Hallo an alle helfenden Hände,

auch ich habe durch meine eigene Schussligkeit den Trojaner aus den Betrüger Mails mit angeblichem Auftraggeber FlirtFever auf meinem Laptop. Die Mail samt Anhang habe ich gelöscht.

Ich kenne mich leider in PC bereich nicht sehr gut aus, habe allerdings schon einige Dinge nach Anleitung durchgeführt:

-Systemwiederherstellung

-einen Systemscan mit Avira Free Antivir
Hierbei wurden 4 gefährliche Dateien gefunden und von mir in Quarantäne verschoben. Dort sind aber nur drei angekommen.
Die Namen: EXP/CVE-2010-0840, EXP/CVE-2011-3544,EXP/CVE-2011-3544.AG

-einen weiteren Systemscan mit Avira im Expertenmodus
Die Einstellungen zum Expertenmodus habe ich auch diesem Forum entnommen. Hierzu habe ich leider keine Logfiles gespeichert. Gefunden wurden hier 3 Dateien. Auch diese wurde in Quarantäne verschoben.
Die Namen: TR/Matsnu.A.67 (alle drei Dateien haben den gleichen Namen)

-einen Scan mit Malwarebytes Anti Malware durchgeführt
Ich bin hier nach der Anleitung aus diesem Forum vorgegangen.
Hierbei wurden 3 Dateien gefunden. Nach dem Fund habe ich damit nichts weiter gemacht, nur das Programm geschlossen.
Die Namen der Dateien weiß ich leider nicht mehr. ich denke es war etwas in der Art: trojan.agent

Das habe ich alles gestern, am Tag der Infizierung gemacht (08.06.2012).

Ich habe auch bereits versucht mit dem Decrypt Helper meine Dateien zu entschlüsseln. Ohne Erfolg, da ich kein "Pärchen" habe und so keinen Schlüssel erstellen kann. Es wurde immer die Meldung angezeigt: "Die Dateien sind unterschiedlich groß". Die Beispielbilder habe ich vor langer Zeit schon vom PC gelöscht.
Wichtig ist vielleicht auch zu wissen, dass ich auf keine meiner Dateien mehr zugreifen kann (zB. auch ppt, doc), bis auf einige Musikdateien. Es kommt die Meldung:
"Die Datei [...] kann nicht geföffnet werden, da der Inhalt Probleme verursacht." --> "OK" --> dann wird gefragt ob ich den Inhalt wiederherstellen möchte. Das habe ich bis jetzt immer mit "Nein" abgehandelt.

Einige Bilder werden mit einem weißen Blatt als Symbol angezeigt und haben eine willkürliche Buchstaben Folge als Namen. Andere Bilder werden mit dieser kleinen Voranzeige ganz normal angezeigt, der Name der Bilder ist auch noch der gleiche. Aber auch diese vermeintlich nicht befallenen Bilder kann ich nicht öffnen. Es wird dieser Text angezeigt:
"Das Foto oder Video kann nicht geöffnet werden. Möglicherweise wird diese Datei nicht unterstützt, oder sie ist beschädigt."

Heute (09.06.2012) habe ich die Anweisungen für "alle Hilfesuchenden" durchgeführt.

-defogger scannen gelassen, keine Fehlermedlung
-OTL scannen lassen
-GMER scannen lassen, da ich ein 32bit System habe (herausgefunden nach Anleitung), keine Warnung aufgetaucht, "show all" war nicht abgehakt, musste den Haken also nicht entfernen, weil er nicht da war
-Neustart

Ich soll nun den Inhalt von
dds.txt
attach.txt
Gmer.txt ( Bei 32 bit Systemen ) posten. Aber die dds.txt. und die attach.txt habe ich gar nicht.

Ich hoffe ich habe das ganze nicht zu ausführlich und mit unnützen Infos beschrieben. Ich hoffe Ihr könnt mir helfen meine Daten zu retten!


Hier nun die Logfiles, die ich habe:



Erster Avira Scan:


Avira Free Antivirus
Erstellungsdatum der Reportdatei: Freitag, 8. Juni 2012 17:05

Es wird nach 3806151 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer : Avira AntiVir Personal - Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : BALLE-PC

Versionsinformationen:
BUILD.DAT : 12.0.0.1125 41829 Bytes 02.05.2012 16:34:00
AVSCAN.EXE : 12.3.0.15 466896 Bytes 08.05.2012 20:17:50
AVSCAN.DLL : 12.3.0.15 66256 Bytes 08.05.2012 20:17:50
LUKE.DLL : 12.3.0.15 68304 Bytes 08.05.2012 20:17:50
AVSCPLR.DLL : 12.3.0.14 97032 Bytes 08.05.2012 20:17:51
AVREG.DLL : 12.3.0.17 232200 Bytes 10.05.2012 20:16:33
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 10:49:21
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 07:56:15
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 07:56:21
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 16:00:40
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 17:00:04
VBASE005.VDF : 7.11.29.136 2166272 Bytes 10.05.2012 20:16:22
VBASE006.VDF : 7.11.29.137 2048 Bytes 10.05.2012 20:16:22
VBASE007.VDF : 7.11.29.138 2048 Bytes 10.05.2012 20:16:22
VBASE008.VDF : 7.11.29.139 2048 Bytes 10.05.2012 20:16:22
VBASE009.VDF : 7.11.29.140 2048 Bytes 10.05.2012 20:16:22
VBASE010.VDF : 7.11.29.141 2048 Bytes 10.05.2012 20:16:22
VBASE011.VDF : 7.11.29.142 2048 Bytes 10.05.2012 20:16:22
VBASE012.VDF : 7.11.29.143 2048 Bytes 10.05.2012 20:16:22
VBASE013.VDF : 7.11.29.144 2048 Bytes 10.05.2012 20:16:22
VBASE014.VDF : 7.11.30.3 198144 Bytes 14.05.2012 20:51:32
VBASE015.VDF : 7.11.30.69 186368 Bytes 17.05.2012 13:36:21
VBASE016.VDF : 7.11.30.143 223744 Bytes 21.05.2012 19:07:52
VBASE017.VDF : 7.11.30.207 287744 Bytes 23.05.2012 19:08:13
VBASE018.VDF : 7.11.31.57 188416 Bytes 28.05.2012 13:03:03
VBASE019.VDF : 7.11.31.111 214528 Bytes 30.05.2012 09:45:06
VBASE020.VDF : 7.11.31.151 116736 Bytes 31.05.2012 10:26:23
VBASE021.VDF : 7.11.31.205 134144 Bytes 03.06.2012 12:13:19
VBASE022.VDF : 7.11.32.9 169472 Bytes 05.06.2012 16:56:53
VBASE023.VDF : 7.11.32.10 2048 Bytes 05.06.2012 16:56:53
VBASE024.VDF : 7.11.32.11 2048 Bytes 05.06.2012 16:56:53
VBASE025.VDF : 7.11.32.12 2048 Bytes 05.06.2012 16:56:53
VBASE026.VDF : 7.11.32.13 2048 Bytes 05.06.2012 16:56:53
VBASE027.VDF : 7.11.32.14 2048 Bytes 05.06.2012 16:56:53
VBASE028.VDF : 7.11.32.15 2048 Bytes 05.06.2012 16:56:53
VBASE029.VDF : 7.11.32.16 2048 Bytes 05.06.2012 16:56:53
VBASE030.VDF : 7.11.32.17 2048 Bytes 05.06.2012 16:56:53
VBASE031.VDF : 7.11.32.70 114688 Bytes 08.06.2012 14:24:23
Engineversion : 8.2.10.80
AEVDF.DLL : 8.1.2.8 106867 Bytes 02.06.2012 10:26:31
AESCRIPT.DLL : 8.1.4.24 450939 Bytes 01.06.2012 10:26:29
AESCN.DLL : 8.1.8.2 131444 Bytes 17.02.2012 16:04:30
AESBX.DLL : 8.2.5.10 606580 Bytes 31.05.2012 09:45:14
AERDL.DLL : 8.1.9.15 639348 Bytes 31.01.2012 07:55:37
AEPACK.DLL : 8.2.16.16 807288 Bytes 31.05.2012 09:45:14
AEOFFICE.DLL : 8.1.2.28 201082 Bytes 28.04.2012 13:34:11
AEHEUR.DLL : 8.1.4.36 4874615 Bytes 01.06.2012 10:26:28
AEHELP.DLL : 8.1.21.0 254326 Bytes 10.05.2012 20:16:23
AEGEN.DLL : 8.1.5.28 422260 Bytes 28.04.2012 13:32:09
AEEXP.DLL : 8.1.0.44 82293 Bytes 31.05.2012 09:45:15
AEEMU.DLL : 8.1.3.0 393589 Bytes 31.01.2012 07:55:34
AECORE.DLL : 8.1.25.10 201080 Bytes 01.06.2012 10:26:24
AEBB.DLL : 8.1.1.0 53618 Bytes 31.01.2012 07:55:33
AVWINLL.DLL : 12.3.0.15 27344 Bytes 08.05.2012 20:17:49
AVPREF.DLL : 12.3.0.15 51920 Bytes 08.05.2012 20:17:50
AVREP.DLL : 12.3.0.15 179208 Bytes 08.05.2012 20:17:51
AVARKT.DLL : 12.3.0.15 211408 Bytes 08.05.2012 20:17:50
AVEVTLOG.DLL : 12.3.0.15 169168 Bytes 08.05.2012 20:17:50
SQLITE3.DLL : 3.7.0.1 398288 Bytes 08.05.2012 20:17:50
AVSMTP.DLL : 12.3.0.15 63440 Bytes 08.05.2012 20:17:50
NETNT.DLL : 12.3.0.15 17104 Bytes 08.05.2012 20:17:50
RCIMAGE.DLL : 12.3.0.15 4447952 Bytes 08.05.2012 20:17:49
RCTEXT.DLL : 12.3.0.15 98512 Bytes 08.05.2012 20:17:49

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\program files\avira\antivir desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Freitag, 8. Juni 2012 17:05

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf nach versteckten Objekten wird begonnen.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'SearchFilterHost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'PresentationFontCache.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqgpc01.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqbam08.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqSTE08.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '108' Modul(e) wurden durchsucht
Durchsuche Prozess 'NMIndexStoreSvr.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'iPodService.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'NMIndexingService.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqtra08.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'NMBgMonitor.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpwuschd2.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'mswinext.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'acrotray.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'GrooveMonitor.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'Energy Management.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'utility.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAANTMon.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxsrvc.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'SmartAudio.exe' - '102' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxpers.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'hkcmd.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxtray.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAAnotif.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'sqlwriter.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'sqlbrowser.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'SeaPort.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'IgrsSvcs.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'NBService.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'IGRS.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'BcmSqlStartupSvc.exe' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '204' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLANExt.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '133' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '120' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
C:\Program Files\SecureW2\Uninstall.exe
[WARNUNG] Unerwartetes Dateiende erreicht
Die Registry wurde durchsucht ( '2990' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <Windows>
C:\Program Files\SecureW2\Uninstall.exe
[WARNUNG] Unerwartetes Dateiende erreicht
C:\Program Files\WinRAR\rarnew.dat
[WARNUNG] Das Archiv ist unbekannt oder defekt
C:\Users\Balle\AppData\Local\Microsoft\Toolbar\BackUp\appmgr.xap
[WARNUNG] Der Archivheader ist defekt
C:\Users\Balle\AppData\Local\Microsoft\Toolbar\BackUp\chameleon.xap
[WARNUNG] Der Archivheader ist defekt
C:\Users\Balle\AppData\Local\Microsoft\Toolbar\BackUp\firstrun.xap
[WARNUNG] Der Archivheader ist defekt
C:\Users\Balle\AppData\Local\Microsoft\Toolbar\BackUp\highlander.xap
[WARNUNG] Der Archivheader ist defekt
C:\Users\Balle\AppData\Local\Microsoft\Toolbar\IsolatedStorage\ObsidianApp\VersionIndependent\Resources\AppResources.zip
[WARNUNG] Der Archivheader ist defekt
C:\Users\Balle\AppData\Local\Microsoft\Toolbar\IsolatedStorage\SearchApp\VersionIndependent\Resources\AppResources.zip
[WARNUNG] Der Archivheader ist defekt
C:\Users\Balle\AppData\Local\Temp\jar_cache3523568372811679422.tmp
[0] Archivtyp: ZIP
--> photo/MultiZoom.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/ClassLoader.AY
--> photo/Zoom.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2010-0840
C:\Users\Balle\AppData\Local\Temp\jar_cache5196444757017071613.tmp
[0] Archivtyp: ZIP
--> v1.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544.AG
C:\Users\Balle\AppData\Local\Temp\jar_cache6560930534831429933.tmp
[0] Archivtyp: ZIP
--> v1.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544
C:\Users\Balle\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip
[WARNUNG] Der Archivheader ist defekt
C:\Users\Balle\AppData\Roaming\ICQ\bart\1024\ACC7EE262326001719E8E0763F8F1F84
[WARNUNG] Der Archivheader ist defekt
C:\Users\Balle\AppData\Roaming\Microsoft\Document Building Blocks\1031\Building Blocks.dotx
[WARNUNG] Der Archivheader ist defekt
C:\Users\Balle\AppData\Roaming\Microsoft\Excel\~ar3684.xar
[WARNUNG] Der Archivheader ist defekt
C:\Users\Balle\Downloads\avira_free_antivirus_de.exe
[WARNUNG] Die Datei ist kennwortgeschützt
Beginne mit der Suche in 'D:\' <Daten>
D:\Eigene Dateien\Eigene Bilder\UNI\Gegenstand u Methodik der Spowi\Neuer Ordner\Hermeneutik (31-38).docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Eigene Bilder\UNI\Gegenstand u Methodik der Spowi\Neuer Ordner\hermeneutik me 63-75.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Eigene Musik\Epica-SerenadeOfSelfDestruction.zip
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Jesse Hausaufgabe\Flyer Deckblatt.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Aufsatz Blutvolumenbestimmung.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Blutvolumenbestimmung.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Klausur Sozio Recht Geschi.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Bewegung und Sport im Kontext\Assessmentverfahren REFERAT\Das sporttherapeutische Assessment.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Biomechanik\Neuer Ordner\Arbeitsmappe3 (Version 1).xlsx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Biomechanik\Neuer Ordner\Biceps Curl Biceps_1.xlsx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Biomechanik\WS11_12\Laboruebung_1.1_Muskelarm.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Biomechanik\WS11_12\Biomechanik Übung 1\Bericht.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Biomechanik\WS11_12\Word Diagramme\Das erste ist glaube die Komplxübung.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\GeMeSpoWi\Gruppe 1.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\GeMeSpoWi\Testat5\Informeller Sport_ Informelles Lernen.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Klausuren Päda Philo\6.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Klausuren Päda Philo\philo\Sportphilosophie.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Klausuren Päda Philo\Päda\Sportpädagogik Fragen usw..docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Leichtahtletik\Frühgeschichte.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Leichtahtletik\Historie Weitsprung.pptx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Leichtahtletik\Kugelstoßen.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Leichtahtletik\Referate 11_12\Methodik_Kugelstoss_A.pptx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Leichtahtletik\Stabhochsprung Referat\Hochsprung.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Leichtahtletik\Stabhochsprung Referat\Stabhochsprung.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Leichtahtletik\Stabhochsprung Referat\Referat\Geschichte Stabhochsprung und Wettkampfregeln.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Portugiesisch\Deutungslernen.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Portugiesisch\Kollektives Gedächtnis.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Psychologische Verfahren\Handout.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Pädagogik\P im Gesundheits und rehasport\30.4.12\Selbststudiumsaufgaben Päda 30.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Schwimmen\Arbeitsblatt 1.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Schwimmen\arbeitsblatt 11.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Schwimmen\Kraul.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Schwimmen\Kilian\Schwimmen Beise.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Sportmotorik_Tr-wiss. 2\Ziel.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Sportmotorik_Tr-wiss. 2\Referat\Frühes Jugendalter.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Sportmotorik_Tr-wiss. 2\Referat\Niveau und Entwicklungsverlauf ausgewählter motorischer Fähigkeiten in der motorischen Ontogenese im Kindes.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Sportmotorik_Tr-wiss. 2\Referat\Niveau und Entwicklungsverlauf ausgewählter motorischer Fähigkeiten in der.pptx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Sportmotorik_Tr-wiss. 2\Vorlesungen\16.01.12SoMo.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Sportmotorik_Tr-wiss. 2\Vorlesungen\SpoMo19.12.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Sportrecht_Sportverwaltung\VL 1.12.2011\Sportrecht VL.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Statistik\Aufgabe 1.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Statistik\Zusammenfassung.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Tischtennis\Herz- Kreislauf- Training\Herz-Kreislauf-Training_Orga_Tipps.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Vorlesungsverzeichnis\Stundenplan\Stundenplan SS11.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Wintersport\Fragen skikurs.docx
[WARNUNG] Der Archivheader ist defekt
D:\Eigene Dateien\Studium\Wintersport\Leistungsanforderungen und Fragen.docx
[WARNUNG] Der Archivheader ist defekt

Beginne mit der Desinfektion:
C:\Users\Balle\AppData\Local\Temp\jar_cache6560930534831429933.tmp
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '548f861e.qua' verschoben!
C:\Users\Balle\AppData\Local\Temp\jar_cache5196444757017071613.tmp
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544.AG
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4c18a9ba.qua' verschoben!
C:\Users\Balle\AppData\Local\Temp\jar_cache3523568372811679422.tmp
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2010-0840
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1e47f352.qua' verschoben!


Ende des Suchlaufs: Freitag, 8. Juni 2012 18:32
Benötigte Zeit: 1:22:04 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

25830 Verzeichnisse wurden überprüft
414035 Dateien wurden geprüft
4 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
3 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
414031 Dateien ohne Befall
3822 Archive wurden durchsucht
60 Warnungen
3 Hinweise
581127 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden




Malwarebytes Scan:

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.08.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
Balle :: BALLE-PC [Administrator]

09.06.2012 00:11:22
mbam-log-2012-06-09 (01-34-56).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 213305
Laufzeit: 9 Minute(n), 24 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Users\Balle\AppData\Local\Temp\welibnofyg.pre (Trojan.Agent) -> Keine Aktion durchgeführt.
C:\Users\Balle\AppData\Local\Temp\rurjqyfpab.pre (Trojan.Agent) -> Keine Aktion durchgeführt.
C:\Users\Balle\AppData\Local\Temp\jqjfyuvzrx.pre (Trojan.Agent) -> Keine Aktion durchgeführt.

(Ende)


OTL:

OTL logfile created on: 09.06.2012 21:03:51 - Run 1
OTL by OldTimer - Version 3.2.48.0 Folder = C:\Users\Balle\Downloads
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,93 Gb Total Physical Memory | 1,87 Gb Available Physical Memory | 63,57% Memory free
5,87 Gb Paging File | 4,69 Gb Available in Paging File | 79,95% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 128,96 Gb Total Space | 89,02 Gb Free Space | 69,03% Space Free | Partition Type: NTFS
Drive D: | 154,17 Gb Total Space | 114,01 Gb Free Space | 73,95% Space Free | Partition Type: NTFS

Computer Name: BALLE-PC | User Name: Balle | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found --
PRC - [2012.05.08 22:17:50 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.08 22:17:50 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 22:17:50 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 22:17:50 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.12.10 19:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
PRC - [2010.12.10 19:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe
PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.05.14 12:00:26 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2010.04.27 17:39:38 | 000,243,544 | ---- | M] (Microsoft Corp.) -- C:\Programme\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe
PRC - [2009.09.29 18:23:20 | 004,114,288 | ---- | M] (Lenovo(beijing) Limited) -- C:\Programme\Lenovo\Energy Management\utility.exe
PRC - [2009.09.29 18:22:46 | 005,064,560 | ---- | M] (Lenovo (Beijing) Limited) -- C:\Programme\Lenovo\Energy Management\Energy Management.exe
PRC - [2009.08.18 12:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2009.08.18 12:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2009.08.12 10:09:32 | 000,683,576 | ---- | M] (Conexant Systems, Inc) -- C:\Programme\CONEXANT\SAII\SmartAudio.exe
PRC - [2009.07.14 16:27:26 | 000,038,152 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\ReadyComm\common\IGRS.exe
PRC - [2009.07.14 03:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\IgrsSvcs.exe
PRC - [2009.06.04 21:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2009.06.04 21:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2009.02.26 19:36:46 | 000,030,040 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
PRC - [2008.01.16 11:51:44 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
PRC - [2007.10.23 14:19:06 | 001,410,344 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Lib\NMIndexStoreSvr.exe
PRC - [2007.10.23 14:18:46 | 000,202,024 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Lib\NMBgMonitor.exe
PRC - [2004.12.14 02:12:02 | 000,483,328 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Acrobat 7.0\Distillr\acrotray.exe


========== Modules (No Company Name) ==========

MOD - [2012.05.11 14:57:30 | 000,240,128 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\9bfbf0613d3780e34d98333c7b381218\WindowsFormsIntegration.ni.dll
MOD - [2012.05.11 14:55:06 | 001,670,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\dab0ad2d0f5da372a4947d3a1c7c07a9\Microsoft.VisualBasic.ni.dll
MOD - [2012.05.11 14:33:06 | 000,220,672 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\626d0ac2f4ada682d7ca6c4ebf821469\CustomMarshalers.ni.dll
MOD - [2012.05.11 12:05:20 | 000,368,128 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8e56489276063ededde74e597a121df3\PresentationFramework.Aero.ni.dll
MOD - [2012.05.11 12:04:46 | 000,771,584 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012.05.11 12:04:23 | 014,340,608 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\07f019692c382d588d3c6cb2da2a9ec5\PresentationFramework.ni.dll
MOD - [2012.05.11 12:03:51 | 012,433,408 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\90555968565afd59bce4b0974e9903bd\System.Windows.Forms.ni.dll
MOD - [2012.05.11 12:03:36 | 001,590,784 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\69f6e582cb79f107c61308b468c1a215\System.Drawing.ni.dll
MOD - [2012.05.11 12:03:27 | 012,237,824 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\2d1fd350e9bc62ce659e5cbcfd555796\PresentationCore.ni.dll
MOD - [2012.05.11 12:03:02 | 003,347,968 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012.05.11 12:02:43 | 005,452,800 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012.05.11 12:02:33 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012.05.11 12:02:29 | 007,967,232 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012.05.11 12:01:02 | 011,492,864 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.02.28 21:42:14 | 000,652,800 | ---- | M] () -- C:\Programme\IZArc\IZArcCM.dll
MOD - [2010.11.13 02:02:21 | 000,315,392 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.11.05 03:57:39 | 000,069,120 | ---- | M] () -- C:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
MOD - [2010.01.19 02:36:23 | 000,167,936 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Xml.resources\2.0.0.0_de_b77a5c561934e089\System.Xml.resources.dll
MOD - [2008.12.20 05:20:50 | 000,063,304 | ---- | M] () -- C:\Programme\Lenovo\Energy Management\KbdHook.dll
MOD - [2008.12.20 05:20:08 | 000,051,016 | ---- | M] () -- C:\Programme\Lenovo\Energy Management\HookLib.dll


========== Win32 Services (SafeList) ==========

SRV - [2012.05.08 22:17:50 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.08 22:17:50 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2010.12.10 19:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2010.12.10 19:29:30 | 029,293,408 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ)
SRV - [2010.12.10 19:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser)
SRV - [2010.12.10 19:29:30 | 000,044,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper)
SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.09.18 21:08:10 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010.05.14 12:00:26 | 000,249,136 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2009.09.22 20:16:32 | 000,579,400 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Programme\Lenovo\ReadyComm\ConnSvc.exe -- (Lenovo ReadyComm ConnSvc)
SRV - [2009.08.18 12:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.08.14 16:22:48 | 000,509,192 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Programme\Lenovo\ReadyComm\AppSvc.exe -- (Lenovo ReadyComm AppSvc)
SRV - [2009.07.16 05:12:42 | 000,276,296 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Programme\Lenovo\ReadyComm\PS_MDP.dll -- (PS_MDP)
SRV - [2009.07.14 16:27:26 | 000,038,152 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\ReadyComm\common\IGRS.exe -- (IGRS)
SRV - [2009.07.14 16:27:20 | 000,103,688 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\ReadyComm\common\router.dll -- (ReadyComm.DirectRouter)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.06.04 21:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2009.02.26 19:36:22 | 000,064,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
SRV - [2008.01.16 11:51:44 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)
SRV - [2006.10.26 16:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- D:\test\ECECECEC\WinRing0.sys -- (WinRing0_1_2_0)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\RtsUCcid.sys -- (USBCCID)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\Rts516xIR.sys -- (RtsUIR)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV - [2012.05.08 22:17:51 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 22:17:51 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.09.16 17:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.05.18 08:09:04 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dc3d.sys -- (dc3d) MS Hardware Device Detection Driver (USB)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.09.18 17:27:46 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2010.05.04 06:15:41 | 000,054,800 | ---- | M] () [Kernel | System | Running] -- C:\windows\System32\drivers\funfrm.sys -- (funfrm)
DRV - [2010.01.20 06:14:42 | 000,023,136 | ---- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AcpiVpc.sys -- (ACPIVPC)
DRV - [2009.10.16 20:37:30 | 000,171,776 | ---- | M] (SMI) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SMIksdrv.sys -- (usbsmi)
DRV - [2009.10.08 17:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.09.14 20:04:28 | 000,217,136 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2009.07.28 23:09:36 | 000,063,240 | ---- | M] (Lenovo) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wdbridge.sys -- (Bridge0)
DRV - [2009.07.21 23:14:58 | 000,081,704 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wsvd.sys -- (wsvd)
DRV - [2009.07.16 14:37:14 | 000,011,792 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WDMirror.sys -- (wdmirror)
DRV - [2009.07.14 02:18:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) Intel(R)
DRV - [2009.07.14 00:02:49 | 000,229,888 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\k57nd60x.sys -- (k57nd60x) Broadcom NetLink (TM)
DRV - [2009.06.15 04:46:22 | 000,475,648 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)
DRV - [2008.08.06 14:34:16 | 000,128,104 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\WimFltr.sys -- (WimFltr)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpWinExt,version=5.0: C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\Firefox [2011.02.03 18:26:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011.12.08 15:46:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012.01.02 19:00:43 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012.01.02 19:00:43 | 000,000,000 | ---D | M]


========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFiel dTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Balle\AppData\Local\Google\Chrome\Application\18.0.1025.168\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Balle\AppData\Local\Google\Chrome\Application\18.0.1025.168\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Balle\AppData\Local\Google\Chrome\Application\18.0.1025.168\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.270.7 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U27 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Bing Bar (Enabled) = C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - Extension: Click to activate/deactivate ProxTube = C:\Users\Balle\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.1.0_1\
CHR - Extension: South Park Theme = C:\Users\Balle\AppData\Local\Google\Chrome\User Data\Default\Extensions\aoiakcboakkfknbginpmpfkcdmcmpnfm\1.3_0\
CHR - Extension: YouTube = C:\Users\Balle\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Chrome YouTube Downloader = C:\Users\Balle\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbdjiinahkdjdcdlgfimlcolkjpbooja\2.6.4_1\
CHR - Extension: Google-Suche = C:\Users\Balle\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Mail = C:\Users\Balle\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Programme\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (@C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Programme\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 7.0] C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Energy Management] C:\Programme\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
O4 - HKLM..\Run: [EnergyUtility] C:\Programme\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4 - HKLM..\Run: [UpdateP2GShortCut] C:\Program Files\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [VeriFaceManager] C:\Program Files\Lenovo\VeriFace\PManage.exe File not found
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe (Nero AG)
O4 - Startup: C:\Users\Balle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Balle\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{45B8CC2E-CC95-462F-BA11-40A1EF752DBE}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8D9A6627-3237-4C47-A3EA-BAED32ADEFD7}: NameServer = 139.18.25.3
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{5e8bcabe-c339-11df-87b5-88ae1d20cb14}\Shell - "" = AutoRun
O33 - MountPoints2\{5e8bcabe-c339-11df-87b5-88ae1d20cb14}\Shell\AutoRun\command - "" = G:\Autoplay.exe -auto
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012.06.09 21:01:29 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Balle\Desktop\OTL.exe
[2012.06.09 00:10:02 | 000,000,000 | ---D | C] -- C:\Users\Balle\AppData\Roaming\Malwarebytes
[2012.06.09 00:09:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.09 00:09:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.09 00:09:04 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2012.06.09 00:09:04 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.06.08 15:59:59 | 000,000,000 | ---D | C] -- C:\Users\Balle\AppData\Roaming\Eslnompvunh
[2012.05.13 18:00:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.05.13 18:00:58 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype

========== Files - Modified Within 30 Days ==========

[2012.06.09 21:06:19 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.09 21:06:19 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.09 21:01:32 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Balle\Desktop\OTL.exe
[2012.06.09 20:57:43 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012.06.09 20:57:33 | 2362,912,768 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.09 20:56:44 | 000,000,020 | ---- | M] () -- C:\Users\Balle\defogger_reenable
[2012.06.09 00:09:06 | 000,001,078 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.08 23:37:36 | 000,690,574 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2012.06.08 23:37:36 | 000,653,898 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012.06.08 23:37:36 | 000,143,916 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2012.06.08 23:37:36 | 000,121,090 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012.06.08 15:56:12 | 000,001,057 | ---- | M] () -- C:\Users\Balle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012.05.11 11:59:23 | 001,768,712 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2012.06.09 20:56:16 | 000,000,020 | ---- | C] () -- C:\Users\Balle\defogger_reenable
[2012.06.09 00:37:52 | 000,775,702 | ---- | C] () -- C:\Users\Balle\Desktop\Jellyfish.jpg
[2012.06.09 00:37:52 | 000,595,284 | ---- | C] () -- C:\Users\Balle\Desktop\Hydrangeas.jpg
[2012.06.09 00:37:51 | 000,879,394 | ---- | C] () -- C:\Users\Balle\Desktop\Chrysanthemum.jpg
[2012.06.09 00:37:51 | 000,845,941 | ---- | C] () -- C:\Users\Balle\Desktop\Desert.jpg
[2012.06.09 00:09:06 | 000,001,078 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.01.02 18:53:27 | 000,231,622 | ---- | C] () -- C:\windows\hpoins47.dat
[2010.10.01 16:24:51 | 000,684,916 | ---- | C] () -- C:\windows\unins000.exe
[2010.10.01 16:24:51 | 000,012,387 | ---- | C] () -- C:\windows\unins000.dat

========== LOP Check ==========

[2012.03.11 12:10:13 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Amazon
[2010.09.18 17:31:38 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\DAEMON Tools Lite
[2012.06.09 02:57:59 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Dropbox
[2012.06.08 16:45:01 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Eslnompvunh
[2012.03.31 12:48:09 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\gtk-2.0
[2011.03.23 20:36:32 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\ICQ
[2010.09.16 21:08:33 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Opera
[2011.11.29 22:51:50 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\PhotoScape
[2010.09.18 22:06:29 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\TeamViewer
[2012.05.08 12:59:36 | 000,032,632 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >


OTL Extras:


OTL Extras logfile created on: 09.06.2012 21:03:51 - Run 1
OTL by OldTimer - Version 3.2.48.0 Folder = C:\Users\Balle\Downloads
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,93 Gb Total Physical Memory | 1,87 Gb Available Physical Memory | 63,57% Memory free
5,87 Gb Paging File | 4,69 Gb Available in Paging File | 79,95% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 128,96 Gb Total Space | 89,02 Gb Free Space | 69,03% Space Free | Partition Type: NTFS
Drive D: | 154,17 Gb Total Space | 114,01 Gb Free Space | 73,95% Space Free | Partition Type: NTFS

Computer Name: BALLE-PC | User Name: Balle | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Opera\opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files\Opera\opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0DF0DFD0-4D0B-49FE-9D9C-1E2635962A41}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{13F651AC-C133-4172-AE18-ED6280FCE885}" = rport=427 | protocol=17 | dir=in | svc=hpslpsvc | app=c:\windows\system32\svchost.exe |
"{1ACC2F11-37C2-47B8-B2B6-2D095D03D26C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2D6D12EC-05A8-4A62-8F6B-62495FFDA095}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{32BAD4AE-D5F9-49FF-886A-612493651C72}" = lport=138 | protocol=17 | dir=in | app=system |
"{3409129C-E77D-4B02-9097-093326B86C68}" = lport=10243 | protocol=6 | dir=in | app=system |
"{3C6D0C83-3356-4180-BCEF-E9D6DD5ECE6C}" = rport=10243 | protocol=6 | dir=out | app=system |
"{45E23ABC-9651-4651-B79B-D79C5CF6D6A0}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{4AEB6AC3-24D4-4F20-882F-25FEF36D308A}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{54A836CB-A947-401E-AD12-585ED59D0EE6}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5A052F03-FED8-4661-B819-06C18BAD72F8}" = lport=2869 | protocol=6 | dir=in | app=system |
"{67F5CA8E-DAE0-4B0C-B014-D443E6E93005}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{741FAC04-92DC-4002-9EEA-BFDE76C7BFBC}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{82CC8CF5-D325-46EC-9A34-B5E24B173D06}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{8BC39BB5-2954-467D-BB6A-ADEF28465955}" = lport=139 | protocol=6 | dir=in | app=system |
"{8E42CA6C-9071-43A9-B734-19F95F1A9B0E}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BAF2FBE7-93DF-4F56-A73B-40BC2843D6E0}" = lport=445 | protocol=6 | dir=in | app=system |
"{D3436C53-ACC4-43B3-932D-C9DA826F99F7}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D4F3593F-0851-49B8-9289-5226157C8513}" = rport=445 | protocol=6 | dir=out | app=system |
"{D735C22B-8665-4FC6-B7C5-6CF3D0062C17}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{DA45F9AD-7357-4D03-8A1C-95038C488847}" = rport=138 | protocol=17 | dir=out | app=system |
"{DE5183A4-E9A5-4E1F-AD33-51FB61B4890D}" = rport=137 | protocol=17 | dir=out | app=system |
"{E942D242-59BD-4703-9142-6131945A3580}" = rport=139 | protocol=6 | dir=out | app=system |
"{EC772A7B-C7D8-4277-B41C-7E16D1577747}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F1DC47FA-DE4B-49DC-9F44-34B1B107631F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{FE397310-8ADF-4369-988E-A0D14C421E8B}" = lport=137 | protocol=17 | dir=in | app=system |
"{FF7007A0-673A-439C-A73C-EEE88765825F}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01C844BA-76D6-4AFA-9832-E9548FBB849E}" = dir=in | app=c:\program files\lenovo\readycomm\common\igrs.exe |
"{028D3604-FC3D-42A8-A491-470880EBF6FE}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{0C21E8C4-23C0-42E5-9352-77C517D54D2C}" = protocol=6 | dir=out | app=system |
"{0D02988C-10D0-40A8-AC5E-4DAC4AAF167E}" = dir=in | app=c:\program files\lenovo\readycomm\common\igrs.exe |
"{0ED231BF-A7FA-4CCF-8141-44D4B9F84E8B}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe |
"{11F51475-A0A2-42E1-A919-8400A969AA70}" = dir=out | app=c:\windows\system32\igrssvcs.exe |
"{121996F0-9C2F-4F96-A9AC-77D320DD148E}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{14F4E9E0-0B3F-46A2-B53C-55A7CC9185B1}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe |
"{173F736D-B9D7-4C54-9795-9AC92DD87E42}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{1830C2BA-86F3-41BF-8CE1-5B83813E1AB5}" = dir=out | app=c:\program files\lenovo\readycomm\common\igrs.exe |
"{19EDF433-BACE-43C5-AE47-407DD2528DE1}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{1BED21CA-7E8B-400E-B3A8-786A8F650527}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{1DBEDBD5-EA52-4ADC-8CAF-213F0FFC081B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{1E632062-C081-4D45-9F72-DB99E3A3C419}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{1EF1D698-CF5B-4C78-900B-2098C4D4AEF9}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{2A4A0902-2591-4420-AD8E-1DDEA274FB78}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2B1C1B0B-1941-43C9-B9CF-10E3C88B3F07}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{33FE07C2-1055-4D13-AB38-09626CB7FEEC}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{34E0269B-5FA4-4364-B4BA-8D98E28CF5A6}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe |
"{3A3763A7-4F3E-4734-9A58-0D4FF0DF6A5A}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{3C777615-0F12-42E8-978C-D37B15DE1FE4}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{3CD5D1A3-663A-47F8-8776-EC29ABA69BDB}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{4039E430-8577-40D7-AC00-2CB61C2C91AF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4779FDDA-F7AE-48F4-916B-A33ED15A0A38}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{49C9ACA1-15FC-4A2A-B012-F91B71E919EB}" = dir=in | app=c:\windows\system32\igrssvcs.exe |
"{4D428986-B023-4389-B64E-429E2635611D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{4EB86574-EB43-4A95-9191-F3428D0EDDC8}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{5AE7A07D-E05F-4421-8F55-086B658EA75C}" = protocol=6 | dir=in | app=c:\program files\hp\hp deskjet 1000 j110 series\bin\usbsetup.exe |
"{5CE3476B-6C53-453C-99F5-46E875A8076B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{65703310-DAF4-4FD3-B328-312C8584C2A0}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe |
"{67112600-5DD3-4677-8360-425C89DD04EB}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe |
"{68D8425A-91AF-4DCB-94AD-EE59CC8E5E33}" = dir=out | app=c:\program files\lenovo\readycomm\projectionist.exe |
"{68F57721-73C2-45CB-B547-670CA7FED630}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{6C2E35C1-5EF1-4558-ACFC-1BFE2531120D}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{6DF16C56-2BF0-4146-9AC5-DAC54077F0D3}" = dir=in | app=c:\program files\lenovo\readycomm\readycom.exe |
"{6F625DD1-B3F3-4DF6-AD31-128E0975717D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6FBFECA3-AA3D-4F1C-B820-C11F1D2CD30B}" = dir=out | app=c:\program files\lenovo\readycomm\connsvc.exe |
"{760D7272-210A-4F7D-A091-C63D924D000E}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe |
"{7AEB96E2-44F9-46C4-95C7-BB005E80F7F5}" = dir=in | app=c:\program files\lenovo\readycomm\projectionist.exe |
"{80533043-EB8C-46B7-B617-A85E3246C891}" = dir=out | app=c:\program files\lenovo\readycomm\appsvc.exe |
"{8154D1A9-2B7C-4F5C-9AA8-2B19150004EC}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"{834852D1-2171-488C-A724-60A8D754A3D2}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe |
"{84EDF68A-AB9B-49D7-9AD4-447528A47967}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{89B87B9A-62CF-4CCE-BF84-76BFC600A7F8}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{907909B5-9BAC-443B-8693-1E0AC6BA6489}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{93CB32FE-65DF-4F7F-BF24-80FDA4A68C47}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{9425A208-4B6B-4B35-AB6E-9AD0108201C0}" = protocol=17 | dir=in | app=c:\users\balle\appdata\roaming\dropbox\bin\dropbox.exe |
"{9EB26558-D0B2-4775-B6F8-B62F469F37ED}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe |
"{A139EB45-1961-414F-99FD-CC3AB86A0240}" = protocol=6 | dir=in | app=c:\users\balle\appdata\roaming\dropbox\bin\dropbox.exe |
"{A1AA3116-F22D-46DF-A14E-9B3395CA23D5}" = dir=in | app=c:\program files\lenovo\readycomm\connsvc.exe |
"{A53EBD41-B05F-49AC-8E7D-4DD9C533B5C2}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe |
"{A7476879-24D2-404F-B45C-E5FCF0A12B19}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{A9662551-F01E-4E07-AF06-BEF1ED6E0864}" = dir=out | app=c:\program files\lenovo\readycomm\common\igrs.exe |
"{AEEFBCD7-45B5-4C36-B450-3228ED1316A4}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{B0C2D180-6062-429B-807A-FA4A3AB90E0B}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe |
"{B0F74D65-55C1-4A88-921E-CC8422456F2C}" = dir=out | app=c:\program files\lenovo\readycomm\readycomm.exe |
"{BE5EB5A8-7BD6-4BB6-A9EA-9A092DD51F0C}" = protocol=17 | dir=in | app=c:\program files\hp\hp deskjet 1000 j110 series\bin\usbsetup.exe |
"{C50443C5-91B3-4CBF-B878-DB3BD340CB2E}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{CF9C6BDA-3078-41E6-BAAA-6F9ED9D31B5F}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe |
"{D00084EB-E795-486E-90CA-40B1BADBCA79}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe |
"{D22FD323-5966-426E-B71D-A1E7E696883F}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe |
"{DC5C7F77-C669-412D-97FC-706A88D828A6}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{DCA56FC0-DB34-4935-A3FB-47B9701D5DC1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{DD123787-95E5-4A0B-ACE4-6CFA2E76291F}" = dir=in | app=e:\setup\hpznui01.exe |
"{E18BF107-13DC-4A37-AD81-FD153C0F5F56}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E1F401A3-2586-414C-8946-D194A4457675}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{E44F0A9C-6362-49D9-BD33-8A08043F9313}" = dir=in | app=c:\program files\lenovo\readycomm\appsvc.exe |
"{E94730EA-EE62-4925-83C3-C7A2B5825AE3}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{EB416C84-5D72-4A4D-9851-A2B40B2D004A}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{FC226656-BB68-4727-9A84-FBB155F7FB00}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"TCP Query User{6B56E8B9-B132-465F-BDAE-B81956542FE9}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"TCP Query User{8C94C0CE-020B-4A39-BC03-7F63A0FF30AD}C:\users\balle\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\balle\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{A54B2133-1606-465E-A6CE-77E5BAF6DBD2}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{490F9222-2AB4-4C3A-9058-2B99899B84F9}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"UDP Query User{A364BD11-ABA5-4397-85B2-C0C5905DF727}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{BF66BAB6-22F1-4003-80C9-436B5106C885}C:\users\balle\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\balle\appdata\roaming\dropbox\bin\dropbox.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{014E482A-0C27-47E3-BA82-307E9DCA2F47}" = HP Photosmart Wireless B110 All-In-One Driver Software 14.0 Rel. 7
"{0224CACC-994D-45F8-B973-D65056EA9C2F}" = Adobe XMP DVA Panels CS3
"{05D08C4D-58A2-438B-A419-EE994E64E15D}" = B110
"{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = Bing Bar
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery
"{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant
"{17542DBF-E17C-4562-BC4D-FA3EF3076C45}" = Lenovo ReadyComm 5
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{193EAFD0-1BAF-4FB4-B18F-79D5D6A4B285}" = Adobe After Effects CS3 Presets
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{23B8A91D-680B-462B-87AD-3D70F7341731}" = iTunes
"{26A24AE4-039D-4CA4-87B4-2F83216027FF}" = Java(TM) 6 Update 27
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{2FB9EA69-51D4-4913-9AD5-762C034DE811}" = Status
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3DEAED7D-E85E-48EB-999E-5B4576A22369}" = HP Deskjet 1000 J110 series - Grundlegende Software für das Gerät
"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"{49F3D04B-B849-4C89-AB31-2366A004EA28}" = Broadcom Gigabit Integrated Controller
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2
"{4F7177E9-2B54-48B4-AAFD-03FA1F87A542}" = Bing Bar Platform
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{565E7B0E-B76B-4EAD-9753-F1E72A5CF12E}" = HPAppStudio
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files
"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{70B7A167-0B88-445D-A3EA-97C73AA88CAC}" = Windows Live Toolbar
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{7670D32F-DAE6-4E49-8C8B-B3F08B5B1686}" = Microsoft SQL Server Native Client
"{76C66170-C538-4E77-B54D-48E136B5B533}" = Lenovo ReadyComm 5.0 Service
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{779DECD7-E072-4B56-9B6B-BEB5973EEEB5}" = MobileMe Control Panel
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7ACFB90E-8FD0-4397-AD3A-5195412623A3}" = Adobe Help Viewer CS3
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{845A8DB9-8802-4FD3-9FE3-938A6C46A2EC}" = Adobe Video Profiles
"{8991E763-21F5-4DEA-A938-5D9D77DCB488}" = Broadcom 802.11 Wireless Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E4B1BE8-DCF3-4B90-A726-B28107442623}" = SolutionCenter
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.1.6
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9EDBB857-8028-49CD-B9C9-0B4D10CD1031}" = Nero 8
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A30EE8A6-6B9F-4973-B5ED-2A60B40576E4}_is1" = StudNET Login Client
"{A80FA752-C491-4ED9-ABF0-4278563160B2}" = 32 Bit HP CIO Components Installer
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}" = HPSSupply
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-1033-F400-7760-000000000002}" = Adobe Acrobat 7.0 Professional - English, Français, Deutsch
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{AE1E24C2-E720-42D5-B8E1-48F71A97B4DB}" = Energy Management
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3
"{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}" = Adobe BridgeTalk Plugin CS3
"{B95B1BA9-F887-4B3C-8D3A-CCD4C4675120}" = Microsoft Default Manager
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2
"{BBFB2E59-B0DB-42C8-8F4D-CF4E85471667}" = Toolbox
"{BC4F8E84-5E29-49EC-B4E7-E6F9CB50986C}" = Adobe Flash Player 9 ActiveX
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{BEAD39CD-901D-4267-8B8B-EAA83CB4B70D}" = Pivot Stickfigure Animator
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch
"{D3C605D8-3A5E-4BAD-965D-2C61441BF2AC}" = Adobe Photoshop CS3
"{D5A31AB1-345D-47C7-A87B-036A669F6DF1}" = Adobe XMP Panels CS3
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{DA896917-C1DA-45B2-B4D2-68162F16C0DD}" = Adobe Creative Suite 3 Master Collection
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DDDFCC77-7F9C-45E9-B38E-721BA599BA0C}" = HP Deskjet 1000 J110 series Hilfe
"{DFFDDCF5-CB32-4354-8823-1B9E68025953}" = Adobe Setup
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E517094C-06B6-419F-8FFD-EF4F57972130}" = QuickTransfer
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E7084B89-69E0-46B3-A118-8F99D06988CD}" = Microsoft SQL Server VSS Writer
"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{EFC04D3F-A152-47E7-8517-EE0F6201AFEF}" = Apple Mobile Device Support
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F80BD4BC-06B8-488E-A62E-C4755013DD71}" = Network
"{F88E2E04-7EF5-488C-8E38-C94EB808458E}" = PS_AIO_07_B110_SW_Min
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm
"{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}" = Lenovo EasyCamera
"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings
"Adobe Acrobat 7.0 Professional - EFG" = Adobe Acrobat 7.0 Professional - English, Français, Deutsch
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe_67a7fb1e97aa14ee9ef0950eb6fd757" = Adobe Creative Suite 3 Master Collection hinzufügen oder entfernen
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"Avira AntiVir Desktop" = Avira Free Antivirus
"Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2
"CNXT_AUDIO_HDA" = Conexant HD Audio
"EasyCapture4.0" = EasyCapture
"ENTERPRISE" = Microsoft Office Enterprise 2007
"GOM Player" = GOM Player
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HP Imaging Device Functions" = HP Imaging Device Functions 14.0
"HP Photo Creations" = HP Photo Creations
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0
"HPExtendedCapabilities" = HP Customer Participation Program 14.0
"Icy Tower v1.4_is1" = Icy Tower v1.4
"InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Opera 11.62.1347" = Opera 11.62
"PC-Doctor for Windows" = PC-Doctor für Windows
"Picasa 3" = Picasa 3
"SecureW2 EAP Suite" = SecureW2 EAP Suite 1.1.3 for Windows
"Shop for HP Supplies" = Shop for HP Supplies
"TVWiz" = Intel(R) TV Wizard
"VLC media player" = VLC media player 1.1.4
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinLiveSuite_Wave3" = Windows Live Essentials
"Yahoo! Companion" = Yahoo! Toolbar

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 13.02.2012 10:23:52 | Computer Name = Balle-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 13.02.2012 10:23:52 | Computer Name = Balle-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2777

Error - 13.02.2012 10:23:52 | Computer Name = Balle-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2777

Error - 13.02.2012 10:23:54 | Computer Name = Balle-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 13.02.2012 10:23:54 | Computer Name = Balle-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 5273

Error - 13.02.2012 10:23:54 | Computer Name = Balle-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 5273

Error - 14.02.2012 06:59:33 | Computer Name = Balle-PC | Source = Application Hang | ID = 1002
Description = Programm opera.exe, Version 11.61.1250.0 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1ab4 Startzeit:
01cceb040ad94240 Endzeit: 15 Anwendungspfad: C:\Program Files\Opera\opera.exe Berichts-ID:
f81714c8-56fa-11e1-a261-88ae1d20cb14

Error - 14.02.2012 12:28:03 | Computer Name = Balle-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 14.02.2012 12:28:03 | Computer Name = Balle-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1001230

Error - 14.02.2012 12:28:03 | Computer Name = Balle-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1001230

[ System Events ]
Error - 30.05.2012 05:20:10 | Computer Name = Balle-PC | Source = DCOM | ID = 10005
Description =

Error - 30.05.2012 05:20:09 | Computer Name = Balle-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
iPod-Dienst erreicht.

Error - 30.05.2012 05:20:10 | Computer Name = Balle-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "iPod-Dienst" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error - 31.05.2012 05:41:03 | Computer Name = Balle-PC | Source = DCOM | ID = 10005
Description =

Error - 31.05.2012 05:41:03 | Computer Name = Balle-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
iPod-Dienst erreicht.

Error - 31.05.2012 05:41:03 | Computer Name = Balle-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "iPod-Dienst" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error - 06.06.2012 04:13:35 | Computer Name = Balle-PC | Source = bowser | ID = 8003
Description =

Error - 08.06.2012 10:37:14 | Computer Name = Balle-PC | Source = sptd | ID = 262148
Description = Der Treiber hat einen internen Fehler in seinen Datenstrukturen für
festgestellt.

Error - 08.06.2012 11:14:39 | Computer Name = Balle-PC | Source = volsnap | ID = 393224
Description = Das Zeitlimit für den Lösch- und Speicherschreibvorgang für Volume
"C:" wurde beim Warten auf eine Schreibvorgangfreigabe überschritten.

Error - 08.06.2012 17:36:48 | Computer Name = Balle-PC | Source = DCOM | ID = 10010
Description =


< End of report >


Gmer Report:


GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-09 22:06:59
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 HITACHI_ rev.PB3Z
Running: 1nb7ri6h.exe; Driver: C:\Users\Balle\AppData\Local\Temp\uwloqpod.sys


---- System - GMER 1.0.15 ----

SSDT 991F9176 ZwCreateSection
SSDT 991F9180 ZwRequestWaitReplyPort
SSDT 991F917B ZwSetContextThread
SSDT 991F9185 ZwSetSecurityObject
SSDT 991F918A ZwSystemDebugControl
SSDT 991F9117 ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwRollbackEnlistment + 140D 82C483C9 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82C81D52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 82C88EAC 4 Bytes [76, 91, 1F, 99] {JBE 0xffffffffffffff93; POP DS; CDQ }
.text ntkrnlpa.exe!KeRemoveQueueEx + 1553 82C89208 4 Bytes CALL A25A128F
.text ntkrnlpa.exe!KeRemoveQueueEx + 1597 82C8924C 4 Bytes [7B, 91, 1F, 99] {JNP 0xffffffffffffff93; POP DS; CDQ }
.text ntkrnlpa.exe!KeRemoveQueueEx + 1613 82C892C8 4 Bytes [85, 91, 1F, 99]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1667 82C8931C 4 Bytes [8A, 91, 1F, 99]
.text ...

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

Device \Driver\ACPI_HAL \Device\0000004a halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002269ec2d88
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xC4 0x0A 0xF8 0xEE ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x5A 0xCB 0x59 0xBA ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x93 0xAC 0xEC 0x86 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002269ec2d88 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xC4 0x0A 0xF8 0xEE ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x5A 0xCB 0x59 0xBA ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x93 0xAC 0xEC 0x86 ...

---- EOF - GMER 1.0.15 ----

Bitte erstmal routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

 hier steht das Log
         

Danke für die Antwort!

Hier der neue Malwarebyte Scan:

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.12.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
Balle :: BALLE-PC [Administrator]

12.06.2012 18:12:06
mbam-log-2012-06-12 (19-28-49).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 366665
Laufzeit: 1 Stunde(n), 16 Minute(n), 17 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
C:\$Recycle.Bin\S-1-5-21-3148202469-1901182517-3593787174-1003\$R60F7RG.exe (PUP.ToolbarDownloader) -> Keine Aktion durchgeführt.
C:\Users\Balle\AppData\Local\Temp\welibnofyg.pre (Trojan.Agent) -> Keine Aktion durchgeführt.
C:\Users\Balle\AppData\Local\Temp\rurjqyfpab.pre (Trojan.Agent) -> Keine Aktion durchgeführt.
C:\Users\Balle\AppData\Local\Temp\jqjfyuvzrx.pre (Trojan.Agent) -> Keine Aktion durchgeführt.

(Ende)
         

Alles in Quarantäne gepackt!
Diese logs habe ich noch im Programm gespeichert gefunden:

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.12.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
Balle :: BALLE-PC [Administrator]

12.06.2012 18:10:23
mbam-log-2012-06-12 (18-10-23).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 3871
Laufzeit: 1 Minute(n), 26 Sekunde(n) [Abgebrochen]

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.12.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
Balle :: BALLE-PC [Administrator]

12.06.2012 18:12:06
mbam-log-2012-06-12 (18-12-06).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 366665
Laufzeit: 1 Stunde(n), 16 Minute(n), 17 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
C:\$Recycle.Bin\S-1-5-21-3148202469-1901182517-3593787174-1003\$R60F7RG.exe (PUP.ToolbarDownloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Balle\AppData\Local\Temp\welibnofyg.pre (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Balle\AppData\Local\Temp\rurjqyfpab.pre (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Balle\AppData\Local\Temp\jqjfyuvzrx.pre (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

Und hier noch der ESET Scan. Der war unauffällig.

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=75711d3b045d394183599d7866e97195
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-06-12 07:38:37
# local_time=2012-06-12 09:38:37 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 10033183 10033183 0 0
# compatibility_mode=5893 16776573 100 94 21097 91154948 0 0
# compatibility_mode=8192 67108863 100 0 141 141 0 0
# scanned=170195
# found=0
# cleaned=0
# scan_time=6160
         

Danke für den Hinweis mit den Code Tags... hatte das vorher nicht gefunden!

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Windows lies sich immer ganz normal starten, es funktioniert auch alles, nur die Dateien lassen sich nicht öffnen.

Im Startmenü scheint auch alles beim alten zu sein. Habe gerade alles durchgeklickt und mir ist nichts aufgefallen.

Liebe Grüße

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

 hier steht das Log
         

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die OTL.exe.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Setze oben mittig den Haken bei Scanne alle Benutzer
• Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Klick auf .
• Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Hier der erneute Scan:

OTL logfile created on: 13.06.2012 22:20:08 - Run 2
OTL by OldTimer - Version 3.2.48.0     Folder = C:\Users\Balle\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,93 Gb Total Physical Memory | 1,90 Gb Available Physical Memory | 64,91% Memory free
5,87 Gb Paging File | 4,73 Gb Available in Paging File | 80,62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 128,96 Gb Total Space | 88,40 Gb Free Space | 68,55% Space Free | Partition Type: NTFS
Drive D: | 154,17 Gb Total Space | 110,73 Gb Free Space | 71,82% Space Free | Partition Type: NTFS
 
Computer Name: BALLE-PC | User Name: Balle | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.09 21:01:32 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Balle\Desktop\OTL.exe
PRC - [2012.05.08 22:17:50 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.08 22:17:50 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 22:17:50 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 22:17:50 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011.01.02 21:29:50 | 000,009,216 | ---- | M] (www.shadowexplorer.com) -- C:\Users\Balle\Desktop\ShadowExplorer\sesvc.exe
PRC - [2010.12.10 19:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
PRC - [2010.12.10 19:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe
PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.05.14 12:00:26 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2010.04.27 17:39:38 | 000,243,544 | ---- | M] (Microsoft Corp.) -- C:\Programme\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe
PRC - [2009.09.29 18:23:20 | 004,114,288 | ---- | M] (Lenovo(beijing) Limited) -- C:\Programme\Lenovo\Energy Management\utility.exe
PRC - [2009.09.29 18:22:46 | 005,064,560 | ---- | M] (Lenovo (Beijing) Limited) -- C:\Programme\Lenovo\Energy Management\Energy Management.exe
PRC - [2009.08.18 12:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2009.08.18 12:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2009.07.14 16:27:26 | 000,038,152 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\ReadyComm\common\IGRS.exe
PRC - [2009.07.14 03:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\IgrsSvcs.exe
PRC - [2009.06.04 21:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2009.06.04 21:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2009.02.26 19:36:46 | 000,030,040 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
PRC - [2008.05.08 01:29:38 | 000,122,880 | ---- | M] (CrypKey (Canada) Ltd.) -- C:\Windows\System32\Crypserv.exe
PRC - [2008.01.16 11:51:44 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
PRC - [2007.10.23 14:19:06 | 001,410,344 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Lib\NMIndexStoreSvr.exe
PRC - [2007.10.23 14:18:46 | 000,202,024 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Lib\NMBgMonitor.exe
PRC - [2004.12.14 02:12:02 | 000,483,328 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Acrobat 7.0\Distillr\acrotray.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.02.28 21:42:14 | 000,652,800 | ---- | M] () -- C:\Programme\IZArc\IZArcCM.dll
MOD - [2008.12.20 05:20:50 | 000,063,304 | ---- | M] () -- C:\Programme\Lenovo\Energy Management\KbdHook.dll
MOD - [2008.12.20 05:20:08 | 000,051,016 | ---- | M] () -- C:\Programme\Lenovo\Energy Management\HookLib.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.05.08 22:17:50 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.08 22:17:50 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2011.01.02 21:29:50 | 000,009,216 | ---- | M] (www.shadowexplorer.com) [Auto | Running] -- C:\Users\Balle\Desktop\ShadowExplorer\sesvc.exe -- (sesvc)
SRV - [2010.12.10 19:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2010.12.10 19:29:30 | 029,293,408 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ)
SRV - [2010.12.10 19:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser)
SRV - [2010.12.10 19:29:30 | 000,044,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper)
SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.09.18 21:08:10 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010.05.14 12:00:26 | 000,249,136 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2009.09.22 20:16:32 | 000,579,400 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Programme\Lenovo\ReadyComm\ConnSvc.exe -- (Lenovo ReadyComm ConnSvc)
SRV - [2009.08.18 12:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.08.14 16:22:48 | 000,509,192 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Programme\Lenovo\ReadyComm\AppSvc.exe -- (Lenovo ReadyComm AppSvc)
SRV - [2009.07.16 05:12:42 | 000,276,296 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Programme\Lenovo\ReadyComm\PS_MDP.dll -- (PS_MDP)
SRV - [2009.07.14 16:27:26 | 000,038,152 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\ReadyComm\common\IGRS.exe -- (IGRS)
SRV - [2009.07.14 16:27:20 | 000,103,688 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\ReadyComm\common\router.dll -- (ReadyComm.DirectRouter)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.06.04 21:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2009.02.26 19:36:22 | 000,064,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
SRV - [2008.05.08 01:29:38 | 000,122,880 | ---- | M] (CrypKey (Canada) Ltd.) [Auto | Running] -- C:\windows\System32\Crypserv.exe -- (Crypkey License)
SRV - [2008.01.16 11:51:44 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)
SRV - [2006.10.26 16:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- D:\test\ECECECEC\WinRing0.sys -- (WinRing0_1_2_0)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\RtsUCcid.sys -- (USBCCID)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\Rts516xIR.sys -- (RtsUIR)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV - [2012.05.08 22:17:51 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 22:17:51 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.09.16 17:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.05.18 08:09:04 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dc3d.sys -- (dc3d) MS Hardware Device Detection Driver (USB)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.09.18 17:27:46 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2010.05.04 06:15:41 | 000,054,800 | ---- | M] () [Kernel | System | Running] -- C:\windows\System32\drivers\funfrm.sys -- (funfrm)
DRV - [2010.01.20 06:14:42 | 000,023,136 | ---- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AcpiVpc.sys -- (ACPIVPC)
DRV - [2009.10.16 20:37:30 | 000,171,776 | ---- | M] (SMI) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SMIksdrv.sys -- (usbsmi)
DRV - [2009.10.08 17:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.09.14 20:04:28 | 000,217,136 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2009.07.28 23:09:36 | 000,063,240 | ---- | M] (Lenovo) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wdbridge.sys -- (Bridge0)
DRV - [2009.07.21 23:14:58 | 000,081,704 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wsvd.sys -- (wsvd)
DRV - [2009.07.16 14:37:14 | 000,011,792 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WDMirror.sys -- (wdmirror)
DRV - [2009.07.14 02:18:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) Intel(R)
DRV - [2009.07.14 00:02:49 | 000,229,888 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\k57nd60x.sys -- (k57nd60x) Broadcom NetLink (TM)
DRV - [2009.06.15 04:46:22 | 000,475,648 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)
DRV - [2008.08.06 14:34:16 | 000,128,104 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\WimFltr.sys -- (WimFltr)
DRV - [2008.03.17 18:45:52 | 000,019,584 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\Ckldrv.sys -- (NetworkX)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3148202469-1901182517-3593787174-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ [binary data]
IE - HKU\S-1-5-21-3148202469-1901182517-3593787174-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
IE - HKU\S-1-5-21-3148202469-1901182517-3593787174-1003\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\S-1-5-21-3148202469-1901182517-3593787174-1003\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3148202469-1901182517-3593787174-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE - HKU\S-1-5-21-3148202469-1901182517-3593787174-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3148202469-1901182517-3593787174-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpWinExt,version=5.0: C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\Firefox [2011.02.03 18:26:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011.12.08 15:46:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012.01.02 19:00:43 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012.01.02 19:00:43 | 000,000,000 | ---D | M]
 
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Balle\AppData\Local\Google\Chrome\Application\18.0.1025.168\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Balle\AppData\Local\Google\Chrome\Application\18.0.1025.168\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Balle\AppData\Local\Google\Chrome\Application\18.0.1025.168\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.270.7 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U27 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Bing Bar (Enabled) = C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - Extension: Click to activate/deactivate ProxTube = C:\Users\Balle\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.1.0_1\
CHR - Extension: South Park Theme = C:\Users\Balle\AppData\Local\Google\Chrome\User Data\Default\Extensions\aoiakcboakkfknbginpmpfkcdmcmpnfm\1.3_0\
CHR - Extension: YouTube = C:\Users\Balle\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Chrome YouTube Downloader = C:\Users\Balle\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbdjiinahkdjdcdlgfimlcolkjpbooja\2.6.4_1\
CHR - Extension: Google-Suche = C:\Users\Balle\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Mail = C:\Users\Balle\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Programme\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (@C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Programme\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-3148202469-1901182517-3593787174-1003\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKU\S-1-5-21-3148202469-1901182517-3593787174-1003\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acrobat Assistant 7.0] C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Energy Management] C:\Programme\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
O4 - HKLM..\Run: [EnergyUtility] C:\Programme\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4 - HKLM..\Run: [UpdateP2GShortCut] C:\Program Files\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [VeriFaceManager] C:\Program Files\Lenovo\VeriFace\PManage.exe File not found
O4 - HKU\S-1-5-21-3148202469-1901182517-3593787174-1003..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Balle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Balle\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 139.18.25.3 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{45B8CC2E-CC95-462F-BA11-40A1EF752DBE}: DhcpNameServer = 139.18.25.3 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8D9A6627-3237-4C47-A3EA-BAED32ADEFD7}: NameServer = 139.18.25.3
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{5e8bcabe-c339-11df-87b5-88ae1d20cb14}\Shell - "" = AutoRun
O33 - MountPoints2\{5e8bcabe-c339-11df-87b5-88ae1d20cb14}\Shell\AutoRun\command - "" = G:\Autoplay.exe -auto
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: mcmscsvc - Service
SafeBootMin: MCODS - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: mcmscsvc - Service
SafeBootNet: MCODS - Service
SafeBootNet: Messenger - Service
SafeBootNet: MpfService - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {8BA4AE82-389F-378D-B742-439295A0DC8E} - Microsoft Windows Media Player
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C60EB297-0FAD-F80D-686B-A1917BF8AF74} - Microsoft Windows Media Player
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.clmp3enc - C:\Programme\Lenovo\Power2Go\CLMP3Enc.ACM (CyberLink Corp.)
Drivers32: msacm.divxa32 - C:\windows\System32\msaud32_divx.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.12 19:53:36 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.06.12 14:29:25 | 000,000,000 | ---D | C] -- C:\ProgramData\CrypKey
[2012.06.12 14:13:47 | 000,000,000 | ---D | C] -- C:\Log
[2012.06.12 14:13:34 | 000,000,000 | ---D | C] -- C:\Users\Balle\Desktop\Orientierungspraktikum
[2012.06.12 14:12:17 | 000,165,888 | ---- | C] (Kenonic Controls) -- C:\windows\Ckconfig.exe
[2012.06.12 14:12:17 | 000,122,880 | ---- | C] (CrypKey (Canada) Ltd.) -- C:\windows\System32\Crypserv.exe
[2012.06.12 14:12:13 | 001,207,808 | ---- | C] (Dmitry Streblechenko) -- C:\windows\System32\PhoenixDll.dll
[2012.06.12 14:12:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellar Phoenix Windows Data Recovery
[2012.06.12 14:12:11 | 000,000,000 | ---D | C] -- C:\Program Files\Stellar Phoenix Windows Data Recovery
[2012.06.10 19:28:48 | 000,000,000 | ---D | C] -- C:\Users\Balle\AppData\Roaming\www.shadowexplorer.com
[2012.06.10 19:28:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShadowExplorer
[2012.06.10 19:28:36 | 000,000,000 | ---D | C] -- C:\Users\Balle\Desktop\ShadowExplorer
[2012.06.10 19:25:27 | 000,000,000 | ---D | C] -- C:\Users\Balle\Desktop\Hintergrundbilder verschlüsselte Kopien
[2012.06.10 19:18:43 | 000,000,000 | ---D | C] -- C:\Users\Balle\Desktop\Bilddateien
[2012.06.09 22:51:48 | 000,000,000 | ---D | C] -- C:\Users\Balle\Desktop\Textdateien
[2012.06.09 21:01:29 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Balle\Desktop\OTL.exe
[2012.06.09 00:10:02 | 000,000,000 | ---D | C] -- C:\Users\Balle\AppData\Roaming\Malwarebytes
[2012.06.09 00:09:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.09 00:09:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.09 00:09:04 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2012.06.09 00:09:04 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.06.08 15:59:59 | 000,000,000 | ---D | C] -- C:\Users\Balle\AppData\Roaming\Eslnompvunh
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.13 21:11:27 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012.06.13 19:30:50 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.13 19:30:50 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.13 19:22:36 | 2362,912,768 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.12 19:30:35 | 000,001,680 | ---- | M] () -- C:\windows\System32\esnecil.ind
[2012.06.12 17:42:20 | 000,000,213 | ---- | M] () -- C:\windows\spwdr.INI
[2012.06.12 17:38:54 | 181,762,390 | ---- | M] () -- D:\Eigene Dateien\SPWDR Scan 12-Jun-2012_05 37 45 PM.IMG
[2012.06.12 14:29:47 | 000,001,680 | ---- | M] () -- C:\windows\System32\esnecil.nlp
[2012.06.12 14:29:47 | 000,000,004 | ---- | M] () -- C:\windows\vx86036.dat
[2012.06.12 14:12:51 | 000,000,071 | ---- | M] () -- C:\windows\Crypkey.ini
[2012.06.12 14:12:14 | 000,001,160 | ---- | M] () -- C:\Users\Balle\Desktop\Stellar Phoenix Windows Data Recovery.lnk
[2012.06.10 19:28:38 | 000,001,531 | ---- | M] () -- C:\Users\Balle\Desktop\ShadowExplorer.lnk
[2012.06.09 21:21:52 | 000,302,592 | ---- | M] () -- C:\Users\Balle\Desktop\1nb7ri6h.exe
[2012.06.09 21:01:32 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Balle\Desktop\OTL.exe
[2012.06.09 20:56:44 | 000,000,020 | ---- | M] () -- C:\Users\Balle\defogger_reenable
[2012.06.09 00:09:06 | 000,001,078 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.08 23:37:36 | 000,690,574 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2012.06.08 23:37:36 | 000,653,898 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012.06.08 23:37:36 | 000,143,916 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2012.06.08 23:37:36 | 000,121,090 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012.06.08 15:56:12 | 000,001,057 | ---- | M] () -- C:\Users\Balle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
 
========== Files Created - No Company Name ==========
 
[2012.06.12 17:37:58 | 181,762,390 | ---- | C] () -- D:\Eigene Dateien\SPWDR Scan 12-Jun-2012_05 37 45 PM.IMG
[2012.06.12 14:29:46 | 000,000,004 | ---- | C] () -- C:\windows\vx86036.dat
[2012.06.12 14:29:26 | 000,001,680 | ---- | C] () -- C:\windows\System32\esnecil.nlp
[2012.06.12 14:29:26 | 000,001,680 | ---- | C] () -- C:\windows\System32\esnecil.ind
[2012.06.12 14:13:47 | 000,000,213 | ---- | C] () -- C:\windows\spwdr.INI
[2012.06.12 14:12:51 | 000,000,071 | ---- | C] () -- C:\windows\Crypkey.ini
[2012.06.12 14:12:17 | 000,027,648 | R--- | C] () -- C:\windows\Setup_ck.exe
[2012.06.12 14:12:17 | 000,019,584 | ---- | C] () -- C:\windows\System32\Ckldrv.sys
[2012.06.12 14:12:17 | 000,018,432 | ---- | C] () -- C:\windows\Setup_ck.dll
[2012.06.12 14:12:17 | 000,011,776 | ---- | C] () -- C:\windows\Ckrfresh.exe
[2012.06.12 14:12:14 | 000,001,160 | ---- | C] () -- C:\Users\Balle\Desktop\Stellar Phoenix Windows Data Recovery.lnk
[2012.06.12 14:12:13 | 000,178,176 | ---- | C] () -- C:\windows\System32\StellarProfile.dll
[2012.06.10 19:28:38 | 000,001,531 | ---- | C] () -- C:\Users\Balle\Desktop\ShadowExplorer.lnk
[2012.06.09 21:21:50 | 000,302,592 | ---- | C] () -- C:\Users\Balle\Desktop\1nb7ri6h.exe
[2012.06.09 20:56:16 | 000,000,020 | ---- | C] () -- C:\Users\Balle\defogger_reenable
[2012.06.09 00:09:06 | 000,001,078 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.01.02 18:53:27 | 000,231,622 | ---- | C] () -- C:\windows\hpoins47.dat
[2010.10.01 16:24:51 | 000,684,916 | ---- | C] () -- C:\windows\unins000.exe
[2010.10.01 16:24:51 | 000,012,387 | ---- | C] () -- C:\windows\unins000.dat
 
========== LOP Check ==========
 
[2012.03.11 12:10:13 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Amazon
[2010.09.18 17:31:38 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\DAEMON Tools Lite
[2012.06.09 02:57:59 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Dropbox
[2012.06.08 16:45:01 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Eslnompvunh
[2012.03.31 12:48:09 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\gtk-2.0
[2011.03.23 20:36:32 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\ICQ
[2010.09.16 21:08:33 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Opera
[2011.11.29 22:51:50 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\PhotoScape
[2010.09.18 22:06:29 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\TeamViewer
[2012.06.10 19:28:48 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\www.shadowexplorer.com
[2012.05.08 12:59:36 | 000,032,632 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.01.20 18:20:55 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Adobe
[2010.09.18 17:54:55 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\AdobeUM
[2012.03.11 12:10:13 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Amazon
[2012.01.03 22:25:51 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Apple Computer
[2012.02.17 19:01:53 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Avira
[2010.09.18 17:31:38 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\DAEMON Tools Lite
[2012.06.09 02:57:59 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Dropbox
[2011.05.12 23:12:06 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\dvdcss
[2012.06.08 16:45:01 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Eslnompvunh
[2011.05.12 23:16:30 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\GRETECH
[2012.03.31 12:48:09 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\gtk-2.0
[2012.01.02 19:10:16 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\HP
[2012.02.21 18:49:24 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\HpUpdate
[2011.03.23 20:36:32 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\ICQ
[2010.09.15 01:41:58 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Identities
[2010.09.16 21:01:35 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Macromedia
[2012.06.09 00:10:02 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Malwarebytes
[2009.07.29 12:50:54 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Media Center Programs
[2010.09.18 19:34:18 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Media Player Classic
[2012.06.10 19:47:38 | 000,000,000 | --SD | M] -- C:\Users\Balle\AppData\Roaming\Microsoft
[2010.09.18 20:55:54 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Nero
[2010.09.16 21:08:33 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Opera
[2011.11.29 22:51:50 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\PhotoScape
[2012.06.09 02:59:36 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Skype
[2010.09.18 22:06:29 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\TeamViewer
[2011.11.29 22:51:52 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\vlc
[2012.06.10 19:28:48 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\www.shadowexplorer.com
[2012.01.02 19:00:59 | 000,000,000 | ---D | M] -- C:\Users\Balle\AppData\Roaming\Yahoo!
 
< %APPDATA%\*.exe /s >
[2012.05.24 20:39:22 | 027,112,840 | ---- | M] (Dropbox, Inc.) -- C:\Users\Balle\AppData\Roaming\Dropbox\bin\Dropbox.exe
[2012.05.24 20:39:24 | 000,872,144 | ---- | M] (Dropbox, Inc.) -- C:\Users\Balle\AppData\Roaming\Dropbox\bin\DropboxUpdateHelper.exe
[2012.05.24 20:39:56 | 000,177,280 | ---- | M] (Dropbox, Inc.) -- C:\Users\Balle\AppData\Roaming\Dropbox\bin\Uninstall.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2009.06.04 20:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2009.06.04 20:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2009.06.04 20:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\drivers\iaStor.sys
[2009.06.04 20:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_4f144d6467fc7c22\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011.03.11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011.03.11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >
         

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

:OTL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{5e8bcabe-c339-11df-87b5-88ae1d20cb14}\Shell - "" = AutoRun
O33 - MountPoints2\{5e8bcabe-c339-11df-87b5-88ae1d20cb14}\Shell\AutoRun\command - "" = G:\Autoplay.exe -auto
:Files
C:\Users\Balle\AppData\Roaming\Eslnompvunh
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
         

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Hier das Log:

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ deleted successfully.
C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5e8bcabe-c339-11df-87b5-88ae1d20cb14}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5e8bcabe-c339-11df-87b5-88ae1d20cb14}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5e8bcabe-c339-11df-87b5-88ae1d20cb14}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5e8bcabe-c339-11df-87b5-88ae1d20cb14}\ not found.
File G:\Autoplay.exe -auto not found.
========== FILES ==========
C:\Users\Balle\AppData\Roaming\Eslnompvunh folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Balle
->Temp folder emptied: 1470201535 bytes
->Temporary Internet Files folder emptied: 96281398 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 435425630 bytes
->Apple Safari cache emptied: 123904 bytes
->Opera cache emptied: 6839018 bytes
->Flash cache emptied: 102358 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 47412099 bytes
RecycleBin emptied: 680729273 bytes
 
Total Files Cleaned = 2.610,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Balle
->Flash cache emptied: 0 bytes
 
User: Default
 
User: Default User
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
C:\windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.48.0 log created on 06142012_111802

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
         

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

TDSS Killer Log:

17:23:31.0045 6008	TDSS rootkit removing tool 2.7.39.0 Jun 14 2012 08:11:46
17:23:31.0170 6008	============================================================
17:23:31.0170 6008	Current date / time: 2012/06/14 17:23:31.0170
17:23:31.0170 6008	SystemInfo:
17:23:31.0170 6008	
17:23:31.0170 6008	OS Version: 6.1.7601 ServicePack: 1.0
17:23:31.0170 6008	Product type: Workstation
17:23:31.0170 6008	ComputerName: BALLE-PC
17:23:31.0170 6008	UserName: Balle
17:23:31.0170 6008	Windows directory: C:\windows
17:23:31.0170 6008	System windows directory: C:\windows
17:23:31.0170 6008	Processor architecture: Intel x86
17:23:31.0170 6008	Number of processors: 2
17:23:31.0170 6008	Page size: 0x1000
17:23:31.0170 6008	Boot type: Normal boot
17:23:31.0170 6008	============================================================
17:23:31.0872 6008	Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
17:23:31.0872 6008	============================================================
17:23:31.0872 6008	\Device\Harddisk0\DR0:
17:23:31.0872 6008	MBR partitions:
17:23:31.0872 6008	\Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x64000
17:23:31.0872 6008	\Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x64800, BlocksNum 0x101EDC00
17:23:31.0888 6008	\Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x10253000, BlocksNum 0x13459000
17:23:31.0888 6008	============================================================
17:23:31.0919 6008	C: <-> \Device\Harddisk0\DR0\Partition1
17:23:31.0950 6008	D: <-> \Device\Harddisk0\DR0\Partition2
17:23:31.0950 6008	============================================================
17:23:31.0950 6008	Initialize success
17:23:31.0950 6008	============================================================
17:23:43.0543 0588	============================================================
17:23:43.0543 0588	Scan started
17:23:43.0543 0588	Mode: Manual; SigCheck; TDLFS; 
17:23:43.0543 0588	============================================================
17:23:44.0027 0588	1394ohci        (1b133875b8aa8ac48969bd3458afe9f5) C:\windows\system32\drivers\1394ohci.sys
17:23:44.0183 0588	1394ohci - ok
17:23:44.0229 0588	ACPI            (cea80c80bed809aa0da6febc04733349) C:\windows\system32\drivers\ACPI.sys
17:23:44.0261 0588	ACPI - ok
17:23:44.0292 0588	AcpiPmi         (1efbc664abff416d1d07db115dcb264f) C:\windows\system32\drivers\acpipmi.sys
17:23:44.0370 0588	AcpiPmi - ok
17:23:44.0448 0588	ACPIVPC         (0ff1f2f287e65a66a3b72484b9895785) C:\windows\system32\DRIVERS\AcpiVpc.sys
17:23:44.0495 0588	ACPIVPC - ok
17:23:44.0573 0588	Adobe LM Service (6d182c31acf16213407f2768f1107fe3) C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
17:23:44.0604 0588	Adobe LM Service ( UnsignedFile.Multi.Generic ) - warning
17:23:44.0604 0588	Adobe LM Service - detected UnsignedFile.Multi.Generic (1)
17:23:44.0729 0588	AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
17:23:44.0744 0588	AdobeARMservice - ok
17:23:44.0853 0588	adp94xx         (21e785ebd7dc90a06391141aac7892fb) C:\windows\system32\DRIVERS\adp94xx.sys
17:23:44.0885 0588	adp94xx - ok
17:23:44.0931 0588	adpahci         (0c676bc278d5b59ff5abd57bbe9123f2) C:\windows\system32\DRIVERS\adpahci.sys
17:23:44.0963 0588	adpahci - ok
17:23:45.0009 0588	adpu320         (7c7b5ee4b7b822ec85321fe23a27db33) C:\windows\system32\DRIVERS\adpu320.sys
17:23:45.0025 0588	adpu320 - ok
17:23:45.0056 0588	AeLookupSvc     (8b5eefeec1e6d1a72a06c526628ad161) C:\windows\System32\aelupsvc.dll
17:23:45.0119 0588	AeLookupSvc - ok
17:23:45.0197 0588	AFD             (9ebbba55060f786f0fcaa3893bfa2806) C:\windows\system32\drivers\afd.sys
17:23:45.0275 0588	AFD - ok
17:23:45.0306 0588	agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\windows\system32\drivers\agp440.sys
17:23:45.0337 0588	agp440 - ok
17:23:45.0384 0588	aic78xx         (8b30250d573a8f6b4bd23195160d8707) C:\windows\system32\DRIVERS\djsvs.sys
17:23:45.0415 0588	aic78xx - ok
17:23:45.0462 0588	ALG             (18a54e132947cd98fea9accc57f98f13) C:\windows\System32\alg.exe
17:23:45.0540 0588	ALG - ok
17:23:45.0571 0588	aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\windows\system32\drivers\aliide.sys
17:23:45.0587 0588	aliide - ok
17:23:45.0618 0588	amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\windows\system32\drivers\amdagp.sys
17:23:45.0633 0588	amdagp - ok
17:23:45.0680 0588	amdide          (cd5914170297126b6266860198d1d4f0) C:\windows\system32\drivers\amdide.sys
17:23:45.0696 0588	amdide - ok
17:23:45.0758 0588	AmdK8           (00dda200d71bac534bf56a9db5dfd666) C:\windows\system32\DRIVERS\amdk8.sys
17:23:45.0821 0588	AmdK8 - ok
17:23:45.0836 0588	AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\windows\system32\DRIVERS\amdppm.sys
17:23:45.0899 0588	AmdPPM - ok
17:23:45.0945 0588	amdsata         (d320bf87125326f996d4904fe24300fc) C:\windows\system32\drivers\amdsata.sys
17:23:45.0977 0588	amdsata - ok
17:23:46.0008 0588	amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\windows\system32\DRIVERS\amdsbs.sys
17:23:46.0039 0588	amdsbs - ok
17:23:46.0055 0588	amdxata         (46387fb17b086d16dea267d5be23a2f2) C:\windows\system32\drivers\amdxata.sys
17:23:46.0070 0588	amdxata - ok
17:23:46.0195 0588	AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) C:\Program Files\Avira\AntiVir Desktop\sched.exe
17:23:46.0211 0588	AntiVirSchedulerService - ok
17:23:46.0273 0588	AntiVirService  (a489be6bb0aa1ff406b488b60542314b) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
17:23:46.0289 0588	AntiVirService - ok
17:23:46.0367 0588	ApfiltrService  (fd6d4bc1cf7d1fec5a17588007ecafb5) C:\windows\system32\DRIVERS\Apfiltr.sys
17:23:46.0382 0588	ApfiltrService - ok
17:23:46.0445 0588	AppID           (aea177f783e20150ace5383ee368da19) C:\windows\system32\drivers\appid.sys
17:23:46.0569 0588	AppID - ok
17:23:46.0616 0588	AppIDSvc        (62a9c86cb6085e20db4823e4e97826f5) C:\windows\System32\appidsvc.dll
17:23:46.0694 0588	AppIDSvc - ok
17:23:46.0725 0588	Appinfo         (fb1959012294d6ad43e5304df65e3c26) C:\windows\System32\appinfo.dll
17:23:46.0788 0588	Appinfo - ok
17:23:46.0913 0588	Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
17:23:46.0928 0588	Apple Mobile Device - ok
17:23:46.0991 0588	arc             (2932004f49677bd84dbc72edb754ffb3) C:\windows\system32\DRIVERS\arc.sys
17:23:47.0022 0588	arc - ok
17:23:47.0053 0588	arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\windows\system32\DRIVERS\arcsas.sys
17:23:47.0069 0588	arcsas - ok
17:23:47.0115 0588	AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\windows\system32\DRIVERS\asyncmac.sys
17:23:47.0256 0588	AsyncMac - ok
17:23:47.0334 0588	atapi           (338c86357871c167a96ab976519bf59e) C:\windows\system32\drivers\atapi.sys
17:23:47.0349 0588	atapi - ok
17:23:47.0412 0588	AudioEndpointBuilder (ce3b4e731638d2ef62fcb419be0d39f0) C:\windows\System32\Audiosrv.dll
17:23:47.0490 0588	AudioEndpointBuilder - ok
17:23:47.0505 0588	Audiosrv        (ce3b4e731638d2ef62fcb419be0d39f0) C:\windows\System32\Audiosrv.dll
17:23:47.0552 0588	Audiosrv - ok
17:23:47.0630 0588	avgntflt        (d5541f0afb767e85fc412fc609d96a74) C:\windows\system32\DRIVERS\avgntflt.sys
17:23:47.0646 0588	avgntflt - ok
17:23:47.0693 0588	avipbb          (7d967a682d4694df7fa57d63a2db01fe) C:\windows\system32\DRIVERS\avipbb.sys
17:23:47.0708 0588	avipbb - ok
17:23:47.0739 0588	avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\windows\system32\DRIVERS\avkmgr.sys
17:23:47.0755 0588	avkmgr - ok
17:23:47.0802 0588	AxInstSV        (6e30d02aac9cac84f421622e3a2f6178) C:\windows\System32\AxInstSV.dll
17:23:47.0880 0588	AxInstSV - ok
17:23:47.0958 0588	b06bdrv         (1a231abec60fd316ec54c66715543cec) C:\windows\system32\DRIVERS\bxvbdx.sys
17:23:48.0036 0588	b06bdrv - ok
17:23:48.0098 0588	b57nd60x        (6f41a4c5745bb99f89406f57164f099e) C:\windows\system32\DRIVERS\b57nd60x.sys
17:23:48.0129 0588	b57nd60x - ok
17:23:48.0317 0588	BCM43XX         (f9ce9b5e049efc66b8e6c73c18ee8438) C:\windows\system32\DRIVERS\bcmwl6.sys
17:23:48.0395 0588	BCM43XX - ok
17:23:48.0488 0588	BcmSqlStartupSvc (6163664c7e9cd110af70180c126c3fdc) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
17:23:48.0504 0588	BcmSqlStartupSvc - ok
17:23:48.0597 0588	BDESVC          (ee1e9c3bb8228ae423dd38db69128e71) C:\windows\System32\bdesvc.dll
17:23:48.0629 0588	BDESVC - ok
17:23:48.0691 0588	Beep            (505506526a9d467307b3c393dedaf858) C:\windows\system32\drivers\Beep.sys
17:23:48.0753 0588	Beep - ok
17:23:48.0831 0588	BFE             (1e2bac209d184bb851e1a187d8a29136) C:\windows\System32\bfe.dll
17:23:48.0894 0588	BFE - ok
17:23:48.0956 0588	BITS            (e585445d5021971fae10393f0f1c3961) C:\windows\System32\qmgr.dll
17:23:49.0034 0588	BITS - ok
17:23:49.0081 0588	blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\windows\system32\DRIVERS\blbdrive.sys
17:23:49.0128 0588	blbdrive - ok
17:23:49.0237 0588	Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe
17:23:49.0268 0588	Bonjour Service - ok
17:23:49.0331 0588	bowser          (8f2da3028d5fcbd1a060a3de64cd6506) C:\windows\system32\DRIVERS\bowser.sys
17:23:49.0393 0588	bowser - ok
17:23:49.0409 0588	BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\windows\system32\DRIVERS\BrFiltLo.sys
17:23:49.0487 0588	BrFiltLo - ok
17:23:49.0502 0588	BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\windows\system32\DRIVERS\BrFiltUp.sys
17:23:49.0549 0588	BrFiltUp - ok
17:23:49.0596 0588	Bridge0         (b35bb97b6dd9913093579f5c83962636) C:\windows\system32\drivers\WDBridge.sys
17:23:49.0611 0588	Bridge0 - ok
17:23:49.0674 0588	Browser         (6e11f33d14d020f58d5e02e4d67dfa19) C:\windows\System32\browser.dll
17:23:49.0752 0588	Browser - ok
17:23:49.0799 0588	Brserid         (845b8ce732e67f3b4133164868c666ea) C:\windows\System32\Drivers\Brserid.sys
17:23:49.0861 0588	Brserid - ok
17:23:49.0892 0588	BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\windows\System32\Drivers\BrSerWdm.sys
17:23:49.0955 0588	BrSerWdm - ok
17:23:49.0986 0588	BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\windows\System32\Drivers\BrUsbMdm.sys
17:23:50.0033 0588	BrUsbMdm - ok
17:23:50.0048 0588	BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\windows\System32\Drivers\BrUsbSer.sys
17:23:50.0095 0588	BrUsbSer - ok
17:23:50.0157 0588	BthEnum         (2865a5c8e98c70c605f417908cebb3a4) C:\windows\system32\drivers\BthEnum.sys
17:23:50.0251 0588	BthEnum - ok
17:23:50.0282 0588	BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\windows\system32\DRIVERS\bthmodem.sys
17:23:50.0329 0588	BTHMODEM - ok
17:23:50.0376 0588	BthPan          (ad1872e5829e8a2c3b5b4b641c3eab0e) C:\windows\system32\DRIVERS\bthpan.sys
17:23:50.0423 0588	BthPan - ok
17:23:50.0485 0588	BTHPORT         (c2fbf6d271d9a94d839c416bf186ead9) C:\windows\System32\Drivers\BTHport.sys
17:23:50.0563 0588	BTHPORT - ok
17:23:50.0610 0588	bthserv         (1df19c96eef6c29d1c3e1a8678e07190) C:\windows\system32\bthserv.dll
17:23:50.0672 0588	bthserv - ok
17:23:50.0688 0588	BTHUSB          (c81e9413a25a439f436b1d4b6a0cf9e9) C:\windows\System32\Drivers\BTHUSB.sys
17:23:50.0735 0588	BTHUSB - ok
17:23:50.0797 0588	cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\windows\system32\DRIVERS\cdfs.sys
17:23:50.0859 0588	cdfs - ok
17:23:50.0937 0588	cdrom           (be167ed0fdb9c1fa1133953c18d5a6c9) C:\windows\system32\drivers\cdrom.sys
17:23:50.0984 0588	cdrom - ok
17:23:51.0031 0588	CertPropSvc     (319c6b309773d063541d01df8ac6f55f) C:\windows\System32\certprop.dll
17:23:51.0109 0588	CertPropSvc - ok
17:23:51.0156 0588	circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\windows\system32\DRIVERS\circlass.sys
17:23:51.0203 0588	circlass - ok
17:23:51.0234 0588	CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\windows\system32\CLFS.sys
17:23:51.0265 0588	CLFS - ok
17:23:51.0359 0588	clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
17:23:51.0374 0588	clr_optimization_v2.0.50727_32 - ok
17:23:51.0405 0588	CmBatt          (dea805815e587dad1dd2c502220b5616) C:\windows\system32\DRIVERS\CmBatt.sys
17:23:51.0452 0588	CmBatt - ok
17:23:51.0499 0588	cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\windows\system32\drivers\cmdide.sys
17:23:51.0515 0588	cmdide - ok
17:23:51.0561 0588	CNG             (6427525d76f61d0c519b008d3680e8e7) C:\windows\system32\Drivers\cng.sys
17:23:51.0608 0588	CNG - ok
17:23:51.0686 0588	CnxtHdAudService (7c47786b58ae503777dbd12fae20ed42) C:\windows\system32\drivers\CHDRT32.sys
17:23:51.0764 0588	CnxtHdAudService - ok
17:23:51.0827 0588	Compbatt        (a6023d3823c37043986713f118a89bee) C:\windows\system32\DRIVERS\compbatt.sys
17:23:51.0842 0588	Compbatt - ok
17:23:51.0905 0588	CompositeBus    (cbe8c58a8579cfe5fccf809e6f114e89) C:\windows\system32\drivers\CompositeBus.sys
17:23:51.0920 0588	CompositeBus - ok
17:23:51.0951 0588	COMSysApp - ok
17:23:51.0967 0588	crcdisk         (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\windows\system32\DRIVERS\crcdisk.sys
17:23:51.0998 0588	crcdisk - ok
17:23:52.0014 0588	Crypkey License - ok
17:23:52.0076 0588	CryptSvc        (a585bebf7d054bd9618eda0922d5484a) C:\windows\system32\cryptsvc.dll
17:23:52.0123 0588	CryptSvc - ok
17:23:52.0185 0588	dc3d            (7caaf4af453ef3582fef65dd72caa0aa) C:\windows\system32\DRIVERS\dc3d.sys
17:23:52.0263 0588	dc3d - ok
17:23:52.0295 0588	DcomLaunch      (7660f01d3b38aca1747e397d21d790af) C:\windows\system32\rpcss.dll
17:23:52.0357 0588	DcomLaunch - ok
17:23:52.0404 0588	defragsvc       (8d6e10a2d9a5eed59562d9b82cf804e1) C:\windows\System32\defragsvc.dll
17:23:52.0482 0588	defragsvc - ok
17:23:52.0529 0588	DfsC            (f024449c97ec1e464aaffda18593db88) C:\windows\system32\Drivers\dfsc.sys
17:23:52.0591 0588	DfsC - ok
17:23:52.0654 0588	Dhcp            (e9e01eb683c132f7fa27cd607b8a2b63) C:\windows\system32\dhcpcore.dll
17:23:52.0732 0588	Dhcp - ok
17:23:52.0779 0588	discache        (1a050b0274bfb3890703d490f330c0da) C:\windows\system32\drivers\discache.sys
17:23:52.0842 0588	discache - ok
17:23:52.0904 0588	Disk            (565003f326f99802e68ca78f2a68e9ff) C:\windows\system32\DRIVERS\disk.sys
17:23:52.0935 0588	Disk - ok
17:23:52.0966 0588	Dnscache        (33ef4861f19a0736b11314aad9ae28d0) C:\windows\System32\dnsrslvr.dll
17:23:53.0029 0588	Dnscache - ok
17:23:53.0060 0588	dot3svc         (366ba8fb4b7bb7435e3b9eacb3843f67) C:\windows\System32\dot3svc.dll
17:23:53.0122 0588	dot3svc - ok
17:23:53.0169 0588	DPS             (8ec04ca86f1d68da9e11952eb85973d6) C:\windows\system32\dps.dll
17:23:53.0247 0588	DPS - ok
17:23:53.0294 0588	drmkaud         (b918e7c5f9bf77202f89e1a9539f2eb4) C:\windows\system32\drivers\drmkaud.sys
17:23:53.0341 0588	drmkaud - ok
17:23:53.0419 0588	DXGKrnl         (23f5d28378a160352ba8f817bd8c71cb) C:\windows\System32\drivers\dxgkrnl.sys
17:23:53.0466 0588	DXGKrnl - ok
17:23:53.0512 0588	EapHost         (8600142fa91c1b96367d3300ad0f3f3a) C:\windows\System32\eapsvc.dll
17:23:53.0575 0588	EapHost - ok
17:23:53.0778 0588	ebdrv           (024e1b5cac09731e4d868e64dbfb4ab0) C:\windows\system32\DRIVERS\evbdx.sys
17:23:53.0902 0588	ebdrv - ok
17:23:54.0012 0588	EFS             (81951f51e318aecc2d68559e47485cc4) C:\windows\System32\lsass.exe
17:23:54.0090 0588	EFS - ok
17:23:54.0168 0588	ehRecvr         (a8c362018efc87beb013ee28f29c0863) C:\windows\ehome\ehRecvr.exe
17:23:54.0261 0588	ehRecvr - ok
17:23:54.0277 0588	ehSched         (d389bff34f80caede417bf9d1507996a) C:\windows\ehome\ehsched.exe
17:23:54.0355 0588	ehSched - ok
17:23:54.0448 0588	elxstor         (0ed67910c8c326796faa00b2bf6d9d3c) C:\windows\system32\DRIVERS\elxstor.sys
17:23:54.0480 0588	elxstor - ok
17:23:54.0526 0588	ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\windows\system32\drivers\errdev.sys
17:23:54.0573 0588	ErrDev - ok
17:23:54.0636 0588	EventSystem     (f6916efc29d9953d5d0df06882ae8e16) C:\windows\system32\es.dll
17:23:54.0698 0588	EventSystem - ok
17:23:54.0745 0588	exfat           (2dc9108d74081149cc8b651d3a26207f) C:\windows\system32\drivers\exfat.sys
17:23:54.0807 0588	exfat - ok
17:23:54.0838 0588	fastfat         (7e0ab74553476622fb6ae36f73d97d35) C:\windows\system32\drivers\fastfat.sys
17:23:54.0916 0588	fastfat - ok
17:23:54.0994 0588	Fax             (967ea5b213e9984cbe270205df37755b) C:\windows\system32\fxssvc.exe
17:23:55.0057 0588	Fax - ok
17:23:55.0088 0588	fdc             (e817a017f82df2a1f8cfdbda29388b29) C:\windows\system32\DRIVERS\fdc.sys
17:23:55.0135 0588	fdc - ok
17:23:55.0182 0588	fdPHost         (f3222c893bd2f5821a0179e5c71e88fb) C:\windows\system32\fdPHost.dll
17:23:55.0244 0588	fdPHost - ok
17:23:55.0260 0588	FDResPub        (7dbe8cbfe79efbdeb98c9fb08d3a9a5b) C:\windows\system32\fdrespub.dll
17:23:55.0338 0588	FDResPub - ok
17:23:55.0369 0588	FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\windows\system32\drivers\fileinfo.sys
17:23:55.0384 0588	FileInfo - ok
17:23:55.0400 0588	Filetrace       (42c51dc94c91da21cb9196eb64c45db9) C:\windows\system32\drivers\filetrace.sys
17:23:55.0462 0588	Filetrace - ok
17:23:55.0556 0588	FLEXnet Licensing Service (227846995afeefa70d328bf5334a86a5) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
17:23:55.0603 0588	FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - warning
17:23:55.0603 0588	FLEXnet Licensing Service - detected UnsignedFile.Multi.Generic (1)
17:23:55.0634 0588	flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\windows\system32\DRIVERS\flpydisk.sys
17:23:55.0682 0588	flpydisk - ok
17:23:55.0729 0588	FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\windows\system32\drivers\fltmgr.sys
17:23:55.0760 0588	FltMgr - ok
17:23:55.0822 0588	FontCache       (b3a5ec6b6b6673db7e87c2bcdbddc074) C:\windows\system32\FntCache.dll
17:23:55.0900 0588	FontCache - ok
17:23:55.0978 0588	FontCache3.0.0.0 (e56f39f6b7fda0ac77a79b0fd3de1a2f) C:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
17:23:55.0994 0588	FontCache3.0.0.0 - ok
17:23:56.0025 0588	FsDepends       (1a16b57943853e598cff37fe2b8cbf1d) C:\windows\system32\drivers\FsDepends.sys
17:23:56.0056 0588	FsDepends - ok
17:23:56.0087 0588	Fs_Rec          (7dae5ebcc80e45d3253f4923dc424d05) C:\windows\system32\drivers\Fs_Rec.sys
17:23:56.0103 0588	Fs_Rec - ok
17:23:56.0181 0588	funfrm          (f626f291e3f56e8969e35945552feca3) C:\windows\system32\drivers\funfrm.sys
17:23:56.0197 0588	funfrm - ok
17:23:56.0259 0588	fvevol          (8a73e79089b282100b9393b644cb853b) C:\windows\system32\DRIVERS\fvevol.sys
17:23:56.0290 0588	fvevol - ok
17:23:56.0337 0588	gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\windows\system32\DRIVERS\gagp30kx.sys
17:23:56.0368 0588	gagp30kx - ok
17:23:56.0431 0588	GEARAspiWDM     (8182ff89c65e4d38b2de4bb0fb18564e) C:\windows\system32\DRIVERS\GEARAspiWDM.sys
17:23:56.0446 0588	GEARAspiWDM - ok
17:23:56.0493 0588	gpsvc           (e897eaf5ed6ba41e081060c9b447a673) C:\windows\System32\gpsvc.dll
17:23:56.0571 0588	gpsvc - ok
17:23:56.0665 0588	gusvc           (c1b577b2169900f4cf7190c39f085794) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
17:23:56.0680 0588	gusvc - ok
17:23:56.0711 0588	hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\windows\system32\drivers\hcw85cir.sys
17:23:56.0774 0588	hcw85cir - ok
17:23:56.0852 0588	HdAudAddService (a5ef29d5315111c80a5c1abad14c8972) C:\windows\system32\drivers\HdAudio.sys
17:23:56.0899 0588	HdAudAddService - ok
17:23:56.0930 0588	HDAudBus        (9036377b8a6c15dc2eec53e489d159b5) C:\windows\system32\drivers\HDAudBus.sys
17:23:56.0977 0588	HDAudBus - ok
17:23:57.0008 0588	HidBatt         (1d58a7f3e11a9731d0eaaaa8405acc36) C:\windows\system32\DRIVERS\HidBatt.sys
17:23:57.0055 0588	HidBatt - ok
17:23:57.0086 0588	HidBth          (89448f40e6df260c206a193a4683ba78) C:\windows\system32\DRIVERS\hidbth.sys
17:23:57.0133 0588	HidBth - ok
17:23:57.0164 0588	HidIr           (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\windows\system32\DRIVERS\hidir.sys
17:23:57.0226 0588	HidIr - ok
17:23:57.0273 0588	hidserv         (2bc6f6a1992b3a77f5f41432ca6b3b6b) C:\windows\system32\hidserv.dll
17:23:57.0351 0588	hidserv - ok
17:23:57.0429 0588	HidUsb          (10c19f8290891af023eaec0832e1eb4d) C:\windows\system32\DRIVERS\hidusb.sys
17:23:57.0460 0588	HidUsb - ok
17:23:57.0507 0588	hkmsvc          (196b4e3f4cccc24af836ce58facbb699) C:\windows\system32\kmsvc.dll
17:23:57.0585 0588	hkmsvc - ok
17:23:57.0632 0588	HomeGroupListener (6658f4404de03d75fe3ba09f7aba6a30) C:\windows\system32\ListSvc.dll
17:23:57.0710 0588	HomeGroupListener - ok
17:23:57.0741 0588	HomeGroupProvider (dbc02d918fff1cad628acbe0c0eaa8e8) C:\windows\system32\provsvc.dll
17:23:57.0803 0588	HomeGroupProvider - ok
17:23:57.0944 0588	hpqcxs08        (5da42d24712e00728cea2342a65009b2) C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
17:23:57.0959 0588	hpqcxs08 - ok
17:23:57.0991 0588	hpqddsvc        (d86a39bf100069444d026d22d9a6e555) C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
17:23:58.0006 0588	hpqddsvc - ok
17:23:58.0053 0588	HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\windows\system32\drivers\HpSAMD.sys
17:23:58.0084 0588	HpSAMD - ok
17:23:58.0147 0588	HPSLPSVC        (9d23402d305869844bc6004a05cc74ba) C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL
17:23:58.0178 0588	HPSLPSVC - ok
17:23:58.0256 0588	HTTP            (871917b07a141bff43d76d8844d48106) C:\windows\system32\drivers\HTTP.sys
17:23:58.0318 0588	HTTP - ok
17:23:58.0349 0588	hwpolicy        (0c4e035c7f105f1299258c90886c64c5) C:\windows\system32\drivers\hwpolicy.sys
17:23:58.0365 0588	hwpolicy - ok
17:23:58.0427 0588	i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\windows\system32\drivers\i8042prt.sys
17:23:58.0474 0588	i8042prt - ok
17:23:58.0568 0588	IAANTMON        (7548066df68a8a1a56b043359f915f37) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
17:23:58.0599 0588	IAANTMON - ok
17:23:58.0630 0588	iaStor          (d483687eace0c065ee772481a96e05f5) C:\windows\system32\DRIVERS\iaStor.sys
17:23:58.0661 0588	iaStor - ok
17:23:58.0724 0588	iaStorV         (5cd5f9a5444e6cdcb0ac89bd62d8b76e) C:\windows\system32\drivers\iaStorV.sys
17:23:58.0755 0588	iaStorV - ok
17:23:58.0864 0588	idsvc           (c521d7eb6497bb1af6afa89e322fb43c) C:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
17:23:58.0911 0588	idsvc - ok
17:23:59.0223 0588	igfx            (45d1a22c0e932768729dd422e175a448) C:\windows\system32\DRIVERS\igdkmd32.sys
17:23:59.0504 0588	igfx - ok
17:23:59.0613 0588	IGRS            (d951d20153e51928f9db2227d6ff5c7a) C:\Program Files\Lenovo\ReadyComm\common\IGRS.exe
17:23:59.0629 0588	IGRS - ok
17:23:59.0769 0588	iirsp           (4173ff5708f3236cf25195fecd742915) C:\windows\system32\DRIVERS\iirsp.sys
17:23:59.0785 0588	iirsp - ok
17:23:59.0878 0588	IKEEXT          (f95622f161474511b8d80d6b093aa610) C:\windows\System32\ikeext.dll
17:23:59.0956 0588	IKEEXT - ok
17:24:00.0003 0588	intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\windows\system32\drivers\intelide.sys
17:24:00.0034 0588	intelide - ok
17:24:00.0081 0588	intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\windows\system32\DRIVERS\intelppm.sys
17:24:00.0128 0588	intelppm - ok
17:24:00.0175 0588	IPBusEnum       (acb364b9075a45c0736e5c47be5cae19) C:\windows\system32\ipbusenum.dll
17:24:00.0237 0588	IPBusEnum - ok
17:24:00.0284 0588	IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\windows\system32\DRIVERS\ipfltdrv.sys
17:24:00.0362 0588	IpFilterDriver - ok
17:24:00.0424 0588	iphlpsvc        (4d65a07b795d6674312f879d09aa7663) C:\windows\System32\iphlpsvc.dll
17:24:00.0502 0588	iphlpsvc - ok
17:24:00.0549 0588	IPMIDRV         (4bd7134618c1d2a27466a099062547bf) C:\windows\system32\drivers\IPMIDrv.sys
17:24:00.0596 0588	IPMIDRV - ok
17:24:00.0627 0588	IPNAT           (a5fa468d67abcdaa36264e463a7bb0cd) C:\windows\system32\drivers\ipnat.sys
17:24:00.0705 0588	IPNAT - ok
17:24:00.0830 0588	iPod Service    (57edb35ea2feca88f8b17c0c095c9a56) C:\Program Files\iPod\bin\iPodService.exe
17:24:00.0861 0588	iPod Service - ok
17:24:00.0923 0588	IRENUM          (42996cff20a3084a56017b7902307e9f) C:\windows\system32\drivers\irenum.sys
17:24:00.0955 0588	IRENUM - ok
17:24:00.0986 0588	isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\windows\system32\drivers\isapnp.sys
17:24:01.0001 0588	isapnp - ok
17:24:01.0048 0588	iScsiPrt        (cb7a9abb12b8415bce5d74994c7ba3ae) C:\windows\system32\drivers\msiscsi.sys
17:24:01.0064 0588	iScsiPrt - ok
17:24:01.0126 0588	k57nd60x        (c4c95805b85bce1eb9d20f4a02fc5f9b) C:\windows\system32\DRIVERS\k57nd60x.sys
17:24:01.0173 0588	k57nd60x - ok
17:24:01.0220 0588	kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\windows\system32\DRIVERS\kbdclass.sys
17:24:01.0235 0588	kbdclass - ok
17:24:01.0282 0588	kbdhid          (9e3ced91863e6ee98c24794d05e27a71) C:\windows\system32\DRIVERS\kbdhid.sys
17:24:01.0313 0588	kbdhid - ok
17:24:01.0345 0588	KeyIso          (81951f51e318aecc2d68559e47485cc4) C:\windows\system32\lsass.exe
17:24:01.0360 0588	KeyIso - ok
17:24:01.0376 0588	KSecDD          (f4647bb23db9038a7536cf6b68f4207f) C:\windows\system32\Drivers\ksecdd.sys
17:24:01.0407 0588	KSecDD - ok
17:24:01.0423 0588	KSecPkg         (e73cae53bbb72ba26918492c6b4c229d) C:\windows\system32\Drivers\ksecpkg.sys
17:24:01.0454 0588	KSecPkg - ok
17:24:01.0501 0588	KtmRm           (89a7b9cc98d0d80c6f31b91c0a310fcd) C:\windows\system32\msdtckrm.dll
17:24:01.0579 0588	KtmRm - ok
17:24:01.0625 0588	LanmanServer    (d64af876d53eca3668bb97b51b4e70ab) C:\windows\system32\srvsvc.dll
17:24:01.0703 0588	LanmanServer - ok
17:24:01.0750 0588	LanmanWorkstation (58405e4f68ba8e4057c6e914f326aba2) C:\windows\System32\wkssvc.dll
17:24:01.0828 0588	LanmanWorkstation - ok
17:24:01.0969 0588	Lenovo ReadyComm AppSvc (7fcb3ec66361f157bcd5b5c33ce2ac16) C:\Program Files\Lenovo\ReadyComm\AppSvc.exe
17:24:02.0000 0588	Lenovo ReadyComm AppSvc - ok
17:24:02.0031 0588	Lenovo ReadyComm ConnSvc (5287074e79e4ba82510886f684dc5f72) C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe
17:24:02.0062 0588	Lenovo ReadyComm ConnSvc - ok
17:24:02.0140 0588	lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\windows\system32\DRIVERS\lltdio.sys
17:24:02.0218 0588	lltdio - ok
17:24:02.0265 0588	lltdsvc         (5700673e13a2117fa3b9020c852c01e2) C:\windows\System32\lltdsvc.dll
17:24:02.0327 0588	lltdsvc - ok
17:24:02.0343 0588	lmhosts         (55ca01ba19d0006c8f2639b6c045e08b) C:\windows\System32\lmhsvc.dll
17:24:02.0405 0588	lmhosts - ok
17:24:02.0483 0588	LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\windows\system32\DRIVERS\lsi_fc.sys
17:24:02.0499 0588	LSI_FC - ok
17:24:02.0546 0588	LSI_SAS         (8ade1c877256a22e49b75d1cc9161f9c) C:\windows\system32\DRIVERS\lsi_sas.sys
17:24:02.0577 0588	LSI_SAS - ok
17:24:02.0593 0588	LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\windows\system32\DRIVERS\lsi_sas2.sys
17:24:02.0608 0588	LSI_SAS2 - ok
17:24:02.0624 0588	LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\windows\system32\DRIVERS\lsi_scsi.sys
17:24:02.0655 0588	LSI_SCSI - ok
17:24:02.0702 0588	luafv           (6703e366cc18d3b6e534f5cf7df39cee) C:\windows\system32\drivers\luafv.sys
17:24:02.0749 0588	luafv - ok
17:24:02.0780 0588	Mcx2Svc         (bfb9ee8ee977efe85d1a3105abef6dd1) C:\windows\system32\Mcx2Svc.dll
17:24:02.0811 0588	Mcx2Svc - ok
17:24:02.0827 0588	megasas         (0fff5b045293002ab38eb1fd1fc2fb74) C:\windows\system32\DRIVERS\megasas.sys
17:24:02.0842 0588	megasas - ok
17:24:02.0905 0588	MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\windows\system32\DRIVERS\MegaSR.sys
17:24:02.0936 0588	MegaSR - ok
17:24:03.0061 0588	Microsoft Office Groove Audit Service (123271bd5237ab991dc5c21fdf8835eb) C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
17:24:03.0076 0588	Microsoft Office Groove Audit Service - ok
17:24:03.0107 0588	MMCSS           (146b6f43a673379a3c670e86d89be5ea) C:\windows\system32\mmcss.dll
17:24:03.0185 0588	MMCSS - ok
17:24:03.0217 0588	Modem           (f001861e5700ee84e2d4e52c712f4964) C:\windows\system32\drivers\modem.sys
17:24:03.0295 0588	Modem - ok
17:24:03.0341 0588	monitor         (79d10964de86b292320e9dfe02282a23) C:\windows\system32\DRIVERS\monitor.sys
17:24:03.0388 0588	monitor - ok
17:24:03.0435 0588	mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\windows\system32\DRIVERS\mouclass.sys
17:24:03.0466 0588	mouclass - ok
17:24:03.0497 0588	mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\windows\system32\DRIVERS\mouhid.sys
17:24:03.0544 0588	mouhid - ok
17:24:03.0591 0588	mountmgr        (fc8771f45ecccfd89684e38842539b9b) C:\windows\system32\drivers\mountmgr.sys
17:24:03.0622 0588	mountmgr - ok
17:24:03.0653 0588	mpio            (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\windows\system32\drivers\mpio.sys
17:24:03.0685 0588	mpio - ok
17:24:03.0700 0588	mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\windows\system32\drivers\mpsdrv.sys
17:24:03.0779 0588	mpsdrv - ok
17:24:03.0842 0588	MpsSvc          (9835584e999d25004e1ee8e5f3e3b881) C:\windows\system32\mpssvc.dll
17:24:03.0935 0588	MpsSvc - ok
17:24:03.0982 0588	MRxDAV          (ceb46ab7c01c9f825f8cc6babc18166a) C:\windows\system32\drivers\mrxdav.sys
17:24:04.0013 0588	MRxDAV - ok
17:24:04.0060 0588	mrxsmb          (5d16c921e3671636c0eba3bbaac5fd25) C:\windows\system32\DRIVERS\mrxsmb.sys
17:24:04.0138 0588	mrxsmb - ok
17:24:04.0185 0588	mrxsmb10        (6d17a4791aca19328c685d256349fefc) C:\windows\system32\DRIVERS\mrxsmb10.sys
17:24:04.0232 0588	mrxsmb10 - ok
17:24:04.0263 0588	mrxsmb20        (b81f204d146000be76651a50670a5e9e) C:\windows\system32\DRIVERS\mrxsmb20.sys
17:24:04.0310 0588	mrxsmb20 - ok
17:24:04.0341 0588	msahci          (012c5f4e9349e711e11e0f19a8589f0a) C:\windows\system32\drivers\msahci.sys
17:24:04.0372 0588	msahci - ok
17:24:04.0419 0588	msdsm           (55055f8ad8be27a64c831322a780a228) C:\windows\system32\drivers\msdsm.sys
17:24:04.0434 0588	msdsm - ok
17:24:04.0481 0588	MSDTC           (e1bce74a3bd9902b72599c0192a07e27) C:\windows\System32\msdtc.exe
17:24:04.0528 0588	MSDTC - ok
17:24:04.0575 0588	Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\windows\system32\drivers\Msfs.sys
17:24:04.0622 0588	Msfs - ok
17:24:04.0637 0588	mshidkmdf       (3e1e5767043c5af9367f0056295e9f84) C:\windows\System32\drivers\mshidkmdf.sys
17:24:04.0700 0588	mshidkmdf - ok
17:24:04.0731 0588	msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\windows\system32\drivers\msisadrv.sys
17:24:04.0762 0588	msisadrv - ok
17:24:04.0824 0588	MSiSCSI         (90f7d9e6b6f27e1a707d4a297f077828) C:\windows\system32\iscsiexe.dll
17:24:04.0887 0588	MSiSCSI - ok
17:24:04.0887 0588	msiserver - ok
17:24:04.0949 0588	MSKSSRV         (8c0860d6366aaffb6c5bb9df9448e631) C:\windows\system32\drivers\MSKSSRV.sys
17:24:05.0012 0588	MSKSSRV - ok
17:24:05.0043 0588	MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\windows\system32\drivers\MSPCLOCK.sys
17:24:05.0105 0588	MSPCLOCK - ok
17:24:05.0136 0588	MSPQM           (f456e973590d663b1073e9c463b40932) C:\windows\system32\drivers\MSPQM.sys
17:24:05.0199 0588	MSPQM - ok
17:24:05.0246 0588	MsRPC           (0e008fc4819d238c51d7c93e7b41e560) C:\windows\system32\drivers\MsRPC.sys
17:24:05.0261 0588	MsRPC - ok
17:24:05.0308 0588	mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\windows\system32\drivers\mssmbios.sys
17:24:05.0324 0588	mssmbios - ok
17:24:05.0417 0588	MSSQL$MSSMLBIZ - ok
17:24:05.0480 0588	MSSQLServerADHelper (1d89eb4e2a99cabd4e81225f4f4c4b25) c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe
17:24:05.0495 0588	MSSQLServerADHelper - ok
17:24:05.0542 0588	MSTEE           (b42c6b921f61a6e55159b8be6cd54a36) C:\windows\system32\drivers\MSTEE.sys
17:24:05.0589 0588	MSTEE - ok
17:24:05.0620 0588	MTConfig        (33599130f44e1f34631cea241de8ac84) C:\windows\system32\DRIVERS\MTConfig.sys
17:24:05.0667 0588	MTConfig - ok
17:24:05.0682 0588	Mup             (159fad02f64e6381758c990f753bcc80) C:\windows\system32\Drivers\mup.sys
17:24:05.0714 0588	Mup - ok
17:24:05.0760 0588	napagent        (61d57a5d7c6d9afe10e77dae6e1b445e) C:\windows\system32\qagentRT.dll
17:24:05.0838 0588	napagent - ok
17:24:05.0901 0588	NativeWifiP     (26384429fcd85d83746f63e798ab1480) C:\windows\system32\DRIVERS\nwifi.sys
17:24:05.0932 0588	NativeWifiP - ok
17:24:05.0979 0588	NDIS            (e7c54812a2aaf43316eb6930c1ffa108) C:\windows\system32\drivers\ndis.sys
17:24:06.0026 0588	NDIS - ok
17:24:06.0057 0588	NdisCap         (0e1787aa6c9191d3d319e8bafe86f80c) C:\windows\system32\DRIVERS\ndiscap.sys
17:24:06.0104 0588	NdisCap - ok
17:24:06.0135 0588	NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\windows\system32\DRIVERS\ndistapi.sys
17:24:06.0197 0588	NdisTapi - ok
17:24:06.0260 0588	Ndisuio         (d8a65dafb3eb41cbb622745676fcd072) C:\windows\system32\DRIVERS\ndisuio.sys
17:24:06.0322 0588	Ndisuio - ok
17:24:06.0369 0588	NdisWan         (38fbe267e7e6983311179230facb1017) C:\windows\system32\DRIVERS\ndiswan.sys
17:24:06.0431 0588	NdisWan - ok
17:24:06.0462 0588	NDProxy         (a4bdc541e69674fbff1a8ff00be913f2) C:\windows\system32\drivers\NDProxy.sys
17:24:06.0509 0588	NDProxy - ok
17:24:06.0712 0588	Nero BackItUp Scheduler 3 (6d4028d458eaaa1782099750790dc8c9) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
17:24:06.0743 0588	Nero BackItUp Scheduler 3 - ok
17:24:06.0806 0588	Net Driver HPZ12 (a081cb6fb9a12668f233eb5414be3a0e) C:\windows\system32\HPZinw12.dll
17:24:06.0837 0588	Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
17:24:06.0837 0588	Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
17:24:06.0884 0588	NetBIOS         (80b275b1ce3b0e79909db7b39af74d51) C:\windows\system32\DRIVERS\netbios.sys
17:24:06.0946 0588	NetBIOS - ok
17:24:07.0008 0588	NetBT           (280122ddcf04b378edd1ad54d71c1e54) C:\windows\system32\DRIVERS\netbt.sys
17:24:07.0071 0588	NetBT - ok
17:24:07.0118 0588	Netlogon        (81951f51e318aecc2d68559e47485cc4) C:\windows\system32\lsass.exe
17:24:07.0149 0588	Netlogon - ok
17:24:07.0211 0588	Netman          (7cccfca7510684768da22092d1fa4db2) C:\windows\System32\netman.dll
17:24:07.0289 0588	Netman - ok
17:24:07.0336 0588	netprofm        (8c338238c16777a802d6a9211eb2ba50) C:\windows\System32\netprofm.dll
17:24:07.0414 0588	netprofm - ok
17:24:07.0476 0588	NetTcpPortSharing (f476ec40033cdb91efbe73eb99b8362d) C:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
17:24:07.0508 0588	NetTcpPortSharing - ok
17:24:07.0757 0588	netw5v32        (58218ec6b61b1169cf54aab0d00f5fe2) C:\windows\system32\DRIVERS\netw5v32.sys
17:24:07.0913 0588	netw5v32 - ok
17:24:08.0054 0588	NetworkX        (5ef7dd401771693245d46f4b0b69fe2b) C:\windows\system32\ckldrv.sys
17:24:08.0054 0588	NetworkX ( UnsignedFile.Multi.Generic ) - warning
17:24:08.0054 0588	NetworkX - detected UnsignedFile.Multi.Generic (1)
17:24:08.0132 0588	nfrd960         (1d85c4b390b0ee09c7a46b91efb2c097) C:\windows\system32\DRIVERS\nfrd960.sys
17:24:08.0147 0588	nfrd960 - ok
17:24:08.0194 0588	NlaSvc          (912084381d30d8b89ec4e293053f4710) C:\windows\System32\nlasvc.dll
17:24:08.0256 0588	NlaSvc - ok
17:24:08.0381 0588	NMIndexingService (ff4d73b16ea3a32d34ceb3a7bc3c3773) C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
17:24:08.0412 0588	NMIndexingService - ok
17:24:08.0428 0588	Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\windows\system32\drivers\Npfs.sys
17:24:08.0506 0588	Npfs - ok
17:24:08.0537 0588	nsi             (ba387e955e890c8a88306d9b8d06bf17) C:\windows\system32\nsisvc.dll
17:24:08.0600 0588	nsi - ok
17:24:08.0600 0588	nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\windows\system32\drivers\nsiproxy.sys
17:24:08.0678 0588	nsiproxy - ok
17:24:08.0771 0588	Ntfs            (81189c3d7763838e55c397759d49007a) C:\windows\system32\drivers\Ntfs.sys
17:24:08.0834 0588	Ntfs - ok
17:24:08.0865 0588	Null            (f9756a98d69098dca8945d62858a812c) C:\windows\system32\drivers\Null.sys
17:24:08.0912 0588	Null - ok
17:24:08.0958 0588	nvraid          (b3e25ee28883877076e0e1ff877d02e0) C:\windows\system32\drivers\nvraid.sys
17:24:08.0990 0588	nvraid - ok
17:24:09.0005 0588	nvstor          (4380e59a170d88c4f1022eff6719a8a4) C:\windows\system32\drivers\nvstor.sys
17:24:09.0036 0588	nvstor - ok
17:24:09.0068 0588	nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\windows\system32\drivers\nv_agp.sys
17:24:09.0099 0588	nv_agp - ok
17:24:09.0224 0588	odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
17:24:09.0255 0588	odserv - ok
17:24:09.0302 0588	ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\windows\system32\drivers\ohci1394.sys
17:24:09.0348 0588	ohci1394 - ok
17:24:09.0395 0588	ose             (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
17:24:09.0426 0588	ose - ok
17:24:09.0489 0588	p2pimsvc        (82a8521ddc60710c3d3d3e7325209bec) C:\windows\system32\pnrpsvc.dll
17:24:09.0567 0588	p2pimsvc - ok
17:24:09.0629 0588	p2psvc          (59c3ddd501e39e006dac31bf55150d91) C:\windows\system32\p2psvc.dll
17:24:09.0660 0588	p2psvc - ok
17:24:09.0692 0588	Parport         (2ea877ed5dd9713c5ac74e8ea7348d14) C:\windows\system32\DRIVERS\parport.sys
17:24:09.0723 0588	Parport - ok
17:24:09.0754 0588	partmgr         (3f34a1b4c5f6475f320c275e63afce9b) C:\windows\system32\drivers\partmgr.sys
17:24:09.0785 0588	partmgr - ok
17:24:09.0816 0588	Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\windows\system32\DRIVERS\parvdm.sys
17:24:09.0863 0588	Parvdm - ok
17:24:09.0894 0588	PcaSvc          (358ab7956d3160000726574083dfc8a6) C:\windows\System32\pcasvc.dll
17:24:09.0926 0588	PcaSvc - ok
17:24:09.0972 0588	pci             (673e55c3498eb970088e812ea820aa8f) C:\windows\system32\drivers\pci.sys
17:24:10.0004 0588	pci - ok
17:24:10.0019 0588	pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\windows\system32\drivers\pciide.sys
17:24:10.0035 0588	pciide - ok
17:24:10.0066 0588	pcmcia          (f396431b31693e71e8a80687ef523506) C:\windows\system32\DRIVERS\pcmcia.sys
17:24:10.0097 0588	pcmcia - ok
17:24:10.0128 0588	pcw             (250f6b43d2b613172035c6747aeeb19f) C:\windows\system32\drivers\pcw.sys
17:24:10.0144 0588	pcw - ok
17:24:10.0222 0588	PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\windows\system32\drivers\peauth.sys
17:24:10.0300 0588	PEAUTH - ok
17:24:10.0425 0588	pla             (414bba67a3ded1d28437eb66aeb8a720) C:\windows\system32\pla.dll
17:24:10.0534 0588	pla - ok
17:24:10.0659 0588	PlugPlay        (ec7bc28d207da09e79b3e9faf8b232ca) C:\windows\system32\umpnpmgr.dll
17:24:10.0737 0588	PlugPlay - ok
17:24:10.0799 0588	Pml Driver HPZ12 (65bc271f337637731d3c71455ae1f476) C:\windows\system32\HPZipm12.dll
17:24:10.0815 0588	Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
17:24:10.0815 0588	Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
17:24:10.0830 0588	PNRPAutoReg     (63ff8572611249931eb16bb8eed6afc8) C:\windows\system32\pnrpauto.dll
17:24:10.0877 0588	PNRPAutoReg - ok
17:24:10.0908 0588	PNRPsvc         (82a8521ddc60710c3d3d3e7325209bec) C:\windows\system32\pnrpsvc.dll
17:24:10.0940 0588	PNRPsvc - ok
17:24:10.0986 0588	PolicyAgent     (53946b69ba0836bd95b03759530c81ec) C:\windows\System32\ipsecsvc.dll
17:24:11.0033 0588	PolicyAgent - ok
17:24:11.0064 0588	Power           (f87d30e72e03d579a5199ccb3831d6ea) C:\windows\system32\umpo.dll
17:24:11.0127 0588	Power - ok
17:24:11.0189 0588	PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\windows\system32\DRIVERS\raspptp.sys
17:24:11.0267 0588	PptpMiniport - ok
17:24:11.0298 0588	Processor       (85b1e3a0c7585bc4aae6899ec6fcf011) C:\windows\system32\DRIVERS\processr.sys
17:24:11.0345 0588	Processor - ok
17:24:11.0392 0588	ProfSvc         (43ca4ccc22d52fb58e8988f0198851d0) C:\windows\system32\profsvc.dll
17:24:11.0439 0588	ProfSvc - ok
17:24:11.0470 0588	ProtectedStorage (81951f51e318aecc2d68559e47485cc4) C:\windows\system32\lsass.exe
17:24:11.0501 0588	ProtectedStorage - ok
17:24:11.0548 0588	Psched          (6270ccae2a86de6d146529fe55b3246a) C:\windows\system32\DRIVERS\pacer.sys
17:24:11.0626 0588	Psched - ok
17:24:11.0657 0588	PS_MDP - ok
17:24:11.0766 0588	ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\windows\system32\DRIVERS\ql2300.sys
17:24:11.0829 0588	ql2300 - ok
17:24:11.0938 0588	ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\windows\system32\DRIVERS\ql40xx.sys
17:24:11.0954 0588	ql40xx - ok
17:24:12.0000 0588	QWAVE           (31ac809e7707eb580b2bdb760390765a) C:\windows\system32\qwave.dll
17:24:12.0032 0588	QWAVE - ok
17:24:12.0047 0588	QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\windows\system32\drivers\qwavedrv.sys
17:24:12.0078 0588	QWAVEdrv - ok
17:24:12.0094 0588	RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\windows\system32\DRIVERS\rasacd.sys
17:24:12.0141 0588	RasAcd - ok
17:24:12.0203 0588	RasAgileVpn     (57ec4aef73660166074d8f7f31c0d4fd) C:\windows\system32\DRIVERS\AgileVpn.sys
17:24:12.0250 0588	RasAgileVpn - ok
17:24:12.0266 0588	RasAuto         (a60f1839849c0c00739787fd5ec03f13) C:\windows\System32\rasauto.dll
17:24:12.0328 0588	RasAuto - ok
17:24:12.0344 0588	Rasl2tp         (d9f91eafec2815365cbe6d167e4e332a) C:\windows\system32\DRIVERS\rasl2tp.sys
17:24:12.0406 0588	Rasl2tp - ok
17:24:12.0453 0588	RasMan          (cb9e04dc05eacf5b9a36ca276d475006) C:\windows\System32\rasmans.dll
17:24:12.0531 0588	RasMan - ok
17:24:12.0578 0588	RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\windows\system32\DRIVERS\raspppoe.sys
17:24:12.0624 0588	RasPppoe - ok
17:24:12.0656 0588	RasSstp         (44101f495a83ea6401d886e7fd70096b) C:\windows\system32\DRIVERS\rassstp.sys
17:24:12.0718 0588	RasSstp - ok
17:24:12.0749 0588	rdbss           (d528bc58a489409ba40334ebf96a311b) C:\windows\system32\DRIVERS\rdbss.sys
17:24:12.0812 0588	rdbss - ok
17:24:12.0858 0588	rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\windows\system32\DRIVERS\rdpbus.sys
17:24:12.0905 0588	rdpbus - ok
17:24:12.0952 0588	RDPCDD          (23dae03f29d253ae74c44f99e515f9a1) C:\windows\system32\DRIVERS\RDPCDD.sys
17:24:12.0999 0588	RDPCDD - ok
17:24:13.0061 0588	RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\windows\system32\drivers\rdpencdd.sys
17:24:13.0108 0588	RDPENCDD - ok
17:24:13.0124 0588	RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\windows\system32\drivers\rdprefmp.sys
17:24:13.0186 0588	RDPREFMP - ok
17:24:13.0248 0588	RDPWD           (f031683e6d1fea157abb2ff260b51e61) C:\windows\system32\drivers\RDPWD.sys
17:24:13.0326 0588	RDPWD - ok
17:24:13.0373 0588	rdyboost        (518395321dc96fe2c9f0e96ac743b656) C:\windows\system32\drivers\rdyboost.sys
17:24:13.0404 0588	rdyboost - ok
17:24:13.0420 0588	ReadyComm.DirectRouter - ok
17:24:13.0467 0588	RemoteAccess    (7b5e1419717fac363a31cc302895217a) C:\windows\System32\mprdim.dll
17:24:13.0529 0588	RemoteAccess - ok
17:24:13.0576 0588	RemoteRegistry  (cb9a8683f4ef2bf99e123d79950d7935) C:\windows\system32\regsvc.dll
17:24:13.0623 0588	RemoteRegistry - ok
17:24:13.0685 0588	RFCOMM          (cb928d9e6daf51879dd6ba8d02f01321) C:\windows\system32\DRIVERS\rfcomm.sys
17:24:13.0716 0588	RFCOMM - ok
17:24:13.0763 0588	RpcEptMapper    (78d072f35bc45d9e4e1b61895c152234) C:\windows\System32\RpcEpMap.dll
17:24:13.0810 0588	RpcEptMapper - ok
17:24:13.0841 0588	RpcLocator      (94d36c0e44677dd26981d2bfeef2a29d) C:\windows\system32\locator.exe
17:24:13.0888 0588	RpcLocator - ok
17:24:13.0935 0588	RpcSs           (7660f01d3b38aca1747e397d21d790af) C:\windows\system32\rpcss.dll
17:24:13.0997 0588	RpcSs - ok
17:24:14.0060 0588	rspndr          (032b0d36ad92b582d869879f5af5b928) C:\windows\system32\DRIVERS\rspndr.sys
17:24:14.0122 0588	rspndr - ok
17:24:14.0153 0588	RSUSBSTOR - ok
17:24:14.0153 0588	RtsUIR - ok
17:24:14.0200 0588	SamSs           (81951f51e318aecc2d68559e47485cc4) C:\windows\system32\lsass.exe
17:24:14.0216 0588	SamSs - ok
17:24:14.0278 0588	sbp2port        (05d860da1040f111503ac416ccef2bca) C:\windows\system32\drivers\sbp2port.sys
17:24:14.0309 0588	sbp2port - ok
17:24:14.0340 0588	SCardSvr        (8fc518ffe9519c2631d37515a68009c4) C:\windows\System32\SCardSvr.dll
17:24:14.0418 0588	SCardSvr - ok
17:24:14.0465 0588	scfilter        (0693b5ec673e34dc147e195779a4dcf6) C:\windows\system32\DRIVERS\scfilter.sys
17:24:14.0528 0588	scfilter - ok
17:24:14.0590 0588	Schedule        (a04bb13f8a72f8b6e8b4071723e4e336) C:\windows\system32\schedsvc.dll
17:24:14.0668 0588	Schedule - ok
17:24:14.0715 0588	SCPolicySvc     (319c6b309773d063541d01df8ac6f55f) C:\windows\System32\certprop.dll
17:24:14.0762 0588	SCPolicySvc - ok
17:24:14.0777 0588	SDRSVC          (08236c4bce5edd0a0318a438af28e0f7) C:\windows\System32\SDRSVC.dll
17:24:14.0840 0588	SDRSVC - ok
17:24:14.0949 0588	SeaPort         (4a5809a1d796e2675ac0332bf7b0cb11) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
17:24:14.0980 0588	SeaPort - ok
17:24:15.0011 0588	secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\windows\system32\drivers\secdrv.sys
17:24:15.0089 0588	secdrv - ok
17:24:15.0120 0588	seclogon        (a59b3a4442c52060cc7a85293aa3546f) C:\windows\system32\seclogon.dll
17:24:15.0198 0588	seclogon - ok
17:24:15.0230 0588	SENS            (dcb7fcdcc97f87360f75d77425b81737) C:\windows\System32\sens.dll
17:24:15.0292 0588	SENS - ok
17:24:15.0323 0588	SensrSvc        (50087fe1ee447009c9cc2997b90de53f) C:\windows\system32\sensrsvc.dll
17:24:15.0370 0588	SensrSvc - ok
17:24:15.0386 0588	Serenum         (9ad8b8b515e3df6acd4212ef465de2d1) C:\windows\system32\DRIVERS\serenum.sys
17:24:15.0432 0588	Serenum - ok
17:24:15.0464 0588	Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\windows\system32\DRIVERS\serial.sys
17:24:15.0495 0588	Serial - ok
17:24:15.0510 0588	sermouse        (79bffb520327ff916a582dfea17aa813) C:\windows\system32\DRIVERS\sermouse.sys
17:24:15.0557 0588	sermouse - ok
17:24:15.0604 0588	SessionEnv      (4ae380f39a0032eab7dd953030b26d28) C:\windows\system32\sessenv.dll
17:24:15.0666 0588	SessionEnv - ok
17:24:15.0822 0588	sesvc           (4c99e251d89c95dcaaa26f9243747c99) C:\Users\Balle\Desktop\ShadowExplorer\sesvc.exe
17:24:15.0838 0588	sesvc ( UnsignedFile.Multi.Generic ) - warning
17:24:15.0838 0588	sesvc - detected UnsignedFile.Multi.Generic (1)
17:24:15.0885 0588	sffdisk         (9f976e1eb233df46fce808d9dea3eb9c) C:\windows\system32\drivers\sffdisk.sys
17:24:15.0932 0588	sffdisk - ok
17:24:15.0947 0588	sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\windows\system32\drivers\sffp_mmc.sys
17:24:15.0978 0588	sffp_mmc - ok
17:24:15.0994 0588	sffp_sd         (6d4ccaedc018f1cf52866bbbaa235982) C:\windows\system32\drivers\sffp_sd.sys
17:24:16.0025 0588	sffp_sd - ok
17:24:16.0056 0588	sfloppy         (db96666cc8312ebc45032f30b007a547) C:\windows\system32\DRIVERS\sfloppy.sys
17:24:16.0088 0588	sfloppy - ok
17:24:16.0134 0588	SharedAccess    (d1a079a0de2ea524513b6930c24527a2) C:\windows\System32\ipnathlp.dll
17:24:16.0212 0588	SharedAccess - ok
17:24:16.0259 0588	ShellHWDetection (414da952a35bf5d50192e28263b40577) C:\windows\System32\shsvcs.dll
17:24:16.0337 0588	ShellHWDetection - ok
17:24:16.0368 0588	sisagp          (2565cac0dc9fe0371bdce60832582b2e) C:\windows\system32\drivers\sisagp.sys
17:24:16.0400 0588	sisagp - ok
17:24:16.0446 0588	SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\windows\system32\DRIVERS\SiSRaid2.sys
17:24:16.0462 0588	SiSRaid2 - ok
17:24:16.0509 0588	SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\windows\system32\DRIVERS\sisraid4.sys
17:24:16.0524 0588	SiSRaid4 - ok
17:24:16.0649 0588	SkypeUpdate     (6128e98eaaed364ed1a32708d2fd22cb) C:\Program Files\Skype\Updater\Updater.exe
17:24:16.0665 0588	SkypeUpdate - ok
17:24:16.0758 0588	Smb             (3e21c083b8a01cb70ba1f09303010fce) C:\windows\system32\DRIVERS\smb.sys
17:24:16.0805 0588	Smb - ok
17:24:16.0852 0588	SNMPTRAP        (6a984831644eca1a33ffeae4126f4f37) C:\windows\System32\snmptrap.exe
17:24:16.0868 0588	SNMPTRAP - ok
17:24:16.0883 0588	spldr           (95cf1ae7527fb70f7816563cbc09d942) C:\windows\system32\drivers\spldr.sys
17:24:16.0914 0588	spldr - ok
17:24:16.0992 0588	Spooler         (866a43013535dc8587c258e43579c764) C:\windows\System32\spoolsv.exe
17:24:17.0055 0588	Spooler - ok
17:24:17.0242 0588	sppsvc          (cf87a1de791347e75b98885214ced2b8) C:\windows\system32\sppsvc.exe
17:24:17.0382 0588	sppsvc - ok
17:24:17.0492 0588	sppuinotify     (b0180b20b065d89232a78a40fe56eaa6) C:\windows\system32\sppuinotify.dll
17:24:17.0554 0588	sppuinotify - ok
17:24:17.0679 0588	sptd            (cdddec541bc3c96f91ecb48759673505) C:\windows\System32\Drivers\sptd.sys
17:24:17.0710 0588	sptd - ok
17:24:17.0835 0588	SQLBrowser      (86ebd8b1f23e743aad21f4d5b4d40985) c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
17:24:17.0850 0588	SQLBrowser - ok
17:24:17.0882 0588	SQLWriter       (d89083c4eb02daca8f944b0e05e57f9d) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
17:24:17.0897 0588	SQLWriter - ok
17:24:17.0944 0588	srv             (e4c2764065d66ea1d2d3ebc28fe99c46) C:\windows\system32\DRIVERS\srv.sys
17:24:18.0022 0588	srv - ok
17:24:18.0053 0588	srv2            (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\windows\system32\DRIVERS\srv2.sys
17:24:18.0100 0588	srv2 - ok
17:24:18.0131 0588	srvnet          (be6bd660caa6f291ae06a718a4fa8abc) C:\windows\system32\DRIVERS\srvnet.sys
17:24:18.0178 0588	srvnet - ok
17:24:18.0225 0588	SSDPSRV         (d887c9fd02ac9fa880f6e5027a43e118) C:\windows\System32\ssdpsrv.dll
17:24:18.0287 0588	SSDPSRV - ok
17:24:18.0350 0588	ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\windows\system32\DRIVERS\ssmdrv.sys
17:24:18.0365 0588	ssmdrv - ok
17:24:18.0396 0588	SstpSvc         (d318f23be45d5e3a107469eb64815b50) C:\windows\system32\sstpsvc.dll
17:24:18.0443 0588	SstpSvc - ok
17:24:18.0490 0588	stexstor        (db32d325c192b801df274bfd12a7e72b) C:\windows\system32\DRIVERS\stexstor.sys
17:24:18.0506 0588	stexstor - ok
17:24:18.0537 0588	StillCam        (edb05bd63148796f23ea78506404a538) C:\windows\system32\DRIVERS\serscan.sys
17:24:18.0584 0588	StillCam - ok
17:24:18.0646 0588	StiSvc          (e1fb3706030fb4578a0d72c2fc3689e4) C:\windows\System32\wiaservc.dll
17:24:18.0708 0588	StiSvc - ok
17:24:18.0755 0588	swenum          (e58c78a848add9610a4db6d214af5224) C:\windows\system32\drivers\swenum.sys
17:24:18.0771 0588	swenum - ok
17:24:18.0818 0588	swprv           (a28bd92df340e57b024ba433165d34d7) C:\windows\System32\swprv.dll
17:24:18.0880 0588	swprv - ok
17:24:18.0974 0588	SysMain         (36650d618ca34c9d357dfd3d89b2c56f) C:\windows\system32\sysmain.dll
17:24:19.0036 0588	SysMain - ok
17:24:19.0083 0588	TabletInputService (763fecdc3d30c815fe72dd57936c6cd1) C:\windows\System32\TabSvc.dll
17:24:19.0130 0588	TabletInputService - ok
17:24:19.0176 0588	TapiSrv         (613bf4820361543956909043a265c6ac) C:\windows\System32\tapisrv.dll
17:24:19.0254 0588	TapiSrv - ok
17:24:19.0317 0588	TBS             (b799d9fdb26111737f58288d8dc172d9) C:\windows\System32\tbssvc.dll
17:24:19.0395 0588	TBS - ok
17:24:19.0551 0588	Tcpip           (7fa2e0f8b072bd04b77b421480b6cc22) C:\windows\system32\drivers\tcpip.sys
17:24:19.0613 0588	Tcpip - ok
17:24:19.0644 0588	TCPIP6          (7fa2e0f8b072bd04b77b421480b6cc22) C:\windows\system32\DRIVERS\tcpip.sys
17:24:19.0691 0588	TCPIP6 - ok
17:24:19.0754 0588	tcpipreg        (cca24162e055c3714ce5a88b100c64ed) C:\windows\system32\drivers\tcpipreg.sys
17:24:19.0816 0588	tcpipreg - ok
17:24:19.0863 0588	TDPIPE          (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\windows\system32\drivers\tdpipe.sys
17:24:19.0925 0588	TDPIPE - ok
17:24:19.0956 0588	TDTCP           (2c2c5afe7ee4f620d69c23c0617651a8) C:\windows\system32\drivers\tdtcp.sys
17:24:20.0003 0588	TDTCP - ok
17:24:20.0050 0588	tdx             (b459575348c20e8121d6039da063c704) C:\windows\system32\DRIVERS\tdx.sys
17:24:20.0112 0588	tdx - ok
17:24:20.0159 0588	TermDD          (04dbf4b01ea4bf25a9a3e84affac9b20) C:\windows\system32\drivers\termdd.sys
17:24:20.0175 0588	TermDD - ok
17:24:20.0237 0588	TermService     (382c804c92811be57829d8e550a900e2) C:\windows\System32\termsrv.dll
17:24:20.0300 0588	TermService - ok
17:24:20.0331 0588	Themes          (42fb6afd6b79d9fe07381609172e7ca4) C:\windows\system32\themeservice.dll
17:24:20.0362 0588	Themes - ok
17:24:20.0393 0588	THREADORDER     (146b6f43a673379a3c670e86d89be5ea) C:\windows\system32\mmcss.dll
17:24:20.0440 0588	THREADORDER - ok
17:24:20.0456 0588	TrkWks          (4792c0378db99a9bc2ae2de6cfff0c3a) C:\windows\System32\trkwks.dll
17:24:20.0518 0588	TrkWks - ok
17:24:20.0596 0588	TrustedInstaller (2c49b175aee1d4364b91b531417fe583) C:\windows\servicing\TrustedInstaller.exe
17:24:20.0674 0588	TrustedInstaller - ok
17:24:20.0690 0588	tssecsrv        (254bb140eee3c59d6114c1a86b636877) C:\windows\system32\DRIVERS\tssecsrv.sys
17:24:20.0752 0588	tssecsrv - ok
17:24:20.0814 0588	TsUsbFlt        (fd1d6c73e6333be727cbcc6054247654) C:\windows\system32\drivers\tsusbflt.sys
17:24:20.0877 0588	TsUsbFlt - ok
17:24:20.0924 0588	tunnel          (b2fa25d9b17a68bb93d58b0556e8c90d) C:\windows\system32\DRIVERS\tunnel.sys
17:24:20.0986 0588	tunnel - ok
17:24:21.0033 0588	uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\windows\system32\DRIVERS\uagp35.sys
17:24:21.0064 0588	uagp35 - ok
17:24:21.0095 0588	udfs            (ee43346c7e4b5e63e54f927babbb32ff) C:\windows\system32\DRIVERS\udfs.sys
17:24:21.0158 0588	udfs - ok
17:24:21.0204 0588	UI0Detect       (8344fd4fce927880aa1aa7681d4927e5) C:\windows\system32\UI0Detect.exe
17:24:21.0236 0588	UI0Detect - ok
17:24:21.0298 0588	uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\windows\system32\drivers\uliagpkx.sys
17:24:21.0314 0588	uliagpkx - ok
17:24:21.0360 0588	umbus           (d295bed4b898f0fd999fcfa9b32b071b) C:\windows\system32\DRIVERS\umbus.sys
17:24:21.0376 0588	umbus - ok
17:24:21.0423 0588	UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\windows\system32\DRIVERS\umpass.sys
17:24:21.0470 0588	UmPass - ok
17:24:21.0516 0588	upnphost        (833fbb672460efce8011d262175fad33) C:\windows\System32\upnphost.dll
17:24:21.0579 0588	upnphost - ok
17:24:21.0610 0588	USBAAPL         (eafe1e00739afe6c51487a050e772e17) C:\windows\system32\Drivers\usbaapl.sys
17:24:21.0657 0588	USBAAPL - ok
17:24:21.0704 0588	usbccgp         (bd9c55d7023c5de374507acc7a14e2ac) C:\windows\system32\DRIVERS\usbccgp.sys
17:24:21.0766 0588	usbccgp - ok
17:24:21.0766 0588	USBCCID - ok
17:24:21.0828 0588	usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\windows\system32\drivers\usbcir.sys
17:24:21.0860 0588	usbcir - ok
17:24:21.0875 0588	usbehci         (f92de757e4b7ce9c07c5e65423f3ae3b) C:\windows\system32\DRIVERS\usbehci.sys
17:24:21.0891 0588	usbehci - ok
17:24:21.0953 0588	usbhub          (8dc94aec6a7e644a06135ae7506dc2e9) C:\windows\system32\DRIVERS\usbhub.sys
17:24:22.0000 0588	usbhub - ok
17:24:22.0047 0588	usbohci         (e185d44fac515a18d9deddc23c2cdf44) C:\windows\system32\drivers\usbohci.sys
17:24:22.0094 0588	usbohci - ok
17:24:22.0140 0588	usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\windows\system32\DRIVERS\usbprint.sys
17:24:22.0172 0588	usbprint - ok
17:24:22.0218 0588	usbscan         (576096ccbc07e7c4ea4f5e6686d6888f) C:\windows\system32\DRIVERS\usbscan.sys
17:24:22.0250 0588	usbscan - ok
17:24:22.0312 0588	usbsmi          (6e90fc65f27ae98fffb0741cefe75679) C:\windows\system32\DRIVERS\SMIksdrv.sys
17:24:22.0343 0588	usbsmi - ok
17:24:22.0374 0588	USBSTOR         (f991ab9cc6b908db552166768176896a) C:\windows\system32\DRIVERS\USBSTOR.SYS
17:24:22.0437 0588	USBSTOR - ok
17:24:22.0452 0588	usbuhci         (68df884cf41cdada664beb01daf67e3d) C:\windows\system32\DRIVERS\usbuhci.sys
17:24:22.0484 0588	usbuhci - ok
17:24:22.0515 0588	usbvideo        (45f4e7bf43db40a6c6b4d92c76cbc3f2) C:\windows\System32\Drivers\usbvideo.sys
17:24:22.0546 0588	usbvideo - ok
17:24:22.0577 0588	UxSms           (081e6e1c91aec36758902a9f727cd23c) C:\windows\System32\uxsms.dll
17:24:22.0655 0588	UxSms - ok
17:24:22.0702 0588	VaultSvc        (81951f51e318aecc2d68559e47485cc4) C:\windows\system32\lsass.exe
17:24:22.0718 0588	VaultSvc - ok
17:24:22.0749 0588	vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\windows\system32\drivers\vdrvroot.sys
17:24:22.0780 0588	vdrvroot - ok
17:24:22.0842 0588	vds             (c3cd30495687c2a2f66a65ca6fd89be9) C:\windows\System32\vds.exe
17:24:22.0905 0588	vds - ok
17:24:22.0952 0588	vga             (17c408214ea61696cec9c66e388b14f3) C:\windows\system32\DRIVERS\vgapnp.sys
17:24:22.0998 0588	vga - ok
17:24:23.0014 0588	VgaSave         (8e38096ad5c8570a6f1570a61e251561) C:\windows\System32\drivers\vga.sys
17:24:23.0061 0588	VgaSave - ok
17:24:23.0092 0588	vhdmp           (5461686cca2fda57b024547733ab42e3) C:\windows\system32\drivers\vhdmp.sys
17:24:23.0123 0588	vhdmp - ok
17:24:23.0154 0588	viaagp          (c829317a37b4bea8f39735d4b076e923) C:\windows\system32\drivers\viaagp.sys
17:24:23.0186 0588	viaagp - ok
17:24:23.0217 0588	ViaC7           (e02f079a6aa107f06b16549c6e5c7b74) C:\windows\system32\DRIVERS\viac7.sys
17:24:23.0248 0588	ViaC7 - ok
17:24:23.0279 0588	viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\windows\system32\drivers\viaide.sys
17:24:23.0310 0588	viaide - ok
17:24:23.0326 0588	volmgr          (4c63e00f2f4b5f86ab48a58cd990f212) C:\windows\system32\drivers\volmgr.sys
17:24:23.0342 0588	volmgr - ok
17:24:23.0388 0588	volmgrx         (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\windows\system32\drivers\volmgrx.sys
17:24:23.0420 0588	volmgrx - ok
17:24:23.0466 0588	volsnap         (f497f67932c6fa693d7de2780631cfe7) C:\windows\system32\drivers\volsnap.sys
17:24:23.0498 0588	volsnap - ok
17:24:23.0560 0588	vsmraid         (9dfa0cc2f8855a04816729651175b631) C:\windows\system32\DRIVERS\vsmraid.sys
17:24:23.0576 0588	vsmraid - ok
17:24:23.0669 0588	VSS             (209a3b1901b83aeb8527ed211cce9e4c) C:\windows\system32\vssvc.exe
17:24:23.0763 0588	VSS - ok
17:24:23.0794 0588	vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\windows\system32\DRIVERS\vwifibus.sys
17:24:23.0856 0588	vwifibus - ok
17:24:23.0888 0588	vwififlt        (7090d3436eeb4e7da3373090a23448f7) C:\windows\system32\DRIVERS\vwififlt.sys
17:24:23.0919 0588	vwififlt - ok
17:24:23.0966 0588	W32Time         (55187fd710e27d5095d10a472c8baf1c) C:\windows\system32\w32time.dll
17:24:24.0044 0588	W32Time - ok
17:24:24.0090 0588	WacomPen        (de3721e89c653aa281428c8a69745d90) C:\windows\system32\DRIVERS\wacompen.sys
17:24:24.0122 0588	WacomPen - ok
17:24:24.0184 0588	WANARP          (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\windows\system32\DRIVERS\wanarp.sys
17:24:24.0231 0588	WANARP - ok
17:24:24.0231 0588	Wanarpv6        (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\windows\system32\DRIVERS\wanarp.sys
17:24:24.0278 0588	Wanarpv6 - ok
17:24:24.0371 0588	wbengine        (691e3285e53dca558e1a84667f13e15a) C:\windows\system32\wbengine.exe
17:24:24.0465 0588	wbengine - ok
17:24:24.0512 0588	WbioSrvc        (9614b5d29dc76ac3c29f6d2d3aa70e67) C:\windows\System32\wbiosrvc.dll
17:24:24.0558 0588	WbioSrvc - ok
17:24:24.0605 0588	wcncsvc         (34eee0dfaadb4f691d6d5308a51315dc) C:\windows\System32\wcncsvc.dll
17:24:24.0668 0588	wcncsvc - ok
17:24:24.0683 0588	WcsPlugInService (5d930b6357a6d2af4d7653bdabbf352f) C:\windows\System32\WcsPlugInService.dll
17:24:24.0746 0588	WcsPlugInService - ok
17:24:24.0792 0588	Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\windows\system32\DRIVERS\wd.sys
17:24:24.0808 0588	Wd - ok
17:24:24.0855 0588	Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\windows\system32\drivers\Wdf01000.sys
17:24:24.0902 0588	Wdf01000 - ok
17:24:24.0917 0588	WdiServiceHost  (46ef9dc96265fd0b423db72e7c38c2a5) C:\windows\system32\wdi.dll
17:24:24.0995 0588	WdiServiceHost - ok
17:24:25.0011 0588	WdiSystemHost   (46ef9dc96265fd0b423db72e7c38c2a5) C:\windows\system32\wdi.dll
17:24:25.0042 0588	WdiSystemHost - ok
17:24:25.0073 0588	wdmirror        (ea4e9dd00e69b35f9bd3d39acb113e3f) C:\windows\system32\DRIVERS\WDMirror.sys
17:24:25.0089 0588	wdmirror - ok
17:24:25.0136 0588	WebClient       (a9d880f97530d5b8fee278923349929d) C:\windows\System32\webclnt.dll
17:24:25.0198 0588	WebClient - ok
17:24:25.0245 0588	Wecsvc          (760f0afe937a77cff27153206534f275) C:\windows\system32\wecsvc.dll
17:24:25.0292 0588	Wecsvc - ok
17:24:25.0307 0588	wercplsupport   (ac804569bb2364fb6017370258a4091b) C:\windows\System32\wercplsupport.dll
17:24:25.0385 0588	wercplsupport - ok
17:24:25.0416 0588	WerSvc          (08e420d873e4fd85241ee2421b02c4a4) C:\windows\System32\WerSvc.dll
17:24:25.0479 0588	WerSvc - ok
17:24:25.0510 0588	WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\windows\system32\DRIVERS\wfplwf.sys
17:24:25.0557 0588	WfpLwf - ok
17:24:25.0588 0588	WimFltr         (f9ad3a5e3fd7e0bdb18b8202b0fdd4e4) C:\windows\system32\DRIVERS\wimfltr.sys
17:24:25.0619 0588	WimFltr - ok
17:24:25.0635 0588	WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\windows\system32\drivers\wimmount.sys
17:24:25.0666 0588	WIMMount - ok
17:24:25.0775 0588	WinDefend       (3fae8f94296001c32eab62cd7d82e0fd) C:\Program Files\Windows Defender\mpsvc.dll
17:24:25.0838 0588	WinDefend - ok
17:24:25.0853 0588	WinHttpAutoProxySvc - ok
17:24:25.0916 0588	Winmgmt         (f62e510b6ad4c21eb9fe8668ed251826) C:\windows\system32\wbem\WMIsvc.dll
17:24:25.0978 0588	Winmgmt - ok
17:24:26.0009 0588	WinRing0_1_2_0 - ok
17:24:26.0103 0588	WinRM           (1b91cd34ea3a90ab6a4ef0550174f4cc) C:\windows\system32\WsmSvc.dll
17:24:26.0181 0588	WinRM - ok
17:24:26.0274 0588	WinUsb          (a67e5f9a400f3bd1be3d80613b45f708) C:\windows\system32\DRIVERS\WinUsb.sys
17:24:26.0306 0588	WinUsb - ok
17:24:26.0384 0588	Wlansvc         (16935c98ff639d185086a3529b1f2067) C:\windows\System32\wlansvc.dll
17:24:26.0430 0588	Wlansvc - ok
17:24:26.0633 0588	wlidsvc         (5144ae67d60ec653f97ddf3feed29e77) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
17:24:26.0696 0588	wlidsvc - ok
17:24:26.0805 0588	WmiAcpi         (0217679b8fca58714c3bf2726d2ca84e) C:\windows\system32\drivers\wmiacpi.sys
17:24:26.0836 0588	WmiAcpi - ok
17:24:26.0898 0588	wmiApSrv        (6eb6b66517b048d87dc1856ddf1f4c3f) C:\windows\system32\wbem\WmiApSrv.exe
17:24:26.0961 0588	wmiApSrv - ok
17:24:27.0117 0588	WMPNetworkSvc   (3b40d3a61aa8c21b88ae57c58ab3122e) C:\Program Files\Windows Media Player\wmpnetwk.exe
17:24:27.0179 0588	WMPNetworkSvc - ok
17:24:27.0195 0588	WPCSvc          (a2f0ec770a92f2b3f9de6d518e11409c) C:\windows\System32\wpcsvc.dll
17:24:27.0273 0588	WPCSvc - ok
17:24:27.0304 0588	WPDBusEnum      (aa53356d60af47eacc85bc617a4f3f66) C:\windows\system32\wpdbusenum.dll
17:24:27.0351 0588	WPDBusEnum - ok
17:24:27.0413 0588	ws2ifsl         (6db3276587b853bf886b69528fdb048c) C:\windows\system32\drivers\ws2ifsl.sys
17:24:27.0476 0588	ws2ifsl - ok
17:24:27.0522 0588	wscsvc          (6f5d49efe0e7164e03ae773a3fe25340) C:\windows\System32\wscsvc.dll
17:24:27.0554 0588	wscsvc - ok
17:24:27.0600 0588	WSDPrintDevice  (553f6ccd7c58eb98d4a8fbdaf283d7a9) C:\windows\system32\DRIVERS\WSDPrint.sys
17:24:27.0647 0588	WSDPrintDevice - ok
17:24:27.0647 0588	WSearch - ok
17:24:27.0694 0588	wsvd            (baedc491374defd5e76336901d6d397d) C:\windows\system32\DRIVERS\wsvd.sys
17:24:27.0710 0588	wsvd - ok
17:24:27.0850 0588	wuauserv        (3026418a50c5b4761befa632cedb7406) C:\windows\system32\wuaueng.dll
17:24:27.0944 0588	wuauserv - ok
17:24:28.0053 0588	WudfPf          (e714a1c0354636837e20ccbf00888ee7) C:\windows\system32\drivers\WudfPf.sys
17:24:28.0100 0588	WudfPf - ok
17:24:28.0146 0588	WUDFRd          (1023ee888c9b47178c5293ed5336ab69) C:\windows\system32\DRIVERS\WUDFRd.sys
17:24:28.0193 0588	WUDFRd - ok
17:24:28.0224 0588	wudfsvc         (8d1e1e529a2c9e9b6a85b55a345f7629) C:\windows\System32\WUDFSvc.dll
17:24:28.0271 0588	wudfsvc - ok
17:24:28.0318 0588	WwanSvc         (ff2d745b560f7c71b31f30f4d49f73d2) C:\windows\System32\wwansvc.dll
17:24:28.0365 0588	WwanSvc - ok
17:24:28.0412 0588	MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
17:24:28.0630 0588	\Device\Harddisk0\DR0 - ok
17:24:28.0646 0588	Boot (0x1200)   (c98a1924b196e8e2d3aab7b0055f6a39) \Device\Harddisk0\DR0\Partition0
17:24:28.0646 0588	\Device\Harddisk0\DR0\Partition0 - ok
17:24:28.0677 0588	Boot (0x1200)   (84a806bd1d4d4e8eb1c369a3c760eeb8) \Device\Harddisk0\DR0\Partition1
17:24:28.0677 0588	\Device\Harddisk0\DR0\Partition1 - ok
17:24:28.0708 0588	Boot (0x1200)   (d76609dad26cac1ddd4015db32cd9517) \Device\Harddisk0\DR0\Partition2
17:24:28.0708 0588	\Device\Harddisk0\DR0\Partition2 - ok
17:24:28.0708 0588	============================================================
17:24:28.0708 0588	Scan finished
17:24:28.0708 0588	============================================================
17:24:28.0724 1144	Detected object count: 6
17:24:28.0724 1144	Actual detected object count: 6
17:24:39.0334 1144	Adobe LM Service ( UnsignedFile.Multi.Generic ) - skipped by user
17:24:39.0334 1144	Adobe LM Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:24:39.0334 1144	FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user
17:24:39.0334 1144	FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:24:39.0334 1144	Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
17:24:39.0334 1144	Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:24:39.0334 1144	NetworkX ( UnsignedFile.Multi.Generic ) - skipped by user
17:24:39.0334 1144	NetworkX ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:24:39.0334 1144	Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
17:24:39.0334 1144	Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:24:39.0349 1144	sesvc ( UnsignedFile.Multi.Generic ) - skipped by user
17:24:39.0349 1144	sesvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
         

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

• Lade dir ComboFix hier herunter auf deinen Desktop.

• Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

• Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
  Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

• Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Hier das CF Log:

ComboFix 12-06-15.02 - Balle 15.06.2012  16:09:45.1.2 - x86
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3005.1881 [GMT 2:00]
ausgeführt von:: c:\users\Balle\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\NOTEPAD.EXE-x.txt
c:\programdata\RUNDLL32.EXE-x.txt
c:\windows\system32\devil.dll
.
Infizierte Kopie von c:\windows\system32\userinit.exe wurde gefunden und desinfiziert 
Kopie von - c:\windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe wurde wiederhergestellt 
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-05-15 bis 2012-06-15  ))))))))))))))))))))))))))))))
.
.
2012-06-15 14:18 . 2012-06-15 14:18	56200	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{CE7376AC-1153-42E2-9171-F1899204690F}\offreg.dll
2012-06-15 14:18 . 2012-06-15 14:20	--------	d-----w-	c:\users\Balle\AppData\Local\temp
2012-06-15 14:18 . 2012-06-15 14:18	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-06-15 10:08 . 2012-05-08 16:40	6737808	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{CE7376AC-1153-42E2-9171-F1899204690F}\mpengine.dll
2012-06-14 09:18 . 2012-06-14 09:18	--------	d-----w-	C:\_OTL
2012-06-13 19:22 . 2012-04-26 04:45	58880	----a-w-	c:\windows\system32\rdpwsx.dll
2012-06-13 19:22 . 2012-04-26 04:45	129536	----a-w-	c:\windows\system32\rdpcorekmts.dll
2012-06-13 19:22 . 2012-04-26 04:41	8192	----a-w-	c:\windows\system32\rdrmemptylst.exe
2012-06-13 19:22 . 2012-04-28 03:17	183808	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-06-13 19:22 . 2012-05-15 01:05	2343936	----a-w-	c:\windows\system32\win32k.sys
2012-06-12 17:53 . 2012-06-12 17:53	--------	d-----w-	c:\program files\ESET
2012-06-12 12:29 . 2012-06-12 12:29	--------	d-----w-	c:\programdata\CrypKey
2012-06-12 12:13 . 2012-06-12 12:13	--------	d-----w-	C:\Log
2012-06-12 12:12 . 2008-05-07 23:29	122880	----a-w-	c:\windows\system32\Crypserv.exe
2012-06-12 12:12 . 2008-03-17 16:45	19584	----a-w-	c:\windows\system32\Ckldrv.sys
2012-06-12 12:12 . 1999-06-18 20:49	165888	----a-w-	c:\windows\Ckconfig.exe
2012-06-12 12:12 . 1996-05-03 16:21	27648	----a-r-	c:\windows\Setup_ck.exe
2012-06-12 12:12 . 1996-05-03 14:36	18432	----a-w-	c:\windows\Setup_ck.dll
2012-06-12 12:12 . 1995-07-04 17:33	11776	----a-w-	c:\windows\Ckrfresh.exe
2012-06-12 12:12 . 2006-04-17 09:56	1207808	----a-w-	c:\windows\system32\PhoenixDll.dll
2012-06-12 12:12 . 2004-10-16 19:46	178176	----a-w-	c:\windows\system32\StellarProfile.dll
2012-06-12 12:12 . 2012-06-12 15:09	--------	d-----w-	c:\program files\Stellar Phoenix Windows Data Recovery
2012-06-10 17:28 . 2012-06-10 17:28	--------	d-----w-	c:\users\Balle\AppData\Roaming\www.shadowexplorer.com
2012-06-08 22:10 . 2012-06-08 22:10	--------	d-----w-	c:\users\Balle\AppData\Roaming\Malwarebytes
2012-06-08 22:09 . 2012-06-08 22:09	--------	d-----w-	c:\programdata\Malwarebytes
2012-06-08 22:09 . 2012-06-08 22:09	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2012-06-08 22:09 . 2012-04-04 13:56	22344	----a-w-	c:\windows\system32\drivers\mbam.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-08 20:17 . 2012-02-17 15:56	83392	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2012-05-08 20:17 . 2012-02-17 15:56	137928	----a-w-	c:\windows\system32\drivers\avipbb.sys
2012-03-31 04:39 . 2012-05-10 08:56	3913072	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-03-31 04:39 . 2012-05-10 08:56	3968368	----a-w-	c:\windows\system32\ntkrnlpa.exe
2012-03-30 10:23 . 2012-05-10 08:56	1291632	----a-w-	c:\windows\system32\drivers\tcpip.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Balle\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Balle\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Balle\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-10-23 202024]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-18 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-18 174104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-18 150552]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-07-16 307768]
"UpdateP2GShortCut"="c:\program files\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"EnergyUtility"="c:\program files\Lenovo\Energy Management\utility.exe" [2009-09-29 4114288]
"Energy Management"="c:\program files\Lenovo\Energy Management\Energy Management.exe" [2009-09-29 5064560]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]
"Bing Bar"="c:\program files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe" [2010-04-27 243544]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-11-11 288088]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-05-08 348624]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WLStart"="c:\program files\Windows Live\Installer\wlstart.exe" [2009-07-26 786760]
.
c:\users\Balle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Balle\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Acrobat - Schnellstart.lnk - c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe [2010-9-18 25214]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2012-02-29 158856]
R3 Bridge0;Bridge0;c:\windows\system32\drivers\WDBridge.sys [2009-07-28 63240]
R3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2009-07-13 229888]
R3 Lenovo ReadyComm AppSvc;Lenovo ReadyComm AppSvc;c:\program files\Lenovo\ReadyComm\AppSvc.exe [2009-08-14 509192]
R3 Lenovo ReadyComm ConnSvc;Lenovo ReadyComm ConnSvc;c:\program files\Lenovo\ReadyComm\ConnSvc.exe [2009-09-22 579400]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 PS_MDP;ReadyComm Presentation Space Helper Service;c:\windows\System32\IgrsSvcs.exe [2009-07-14 20992]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WinRing0_1_2_0;WinRing0_1_2_0;d:\test\ECECECEC\WinRing0.sys [x]
R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 17920]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 81704]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-09-18 691696]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-09-16 36000]
S1 funfrm;funfrm; [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2012-05-08 86224]
S2 IGRS;IGRS;c:\program files\Lenovo\ReadyComm\common\IGRS.exe [2009-07-14 38152]
S2 ReadyComm.DirectRouter;ReadyComm.DirectRouter;c:\windows\System32\IgrsSvcs.exe [2009-07-14 20992]
S2 sesvc;ShadowExplorer Service;c:\users\Balle\Desktop\ShadowExplorer\sesvc.exe [2011-01-02 9216]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2010-01-20 23136]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2011-05-18 40320]
S3 usbsmi;Lenovo EasyCamera;c:\windows\system32\DRIVERS\SMIksdrv.sys [2009-10-16 171776]
S3 wdmirror;wdmirror;c:\windows\system32\DRIVERS\WDMirror.sys [2009-07-16 11792]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc Mcx2Svc
IgrsSvcs	REG_MULTI_SZ   	ReadyComm.DirectRouter PS_MDP
HPService	REG_MULTI_SZ   	HPSLPSVC
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://lenovo.msn.com
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Auswahl in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Auswahl in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: In vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Verknüpfungsziel in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
TCP: DhcpNameServer = 139.18.25.3 192.168.1.1
TCP: Interfaces\{8D9A6627-3237-4C47-A3EA-BAED32ADEFD7}: NameServer = 139.18.25.3
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-VeriFaceManager - c:\program files\Lenovo\VeriFace\PManage.exe
SafeBoot-mcmscsvc
SafeBoot-MCODS
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(380)
c:\users\Balle\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\crypserv.exe
c:\windows\system32\taskhost.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\conhost.exe
c:\windows\system32\DllHost.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-06-15  16:26:11 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-06-15 14:26
.
Vor Suchlauf: 9 Verzeichnis(se), 97.377.124.352 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 97.276.252.160 Bytes frei
.
- - End Of File - - 395B820E11E5B8CAB4D69C0CFCFC8CDD
         

Ich brauch den Quarantäneordner von Combofix. Bitte folgendes machen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinflussen!
2.) Ordner Quarantine in C:\Qoobox in eine Datei zippen
3.) die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten!

4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

"Vorgang erfolgreich abgeschlossen."

Habe Quarantine.zip hochgeladen!