07-29 13:18 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF
2013-07-28 08:51 - 2013-07-28 08:37 - 00000000 ____D C:\Users\Samy\Desktop\Urlaub Eltern 2013
2013-07-18 07:25 - 2013-07-18 07:25 - 00003072 ____H C:\Users\Samy\photothumb.db
2013-07-18 07:25 - 2012-02-11 12:22 - 00000000 ____D C:\users\Samy
2013-07-18 07:24 - 2013-07-18 07:24 - 00024576 ____H C:\Users\Samy\Desktop\photothumb.db
2013-07-15 05:49 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache
2013-07-14 09:53 - 2009-07-13 20:45 - 00530648 _____ C:\Windows\System32\FNTCACHE.DAT
2013-07-14 09:51 - 2013-03-14 02:31 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-14 09:51 - 2013-03-14 02:31 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-14 09:48 - 2011-02-11 00:20 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2013-07-14 09:48 - 2010-11-20 23:17 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-14 09:48 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\SysWOW64\winrm
2013-07-14 09:48 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\SysWOW64\WCN
2013-07-14 09:48 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\SysWOW64\sysprep
2013-07-14 09:48 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\SysWOW64\slmgr
2013-07-14 09:48 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\SysWOW64\Printing_Admin_Scripts
2013-07-14 09:48 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\System32\winrm
2013-07-14 09:48 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\System32\WCN
2013-07-14 09:48 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\System32\slmgr
2013-07-14 09:48 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\System32\Printing_Admin_Scripts
2013-07-14 09:48 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Sidebar
2013-07-14 09:48 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-07-14 09:48 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-14 09:48 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar
2013-07-14 09:48 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-07-14 09:48 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\Setup
2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\oobe
2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\MUI
2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\migwiz
2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\Dism
2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\com
2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\sysprep
2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\Setup
2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\oobe
2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\MUI
2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\migwiz
2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\Dism
2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\com
2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\servicing
2013-07-14 09:48 - 2009-07-13 19:20 - 00000000 ____D C:\Program Files\Common Files\System
2013-07-14 09:45 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\DVD Maker
2013-07-14 01:27 - 2012-04-24 09:04 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-14 01:18 - 2012-06-08 01:50 - 78185248 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-07-12 10:01 - 2013-01-27 04:57 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-07-12 10:01 - 2011-08-03 02:05 - 00000000 ____D C:\ProgramData\Skype
2013-07-11 13:14 - 2013-05-23 08:43 - 00000000 ____D C:\Users\Samy\Desktop\dom
2013-07-11 04:28 - 2013-07-02 08:53 - 00000000 ____D C:\Users\Samy\Desktop\steckbrief

Files to move or delete:
====================
C:\Users\Samy\AppData\Roaming\cache.dat
C:\Users\Samy\AppData\Roaming\cache.ini

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-07-14 01:07:12
Restore point made on: 2013-07-14 08:08:43
Restore point made on: 2013-07-16 01:26:33
Restore point made on: 2013-07-19 03:43:42
Restore point made on: 2013-07-23 23:06:03
Restore point made on: 2013-07-29 15:45:49
Restore point made on: 2013-08-04 04:40:48
Restore point made on: 2013-08-07 10:29:33

==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=E:
description            Windows Boot Manager
locale                  de-DE
inherit                {globalsettings}
default                {default}
resumeobject            {5123a86a-bdae-11e0-afe4-60eb699c533a}
displayorder            {default}
toolsdisplayorder      {memdiag}
timeout                30

Windows-Startladeprogramm
-------------------------
Bezeichner              {default}
device                  partition=C:
path                    \Windows\system32\winload.exe
description            Windows 7
locale                  de-DE
inherit                {bootloadersettings}
recoverysequence        {current}
recoveryenabled        Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {5123a86a-bdae-11e0-afe4-60eb699c533a}
nx                      OptIn

Windows-Startladeprogramm
-------------------------
Bezeichner              {current}
device                  ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{5123a86d-bdae-11e0-afe4-60eb699c533a}
path                    \windows\system32\winload.exe
description            Windows Recovery Environment
inherit                {bootloadersettings}
osdevice                ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{5123a86d-bdae-11e0-afe4-60eb699c533a}
systemroot              \windows
nx                      OptIn
winpe                  Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {5123a86a-bdae-11e0-afe4-60eb699c533a}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description            Windows Resume Application
locale                  de-DE
inherit                {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=E:
path                    \boot\memtest.exe
description            Windows Memory Diagnostic
locale                  de-DE
inherit                {globalsettings}
badmemoryaccess        Yes

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype              Serial
debugport              1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype    Serial
hypervisordebugport    1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                {globalsettings}

Ger„teoptionen
--------------
Bezeichner              {5123a86d-bdae-11e0-afe4-60eb699c533a}
description            Ramdisk Options
ramdisksdidevice        partition=E:
ramdisksdipath          \Recovery\WindowsRE\boot.sdi


==================== Memory info ===========================

Percentage of memory in use: 15%
Total physical RAM: 4043.86 MB
Available physical RAM: 3399.86 MB
Total Pagefile: 4042.06 MB
Available Pagefile: 3385.79 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB

==================== Drives ================================

Drive c: (WINDOWS) (Fixed) (Total:232.34 GB) (Free:167.65 GB) NTFS (Disk=0 Partition=2)
Drive d: (Data) (Fixed) (Total:233.03 GB) (Free:198.55 GB) NTFS (Disk=0 Partition=3)
Drive e: (SYSTEM) (Fixed) (Total:0.39 GB) (Free:0.15 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]
Drive f: (KNOPPIX) (CDROM) (Total:0.67 GB) (Free:0 GB) CDFS
Drive h: (KINGSTON) (Removable) (Total:0.47 GB) (Free:0.41 GB) FAT (Disk=2 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 3C96D6C9)
Partition 1: (Active) - (Size=399 MB) - (Type=27)
Partition 2: (Not Active) - (Size=232 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=233 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 478 MB) (Disk ID: 6F20736B)
No partition Table on disk 2.
Disk 2 is a removable device.


LastRegBack: 2013-07-14 07:58

==================== End Of Log ============================
--- --- ---

--- --- ---


Wie geht es weiter?

markusg 07.08.2013 20:24
Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKU\Samy\...\Winlogon: [Shell] explorer.exe,C:\Users\Samy\AppData\Roaming\cache.dat [90624 2011-11-16] () <==== ATTENTION
C:\Users\Samy\AppData\Roaming\cache.dat
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

sollte der PC wieder normal starten:

Navigiere bitte zu:
C:\FRST\Quarantine
Rechtsklick, mit Winrar oder einem anderen Archvierer packen und im Uploadchannel hochladen.
Trojaner-Board Upload Channel

ataba 07.08.2013 20:36
folgend die Fixlog...
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-08-2013 04
Ran by SYSTEM at 2013-08-07 21:33:22 Run:3
Running from H:\
Boot Mode: Recovery
==============================================

HKU\Samy\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
C:\Users\Samy\AppData\Roaming\cache.dat => Moved successfully.

==== End of Fixlog ====

markusg 07.08.2013 20:47
Sehr gut, danke fürs hochladen.
gleich kommt eine Anleitung für FRST.
mir würde hier aber vorerst die Liste der Programme, info folgt gleich, aus der Additions.txt reichen, bearbeite die bitte mit deiner Tochter

Empfehlungen fürs Deinstallieren
Bitte kopiere die Liste der installierten Programme aus der additions.txt hier in deinen Thread. Notiere mir bitte
hinter jede Zeile, ob folgendes Kategorie zutrifft: Unbekannt, Nötig, Unnötig

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


ataba 07.08.2013 21:07
ok, ich hab's


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-08-2013 06
Ran by Samy (administrator) on 07-08-2013 22:00:02
Running from C:\Users\Samy\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe
() C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe
(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
(Dropbox, Inc.) C:\Users\Samy\AppData\Roaming\Dropbox\bin\Dropbox.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKCU\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10l_ActiveX.exe -update activex [233936 2011-09-24] (Adobe Systems, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKU\Default\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
HKU\Default User\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
AppInit_DLLs-x32: c:\progra~3\browse~1\261519~1.190\{c16c1~1\browse~1.dll [2691536 2013-07-26] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Samy\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP&dt=071213
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://search.babylon.com/?babsrc=HP_ss_din2g&mntrId=E24974DE2B1D9015&affID=121563&tt=040713_ifrmful&tsp=4934
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.yhs.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=E24974DE2B1D9015&affID=121563&tt=040713_ifrmful&tsp=4934
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {DED82C22-F7A9-4C6D-BB8F-D26E10652D83} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=MYC2&o=APN10416&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AIT&apn_dtid=^zzz000^YY^DE&apn_uid=68585a97-976e-4f85-836a-7ff40e5333f0&apn_sauid=30B398E5-8BF8-4577-9DF2-3BB57A44E25C
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll (Delta-search.com)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaTlbr.dll (Delta-search.com)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default
FF user.js: detected! => C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\user.js
FF NewTab: hxxp://www.yhs.delta-search.com/?babsrc=NT_ss&mntrId=E24974DE2B1D9015&affID=121563&tt=040713_ifrmful&tsp=4934
FF SelectedSearchEngine: Delta Search
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_171.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.7.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\babylon.xml
FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\delta.xml
FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Delta Toolbar - C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\Extensions\ffxtlbr@delta.com
FF Extension: gophoto - C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\Extensions\gophoto@gophoto.it.xpi
FF Extension: movie2kdownloader - C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\Extensions\movie2kdownloader@movie2kdownloader.com.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [webbooster@iminent.com] C:\Program Files (x86)\Iminent\webbooster@iminent.com
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: No Name - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\

Chrome:
=======
CHR Extension: () - C:\Users\Samy\AppData\Local\Google\Chrome\User Data\Default\Extensions\2.0.0.0_0\manifest.json
CHR HKLM-x32\...\Chrome\Extension: [blaofbhgbmeikidhlkmjhbkbfohpgekf] - C:\Program Files (x86)\Movie2KDownloader.com\Movie2KDownloader10.crx
CHR HKLM-x32\...\Chrome\Extension: [nkgfcicgjhneabbbfhddfcgifljdhhpl] - C:\Users\Samy\AppData\Roaming\BabSolution\CR\Delta.crx
CHR HKLM-x32\...\Chrome\Extension: [pfmopbbadnfoelckkcmjjeaaegjpjjbk] - C:\Program Files (x86)\Gophoto.it\gophotoit14.crx

==================== Services (Whitelisted) =================

R2 BrowserDefendert; C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe [2847696 2013-07-26] ()
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)

==================== Drivers (Whitelisted) ====================

R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv_x64.sys [44928 2012-10-11] (ManyCam LLC)
R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [29696 2012-10-11] (ManyCam LLC)
S3 Tosrfcom; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-07 21:56 - 2013-08-07 21:59 - 01789861 _____ (Farbar) C:\Users\Samy\Desktop\FRST64.exe
2013-08-07 21:50 - 2013-08-07 21:50 - 00003436 _____ C:\Windows\System32\Tasks\BrowserDefendert
2013-08-05 21:23 - 2013-08-05 21:23 - 00000000 ____D C:\FRST
2013-08-04 14:27 - 2013-08-04 14:27 - 00001614 _____ C:\Windows\PFRO.log
2013-07-31 16:46 - 2013-08-07 21:00 - 00000004 _____ C:\Users\Samy\AppData\Roaming\cache.ini
2013-07-31 14:05 - 2013-08-07 21:50 - 00001581 _____ C:\Windows\setupact.log
2013-07-31 14:05 - 2013-07-31 14:05 - 00000000 _____ C:\Windows\setuperr.log
2013-07-30 22:40 - 2013-07-30 23:13 - 00015543 _____ C:\Users\Samy\Desktop\architekt.odt
2013-07-28 18:37 - 2013-07-28 18:51 - 00000000 ____D C:\Users\Samy\Desktop\Urlaub Eltern 2013
2013-07-18 17:25 - 2013-07-18 17:25 - 00003072 ____H C:\Users\Samy\photothumb.db
2013-07-18 17:24 - 2013-07-18 17:24 - 00024576 ____H C:\Users\Samy\Desktop\photothumb.db
2013-07-14 11:17 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-14 11:17 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-14 11:17 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-14 11:17 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-14 11:17 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-14 11:17 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-14 11:17 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-14 11:17 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-14 11:17 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-14 11:17 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-14 11:17 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-14 11:17 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-14 11:17 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-14 11:17 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-14 11:17 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-14 11:17 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-14 11:17 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-14 11:17 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-14 11:17 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-14 11:17 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-14 11:17 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-14 11:17 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-14 11:17 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-14 11:16 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-14 11:16 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-14 11:16 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-14 11:16 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-14 11:16 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-14 11:16 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-14 11:16 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-14 11:16 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-12 08:43 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-12 08:43 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-12 08:43 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-12 08:43 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-12 08:43 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-12 08:43 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-12 08:43 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

==================== One Month Modified Files and Folders =======

2013-08-07 22:00 - 2009-07-14 06:45 - 00024912 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-07 22:00 - 2009-07-14 06:45 - 00024912 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-07 21:59 - 2013-08-07 21:56 - 01789861 _____ (Farbar) C:\Users\Samy\Desktop\FRST64.exe
2013-08-07 21:58 - 2011-02-11 10:21 - 00669012 _____ C:\Windows\system32\perfh007.dat
2013-08-07 21:58 - 2011-02-11 10:21 - 00134796 _____ C:\Windows\system32\perfc007.dat
2013-08-07 21:58 - 2009-07-14 07:13 - 01527002 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-07 21:54 - 2012-02-11 22:28 - 00000000 ____D C:\Users\Samy\AppData\Roaming\Skype
2013-08-07 21:50 - 2013-08-07 21:50 - 00003436 _____ C:\Windows\System32\Tasks\BrowserDefendert
2013-08-07 21:50 - 2013-07-31 14:05 - 00001581 _____ C:\Windows\setupact.log
2013-08-07 21:50 - 2013-03-06 14:07 - 00000000 ___RD C:\Users\Samy\Dropbox
2013-08-07 21:50 - 2013-03-06 14:02 - 00000000 ____D C:\Users\Samy\AppData\Roaming\Dropbox
2013-08-07 21:50 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-07 21:48 - 2013-07-04 21:59 - 01610807 _____ C:\Windows\WindowsUpdate.log
2013-08-07 21:00 - 2013-07-31 16:46 - 00000004 _____ C:\Users\Samy\AppData\Roaming\cache.ini
2013-08-05 21:23 - 2013-08-05 21:23 - 00000000 ____D C:\FRST
2013-08-04 14:27 - 2013-08-04 14:27 - 00001614 _____ C:\Windows\PFRO.log
2013-08-04 14:27 - 2013-07-05 15:54 - 00000000 ____D C:\ProgramData\BrowserDefender
2013-07-31 14:05 - 2013-07-31 14:05 - 00000000 _____ C:\Windows\setuperr.log
2013-07-31 00:04 - 2011-08-03 10:55 - 00000000 ____D C:\Windows\Panther
2013-07-30 23:13 - 2013-07-30 22:40 - 00015543 _____ C:\Users\Samy\Desktop\architekt.odt
2013-07-29 23:18 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-07-28 18:51 - 2013-07-28 18:37 - 00000000 ____D C:\Users\Samy\Desktop\Urlaub Eltern 2013
2013-07-18 17:25 - 2013-07-18 17:25 - 00003072 ____H C:\Users\Samy\photothumb.db
2013-07-18 17:25 - 2012-02-11 22:22 - 00000000 ____D C:\Users\Samy
2013-07-18 17:24 - 2013-07-18 17:24 - 00024576 ____H C:\Users\Samy\Desktop\photothumb.db
2013-07-15 15:49 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-07-14 19:53 - 2009-07-14 06:45 - 00530648 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-14 19:51 - 2013-03-14 12:31 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-14 19:51 - 2013-03-14 12:31 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-14 19:48 - 2011-02-11 10:20 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2013-07-14 19:48 - 2010-11-21 09:17 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\SysWOW64\winrm
2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\SysWOW64\WCN
2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\SysWOW64\sysprep
2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\SysWOW64\slmgr
2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\SysWOW64\Printing_Admin_Scripts
2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\system32\winrm
2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\system32\WCN
2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\system32\slmgr
2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\system32\Printing_Admin_Scripts
2013-07-14 19:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Sidebar
2013-07-14 19:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-07-14 19:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-14 19:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar
2013-07-14 19:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-07-14 19:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\Setup
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\oobe
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\MUI
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\migwiz
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\Dism
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\com
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\sysprep
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\Setup
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\oobe
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\MUI
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\migwiz
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\Dism
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\com
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\servicing
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\System
2013-07-14 19:45 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\DVD Maker
2013-07-14 11:27 - 2012-04-24 19:04 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-14 11:18 - 2012-06-08 11:50 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-12 20:01 - 2013-01-27 14:57 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-07-12 20:01 - 2011-08-03 12:05 - 00000000 ____D C:\ProgramData\Skype
2013-07-11 23:14 - 2013-05-23 18:43 - 00000000 ____D C:\Users\Samy\Desktop\dom
2013-07-11 14:28 - 2013-07-02 18:53 - 00000000 ____D C:\Users\Samy\Desktop\steckbrief
2013-07-08 08:59 - 2012-06-03 20:58 - 00000000 ____D C:\Users\Samy\Desktop\FH Meschede
2013-07-08 08:58 - 2013-03-13 23:40 - 00000000 ____D C:\Users\Samy\Desktop\Rezepte

Files to move or delete:
====================
C:\Users\Samy\AppData\Roaming\cache.ini

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-14 17:58

==================== End Of Log ============================
--- --- ---

--- --- ---
Als nächstes gehe ich nun diese Addition.txt an.

markusg 07.08.2013 21:10
hi, poste logs immmer gleichzeitig, sonst muss ich hier immer umsonst reingucken da neue Logs angehangen werden an den vorherigen post.
Also nächster Post bitte mit der bearbeiteten TXT :-)

ataba 07.08.2013 21:47
sorry :-)

hat nun doch einige Zeit gedauer die TXT durchzugehen..

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-08-2013 06
Ran by Samy at 2013-08-07 22:05:05
Running from C:\Users\Samy\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

 
Adobe Flash Player 10 ActiveX (x32 Version: 10.1.102.64): nötig
Adobe Flash Player 11 Plugin (x32 Version: 11.6.602.171): nötig
Adobe Reader X (10.1.7) MUI (x32 Version: 10.1.7)      : nötig   
Apple Application Support (x32 Version: 2.1.9)          : nötig
Apple Mobile Device Support (Version: 5.2.0.6)                : nötig
Apple Software Update (x32 Version: 2.1.3.127)                : nötig
Atheros Bluetooth Filter Driver Package (Version: 1.00.007)        : nötig
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.36)        : nötig
Atheros Driver Installation Program (x32 Version: 9.2)                : nötig
AviSynth 2.6 (x32 Version: 2.6.0.2)                                : unbekannt
AvsP (x32)                                                        : unbekannt
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95)                        : unbekannt
Bejeweled 3 (x32 Version: 2.2.0.97)                                : unbekannt
Bluetooth Stack for Windows by Toshiba (Version: v8.00.04(T))        : unbekannt
Bonjour (Version: 3.0.0.10)                                        : nötig
BrowserDefender (x32)                                                : unbekannt
Canon MP550 series MP Drivers                                        : nötig
Chicken Invaders 3 - Revenge of the Yolk (x32 Version: 2.2.0.95) : unnötig
Chuzzle Deluxe (x32 Version: 2.2.0.95)                                : unbekannt
Conexant HD Audio (Version: 8.51.1.0)                                : unbekannt
D3DX10 (x32 Version: 15.4.2368.0902)                                : unbekannt
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32):nötig
Delta Chrome Toolbar (x32)                                        : unnötig
Delta toolbar  (x32 Version: 1.8.21.5)                                : unnötig
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95)                : unnötig
Dropbox (HKCU Version: 2.0.22)                                        : unbekannt
DVD slideshow GUI 0.9.5.4 (x32 Version: DVD slideshow GUI 0.9.5.4) : unbekannt
eaner (Version: 3.19)                                                : unbekannt
FATE (x32 Version: 2.2.0.97)                                        : unbekantt
Final Drive: Nitro (x32 Version: 2.2.0.95)                        : unnötig
Firebird SQL Server - MAGIX Edition (x32 Version: 2.1.31.0)        : unbekannt
FMS (x32)                                                        : unbekannt
Fotogalerie (x32 Version: 16.4.3508.0205)                        : nötig
Free YouTube to MP3 Converter version 3.12.5.628 (x32 Version: 3.12.5.628) : nötig
Galerie de photos (x32 Version: 16.4.3508.0205)                        : nötig
GUI for dvdauthor 1.07 (x32 Version: 1.07)                        : unbekannt
Haali Media Splitter (x32)                                        : unbekannt
Helix YUV Codecs (remove only) (x32)                                : unbekannt
High-Definition Video Playback (x32 Version: 7.3.10900.8.0)        : nötig
ImgBurn (x32 Version: 2.5.5.0)                                        : nötig
Insaniquarium Deluxe (x32 Version: 2.2.0.97)                        : unbekannt
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144) : nötig
Intel(R) Processor Graphics (x32 Version: 8.15.10.2353)                : nötig
Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004)        : nötig
iTunes (Version: 10.6.3.25)                                        : nötig
Java 7 Update 9 (x32 Version: 7.0.90)                                : nötig
Java Auto Updater (x32 Version: 2.1.9.0)                        : nötig
Java(TM) 6 Update 20 (x32 Version: 6.0.200)                        : nötig
JavaFX 2.1.1 (x32 Version: 2.1.1)                                : nötig
Junk Mail filter update (x32 Version: 16.4.3508.0205)                : nötig
Kurvenprofi 5.1.1 (x32)                                                : nötig
MAGIX Speed burnR (MSI) (Version: 7.0.2.6)                        : unbekannt
MAGIX Speed burnR (MSI) (x32 Version: 7.0.2.6)                        : unbekannt
MAGIX Video deluxe 2013 (Version: 12.0.0.32)                        : unbekannt
MAGIX Video deluxe 2013 (x32 Version: 12.0.0.32)                : unbekannt
ManyCam 3.1.21 (x32 Version: 3.1.21)                                : unbekannt
McAfee Security Scan Plus (x32 Version: 3.0.318.3)                : unnötig
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)        : nötig
Microsoft Application Error Reporting (Version: 12.0.6015.5000)        : nötig
Microsoft Office 2010 Service Pack 1 (SP1) (x32)                : nötig
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)        : nötig
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)                        : nötig
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)        : nötig
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.6029.1000)        : nötig
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)        : nötig
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)        : nötig
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)        : nötig
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)        : nötig
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)        : nötig
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)                : nötig
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)                : nötig
Microsoft Primary Interoperability Assemblies 2005 (x32 Version: 9.0.21022)        : unbekannt
Microsoft Silverlight (Version: 5.1.20513.0)                                        : unbekannt
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)                : unnötig
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)                : unnötig
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)                : unnötig
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)                : unnötig
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)        : unnötig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)        : unnötig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)        : unnötig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)        : unnötig
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (x32 Version: 10.0.30319)        : unnötig
Movie Maker (x32 Version: 16.4.3508.0205)                : nötig
Movie2KDownloader (x32 Version: 2.1 Build 26473)        : nötig
Mozilla Firefox 13.0.1 (x86 de) (x32 Version: 13.0.1)        : nötig
Mozilla Maintenance Service (x32 Version: 13.0.1)        : nötig
MSVCRT (x32 Version: 15.4.2862.0708)                        : unbekannt
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)                : unbekannt
MSVCRT110 (x32 Version: 16.4.1108.0727)                        : unbekannt
MSVCRT110_amd64 (Version: 16.4.1109.0912)                : unbekannt
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)        : unbekannt
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)        : unbekannt
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)        : unbekannt
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)                        : unbekannt
Nero 10 Movie ThemePack Basic (x32 Version: 10.6.10000.1.0)        : unnötig
Nero BackItUp 10 Help (CHM) (x32 Version: 10.6.10700)                : unnötig
Nero BurnRights 10 Help (CHM) (x32 Version: 10.6.10700)                : unnötig
Nero Control Center 10 (x32 Version: 10.6.12700.0.7)                : unnötig
Nero ControlCenter 10 Help (CHM) (x32 Version: 10.6.10800)        : unnötig
Nero Core Components 10 (x32 Version: 2.0.20000.9.12)                : unnötig
Nero Express 10 Help (CHM) (x32 Version: 10.6.10700)                : unnötig
Nero InfoTool 10 Help (CHM) (x32 Version: 10.6.10700)                : unnötig
Nero Multimedia Suite 10 Essentials (x32 Version: 10.6.10300)        : unnötig
Nero RescueAgent 10 Help (CHM) (x32 Version: 10.6.10800)        : unnötig
Nero StartSmart 10 Help (CHM) (x32 Version: 10.6.10700)                : unnötig
NeroKwikMedia Help (CHM) (x32 Version: 10.6.10900)                : unnötig
PDFCreator (x32 Version: 1.7.0)                                        : nötig
Penguins! (x32 Version: 2.2.0.95)                                : unbekannt
Photo Common (x32 Version: 16.4.3508.0205)                        : nötig
Photo Gallery (x32 Version: 16.4.3508.0205)                        : nötig
PhotoScape (x32)                                                : nötig
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95)        : unnötig
PlayReady PC Runtime amd64 (Version: 1.3.0)                        : unnötig
Polar Bowler (x32 Version: 2.2.0.97)                                : unnötig
Raccolta foto (x32 Version: 16.4.3508.0205)                        : nötig
Realtek USB 2.0 Reader Driver (x32 Version: 1.0.0.15)                : unbekannt
Screenshot Captor 3.26.01 (x32)                                        : nötig
SketchUp 8 (x32 Version: 3.0.16944)                                : unnötig
Skype™ 6.6 (x32 Version: 6.6.106)                                : nötig
Slingo Deluxe (x32 Version: 2.2.0.95)                                : unbekannt
Synaptics Pointing Device Driver (Version: 15.2.11.1)                : unbekannt
TOSHIBA Assist (x32 Version: 4.02.02)                                : unbekannt
TOSHIBA Bulletin Board (Version: 2.1.10.64)                        : unbekannt
TOSHIBA Bulletin Board (x32 Version: 2.1.10.64)                        : unbekannt
TOSHIBA ConfigFree (x32 Version: 8.0.37)                        : unbekannt
TOSHIBA Disc Creator (Version: 2.1.0.6 for x64)                        : unbekannt
TOSHIBA eco Utility (Version: 1.2.25.64)                        : unbekannt
TOSHIBA Face Recognition (Version: 3.1.8.64)                        : unbekannt
TOSHIBA Face Recognition (x32 Version: 3.1.8.64)                : unbekannt
TOSHIBA Hardware Setup (Version: 4.08.06.00)                        : unbekannt
TOSHIBA Hardware Setup (x32 Version: 4.08.06.00)                : unbekannt
TOSHIBA HDD/SSD Alert (Version: 3.1.64.7)                        : unbekannt
TOSHIBA HDD/SSD Alert (x32 Version: 3.1.64.7)                        : unbekannt
Toshiba Manuals (x32 Version: 10.02)                                : unbekannt
TOSHIBA Online Product Information (x32 Version: 4.01.0000)        : unbekannt
TOSHIBA PC Health Monitor (Version: 1.7.9.64M)                        : unbekannt
TOSHIBA Places Icon Utility (x32 Version: 1.1.1.4)                : unbekannt
TOSHIBA Recovery Media Creator (x32 Version: 2.1.3.10010)        : unbekannt
TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.00.0019): unbekannt
TOSHIBA ReelTime (Version: 1.7.17.64)                                : unbekannt
TOSHIBA ReelTime (x32 Version: 1.7.17.64)                        : unbekannt
TOSHIBA Service Station (x32 Version: 2.2.9)                        : unbekannt
TOSHIBA Sleep Utility (x32 Version: 1.4.2.7)                        : unbekannt
TOSHIBA Supervisor Password (Version: 4.08.06.00)                : unbekannt
TOSHIBA Supervisor Password (x32 Version: 4.08.06.00)                : unbekannt
TOSHIBA TEMPRO (x32 Version: 3.35)                                : unbekannt
TOSHIBA Value Added Package (Version: 1.5.4.64)                        : unbekannt
TOSHIBA Value Added Package (x32 Version: 1.5.4.64)                : unbekannt
TOSHIBA Web Camera Application (x32 Version: 2.0.0.19)                : unbekannt
TOSHIBA Wireless LAN Indicator (x32 Version: 1.0.3)                : unbekannt
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)        : unbekannt
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)        : unbekannt
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)        : unbekannt
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)        : unbekannt
Update for Microsoft Office 2010 (KB2553065) (x32)
Update for Microsoft Office 2010 (KB2553092) (x32)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2566458) (x32)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition (x32)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
Update Installer for WildTangent Games App (x32)                        : unnötig
Wedding Dash 2 - Rings Around the World (x32 Version: 2.2.0.95)                : unnötig
WildTangent Games (x32 Version: 1.0.2.5)                                : unnötig
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.5.36)                : unnötig
Windows Live (x32 Version: 16.4.3508.0205)                                : unnötig
Windows Live Communications Platform (x32 Version: 16.4.3508.0205)        : unnötig
Windows Live Essentials (x32 Version: 16.4.3508.0205)                        : unnötig
Windows Live Family Safety (Version: 16.4.3508.0205)                        : unnötig
Windows Live Family Safety (x32 Version: 16.4.3508.0205)                : unnötig
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)                : unnötig
Windows Live Installer (x32 Version: 16.4.3508.0205)                        : unnötig
Windows Live Mail (x32 Version: 16.4.3508.0205)                                : unnötig
Windows Live Messenger (x32 Version: 16.4.3508.0205)                        : unnötig
Windows Live MIME IFilter (Version: 16.4.3508.0205)                        : unnötig
Windows Live Photo Common (x32 Version: 16.4.3508.0205)                        : unnötig
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205)                : unnötig
Windows Live SOXE (x32 Version: 16.4.3508.0205)                                : unnötig
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205)                : unnötig
Windows Live UX Platform (x32 Version: 16.4.3508.0205)                        : unnötig
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205)        : unnötig
Windows Live Writer (x32 Version: 16.4.3508.0205)                        : unnötig
Windows Live Writer Resources (x32 Version: 16.4.3508.0205)                : unnötig
WXTide32 (x32)                                                                : unnötig
Zuma Deluxe (x32 Version: 2.2.0.95)                                        : unnötig

==================== Restore Points  =========================

14-07-2013 09:06:33 Windows Modules Installer
14-07-2013 16:08:04 Sprachpaketdeinstallation
16-07-2013 09:25:55 Windows Update
19-07-2013 11:43:16 Windows Update
24-07-2013 07:05:31 Windows Update
29-07-2013 23:45:30 Windows Update
04-08-2013 12:40:23 Windows Update
07-08-2013 18:29:07 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {1651C67A-3E2C-4D17-AF36-DE63DF4B032D} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {58F48707-CB3C-4010-8BEC-4381EC4BA1ED} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2010-12-03] (TOSHIBA CORPORATION)
Task: {5A66AE0F-5A92-4E47-AE46-EAAEA6A63047} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {63E93C93-6AC2-4E1E-831C-D36613B655C8} - System32\Tasks\EPUpdater => C:\Users\Samy\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe [2013-06-06] ()
Task: {94671AFF-6192-4FE5-8680-474AE2104F6D} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: {B731B22E-FC7D-49BC-8183-0F2DC551D28A} - System32\Tasks\File Helper => C:\Program Files (x86)\File Helper\File Helper.lnk No File
Task: {E279A6E4-A01A-45D8-A3E9-644ED470BAE4} - System32\Tasks\BrowserDefendert => C:\Windows\system32\sc.exe [2009-07-14] (Microsoft Corporation)
Task: {E8F0C63D-1010-4D45-AB5F-5309F9A8A328} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2214768358-217717142-1947330960-1000
Task: {F366CFC1-9543-4161-BABC-83C641F42AA5} - System32\Tasks\Microsoft\Windows Defender\MpIdleTask => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: C:\Windows\Tasks\File Helper.job => ?

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/07/2013 09:51:17 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/07/2013 09:36:06 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/07/2013 08:25:37 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2013 10:27:32 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2013 10:26:33 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000005124a
ID des fehlerhaften Prozesses: 0x6e0
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (08/05/2013 09:20:04 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2013 09:10:50 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2013 09:07:11 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2013 08:53:45 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/04/2013 02:55:59 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (08/07/2013 09:50:53 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80004005

Error: (08/07/2013 08:24:34 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Kaspersky Security Suite CBE 11 Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (08/07/2013 08:24:34 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Kaspersky Security Suite CBE 11 Service erreicht.

Error: (08/05/2013 09:23:32 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (08/05/2013 09:23:32 PM) (Source: DCOM) (User: )
Description: 1068netprofm{A47979D2-C419-11D9-A5B4-001185AD2B89}

Error: (08/05/2013 09:20:07 PM) (Source: DCOM) (User: )
Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error: (08/05/2013 09:18:37 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AFD
DfsC
discache
kl2
KLIF
KLIM6
NetBIOS
NetBT
nsiproxy
Psched
rdbss
spldr
tdx
vwififlt
Wanarpv6
WfpLwf

Error: (08/05/2013 09:18:23 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NLA (Network Location Awareness)" ist vom Dienst "Netzwerkspeicher-Schnittstellendienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (08/05/2013 09:18:23 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SMB 2.0-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (08/05/2013 09:18:23 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SMB 1.x-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068


Microsoft Office Sessions:
=========================
Error: (08/07/2013 09:51:17 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/07/2013 09:36:06 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/07/2013 08:25:37 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2013 10:27:32 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2013 10:26:33 PM) (Source: Application Error)(User: )
Description: Explorer.EXE6.1.7601.175674d672ee4ntdll.dll6.1.7601.177254ec4aa8ec0000005000000000005124a6e001ce9219ff2fb177C:\Windows\Explorer.EXEC:\Windows\SYSTEM32\ntdll.dll5136fe3e-fe0d-11e2-9734-e89a8fdfbf9b

Error: (08/05/2013 09:20:04 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2013 09:10:50 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2013 09:07:11 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2013 08:53:45 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/04/2013 02:55:59 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info ===========================

Percentage of memory in use: 31%
Total physical RAM: 4043.86 MB
Available physical RAM: 2777.06 MB
Total Pagefile: 8085.9 MB
Available Pagefile: 6740.68 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (WINDOWS) (Fixed) (Total:232.34 GB) (Free:170.7 GB) NTFS (Disk=0 Partition=2)
Drive d: (Data) (Fixed) (Total:233.03 GB) (Free:198.55 GB) NTFS (Disk=0 Partition=3)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 3C96D6C9)
Partition 1: (Active) - (Size=399 MB) - (Type=27)
Partition 2: (Not Active) - (Size=232 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=233 GB) - (Type=07 NTFS)

==================== End Of Log ============================

markusg 07.08.2013 22:07
Hi,
bitte beachtet beide bei instalationen:
- instaliert Software nur von der Herstellerseite.
- Googled die jeweilige Software und das Stichwort Adware, um Instalationen die Toolbars mitbringen auszufiltern.
- Lest die Lizenzverträge (AGB's) und sucht nach Drittanbietersoftware.
- instaliert immer Benutzerdefiniert, und wählt evtl. Toolbars ab.
Diese Plage wird immer schlimmer im Moment und da seit ihr als nutzer gefragt.
es sind 2 Logs zu erstellen, möglichst gleichzeitig posten!
Falls es Probleme beim deinstalieren gibt, nutzt Rewo:
Revo Uninstaller - Download - Filepony

1.
deinstaliere:
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden, instalieren.
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen
bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
Sicherheit (erweitert)
Erweiterte Sicherheit anhaken
und alle Dateien auswählen.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
AviSynth
AvsP
Bejeweled : beide
BrowserDefender
Chicken
Chuzzle
Delta : beide
Diner
Dropbox
DVD
Final
Insaniquarium
Java 7
Java(TM)
downloade Java jre:
Java-Downloads für alle Betriebssysteme
klicke:
Download der Java-Software für Windows Offline
laden, und instalieren
deinstaliere:
MAGIX : alle
McAfee
Movie2KDownloader : weg damit, hau deiner Tochter gleich mal auf die Finger, movie2k und andere Streamingseiten sind illegal, dass dem so ist, kann man schon rausfinden, in dem dort Kinofilme gezeigt werden, da kann schon was nicht stimmen, die Leute geben das Zeug nich kostenlos raus da wird ordendlich Malware verteilt, + natürlich der Werbung.
Mozilla Firefox : öffnen, Hilfe, Update, Version 23 ist aktuell.

deinstaliere:
Nero: alle
Penguins
Plants vs
Polar Bowler
SketchUp
Slingo Deluxe
Wedding
WildTangent : beide
Windows Live : alle für dich unnötigen.
Zuma

Neustarten.
2.
Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.


3.
Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

ataba 11.08.2013 12:51
Hi,
folgend Ergebnis Combofix:
Code:
Combofix Logfile:

       
Code:

       
ComboFix 13-08-11.01 - Samy 11.08.2013  13:25:12.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4044.2578 [GMT 2:00]
ausgeführt von:: c:\users\Samy\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Samy\AppData\Roaming\Avisynth.exe
c:\users\Samy\AppData\Roaming\AvsP.exe
c:\users\Samy\AppData\Roaming\ImgBurn.exe
c:\users\Samy\AppData\Roaming\MatroskaSplitter.exe
c:\users\Samy\AppData\Roaming\SetupGFD.exe
c:\users\Samy\AppData\Roaming\yuvcodecs-1.3.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-07-11 bis 2013-08-11  ))))))))))))))))))))))))))))))
.
.
2013-08-11 11:30 . 2013-08-11 11:30        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-08-11 10:40 . 2013-08-11 10:40        --------        d-----w-        c:\program files (x86)\VS Revo Group
2013-08-11 10:25 . 2013-08-11 10:25        74136        ----a-w-        c:\program files (x86)\Mozilla Firefox\breakpadinjector.dll
2013-08-11 10:25 . 2013-08-11 10:25        262552        ----a-w-        c:\program files (x86)\Mozilla Firefox\browser\components\browsercomps.dll
2013-08-11 10:25 . 2013-08-11 10:25        92056        ----a-w-        c:\program files (x86)\Mozilla Firefox\webapprt-stub.exe
2013-08-11 10:25 . 2013-08-11 10:25        26520        ----a-w-        c:\program files (x86)\Mozilla Firefox\plugin-hang-ui.exe
2013-08-11 10:25 . 2013-08-11 10:25        170232        ----a-w-        c:\program files (x86)\Mozilla Firefox\webapp-uninstaller.exe
2013-08-11 10:20 . 2013-08-11 10:20        972712        ----a-w-        c:\windows\system32\deployJava1.dll
2013-08-11 10:20 . 2013-08-11 10:20        312232        ----a-w-        c:\windows\system32\javaws.exe
2013-08-11 10:20 . 2013-08-11 10:20        1093032        ----a-w-        c:\windows\system32\npDeployJava1.dll
2013-08-11 10:20 . 2013-08-11 10:20        108968        ----a-w-        c:\windows\system32\WindowsAccessBridge-64.dll
2013-08-11 10:20 . 2013-08-11 10:20        189352        ----a-w-        c:\windows\system32\javaw.exe
2013-08-11 10:20 . 2013-08-11 10:20        188840        ----a-w-        c:\windows\system32\java.exe
2013-08-11 10:20 . 2013-08-11 10:20        --------        d-----w-        c:\program files\Java
2013-08-11 10:00 . 2013-07-02 08:34        9460976        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{DB12DF67-631B-4DBB-B1A2-6E91A9CF749F}\mpengine.dll
2013-08-07 21:29 . 2013-08-07 21:29        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-07 21:29 . 2013-08-07 21:29        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2013-08-05 19:23 . 2013-08-05 19:23        --------        d-----w-        C:\FRST
2013-07-14 09:16 . 2013-06-11 23:43        817664        ----a-w-        c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
2013-07-14 09:16 . 2013-06-11 23:43        108032        ----a-w-        c:\program files (x86)\Internet Explorer\jsdebuggeride.dll
2013-07-14 09:16 . 2013-06-11 23:26        1084928        ----a-w-        c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-07-14 09:16 . 2013-06-11 23:43        1767936        ----a-w-        c:\windows\SysWow64\wininet.dll
2013-07-14 09:16 . 2013-06-11 23:25        53248        ----a-w-        c:\windows\system32\jsproxy.dll
2013-07-14 09:16 . 2013-06-11 23:26        2241024        ----a-w-        c:\windows\system32\wininet.dll
2013-07-14 09:16 . 2013-06-11 23:25        15404032        ----a-w-        c:\windows\system32\ieframe.dll
2013-07-14 09:16 . 2013-06-11 23:25        19238912        ----a-w-        c:\windows\system32\mshtml.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-14 09:18 . 2012-06-08 09:50        78185248        ----a-w-        c:\windows\system32\MRT.exe
2013-07-02 20:26 . 2013-07-02 20:26        34936        ----a-w-        c:\windows\SysWow64\uninstHelixYUV.exe
2013-07-02 19:46 . 2007-04-27 08:43        120200        ----a-w-        c:\windows\SysWow64\DLLDEV32i.dll
2013-06-08 06:17 . 2013-06-08 06:17        719360        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll
2013-06-08 06:17 . 2013-06-08 06:17        226304        ----a-w-        c:\windows\system32\elshyph.dll
2013-06-08 06:17 . 2013-06-08 06:17        185344        ----a-w-        c:\windows\SysWow64\elshyph.dll
2013-06-08 06:17 . 2013-06-08 06:17        158720        ----a-w-        c:\windows\SysWow64\msls31.dll
2013-06-08 06:17 . 2013-06-08 06:17        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe
2013-06-08 06:17 . 2013-06-08 06:17        138752        ----a-w-        c:\windows\SysWow64\wextract.exe
2013-06-08 06:17 . 2013-06-08 06:17        1054720        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe
2013-06-08 06:17 . 2013-06-08 06:17        73728        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe
2013-06-08 06:17 . 2013-06-08 06:17        61952        ----a-w-        c:\windows\SysWow64\tdc.ocx
2013-06-08 06:17 . 2013-06-08 06:17        523264        ----a-w-        c:\windows\SysWow64\vbscript.dll
2013-06-08 06:17 . 2013-06-08 06:17        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll
2013-06-08 06:17 . 2013-06-08 06:17        38400        ----a-w-        c:\windows\SysWow64\imgutil.dll
2013-06-08 06:17 . 2013-06-08 06:17        361984        ----a-w-        c:\windows\SysWow64\html.iec
2013-06-08 06:17 . 2013-06-08 06:17        23040        ----a-w-        c:\windows\SysWow64\licmgr10.dll
2013-06-08 06:17 . 2013-06-08 06:17        1441280        ----a-w-        c:\windows\SysWow64\inetcpl.cpl
2013-06-08 06:17 . 2013-06-08 06:17        137216        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2013-06-08 06:17 . 2013-06-08 06:17        12800        ----a-w-        c:\windows\SysWow64\mshta.exe
2013-06-08 06:17 . 2013-06-08 06:17        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll
2013-06-08 06:17 . 2013-06-08 06:17        905728        ----a-w-        c:\windows\system32\mshtmlmedia.dll
2013-06-08 06:17 . 2013-06-08 06:17        81408        ----a-w-        c:\windows\system32\icardie.dll
2013-06-08 06:17 . 2013-06-08 06:17        762368        ----a-w-        c:\windows\system32\ieapfltr.dll
2013-06-08 06:17 . 2013-06-08 06:17        452096        ----a-w-        c:\windows\system32\dxtmsft.dll
2013-06-08 06:17 . 2013-06-08 06:17        441856        ----a-w-        c:\windows\system32\html.iec
2013-06-08 06:17 . 2013-06-08 06:17        281600        ----a-w-        c:\windows\system32\dxtrans.dll
2013-06-08 06:17 . 2013-06-08 06:17        235008        ----a-w-        c:\windows\system32\url.dll
2013-06-08 06:17 . 2013-06-08 06:17        216064        ----a-w-        c:\windows\system32\msls31.dll
2013-06-08 06:17 . 2013-06-08 06:17        197120        ----a-w-        c:\windows\system32\msrating.dll
2013-06-08 06:17 . 2013-06-08 06:17        1400416        ----a-w-        c:\windows\system32\ieapfltr.dat
2013-06-08 06:17 . 2013-06-08 06:17        97280        ----a-w-        c:\windows\system32\mshtmled.dll
2013-06-08 06:17 . 2013-06-08 06:17        92160        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe
2013-06-08 06:17 . 2013-06-08 06:17        77312        ----a-w-        c:\windows\system32\tdc.ocx
2013-06-08 06:17 . 2013-06-08 06:17        62976        ----a-w-        c:\windows\system32\pngfilt.dll
2013-06-08 06:17 . 2013-06-08 06:17        599552        ----a-w-        c:\windows\system32\vbscript.dll
2013-06-08 06:17 . 2013-06-08 06:17        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll
2013-06-08 06:17 . 2013-06-08 06:17        51200        ----a-w-        c:\windows\system32\imgutil.dll
2013-06-08 06:17 . 2013-06-08 06:17        48640        ----a-w-        c:\windows\system32\mshtmler.dll
2013-06-08 06:17 . 2013-06-08 06:17        27648        ----a-w-        c:\windows\system32\licmgr10.dll
2013-06-08 06:17 . 2013-06-08 06:17        270848        ----a-w-        c:\windows\system32\iedkcs32.dll
2013-06-08 06:17 . 2013-06-08 06:17        247296        ----a-w-        c:\windows\system32\webcheck.dll
2013-06-08 06:17 . 2013-06-08 06:17        173568        ----a-w-        c:\windows\system32\ieUnatt.exe
2013-06-08 06:17 . 2013-06-08 06:17        167424        ----a-w-        c:\windows\system32\iexpress.exe
2013-06-08 06:17 . 2013-06-08 06:17        1509376        ----a-w-        c:\windows\system32\inetcpl.cpl
2013-06-08 06:17 . 2013-06-08 06:17        149504        ----a-w-        c:\windows\system32\occache.dll
2013-06-08 06:17 . 2013-06-08 06:17        144896        ----a-w-        c:\windows\system32\wextract.exe
2013-06-08 06:17 . 2013-06-08 06:17        13824        ----a-w-        c:\windows\system32\mshta.exe
2013-06-08 06:17 . 2013-06-08 06:17        136192        ----a-w-        c:\windows\system32\iepeers.dll
2013-06-08 06:17 . 2013-06-08 06:17        135680        ----a-w-        c:\windows\system32\IEAdvpack.dll
2013-06-08 06:17 . 2013-06-08 06:17        12800        ----a-w-        c:\windows\system32\msfeedssync.exe
2013-06-08 06:17 . 2013-06-08 06:17        102912        ----a-w-        c:\windows\system32\inseng.dll
2013-06-05 03:34 . 2013-07-12 06:43        3153920        ----a-w-        c:\windows\system32\win32k.sys
2013-06-04 06:00 . 2013-07-12 06:43        624128        ----a-w-        c:\windows\system32\qedit.dll
2013-06-04 04:53 . 2013-07-12 06:43        509440        ----a-w-        c:\windows\SysWow64\qedit.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2013-06-28 14:56        279552        ----a-w-        c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"TOPI.EXE"="c:\program files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe" [2011-05-16 846936]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe [2009-9-1 481184]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 BtFilter;Bluetooth LowerFilter Class Filter Driver;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 RSUSBVSTOR;RTSUVSTOR.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTSUVSTOR.sys;c:\windows\SYSNATIVE\Drivers\RTSUVSTOR.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe;c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe [x]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [x]
R3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [x]
S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [x]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe;c:\program files\TOSHIBA\TECO\TecoService.exe [x]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys;c:\windows\SYSNATIVE\DRIVERS\TVALZFL.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 ManyCam;ManyCam Virtual Webcam;c:\windows\system32\DRIVERS\mcvidrv_x64.sys;c:\windows\SYSNATIVE\DRIVERS\mcvidrv_x64.sys [x]
S3 mcaudrv_simple;ManyCam Virtual Microphone;c:\windows\system32\drivers\mcaudrv_x64.sys;c:\windows\SYSNATIVE\drivers\mcaudrv_x64.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys;c:\windows\SYSNATIVE\DRIVERS\pgeffect.sys [x]
S3 QIOMem;Generic IO & Memory Access;c:\windows\system32\drivers\QIOMem.sys;c:\windows\SYSNATIVE\drivers\QIOMem.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2013-06-28 14:56        339456        ----a-w-        c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-07 167256]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-07 391000]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-07 418136]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-12-14 316032]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Zu TOSHIBA Bulletin Board hinzufügen - c:\program files\TOSHIBA\BulletinBoard\TosBBCom.dll/1000
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\
FF - prefs.js: browser.startup.homepage - www.google.de
FF - ExtSQL: 2013-07-05 15:53; {ACAA314B-EEBA-48e4-AD47-84E31C44796C}; c:\program files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF - user.js: extensions.delta.tlbrSrchUrl -
FF - user.js: extensions.delta.id - e249378800000000000074de2b1d9015
FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
FF - user.js: extensions.delta.instlDay - 15891
FF - user.js: extensions.delta.vrsn - 1.8.21.5
FF - user.js: extensions.delta.vrsni - 1.8.21.5
FF - user.js: extensions.delta.vrsnTs - 1.8.21.515:54
FF - user.js: extensions.delta.prtnrId - delta
FF - user.js: extensions.delta.prdct - delta
FF - user.js: extensions.delta.aflt - babsst
FF - user.js: extensions.delta.smplGrp - none
FF - user.js: extensions.delta.tlbrId - base
FF - user.js: extensions.delta.instlRef - sst
FF - user.js: extensions.delta.dfltLng - de
FF - user.js: extensions.delta.excTlbr - false
FF - user.js: extensions.delta.ffxUnstlRst - true
FF - user.js: extensions.delta.admin - false
FF - user.js: extensions.delta_i.babTrack - affID=121563&tt=040713_ifrmful&tsp=4934
FF - user.js: extensions.delta_i.babExt -
FF - user.js: extensions.delta_i.srcExt - ss
FF - user.js: extensions.delta.autoRvrt - false
FF - user.js: extensions.delta.rvrt - false
FF - user.js: extensions.delta.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
AddRemove-HelixYUVCodecs - c:\windows\system32\uninstHelixYUV.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-08-11  13:33:06
ComboFix-quarantined-files.txt  2013-08-11 11:33
.
Vor Suchlauf: 11 Verzeichnis(se), 188.010.033.152 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 187.641.143.296 Bytes frei
.
- - End Of File - - 3756892BF8D868DAB31D5F146B58F3DB

--- --- ---
D41D8CD98F00B204E9800998ECF8427E
und hier noch das Ergebnis TDDSKiller:
Code:
13:40:24.0611 3472  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
13:40:24.0807 3472  ============================================================
13:40:24.0807 3472  Current date / time: 2013/08/11 13:40:24.0807
13:40:24.0807 3472  SystemInfo:
13:40:24.0807 3472 
13:40:24.0807 3472  OS Version: 6.1.7601 ServicePack: 1.0
13:40:24.0807 3472  Product type: Workstation
13:40:24.0807 3472  ComputerName: SAMY-TOSH
13:40:24.0807 3472  UserName: Samy
13:40:24.0807 3472  Windows directory: C:\Windows
13:40:24.0807 3472  System windows directory: C:\Windows
13:40:24.0807 3472  Running under WOW64
13:40:24.0807 3472  Processor architecture: Intel x64
13:40:24.0807 3472  Number of processors: 4
13:40:24.0807 3472  Page size: 0x1000
13:40:24.0807 3472  Boot type: Normal boot
13:40:24.0807 3472  ============================================================
13:40:25.0140 3472  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
13:40:25.0144 3472  ============================================================
13:40:25.0144 3472  \Device\Harddisk0\DR0:
13:40:25.0145 3472  MBR partitions:
13:40:25.0145 3472  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0xC8000, BlocksNum 0x1D0AE800
13:40:25.0145 3472  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1D176800, BlocksNum 0x1D20F800
13:40:25.0145 3472  ============================================================
13:40:25.0165 3472  C: <-> \Device\Harddisk0\DR0\Partition1
13:40:25.0205 3472  D: <-> \Device\Harddisk0\DR0\Partition2
13:40:25.0205 3472  ============================================================
13:40:25.0205 3472  Initialize success
13:40:25.0205 3472  ============================================================
13:43:05.0438 3048  ============================================================
13:43:05.0438 3048  Scan started
13:43:05.0438 3048  Mode: Manual; SigCheck; TDLFS;
13:43:05.0438 3048  ============================================================
13:43:05.0742 3048  ================ Scan system memory ========================
13:43:05.0743 3048  System memory - ok
13:43:05.0743 3048  ================ Scan services =============================
13:43:06.0202 3048  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
13:43:06.0254 3048  1394ohci - ok
13:43:06.0289 3048  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
13:43:06.0302 3048  ACPI - ok
13:43:06.0326 3048  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
13:43:06.0396 3048  AcpiPmi - ok
13:43:06.0529 3048  [ ADDA5E1951B90D3D23C56D3CF0622ADC ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
13:43:06.0538 3048  AdobeARMservice - ok
13:43:06.0592 3048  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx        C:\Windows\system32\drivers\adp94xx.sys
13:43:06.0607 3048  adp94xx - ok
13:43:06.0676 3048  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci        C:\Windows\system32\drivers\adpahci.sys
13:43:06.0689 3048  adpahci - ok
13:43:06.0695 3048  [ E109549C90F62FB570B9540C4B148E54 ] adpu320        C:\Windows\system32\drivers\adpu320.sys
13:43:06.0705 3048  adpu320 - ok
13:43:06.0728 3048  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
13:43:06.0778 3048  AeLookupSvc - ok
13:43:06.0824 3048  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD            C:\Windows\system32\drivers\afd.sys
13:43:06.0864 3048  AFD - ok
13:43:06.0906 3048  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys
13:43:06.0915 3048  agp440 - ok
13:43:06.0957 3048  [ 3290D6946B5E30E70414990574883DDB ] ALG            C:\Windows\System32\alg.exe
13:43:06.0981 3048  ALG - ok
13:43:07.0029 3048  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys
13:43:07.0037 3048  aliide - ok
13:43:07.0040 3048  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys
13:43:07.0048 3048  amdide - ok
13:43:07.0061 3048  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8          C:\Windows\system32\drivers\amdk8.sys
13:43:07.0071 3048  AmdK8 - ok
13:43:07.0075 3048  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys
13:43:07.0106 3048  AmdPPM - ok
13:43:07.0125 3048  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
13:43:07.0135 3048  amdsata - ok
13:43:07.0152 3048  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
13:43:07.0166 3048  amdsbs - ok
13:43:07.0182 3048  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata        C:\Windows\system32\drivers\amdxata.sys
13:43:07.0191 3048  amdxata - ok
13:43:07.0205 3048  [ 89A69C3F2F319B43379399547526D952 ] AppID          C:\Windows\system32\drivers\appid.sys
13:43:07.0265 3048  AppID - ok
13:43:07.0286 3048  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
13:43:07.0319 3048  AppIDSvc - ok
13:43:07.0344 3048  [ 9D2A2369AB4B08A4905FE72DB104498F ] Appinfo        C:\Windows\System32\appinfo.dll
13:43:07.0356 3048  Appinfo - ok
13:43:07.0495 3048  [ F401929EE0CC92BFE7F15161CA535383 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
13:43:07.0502 3048  Apple Mobile Device - ok
13:43:07.0567 3048  [ C484F8CEB1717C540242531DB7845C4E ] arc            C:\Windows\system32\drivers\arc.sys
13:43:07.0576 3048  arc - ok
13:43:07.0581 3048  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\drivers\arcsas.sys
13:43:07.0590 3048  arcsas - ok
13:43:07.0601 3048  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
13:43:07.0635 3048  AsyncMac - ok
13:43:07.0643 3048  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi          C:\Windows\system32\drivers\atapi.sys
13:43:07.0653 3048  atapi - ok
13:43:07.0743 3048  [ B2931C83CFB12A3223A47B180473AE1A ] athr            C:\Windows\system32\DRIVERS\athrx.sys
13:43:07.0794 3048  athr - ok
13:43:07.0847 3048  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
13:43:07.0908 3048  AudioEndpointBuilder - ok
13:43:07.0918 3048  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
13:43:07.0958 3048  AudioSrv - ok
13:43:07.0987 3048  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll
13:43:08.0051 3048  AxInstSV - ok
13:43:08.0101 3048  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv        C:\Windows\system32\drivers\bxvbda.sys
13:43:08.0133 3048  b06bdrv - ok
13:43:08.0171 3048  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
13:43:08.0203 3048  b57nd60a - ok
13:43:08.0247 3048  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll
13:43:08.0268 3048  BDESVC - ok
13:43:08.0282 3048  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
13:43:08.0330 3048  Beep - ok
13:43:08.0381 3048  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE            C:\Windows\System32\bfe.dll
13:43:08.0440 3048  BFE - ok
13:43:08.0487 3048  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\system32\qmgr.dll
13:43:08.0529 3048  BITS - ok
13:43:08.0571 3048  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\drivers\blbdrive.sys
13:43:08.0605 3048  blbdrive - ok
13:43:08.0701 3048  [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
13:43:08.0719 3048  Bonjour Service - ok
13:43:08.0764 3048  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
13:43:08.0800 3048  bowser - ok
13:43:08.0817 3048  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
13:43:08.0831 3048  BrFiltLo - ok
13:43:08.0849 3048  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
13:43:08.0863 3048  BrFiltUp - ok
13:43:08.0926 3048  [ 5C2F352A4E961D72518261257AAE204B ] BridgeMP        C:\Windows\system32\DRIVERS\bridge.sys
13:43:08.0971 3048  BridgeMP - ok
13:43:09.0006 3048  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser        C:\Windows\System32\browser.dll
13:43:09.0016 3048  Browser - ok
13:43:09.0040 3048  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
13:43:09.0069 3048  Brserid - ok
13:43:09.0074 3048  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
13:43:09.0098 3048  BrSerWdm - ok
13:43:09.0116 3048  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
13:43:09.0145 3048  BrUsbMdm - ok
13:43:09.0149 3048  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
13:43:09.0166 3048  BrUsbSer - ok
13:43:09.0211 3048  [ 2347ABBD13BADA65826FDAB4CAAFE357 ] BtFilter        C:\Windows\system32\DRIVERS\btfilter.sys
13:43:09.0228 3048  BtFilter - ok
13:43:09.0242 3048  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
13:43:09.0279 3048  BTHMODEM - ok
13:43:09.0319 3048  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv        C:\Windows\system32\bthserv.dll
13:43:09.0366 3048  bthserv - ok
13:43:09.0424 3048  catchme - ok
13:43:09.0447 3048  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
13:43:09.0500 3048  cdfs - ok
13:43:09.0522 3048  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
13:43:09.0546 3048  cdrom - ok
13:43:09.0592 3048  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc    C:\Windows\System32\certprop.dll
13:43:09.0642 3048  CertPropSvc - ok
13:43:09.0755 3048  [ 41E7C4FA6491747402CFCA77CC1C7AAB ] cfWiMAXService  C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
13:43:09.0765 3048  cfWiMAXService - ok
13:43:09.0807 3048  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\drivers\circlass.sys
13:43:09.0832 3048  circlass - ok
13:43:09.0867 3048  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys
13:43:09.0880 3048  CLFS - ok
13:43:10.0019 3048  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
13:43:10.0026 3048  clr_optimization_v2.0.50727_32 - ok
13:43:10.0125 3048  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
13:43:10.0133 3048  clr_optimization_v2.0.50727_64 - ok
13:43:10.0293 3048  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
13:43:10.0305 3048  clr_optimization_v4.0.30319_32 - ok
13:43:10.0474 3048  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
13:43:10.0488 3048  clr_optimization_v4.0.30319_64 - ok
13:43:10.0531 3048  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\drivers\CmBatt.sys
13:43:10.0564 3048  CmBatt - ok
13:43:10.0569 3048  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys
13:43:10.0578 3048  cmdide - ok
13:43:10.0625 3048  [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG            C:\Windows\system32\Drivers\cng.sys
13:43:10.0652 3048  CNG - ok
13:43:10.0756 3048  [ 66847C979893A11CFCC2280E772D7EA1 ] CnxtHdAudService C:\Windows\system32\drivers\CHDRT64.sys
13:43:10.0792 3048  CnxtHdAudService - ok
13:43:10.0822 3048  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys
13:43:10.0832 3048  Compbatt - ok
13:43:10.0849 3048  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
13:43:10.0882 3048  CompositeBus - ok
13:43:10.0902 3048  COMSysApp - ok
13:43:10.0927 3048  [ CAB0EEAF5295FC96DDD3E19DCE27E131 ] ConfigFree Service C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
13:43:10.0936 3048  ConfigFree Service - ok
13:43:10.0940 3048  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk        C:\Windows\system32\drivers\crcdisk.sys
13:43:10.0950 3048  crcdisk - ok
13:43:10.0997 3048  [ D8129C49798CBBFB2E4351D4B7B8EF9C ] CryptSvc        C:\Windows\system32\cryptsvc.dll
13:43:11.0009 3048  CryptSvc - ok
13:43:11.0048 3048  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll
13:43:11.0093 3048  DcomLaunch - ok
13:43:11.0127 3048  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc      C:\Windows\System32\defragsvc.dll
13:43:11.0189 3048  defragsvc - ok
13:43:11.0227 3048  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
13:43:11.0271 3048  DfsC - ok
13:43:11.0313 3048  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll
13:43:11.0345 3048  Dhcp - ok
13:43:11.0350 3048  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys
13:43:11.0398 3048  discache - ok
13:43:11.0442 3048  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\drivers\disk.sys
13:43:11.0451 3048  Disk - ok
13:43:11.0475 3048  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
13:43:11.0504 3048  Dnscache - ok
13:43:11.0523 3048  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc        C:\Windows\System32\dot3svc.dll
13:43:11.0582 3048  dot3svc - ok
13:43:11.0607 3048  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS            C:\Windows\system32\dps.dll
13:43:11.0663 3048  DPS - ok
13:43:11.0700 3048  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
13:43:11.0728 3048  drmkaud - ok
13:43:11.0783 3048  [ AF2E16242AA723F68F461B6EAE2EAD3D ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
13:43:11.0808 3048  DXGKrnl - ok
13:43:11.0860 3048  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost        C:\Windows\System32\eapsvc.dll
13:43:11.0899 3048  EapHost - ok
13:43:12.0026 3048  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv          C:\Windows\system32\drivers\evbda.sys
13:43:12.0076 3048  ebdrv - ok
13:43:12.0115 3048  [ C118A82CD78818C29AB228366EBF81C3 ] EFS            C:\Windows\System32\lsass.exe
13:43:12.0128 3048  EFS - ok
13:43:12.0267 3048  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
13:43:12.0318 3048  ehRecvr - ok
13:43:12.0359 3048  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched        C:\Windows\ehome\ehsched.exe
13:43:12.0407 3048  ehSched - ok
13:43:12.0500 3048  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor        C:\Windows\system32\drivers\elxstor.sys
13:43:12.0521 3048  elxstor - ok
13:43:12.0525 3048  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys
13:43:12.0552 3048  ErrDev - ok
13:43:12.0605 3048  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem    C:\Windows\system32\es.dll
13:43:12.0644 3048  EventSystem - ok
13:43:12.0657 3048  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat          C:\Windows\system32\drivers\exfat.sys
13:43:12.0691 3048  exfat - ok
13:43:12.0707 3048  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat        C:\Windows\system32\drivers\fastfat.sys
13:43:12.0757 3048  fastfat - ok
13:43:12.0797 3048  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax            C:\Windows\system32\fxssvc.exe
13:43:12.0837 3048  Fax - ok
13:43:12.0841 3048  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc            C:\Windows\system32\drivers\fdc.sys
13:43:12.0867 3048  fdc - ok
13:43:12.0908 3048  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost        C:\Windows\system32\fdPHost.dll
13:43:12.0953 3048  fdPHost - ok
13:43:12.0959 3048  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
13:43:13.0014 3048  FDResPub - ok
13:43:13.0054 3048  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
13:43:13.0066 3048  FileInfo - ok
13:43:13.0071 3048  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
13:43:13.0119 3048  Filetrace - ok
13:43:13.0123 3048  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys
13:43:13.0145 3048  flpydisk - ok
13:43:13.0185 3048  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
13:43:13.0199 3048  FltMgr - ok
13:43:13.0257 3048  [ C4C183E6551084039EC862DA1C945E3D ] FontCache      C:\Windows\system32\FntCache.dll
13:43:13.0284 3048  FontCache - ok
13:43:13.0320 3048  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
13:43:13.0327 3048  FontCache3.0.0.0 - ok
13:43:13.0342 3048  [ D43703496149971890703B4B1B723EAC ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
13:43:13.0352 3048  FsDepends - ok
13:43:13.0382 3048  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
13:43:13.0390 3048  Fs_Rec - ok
13:43:13.0427 3048  [ 8F6322049018354F45F05A2FD2D4E5E0 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
13:43:13.0442 3048  fvevol - ok
13:43:13.0488 3048  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
13:43:13.0497 3048  gagp30kx - ok
13:43:13.0531 3048  [ E403AACF8C7BB11375122D2464560311 ] GEARAspiWDM    C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
13:43:13.0538 3048  GEARAspiWDM - ok
13:43:13.0586 3048  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc          C:\Windows\System32\gpsvc.dll
13:43:13.0628 3048  gpsvc - ok
13:43:13.0641 3048  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
13:43:13.0670 3048  hcw85cir - ok
13:43:13.0699 3048  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
13:43:13.0734 3048  HdAudAddService - ok
13:43:13.0754 3048  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
13:43:13.0792 3048  HDAudBus - ok
13:43:13.0796 3048  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt        C:\Windows\system32\drivers\HidBatt.sys
13:43:13.0817 3048  HidBatt - ok
13:43:13.0821 3048  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\drivers\hidbth.sys
13:43:13.0848 3048  HidBth - ok
13:43:13.0883 3048  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr          C:\Windows\system32\drivers\hidir.sys
13:43:13.0895 3048  HidIr - ok
13:43:13.0929 3048  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv        C:\Windows\System32\hidserv.dll
13:43:13.0982 3048  hidserv - ok
13:43:14.0012 3048  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
13:43:14.0023 3048  HidUsb - ok
13:43:14.0044 3048  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll
13:43:14.0101 3048  hkmsvc - ok
13:43:14.0134 3048  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
13:43:14.0171 3048  HomeGroupListener - ok
13:43:14.0203 3048  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
13:43:14.0230 3048  HomeGroupProvider - ok
13:43:14.0253 3048  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
13:43:14.0262 3048  HpSAMD - ok
13:43:14.0288 3048  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
13:43:14.0342 3048  HTTP - ok
13:43:14.0361 3048  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
13:43:14.0369 3048  hwpolicy - ok
13:43:14.0382 3048  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
13:43:14.0392 3048  i8042prt - ok
13:43:14.0435 3048  [ D469B77687E12FE43E344806740B624D ] iaStor          C:\Windows\system32\DRIVERS\iaStor.sys
13:43:14.0448 3048  iaStor - ok
13:43:14.0482 3048  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
13:43:14.0497 3048  iaStorV - ok
13:43:14.0569 3048  [ DAF66902F08796F9C694901660E5A64A ] IDriverT        C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
13:43:14.0606 3048  IDriverT ( UnsignedFile.Multi.Generic ) - warning
13:43:14.0606 3048  IDriverT - detected UnsignedFile.Multi.Generic (1)
13:43:14.0681 3048  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc          C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
13:43:14.0702 3048  idsvc - ok
13:43:15.0010 3048  [ 370C2A8629B30F910F740387795DDC6F ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys
13:43:15.0194 3048  igfx - ok
13:43:15.0225 3048  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp          C:\Windows\system32\drivers\iirsp.sys
13:43:15.0236 3048  iirsp - ok
13:43:15.0274 3048  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll
13:43:15.0315 3048  IKEEXT - ok
13:43:15.0363 3048  [ FC727061C0F47C8059E88E05D5C8E381 ] IntcDAud        C:\Windows\system32\DRIVERS\IntcDAud.sys
13:43:15.0388 3048  IntcDAud - ok
13:43:15.0415 3048  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys
13:43:15.0426 3048  intelide - ok
13:43:15.0441 3048  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
13:43:15.0466 3048  intelppm - ok
13:43:15.0488 3048  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
13:43:15.0547 3048  IPBusEnum - ok
13:43:15.0551 3048  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
13:43:15.0590 3048  IpFilterDriver - ok
13:43:15.0636 3048  [ 08C2957BB30058E663720C5606885653 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
13:43:15.0670 3048  iphlpsvc - ok
13:43:15.0697 3048  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
13:43:15.0722 3048  IPMIDRV - ok
13:43:15.0731 3048  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
13:43:15.0781 3048  IPNAT - ok
13:43:15.0837 3048  [ A9AB99EE7D39725EAFEC82732D2B3271 ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe
13:43:15.0859 3048  iPod Service - ok
13:43:15.0890 3048  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
13:43:15.0918 3048  IRENUM - ok
13:43:15.0924 3048  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
13:43:15.0935 3048  isapnp - ok
13:43:15.0976 3048  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
13:43:15.0991 3048  iScsiPrt - ok
13:43:16.0009 3048  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
13:43:16.0022 3048  kbdclass - ok
13:43:16.0033 3048  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
13:43:16.0057 3048  kbdhid - ok
13:43:16.0081 3048  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe
13:43:16.0091 3048  KeyIso - ok
13:43:16.0123 3048  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
13:43:16.0132 3048  KSecDD - ok
13:43:16.0145 3048  [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
13:43:16.0155 3048  KSecPkg - ok
13:43:16.0195 3048  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk        C:\Windows\system32\drivers\ksthunk.sys
13:43:16.0242 3048  ksthunk - ok
13:43:16.0277 3048  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm          C:\Windows\system32\msdtckrm.dll
13:43:16.0335 3048  KtmRm - ok
13:43:16.0393 3048  [ EBED8B3FF4A823C1A6EEBEED7B29353F ] L1C            C:\Windows\system32\DRIVERS\L1C62x64.sys
13:43:16.0401 3048  L1C - ok
13:43:16.0450 3048  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\System32\srvsvc.dll
13:43:16.0497 3048  LanmanServer - ok
13:43:16.0515 3048  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
13:43:16.0564 3048  LanmanWorkstation - ok
13:43:16.0607 3048  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
13:43:16.0658 3048  lltdio - ok
13:43:16.0688 3048  [ C1185803384AB3FEED115F79F109427F ] lltdsvc        C:\Windows\System32\lltdsvc.dll
13:43:16.0741 3048  lltdsvc - ok
13:43:16.0747 3048  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts        C:\Windows\System32\lmhsvc.dll
13:43:16.0797 3048  lmhosts - ok
13:43:16.0879 3048  [ 2ED1786B7542CDA261029F6B526EDF44 ] LMS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
13:43:16.0891 3048  LMS - ok
13:43:16.0921 3048  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
13:43:16.0930 3048  LSI_FC - ok
13:43:16.0951 3048  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
13:43:16.0965 3048  LSI_SAS - ok
13:43:16.0970 3048  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
13:43:16.0979 3048  LSI_SAS2 - ok
13:43:16.0997 3048  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
13:43:17.0006 3048  LSI_SCSI - ok
13:43:17.0020 3048  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv          C:\Windows\system32\drivers\luafv.sys
13:43:17.0057 3048  luafv - ok
13:43:17.0118 3048  [ DE585D1D266805E5EEDAE911FDD16F38 ] ManyCam        C:\Windows\system32\DRIVERS\mcvidrv_x64.sys
13:43:17.0144 3048  ManyCam - ok
13:43:17.0183 3048  [ 2E7FFDEF8BAFD04CBB517507B821E878 ] mcaudrv_simple  C:\Windows\system32\drivers\mcaudrv_x64.sys
13:43:17.0209 3048  mcaudrv_simple - ok
13:43:17.0248 3048  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
13:43:17.0301 3048  Mcx2Svc - ok
13:43:17.0333 3048  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas        C:\Windows\system32\drivers\megasas.sys
13:43:17.0343 3048  megasas - ok
13:43:17.0354 3048  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
13:43:17.0368 3048  MegaSR - ok
13:43:17.0408 3048  [ A6518DCC42F7A6E999BB3BEA8FD87567 ] MEIx64          C:\Windows\system32\DRIVERS\HECIx64.sys
13:43:17.0416 3048  MEIx64 - ok
13:43:17.0587 3048  Microsoft SharePoint Workspace Audit Service - ok
13:43:17.0614 3048  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS          C:\Windows\system32\mmcss.dll
13:43:17.0684 3048  MMCSS - ok
13:43:17.0720 3048  [ 800BA92F7010378B09F9ED9270F07137 ] Modem          C:\Windows\system32\drivers\modem.sys
13:43:17.0764 3048  Modem - ok
13:43:17.0778 3048  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
13:43:17.0810 3048  monitor - ok
13:43:17.0828 3048  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
13:43:17.0836 3048  mouclass - ok
13:43:17.0842 3048  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
13:43:17.0872 3048  mouhid - ok
13:43:17.0914 3048  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
13:43:17.0924 3048  mountmgr - ok
13:43:18.0019 3048  [ E6DB6C61739E18906DC2C4191F6EDEA2 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
13:43:18.0029 3048  MozillaMaintenance - ok
13:43:18.0051 3048  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys
13:43:18.0062 3048  mpio - ok
13:43:18.0075 3048  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
13:43:18.0125 3048  mpsdrv - ok
13:43:18.0172 3048  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll
13:43:18.0231 3048  MpsSvc - ok
13:43:18.0256 3048  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
13:43:18.0294 3048  MRxDAV - ok
13:43:18.0320 3048  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
13:43:18.0368 3048  mrxsmb - ok
13:43:18.0401 3048  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
13:43:18.0419 3048  mrxsmb10 - ok
13:43:18.0442 3048  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
13:43:18.0452 3048  mrxsmb20 - ok
13:43:18.0463 3048  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\DRIVERS\msahci.sys
13:43:18.0472 3048  msahci - ok
13:43:18.0477 3048  [ DB801A638D011B9633829EB6F663C900 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
13:43:18.0487 3048  msdsm - ok
13:43:18.0506 3048  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC          C:\Windows\System32\msdtc.exe
13:43:18.0518 3048  MSDTC - ok
13:43:18.0537 3048  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
13:43:18.0585 3048  Msfs - ok
13:43:18.0589 3048  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
13:43:18.0633 3048  mshidkmdf - ok
13:43:18.0637 3048  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
13:43:18.0645 3048  msisadrv - ok
13:43:18.0685 3048  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
13:43:18.0734 3048  MSiSCSI - ok
13:43:18.0737 3048  msiserver - ok
13:43:18.0787 3048  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
13:43:18.0836 3048  MSKSSRV - ok
13:43:18.0840 3048  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
13:43:18.0874 3048  MSPCLOCK - ok
13:43:18.0878 3048  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
13:43:18.0917 3048  MSPQM - ok
13:43:18.0944 3048  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
13:43:18.0957 3048  MsRPC - ok
13:43:18.0966 3048  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
13:43:18.0975 3048  mssmbios - ok
13:43:18.0995 3048  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
13:43:19.0050 3048  MSTEE - ok
13:43:19.0074 3048  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
13:43:19.0105 3048  MTConfig - ok
13:43:19.0111 3048  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup            C:\Windows\system32\Drivers\mup.sys
13:43:19.0123 3048  Mup - ok
13:43:19.0163 3048  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll
13:43:19.0217 3048  napagent - ok
13:43:19.0269 3048  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
13:43:19.0304 3048  NativeWifiP - ok
13:43:19.0364 3048  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\Windows\system32\drivers\ndis.sys
13:43:19.0387 3048  NDIS - ok
13:43:19.0426 3048  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
13:43:19.0476 3048  NdisCap - ok
13:43:19.0494 3048  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
13:43:19.0526 3048  NdisTapi - ok
13:43:19.0541 3048  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
13:43:19.0572 3048  Ndisuio - ok
13:43:19.0577 3048  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
13:43:19.0631 3048  NdisWan - ok
13:43:19.0656 3048  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
13:43:19.0706 3048  NDProxy - ok
13:43:19.0724 3048  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
13:43:19.0772 3048  NetBIOS - ok
13:43:19.0808 3048  [ 09594D1089C523423B32A4229263F068 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
13:43:19.0841 3048  NetBT - ok
13:43:19.0860 3048  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe
13:43:19.0870 3048  Netlogon - ok
13:43:19.0925 3048  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll
13:43:19.0961 3048  Netman - ok
13:43:19.0985 3048  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll
13:43:20.0044 3048  netprofm - ok
13:43:20.0082 3048  [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
13:43:20.0090 3048  NetTcpPortSharing - ok
13:43:20.0129 3048  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960        C:\Windows\system32\drivers\nfrd960.sys
13:43:20.0138 3048  nfrd960 - ok
13:43:20.0174 3048  [ 8AD77806D336673F270DB31645267293 ] NlaSvc          C:\Windows\System32\nlasvc.dll
13:43:20.0209 3048  NlaSvc - ok
13:43:20.0214 3048  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
13:43:20.0250 3048  Npfs - ok
13:43:20.0281 3048  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi            C:\Windows\system32\nsisvc.dll
13:43:20.0334 3048  nsi - ok
13:43:20.0364 3048  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
13:43:20.0399 3048  nsiproxy - ok
13:43:20.0466 3048  [ B98F8C6E31CD07B2E6F71F7F648E38C0 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
13:43:20.0501 3048  Ntfs - ok
13:43:20.0519 3048  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys
13:43:20.0551 3048  Null - ok
13:43:20.0568 3048  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys
13:43:20.0578 3048  nvraid - ok
13:43:20.0593 3048  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys
13:43:20.0603 3048  nvstor - ok
13:43:20.0608 3048  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
13:43:20.0618 3048  nv_agp - ok
13:43:20.0631 3048  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
13:43:20.0642 3048  ohci1394 - ok
13:43:20.0743 3048  [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose            C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
13:43:20.0752 3048  ose - ok
13:43:20.0924 3048  [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc        C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
13:43:21.0007 3048  osppsvc - ok
13:43:21.0060 3048  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
13:43:21.0089 3048  p2pimsvc - ok
13:43:21.0114 3048  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll
13:43:21.0141 3048  p2psvc - ok
13:43:21.0174 3048  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport        C:\Windows\system32\drivers\parport.sys
13:43:21.0185 3048  Parport - ok
13:43:21.0218 3048  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr        C:\Windows\system32\drivers\partmgr.sys
13:43:21.0227 3048  partmgr - ok
13:43:21.0239 3048  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
13:43:21.0272 3048  PcaSvc - ok
13:43:21.0279 3048  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci            C:\Windows\system32\drivers\pci.sys
13:43:21.0290 3048  pci - ok
13:43:21.0315 3048  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\DRIVERS\pciide.sys
13:43:21.0324 3048  pciide - ok
13:43:21.0344 3048  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
13:43:21.0356 3048  pcmcia - ok
13:43:21.0380 3048  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw            C:\Windows\system32\drivers\pcw.sys
13:43:21.0388 3048  pcw - ok
13:43:21.0400 3048  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
13:43:21.0460 3048  PEAUTH - ok
13:43:21.0659 3048  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe
13:43:21.0689 3048  PerfHost - ok
13:43:21.0732 3048  [ 91111CEBBDE8015E822C46120ED9537C ] PGEffect        C:\Windows\system32\DRIVERS\pgeffect.sys
13:43:21.0739 3048  PGEffect - ok
13:43:21.0804 3048  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla            C:\Windows\system32\pla.dll
13:43:21.0858 3048  pla - ok
13:43:21.0906 3048  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
13:43:21.0936 3048  PlugPlay - ok
13:43:21.0975 3048  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
13:43:22.0009 3048  PNRPAutoReg - ok
13:43:22.0018 3048  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
13:43:22.0031 3048  PNRPsvc - ok
13:43:22.0068 3048  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
13:43:22.0122 3048  PolicyAgent - ok
13:43:22.0160 3048  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power          C:\Windows\system32\umpo.dll
13:43:22.0206 3048  Power - ok
13:43:22.0258 3048  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
13:43:22.0307 3048  PptpMiniport - ok
13:43:22.0328 3048  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor      C:\Windows\system32\drivers\processr.sys
13:43:22.0352 3048  Processor - ok
13:43:22.0389 3048  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc        C:\Windows\system32\profsvc.dll
13:43:22.0419 3048  ProfSvc - ok
13:43:22.0438 3048  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
13:43:22.0447 3048  ProtectedStorage - ok
13:43:22.0483 3048  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
13:43:22.0534 3048  Psched - ok
13:43:22.0576 3048  [ C8FCB4899F8B70CC34E0D9876A80963C ] QIOMem          C:\Windows\system32\drivers\QIOMem.sys
13:43:22.0615 3048  QIOMem - ok
13:43:22.0686 3048  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
13:43:22.0717 3048  ql2300 - ok
13:43:22.0723 3048  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
13:43:22.0733 3048  ql40xx - ok
13:43:22.0764 3048  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE          C:\Windows\system32\qwave.dll
13:43:22.0781 3048  QWAVE - ok
13:43:22.0786 3048  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
13:43:22.0813 3048  QWAVEdrv - ok
13:43:22.0831 3048  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
13:43:22.0882 3048  RasAcd - ok
13:43:22.0928 3048  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
13:43:22.0968 3048  RasAgileVpn - ok
13:43:22.0999 3048  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto        C:\Windows\System32\rasauto.dll
13:43:23.0058 3048  RasAuto - ok
13:43:23.0085 3048  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
13:43:23.0136 3048  Rasl2tp - ok
13:43:23.0160 3048  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll
13:43:23.0199 3048  RasMan - ok
13:43:23.0218 3048  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
13:43:23.0267 3048  RasPppoe - ok
13:43:23.0287 3048  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
13:43:23.0323 3048  RasSstp - ok
13:43:23.0344 3048  [ 77F665941019A1594D887A74F301FA2F ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
13:43:23.0437 3048  rdbss - ok
13:43:23.0443 3048  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\drivers\rdpbus.sys
13:43:23.0461 3048  rdpbus - ok
13:43:23.0467 3048  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
13:43:23.0499 3048  RDPCDD - ok
13:43:23.0522 3048  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
13:43:23.0555 3048  RDPENCDD - ok
13:43:23.0561 3048  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
13:43:23.0618 3048  RDPREFMP - ok
13:43:23.0655 3048  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
13:43:23.0679 3048  RDPWD - ok
13:43:23.0718 3048  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
13:43:23.0729 3048  rdyboost - ok
13:43:23.0752 3048  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
13:43:23.0798 3048  RemoteAccess - ok
13:43:23.0837 3048  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
13:43:23.0871 3048  RemoteRegistry - ok
13:43:23.0886 3048  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
13:43:23.0942 3048  RpcEptMapper - ok
13:43:23.0971 3048  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe
13:43:23.0981 3048  RpcLocator - ok
13:43:24.0003 3048  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs          C:\Windows\system32\rpcss.dll
13:43:24.0042 3048  RpcSs - ok
13:43:24.0066 3048  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
13:43:24.0120 3048  rspndr - ok
13:43:24.0190 3048  [ 135A64530D7699AD48F29D73A658DD11 ] RSUSBSTOR      C:\Windows\system32\Drivers\RtsUStor.sys
13:43:24.0200 3048  RSUSBSTOR - ok
13:43:24.0223 3048  [ E5DC911D0FEB72CAFF2BBDD6E7C3672F ] RSUSBVSTOR      C:\Windows\system32\Drivers\RTSUVSTOR.sys
13:43:24.0235 3048  RSUSBVSTOR - ok
13:43:24.0260 3048  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs          C:\Windows\system32\lsass.exe
13:43:24.0269 3048  SamSs - ok
13:43:24.0304 3048  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
13:43:24.0314 3048  sbp2port - ok
13:43:24.0345 3048  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
13:43:24.0395 3048  SCardSvr - ok
13:43:24.0400 3048  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
13:43:24.0448 3048  scfilter - ok
13:43:24.0492 3048  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll
13:43:24.0543 3048  Schedule - ok
13:43:24.0570 3048  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc    C:\Windows\System32\certprop.dll
13:43:24.0604 3048  SCPolicySvc - ok
13:43:24.0638 3048  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
13:43:24.0650 3048  SDRSVC - ok
13:43:24.0687 3048  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
13:43:24.0719 3048  secdrv - ok
13:43:24.0732 3048  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll
13:43:24.0765 3048  seclogon - ok
13:43:24.0774 3048  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\system32\sens.dll
13:43:24.0822 3048  SENS - ok
13:43:24.0852 3048  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
13:43:24.0884 3048  SensrSvc - ok
13:43:24.0920 3048  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum        C:\Windows\system32\drivers\serenum.sys
13:43:24.0953 3048  Serenum - ok
13:43:24.0981 3048  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\drivers\serial.sys
13:43:25.0016 3048  Serial - ok
13:43:25.0020 3048  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
13:43:25.0043 3048  sermouse - ok
13:43:25.0079 3048  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll
13:43:25.0115 3048  SessionEnv - ok
13:43:25.0120 3048  [ A554811BCD09279536440C964AE35BBF ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
13:43:25.0133 3048  sffdisk - ok
13:43:25.0168 3048  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
13:43:25.0183 3048  sffp_mmc - ok
13:43:25.0188 3048  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
13:43:25.0217 3048  sffp_sd - ok
13:43:25.0223 3048  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy        C:\Windows\system32\drivers\sfloppy.sys
13:43:25.0237 3048  sfloppy - ok
13:43:25.0281 3048  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll
13:43:25.0319 3048  SharedAccess - ok
13:43:25.0353 3048  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
13:43:25.0390 3048  ShellHWDetection - ok
13:43:25.0415 3048  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
13:43:25.0424 3048  SiSRaid2 - ok
13:43:25.0443 3048  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
13:43:25.0452 3048  SiSRaid4 - ok
13:43:25.0528 3048  [ 3E587DBBDFF938DDE5D4CE4047BE9041 ] SkypeUpdate    C:\Program Files (x86)\Skype\Updater\Updater.exe
13:43:25.0540 3048  SkypeUpdate - ok
13:43:25.0546 3048  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
13:43:25.0602 3048  Smb - ok
13:43:25.0646 3048  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
13:43:25.0674 3048  SNMPTRAP - ok
13:43:25.0710 3048  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr          C:\Windows\system32\drivers\spldr.sys
13:43:25.0718 3048  spldr - ok
13:43:25.0752 3048  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler        C:\Windows\System32\spoolsv.exe
13:43:25.0769 3048  Spooler - ok
13:43:25.0860 3048  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe
13:43:25.0953 3048  sppsvc - ok
13:43:25.0958 3048  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
13:43:26.0006 3048  sppuinotify - ok
13:43:26.0051 3048  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv            C:\Windows\system32\DRIVERS\srv.sys
13:43:26.0101 3048  srv - ok
13:43:26.0109 3048  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
13:43:26.0123 3048  srv2 - ok
13:43:26.0151 3048  [ 0C4540311E11664B245A263E1154CEF8 ] SrvHsfHDA      C:\Windows\system32\DRIVERS\VSTAZL6.SYS
13:43:26.0163 3048  SrvHsfHDA - ok
13:43:26.0213 3048  [ 02071D207A9858FBE3A48CBFD59C4A04 ] SrvHsfV92      C:\Windows\system32\DRIVERS\VSTDPV6.SYS
13:43:26.0258 3048  SrvHsfV92 - ok
13:43:26.0293 3048  [ 18E40C245DBFAF36FD0134A7EF2DF396 ] SrvHsfWinac    C:\Windows\system32\DRIVERS\VSTCNXT6.SYS
13:43:26.0311 3048  SrvHsfWinac - ok
13:43:26.0324 3048  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
13:43:26.0347 3048  srvnet - ok
13:43:26.0389 3048  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
13:43:26.0439 3048  SSDPSRV - ok
13:43:26.0456 3048  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc        C:\Windows\system32\sstpsvc.dll
13:43:26.0491 3048  SstpSvc - ok
13:43:26.0524 3048  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\drivers\stexstor.sys
13:43:26.0533 3048  stexstor - ok
13:43:26.0572 3048  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll
13:43:26.0593 3048  stisvc - ok
13:43:26.0598 3048  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\drivers\swenum.sys
13:43:26.0606 3048  swenum - ok
13:43:26.0641 3048  [ E08E46FDD841B7184194011CA1955A0B ] swprv          C:\Windows\System32\swprv.dll
13:43:26.0702 3048  swprv - ok
13:43:26.0763 3048  [ F5B46DF59FEAA48A442AED7EEB754D4B ] SynTP          C:\Windows\system32\DRIVERS\SynTP.sys
13:43:26.0792 3048  SynTP - ok
13:43:26.0861 3048  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain        C:\Windows\system32\sysmain.dll
13:43:26.0910 3048  SysMain - ok
13:43:26.0942 3048  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
13:43:26.0958 3048  TabletInputService - ok
13:43:27.0008 3048  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv        C:\Windows\System32\tapisrv.dll
13:43:27.0052 3048  TapiSrv - ok
13:43:27.0067 3048  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS            C:\Windows\System32\tbssvc.dll
13:43:27.0102 3048  TBS - ok
13:43:27.0163 3048  [ 9849EA3843A2ADBDD1497E97A85D8CAE ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
13:43:27.0200 3048  Tcpip - ok
13:43:27.0241 3048  [ 9849EA3843A2ADBDD1497E97A85D8CAE ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
13:43:27.0278 3048  TCPIP6 - ok
13:43:27.0308 3048  [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
13:43:27.0329 3048  tcpipreg - ok
13:43:27.0381 3048  [ FD542B661BD22FA69CA789AD0AC58C29 ] tdcmdpst        C:\Windows\system32\DRIVERS\tdcmdpst.sys
13:43:27.0387 3048  tdcmdpst - ok
13:43:27.0427 3048  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
13:43:27.0451 3048  TDPIPE - ok
13:43:27.0489 3048  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
13:43:27.0499 3048  TDTCP - ok
13:43:27.0505 3048  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
13:43:27.0540 3048  tdx - ok
13:43:27.0591 3048  [ 1B709733A04DCC41A63F9CD1F76A4EBE ] TemproMonitoringService C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe
13:43:27.0599 3048  TemproMonitoringService - ok
13:43:27.0616 3048  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\drivers\termdd.sys
13:43:27.0627 3048  TermDD - ok
13:43:27.0665 3048  [ 2E648163254233755035B46DD7B89123 ] TermService    C:\Windows\System32\termsrv.dll
13:43:27.0705 3048  TermService - ok
13:43:27.0716 3048  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll
13:43:27.0732 3048  Themes - ok
13:43:27.0747 3048  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER    C:\Windows\system32\mmcss.dll
13:43:27.0784 3048  THREADORDER - ok
13:43:27.0885 3048  [ F120967184A27E927052E8DDBB727851 ] TMachInfo      C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
13:43:27.0892 3048  TMachInfo - ok
13:43:27.0939 3048  [ 8E2C799D3476EAC32C3BA0DF7CE6AF19 ] TODDSrv        C:\Windows\system32\TODDSrv.exe
13:43:27.0949 3048  TODDSrv - ok
13:43:28.0023 3048  [ CDC97FA5C42B07FB0D4600E17C32F582 ] TosCoSrv        C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
13:43:28.0036 3048  TosCoSrv - ok
13:43:28.0117 3048  [ 8F099BE5DB17D025E19652851399B9F1 ] TOSHIBA Bluetooth Service C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
13:43:28.0126 3048  TOSHIBA Bluetooth Service - ok
13:43:28.0199 3048  [ D0F868A67CB4D817A3F7ABEF8C42F49C ] TOSHIBA eco Utility Service C:\Program Files\TOSHIBA\TECO\TecoService.exe
13:43:28.0209 3048  TOSHIBA eco Utility Service - ok
13:43:28.0295 3048  [ EDB4B432DB13EA3D1EB2356310D33263 ] TOSHIBA HDD SSD Alert Service C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
13:43:28.0303 3048  TOSHIBA HDD SSD Alert Service - ok
13:43:28.0319 3048  Tosrfcom - ok
13:43:28.0359 3048  [ F5E3AC4CBCD154EE80849B21887FD0B0 ] tosrfec        C:\Windows\system32\DRIVERS\tosrfec.sys
13:43:28.0365 3048  tosrfec - ok
13:43:28.0382 3048  [ 7A0048693F98460FF537BE31C741B927 ] Tosrfusb        C:\Windows\system32\DRIVERS\tosrfusb.sys
13:43:28.0389 3048  Tosrfusb - ok
13:43:28.0449 3048  [ 098B8A408C17E125A3D9A8E1166780C8 ] TPCHSrv        C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
13:43:28.0468 3048  TPCHSrv - ok
13:43:28.0491 3048  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll
13:43:28.0543 3048  TrkWks - ok
13:43:28.0598 3048  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
13:43:28.0631 3048  TrustedInstaller - ok
13:43:28.0650 3048  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
13:43:28.0688 3048  tssecsrv - ok
13:43:28.0710 3048  [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
13:43:28.0740 3048  TsUsbFlt - ok
13:43:28.0743 3048  [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD        C:\Windows\system32\drivers\TsUsbGD.sys
13:43:28.0761 3048  TsUsbGD - ok
13:43:28.0789 3048  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
13:43:28.0838 3048  tunnel - ok
13:43:28.0873 3048  [ 550B567F9364D8F7684C3FB3EA665A72 ] TVALZ          C:\Windows\system32\DRIVERS\TVALZ_O.SYS
13:43:28.0880 3048  TVALZ - ok
13:43:28.0931 3048  [ 9C7191F4B2E49BFF47A6C1144B5923FA ] TVALZFL        C:\Windows\system32\DRIVERS\TVALZFL.sys
13:43:28.0937 3048  TVALZFL - ok
13:43:28.0958 3048  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
13:43:28.0967 3048  uagp35 - ok
13:43:29.0001 3048  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
13:43:29.0050 3048  udfs - ok
13:43:29.0094 3048  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
13:43:29.0125 3048  UI0Detect - ok
13:43:29.0129 3048  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
13:43:29.0139 3048  uliagpkx - ok
13:43:29.0191 3048  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
13:43:29.0201 3048  umbus - ok
13:43:29.0205 3048  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\drivers\umpass.sys
13:43:29.0233 3048  UmPass - ok
13:43:29.0373 3048  [ 7E5E1603D0FF2D240AE70295C5C3FEFC ] UNS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
13:43:29.0418 3048  UNS - ok
13:43:29.0455 3048  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll
13:43:29.0514 3048  upnphost - ok
13:43:29.0562 3048  [ FB251567F41BC61988B26731DEC19E4B ] USBAAPL64      C:\Windows\system32\Drivers\usbaapl64.sys
13:43:29.0578 3048  USBAAPL64 - ok
13:43:29.0629 3048  [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
13:43:29.0641 3048  usbaudio - ok
13:43:29.0661 3048  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
13:43:29.0674 3048  usbccgp - ok
13:43:29.0679 3048  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
13:43:29.0704 3048  usbcir - ok
13:43:29.0708 3048  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci        C:\Windows\system32\drivers\usbehci.sys
13:43:29.0717 3048  usbehci - ok
13:43:29.0746 3048  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\drivers\usbhub.sys
13:43:29.0774 3048  usbhub - ok
13:43:29.0778 3048  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci        C:\Windows\system32\drivers\usbohci.sys
13:43:29.0787 3048  usbohci - ok
13:43:29.0810 3048  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
13:43:29.0824 3048  usbprint - ok
13:43:29.0853 3048  [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan        C:\Windows\system32\DRIVERS\usbscan.sys
13:43:29.0881 3048  usbscan - ok
13:43:29.0899 3048  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
13:43:29.0927 3048  USBSTOR - ok
13:43:29.0933 3048  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
13:43:29.0969 3048  usbuhci - ok
13:43:30.0009 3048  [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys
13:43:30.0036 3048  usbvideo - ok
13:43:30.0072 3048  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms          C:\Windows\System32\uxsms.dll
13:43:30.0119 3048  UxSms - ok
13:43:30.0137 3048  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe
13:43:30.0149 3048  VaultSvc - ok
13:43:30.0176 3048  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
13:43:30.0184 3048  vdrvroot - ok
13:43:30.0208 3048  [ 8D6B481601D01A456E75C3210F1830BE ] vds            C:\Windows\System32\vds.exe
13:43:30.0250 3048  vds - ok
13:43:30.0265 3048  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
13:43:30.0277 3048  vga - ok
13:43:30.0281 3048  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave        C:\Windows\System32\drivers\vga.sys
13:43:30.0326 3048  VgaSave - ok
13:43:30.0349 3048  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
13:43:30.0360 3048  vhdmp - ok
13:43:30.0364 3048  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys
13:43:30.0372 3048  viaide - ok
13:43:30.0377 3048  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
13:43:30.0386 3048  volmgr - ok
13:43:30.0400 3048  [ A255814907C89BE58B79EF2F189B843B ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
13:43:30.0413 3048  volmgrx - ok
13:43:30.0428 3048  [ DF8126BD41180351A093A3AD2FC8903B ] volsnap        C:\Windows\system32\drivers\volsnap.sys
13:43:30.0441 3048  volsnap - ok
13:43:30.0460 3048  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
13:43:30.0471 3048  vsmraid - ok
13:43:30.0523 3048  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS            C:\Windows\system32\vssvc.exe
13:43:30.0593 3048  VSS - ok
13:43:30.0633 3048  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
13:43:30.0645 3048  vwifibus - ok
13:43:30.0663 3048  [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
13:43:30.0698 3048  vwififlt - ok
13:43:30.0727 3048  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time        C:\Windows\system32\w32time.dll
13:43:30.0777 3048  W32Time - ok
13:43:30.0812 3048  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
13:43:30.0836 3048  WacomPen - ok
13:43:30.0857 3048  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
13:43:30.0890 3048  WANARP - ok
13:43:30.0905 3048  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
13:43:30.0937 3048  Wanarpv6 - ok
13:43:30.0983 3048  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe
13:43:31.0021 3048  wbengine - ok
13:43:31.0030 3048  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
13:43:31.0049 3048  WbioSrvc - ok
13:43:31.0078 3048  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc        C:\Windows\System32\wcncsvc.dll
13:43:31.0118 3048  wcncsvc - ok
13:43:31.0147 3048  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
13:43:31.0158 3048  WcsPlugInService - ok
13:43:31.0194 3048  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\drivers\wd.sys
13:43:31.0202 3048  Wd - ok
13:43:31.0243 3048  [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
13:43:31.0265 3048  Wdf01000 - ok
13:43:31.0290 3048  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
13:43:31.0321 3048  WdiServiceHost - ok
13:43:31.0325 3048  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost  C:\Windows\system32\wdi.dll
13:43:31.0349 3048  WdiSystemHost - ok
13:43:31.0387 3048  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient      C:\Windows\System32\webclnt.dll
13:43:31.0419 3048  WebClient - ok
13:43:31.0436 3048  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
13:43:31.0491 3048  Wecsvc - ok
13:43:31.0510 3048  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
13:43:31.0558 3048  wercplsupport - ok
13:43:31.0598 3048  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
13:43:31.0650 3048  WerSvc - ok
13:43:31.0703 3048  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
13:43:31.0736 3048  WfpLwf - ok
13:43:31.0741 3048  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
13:43:31.0749 3048  WIMMount - ok
13:43:31.0772 3048  WinDefend - ok
13:43:31.0777 3048  WinHttpAutoProxySvc - ok
13:43:31.0921 3048  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
13:43:31.0956 3048  Winmgmt - ok
13:43:32.0022 3048  [ BCB1310604AA415C4508708975B3931E ] WinRM          C:\Windows\system32\WsmSvc.dll
13:43:32.0079 3048  WinRM - ok
13:43:32.0135 3048  [ FE88B288356E7B47B74B13372ADD906D ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
13:43:32.0162 3048  WinUsb - ok
13:43:32.0213 3048  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc        C:\Windows\System32\wlansvc.dll
13:43:32.0255 3048  Wlansvc - ok
13:43:32.0304 3048  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
13:43:32.0313 3048  WmiAcpi - ok
13:43:32.0338 3048  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
13:43:32.0367 3048  wmiApSrv - ok
13:43:32.0408 3048  WMPNetworkSvc - ok
13:43:32.0439 3048  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
13:43:32.0450 3048  WPCSvc - ok
13:43:32.0457 3048  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
13:43:32.0471 3048  WPDBusEnum - ok
13:43:32.0505 3048  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
13:43:32.0538 3048  ws2ifsl - ok
13:43:32.0565 3048  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\system32\wscsvc.dll
13:43:32.0581 3048  wscsvc - ok
13:43:32.0585 3048  WSearch - ok
13:43:32.0671 3048  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll
13:43:32.0716 3048  wuauserv - ok
13:43:32.0750 3048  [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
13:43:32.0772 3048  WudfPf - ok
13:43:32.0800 3048  [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
13:43:32.0814 3048  WUDFRd - ok
13:43:32.0844 3048  [ B20F051B03A966392364C83F009F7D17 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
13:43:32.0875 3048  wudfsvc - ok
13:43:32.0919 3048  [ FE90B750AB808FB9DD8FBB428B5FF83B ] WwanSvc        C:\Windows\System32\wwansvc.dll
13:43:32.0943 3048  WwanSvc - ok
13:43:32.0949 3048  ================ Scan global ===============================
13:43:32.0979 3048  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
13:43:33.0023 3048  [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
13:43:33.0032 3048  [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
13:43:33.0072 3048  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
13:43:33.0107 3048  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
13:43:33.0110 3048  [Global] - ok
13:43:33.0111 3048  ================ Scan MBR ==================================
13:43:33.0126 3048  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
13:43:33.0306 3048  \Device\Harddisk0\DR0 - ok
13:43:33.0307 3048  ================ Scan VBR ==================================
13:43:33.0339 3048  [ 815FA055A33A49FF54F714B2377BFCD3 ] \Device\Harddisk0\DR0\Partition1
13:43:33.0340 3048  \Device\Harddisk0\DR0\Partition1 - ok
13:43:33.0369 3048  [ 7C10470F15227438B3B7BB9E81412B53 ] \Device\Harddisk0\DR0\Partition2
13:43:33.0370 3048  \Device\Harddisk0\DR0\Partition2 - ok
13:43:33.0373 3048  ============================================================
13:43:33.0373 3048  Scan finished
13:43:33.0373 3048  ============================================================
13:43:33.0383 3696  Detected object count: 1
13:43:33.0383 3696  Actual detected object count: 1
13:45:36.0499 3696  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
13:45:36.0499 3696  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
Wie geht es nun weiter?

Danke und Gruß
Frady

markusg 12.08.2013 15:44
Hi,
es sind 4 Logs zu erstellen, poste diese möglichst gleichzeitig.
1.

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Neustarten.
2.
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Neustarten.
3.

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


neustarten.
4.
HitmanPro - Download - Filepony
Hitmanpro laden, doppelklicken, Scan klicken.
Log speichern und posten, bzw als XML exportieren, packen und anhängen.
Hitmanpro schließen.

ataba 12.08.2013 19:39
Hi,
nun die vier Logs:
Code:
Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.08.12.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16635
Samy :: SAMY-TOSH [Administrator]

Schutz: Aktiviert

12.08.2013 19:37:16
mbam-log-2013-08-12 (19-37-16).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 223752
Laufzeit: 2 Minute(n), 48 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 4
C:\Users\Samy\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504} (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Cache (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 6
C:\Users\Samy\AppData\Roaming\OpenCandy\18323F7F663A47E3A984377B142E508B\DeltaTB.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Samy\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
AdwCleaner Logfile:
Code:
# AdwCleaner v2.306 - Datei am 12/08/2013 um 19:49:47 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Samy - SAMY-TOSH
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Samy\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\extensions\gophoto@gophoto.it.xpi
Datei Gelöscht : C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\extensions\movie2kdownloader@movie2kdownloader.com.xpi
Datei Gelöscht : C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\11-suche.xml
Datei Gelöscht : C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\Babylon.xml
Datei Gelöscht : C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\delta.xml
Ordner Gelöscht : C:\Program Files (x86)\Gophoto.it
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\Users\Samy\AppData\Local\PutLockerDownloader
Ordner Gelöscht : C:\Users\Samy\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Movie2KDownloader.com
Ordner Gelöscht : C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\jetpack
Ordner Gelöscht : C:\Users\Samy\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\Samy\AppData\Roaming\pdfforge

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\1ClickDownload
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\BabSolution
Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\e4dad0b73be449
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Movie2KDownloader
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\Iminent
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASMANCS
Schlüssel Gelöscht : HKLM\Software\PIP
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\e4dad0b73be449
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\blaofbhgbmeikidhlkmjhbkbfohpgekf
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pfmopbbadnfoelckkcmjjeaaegjpjjbk
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4BD8E034-E0F4-4509-A753-467A8E854CD8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4BD8E034-E0F4-4509-A753-467A8E854CD8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A76AA284-E52D-47E6-9E4F-B85DBF8E35C3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Schlüssel Gelöscht : HKLM\SOFTWARE\Software
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{acaa314b-eeba-48e4-ad47-84e31c44796c}]
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [webbooster@iminent.com]

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16635

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v23.0 (de)

Datei : C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\prefs.js

C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\user.js ... Gelöscht !

Gelöscht : user_pref("extensions.delta.admin", false);
Gelöscht : user_pref("extensions.delta.aflt", "babsst");
Gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Gelöscht : user_pref("extensions.delta.dfltLng", "de");
Gelöscht : user_pref("extensions.delta.excTlbr", false);
Gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);
Gelöscht : user_pref("extensions.delta.id", "e249378800000000000074de2b1d9015");
Gelöscht : user_pref("extensions.delta.instlDay", "15891");
Gelöscht : user_pref("extensions.delta.instlRef", "sst");
Gelöscht : user_pref("extensions.delta.newTab", false);
Gelöscht : user_pref("extensions.delta.prdct", "delta");
Gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Gelöscht : user_pref("extensions.delta.rvrt", "false");
Gelöscht : user_pref("extensions.delta.smplGrp", "none");
Gelöscht : user_pref("extensions.delta.tlbrId", "base");
Gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Gelöscht : user_pref("extensions.delta.vrsn", "1.8.21.5");
Gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.21.515:54:04");
Gelöscht : user_pref("extensions.delta.vrsni", "1.8.21.5");
Gelöscht : user_pref("extensions.delta_i.babExt", "");
Gelöscht : user_pref("extensions.delta_i.babTrack", "affID=121563&tt=040713_ifrmful&tsp=4934");
Gelöscht : user_pref("extensions.delta_i.srcExt", "ss");

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\Samy\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [17388 octets] - [12/08/2013 19:49:47]

########## EOF - C:\AdwCleaner[S1].txt - [17449 octets] ##########
--- --- ---


Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.4.4 (08.12.2013:1)
OS: Windows 7 Home Premium x64
Ran by Samy on 12.08.2013 at 20:04:03,43
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\sweetim
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{DED82C22-F7A9-4C6D-BB8F-D26E10652D83}



~~~ Files

Successfully deleted: [File] C:\Windows\syswow64\sho13FC.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho1BCB.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho26A7.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho272A.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho31FD.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho402C.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho44D3.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho50FD.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho5CD5.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho708E.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho7697.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho7849.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho7A1F.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho7B57.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho7F5C.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho83FF.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho8A8D.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho8B30.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho937B.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho9915.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoA43B.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoA516.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoA7C9.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoAAA.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoAFCB.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoB59B.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoBF4C.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoC1E9.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoC9C6.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoCE95.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoD0C8.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoDABB.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoF7F6.tmp



~~~ Folders



~~~ FireFox

Successfully deleted: [File] C:\Users\Samy\AppData\Roaming\mozilla\firefox\profiles\9tgy6iv2.default\invalidprefs.js
Successfully deleted the following from C:\Users\Samy\AppData\Roaming\mozilla\firefox\profiles\9tgy6iv2.default\prefs.js

user_pref("id_imbooster4web_v6.bubble_src", "hxxp%3A//toolbar.iminent.com/SocialNetworking/%3FvToolbar%3DIminent");
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent109", "1357486120960");
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent110", "1357549297552");
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent111", "1357486120954");
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent112", "1357486120966");
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent122", "1357486120969");
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent134", "1360070700901");
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent140", "1358863245623");
user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent109", "1357568470518");
user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent110", "1357568471821");
user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent111", "1357568470514");
user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent112", "1357568470522");
user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent122", "1357568470524");
user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent134", "1359656510935");
Emptied folder: C:\Users\Samy\AppData\Roaming\mozilla\firefox\profiles\9tgy6iv2.default\minidumps [142 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 12.08.2013 at 20:17:49,39
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:

       
Code:

       
HitmanPro 3.7.7.203
www.hitmanpro.com

   Computer name . . . . : SAMY-TOSH
   Windows . . . . . . . : 6.1.1.7601.X64/4
   User name . . . . . . : Samy-TOSH\Samy
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2013-08-12 20:26:35
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 4m 4s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 57

   Objects scanned . . . : 1.659.596
   Files scanned . . . . : 12.144
   Remnants scanned  . . : 417.902 files / 1.229.550 keys

Potential Unwanted Programs _________________________________________________

   HKU\S-1-5-21-2214768358-217717142-1947330960-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{4D2D3B0F-69BE-477A-90F5-FDDB05357975} (Claro)
   HKU\S-1-5-21-2214768358-217717142-1947330960-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{98889811-442D-49DD-99D7-DC866BE87DBC} (Claro)

Cookies _____________________________________________________________________

   C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\cookies.sqlite:ad.yieldmanager.com
   C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\cookies.sqlite:ad.zanox.com
   C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\cookies.sqlite:apmebf.com
   C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\cookies.sqlite:doubleclick.net
   C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\cookies.sqlite:track.adform.net

kommt noch was? hab lansam das Gefühl dass der Rechner total befallen war :-)
Welche AntiVir Software kannst du empfehlen?

Gruß
Frady

markusg 12.08.2013 19:43
Kommt noch kommt noch, immer mit der Ruhe :-)
Das was wir jetzt gelöscht haben, war adware.
nichts weiter tragisches, nur nerfig :-(
bitte schließe alle Browser, nutze Hitmanpro, lösche Funde.
Starte neu, frisches frst Logb

ataba 12.08.2013 20:00
... na dann bin ich schon gespannt :-)
Code:

       
Code:

       
HitmanPro 3.7.7.203
www.hitmanpro.com

   Computer name . . . . : SAMY-TOSH
   Windows . . . . . . . : 6.1.1.7601.X64/4
   User name . . . . . . : Samy-TOSH\Samy
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Trial (30 days left)

   Scan date . . . . . . : 2013-08-12 20:51:22
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 1m 58s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 22

   Objects scanned . . . : 1.437.832
   Files scanned . . . . : 12.110
   Remnants scanned  . . : 417.942 files / 1.007.780 keys

Potential Unwanted Programs _________________________________________________

   HKU\S-1-5-21-2214768358-217717142-1947330960-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{4D2D3B0F-69BE-477A-90F5-FDDB05357975} (Claro) -> Deleted
   HKU\S-1-5-21-2214768358-217717142-1947330960-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{98889811-442D-49DD-99D7-DC866BE87DBC} (Claro) -> Deleted

Cookies _____________________________________________________________________

   C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\cookies.sqlite:doubleclick.net

markusg 12.08.2013 20:07
FRST Log fehlt

ataba 12.08.2013 20:20
shit, habs überlesen... :-(


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-08-2013 06
Ran by Samy (administrator) on 12-08-2013 21:16:24
Running from C:\Users\Samy\Desktop\Virus
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKU\Default\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
HKU\Default User\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP&dt=071213
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.5.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Samy\AppData\Roaming\Mozilla\Firefox\Profiles\9tgy6iv2.default\searchplugins\webde-suche.xml
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

Chrome:
=======
CHR Extension: () - C:\Users\Samy\AppData\Local\Google\Chrome\User Data\Default\Extensions\2.0.0.0_0\manifest.json

==================== Services (Whitelisted) =================

R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [109352 2013-08-12] (SurfRight B.V.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)

==================== Drivers (Whitelisted) ====================

R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv_x64.sys [44928 2012-10-11] (ManyCam LLC)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [29696 2012-10-11] (ManyCam LLC)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 Tosrfcom; No ImagePath

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\drivers\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 1C7857B62DE5994A75B054A9FD4C3825
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdk8.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\system32\drivers\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\drivers\arc.sys ==> MD5 is legit
C:\Windows\system32\drivers\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\athrx.sys B2931C83CFB12A3223A47B180473AE1A
C:\Windows\system32\drivers\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\system32\drivers\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bridge.sys 5C2F352A4E961D72518261257AAE204B
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\btfilter.sys 2347ABBD13BADA65826FDAB4CAAFE357
C:\Windows\system32\drivers\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\drivers\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\system32\drivers\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 9AC4F97C2D3E93367E2148EA940CD2CD
C:\Windows\System32\drivers\CHDRT64.sys 66847C979893A11CFCC2280E772D7EA1
C:\Windows\System32\drivers\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\drivers\disk.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys AF2E16242AA723F68F461B6EAE2EAD3D
C:\Windows\system32\drivers\evbda.sys ==> MD5 is legit
C:\Windows\system32\drivers\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\drivers\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\drivers\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0
C:\Windows\system32\drivers\gagp30kx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\GEARAspiWDM.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\System32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidbth.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\iaStor.sys D469B77687E12FE43E344806740B624D
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\System32\DRIVERS\igdkmd64.sys 370C2A8629B30F910F740387795DDC6F
C:\Windows\system32\drivers\iirsp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\IntcDAud.sys FC727061C0F47C8059E88E05D5C8E381
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys 97A7070AEA4C058B6418519E869A63B4
C:\Windows\System32\Drivers\ksecpkg.sys 26C43A7C2862447EC59DEDA188D1DA07
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\L1C62x64.sys EBED8B3FF4A823C1A6EEBEED7B29353F
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mcvidrv_x64.sys DE585D1D266805E5EEDAE911FDD16F38
C:\Windows\system32\drivers\mbam.sys 0BB97D43299910CBFBA59C461B99B910
C:\Windows\system32\drivers\mbam.sys 0BB97D43299910CBFBA59C461B99B910
C:\Windows\System32\drivers\mcaudrv_x64.sys 2E7FFDEF8BAFD04CBB517507B821E878
C:\Windows\system32\drivers\megasas.sys ==> MD5 is legit
C:\Windows\system32\drivers\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\HECIx64.sys A6518DCC42F7A6E999BB3BEA8FD87567
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\System32\DRIVERS\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\drivers\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\system32\drivers\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys B98F8C6E31CD07B2E6F71F7F648E38C0
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\drivers\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pciide.sys ==> MD5 is legit
C:\Windows\system32\drivers\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pgeffect.sys 91111CEBBDE8015E822C46120ED9537C
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\drivers\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\drivers\QIOMem.sys C8FCB4899F8B70CC34E0D9876A80963C
C:\Windows\system32\drivers\ql2300.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\drivers\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RtsUStor.sys 135A64530D7699AD48F29D73A658DD11
C:\Windows\System32\Drivers\RTSUVSTOR.sys E5DC911D0FEB72CAFF2BBDD6E7C3672F
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\serenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\serial.sys ==> MD5 is legit
C:\Windows\system32\drivers\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\drivers\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\drivers\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\VSTAZL6.SYS 0C4540311E11664B245A263E1154CEF8
C:\Windows\System32\DRIVERS\VSTDPV6.SYS 02071D207A9858FBE3A48CBFD59C4A04
C:\Windows\System32\DRIVERS\VSTCNXT6.SYS 18E40C245DBFAF36FD0134A7EF2DF396
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\system32\drivers\stexstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SynTP.sys F5B46DF59FEAA48A442AED7EEB754D4B
C:\Windows\System32\drivers\tcpip.sys 9849EA3843A2ADBDD1497E97A85D8CAE
C:\Windows\System32\DRIVERS\tcpip.sys 9849EA3843A2ADBDD1497E97A85D8CAE
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\DRIVERS\tdcmdpst.sys FD542B661BD22FA69CA789AD0AC58C29
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tosrfec.sys F5E3AC4CBCD154EE80849B21887FD0B0
C:\Windows\System32\DRIVERS\tosrfusb.sys 7A0048693F98460FF537BE31C741B927
C:\Windows\System32\DRIVERS\tssecsrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\system32\drivers\TsUsbGD.sys 9CC2CCAE8A84820EAECB886D477CBCB8
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\TVALZ_O.SYS ==> MD5 is legit
C:\Windows\System32\DRIVERS\TVALZFL.sys 9C7191F4B2E49BFF47A6C1144B5923FA
C:\Windows\system32\drivers\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\umpass.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbaapl64.sys FB251567F41BC61988B26731DEC19E4B
C:\Windows\System32\drivers\usbaudio.sys 82E8F44688E6FAC57B5B7C6FC7ADBC2A
C:\Windows\System32\DRIVERS\usbccgp.sys 6F1A3157A1C89435352CEB543CDB359C
C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit
C:\Windows\system32\drivers\usbehci.sys C025055FE7B87701EB042095DF1A2D7B
C:\Windows\system32\drivers\usbhub.sys 287C6C9410B111B68B52CA298F7B8C24
C:\Windows\system32\drivers\usbohci.sys 9840FC418B4CBD632D3D0A667A725C31
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbscan.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\system32\drivers\usbuhci.sys 62069A34518BCF9C1FD9E74B3F6DB7CD
C:\Windows\System32\Drivers\usbvideo.sys 454800C2BC7F3927CE030141EE4F4C50
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys DF8126BD41180351A093A3AD2FC8903B
C:\Windows\system32\drivers\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit
C:\Windows\system32\drivers\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\drivers\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys 442783E2CB0DA19873B7A63833FF4CB4
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWow64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys FE88B288356E7B47B74B13372ADD906D
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-12 20:26 - 2013-08-12 20:51 - 00001912 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2013-08-12 20:26 - 2013-08-12 20:26 - 00000000 ____D C:\Program Files\HitmanPro
2013-08-12 20:25 - 2013-08-12 20:57 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-12 20:25 - 2013-08-12 20:25 - 09853928 _____ (SurfRight B.V.) C:\Users\Samy\Desktop\HitmanPro_x64.exe
2013-08-12 20:17 - 2013-08-12 20:17 - 00004657 _____ C:\Users\Samy\Desktop\JRT.txt
2013-08-12 20:04 - 2013-08-12 20:04 - 00000000 ____D C:\Windows\ERUNT
2013-08-12 20:02 - 2013-08-12 20:02 - 00959697 _____ (Oleg N. Scherbakov) C:\Users\Samy\Desktop\JRT.exe
2013-08-12 19:49 - 2013-08-12 19:50 - 00017413 _____ C:\AdwCleaner[S1].txt
2013-08-12 19:48 - 2013-08-12 19:48 - 00666633 _____ C:\Users\Samy\Desktop\adwcleaner.exe
2013-08-12 19:44 - 2013-08-12 19:44 - 00002846 _____ C:\Windows\PFRO.log
2013-08-12 19:33 - 2013-08-12 19:33 - 00001076 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-08-12 19:33 - 2013-08-12 19:33 - 00000000 ____D C:\Users\Samy\AppData\Roaming\Malwarebytes
2013-08-12 19:33 - 2013-08-12 19:33 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-12 19:33 - 2013-08-12 19:33 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-12 19:33 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-12 19:25 - 2013-08-12 20:21 - 00000280 _____ C:\Windows\setupact.log
2013-08-12 19:25 - 2013-08-12 19:25 - 00000000 _____ C:\Windows\setuperr.log
2013-08-11 21:00 - 2013-08-11 21:10 - 00000000 ____D C:\Users\Samy\Desktop\von Papa
2013-08-11 13:24 - 2013-08-11 13:33 - 00000000 ____D C:\Qoobox
2013-08-11 13:24 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-11 13:24 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-11 13:24 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-11 13:24 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-11 13:24 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-11 13:24 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-11 13:24 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-11 13:24 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-11 13:23 - 2013-08-11 13:31 - 00000000 ____D C:\Windows\erdnt
2013-08-11 12:59 - 2013-08-11 12:59 - 00003284 _____ C:\Windows\System32\Tasks\{B31B0E27-CAED-4624-A8FB-1534D393D55D}
2013-08-11 12:40 - 2013-08-11 12:40 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2013-08-11 12:35 - 2013-08-11 12:35 - 00000020 _____ C:\Windows\Xø—
2013-08-11 12:20 - 2013-08-11 12:20 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-08-11 12:20 - 2013-08-11 12:20 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-08-11 12:20 - 2013-08-11 12:20 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-08-11 12:20 - 2013-08-11 12:20 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-08-11 12:20 - 2013-08-11 12:20 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-08-11 12:20 - 2013-08-11 12:20 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-08-11 12:20 - 2013-08-11 12:20 - 00000000 ____D C:\Program Files\Java
2013-08-11 11:58 - 2013-08-12 21:12 - 00000000 ____D C:\Users\Samy\Desktop\Virus
2013-08-07 23:35 - 2013-08-07 23:35 - 00002026 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-08-07 23:35 - 2013-08-07 23:35 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-08-07 23:29 - 2013-08-07 23:29 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-07 23:29 - 2013-08-07 23:29 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-05 21:23 - 2013-08-05 21:23 - 00000000 ____D C:\FRST
2013-07-31 16:46 - 2013-08-07 21:00 - 00000004 _____ C:\Users\Samy\AppData\Roaming\cache.ini
2013-07-18 17:25 - 2013-07-18 17:25 - 00003072 ____H C:\Users\Samy\photothumb.db
2013-07-18 17:24 - 2013-07-18 17:24 - 00024576 ____H C:\Users\Samy\Desktop\photothumb.db
2013-07-14 11:17 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-14 11:17 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-14 11:17 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-14 11:17 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-14 11:17 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-14 11:17 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-14 11:17 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-14 11:17 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-14 11:17 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-14 11:17 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-14 11:17 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-14 11:17 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-14 11:17 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-14 11:17 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-14 11:17 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-14 11:17 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-14 11:17 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-14 11:17 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-14 11:17 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-14 11:17 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-14 11:17 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-14 11:17 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-14 11:17 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-14 11:16 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-14 11:16 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-14 11:16 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-14 11:16 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-14 11:16 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-14 11:16 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-14 11:16 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-14 11:16 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

==================== One Month Modified Files and Folders =======

2013-08-12 21:12 - 2013-08-11 11:58 - 00000000 ____D C:\Users\Samy\Desktop\Virus
2013-08-12 20:57 - 2013-08-12 20:25 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-12 20:51 - 2013-08-12 20:26 - 00001912 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2013-08-12 20:28 - 2009-07-14 06:45 - 00024912 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-12 20:28 - 2009-07-14 06:45 - 00024912 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-12 20:26 - 2013-08-12 20:26 - 00000000 ____D C:\Program Files\HitmanPro
2013-08-12 20:25 - 2013-08-12 20:25 - 09853928 _____ (SurfRight B.V.) C:\Users\Samy\Desktop\HitmanPro_x64.exe
2013-08-12 20:25 - 2011-02-11 10:21 - 00669012 _____ C:\Windows\system32\perfh007.dat
2013-08-12 20:25 - 2011-02-11 10:21 - 00134796 _____ C:\Windows\system32\perfc007.dat
2013-08-12 20:25 - 2009-07-14 07:13 - 01527002 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-12 20:21 - 2013-08-12 19:25 - 00000280 _____ C:\Windows\setupact.log
2013-08-12 20:21 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-12 20:20 - 2013-07-04 21:59 - 01912236 _____ C:\Windows\WindowsUpdate.log
2013-08-12 20:17 - 2013-08-12 20:17 - 00004657 _____ C:\Users\Samy\Desktop\JRT.txt
2013-08-12 20:04 - 2013-08-12 20:04 - 00000000 ____D C:\Windows\ERUNT
2013-08-12 20:02 - 2013-08-12 20:02 - 00959697 _____ (Oleg N. Scherbakov) C:\Users\Samy\Desktop\JRT.exe
2013-08-12 19:50 - 2013-08-12 19:49 - 00017413 _____ C:\AdwCleaner[S1].txt
2013-08-12 19:48 - 2013-08-12 19:48 - 00666633 _____ C:\Users\Samy\Desktop\adwcleaner.exe
2013-08-12 19:44 - 2013-08-12 19:44 - 00002846 _____ C:\Windows\PFRO.log
2013-08-12 19:33 - 2013-08-12 19:33 - 00001076 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-08-12 19:33 - 2013-08-12 19:33 - 00000000 ____D C:\Users\Samy\AppData\Roaming\Malwarebytes
2013-08-12 19:33 - 2013-08-12 19:33 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-12 19:33 - 2013-08-12 19:33 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-12 19:25 - 2013-08-12 19:25 - 00000000 _____ C:\Windows\setuperr.log
2013-08-11 21:10 - 2013-08-11 21:00 - 00000000 ____D C:\Users\Samy\Desktop\von Papa
2013-08-11 21:05 - 2013-07-02 18:53 - 00000000 ____D C:\Users\Samy\Desktop\steckbrief David
2013-08-11 13:33 - 2013-08-11 13:24 - 00000000 ____D C:\Qoobox
2013-08-11 13:31 - 2013-08-11 13:23 - 00000000 ____D C:\Windows\erdnt
2013-08-11 13:30 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-11 13:08 - 2013-07-01 22:50 - 00000000 ____D C:\Users\Samy\AppData\Local\Windows Live
2013-08-11 13:08 - 2011-08-03 12:18 - 00000000 ____D C:\Program Files (x86)\Windows Live
2013-08-11 13:07 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-08-11 12:59 - 2013-08-11 12:59 - 00003284 _____ C:\Windows\System32\Tasks\{B31B0E27-CAED-4624-A8FB-1534D393D55D}
2013-08-11 12:42 - 2009-07-14 06:45 - 00529888 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-11 12:41 - 2012-07-06 16:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-11 12:40 - 2013-08-11 12:40 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2013-08-11 12:35 - 2013-08-11 12:35 - 00000020 _____ C:\Windows\Xø—
2013-08-11 12:33 - 2012-02-11 22:25 - 00159080 _____ C:\Users\Samy\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-11 12:32 - 2011-08-03 12:30 - 00000000 ____D C:\Program Files (x86)\TOSHIBA Games
2013-08-11 12:31 - 2011-08-03 12:29 - 00000000 ____D C:\ProgramData\WildTangent
2013-08-11 12:30 - 2012-05-20 16:15 - 00000000 ____D C:\Users\Samy\AppData\Roaming\WildTangent
2013-08-11 12:29 - 2011-08-03 12:26 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-11 12:25 - 2012-02-11 22:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-11 12:20 - 2013-08-11 12:20 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-08-11 12:20 - 2013-08-11 12:20 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-08-11 12:20 - 2013-08-11 12:20 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-08-11 12:20 - 2013-08-11 12:20 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-08-11 12:20 - 2013-08-11 12:20 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-08-11 12:20 - 2013-08-11 12:20 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-08-11 12:20 - 2013-08-11 12:20 - 00000000 ____D C:\Program Files\Java
2013-08-11 12:17 - 2013-07-02 21:44 - 00000000 ____D C:\ProgramData\MAGIX
2013-08-11 12:11 - 2013-07-02 22:25 - 00000000 ____D C:\Program Files (x86)\DVD slideshow GUI
2013-08-11 12:09 - 2013-03-06 14:02 - 00000000 ____D C:\Users\Samy\AppData\Roaming\Dropbox
2013-08-11 12:09 - 2012-02-11 22:22 - 00000000 ___RD C:\Users\Samy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-11 12:08 - 2013-07-02 22:25 - 00000000 ____D C:\Program Files (x86)\AviSynth 2.5
2013-08-11 12:00 - 2012-10-29 21:51 - 00000000 ____D C:\Windows\pss
2013-08-11 11:55 - 2012-02-11 22:28 - 00000000 ____D C:\Users\Samy\AppData\Roaming\Skype
2013-08-11 11:54 - 2013-03-06 14:07 - 00000000 ___RD C:\Users\Samy\Dropbox
2013-08-07 23:35 - 2013-08-07 23:35 - 00002026 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-08-07 23:35 - 2013-08-07 23:35 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-08-07 23:35 - 2011-08-03 12:01 - 00000000 ____D C:\ProgramData\Adobe
2013-08-07 23:33 - 2012-02-15 07:30 - 00000000 ____D C:\Users\Samy\AppData\Local\Adobe
2013-08-07 23:29 - 2013-08-07 23:29 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-07 23:29 - 2013-08-07 23:29 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-07 21:00 - 2013-07-31 16:46 - 00000004 _____ C:\Users\Samy\AppData\Roaming\cache.ini
2013-08-05 21:23 - 2013-08-05 21:23 - 00000000 ____D C:\FRST
2013-07-31 00:04 - 2011-08-03 10:55 - 00000000 ____D C:\Windows\Panther
2013-07-29 23:18 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-07-18 17:25 - 2013-07-18 17:25 - 00003072 ____H C:\Users\Samy\photothumb.db
2013-07-18 17:25 - 2012-02-11 22:22 - 00000000 ____D C:\Users\Samy
2013-07-18 17:24 - 2013-07-18 17:24 - 00024576 ____H C:\Users\Samy\Desktop\photothumb.db
2013-07-15 15:49 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-07-14 19:51 - 2013-03-14 12:31 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-14 19:51 - 2013-03-14 12:31 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-14 19:48 - 2011-02-11 10:20 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2013-07-14 19:48 - 2010-11-21 09:17 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\SysWOW64\winrm
2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\SysWOW64\WCN
2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\SysWOW64\sysprep
2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\SysWOW64\slmgr
2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\SysWOW64\Printing_Admin_Scripts
2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\system32\winrm
2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\system32\WCN
2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\system32\slmgr
2013-07-14 19:48 - 2010-11-21 09:06 - 00000000 ____D C:\Windows\system32\Printing_Admin_Scripts
2013-07-14 19:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Sidebar
2013-07-14 19:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-07-14 19:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-14 19:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar
2013-07-14 19:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-07-14 19:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\Setup
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\oobe
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\MUI
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\migwiz
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\Dism
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\com
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\sysprep
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\Setup
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\oobe
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\MUI
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\migwiz
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\Dism
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\com
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\servicing
2013-07-14 19:48 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\System
2013-07-14 19:45 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\DVD Maker
2013-07-14 11:27 - 2012-04-24 19:04 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-14 11:18 - 2012-06-08 11:50 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Files to move or delete:
====================
C:\Users\Samy\AppData\Roaming\cache.ini

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=\Device\HarddiskVolume1
description            Windows Boot Manager
locale                  de-DE
inherit                {globalsettings}
default                {current}
resumeobject            {5123a86a-bdae-11e0-afe4-60eb699c533a}
displayorder            {current}
toolsdisplayorder      {memdiag}
timeout                30

Windows-Startladeprogramm
-------------------------
Bezeichner              {current}
device                  partition=C:
path                    \Windows\system32\winload.exe
description            Windows 7
locale                  de-DE
inherit                {bootloadersettings}
recoverysequence        {5123a86c-bdae-11e0-afe4-60eb699c533a}
recoveryenabled        Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {5123a86a-bdae-11e0-afe4-60eb699c533a}
nx                      OptIn

Windows-Startladeprogramm
-------------------------
Bezeichner              {5123a86c-bdae-11e0-afe4-60eb699c533a}
device                  ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim,{5123a86d-bdae-11e0-afe4-60eb699c533a}
path                    \windows\system32\winload.exe
description            Windows Recovery Environment
inherit                {bootloadersettings}
osdevice                ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim,{5123a86d-bdae-11e0-afe4-60eb699c533a}
systemroot              \windows
nx                      OptIn
winpe                  Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {5123a86a-bdae-11e0-afe4-60eb699c533a}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description            Windows Resume Application
locale                  de-DE
inherit                {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=\Device\HarddiskVolume1
path                    \boot\memtest.exe
description            Windows Memory Diagnostic
locale                  de-DE
inherit                {globalsettings}
badmemoryaccess        Yes

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype              Serial
debugport              1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype    Serial
hypervisordebugport    1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                {globalsettings}

Ger„teoptionen
--------------
Bezeichner              {5123a86d-bdae-11e0-afe4-60eb699c533a}
description            Ramdisk Options
ramdisksdidevice        partition=\Device\HarddiskVolume1
ramdisksdipath          \Recovery\WindowsRE\boot.sdi



LastRegBack: 2013-07-14 17:58

==================== End Of Log ============================
--- --- ---

--- --- ---

markusg 12.08.2013 20:32
Hi,
1.
bitte teste, ob es im Firefox, internet explorer, und sonstigen
evtl. instalierte Browser, irgendwelche ungewollten toolbars, umleitungen oder sonstigen Probleme gibt.
Teste wie pc und programme allgemein laufen.
Wenn alles läuft:
2.
Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.


4. PC absichern:
als antimalware programm würde ich emsisoft empfehlen.
diese haben für mich den besten schutz kostet aber etwas.
Computeractive Software Store - Emsisoft Anti-Malware 8 [1-PC] - 63% off RRP
testversion:
Meine Antivirus-Empfehlung: Emsisoft Anti-Malware
insbesondere wenn du onlinebanking, einkäufe, sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches machst, also sensible daten zu schützen sind, solltest du in sicherheitssoftware investieren.
vor dem aktivieren der lizenz die 30 tage testzeitraum ausnutzen.

kostenlos, aber eben nicht ganz so gut währe avast zu empfehlen.
http://www.trojaner-board.de/110895-...antivirus.html

sag mir welches du nutzt, dann gebe ich konfigurationshinweise.
bitte dein bisheriges av deinstalieren
die folgende anleitung ist umfangreich, dass ist mir klar, sie sollte aber umgesetzt werden, da nur dann dein pc sicher ist. stelle so viele fragen wie nötig, ich arbeite gern alles mit dir durch!

http://www.trojaner-board.de/96344-a...-rechners.html
Starte bitte mit der Passage, Windows Vista und Windows 7
Bitte beginne damit, Windows Updates zu instalieren.
Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst.
Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist:
- Updates automatisch Instalieren,
- Täglich
- Uhrzeit wählen
- Bitte den gesammten rest anhaken, außer:
- detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist.
Klicke jetzt die Schaltfläche "OK"
Klicke jetzt "nach Updates suchen".
Bitte instaliere zunächst wichtige Updates.
Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren.
Mache das selbe bitte mit den optionalen Updates.
Bitte übernimm den rest so, wie es im Abschnitt windows 7 / Vista zu lesen ist.
aus dem Abschnitt xp, bitte den punkt "datenausführungsverhinderung, dep" übernehmen.
als browser rate ich dir zu chrome:
http://support.google.com/chrome/bin...&answer=118663
anleitung lesen bitte
falls du nen andern nutzen willst, sags mir dann muss ich teile der nun folgenden anleitung anpassen.


Sandboxie
Die devinition einer Sandbox ist hier nachzulesen:
Sandbox
Kurz gesagt, man kann Programme fast 100 %ig isuliert vom System ausführen.

Der Vorteil liegt klar auf der Hand, wenn über den Browser Schadcode eingeschläust wird, kann dieser nicht nach außen dringen.
Download Link:
Sandboxie - Download - Filepony

anleitung:
http://www.trojaner-board.de/71542-a...sandboxie.html
ausführliche anleitung als pdf, auch abarbeiten:
Sandbox Einstellungen |

bitte folgende zusatz konfiguration machen:
sandboxie control öffnen, menü sandbox anklicken, defauldbox wählen.
dort klicke auf sandbox einstellungen.
beschrenkungen, bei programm start und internet zugriff schreibe:
chrome.exe
dann gehe auf anwendungen, webbrowser, chrome.
dort aktiviere alles außer gesammten profil ordner freigeben.
Wie du evtl. schon gesehen hast, kannst du einige Funktionen nicht nutzen.
Dies ist nur in der Vollversion nötig, zu deren Kauf ich dir rate.
Du kannst zb unter "Erzwungene Programmstarts" festlegen, dass alle Browser in der Sandbox starten.
Ansonsten musst du immer auf "Sandboxed webbrowser" klicken bzw Rechtsklick, in Sandboxie starten.
Eine lebenslange Lizenz kostet 30 €, und ist auf allen deinen PC's nutzbar.

Weiter mit:
Maßnahmen für ALLE Windows-Versionen
alles komplett durcharbeiten
anmerkung zu file hippo.
in den settings zusätzlich auswählen:
hide beta updates.
Run updateChecker when Windows starts

Backup Programm:
in meiner Anleitung ist bereits ein Backup Programm verlinkt, als Alternative bietet sich auch das Windows eigene Backup Programm an:
http://www.trojaner-board.de/82962-w...en-backup.html
Dies ist aber leider nur für Windows 7 Nutzer vernünftig nutzbar.
Alle Anderen sollten sich aber auf jeden fall auch ein Backup Programm instalieren, denn dies kann unter Umständen sehr wichtig sein, zum Beispiel, wenn die Festplatte einmal kaputt ist.

Zum Schluss, die allgemeinen sicherheitstipps beachten, wenn es dich betrifft, den Tipp zum Onlinebanking beachten und alle Passwörter ändern
bitte auch lesen, wie mache ich programme für alle sichtbar:
Programme für alle Konten nutzbar machen - PCtipp.ch - Praxis & Hilfe
surfe jetzt also nur noch im standard nutzer konto und dort in der sandbox.
wenn du die kostenlose version nutzt, dann mit klick auf sandboxed web browser, wenn du die bezahlversion hast, kannst du erzwungene programm starts festlegen, dann wird sandboxie immer gestartet wenn du nen browser aufrufst.
wenn du mit der maus über den browser fährst sollte der eingerahmt sein, dann bist du im sandboxed web browser

passwort sicherheit:
jeder dienst benötigt ein eigenes, mindestens 12-stelliges passwort
bei der passwort verwaltung und erstellung hilft roboform
Password Manager, Form Filler, Password Management | RoboForm Password Manager
anleitung:
RoboForm Manual


Alle Zeitangaben in WEZ +1. Es ist jetzt 07:29 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27