Hallo,

ich habe mir vor einigen Tagen auf meinem VISTA-Notebook den SMART Repair Virus eingefangen.

Die Symptome:

• Der Bildschirm ist schwarz, nur der Internet Explorer ist noch sichtbar
• Eine ganze Batterie von Fehlermeldungen (System Message - Write Fault Error) erscheint.
• Ein Scan-Fenster S.M.A.R.T Repair erscheint und zeigt etliche System-Probleme an. Das Fenster läßt sich nur minimieren, nicht schliessen.
• So gut wie alle Dateien und Ordner scheinen weg, nur Laufwerk C zeigt noch eine Datei BOOTSEC.BAK an.
• Der Taskmanager läßt ich nicht mehr öffnen.

Meine bisherigen Aktionen:

• Ich habe Defogger als Admin gestartet und Disable geklickt. Es kam keine Fehlermeldung. Bisher habe ich noch nicht Re-enable geklickt.
• Ich habe dds.com per Doppelklick gestartet, die Protokolle stehen weiter unten.
• Ich habe GMER gestartet, allerdings kam da ein Bluescreen. Bisher habe ich das nicht wiederholt.
• Ich habe unhide ausgeführt. Ich glaube, dass alle Dateien und Ordner wieder sichtbar sind.

Microsoft Security Essentials hat heute - wohl nach Aktualisierung der Signatur (1.127.836.0 vom 27.05.2012 10:14) - eine Bereinigung durchgeführt, während ich den Forumsbeitrag formuliert habe.
Leider weiß ich nicht, wo ich davon ein Logfile herbekommen kann
Seit dem von MS SecurityEssentials verlangten Neustart kommen die Fehlermeldungen und das Scan-Fenster nicht mehr.
Nachdem ich unhide ausgeführt habe, erkannte MS Security Essentials eine weiter Bedrohung. Die Details habe ich in Code-Blöcken unten eingefügt.
Mittlerweile hat MS SecuritaEssentials da auch schon eine Bereinigung durchgeführt und leuchtet wieder freundlich grün.

DDS.txt:

.
DDS (Ver_2011-08-26.01) - NTFSx86 
Internet Explorer: 8.0.6001.18904
Run by ******* at 19:20:27 on 2012-05-27
Microsoft® Windows Vista™ Home Premium   6.0.6000.0.1252.49.1031.18.1014.163 [GMT 2:00]
.
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Keyboard Manager\Manager Utility\KeyboardManager.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe
C:\Program Files\FreePDF_XP\fpassist.exe
C:\ProgramData\NamKXRvEQrip.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\conime.exe
C:\ProgramData\SfvACqtJ74g9Ik.exe
C:\Windows\system32\taskeng.exe
C:\Windows\ehome\mcupdate.EXE
C:\Windows\system32\sdclt.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\lpremove.exe
C:\Windows\system32\lpksetup.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\WUDFHost.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Media Player\wmplayer.exe
\\?\C:\Windows\system32\wbem\WMIADAP.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.de/
mWinlogon: Userinit=c:\windows\system32\userinit.exe,d:\users\*******\appdata\roaming\appconf32.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [NokiaOviSuite2] c:\program files\nokia\nokia ovi suite\NokiaOviSuite.exe -tray
uRun: [Imgfla] d:\users\*******\appdata\roaming\adobe\update\forimg.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [4W1W8B7A8ZVD1HVGVJBRH] c:\washer2.rar\D60D32919C0.exe /q
uRun: [bbccfaedacbedcdbdct] "c:\programdata\bbccfaedacbedcdbdct.exe"
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [Keyboard Manager Utility] "c:\program files\keyboard manager\manager utility\KeyboardManager.exe" /lang DE /H
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop elements 5.0\apdproxy.exe"
mRun: [FreePDF Assistant] c:\program files\freepdf_xp\fpassist.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [NamKXRvEQrip.exe] c:\programdata\NamKXRvEQrip.exe
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mPolicies-system: EnableLUA = 0 (0x0)
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {474F00F5-3853-492C-AC3A-476512BBC336} - hxxp://picasaweb.google.com/s/v/24.16/uploader2.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{6B2C3213-04F5-4CC7-A18B-296A232C3C11} : DhcpNameServer = 192.168.178.1
TCP: Interfaces\{CB9F5C1F-04BC-4231-9D96-D652DD20BDA9} : DhcpNameServer = 192.168.1.1
Notify: igfxcui - igfxdev.dll
Hosts: 127.0.0.1	www.spywareinfo.com
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-4-5 61960]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2011-4-18 43392]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\avira\antivir desktop\sched.exe [2010-3-26 136360]
S2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-3-26 269480]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-9-9 133104]
S3 BthAvrcp;Bluetooth-AVRCP-Profil;c:\windows\system32\drivers\BthAvrcp.sys [2010-2-5 28048]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-9-9 133104]
.
=============== Created Last 30 ================
.
2012-05-27 17:19:34	713784	----a-w-	c:\programdata\microsoft\microsoft antimalware\definition updates\{9012fb24-35dc-48d2-98e1-a998582ff975}

\gapaengine.dll
2012-05-27 17:14:16	6737808	----a-w-	c:\programdata\microsoft\microsoft antimalware\definition updates\{954c594a-dc17-4590-8737-4d17510b0ba2}

\mpengine.dll
2012-05-21 19:17:04	--------	d--h--w-	c:\programdata\AVAST Software
2012-05-21 19:17:04	--------	d--h--w-	c:\program files\AVAST Software
2012-05-21 11:13:35	1474530	----a-w-	c:\windows\system32\PerfStringBackup.TMP
2012-05-21 08:59:24	6737808	---ha-w-	c:\programdata\microsoft\microsoft antimalware\definition updates\updates\mpengine.dll
2012-05-21 07:14:32	56200	----a-w-	c:\programdata\microsoft\microsoft antimalware\definition updates\{206dad07-f92e-4374-ae80-cf200f38b51b}

\offreg.dll
2012-05-20 19:07:30	6737808	------w-	c:\programdata\microsoft\microsoft antimalware\definition updates\{206dad07-f92e-4374-ae80-cf200f38b51b}

\mpengine.dll
2012-05-20 18:48:21	269824	---ha-w-	c:\programdata\SfvACqtJ74g9Ik.exe
2012-05-20 18:36:25	380928	---ha-w-	c:\programdata\NamKXRvEQrip.exe
2012-05-09 10:51:58	6737808	----a-w-	c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2012-05-09 10:20:57	6734704	---h--w-	c:\programdata\microsoft\windows defender\definition updates\{700337a2-8e3b-4ce2-b579-5b318a62e7b5}

\mpengine.dll
2012-05-08 11:30:11	--------	d--h--w-	C:\04001785caae1820ebce7865ce
.
==================== Find3M  ====================
.
2012-03-11 18:34:56	414368	---ha-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
.
============= FINISH: 19:22:06,53 ===============
         

Attach.txt:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vista™ Home Premium 
Boot Device: \Device\HarddiskVolume2
Install Date: 03.07.2007 18:11:10
System Uptime: 27.05.2012 18:57:33 (1 hours ago)
.
Motherboard: FUJITSU   |  | 10AD
Processor: Intel(R) Core(TM)2 CPU         T5600  @ 1.83GHz | U1 | 1833/mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 79 GiB total, 37,409 GiB free.
D: is FIXED (NTFS) - 19 GiB total, 3,54 GiB free.
E: is CDROM ()
F: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
.
==== Installed Programs ======================
.
Adobe Flash Player 11 ActiveX
Adobe Help Center 2.1
Adobe Photoshop Elements 5.0
Adobe Reader 9.5.0 - Deutsch
Amazon MP3-Downloader 1.0.5
Apple Mobile Device Support
Apple Software Update
Conexant HD Audio
FirstSteps Diagnostics
FreePDF XP (Remove only)
Google Earth
Google Update Helper
GPL Ghostscript 8.60
HDAUDIO Soft Data Fax Modem with SmartCP
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Intel(R) Graphics Media Accelerator Driver
iTunes
J2SE Development Kit 5.0 Update 11
J2SE Runtime Environment 5.0 Update 11
Java Auto Updater
Java(TM) 6 Update 22
Keyboard Manager Utility
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 SP1
Microsoft Antimalware
Microsoft Antimalware Service DE-DE Language Pack
Microsoft Security Client
Microsoft Security Client DE-DE Language Pack
Microsoft Security Essentials
Microsoft Visual C++ 2005 SP1 CRT Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works
MSVC80_x86_v2
MSVC90_x86
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero 7 Essentials
PC Connectivity Solution
QuickTime
RedMon - Redirection Port Monitor
Spybot - Search & Destroy
Synaptics Pointing Device Driver
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
WISO Sparbuch 2010
WISO Steuer-Sparbuch 2011
WISO Steuer-Sparbuch 2012
XMedia Recode 2.2.9.3
Yahoo! Music Jukebox
.
==== End Of File ===========================
         

MS Security Essentials Warnung(1)

Kategorie: Ausnutzen

Beschreibung: Dieses Programm ist gefährlich. Es nutzt die Sicherheitslücken eines Computers aus.

Empfohlene Aktion: Entfernen Sie diese Software unverzüglich.

Security Essentials hat Programme erkannt, die Ihre Privatsphäre gefährden oder Ihren Computer beschädigen könnten. Sie können auf die von diesen Programmen 

verwendeten Dateien weiterhin zugreifen, ohne sie zu entfernen (nicht empfohlen). Wählen Sie zum Zugreifen auf diese Dateien die Aktion "Zulassen" aus, und 

klicken Sie dann auf "Aktionen anwenden". Wenn diese Option nicht verfügbar ist, melden Sie sich als Administrator an, oder bitten Sie den 

Sicherheitsadministrator um Unterstützung.

Elemente: 
file:D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\356821a5-426d0701->Leps.class
         

Kategorie: Ausnutzen

Beschreibung: Dieses Programm ist gefährlich. Es nutzt die Sicherheitslücken eines Computers aus.

Empfohlene Aktion: Entfernen Sie diese Software unverzüglich.

Security Essentials hat Programme erkannt, die Ihre Privatsphäre gefährden oder Ihren Computer beschädigen könnten. Sie können auf die von diesen Programmen 

verwendeten Dateien weiterhin zugreifen, ohne sie zu entfernen (nicht empfohlen). Wählen Sie zum Zugreifen auf diese Dateien die Aktion "Zulassen" aus, und 

klicken Sie dann auf "Aktionen anwenden". Wenn diese Option nicht verfügbar ist, melden Sie sich als Administrator an, oder bitten Sie den 

Sicherheitsadministrator um Unterstützung.

Elemente: 
file:D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\112134e7-576d605a->aqmfacpj/hnvtbt.class
         

Viele Grüße

Bitte erstmal routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

 hier steht das Log
         

Hallo Arne,

vielen Dank für die schnelle Antwort!

Hier ist das Logfile von Malwarebytes:

 Malwarebytes Anti-Malware  (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.05.29.05

Windows Vista x86 NTFS
Internet Explorer 8.0.6001.18904
***** :: *****-PC [Administrator]

Schutz: Aktiviert

29.05.2012 20:56:14
mbam-log-2012-05-29 (20-56-14).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 348590
Laufzeit: 1 Stunde(n), 42 Minute(n), 37 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 3
HKCR\CLSID\{C689C99E-3A8C-4c87-A79C-C80DC9C81632} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C689C99E-3A8C-4C87-A79C-C80DC9C81632} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C689C99E-3A8C-4C87-A79C-C80DC9C81632} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|4W1W8B7A8ZVD1HVGVJBRH (Trojan.SpyEyes) -> Daten: C:\Washer2.rar\D60D32919C0.exe /q -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Userinit (Hijack.UserInit) -> Bösartig: (C:\Windows\system32\userinit.exe,D:\Users\*****\AppData\Roaming\appconf32.exe,) Gut: (userinit.exe) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 1
C:\sifgayiguha (Trojan.SpyEyes) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 1
D:\Users\*****\AppData\Local\Temp\0.9966188480413017.exe (Exploit.Drop.2) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

Und hier das von ESET:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=7cfb663ad8213f4d9601841ec029e429
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-05-29 10:50:46
# local_time=2012-05-30 12:50:46 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6000 NT 
# compatibility_mode=768 16777215 100 0 50665912 50665912 0 0
# compatibility_mode=1792 16777175 100 0 29207492 29207492 0 0
# compatibility_mode=5892 16776549 100 100 1442 175858310 0 0
# compatibility_mode=8192 67108863 100 0 284 284 0 0
# scanned=128022
# found=9
# cleaned=0
# scan_time=6258
D:\Users\*****\AppData\Local\Temp\jar_cache8456681225022311029.tmp	Java/Exploit.CVE-2011-3544.AP trojan (unable to clean)	00000000000000000000000000000000	I
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\3b719b51-565074ac	Java/Agent.ED trojan (unable to clean)	00000000000000000000000000000000	I
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\5b377f62-2c364dea	a variant of Java/TrojanDownloader.OpenStream.NCI trojan (unable to clean)	00000000000000000000000000000000	I
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\5b377f62-2f7c0e7f	a variant of Java/TrojanDownloader.OpenStream.NCI trojan (unable to clean)	00000000000000000000000000000000	I
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\5b377f62-47485651	a variant of Java/TrojanDownloader.OpenStream.NCI trojan (unable to clean)	00000000000000000000000000000000	I
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\5b377f62-64e566a8	a variant of Java/TrojanDownloader.OpenStream.NCI trojan (unable to clean)	00000000000000000000000000000000	I
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\5b377f62-6849256b	a variant of Java/TrojanDownloader.OpenStream.NCI trojan (unable to clean)	00000000000000000000000000000000	I
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\5b377f62-7380dd30	a variant of Java/TrojanDownloader.OpenStream.NCI trojan (unable to clean)	00000000000000000000000000000000	I
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\356821a5-426d0701	a variant of Java/Exploit.CVE-2012-0507.AM trojan (unable to clean)	00000000000000000000000000000000	I
         

Viele Grüße

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Ja, der normale Modus geht - ich hab den Rechner gar nicht im abgesicherten Modus gestartet.

Soweit ich das jetzt sehe, fehlt nichts im Start-Menü.
Ein paar Links hab ich stichprobenartig ausprobiert, die Progamme wurden gestartet.

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

 hier steht das Log
         

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die OTL.exe.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Setze oben mittig den Haken bei Scanne alle Benutzer
• Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Klick auf .
• Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Klar gerne, hier ist das OTL-Log:

OTL logfile created on: 30.05.2012 22:29:48 - Run 2
OTL by OldTimer - Version 3.2.43.1     Folder = D:\Users\Martina\Desktop
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1013,56 Mb Total Physical Memory | 232,80 Mb Available Physical Memory | 22,97% Memory free
2,22 Gb Paging File | 1,36 Gb Available in Paging File | 61,09% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 78,76 Gb Total Space | 36,56 Gb Free Space | 46,42% Space Free | Partition Type: NTFS
Drive D: | 19,36 Gb Total Space | 3,62 Gb Free Space | 18,70% Space Free | Partition Type: NTFS
Drive F: | 983,72 Mb Total Space | 666,67 Mb Free Space | 67,77% Space Free | Partition Type: FAT
 
Computer Name: MARTINA-PC | User Name: Martina | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.05.22 16:09:46 | 000,595,968 | ---- | M] (OldTimer Tools) -- D:\Users\Martina\Desktop\OTL.exe
PRC - [2012.04.26 11:00:19 | 001,380,464 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\mshaktuell.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2009.03.05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2007.06.26 21:27:46 | 000,312,320 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe
PRC - [2007.06.13 19:01:53 | 001,006,264 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2007.01.11 20:54:12 | 001,359,872 | ---- | M] (Quanta Computer, INC.) -- C:\Programme\Keyboard Manager\Manager Utility\KeyboardManager.exe
PRC - [2006.12.22 07:31:50 | 000,108,712 | ---- | M] () -- C:\Programme\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
PRC - [2006.12.22 07:29:56 | 000,067,752 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Photoshop Elements 5.0\apdproxy.exe
PRC - [2006.12.08 10:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe
PRC - [2006.11.02 14:36:04 | 000,895,488 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2006.11.02 14:36:04 | 000,201,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.04.26 11:17:29 | 002,002,032 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\wfvie12.dll
MOD - [2012.04.26 11:17:24 | 000,319,600 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\rsguiwinapi47.dll
MOD - [2012.04.26 11:17:23 | 001,543,280 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\wsteu12.dll
MOD - [2012.04.26 11:17:20 | 000,275,056 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\rscorewinapi47.dll
MOD - [2012.04.26 11:01:32 | 007,921,776 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\wgui12.dll
MOD - [2012.04.26 11:01:14 | 002,984,560 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\wcore12.dll
MOD - [2012.04.26 11:01:02 | 004,443,760 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\wauff12.dll
MOD - [2012.04.26 11:00:34 | 001,640,560 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\wreli12.dll
MOD - [2012.04.26 11:00:19 | 001,380,464 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\mshaktuell.exe
MOD - [2012.04.26 11:00:11 | 000,135,792 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\rsodbc47.dll
MOD - [2012.04.26 11:00:08 | 000,028,672 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\rsdcom47.dll
MOD - [2012.01.25 11:01:03 | 000,720,896 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qtsqlrs47.dll
MOD - [2011.11.04 13:47:20 | 000,865,280 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qtcluceners47.dll
MOD - [2011.11.04 13:47:18 | 000,271,872 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\phononrs47.dll
MOD - [2011.11.04 13:47:16 | 011,163,648 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qtwebkitrs47.dll
MOD - [2011.11.04 13:47:14 | 000,108,544 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qttestrs47.dll
MOD - [2011.11.04 13:47:12 | 001,340,416 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qtscriptrs47.dll
MOD - [2011.11.04 13:47:12 | 000,281,088 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qtsvgrs47.dll
MOD - [2011.11.04 13:47:10 | 008,934,400 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qtguirs47.dll
MOD - [2011.11.04 13:47:10 | 002,395,648 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qt3supportrs47.dll
MOD - [2011.11.04 13:47:10 | 000,990,208 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qtnetworkrs47.dll
MOD - [2011.11.04 13:47:10 | 000,358,400 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qtxmlrs47.dll
MOD - [2011.11.04 13:47:08 | 002,356,736 | ---- | M] () -- C:\Programme\WISO\Steuersoftware 2012\qtcorers47.dll
MOD - [2006.11.06 10:05:40 | 000,061,440 | ---- | M] () -- C:\Windows\System32\igfxTMM.dll
MOD - [2006.11.06 10:00:56 | 000,077,824 | ---- | M] () -- C:\Windows\System32\hccutils.dll
MOD - [2006.10.25 19:33:48 | 000,015,872 | ---- | M] () -- C:\Programme\Keyboard Manager\Manager Utility\QManager.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SBSDWSCService)
SRV - File not found [Auto | Stopped] -- c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon -- (CLTNetCnService)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.04.29 19:55:24 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.03.18 19:24:16 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.01.26 12:41:08 | 000,652,800 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2007.06.13 19:01:53 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2006.12.22 07:31:50 | 000,108,712 | ---- | M] () [Auto | Running] -- C:\Programme\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor5.0)
SRV - [2006.12.08 10:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) [Auto | Running] -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe -- (TestHandler)
SRV - [2006.11.02 14:36:04 | 000,895,488 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\usbser_lowerflt.sys -- (upperdev)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\dtwmnic5.sys -- (dtwmnic5)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.03.18 19:24:16 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2010.11.22 13:01:24 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.02.05 06:16:10 | 000,028,048 | ---- | M] (CSR, plc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BthAvrcp.sys -- (BthAvrcp)
DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.08.26 09:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008.03.04 02:32:00 | 000,188,416 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)
DRV - [2007.04.03 16:53:12 | 000,047,872 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV - [2006.11.15 18:16:24 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2006.11.15 13:42:46 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006.11.15 11:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2006.11.01 23:43:50 | 000,145,920 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CHDART.sys -- (HdAudAddService)
DRV - [2006.10.30 09:42:28 | 001,786,880 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2006.08.17 15:32:26 | 000,033,664 | ---- | M] (Quanta Computer Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\qkbfiltr.sys -- (qkbfiltr)
DRV - [2006.08.04 17:39:10 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2006.07.14 14:55:34 | 000,105,088 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nvatabus.sys -- (nvatabus)
DRV - [2006.02.07 19:52:58 | 000,006,912 | ---- | M] (JMicron ) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\JGOGO.sys -- (JGOGO)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000\..\SearchScopes,DefaultScope = {0E21D2FC-E1F5-4282-938C-18F6ABE547DA}
IE - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000\..\SearchScopes\{0E21D2FC-E1F5-4282-938C-18F6ABE547DA}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
 
 
O1 HOSTS File: ([2012.04.21 20:49:19 | 000,442,689 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O1 - Hosts: 127.0.0.1	www.007guard.com
O1 - Hosts: 127.0.0.1	007guard.com
O1 - Hosts: 127.0.0.1	008i.com
O1 - Hosts: 127.0.0.1	www.008k.com
O1 - Hosts: 127.0.0.1	008k.com
O1 - Hosts: 127.0.0.1	www.00hq.com
O1 - Hosts: 127.0.0.1	00hq.com
O1 - Hosts: 127.0.0.1	010402.com
O1 - Hosts: 127.0.0.1	www.032439.com
O1 - Hosts: 127.0.0.1	032439.com
O1 - Hosts: 127.0.0.1	www.0scan.com
O1 - Hosts: 127.0.0.1	0scan.com
O1 - Hosts: 127.0.0.1	1000gratisproben.com
O1 - Hosts: 127.0.0.1	www.1000gratisproben.com
O1 - Hosts: 127.0.0.1	1001namen.com
O1 - Hosts: 127.0.0.1	www.1001namen.com
O1 - Hosts: 127.0.0.1	100888290cs.com
O1 - Hosts: 127.0.0.1	www.100888290cs.com
O1 - Hosts: 127.0.0.1	www.100sexlinks.com
O1 - Hosts: 127.0.0.1	100sexlinks.com
O1 - Hosts: 127.0.0.1	10sek.com
O1 - Hosts: 127.0.0.1	www.10sek.com
O1 - Hosts: 127.0.0.1	www.1-2005-search.com
O1 - Hosts: 15213 more lines...
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Keyboard Manager Utility] c:\Program Files\Keyboard Manager\Manager Utility\KeyboardManager.exe (Quanta Computer, INC.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000..\Run: [bbccfaedacbedcdbdct] "C:\ProgramData\bbccfaedacbedcdbdct.exe" File not found
O4 - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000..\Run: [Imgfla] D:\Users\Martina\AppData\Roaming\Adobe\Update\forimg.exe File not found
O4 - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000..\Run: [NokiaOviSuite2] C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray File not found
O4 - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} hxxp://picasaweb.google.com/s/v/24.16/uploader2.cab (UploadListView Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6B2C3213-04F5-4CC7-A18B-296A232C3C11}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CB9F5C1F-04BC-4231-9D96-D652DD20BDA9}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{2cc3060e-a376-11e1-9cdd-001636cad7f9}\Shell\AutoRun\command - "" = wscript.exe Deploy\Scripts\BDD_AutoRun.wsf
O33 - MountPoints2\{8f81981c-297f-11dc-9079-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{8f81981c-297f-11dc-9079-806e6f6e6963}\Shell\AutoRun\command - "" = E:\start.exe /auto
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {38539595-3E29-410d-ABBD-3D6A75BC9A73} - Reg Error: Value error.
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.05.29 23:01:38 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.05.27 20:41:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.05.27 20:41:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.05.27 20:41:20 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.05.27 20:41:19 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.05.21 21:17:04 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2012.05.08 13:30:11 | 000,000,000 | ---D | C] -- C:\04001785caae1820ebce7865ce
[2012.05.01 09:53:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WISO Steuer-Sparbuch 2012
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.05.30 22:32:00 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{43D47738-EC2A-4BC5-85D2-AC0F3B7ED4A3}.job
[2012.05.30 22:20:49 | 000,054,156 | ---- | M] () -- C:\Windows\QTFont.qfn
[2012.05.30 22:20:20 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.05.30 22:20:11 | 000,003,200 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.05.30 22:20:11 | 000,003,200 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.05.30 22:20:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.05.30 22:19:59 | 1063,444,480 | -HS- | M] () -- C:\hiberfil.sys
[2012.05.30 20:17:40 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.05.30 02:46:00 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.05.29 20:52:04 | 000,000,422 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{0941ED73-D275-454C-A0A6-94DA8B7E2A8D}.job
[2012.05.28 10:30:18 | 000,002,106 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012.05.27 20:41:29 | 000,000,794 | ---- | M] () -- D:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.05.27 19:38:55 | 189,208,887 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.05.27 19:11:02 | 000,000,000 | ---- | M] () -- D:\Users\Martina\defogger_reenable
[2012.05.21 08:05:36 | 000,000,256 | ---- | M] () -- C:\ProgramData\SfvACqtJ74g9Ik
[2012.05.21 07:51:57 | 000,635,060 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.05.21 07:51:57 | 000,603,858 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.05.21 07:51:57 | 000,101,696 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.05.21 07:51:56 | 000,114,478 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.05.21 07:48:41 | 000,000,152 | ---- | M] () -- C:\ProgramData\-SfvACqtJ74g9Ikr
[2012.05.21 07:48:41 | 000,000,000 | ---- | M] () -- C:\ProgramData\-SfvACqtJ74g9Ik
[2012.05.17 19:26:23 | 000,001,166 | ---- | M] () -- C:\Windows\wiso.ini
[2012.05.01 09:54:03 | 000,001,912 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.05.27 20:53:30 | 000,002,267 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yahoo! Music Jukebox.lnk
[2012.05.27 20:53:30 | 000,002,149 | ---- | C] () -- D:\Users\Public\Desktop\iTunes.lnk
[2012.05.27 20:53:30 | 000,002,111 | ---- | C] () -- D:\Users\Public\Desktop\Yahoo! Music Jukebox.lnk
[2012.05.27 20:53:30 | 000,001,947 | ---- | C] () -- D:\Users\Public\Desktop\Google Earth.lnk
[2012.05.27 20:53:30 | 000,001,773 | ---- | C] () -- D:\Users\Public\Desktop\Adobe Reader 9.lnk
[2012.05.27 20:53:30 | 000,000,990 | ---- | C] () -- D:\Users\Public\Desktop\Adobe Photoshop Elements 5.0.lnk
[2012.05.27 20:53:30 | 000,000,760 | ---- | C] () -- D:\Users\Public\Desktop\XMedia Recode.lnk
[2012.05.27 20:53:27 | 000,001,950 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Photo Gallery.lnk
[2012.05.27 20:53:27 | 000,001,912 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
[2012.05.27 20:53:27 | 000,001,852 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Collaboration.lnk
[2012.05.27 20:53:27 | 000,001,803 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012.05.27 20:53:27 | 000,001,770 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Calendar.lnk
[2012.05.27 20:53:27 | 000,001,768 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Movie Maker.lnk
[2012.05.27 20:53:27 | 000,001,757 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Defender.lnk
[2012.05.27 20:53:27 | 000,001,743 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
[2012.05.27 20:53:27 | 000,001,703 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Contacts.lnk
[2012.05.27 20:53:27 | 000,000,604 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live.lnk
[2012.05.27 20:53:26 | 000,001,799 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works-Start.lnk
[2012.05.27 20:53:25 | 000,001,901 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office PowerPoint Viewer 2003.lnk
[2012.05.27 20:53:25 | 000,001,630 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012.05.27 20:53:24 | 000,001,896 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help Center.lnk
[2012.05.27 20:53:24 | 000,001,804 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2012.05.27 20:53:24 | 000,001,002 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Elements 5.0.lnk
[2012.05.27 20:41:29 | 000,000,794 | ---- | C] () -- D:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.05.27 19:11:02 | 000,000,000 | ---- | C] () -- D:\Users\Martina\defogger_reenable
[2012.05.20 20:48:52 | 000,000,152 | ---- | C] () -- C:\ProgramData\-SfvACqtJ74g9Ikr
[2012.05.20 20:48:52 | 000,000,000 | ---- | C] () -- C:\ProgramData\-SfvACqtJ74g9Ik
[2012.05.20 20:48:42 | 000,000,256 | ---- | C] () -- C:\ProgramData\SfvACqtJ74g9Ik
 
========== LOP Check ==========
 
[2009.12.20 01:02:48 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Amazon
[2008.07.10 16:52:31 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Buhl Data Service
[2007.11.18 17:43:02 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Engelmann Media
[2011.05.31 16:46:18 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\kock
[2010.06.07 11:49:14 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Nokia
[2012.04.27 19:07:04 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Opera
[2010.06.18 19:04:59 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\PC Suite
[2007.11.18 17:43:10 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Template
[2010.10.13 14:06:03 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\TrusteerHelp
[2011.06.06 12:45:04 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\UAs
[2010.12.17 23:00:56 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\XMedia Recode
[2011.06.09 12:30:57 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\xmldm
[2009.08.03 18:23:31 | 000,000,000 | ---D | M] -- D:\Users\Test\AppData\Roaming\Template
[2012.05.30 20:17:41 | 000,032,620 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.05.29 20:52:04 | 000,000,422 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{0941ED73-D275-454C-A0A6-94DA8B7E2A8D}.job
[2012.05.30 22:32:00 | 000,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{43D47738-EC2A-4BC5-85D2-AC0F3B7ED4A3}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.07.18 09:28:43 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Adobe
[2007.11.18 17:42:59 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Ahead
[2009.12.20 01:02:48 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Amazon
[2007.11.18 17:43:02 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Apple Computer
[2008.07.10 16:52:31 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Buhl Data Service
[2007.11.18 17:43:02 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Engelmann Media
[2007.11.18 17:43:02 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Google
[2010.10.14 12:37:35 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Helper
[2007.11.18 17:43:02 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Identities
[2012.05.01 09:40:51 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\InstallShield
[2011.05.31 16:46:18 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\kock
[2007.11.18 17:43:02 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Macromedia
[2012.05.27 20:41:38 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Malwarebytes
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Media Center Programs
[2010.10.24 22:46:17 | 000,000,000 | --SD | M] -- D:\Users\Martina\AppData\Roaming\Microsoft
[2010.06.07 11:49:14 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Nokia
[2012.04.27 19:07:04 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Opera
[2010.06.18 19:04:59 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\PC Suite
[2007.11.18 17:43:10 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\Template
[2010.10.13 14:06:03 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\TrusteerHelp
[2011.06.06 12:45:04 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\UAs
[2010.12.17 23:00:56 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\XMedia Recode
[2011.06.09 12:30:57 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\xmldm
 
< %APPDATA%\*.exe /s >
[2010.09.03 12:36:31 | 068,725,024 | ---- | M] () -- D:\Users\Martina\AppData\Roaming\Nokia\Ovi Suite\Software Updater\NokiaOviSuite2Installer.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.01.19 07:06:48 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\drivers\atapi.sys
[2008.01.19 07:06:48 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008.01.19 07:06:48 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008.01.19 06:33:23 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2006.05.11 11:30:52 | 000,247,808 | ---- | M] (Intel Corporation) MD5=294110966CEDD127629C5BE48367C8CF -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_6c3369af\iaStor.sys
[2006.05.11 11:30:52 | 000,247,808 | ---- | M] (Intel Corporation) MD5=294110966CEDD127629C5BE48367C8CF -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_0d20ce62\iaStor.sys
[2006.10.31 14:46:36 | 000,250,368 | ---- | M] (Intel Corporation) MD5=DE01BF14FFB150C779FD561BD0E3C5C5 -- C:\DRIVER\SATA\INTEL\iaStor.sys
[2006.10.31 14:46:36 | 000,250,368 | ---- | M] (Intel Corporation) MD5=DE01BF14FFB150C779FD561BD0E3C5C5 -- C:\Windows\System32\drivers\iaStor.sys
[2006.10.31 14:46:36 | 000,250,368 | ---- | M] (Intel Corporation) MD5=DE01BF14FFB150C779FD561BD0E3C5C5 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_3bb7bc45\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\System32\netlogon.dll
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
 
< MD5 for: NVATABUS.SYS  >
[2006.07.14 14:55:34 | 000,105,088 | ---- | M] (NVIDIA Corporation) MD5=7D960340BE5B0E008BB94E4C3B991339 -- C:\Windows\System32\drivers\nvatabus.sys
[2006.07.14 14:55:34 | 000,105,088 | ---- | M] (NVIDIA Corporation) MD5=7D960340BE5B0E008BB94E4C3B991339 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_27229839\nvatabus.sys
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\System32\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.06.13 18:56:59 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
[2007.06.13 18:56:59 | 000,633,856 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2007.06.13 18:56:59 | 000,633,856 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\System32\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: VIAMRAID.SYS  >
[2006.03.31 02:18:30 | 000,100,992 | ---- | M] (VIA Technologies inc,.ltd) MD5=9F3F276C7300ED211129757A411B605F -- C:\Windows\System32\drivers\viamraid.sys
[2006.03.31 02:18:30 | 000,100,992 | ---- | M] (VIA Technologies inc,.ltd) MD5=9F3F276C7300ED211129757A411B605F -- C:\Windows\System32\DriverStore\FileRepository\viamraid.inf_2d6a7e3a\viamraid.sys
 
< MD5 for: WININIT.EXE  >
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\System32\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\System32\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\System32\drivers\ws2ifsl.sys
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2007.06.13 11:59:40 | 006,664,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2007.06.13 11:59:37 | 000,102,400 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2007.06.13 11:59:41 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2007.06.13 11:59:57 | 015,720,448 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2007.06.13 12:00:00 | 006,021,120 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
<           >

< End of report >
         

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

:OTL
O4 - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000..\Run: [bbccfaedacbedcdbdct] "C:\ProgramData\bbccfaedacbedcdbdct.exe" File not found
O4 - HKU\S-1-5-21-3794037573-2674974133-3482154547-1000..\Run: [Imgfla] D:\Users\Martina\AppData\Roaming\Adobe\Update\forimg.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{2cc3060e-a376-11e1-9cdd-001636cad7f9}\Shell\AutoRun\command - "" = wscript.exe Deploy\Scripts\BDD_AutoRun.wsf
O33 - MountPoints2\{8f81981c-297f-11dc-9079-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{8f81981c-297f-11dc-9079-806e6f6e6963}\Shell\AutoRun\command - "" = E:\start.exe /auto
[2012.05.21 08:05:36 | 000,000,256 | ---- | M] () -- C:\ProgramData\SfvACqtJ74g9Ik
[2012.05.21 07:48:41 | 000,000,152 | ---- | M] () -- C:\ProgramData\-SfvACqtJ74g9Ikr
[2012.05.21 07:48:41 | 000,000,000 | ---- | M] () -- C:\ProgramData\-SfvACqtJ74g9Ik
[2011.06.09 12:30:57 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\xmldm
[2011.05.31 16:46:18 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\kock
[2011.06.06 12:45:04 | 000,000,000 | ---D | M] -- D:\Users\Martina\AppData\Roaming\UAs
:Files
D:\Users\Martina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
         

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Aaalso ... ich hab den Fix mit OTL gemacht.

Nach Klicken auf OK wurde der Rechner sofort ohne Rückfrage durchgestartet.
Beim wieder Hochfahren konnte ich mich mit meinem Administrator-Account nicht mehr anmelden. (Die Anmeldung des Dienstes "Benutzerprofildienst" ist fehlgeschlagen. Das Benutzerprofil kann nicht geladen werden.)

Mit einem Standard-Account kann ich mich anmelden. Nach der Anmeldung kam das OTL-Logfile hoch (siehe unten).
Unter diesem Account kann ich dann auch das Administrator-Passwort engeben (erfolgreich) wenn ich z.B. in die Benutzerkontensteuerung gehe.

Nach der ersten Anmeldung mit dem Standard-Account konnte ich einen Benutzerwechsel zum Admin-Account durchführen. Das ging aber nur einmal.
Nach dieser Anmeldung sagte mir aber eine Fehlermeldung, dass der Zugriff auf D: verweigert oder nicht möglich sei.

Falls das was mit dem OTL-Fix zu tun haben könnte, hoffe ich dass sich das mit den nächsten Aktionen irgendwann wieder legt.
Ansonsten versuch ich nach der Fertigstellung unserer Reparatur-Party, einen neuen Administrativen Account anzulegen und hoff, dass mit dem dann wieder alles in Ordnung sein wird... in die Benutzerkontensteuerung komm ich ja rein.

Hier ist jedenfalls erst mal das OTL-Log:

All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-3794037573-2674974133-3482154547-1000\Software\Microsoft\Windows\CurrentVersion\Run\\bbccfaedacbedcdbdct deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3794037573-2674974133-3482154547-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Imgfla deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2cc3060e-a376-11e1-9cdd-001636cad7f9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2cc3060e-a376-11e1-9cdd-001636cad7f9}\ not found.
File wscript.exe Deploy\Scripts\BDD_AutoRun.wsf not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f81981c-297f-11dc-9079-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f81981c-297f-11dc-9079-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f81981c-297f-11dc-9079-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f81981c-297f-11dc-9079-806e6f6e6963}\ not found.
File E:\start.exe /auto not found.
C:\ProgramData\SfvACqtJ74g9Ik moved successfully.
C:\ProgramData\-SfvACqtJ74g9Ikr moved successfully.
C:\ProgramData\-SfvACqtJ74g9Ik moved successfully.
D:\Users\*****\AppData\Roaming\xmldm folder moved successfully.
D:\Users\*****\AppData\Roaming\kock folder moved successfully.
D:\Users\*****\AppData\Roaming\UAs folder moved successfully.
========== FILES ==========
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
D:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Default
 
User: *****
 
User: Public
 
User: Test
 
%systemdrive% .tmp files removed: 12797680 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 1474530 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 223609230 bytes
RecycleBin emptied: 104 bytes
 
Total Files Cleaned = 227,00 mb
 
 
[EMPTYFLASH]
 
User: Default
 
User: *****
 
User: Public
 
User: Test
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.43.1 log created on 05312012_190628

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
         

Viele hoffnungsvolle Grüße

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

Logfile von TDSS-Killer:

21:59:05.0732 4292	TDSS rootkit removing tool 2.7.36.0 May 21 2012 16:40:16
21:59:05.0820 4292	============================================================
21:59:05.0820 4292	Current date / time: 2012/06/01 21:59:05.0820
21:59:05.0820 4292	SystemInfo:
21:59:05.0820 4292	
21:59:05.0820 4292	OS Version: 6.0.6000 ServicePack: 0.0
21:59:05.0820 4292	Product type: Workstation
21:59:05.0820 4292	ComputerName: ******-PC
21:59:05.0820 4292	UserName: ******
21:59:05.0820 4292	Windows directory: C:\Windows
21:59:05.0820 4292	System windows directory: C:\Windows
21:59:05.0821 4292	Processor architecture: Intel x86
21:59:05.0821 4292	Number of processors: 2
21:59:05.0821 4292	Page size: 0x1000
21:59:05.0821 4292	Boot type: Normal boot
21:59:05.0821 4292	============================================================
21:59:06.0734 4292	Drive \Device\Harddisk0\DR0 - Size: 0x1BF2976000 (111.79 Gb), SectorSize: 0x200, Cylinders: 0x3901, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
21:59:06.0766 4292	Drive \Device\Harddisk1\DR1 - Size: 0x3D800000 (0.96 Gb), SectorSize: 0x200, Cylinders: 0x7D, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
21:59:06.0767 4292	============================================================
21:59:06.0767 4292	\Device\Harddisk0\DR0:
21:59:06.0767 4292	MBR partitions:
21:59:06.0767 4292	\Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1770800, BlocksNum 0x9D84000
21:59:06.0767 4292	\Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0xB8DC800, BlocksNum 0x26B7800
21:59:06.0767 4292	\Device\Harddisk1\DR1:
21:59:06.0769 4292	MBR partitions:
21:59:06.0769 4292	\Device\Harddisk1\DR1\Partition0: MBR, Type 0x6, StartLBA 0x20, BlocksNum 0x1EBFE0
21:59:06.0769 4292	============================================================
21:59:06.0805 4292	C: <-> \Device\Harddisk0\DR0\Partition0
21:59:06.0862 4292	D: <-> \Device\Harddisk0\DR0\Partition1
21:59:06.0862 4292	============================================================
21:59:06.0862 4292	Initialize success
21:59:06.0862 4292	============================================================
22:01:10.0786 2724	============================================================
22:01:10.0786 2724	Scan started
22:01:10.0786 2724	Mode: Manual; SigCheck; TDLFS; 
22:01:10.0786 2724	============================================================
22:01:12.0746 2724	ACPI            (84fc6df81212d16be5c4f441682feccc) C:\Windows\system32\drivers\acpi.sys
22:01:12.0934 2724	ACPI - ok
22:01:13.0080 2724	AdobeActiveFileMonitor5.0 (63ab43534cbf5d7f3eb81dfdc8161490) C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
22:01:13.0091 2724	AdobeActiveFileMonitor5.0 - ok
22:01:13.0170 2724	adp94xx         (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
22:01:13.0217 2724	adp94xx - ok
22:01:13.0265 2724	adpahci         (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
22:01:13.0306 2724	adpahci - ok
22:01:13.0345 2724	adpu160m        (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
22:01:13.0364 2724	adpu160m - ok
22:01:13.0405 2724	adpu320         (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
22:01:13.0425 2724	adpu320 - ok
22:01:13.0474 2724	AeLookupSvc     (9d1fda9e086ba64e3c93c9de32461bcf) C:\Windows\System32\aelupsvc.dll
22:01:13.0560 2724	AeLookupSvc - ok
22:01:13.0606 2724	AFD             (5d24caf8efd924a875698ff28384db8b) C:\Windows\system32\drivers\afd.sys
22:01:13.0756 2724	AFD - ok
22:01:13.0808 2724	agp440          (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
22:01:13.0817 2724	agp440 - ok
22:01:13.0847 2724	aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
22:01:13.0858 2724	aic78xx - ok
22:01:13.0889 2724	ALG             (e69fb0e3112c40fdc0ef7d21a52dc951) C:\Windows\System32\alg.exe
22:01:13.0921 2724	ALG - ok
22:01:13.0953 2724	aliide          (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
22:01:13.0962 2724	aliide - ok
22:01:13.0991 2724	amdagp          (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
22:01:14.0000 2724	amdagp - ok
22:01:14.0025 2724	amdide          (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
22:01:14.0041 2724	amdide - ok
22:01:14.0073 2724	AmdK7           (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
22:01:14.0174 2724	AmdK7 - ok
22:01:14.0204 2724	AmdK8           (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys
22:01:14.0292 2724	AmdK8 - ok
22:01:14.0410 2724	AntiVirSchedulerService (c27d46b06d340293670450fce9dfb166) C:\Program Files\Avira\AntiVir Desktop\sched.exe
22:01:14.0438 2724	AntiVirSchedulerService - ok
22:01:14.0474 2724	AntiVirService  (c9fb073fd3c306b9eb32993be72f8ab7) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
22:01:14.0538 2724	AntiVirService - ok
22:01:14.0609 2724	Appinfo         (cfa455816879f06f1c4e5bbf9e8aef7d) C:\Windows\System32\appinfo.dll
22:01:14.0695 2724	Appinfo - ok
22:01:14.0804 2724	Apple Mobile Device (e4e3a862fee8061adc922a73b15800f3) C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
22:01:14.0835 2724	Apple Mobile Device ( UnsignedFile.Multi.Generic ) - warning
22:01:14.0835 2724	Apple Mobile Device - detected UnsignedFile.Multi.Generic (1)
22:01:14.0854 2724	arc             (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
22:01:14.0864 2724	arc - ok
22:01:14.0916 2724	arcsas          (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
22:01:14.0934 2724	arcsas - ok
22:01:14.0990 2724	AsyncMac        (e86cf7ce67d5de898f27ef884dc357d8) C:\Windows\system32\DRIVERS\asyncmac.sys
22:01:15.0088 2724	AsyncMac - ok
22:01:15.0133 2724	atapi           (b35cfcef838382ab6490b321c87edf17) C:\Windows\system32\drivers\atapi.sys
22:01:15.0150 2724	atapi - ok
22:01:15.0269 2724	AudioEndpointBuilder (e760fc1bd68f7f6f1b17eb4e8d9480b0) C:\Windows\System32\Audiosrv.dll
22:01:15.0364 2724	AudioEndpointBuilder - ok
22:01:15.0371 2724	Audiosrv        (e760fc1bd68f7f6f1b17eb4e8d9480b0) C:\Windows\System32\Audiosrv.dll
22:01:15.0422 2724	Audiosrv - ok
22:01:15.0516 2724	avgntflt        (47b879406246ffdced59e18d331a0e7d) C:\Windows\system32\DRIVERS\avgntflt.sys
22:01:15.0694 2724	avgntflt - ok
22:01:15.0749 2724	avipbb          (5fedef54757b34fb611b9ec8fb399364) C:\Windows\system32\DRIVERS\avipbb.sys
22:01:15.0768 2724	avipbb - ok
22:01:15.0825 2724	Beep            (ac3dd1708b22761ebd7cbe14dcc3b5d7) C:\Windows\system32\drivers\Beep.sys
22:01:15.0927 2724	Beep - ok
22:01:16.0023 2724	BFE             (98ebdffb824a7c265337d68dd480e45c) C:\Windows\System32\bfe.dll
22:01:16.0170 2724	BFE - ok
22:01:16.0291 2724	BITS            (da551697e34d2b9943c8b1c8eaffe89a) C:\Windows\System32\qmgr.dll
22:01:16.0451 2724	BITS - ok
22:01:16.0457 2724	blbdrive - ok
22:01:16.0485 2724	bowser          (913cd06fbe9105ce6077e90fd4418561) C:\Windows\system32\DRIVERS\bowser.sys
22:01:16.0592 2724	bowser - ok
22:01:16.0642 2724	BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
22:01:16.0750 2724	BrFiltLo - ok
22:01:16.0771 2724	BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
22:01:16.0878 2724	BrFiltUp - ok
22:01:16.0919 2724	Browser         (beb6470532b7461d7bb426e3facb424f) C:\Windows\System32\browser.dll
22:01:17.0022 2724	Browser - ok
22:01:17.0074 2724	Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
22:01:17.0169 2724	Brserid - ok
22:01:17.0195 2724	BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
22:01:17.0265 2724	BrSerWdm - ok
22:01:17.0282 2724	BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
22:01:17.0347 2724	BrUsbMdm - ok
22:01:17.0374 2724	BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
22:01:17.0455 2724	BrUsbSer - ok
22:01:17.0503 2724	BthAvrcp        (3472331b9d460212965b51a8d38e8bec) C:\Windows\system32\DRIVERS\BthAvrcp.sys
22:01:17.0515 2724	BthAvrcp - ok
22:01:17.0563 2724	BthEnum         (cf97c2d6a011ee9403b42191b5f95ba8) C:\Windows\system32\DRIVERS\BthEnum.sys
22:01:17.0625 2724	BthEnum - ok
22:01:17.0658 2724	BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\DRIVERS\bthmodem.sys
22:01:17.0763 2724	BTHMODEM - ok
22:01:17.0812 2724	BthPan          (b8c3d9ddf85fd197c3e5f849fef71144) C:\Windows\system32\DRIVERS\bthpan.sys
22:01:17.0885 2724	BthPan - ok
22:01:17.0937 2724	BTHPORT         (b4ce8000aab30a9ab16cd0fb3db4d7cf) C:\Windows\system32\Drivers\BTHport.sys
22:01:17.0975 2724	BTHPORT - ok
22:01:18.0029 2724	BthServ         (58ee7f5e68310bc8d4e7cebd8358c12e) C:\Windows\System32\bthserv.dll
22:01:18.0145 2724	BthServ - ok
22:01:18.0169 2724	BTHUSB          (9a4ddc8544c1459aa2a118a8858dade3) C:\Windows\system32\Drivers\BTHUSB.sys
22:01:18.0205 2724	BTHUSB - ok
22:01:18.0263 2724	cdfs            (6c3a437fc873c6f6a4fc620b6888cb86) C:\Windows\system32\DRIVERS\cdfs.sys
22:01:18.0310 2724	cdfs - ok
22:01:18.0332 2724	cdrom           (8d1866e61af096ae8b582454f5e4d303) C:\Windows\system32\DRIVERS\cdrom.sys
22:01:18.0380 2724	cdrom - ok
22:01:18.0421 2724	CertPropSvc     (0600e04315fe543802a379d5d23c8be0) C:\Windows\System32\certprop.dll
22:01:18.0489 2724	CertPropSvc - ok
22:01:18.0506 2724	circlass        (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
22:01:18.0553 2724	circlass - ok
22:01:18.0614 2724	CLFS            (1b84fd0937d3b99af9ba38ddff3daf54) C:\Windows\system32\CLFS.sys
22:01:18.0629 2724	CLFS - ok
22:01:18.0711 2724	clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
22:01:18.0723 2724	clr_optimization_v2.0.50727_32 - ok
22:01:18.0816 2724	CLTNetCnService - ok
22:01:18.0874 2724	CmBatt          (ed97ad3df1b9005989eaf149bf06c821) C:\Windows\system32\DRIVERS\CmBatt.sys
22:01:18.0939 2724	CmBatt - ok
22:01:18.0970 2724	cmdide          (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
22:01:18.0985 2724	cmdide - ok
22:01:19.0045 2724	CnxtHdAudService (b6e7991e3d6146c04c85cd31af22a381) C:\Windows\system32\drivers\CHDRT32.sys
22:01:19.0153 2724	CnxtHdAudService - ok
22:01:19.0160 2724	Compbatt        (722936afb75a7f509662b69b5632f48a) C:\Windows\system32\DRIVERS\compbatt.sys
22:01:19.0177 2724	Compbatt - ok
22:01:19.0184 2724	COMSysApp - ok
22:01:19.0197 2724	crcdisk         (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
22:01:19.0213 2724	crcdisk - ok
22:01:19.0248 2724	Crusoe          (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
22:01:19.0317 2724	Crusoe - ok
22:01:19.0420 2724	CryptSvc        (1c26fb097170a2a91066d1e3a24366e3) C:\Windows\system32\cryptsvc.dll
22:01:19.0494 2724	CryptSvc - ok
22:01:19.0573 2724	DcomLaunch      (7b981222a257d076885bffb66f19b7ce) C:\Windows\system32\rpcss.dll
22:01:19.0731 2724	DcomLaunch - ok
22:01:19.0819 2724	DfsC            (a7179de59ae269ab70345527894ccd7c) C:\Windows\system32\Drivers\dfsc.sys
22:01:19.0931 2724	DfsC - ok
22:01:20.0162 2724	DFSR            (e0d584aa76c7d845ba9f3a788260528f) C:\Windows\system32\DFSR.exe
22:01:20.0474 2724	DFSR - ok
22:01:20.0638 2724	Dhcp            (dc45739bc22d528d2b3e50d3f6761750) C:\Windows\System32\dhcpcsvc.dll
22:01:20.0741 2724	Dhcp - ok
22:01:20.0841 2724	disk            (841af4c4d41d3e3b2f244e976b0f7963) C:\Windows\system32\drivers\disk.sys
22:01:20.0858 2724	disk - ok
22:01:20.0928 2724	Dnscache        (eecba1dd142bf8693c476be8f32fe253) C:\Windows\System32\dnsrslvr.dll
22:01:21.0023 2724	Dnscache - ok
22:01:21.0081 2724	dot3svc         (1f795d214820e496bf1124434a6db546) C:\Windows\System32\dot3svc.dll
22:01:21.0199 2724	dot3svc - ok
22:01:21.0271 2724	DPS             (032c90ad677bf7b7a8013d6087c7a921) C:\Windows\system32\dps.dll
22:01:21.0306 2724	DPS - ok
22:01:21.0365 2724	drmkaud         (ee472cd2c01f6f8e8aa1fa06ffef61b6) C:\Windows\system32\drivers\drmkaud.sys
22:01:21.0436 2724	drmkaud - ok
22:01:21.0459 2724	dtwmnic5 - ok
22:01:21.0524 2724	DXGKrnl         (a2b160c1bb13ee3303c342e551373c59) C:\Windows\System32\drivers\dxgkrnl.sys
22:01:21.0573 2724	DXGKrnl - ok
22:01:21.0669 2724	E100B           (c0b00e55cf82d122d25983c7a6a53dea) C:\Windows\system32\DRIVERS\e100b325.sys
22:01:21.0773 2724	E100B - ok
22:01:21.0836 2724	E1G60           (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
22:01:21.0893 2724	E1G60 - ok
22:01:21.0936 2724	EapHost         (90a0a875642e18618010645311b4e89e) C:\Windows\System32\eapsvc.dll
22:01:22.0024 2724	EapHost - ok
22:01:22.0081 2724	Ecache          (0efc7531b936ee57fdb4e837664c509f) C:\Windows\system32\drivers\ecache.sys
22:01:22.0097 2724	Ecache - ok
22:01:22.0216 2724	ehRecvr         (b4580122b0a7b263b6ee9acba69c8013) C:\Windows\ehome\ehRecvr.exe
22:01:22.0279 2724	ehRecvr - ok
22:01:22.0341 2724	ehSched         (ad1870c8e5d6dd340c829e6074bf3c3f) C:\Windows\ehome\ehsched.exe
22:01:22.0390 2724	ehSched - ok
22:01:22.0428 2724	ehstart         (c27c4ee8926e74aa72efcab24c5242c3) C:\Windows\ehome\ehstart.dll
22:01:22.0447 2724	ehstart - ok
22:01:22.0561 2724	elxstor         (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
22:01:22.0601 2724	elxstor - ok
22:01:22.0699 2724	EMDMgmt         (3226fda08988526e819e364e8cce4cee) C:\Windows\system32\emdmgmt.dll
22:01:22.0911 2724	EMDMgmt - ok
22:01:22.0991 2724	EventSystem     (7b4971c3d43525175a4ea0d143e0412e) C:\Windows\system32\es.dll
22:01:23.0094 2724	EventSystem - ok
22:01:23.0114 2724	fastfat         (84a317cb0b3954d3768cdcd018dbf670) C:\Windows\system32\drivers\fastfat.sys
22:01:23.0187 2724	fastfat - ok
22:01:23.0206 2724	fdc             (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
22:01:23.0276 2724	fdc - ok
22:01:23.0302 2724	fdPHost         (e43bce1a77d6fd4ed5f8e0482b9e7df1) C:\Windows\system32\fdPHost.dll
22:01:23.0369 2724	fdPHost - ok
22:01:23.0375 2724	FDResPub        (89ed56dce8e47af40892778a5bd31fd2) C:\Windows\system32\fdrespub.dll
22:01:23.0428 2724	FDResPub - ok
22:01:23.0454 2724	FileInfo        (65773d6115c037ffd7ef8280ae85eb9d) C:\Windows\system32\drivers\fileinfo.sys
22:01:23.0464 2724	FileInfo - ok
22:01:23.0494 2724	Filetrace       (c226dd0de060745f3e042f58dcf78402) C:\Windows\system32\drivers\filetrace.sys
22:01:23.0562 2724	Filetrace - ok
22:01:23.0579 2724	flpydisk        (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
22:01:23.0625 2724	flpydisk - ok
22:01:23.0639 2724	FltMgr          (a6a8da7ae4d53394ab22ac3ab6d3f5d3) C:\Windows\system32\drivers\fltmgr.sys
22:01:23.0653 2724	FltMgr - ok
22:01:23.0726 2724	FontCache3.0.0.0 (c9be08664611ddaf98e2331e9288b00b) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
22:01:23.0736 2724	FontCache3.0.0.0 - ok
22:01:23.0772 2724	Fs_Rec          (66a078591208baa210c7634b11eb392c) C:\Windows\system32\drivers\Fs_Rec.sys
22:01:23.0806 2724	Fs_Rec - ok
22:01:23.0828 2724	gagp30kx        (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
22:01:23.0839 2724	gagp30kx - ok
22:01:23.0870 2724	GEARAspiWDM     (4ac51459805264affd5f6fdfb9d9235f) C:\Windows\system32\Drivers\GEARAspiWDM.sys
22:01:23.0886 2724	GEARAspiWDM - ok
22:01:23.0957 2724	gpsvc           (bcf6589c42d8f6a20f33ef133ffe0524) C:\Windows\System32\gpsvc.dll
22:01:24.0114 2724	gpsvc - ok
22:01:24.0223 2724	gupdate         (626a24ed1228580b9518c01930936df9) C:\Program Files\Google\Update\GoogleUpdate.exe
22:01:24.0238 2724	gupdate - ok
22:01:24.0260 2724	gupdatem        (626a24ed1228580b9518c01930936df9) C:\Program Files\Google\Update\GoogleUpdate.exe
22:01:24.0278 2724	gupdatem - ok
22:01:24.0334 2724	HdAudAddService (de4020f928a2f8a6327f5687f36d361b) C:\Windows\system32\drivers\CHDART.sys
22:01:24.0413 2724	HdAudAddService - ok
22:01:24.0442 2724	HDAudBus        (0db613a7e427b5663563677796fd5258) C:\Windows\system32\DRIVERS\HDAudBus.sys
22:01:24.0486 2724	HDAudBus - ok
22:01:24.0516 2724	HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
22:01:24.0596 2724	HidBth - ok
22:01:24.0622 2724	HidIr           (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
22:01:24.0668 2724	HidIr - ok
22:01:24.0699 2724	hidserv         (8fa640195279ace21bea91396a0054fc) C:\Windows\system32\hidserv.dll
22:01:24.0771 2724	hidserv - ok
22:01:24.0801 2724	HidUsb          (01e7971e9f4bd6ac6a08db52d0ea0418) C:\Windows\system32\DRIVERS\hidusb.sys
22:01:24.0827 2724	HidUsb - ok
22:01:24.0856 2724	hkmsvc          (d40aa05e29bf6ed29b139f044b461e9b) C:\Windows\system32\kmsvc.dll
22:01:24.0923 2724	hkmsvc - ok
22:01:24.0947 2724	HpCISSs         (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
22:01:24.0956 2724	HpCISSs - ok
22:01:25.0011 2724	HSFHWAZL        (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
22:01:25.0098 2724	HSFHWAZL - ok
22:01:25.0193 2724	HSF_DPV         (53229dcf431d76434816cd29251168a0) C:\Windows\system32\DRIVERS\HSX_DPV.sys
22:01:25.0348 2724	HSF_DPV - ok
22:01:25.0397 2724	HSXHWAZL        (31f949d452201f2f0af0c88d7db512cd) C:\Windows\system32\DRIVERS\HSXHWAZL.sys
22:01:25.0455 2724	HSXHWAZL - ok
22:01:25.0598 2724	HTTP            (ea24fe637d974a8a31bc650f478e3533) C:\Windows\system32\drivers\HTTP.sys
22:01:25.0754 2724	HTTP - ok
22:01:25.0787 2724	i2omp           (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
22:01:25.0804 2724	i2omp - ok
22:01:25.0900 2724	i8042prt        (1c9ee072baa3abb460b91d7ee9152660) C:\Windows\system32\DRIVERS\i8042prt.sys
22:01:25.0950 2724	i8042prt - ok
22:01:26.0150 2724	ialm            (0215e1204d5410e50a5ea9d442fe7da3) C:\Windows\system32\DRIVERS\igdkmd32.sys
22:01:26.0380 2724	ialm - ok
22:01:26.0552 2724	iaStor          (de01bf14ffb150c779fd561bd0e3c5c5) C:\Windows\system32\drivers\iastor.sys
22:01:26.0640 2724	iaStor - ok
22:01:26.0688 2724	iaStorV         (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
22:01:26.0718 2724	iaStorV - ok
22:01:26.0857 2724	idsvc           (7b630acaed64fef0c3e1cf255cb56686) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
22:01:26.0956 2724	idsvc - ok
22:01:27.0136 2724	igfx            (0215e1204d5410e50a5ea9d442fe7da3) C:\Windows\system32\DRIVERS\igdkmd32.sys
22:01:27.0248 2724	igfx - ok
22:01:27.0391 2724	iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
22:01:27.0408 2724	iirsp - ok
22:01:27.0475 2724	IKEEXT          (35662fe4d8622f667aa5a5568f7f1b40) C:\Windows\System32\ikeext.dll
22:01:27.0616 2724	IKEEXT - ok
22:01:27.0667 2724	intelide        (988981c840084f480ba9e3319cebde1b) C:\Windows\system32\drivers\intelide.sys
22:01:27.0683 2724	intelide - ok
22:01:27.0710 2724	intelppm        (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys
22:01:27.0814 2724	intelppm - ok
22:01:27.0845 2724	IPBusEnum       (88cf5281ed9880d74dc9011cf8b5262d) C:\Windows\system32\ipbusenum.dll
22:01:27.0961 2724	IPBusEnum - ok
22:01:27.0986 2724	IpFilterDriver  (880c6f86cc3f551b8fea2c11141268c0) C:\Windows\system32\DRIVERS\ipfltdrv.sys
22:01:28.0088 2724	IpFilterDriver - ok
22:01:28.0135 2724	iphlpsvc        (ecc9ad72cfc4ab41cf6a9bcc11f9fef6) C:\Windows\System32\iphlpsvc.dll
22:01:28.0241 2724	iphlpsvc - ok
22:01:28.0250 2724	IpInIp - ok
22:01:28.0278 2724	IPMIDRV         (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
22:01:28.0376 2724	IPMIDRV - ok
22:01:28.0401 2724	IPNAT           (10077c35845101548037df04fd1a420b) C:\Windows\system32\DRIVERS\ipnat.sys
22:01:28.0449 2724	IPNAT - ok
22:01:28.0551 2724	iPod Service    (d462588d99310a87f758a2af4a82d98f) C:\Program Files\iPod\bin\iPodService.exe
22:01:28.0593 2724	iPod Service - ok
22:01:28.0649 2724	IRENUM          (a82f328f4792304184642d6d397bb1e3) C:\Windows\system32\drivers\irenum.sys
22:01:28.0748 2724	IRENUM - ok
22:01:28.0793 2724	isapnp          (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
22:01:28.0803 2724	isapnp - ok
22:01:28.0847 2724	iScsiPrt        (4dca456d4d5723f8fa9c6760d240b0df) C:\Windows\system32\DRIVERS\msiscsi.sys
22:01:28.0861 2724	iScsiPrt - ok
22:01:28.0882 2724	iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
22:01:28.0892 2724	iteatapi - ok
22:01:28.0910 2724	iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
22:01:28.0919 2724	iteraid - ok
22:01:28.0961 2724	JGOGO           (c995c0e8b4503fac38793bb0236ad246) C:\Windows\system32\drivers\jgogo.sys
22:01:28.0994 2724	JGOGO - ok
22:01:29.0013 2724	JRAID           (6568289bc2e9ca3e8082817f0933685b) C:\Windows\system32\drivers\jraid.sys
22:01:29.0020 2724	JRAID ( UnsignedFile.Multi.Generic ) - warning
22:01:29.0021 2724	JRAID - detected UnsignedFile.Multi.Generic (1)
22:01:29.0045 2724	kbdclass        (b076b2ab806b3f696dab21375389101c) C:\Windows\system32\DRIVERS\kbdclass.sys
22:01:29.0059 2724	kbdclass - ok
22:01:29.0088 2724	kbdhid          (d2600cb17b7408b4a83f231dc9a11ac3) C:\Windows\system32\drivers\kbdhid.sys
22:01:29.0151 2724	kbdhid - ok
22:01:29.0180 2724	KeyIso          (c731b1fe449d4e9cea358c9d55b69be9) C:\Windows\system32\lsass.exe
22:01:29.0263 2724	KeyIso - ok
22:01:29.0312 2724	KSecDD          (0a829977b078dea11641fc2af87ceade) C:\Windows\system32\Drivers\ksecdd.sys
22:01:29.0407 2724	KSecDD - ok
22:01:29.0489 2724	KtmRm           (45c537fe5dde9a0146aeff76e615737d) C:\Windows\system32\msdtckrm.dll
22:01:29.0593 2724	KtmRm - ok
22:01:29.0646 2724	LanmanServer    (53d1482fc1aa36ac015a85e6cf2146bd) C:\Windows\system32\srvsvc.dll
22:01:29.0754 2724	LanmanServer - ok
22:01:29.0795 2724	LanmanWorkstation (435f0f6dc87a4b5da78f1fa309884189) C:\Windows\System32\wkssvc.dll
22:01:29.0877 2724	LanmanWorkstation - ok
22:01:29.0916 2724	lltdio          (fd015b4f95daa2b712f0e372a116fbad) C:\Windows\system32\DRIVERS\lltdio.sys
22:01:30.0001 2724	lltdio - ok
22:01:30.0057 2724	lltdsvc         (7450dbcf754391dd6363fffd5ef0e789) C:\Windows\System32\lltdsvc.dll
22:01:30.0139 2724	lltdsvc - ok
22:01:30.0164 2724	lmhosts         (35d40113e4a5b961b6ce5c5857702518) C:\Windows\System32\lmhsvc.dll
22:01:30.0233 2724	lmhosts - ok
22:01:30.0264 2724	LSI_FC          (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
22:01:30.0274 2724	LSI_FC - ok
22:01:30.0295 2724	LSI_SAS         (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
22:01:30.0307 2724	LSI_SAS - ok
22:01:30.0345 2724	LSI_SCSI        (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
22:01:30.0356 2724	LSI_SCSI - ok
22:01:30.0381 2724	luafv           (42885bb44b6e065b8575a8dd6c430c52) C:\Windows\system32\drivers\luafv.sys
22:01:30.0448 2724	luafv - ok
22:01:30.0492 2724	MBAMProtector   (fb097bbc1a18f044bd17bd2fccf97865) C:\Windows\system32\drivers\mbam.sys
22:01:30.0509 2724	MBAMProtector - ok
22:01:30.0822 2724	MBAMService     (ba400ed640bca1eae5c727ae17c10207) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
22:01:30.0866 2724	MBAMService - ok
22:01:30.0912 2724	Mcx2Svc         (e93c1ad58e88a0846eaee10671c2a8f3) C:\Windows\system32\Mcx2Svc.dll
22:01:30.0954 2724	Mcx2Svc - ok
22:01:31.0000 2724	mdmxsdk         (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys
22:01:31.0042 2724	mdmxsdk - ok
22:01:31.0085 2724	megasas         (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
22:01:31.0101 2724	megasas - ok
22:01:31.0166 2724	MMCSS           (9dfa3a459af0954aa85b4f7622ad87bb) C:\Windows\system32\mmcss.dll
22:01:31.0285 2724	MMCSS - ok
22:01:31.0320 2724	Modem           (21755967298a46fb6adfec9db6012211) C:\Windows\system32\drivers\modem.sys
22:01:31.0389 2724	Modem - ok
22:01:31.0428 2724	monitor         (7446e104a5fe5987ca9e4983fbac4f97) C:\Windows\system32\DRIVERS\monitor.sys
22:01:31.0488 2724	monitor - ok
22:01:31.0514 2724	mouclass        (5fba13c1a1841b0885d316ed3589489d) C:\Windows\system32\DRIVERS\mouclass.sys
22:01:31.0525 2724	mouclass - ok
22:01:31.0560 2724	mouhid          (b569b5c5d3bde545df3a6af512cccdba) C:\Windows\system32\DRIVERS\mouhid.sys
22:01:31.0589 2724	mouhid - ok
22:01:31.0615 2724	MountMgr        (01f1e5a3e4877c931cbb31613fec16a6) C:\Windows\system32\drivers\mountmgr.sys
22:01:31.0629 2724	MountMgr - ok
22:01:31.0660 2724	mpio            (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
22:01:31.0674 2724	mpio - ok
22:01:31.0710 2724	mpsdrv          (6e7a7f0c1193ee5648443fe2d4b789ec) C:\Windows\system32\drivers\mpsdrv.sys
22:01:31.0782 2724	mpsdrv - ok
22:01:31.0842 2724	MpsSvc          (563ed845885c6a7c09a7715d8bd0585c) C:\Windows\system32\mpssvc.dll
22:01:31.0936 2724	MpsSvc - ok
22:01:31.0978 2724	Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
22:01:31.0995 2724	Mraid35x - ok
22:01:32.0022 2724	MRxDAV          (1d8828b98ee309d65e006f0829e280e5) C:\Windows\system32\drivers\mrxdav.sys
22:01:32.0071 2724	MRxDAV - ok
22:01:32.0103 2724	mrxsmb          (8af705ce1bb907932157fab821170f27) C:\Windows\system32\DRIVERS\mrxsmb.sys
22:01:32.0170 2724	mrxsmb - ok
22:01:32.0199 2724	mrxsmb10        (47e13ab23371be3279eef22bbfa2c1be) C:\Windows\system32\DRIVERS\mrxsmb10.sys
22:01:32.0324 2724	mrxsmb10 - ok
22:01:32.0351 2724	mrxsmb20        (90b3fc7bd6b3d7ee7635debba2187f66) C:\Windows\system32\DRIVERS\mrxsmb20.sys
22:01:32.0394 2724	mrxsmb20 - ok
22:01:32.0426 2724	msahci          (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
22:01:32.0443 2724	msahci - ok
22:01:32.0495 2724	msdsm           (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
22:01:32.0513 2724	msdsm - ok
22:01:32.0584 2724	MSDTC           (bc64a92d821efea8bab8e8caf1b668bc) C:\Windows\System32\msdtc.exe
22:01:32.0621 2724	MSDTC - ok
22:01:32.0679 2724	Msfs            (729eafefd4e7417165f353a18dbe947d) C:\Windows\system32\drivers\Msfs.sys
22:01:32.0776 2724	Msfs - ok
22:01:32.0828 2724	msisadrv        (5f454a16a5146cd91a176d70f0cfa3ec) C:\Windows\system32\drivers\msisadrv.sys
22:01:32.0837 2724	msisadrv - ok
22:01:32.0871 2724	MSiSCSI         (8acf956d9154e893e789881430c12632) C:\Windows\system32\iscsiexe.dll
22:01:32.0948 2724	MSiSCSI - ok
22:01:32.0955 2724	msiserver - ok
22:01:32.0984 2724	MSKSSRV         (892cedefa7e0ffe7be8da651b651d047) C:\Windows\system32\drivers\MSKSSRV.sys
22:01:33.0031 2724	MSKSSRV - ok
22:01:33.0050 2724	MSPCLOCK        (ae2cb1da69b2676b4cee2a501af5871c) C:\Windows\system32\drivers\MSPCLOCK.sys
22:01:33.0125 2724	MSPCLOCK - ok
22:01:33.0154 2724	MSPQM           (f910da84fa90c44a3addb7cd874463fd) C:\Windows\system32\drivers\MSPQM.sys
22:01:33.0202 2724	MSPQM - ok
22:01:33.0228 2724	MsRPC           (84571c0ae07647ba38d493f5f0015df7) C:\Windows\system32\drivers\MsRPC.sys
22:01:33.0241 2724	MsRPC - ok
22:01:33.0260 2724	mssmbios        (4385c80ede885e25492d408cad91bd6f) C:\Windows\system32\DRIVERS\mssmbios.sys
22:01:33.0270 2724	mssmbios - ok
22:01:33.0289 2724	MSTEE           (c826dd1373f38afd9ca46ec3c436a14e) C:\Windows\system32\drivers\MSTEE.sys
22:01:33.0335 2724	MSTEE - ok
22:01:33.0342 2724	Mup             (fa7aa70050cf5e2d15de00941e5665e5) C:\Windows\system32\Drivers\mup.sys
22:01:33.0352 2724	Mup - ok
22:01:33.0393 2724	napagent        (1cdbb5d002fe2bc5300aa20550d8a52e) C:\Windows\system32\qagentRT.dll
22:01:33.0479 2724	napagent - ok
22:01:33.0527 2724	NativeWifiP     (6da4a0fc7c0e83df0cb3cfd0a514c3bc) C:\Windows\system32\DRIVERS\nwifi.sys
22:01:33.0565 2724	NativeWifiP - ok
22:01:33.0616 2724	NDIS            (227c11e1e7cf6ef8afb2a238d209760c) C:\Windows\system32\drivers\ndis.sys
22:01:33.0662 2724	NDIS - ok
22:01:33.0724 2724	NdisTapi        (81659cdcbd0f9a9e07e6878ad8c78d3f) C:\Windows\system32\DRIVERS\ndistapi.sys
22:01:33.0763 2724	NdisTapi - ok
22:01:33.0783 2724	Ndisuio         (5de5ee546bf40838ebe0e01cb629df64) C:\Windows\system32\DRIVERS\ndisuio.sys
22:01:33.0866 2724	Ndisuio - ok
22:01:33.0886 2724	NdisWan         (397402adcbb8946223a1950101f6cd94) C:\Windows\system32\DRIVERS\ndiswan.sys
22:01:33.0959 2724	NdisWan - ok
22:01:34.0004 2724	NDProxy         (1b24fa907af283199a81b3bb37e5e526) C:\Windows\system32\drivers\NDProxy.sys
22:01:34.0043 2724	NDProxy - ok
22:01:34.0070 2724	NetBIOS         (356dbb9f98e8dc1028dd3092fceeb877) C:\Windows\system32\DRIVERS\netbios.sys
22:01:34.0179 2724	NetBIOS - ok
22:01:34.0222 2724	netbt           (e3a168912e7eefc3bd3b814720d68b41) C:\Windows\system32\DRIVERS\netbt.sys
22:01:34.0329 2724	netbt - ok
22:01:34.0366 2724	Netlogon        (c731b1fe449d4e9cea358c9d55b69be9) C:\Windows\system32\lsass.exe
22:01:34.0395 2724	Netlogon - ok
22:01:34.0461 2724	Netman          (90a4dae28b94497f83bea0f2a3b77092) C:\Windows\System32\netman.dll
22:01:34.0583 2724	Netman - ok
22:01:34.0625 2724	netprofm        (7c5c3d9ceee838856b828ab6f98a2857) C:\Windows\System32\netprofm.dll
22:01:34.0724 2724	netprofm - ok
22:01:34.0800 2724	NetTcpPortSharing (0ad5876ef4e9eb77c8f93eb5b2fff386) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
22:01:34.0812 2724	NetTcpPortSharing - ok
22:01:34.0960 2724	NETw3v32        (acc6170d80c69e50145b370023b64ed3) C:\Windows\system32\DRIVERS\NETw3v32.sys
22:01:35.0203 2724	NETw3v32 - ok
22:01:35.0342 2724	nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
22:01:35.0358 2724	nfrd960 - ok
22:01:35.0414 2724	NlaSvc          (c424117a562f2de37a42266894c79aeb) C:\Windows\System32\nlasvc.dll
22:01:35.0525 2724	NlaSvc - ok
22:01:35.0682 2724	NMIndexingService (7b273501c59d52978b761f82bebadb06) C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
22:01:35.0721 2724	NMIndexingService - ok
22:01:35.0815 2724	Npfs            (4f9832beb9fafd8ceb0e541f1323b26e) C:\Windows\system32\drivers\Npfs.sys
22:01:35.0923 2724	Npfs - ok
22:01:35.0962 2724	nsi             (23b8201a363de0e649fc75ee9874dee2) C:\Windows\system32\nsisvc.dll
22:01:36.0046 2724	nsi - ok
22:01:36.0078 2724	nsiproxy        (b488dfec274de1fc9d653870ef2587be) C:\Windows\system32\drivers\nsiproxy.sys
22:01:36.0142 2724	nsiproxy - ok
22:01:36.0256 2724	Ntfs            (37430aa7a66d7a63407adc2c0d05e9f6) C:\Windows\system32\drivers\Ntfs.sys
22:01:36.0367 2724	Ntfs - ok
22:01:36.0406 2724	ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
22:01:36.0487 2724	ntrigdigi - ok
22:01:36.0494 2724	Null            (ec5efb3c60f1b624648344a328bce596) C:\Windows\system32\drivers\Null.sys
22:01:36.0573 2724	Null - ok
22:01:36.0631 2724	nvatabus        (7d960340be5b0e008bb94e4c3b991339) C:\Windows\system32\drivers\nvatabus.sys
22:01:36.0691 2724	nvatabus - ok
22:01:36.0729 2724	nvraid          (52f54c59a0ec7920c23638313e99e43c) C:\Windows\system32\drivers\nvraid.sys
22:01:36.0741 2724	nvraid - ok
22:01:36.0769 2724	nvstor          (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
22:01:36.0781 2724	nvstor - ok
22:01:36.0810 2724	nv_agp          (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
22:01:36.0825 2724	nv_agp - ok
22:01:36.0830 2724	NwlnkFlt - ok
22:01:36.0842 2724	NwlnkFwd - ok
22:01:36.0882 2724	ohci1394        (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\DRIVERS\ohci1394.sys
22:01:36.0948 2724	ohci1394 - ok
22:01:37.0060 2724	p2pimsvc        (016d01d3b8fb976a193c7434bed8dccf) C:\Windows\system32\p2psvc.dll
22:01:37.0144 2724	p2pimsvc - ok
22:01:37.0160 2724	p2psvc          (016d01d3b8fb976a193c7434bed8dccf) C:\Windows\system32\p2psvc.dll
22:01:37.0194 2724	p2psvc - ok
22:01:37.0245 2724	Parport         (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
22:01:37.0325 2724	Parport - ok
22:01:37.0353 2724	partmgr         (555a5b2c8022983bc7467bc925b222ee) C:\Windows\system32\drivers\partmgr.sys
22:01:37.0367 2724	partmgr - ok
22:01:37.0390 2724	Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
22:01:37.0500 2724	Parvdm - ok
22:01:37.0540 2724	PcaSvc          (d8c5c215c932233a4f1d7f368f4e4e65) C:\Windows\System32\pcasvc.dll
22:01:37.0582 2724	PcaSvc - ok
22:01:37.0673 2724	pccsmcfd        (fd2041e9ba03db7764b2248f02475079) C:\Windows\system32\DRIVERS\pccsmcfd.sys
22:01:37.0736 2724	pccsmcfd - ok
22:01:37.0755 2724	pci             (1085d75657807e0e8b32f9e19a1647c3) C:\Windows\system32\drivers\pci.sys
22:01:37.0774 2724	pci - ok
22:01:37.0837 2724	pciide          (3b1901e401473e03eb8c874271e50c26) C:\Windows\system32\drivers\pciide.sys
22:01:37.0847 2724	pciide - ok
22:01:37.0873 2724	pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
22:01:37.0887 2724	pcmcia - ok
22:01:37.0963 2724	PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
22:01:38.0135 2724	PEAUTH - ok
22:01:38.0275 2724	pla             (cd05a38d166beade18030bafc0c0a939) C:\Windows\system32\pla.dll
22:01:38.0525 2724	pla - ok
22:01:38.0578 2724	PlugPlay        (747bb4c31f3b6e8d1b5ed0ad61518cb5) C:\Windows\system32\umpnpmgr.dll
22:01:38.0641 2724	PlugPlay - ok
22:01:38.0737 2724	PNRPAutoReg     (016d01d3b8fb976a193c7434bed8dccf) C:\Windows\system32\p2psvc.dll
22:01:38.0778 2724	PNRPAutoReg - ok
22:01:38.0792 2724	PNRPsvc         (016d01d3b8fb976a193c7434bed8dccf) C:\Windows\system32\p2psvc.dll
22:01:38.0833 2724	PNRPsvc - ok
22:01:38.0914 2724	PolicyAgent     (5ebdec613bd377ce9a85382be5c6b83b) C:\Windows\System32\ipsecsvc.dll
22:01:39.0048 2724	PolicyAgent - ok
22:01:39.0150 2724	PptpMiniport    (c04dec5ace67c5247b150c4223970bb7) C:\Windows\system32\DRIVERS\raspptp.sys
22:01:39.0222 2724	PptpMiniport - ok
22:01:39.0299 2724	Processor       (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
22:01:39.0376 2724	Processor - ok
22:01:39.0409 2724	ProfSvc         (213112e152e68f0e4705e36f052a2880) C:\Windows\system32\profsvc.dll
22:01:39.0488 2724	ProfSvc - ok
22:01:39.0520 2724	ProtectedStorage (c731b1fe449d4e9cea358c9d55b69be9) C:\Windows\system32\lsass.exe
22:01:39.0534 2724	ProtectedStorage - ok
22:01:39.0568 2724	PxHelp20        (1962166e0ceb740704f30fa55ad3d509) C:\Windows\system32\Drivers\PxHelp20.sys
22:01:39.0597 2724	PxHelp20 ( UnsignedFile.Multi.Generic ) - warning
22:01:39.0597 2724	PxHelp20 - detected UnsignedFile.Multi.Generic (1)
22:01:39.0649 2724	qkbfiltr        (3a9036152131478f2d6e1e8531df6825) C:\Windows\system32\DRIVERS\qkbfiltr.sys
22:01:39.0709 2724	qkbfiltr - ok
22:01:39.0811 2724	ql2300          (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
22:01:39.0930 2724	ql2300 - ok
22:01:39.0968 2724	ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
22:01:39.0987 2724	ql40xx - ok
22:01:40.0071 2724	QWAVE           (ca61bdfd3713a7ce75f2812afc431594) C:\Windows\system32\qwave.dll
22:01:40.0147 2724	QWAVE - ok
22:01:40.0184 2724	QWAVEdrv        (d2b3e2b7426dc23e185fbc73c8936c12) C:\Windows\system32\drivers\qwavedrv.sys
22:01:40.0232 2724	QWAVEdrv - ok
22:01:40.0261 2724	RasAcd          (bd7b30f55b3649506dd8b3d38f571d2a) C:\Windows\system32\DRIVERS\rasacd.sys
22:01:40.0361 2724	RasAcd - ok
22:01:40.0397 2724	RasAuto         (f14f4aab9f54d099fe99192bdb100ac9) C:\Windows\System32\rasauto.dll
22:01:40.0479 2724	RasAuto - ok
22:01:40.0505 2724	Rasl2tp         (68b0019fee429ec49d29017af937e482) C:\Windows\system32\DRIVERS\rasl2tp.sys
22:01:40.0518 2724	Rasl2tp - ok
22:01:40.0545 2724	RasMan          (11d65e29bc9d1e4114d18fe68194394c) C:\Windows\System32\rasmans.dll
22:01:40.0627 2724	RasMan - ok
22:01:40.0654 2724	RasPppoe        (ccf4e9c6cbbac81437f88cb2ae0b6c96) C:\Windows\system32\DRIVERS\raspppoe.sys
22:01:40.0713 2724	RasPppoe - ok
22:01:40.0741 2724	rdbss           (54129c5d9581bbec8bd1ebd3ba813f47) C:\Windows\system32\DRIVERS\rdbss.sys
22:01:40.0855 2724	rdbss - ok
22:01:40.0895 2724	RDPCDD          (794585276b5d7fca9f3fc15543f9f0b9) C:\Windows\system32\DRIVERS\RDPCDD.sys
22:01:40.0981 2724	RDPCDD - ok
22:01:41.0033 2724	rdpdr           (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
22:01:41.0092 2724	rdpdr - ok
22:01:41.0097 2724	RDPENCDD        (980b56e2e273e19d3a9d72d5c420f008) C:\Windows\system32\drivers\rdpencdd.sys
22:01:41.0146 2724	RDPENCDD - ok
22:01:41.0184 2724	RDPWD           (8830e790a74a96605faba74f9665bb3c) C:\Windows\system32\drivers\RDPWD.sys
22:01:41.0233 2724	RDPWD - ok
22:01:41.0285 2724	RemoteAccess    (6c1a43c589ee8011a1ebfd51c01b77ce) C:\Windows\System32\mprdim.dll
22:01:41.0334 2724	RemoteAccess - ok
22:01:41.0364 2724	RemoteRegistry  (9a043808667c8c1893da7275af373f0e) C:\Windows\system32\regsvc.dll
22:01:41.0444 2724	RemoteRegistry - ok
22:01:41.0481 2724	RFCOMM          (7ec90c316177ba3f1bce92005264b447) C:\Windows\system32\DRIVERS\rfcomm.sys
22:01:41.0529 2724	RFCOMM - ok
22:01:41.0570 2724	rimmptsk        (d85e3fa9f5b1f29bb4ed185c450d1470) C:\Windows\system32\DRIVERS\rimmptsk.sys
22:01:41.0595 2724	rimmptsk - ok
22:01:41.0627 2724	rimsptsk        (db8eb01c58c9fada00c70b1775278ae0) C:\Windows\system32\DRIVERS\rimsptsk.sys
22:01:41.0690 2724	rimsptsk - ok
22:01:41.0720 2724	rismxdp         (6c1f93c0760c9f79a1869d07233df39d) C:\Windows\system32\DRIVERS\rixdptsk.sys
22:01:41.0740 2724	rismxdp - ok
22:01:41.0791 2724	ROOTMODEM       (d49d61312b273de069584d48c81c8b1d) C:\Windows\system32\Drivers\RootMdm.sys
22:01:41.0874 2724	ROOTMODEM - ok
22:01:41.0905 2724	RpcLocator      (5123f83cbc4349d065534eeb6bbdc42b) C:\Windows\system32\locator.exe
22:01:41.0923 2724	RpcLocator - ok
22:01:41.0988 2724	RpcSs           (7b981222a257d076885bffb66f19b7ce) C:\Windows\system32\rpcss.dll
22:01:42.0027 2724	RpcSs - ok
22:01:42.0063 2724	rspndr          (97e939d2128fec5d5a3e6e79b290a2f4) C:\Windows\system32\DRIVERS\rspndr.sys
22:01:42.0112 2724	rspndr - ok
22:01:42.0136 2724	SamSs           (c731b1fe449d4e9cea358c9d55b69be9) C:\Windows\system32\lsass.exe
22:01:42.0149 2724	SamSs - ok
22:01:42.0178 2724	sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
22:01:42.0190 2724	sbp2port - ok
22:01:42.0360 2724	SBSDWSCService  (794d4b48dfb6e999537c7c3947863463) C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
22:01:42.0559 2724	SBSDWSCService - ok
22:01:42.0615 2724	SCardSvr        (565b4b9e5ad2f2f18a4f8aafa6c06bbb) C:\Windows\System32\SCardSvr.dll
22:01:42.0722 2724	SCardSvr - ok
22:01:42.0800 2724	Schedule        (886cec884b5be29ab9828b8ab46b11f7) C:\Windows\system32\schedsvc.dll
22:01:42.0869 2724	Schedule - ok
22:01:42.0937 2724	SCPolicySvc     (0600e04315fe543802a379d5d23c8be0) C:\Windows\System32\certprop.dll
22:01:42.0997 2724	SCPolicySvc - ok
22:01:43.0045 2724	sdbus           (7b3973cc28b8aa3e9e2e5d53e720e2c9) C:\Windows\system32\DRIVERS\sdbus.sys
22:01:43.0071 2724	sdbus - ok
22:01:43.0094 2724	SDRSVC          (f7b6bf02240d0a764adf8c8966735552) C:\Windows\System32\SDRSVC.dll
22:01:43.0155 2724	SDRSVC - ok
22:01:43.0192 2724	secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
22:01:43.0239 2724	secdrv - ok
22:01:43.0251 2724	seclogon        (8388c4133ddbe62ad7bc3ec9f14271ed) C:\Windows\system32\seclogon.dll
22:01:43.0325 2724	seclogon - ok
22:01:43.0366 2724	SENS            (34350ae2c1d33d21c7305f861bd8dad8) C:\Windows\System32\sens.dll
22:01:43.0430 2724	SENS - ok
22:01:43.0451 2724	Serenum         (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
22:01:43.0520 2724	Serenum - ok
22:01:43.0552 2724	Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
22:01:43.0614 2724	Serial - ok
22:01:43.0651 2724	sermouse        (450accd77ec5cea720c1cdb9e26b953b) C:\Windows\system32\drivers\sermouse.sys
22:01:43.0691 2724	sermouse - ok
22:01:43.0832 2724	ServiceLayer    (5bf59c6bc737baaf541168e5cb2ec1d9) C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
22:01:43.0862 2724	ServiceLayer ( UnsignedFile.Multi.Generic ) - warning
22:01:43.0862 2724	ServiceLayer - detected UnsignedFile.Multi.Generic (1)
22:01:43.0931 2724	SessionEnv      (78878235da4df0d116e86837a0a21df8) C:\Windows\system32\sessenv.dll
22:01:43.0984 2724	SessionEnv - ok
22:01:44.0009 2724	sffdisk         (51cf56aa8bcc241f134b420b8f850406) C:\Windows\system32\DRIVERS\sffdisk.sys
22:01:44.0043 2724	sffdisk - ok
22:01:44.0081 2724	sffp_mmc        (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
22:01:44.0169 2724	sffp_mmc - ok
22:01:44.0194 2724	sffp_sd         (8b08cab1267b2c377883fc9e56981f90) C:\Windows\system32\DRIVERS\sffp_sd.sys
22:01:44.0210 2724	sffp_sd - ok
22:01:44.0235 2724	sfloppy         (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
22:01:44.0310 2724	sfloppy - ok
22:01:44.0375 2724	SharedAccess    (9a82bf4c90b00a63150a606a1e2fd82b) C:\Windows\System32\ipnathlp.dll
22:01:44.0441 2724	SharedAccess - ok
22:01:44.0503 2724	ShellHWDetection (b264dfa21677728613267fe63802b332) C:\Windows\System32\shsvcs.dll
22:01:44.0548 2724	ShellHWDetection - ok
22:01:44.0572 2724	sisagp          (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
22:01:44.0589 2724	sisagp - ok
22:01:44.0616 2724	SiSRaid2        (b8a2f8dcdc75f19962d975727f393920) C:\Windows\system32\drivers\sisraid2.sys
22:01:44.0702 2724	SiSRaid2 - ok
22:01:44.0732 2724	SiSRaid4        (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
22:01:44.0750 2724	SiSRaid4 - ok
22:01:45.0036 2724	slsvc           (a1dcd30534835cb67733ad00175125a6) C:\Windows\system32\SLsvc.exe
22:01:45.0343 2724	slsvc - ok
22:01:45.0463 2724	SLUINotify      (56da296e7b376a727e7bdc5ac7fbee02) C:\Windows\system32\SLUINotify.dll
22:01:45.0504 2724	SLUINotify - ok
22:01:45.0560 2724	Smb             (ac0d90738adb51a6fd12ff00874a2162) C:\Windows\system32\DRIVERS\smb.sys
22:01:45.0639 2724	Smb - ok
22:01:45.0668 2724	SNMPTRAP        (2a146a055b4401c16ee62d18b8e2a032) C:\Windows\System32\snmptrap.exe
22:01:45.0683 2724	SNMPTRAP - ok
22:01:45.0727 2724	spldr           (426f9b029aa9162ceccf65369457d046) C:\Windows\system32\drivers\spldr.sys
22:01:45.0736 2724	spldr - ok
22:01:45.0755 2724	Spooler         (da612ef2556776df2630b68bf2d48935) C:\Windows\System32\spoolsv.exe
22:01:45.0772 2724	Spooler - ok
22:01:45.0818 2724	srv             (038579c35f7cad4a4bbf735dbf83277d) C:\Windows\system32\DRIVERS\srv.sys
22:01:45.0997 2724	srv - ok
22:01:46.0083 2724	srv2            (6971a757af8cb5e2cbcbb76cc530db6c) C:\Windows\system32\DRIVERS\srv2.sys
22:01:46.0168 2724	srv2 - ok
22:01:46.0244 2724	srvnet          (9e1a4603b874eebce0298113951abefb) C:\Windows\system32\DRIVERS\srvnet.sys
22:01:46.0269 2724	srvnet - ok
22:01:46.0326 2724	SSDPSRV         (8d3e4baff8b3997138c38eb1b600519a) C:\Windows\System32\ssdpsrv.dll
22:01:46.0424 2724	SSDPSRV - ok
22:01:46.0460 2724	ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
22:01:46.0468 2724	ssmdrv - ok
22:01:46.0523 2724	stisvc          (a941e099ef46e3cc12f898cbe1c39910) C:\Windows\System32\wiaservc.dll
22:01:46.0605 2724	stisvc - ok
22:01:46.0646 2724	swenum          (1379bdb336f8158c176a465e30759f57) C:\Windows\system32\DRIVERS\swenum.sys
22:01:46.0659 2724	swenum - ok
22:01:46.0709 2724	swprv           (749ada8d6c18a08adfede69cbf5db2e0) C:\Windows\System32\swprv.dll
22:01:46.0812 2724	swprv - ok
22:01:46.0834 2724	Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
22:01:46.0850 2724	Symc8xx - ok
22:01:46.0871 2724	Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
22:01:46.0881 2724	Sym_hi - ok
22:01:46.0893 2724	Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
22:01:46.0903 2724	Sym_u3 - ok
22:01:46.0950 2724	SynTP           (2d2c815364a878c7e358d5f549711197) C:\Windows\system32\DRIVERS\SynTP.sys
22:01:46.0964 2724	SynTP - ok
22:01:47.0026 2724	SysMain         (8f2b5fede18bd3c4c926cbf88e6f1264) C:\Windows\system32\sysmain.dll
22:01:47.0169 2724	SysMain - ok
22:01:47.0186 2724	TabletInputService (2dca225eae15f42c0933e998ee0231c3) C:\Windows\System32\TabSvc.dll
22:01:47.0246 2724	TabletInputService - ok
22:01:47.0291 2724	TapiSrv         (ef3dd33c740fc2f82e7e4622f1c49289) C:\Windows\System32\tapisrv.dll
22:01:47.0351 2724	TapiSrv - ok
22:01:47.0402 2724	TBS             (68fa52794ae9acc61bde16fe0956b414) C:\Windows\System32\tbssvc.dll
22:01:47.0485 2724	TBS - ok
22:01:47.0588 2724	Tcpip           (4a82fa8f0df67aa354580c3faaf8bde3) C:\Windows\system32\drivers\tcpip.sys
22:01:47.0647 2724	Tcpip - ok
22:01:47.0660 2724	Tcpip6          (4a82fa8f0df67aa354580c3faaf8bde3) C:\Windows\system32\DRIVERS\tcpip.sys
22:01:47.0695 2724	Tcpip6 - ok
22:01:47.0746 2724	tcpipreg        (5ce0c4a7b12d0067dad527d72b68c726) C:\Windows\system32\drivers\tcpipreg.sys
22:01:47.0812 2724	tcpipreg - ok
22:01:47.0860 2724	TDPIPE          (964248aef49c31fa6a93201a73ffaf50) C:\Windows\system32\drivers\tdpipe.sys
22:01:47.0950 2724	TDPIPE - ok
22:01:47.0975 2724	TDTCP           (7d2c1ae1648a60fce4aa0f7982e419d3) C:\Windows\system32\drivers\tdtcp.sys
22:01:48.0058 2724	TDTCP - ok
22:01:48.0086 2724	tdx             (ab4fde8af4a0270a46a001c08cbce1c2) C:\Windows\system32\DRIVERS\tdx.sys
22:01:48.0135 2724	tdx - ok
22:01:48.0148 2724	TermDD          (2c549bd9dd091fbfaa0a2a48e82ec2fb) C:\Windows\system32\DRIVERS\termdd.sys
22:01:48.0159 2724	TermDD - ok
22:01:48.0195 2724	TermService     (fad71c1e8e4047b154e899ae31eb8caa) C:\Windows\System32\termsrv.dll
22:01:48.0267 2724	TermService - ok
22:01:48.0345 2724	TestHandler     (8c80a73a5d77b2208ca91e4fa269981d) C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
22:01:48.0377 2724	TestHandler ( UnsignedFile.Multi.Generic ) - warning
22:01:48.0378 2724	TestHandler - detected UnsignedFile.Multi.Generic (1)
22:01:48.0438 2724	Themes          (b264dfa21677728613267fe63802b332) C:\Windows\system32\shsvcs.dll
22:01:48.0458 2724	Themes - ok
22:01:48.0489 2724	THREADORDER     (9dfa3a459af0954aa85b4f7622ad87bb) C:\Windows\system32\mmcss.dll
22:01:48.0552 2724	THREADORDER - ok
22:01:48.0570 2724	TrkWks          (6bba0582c0025d43729a1112d3b57897) C:\Windows\System32\trkwks.dll
22:01:48.0655 2724	TrkWks - ok
22:01:48.0731 2724	TrustedInstaller (34e388a395fedba1d0511ed39bbf4074) C:\Windows\servicing\TrustedInstaller.exe
22:01:48.0768 2724	TrustedInstaller - ok
22:01:48.0804 2724	tssecsrv        (29f0eca726f0d51f7e048bdb0b372f29) C:\Windows\system32\DRIVERS\tssecsrv.sys
22:01:48.0886 2724	tssecsrv - ok
22:01:48.0934 2724	tunmp           (65e953bc0084d44498b51f59784d2a82) C:\Windows\system32\DRIVERS\tunmp.sys
22:01:48.0952 2724	tunmp - ok
22:01:48.0959 2724	tunnel          (4a39bda5e0fd30bdf4884f9d33ae6105) C:\Windows\system32\DRIVERS\tunnel.sys
22:01:48.0977 2724	tunnel - ok
22:01:49.0019 2724	uagp35          (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
22:01:49.0032 2724	uagp35 - ok
22:01:49.0071 2724	udfs            (6348da98707ceda8a0dfb05820e17732) C:\Windows\system32\DRIVERS\udfs.sys
22:01:49.0138 2724	udfs - ok
22:01:49.0191 2724	UI0Detect       (24a333f4f14dcfb6ff6d5a1b9e5d79dd) C:\Windows\system32\UI0Detect.exe
22:01:49.0213 2724	UI0Detect - ok
22:01:49.0235 2724	uliagpkx        (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
22:01:49.0245 2724	uliagpkx - ok
22:01:49.0278 2724	uliahci         (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
22:01:49.0294 2724	uliahci - ok
22:01:49.0311 2724	UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
22:01:49.0326 2724	UlSata - ok
22:01:49.0357 2724	ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
22:01:49.0369 2724	ulsata2 - ok
22:01:49.0401 2724	umbus           (3fb78f1d1dd86d87bececd9dffa24dd9) C:\Windows\system32\DRIVERS\umbus.sys
22:01:49.0491 2724	umbus - ok
22:01:49.0531 2724	upnphost        (8eb871a3deb6b3d5a85eb6ddfc390b59) C:\Windows\System32\upnphost.dll
22:01:49.0620 2724	upnphost - ok
22:01:49.0634 2724	upperdev - ok
22:01:49.0685 2724	usbccgp         (8bd3ae150d97ba4e633c6c5c51b41ae1) C:\Windows\system32\drivers\usbccgp.sys
22:01:49.0812 2724	usbccgp - ok
22:01:49.0837 2724	usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
22:01:49.0943 2724	usbcir - ok
22:01:50.0001 2724	usbehci         (11fa3acbf0de0286829c69e01fe705e4) C:\Windows\system32\DRIVERS\usbehci.sys
22:01:50.0013 2724	usbehci - ok
22:01:50.0040 2724	usbhub          (6a7858a38b5105731e219e7c6a238730) C:\Windows\system32\DRIVERS\usbhub.sys
22:01:50.0082 2724	usbhub - ok
22:01:50.0110 2724	usbohci         (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
22:01:50.0183 2724	usbohci - ok
22:01:50.0214 2724	usbprint        (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys
22:01:50.0299 2724	usbprint - ok
22:01:50.0337 2724	USBSTOR         (7887ce56934e7f104e98c975f47353c5) C:\Windows\system32\DRIVERS\USBSTOR.SYS
22:01:50.0394 2724	USBSTOR - ok
22:01:50.0414 2724	usbuhci         (4013315fed70a2d293b998cbba4022ee) C:\Windows\system32\DRIVERS\usbuhci.sys
22:01:50.0462 2724	usbuhci - ok
22:01:50.0516 2724	UxSms           (f79d0d7c9004474cb42746d9b2c30a2b) C:\Windows\System32\uxsms.dll
22:01:50.0604 2724	UxSms - ok
22:01:50.0655 2724	vds             (c9d0bafee0d0a2681f048ca61bc0da96) C:\Windows\System32\vds.exe
22:01:50.0730 2724	vds - ok
22:01:50.0801 2724	vga             (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
22:01:50.0944 2724	vga - ok
22:01:50.0990 2724	VgaSave         (17a8f877314e4067f8c8172cc6d9101c) C:\Windows\System32\drivers\vga.sys
22:01:51.0072 2724	VgaSave - ok
22:01:51.0100 2724	viaagp          (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
22:01:51.0110 2724	viaagp - ok
22:01:51.0131 2724	ViaC7           (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
22:01:51.0178 2724	ViaC7 - ok
22:01:51.0198 2724	viaide          (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
22:01:51.0208 2724	viaide - ok
22:01:51.0249 2724	viamraid        (9f3f276c7300ed211129757a411b605f) C:\Windows\system32\drivers\viamraid.sys
22:01:51.0307 2724	viamraid - ok
22:01:51.0322 2724	volmgr          (103e84c95832d0ed93507997cc7b54e8) C:\Windows\system32\drivers\volmgr.sys
22:01:51.0332 2724	volmgr - ok
22:01:51.0363 2724	volmgrx         (294da8d3f965f6a8db934a83c7b461ff) C:\Windows\system32\drivers\volmgrx.sys
22:01:51.0388 2724	volmgrx - ok
22:01:51.0432 2724	volsnap         (80dc0c9bcb579ed9815001a4d37cbfd5) C:\Windows\system32\drivers\volsnap.sys
22:01:51.0448 2724	volsnap - ok
22:01:51.0471 2724	vsmraid         (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
22:01:51.0488 2724	vsmraid - ok
22:01:51.0582 2724	VSS             (e0e29d9ef2524abd11749c7c2fd7f607) C:\Windows\system32\vssvc.exe
22:01:51.0695 2724	VSS - ok
22:01:51.0745 2724	W32Time         (62b0d0f6f5580d9d0dfa5e0b466ff2ed) C:\Windows\system32\w32time.dll
22:01:51.0869 2724	W32Time - ok
22:01:51.0920 2724	WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
22:01:52.0029 2724	WacomPen - ok
22:01:52.0076 2724	Wanarp          (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys
22:01:52.0089 2724	Wanarp - ok
22:01:52.0093 2724	Wanarpv6        (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys
22:01:52.0105 2724	Wanarpv6 - ok
22:01:52.0132 2724	wcncsvc         (c1b19162e0509ceab4cdf664e139d956) C:\Windows\System32\wcncsvc.dll
22:01:52.0200 2724	wcncsvc - ok
22:01:52.0227 2724	WcsPlugInService (11bcb7afcdd7aadacb5746f544d3a9c7) C:\Windows\System32\WcsPlugInService.dll
22:01:52.0276 2724	WcsPlugInService - ok
22:01:52.0295 2724	Wd              (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
22:01:52.0325 2724	Wd - ok
22:01:52.0404 2724	Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
22:01:52.0495 2724	Wdf01000 - ok
22:01:52.0533 2724	WdiServiceHost  (2a424b89b14ef17a3d06bcb5a8f79601) C:\Windows\system32\wdi.dll
22:01:52.0563 2724	WdiServiceHost - ok
22:01:52.0569 2724	WdiSystemHost   (2a424b89b14ef17a3d06bcb5a8f79601) C:\Windows\system32\wdi.dll
22:01:52.0588 2724	WdiSystemHost - ok
22:01:52.0618 2724	WebClient       (01e41c264eedcb827820a1909162579f) C:\Windows\System32\webclnt.dll
22:01:52.0636 2724	WebClient - ok
22:01:52.0669 2724	Wecsvc          (9cf67ff7f8d34cbf115d0c278b9f74aa) C:\Windows\system32\wecsvc.dll
22:01:52.0739 2724	Wecsvc - ok
22:01:52.0774 2724	wercplsupport   (b68cab45db1dab59d92acadfad6364a8) C:\Windows\System32\wercplsupport.dll
22:01:52.0852 2724	wercplsupport - ok
22:01:52.0882 2724	WerSvc          (36ba0707680ef4236fd752bee982cc25) C:\Windows\System32\WerSvc.dll
22:01:52.0932 2724	WerSvc - ok
22:01:53.0005 2724	winachsf        (6d2350bb6e77e800fc4be4e5b7a2e89a) C:\Windows\system32\DRIVERS\HSX_CNXT.sys
22:01:53.0052 2724	winachsf - ok
22:01:53.0199 2724	WinDefend       (0d5ad0e71ff5ddac5dd2f443b499abd0) C:\Program Files\Windows Defender\mpsvc.dll
22:01:53.0241 2724	WinDefend - ok
22:01:53.0251 2724	WinHttpAutoProxySvc - ok
22:01:53.0330 2724	Winmgmt         (38a7b89de4e3417c122317949667fdd8) C:\Windows\system32\wbem\WMIsvc.dll
22:01:53.0439 2724	Winmgmt - ok
22:01:53.0514 2724	WinRM           (3f6823040030c3e4da1cf11cd40b7534) C:\Windows\system32\WsmSvc.dll
22:01:53.0691 2724	WinRM - ok
22:01:53.0775 2724	Wlansvc         (7640acea41348bfef34b76e245501261) C:\Windows\System32\wlansvc.dll
22:01:53.0908 2724	Wlansvc - ok
22:01:53.0978 2724	WmiAcpi         (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
22:01:54.0062 2724	WmiAcpi - ok
22:01:54.0095 2724	wmiApSrv        (a279323bee5fffafda222910bce92132) C:\Windows\system32\wbem\WmiApSrv.exe
22:01:54.0140 2724	wmiApSrv - ok
22:01:54.0258 2724	WMPNetworkSvc   (acb2e63d50157e3ea7140f29d9e76a48) C:\Program Files\Windows Media Player\wmpnetwk.exe
22:01:54.0407 2724	WMPNetworkSvc - ok
22:01:54.0451 2724	WPCSvc          (3d3b3b80c12abe506f56930c46422c28) C:\Windows\System32\wpcsvc.dll
22:01:54.0487 2724	WPCSvc - ok
22:01:54.0530 2724	WPDBusEnum      (c24844a1d0d9528b19d5bc266b8cd572) C:\Windows\system32\wpdbusenum.dll
22:01:54.0610 2724	WPDBusEnum - ok
22:01:54.0665 2724	WpdUsb          (2d27171b16a577ef14c1273668753485) C:\Windows\system32\DRIVERS\wpdusb.sys
22:01:54.0769 2724	WpdUsb - ok
22:01:54.0811 2724	ws2ifsl         (84620aecdcfd2a7a14e6263927d8c0ed) C:\Windows\system32\drivers\ws2ifsl.sys
22:01:54.0919 2724	ws2ifsl - ok
22:01:54.0948 2724	wscsvc          (f97cbb919af6d0a6643d1a59c15014d1) C:\Windows\System32\wscsvc.dll
22:01:54.0979 2724	wscsvc - ok
22:01:54.0986 2724	WSearch - ok
22:01:55.0189 2724	wuauserv        (6298277b73c77fa99106b271a7525163) C:\Windows\system32\wuaueng.dll
22:01:55.0408 2724	wuauserv - ok
22:01:56.0078 2724	WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
22:01:56.0148 2724	WUDFRd - ok
22:01:56.0216 2724	wudfsvc         (b746bc5f820318c21f28a4981c437c5e) C:\Windows\System32\WUDFSvc.dll
22:01:56.0241 2724	wudfsvc - ok
22:01:56.0325 2724	XAudio          (5a7ff9a18ff6d7e0527fe3abf9204ef8) C:\Windows\system32\DRIVERS\xaudio.sys
22:01:56.0341 2724	XAudio - ok
22:01:56.0436 2724	XAudioService   (28dc5d626e036a75a572556f0a6eb1f6) C:\Windows\system32\DRIVERS\xaudio.exe
22:01:56.0484 2724	XAudioService - ok
22:01:56.0530 2724	MBR (0x1B8)     (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
22:01:57.0023 2724	\Device\Harddisk0\DR0 - ok
22:01:57.0031 2724	MBR (0x1B8)     (e5fa06aca0d60ba9c870d0ef3d9898c9) \Device\Harddisk1\DR1
22:01:59.0927 2724	\Device\Harddisk1\DR1 - ok
22:01:59.0932 2724	Boot (0x1200)   (192157ad9df017d880d2f51a6ba0364b) \Device\Harddisk0\DR0\Partition0
22:01:59.0933 2724	\Device\Harddisk0\DR0\Partition0 - ok
22:01:59.0984 2724	Boot (0x1200)   (b71a2c423c58cf9481b211c4c63e2a29) \Device\Harddisk0\DR0\Partition1
22:01:59.0986 2724	\Device\Harddisk0\DR0\Partition1 - ok
22:01:59.0991 2724	Boot (0x1200)   (477c97c953891c6d0d59ad139db50e51) \Device\Harddisk1\DR1\Partition0
22:01:59.0992 2724	\Device\Harddisk1\DR1\Partition0 - ok
22:01:59.0994 2724	============================================================
22:01:59.0994 2724	Scan finished
22:01:59.0994 2724	============================================================
22:02:00.0008 4908	Detected object count: 5
22:02:00.0008 4908	Actual detected object count: 5
22:03:57.0354 4908	Apple Mobile Device ( UnsignedFile.Multi.Generic ) - skipped by user
22:03:57.0354 4908	Apple Mobile Device ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:03:57.0357 4908	JRAID ( UnsignedFile.Multi.Generic ) - skipped by user
22:03:57.0357 4908	JRAID ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:03:57.0361 4908	PxHelp20 ( UnsignedFile.Multi.Generic ) - skipped by user
22:03:57.0361 4908	PxHelp20 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:03:57.0365 4908	ServiceLayer ( UnsignedFile.Multi.Generic ) - skipped by user
22:03:57.0365 4908	ServiceLayer ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:03:57.0368 4908	TestHandler ( UnsignedFile.Multi.Generic ) - skipped by user
22:03:57.0368 4908	TestHandler ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:04:05.0296 4192	Deinitialize success
         

...

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

• Lade dir ComboFix hier herunter auf deinen Desktop.

• Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

• Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
  Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

• Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Hallo,

ich hab Combofix runtergeladen, Virenscanner, Firewall und alle offenen Fenster geschlossen und Combofix gestartet.

Die Anzeige "versuche Wiederherstellungspunkt zu erstellen" kam, ebenfalls die Auflistung der diversen Stufen.

Aber dann wurde der Rechner ohne Rückfrage neu gestartet und seit dem kommen bei jedem Hochfahren im Millisekundentakt Combofix-Fenster hoch, immer geschätzt 5-10 Stück, die von links oben nach rechts unten aufblitzen. Beim ersten mal hab ich noch recht lange gewartet, ca. 1/2 Std. bevor mir das zu unheimlich wurde und ich den Rechner hab durchstarten lassen.

Leider kommen die Fenster immer wieder so lange bis ich es schaffe den Task abzuschiessen .
Laut Taskmanager sind das - soweit ich das erkennen kann, geht ziemlich schnell - mindestens 3 verschiedene Programme, mind. 2 davon enden auf 3XE.
Ach ja, mein Windows-Firewall-Dienst ist jetzt weg und Logfile gibt's auch keins

Bislang hab ich Combofix nicht deinstalliert.

... bitte hilfe ?

Viele Grüße

Starte Windows neu, lösch die alte combofix.exe, lade CF neu runter und probier es bitte nochmal.

Ok, hab ich gemacht.

Ich hoffe, da ist jetzt nicht zu viel irrelevanter Kram dabei, aber ich schreib einach mal alles auf, was mir aufgefallen ist:

Ziemlich am Anfang und nochmal nach Stufe 38 kam im Combofix-Fenster die Meldung "Failed to get data for 'EnableLUA'". Combofix kam bis Stufe 50.

Dann kam die Meldung "Starte Windows neu. Bitte warten...".
Nach dem automatischen Reboot ging es wieder los mit den vielen Fenstern. Die Anwendungen zu denen diese Fenster gehörten waren zumindest:

• ComboFix
• C:\Combofix\pev.3XE
• c:\ComboFix\CF19265.3XE

Nach einiger Zeit hab ich wieder den Task abgeschossen und einen Benutzerwechsel zum Administrator-Account versucht. Das hat auch funktioniert und nach der Anmeldung sagte Combofix dann endlich, dass das Logfile erstellt wird, siehe weiter unten.
Jetzt kann ich mich generell wieder ganz normal mit meinem Admin-Account anmelden .

Was bisher noch seltsam oder anders als vorher ist:

• Der Windows-Firewall Dienst ist noch weg und das wird nach der Anmedlung vom Sicherheitscenter moniert
• MS Security Essentials ist auch weg
• freePDF meldet nach der Anmeldung "Invalid Picture" (FreePDF ist mir aber nicht wichtig, wenn das nix Bekanntes ist kann ich den am Ende deinstallieren)
• Mein WISO-Programm meldet nach der Anmeldung: "DAO-ODBC Message" - "D:\Users\******\Documents\Mein Steuer-Sparbuch Heute\msndb.mdb (3051): Unable to connect"
• Beim Starten von Internet Explorer kam die Meldung "Internet Explorer Standardsuchanbieter" - "Ein Programm auf dem Computer hat die Einstellung für den Standardsuchanbieter für Internet Explorer beschädigt.
  Diese Einstellung wurde von IE auf den ursprünglichen Suchanbieter zurückgesetzt, Live Search (search.live.com)
  Es werden jetzt die Sucheinstellungen geöffnet, in denen Sie diese Einstellung ändern oder weiter Suchanbieter" installieren können."

Nach der Anmedlung meldet sich "Java Auto Updater" mit "Java-Update verfügbar" - aber da trau ich mich noch nicht zu bestätigen.

Logfile von Combofix:

ComboFix 12-06-03.02 - ****** 03.06.2012  21:07:03.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6000.0.1252.49.1031.18.1014.220 [GMT 2:00]
ausgeführt von:: d:\users\Test\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Vorheriger Suchlauf -------
.
C:\Washer2.rar
d:\users\******\AppData\Roaming\srvblck2.tmp
d:\users\******\AppData\Roaming\TrusteerHelp
d:\users\******\AppData\Roaming\TrusteerHelp\spuninst.inf
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-05-03 bis 2012-06-03  ))))))))))))))))))))))))))))))
.
.
2012-06-03 19:16 . 2012-06-03 19:31	--------	d-----w-	d:\users\******\AppData\Local\temp
2012-06-03 19:16 . 2012-06-03 19:16	--------	d-----w-	d:\users\Default\AppData\Local\temp
2012-06-03 19:16 . 2012-06-03 19:16	--------	d-----w-	c:\windows\system32\config\systemprofile\AppData\Local\temp
2012-06-01 20:08 . 2012-06-01 20:08	--------	d-----w-	d:\users\Test\AppData\Roaming\Malwarebytes
2012-06-01 20:07 . 2012-05-08 16:40	6737808	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{55840B83-8E7E-4CDE-8DC9-CCE387008862}\mpengine.dll
2012-06-01 19:54 . 2012-06-01 19:54	--------	d-----w-	d:\users\Test\AppData\Roaming\PC Suite
2012-05-31 17:56 . 2012-05-31 17:56	--------	d-----w-	C:\msh
2012-05-29 21:01 . 2012-05-29 21:01	--------	d-----w-	c:\program files\ESET
2012-05-28 08:27 . 2012-05-08 16:40	6737808	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8B22AA2C-5B2B-40A6-BF55-CFB5D3B64153}\mpengine.dll
2012-05-28 08:23 . 2012-05-08 16:40	6737808	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll
2012-05-27 18:41 . 2012-05-27 18:41	--------	d-----w-	d:\users\******\AppData\Roaming\Malwarebytes
2012-05-27 18:41 . 2012-05-27 18:41	--------	d-----w-	c:\programdata\Malwarebytes
2012-05-27 18:41 . 2012-04-04 13:56	22344	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-05-27 18:41 . 2012-05-27 18:41	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2012-05-27 17:19 . 2012-02-09 11:17	713784	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9012FB24-35DC-48D2-98E1-A998582FF975}\gapaengine.dll
2012-05-27 17:14 . 2012-05-08 16:40	6737808	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{954C594A-DC17-4590-8737-4D17510B0BA2}\mpengine.dll
2012-05-21 19:17 . 2012-05-21 19:17	--------	d-----w-	c:\program files\AVAST Software
2012-05-09 10:51 . 2012-05-08 16:40	6737808	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-05-08 11:30 . 2012-05-08 11:30	--------	d-----w-	C:\04001785caae1820ebce7865ce
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-20 18:44 . 2011-04-18 11:18	171064	----a-w-	c:\windows\system32\drivers\MpFilter.sys
2012-03-11 18:34 . 2012-03-11 18:34	414368	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-06 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-06 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-06 81920]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-26 815104]
"Keyboard Manager Utility"="c:\program files\Keyboard Manager\Manager Utility\KeyboardManager.exe" [2007-01-11 1359872]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-02-26 153136]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-08-15 271672]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 5.0\apdproxy.exe" [2006-12-22 67752]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2007-06-26 312320]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
WISO Mein Steuer-Sparbuch heute.lnk - c:\program files\WISO\Steuersoftware 2012\mshaktuell.exe [2012-5-1 1380464]
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3794037573-2674974133-3482154547-1000]
"EnableNotificationsRef"=dword:00000004
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-09 20:08]
.
2012-06-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-09 20:08]
.
2012-06-03 c:\windows\Tasks\User_Feed_Synchronization-{0941ED73-D275-454C-A0A6-94DA8B7E2A8D}.job
- c:\windows\system32\msfeedssync.exe [2010-04-06 04:54]
.
2012-06-02 c:\windows\Tasks\User_Feed_Synchronization-{43D47738-EC2A-4BC5-85D2-AC0F3B7ED4A3}.job
- c:\windows\system32\msfeedssync.exe [2010-04-06 04:54]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
TCP: DhcpNameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-NokiaOviSuite2 - c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
.
.
.
**************************************************************************
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MpsSvc]
"ImagePath"="."
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pls\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.spx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Spybot - Search & Destroy\SDWinSec.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe
c:\program files\Windows Sidebar\sidebar.exe
c:\windows\system32\igfxext.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\conime.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\igfxext.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\consent.exe
c:\windows\system32\sdclt.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-06-03  21:41:16 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-06-03 19:40
.
Vor Suchlauf: 23 Verzeichnis(se), 39.946.235.904 Bytes frei
Nach Suchlauf: 26 Verzeichnis(se), 39.640.600.576 Bytes frei
.
- - End Of File - - CECC73C8A511338E6EA71E9834220344
         

Ich hätt da noch eine Frage:
Wäre es in Ordnung, wenn ich zwischendrin eine Datensicherung mache?
Wie jeder vernünftige User hab ich natürlich schon sehr lange keine Sicherung meiner Daten mehr gemacht .
Oder kommt das den Reparatur-Arbeiten eher in die Quere?

Viele Grüße