Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 01.07.2012, 22:06   #1
nimbu
 
Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden - Standard

Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden



Hallo,
auf meinem noch recht neuen Dell Vostro (64bit-System, Windows 7) kommt seit heute Abend alle 5 min Minuten von Trend Micro die Meldung über einen Fund des Trojaners Sirefef.ts informiert, der in Quarantäne verschoben wird. Alle ca. 20 min kommt dann auch die Meldung, dass der Zugriff auf eine omninöse Website (hxxp://promos.fling.com7geo/txt/city.php) verhindert wurde. Bis auf die nervigen Fundmeldungen funktioniert bisher alles noch (habe den Rechner bisher auch noch nicht neu gestartet).
Im Anhang kommt noch das Logfile meines Scanners. Wie kann ich die Malware entfernen?
Vielen Dank für eure Hilfe im Vorraus!!!
Code:
ATTFilter
20120701<;>1948<;>TROJ_GEN.RFFCDG1<;>10<;>1<;>0<;>C:\Users\***\AppData\Local\Temp\2222125.exe<;>
20120701<;>1948<;>TROJ_SIREF64.SM<;>1<;>1<;>0<;>C:\Users\***\AppData\Local\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\n<;>
20120701<;>1949<;>TROJ_SIREF64.SM<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\n<;>
20120701<;>1949<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>1953<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>1957<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2002<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2006<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2010<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2015<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2019<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2023<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2027<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2032<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2036<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2040<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2044<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2049<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2053<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2057<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2101<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2106<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2110<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2114<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2119<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2123<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2127<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2131<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2136<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2140<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2144<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2149<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2153<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2157<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2201<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2205<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2211<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2215<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2219<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2224<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2228<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2232<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2237<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2241<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2245<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2249<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2254<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
         

Alt 02.07.2012, 15:57   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden - Standard

Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden



Bitte erstmal routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
ATTFilter
 hier steht das Log
         
__________________

__________________

Alt 03.07.2012, 09:30   #3
nimbu
 
Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden - Standard

Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden



Hallo,
vielen Dank schon mal für deine Hilfe!
habe zunächst Malwarebytes laufen lassen (mein Virenscanner, war aber noch, ist das ein Problem?). Malwarebytes hat nichts gefunden. Logs folgen unten. Danach habe ich Eset installiert. Trendmicro und Malwarebytes habe ich vor dem Scannen deaktiviert. Aber die Windows-FIrewall ließ sich nicht deaktivieren. Dazu kam die im Anhang beigefügte Fehlermeldung. Eset lief dann normal und hat auch was gefunden. Siehe ebenfalls unten.

Malwarebytes Logfile:
Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.07.02.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
*** :: ***-LAPTOP [Administrator]

Schutz: Aktiviert

02.07.2012 21:54:00
mbam-log-2012-07-02 (21-54-00).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 368836
Laufzeit: 2 Stunde(n), 4 Minute(n), 53 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         
Malwarebytes Protection-Logs der letzten beiden Tage:

2.7.
Code:
ATTFilter
2012/07/02 21:53:45 +0200	***-LAPTOP	***	MESSAGE	Starting protection
2012/07/02 21:53:45 +0200	***-LAPTOP	***	MESSAGE	Executing scheduled update:  Daily
2012/07/02 21:53:46 +0200	***-LAPTOP	***	MESSAGE	Database already up-to-date
2012/07/02 21:53:46 +0200	***-LAPTOP	***	MESSAGE	Protection started successfully
2012/07/02 21:53:49 +0200	***-LAPTOP	***	MESSAGE	Starting IP protection
2012/07/02 21:53:51 +0200	***-LAPTOP	***	MESSAGE	IP Protection started successfully
2012/07/02 23:24:31 +0200	***-LAPTOP	***	IP-BLOCK	77.78.240.33 (Type: outgoing, Port: 54895, Process: services.exe)
2012/07/02 23:24:39 +0200	***-LAPTOP	***	IP-BLOCK	77.78.240.33 (Type: outgoing, Port: 54895, Process: services.exe)
2012/07/02 23:40:21 +0200	***-LAPTOP	***	IP-BLOCK	77.78.240.33 (Type: outgoing, Port: 54895, Process: services.exe)
         
3.7. (bis 7:00, danach lief ESET)
Code:
ATTFilter
2012/07/03 00:17:28 +0200	***-LAPTOP	***	IP-BLOCK	77.78.209.44 (Type: outgoing, Port: 54895, Process: services.exe)
2012/07/03 00:58:47 +0200	***-LAPTOP	***	IP-BLOCK	77.78.209.44 (Type: outgoing, Port: 54895, Process: services.exe)
2012/07/03 01:19:53 +0200	***-LAPTOP	***	IP-BLOCK	77.78.209.44 (Type: outgoing, Port: 54895, Process: services.exe)
2012/07/03 07:15:04 +0200	***-LAPTOP	***	MESSAGE	Stopping IP protection
2012/07/03 07:16:12 +0200	***-LAPTOP	***	MESSAGE	IP Protection stopped
         
ESET
Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=e130c0420a0af44ab1aec72750f56f03
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-03 06:22:06
# local_time=2012-07-03 08:22:06 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=512 16777215 100 0 6603091 6603091 0 0
# compatibility_mode=5893 16776574 66 94 50974256 92922706 0 0
# compatibility_mode=8192 67108863 100 0 410 410 0 0
# scanned=173102
# found=2
# cleaned=0
# scan_time=3670
C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@	Win64/Sirefef.AL trojan (unable to clean)	00000000000000000000000000000000	I
C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@	Win64/Sirefef.T trojan (unable to clean)	00000000000000000000000000000000	I
         
__________________
Miniaturansicht angehängter Grafiken
Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden-firewall.jpg  

Alt 03.07.2012, 14:07   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden - Standard

Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden



Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 03.07.2012, 14:30   #5
nimbu
 
Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden - Standard

Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden



Hallo Arne,
ich habe Malwarebytes nur einmal laufen lassen und das entsprechende Logfile habe ich im vorigen Beitrag gepostet. Ich habe Malwarebytes gestern zum allerersten Mal installiert.
Grüße!


Geändert von nimbu (03.07.2012 um 15:14 Uhr)

Alt 03.07.2012, 15:22   #6
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden - Standard

Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden



Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
ATTFilter
 hier steht das Log
         
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
  • Starte bitte die OTL.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet
Code:
ATTFilter
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
         
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Klick auf .
  • Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread
__________________
--> Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden

Alt 03.07.2012, 19:53   #7
nimbu
 
Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden - Standard

Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden



Hi Arne,
folgendes spuckte der OTL aus (Virenscanner Trendmicro habe ich angelassen!?)
Anmerkung: Sirefef wird weiter fleißig gefunden...

Code:
ATTFilter
OTL logfile created on: 03.07.2012 20:21:23 - Run 1
OTL by OldTimer - Version 3.2.53.1     Folder = C:\Users\***\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,90 Gb Total Physical Memory | 2,17 Gb Available Physical Memory | 55,61% Memory free
7,79 Gb Paging File | 5,66 Gb Available in Paging File | 72,70% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | *** Gb Total Space | *** Gb Free Space | ***% Space Free | Partition Type: NTFS
Drive D: | *** Gb Total Space | *** Gb Free Space | ***% Space Free | Partition Type: UDF
Drive E: | *** Gb Total Space | *** Gb Free Space | ***% Space Free | Partition Type: NTFS
 
Computer Name: ***-LAPTOP | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.03 20:19:22 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.04.03 22:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.02.07 22:16:44 | 000,050,704 | ---- | M] (Trend Micro Inc.) -- c:\Program Files (x86)\Trend Micro\Client Server Security Agent\HostedAgent\svcGenericHost.exe
PRC - [2012.02.07 22:13:50 | 000,024,592 | ---- | M] (Trend Micro Inc.) -- c:\Program Files (x86)\Trend Micro\Client Server Security Agent\HostedAgent\HostedAgent.exe
PRC - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011.09.15 19:28:50 | 000,199,760 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\SmarThru Office\BackUpSvr.exe
PRC - [2011.04.19 15:03:52 | 000,268,864 | ---- | M] (ArcSoft, Inc.) -- C:\Program Files (x86)\ArcSoft\TotalMedia 3.5\TMMonitor.exe
PRC - [2011.02.23 22:19:22 | 000,371,200 | ---- | M] (shbox.de) -- C:\Program Files (x86)\FreePDF_XP\fpassist.exe
PRC - [2011.01.13 22:56:42 | 000,013,600 | ---- | M] (Broadcom Corporation.) -- c:\Programme\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
PRC - [2010.12.29 20:54:10 | 000,740,688 | ---- | M] (DigitalPersona, Inc.) -- C:\Program Files (x86)\DigitalPersona\Bin\DPAgent.exe
PRC - [2010.12.21 01:24:38 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2010.12.21 01:24:36 | 000,325,656 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010.10.27 19:17:52 | 000,207,424 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
PRC - [2010.10.01 16:49:34 | 000,727,664 | ---- | M] () -- C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
PRC - [2010.03.18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2010.10.01 16:49:34 | 000,727,664 | ---- | M] () -- C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
MOD - [2009.07.14 03:15:45 | 000,364,544 | ---- | M] () -- C:\Windows\SysWOW64\msjetoledb40.dll
MOD - [2008.11.26 16:59:32 | 000,131,584 | ---- | M] () -- C:\Program Files (x86)\ArcSoft\TotalMedia 3.5\AbilisWinUsb.dll
MOD - [2008.10.22 16:01:00 | 000,200,704 | ---- | M] () -- C:\Program Files (x86)\ArcSoft\TotalMedia 3.5\VendorCmdRW.dll
MOD - [2007.04.19 09:33:00 | 000,035,584 | ---- | M] () -- C:\Program Files (x86)\ArcSoft\TotalMedia 3.5\uPiApi.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011.10.17 11:39:34 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010.10.07 15:56:44 | 003,137,840 | ---- | M] (Validity Sensors, Inc.) [Auto | Running] -- C:\Windows\SysNative\vcsFPService.exe -- (vcsFPService)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.07.01 19:49:38 | 000,257,224 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.06.24 19:18:40 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.05.07 09:17:58 | 001,853,072 | ---- | M] (Trend Micro Inc.) [Auto | Running] -- c:\Program Files (x86)\Trend Micro\Client Server Security Agent\ntrtscan.exe -- (ntrtscan)
SRV - [2012.04.26 16:04:26 | 000,918,032 | ---- | M] (Trend Micro Inc.) [On_Demand | Running] -- c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmProxy.exe -- (TmProxy)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.04.03 22:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.02.07 22:16:44 | 000,050,704 | ---- | M] (Trend Micro Inc.) [Auto | Running] -- c:\Program Files (x86)\Trend Micro\Client Server Security Agent\HostedAgent\svcGenericHost.exe -- (svcGenericHost)
SRV - [2011.12.08 19:29:58 | 002,064,992 | ---- | M] (Trend Micro Inc.) [Auto | Running] -- c:\Program Files (x86)\Trend Micro\Client Server Security Agent\tmlisten.exe -- (tmlisten)
SRV - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2011.01.13 22:56:40 | 000,956,192 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- c:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2010.12.29 20:54:24 | 000,440,144 | ---- | M] (DigitalPersona, Inc.) [Auto | Running] -- C:\Programme\DigitalPersona\Bin\DpHostW.exe -- (DpHost)
SRV - [2010.12.21 01:24:38 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2010.12.21 01:24:36 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2010.11.29 22:00:56 | 000,149,504 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Programme\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost) Intel(R)
SRV - [2010.11.25 12:34:18 | 000,219,632 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe -- (RoxWatch12)
SRV - [2010.11.25 12:33:18 | 001,116,656 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe -- (RoxMediaDB12OEM)
SRV - [2010.10.07 15:45:28 | 002,692,400 | ---- | M] (Validity Sensors, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vcsFPService.exe -- (vcsFPService)
SRV - [2010.09.23 01:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.08.26 03:28:54 | 002,823,000 | ---- | M] (Dell, Inc.) [Auto | Running] -- C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe -- (NOBU)
SRV - [2010.07.21 14:48:20 | 000,596,032 | ---- | M] (Trend Micro Inc.) [On_Demand | Running] -- c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmPfw.exe -- (TmPfw)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009.11.18 04:14:26 | 000,098,208 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Programme\Realtek\Audio\HDA\AERTSr64.exe -- (AERTFilters)
SRV - [2009.07.06 21:16:50 | 000,570,632 | ---- | M] (Trend Micro Inc.) [On_Demand | Running] -- c:\Program Files (x86)\Trend Micro\BM\TMBMSRV.exe -- (TMBMServer)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007.05.31 10:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 10:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.03.22 16:53:45 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2012.03.22 16:53:45 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.10.17 12:09:10 | 009,319,424 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011.10.17 11:03:18 | 000,304,128 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011.10.01 08:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011.10.01 08:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011.10.01 08:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011.10.01 08:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011.09.14 02:14:44 | 000,212,992 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2011.09.14 02:14:42 | 000,095,744 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2011.09.05 19:38:22 | 000,212,544 | ---- | M] (Fresco Logic) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\FLxHCIc.sys -- (FLxHCIc) Fresco Logic xHCI (USB3)
DRV:64bit: - [2011.09.05 19:38:22 | 000,069,184 | ---- | M] (Fresco Logic) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\FLxHCIh.sys -- (FLxHCIh) Fresco Logic xHCI (USB3)
DRV:64bit: - [2011.08.24 07:57:24 | 000,565,352 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.08.09 18:32:02 | 012,289,472 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdpmd64.sys -- (intelkmd)
DRV:64bit: - [2011.06.13 13:06:10 | 000,048,488 | ---- | M] (Realtek) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RTL2832U_IRHID.sys -- (RTL2832U_IRHID)
DRV:64bit: - [2011.05.17 14:48:22 | 000,225,256 | ---- | M] (REALTEK SEMICONDUCTOR Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RTL2832UBDA.sys -- (RTL2832UBDA)
DRV:64bit: - [2011.05.17 14:48:22 | 000,039,016 | ---- | M] (REALTEK SEMICONDUCTOR Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RTL2832UUSB.sys -- (RTL2832UUSB)
DRV:64bit: - [2011.04.23 04:24:38 | 001,438,768 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2011.03.14 08:36:08 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\SSPORT.SYS -- (SSPORT)
DRV:64bit: - [2011.01.20 18:20:46 | 000,176,096 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV:64bit: - [2011.01.14 19:09:00 | 000,349,736 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (BTWAMPFL)
DRV:64bit: - [2011.01.14 19:08:42 | 000,138,280 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2011.01.14 19:08:42 | 000,039,464 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2011.01.14 19:08:42 | 000,021,416 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2011.01.14 19:08:40 | 000,106,536 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2011.01.13 03:51:44 | 000,439,320 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.12.01 18:12:06 | 000,250,984 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010.11.29 22:00:04 | 000,016,120 | ---- | M] (Intel(R) Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB)
DRV:64bit: - [2010.11.24 18:21:32 | 004,719,168 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:48 | 000,168,448 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netvsc60.sys -- (netvsc)
DRV:64bit: - [2010.11.21 05:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010.11.21 05:23:48 | 000,022,528 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VMBusVideoM.sys -- (SynthVid)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.11.09 02:07:48 | 000,338,000 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\tmwfp.sys -- (tmwfp)
DRV:64bit: - [2010.11.09 02:06:58 | 000,196,688 | ---- | M] (Trend Micro Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tmlwf.sys -- (tmlwf)
DRV:64bit: - [2010.11.09 02:05:20 | 000,108,624 | ---- | M] (Trend Micro Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tmtdi.sys -- (tmtdi)
DRV:64bit: - [2010.10.20 02:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R)
DRV:64bit: - [2010.10.15 10:28:16 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2010.09.29 20:38:32 | 000,027,760 | ---- | M] (ST Microelectronics) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelern.sys -- (Acceler)
DRV:64bit: - [2010.08.20 12:05:12 | 000,021,616 | ---- | M] (ST Microelectronics) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stdcfltn.sys -- (stdcfltn)
DRV:64bit: - [2010.03.19 10:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2012.04.10 21:04:32 | 000,025,072 | ---- | M] (PC-Doctor, Inc.) [Kernel | On_Demand | Running] -- c:\Programme\Dell Support Center\pcdsrvc_x64.pkms -- (PCDSRVC{1E208CE0-FB7451FF-06020101}_0)
DRV - [2011.07.12 10:56:50 | 000,342,288 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmXPFlt.sys -- (TmFilter)
DRV - [2011.07.12 10:56:36 | 000,042,768 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmPreFlt.sys -- (TmPreFilter)
DRV - [2011.07.12 10:47:06 | 002,077,456 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- c:\Program Files (x86)\Trend Micro\Client Server Security Agent\VSApiNt.sys -- (VSApiNt)
DRV - [2011.06.13 13:06:10 | 000,048,488 | ---- | M] (Realtek) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\RTL2832U_IRHID.sys -- (RTL2832U_IRHID)
DRV - [2011.05.17 14:48:22 | 000,225,256 | ---- | M] (REALTEK SEMICONDUCTOR Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\RTL2832UBDA.sys -- (RTL2832UBDA)
DRV - [2011.05.17 14:48:22 | 000,039,016 | ---- | M] (REALTEK SEMICONDUCTOR Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\RTL2832UUSB.sys -- (RTL2832UUSB)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {1FF8C28D-9F02-4236-86AB-26BAAA52B5BC}
IE:64bit: - HKLM\..\SearchScopes\{1FF8C28D-9F02-4236-86AB-26BAAA52B5BC}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLSDF8&pc=MDDR&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {1FF8C28D-9F02-4236-86AB-26BAAA52B5BC}
IE - HKLM\..\SearchScopes\{1FF8C28D-9F02-4236-86AB-26BAAA52B5BC}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLSDF8&pc=MDDR&src=IE-SearchBox
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3673317262-787391419-4269671268-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USSMB/8
IE - HKU\S-1-5-21-3673317262-787391419-4269671268-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/USSMB/8
IE - HKU\S-1-5-21-3673317262-787391419-4269671268-1001\..\SearchScopes,DefaultScope = {1FF8C28D-9F02-4236-86AB-26BAAA52B5BC}
IE - HKU\S-1-5-21-3673317262-787391419-4269671268-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\otis@digitalpersona.com: C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt\ [2012.03.22 14:41:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: c:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1046\FirefoxExtension [2012.06.03 09:37:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.24 19:18:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.07.01 11:29:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.24 19:18:41 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012.04.18 17:44:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2012.06.29 21:14:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\9lp1iowa.default\extensions
[2012.05.21 19:34:15 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\9lp1iowa.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2012.06.24 19:18:42 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.06.29 21:14:08 | 000,743,305 | ---- | M] () (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9LP1IOWA.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.06.27 08:05:51 | 000,094,344 | ---- | M] () (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9LP1IOWA.DEFAULT\EXTENSIONS\CANITBECHEAPER@TRAFFICBROKER.CO.UK.XPI
[2012.06.24 19:18:41 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.06.24 19:18:37 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.24 19:18:37 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.24 19:18:37 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.24 19:18:37 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.24 19:18:37 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.24 19:18:37 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - c:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1046\TmIEPlg.dll (Trend Micro Inc.)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - c:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1046\TmIEPlg32.dll (Trend Micro Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [CDAServer] C:\Programme\Common Files\Common Desktop Agent\CDASrv.exe ()
O4:64bit: - HKLM..\Run: [DBRMTray] C:\DELL\DBRM\Reminder\DbrmTrayicon.exe (Dell Computer Corporation)
O4:64bit: - HKLM..\Run: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [QuickSet] c:\Programme\Dell\QuickSet\quickset.exe (Dell Inc.)
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe (Dell, Inc.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [IR_SERVER] C:\PROGRA~2\Realtek\REALTE~1\IR_SERVER.exe File not found
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [OfficeScanNT Monitor] c:\Program Files (x86)\Trend Micro\Client Server Security Agent\pccntmon.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe (Sonic Solutions)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [STO Backup Service] C:\Program Files (x86)\SmarThru Office\BackUpSvr.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [STO Launcher Service] C:\Program Files (x86)\SmarThru Office\x64\LegacyLauncher.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre7\bin\jusched.exe" File not found
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [DBRMTray] C:\DELL\DBRM\Reminder\TrayApp.exe (Microsoft)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - c:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - c:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - c:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - c:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra Button: @c:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @c:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-3673317262-787391419-4269671268-1001\..Trusted Domains: samsungsetup.com ([www] http in Vertrauenswürdige Sites)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 10.1.0)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab (Creative Software AutoUpdate)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 10.1.0)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B2DE30B8-2468-42C2-871D-09DC6E8A80BA}: DhcpNameServer = 13.35.0.103
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B5F3A03A-721A-4275-8EE2-272A1F310872}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - c:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1046\TmIEPlg.dll (Trend Micro Inc.)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - c:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1046\TmIEPlg32.dll (Trend Micro Inc.)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Program Files (x86)\DigitalPersona\Bin\DPAgent.exe) - C:\Program Files (x86)\DigitalPersona\Bin\DPAgent.exe (DigitalPersona, Inc.)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: Dell Webcam Central - hkey= - key= - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
MsConfig:64bit - StartUpReg: Desktop Disc Tool - hkey= - key= - C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe ()
MsConfig:64bit - StartUpReg: PDVD9LanguageShortcut - hkey= - key= - C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe (CyberLink Corp.)
MsConfig:64bit - StartUpReg: RemoteControl9 - hkey= - key= - C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe (CyberLink Corp.)
MsConfig:64bit - StartUpReg: RTHDVCPL - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: MPSSvc - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: DpHost - C:\Programme\DigitalPersona\Bin\DpHostW.exe (DigitalPersona, Inc.)
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: MPSSvc - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.03 20:17:38 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2012.07.03 07:18:58 | 000,000,000 | -HSD | C] -- C:\Windows\SysNative\%APPDATA%
[2012.07.03 07:15:57 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\MWB
[2012.07.03 07:14:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.07.03 07:13:13 | 002,322,184 | ---- | C] (ESET) -- C:\Users\***\Desktop\esetsmartinstaller_enu.exe
[2012.07.02 21:52:29 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2012.07.02 21:52:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.02 21:52:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.02 21:52:17 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.07.02 21:52:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.06.25 23:07:29 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\dvdcss
[2012.06.25 23:07:03 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\vlc
[2012.06.25 23:05:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012.06.25 23:05:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VideoLAN
[2012.06.25 20:41:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVD Shrink
[2012.06.25 20:41:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVD Shrink
[2012.06.24 17:56:04 | 000,000,000 | ---D | C] -- C:\ProgramData\DVD Shrink
[2012.06.16 21:59:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trend Micro Client-Server Security Agent
[2012.06.11 21:28:47 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Macromedia
[2012.06.09 16:59:28 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
[2012.06.07 22:54:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\USB Media Adaptor
[2012.06.07 22:53:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\USB Media Adaptor
 
========== Files - Modified Within 30 Days ==========
 
File not found -- C:\Windows\SysNative\
[2012.07.03 20:19:22 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2012.07.03 20:16:38 | 000,000,506 | ---- | M] () -- C:\Windows\tasks\SystemToolsDailyTest.job
[2012.07.03 20:16:20 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.03 20:16:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.03 10:20:20 | 000,000,031 | ---- | M] () -- C:\tmuninst.ini
[2012.07.03 07:13:14 | 002,322,184 | ---- | M] (ESET) -- C:\Users\***\Desktop\esetsmartinstaller_enu.exe
[2012.07.02 21:52:22 | 000,001,111 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.01 20:13:43 | 000,943,230 | ---- | M] () -- C:\Users\***\AppData\Local\census.cache
[2012.07.01 20:12:50 | 000,109,811 | ---- | M] () -- C:\Users\***\AppData\Local\ars.cache
[2012.07.01 20:01:30 | 000,000,036 | ---- | M] () -- C:\Users\***\AppData\Local\housecall.guid.cache
[2012.07.01 19:18:40 | 000,021,088 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.01 19:18:40 | 000,021,088 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.01 19:11:05 | 3137,970,176 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.30 13:31:55 | 000,741,706 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.06.30 13:31:55 | 000,696,984 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.06.30 13:31:55 | 000,162,664 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.06.30 13:31:55 | 000,135,610 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.06.30 13:31:54 | 001,733,384 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.06.29 20:46:32 | 000,107,800 | ---- | M] () -- C:\Users\***\Desktop\2012-06-29_***_v2 (1).pdf
[2012.06.29 20:46:06 | 000,107,801 | ---- | M] () -- C:\Users\***\Desktop\2012-06-29_***_v2.pdf
[2012.06.29 20:44:29 | 000,107,806 | ---- | M] () -- C:\Users\***\Desktop\2012-06-29_***.pdf
[2012.06.25 23:05:47 | 000,001,068 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012.06.24 14:43:48 | 000,000,564 | ---- | M] () -- C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2012.06.24 01:37:00 | 000,000,564 | ---- | M] () -- C:\Windows\tasks\PCDoctorBackgroundMonitorTask-Delay.job
[2012.06.15 21:20:01 | 000,493,432 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
File not found -- C:\Windows\SysNative\
[2012.07.02 21:52:22 | 000,001,111 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.01 20:13:43 | 000,943,230 | ---- | C] () -- C:\Users\***\AppData\Local\census.cache
[2012.07.01 20:12:50 | 000,109,811 | ---- | C] () -- C:\Users\***\AppData\Local\ars.cache
[2012.07.01 20:00:38 | 000,000,036 | ---- | C] () -- C:\Users\***\AppData\Local\housecall.guid.cache
[2012.07.01 19:49:26 | 000,001,696 | ---- | C] () -- C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\00000001.@
[2012.06.29 20:46:32 | 000,107,800 | ---- | C] () -- C:\Users\***\Desktop\2012-06-29_***_v2 (1).pdf
[2012.06.29 20:46:06 | 000,107,801 | ---- | C] () -- C:\Users\***\Desktop\2012-06-29_***_v2.pdf
[2012.06.29 20:44:29 | 000,107,806 | ---- | C] () -- C:\Users\***\Desktop\2012-06-29_***.pdf
[2012.06.25 23:05:47 | 000,001,068 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012.06.24 01:07:08 | 000,000,564 | ---- | C] () -- C:\Windows\tasks\PCDoctorBackgroundMonitorTask-Delay.job
[2012.05.27 12:53:10 | 000,950,585 | ---- | C] () -- C:\Windows\SysWow64\libiconv-2.dll
[2012.05.27 12:41:52 | 000,149,880 | ---- | C] () -- C:\Windows\Wiainst64.exe
[2012.05.20 22:48:10 | 000,001,270 | ---- | C] () -- C:\Users\***\.recently-used.xbel
[2012.05.05 20:11:45 | 005,746,780 | ---- | C] ( ) -- C:\Windows\SysWow64\RTKISDBT.dll
[2012.05.01 18:29:26 | 000,001,994 | ---- | C] () -- C:\Users\***\AppData\Roaming\gnuplot_history
[2012.04.23 21:27:44 | 000,004,608 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.04.22 19:40:44 | 000,001,466 | ---- | C] () -- C:\Users\***\AppData\Local\recently-used.xbel
[2012.04.21 19:18:53 | 000,219,848 | ---- | C] () -- C:\Users\***\AppData\Roaming\hdsmsu.dll
[2012.04.19 23:20:40 | 000,039,026 | ---- | C] () -- C:\Users\***\Feiertage_DE.ics
[2012.03.22 16:54:00 | 000,002,048 | -HS- | C] () -- C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\@
[2012.03.22 16:54:00 | 000,002,048 | -HS- | C] () -- C:\Users\***\AppData\Local\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\@
[2012.03.22 16:22:12 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll
[2012.03.22 16:21:47 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2012.03.22 16:21:45 | 000,216,000 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2012.03.22 16:21:43 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2012.03.22 16:21:42 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2012.03.22 16:21:41 | 013,903,872 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll
[2012.03.22 16:21:36 | 000,003,914 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2012.03.22 14:31:36 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.03.22 14:30:25 | 000,003,914 | ---- | C] () -- C:\Windows\SysWow64\atipblup.dat
[2011.10.17 09:05:18 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011.02.11 19:45:27 | 001,701,402 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
 
========== LOP Check ==========
 
[2012.04.17 20:48:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DigitalPersona
[2012.04.24 16:39:28 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FreePDF
[2012.05.18 15:23:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\inkscape
[2012.04.21 19:10:50 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LibreOffice
[2012.05.01 15:12:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PCDr
[2012.05.27 12:55:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Samsung
[2012.04.26 19:32:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\SoftGrid Client
[2012.04.18 17:45:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Thunderbird
[2012.04.24 14:30:25 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TP
[2012.06.24 01:37:00 | 000,000,564 | ---- | M] () -- C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
[2012.06.24 14:43:48 | 000,000,564 | ---- | M] () -- C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
[2012.06.24 14:43:48 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.07.03 20:16:38 | 000,000,506 | ---- | M] () -- C:\Windows\Tasks\SystemToolsDailyTest.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.04.21 19:15:05 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Adobe
[2012.05.05 20:15:40 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ArcSoft
[2012.04.17 20:59:24 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ATI
[2012.04.17 20:59:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Creative
[2012.05.02 20:38:39 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\CyberLink
[2012.05.01 13:27:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dell
[2012.04.17 20:48:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DigitalPersona
[2012.06.26 07:18:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\dvdcss
[2012.04.18 17:36:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FLEXnet
[2012.04.24 16:39:28 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FreePDF
[2012.04.17 20:59:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Identities
[2012.05.18 15:23:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\inkscape
[2012.05.05 20:11:20 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\InstallShield
[2012.04.21 19:10:50 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LibreOffice
[2012.04.17 21:29:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Macromedia
[2012.07.02 21:52:29 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2010.11.21 09:00:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Media Center Programs
[2012.06.03 18:47:49 | 000,000,000 | --SD | M] -- C:\Users\***\AppData\Roaming\Microsoft
[2012.04.18 17:44:05 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Mozilla
[2012.05.01 15:12:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PCDr
[2012.04.23 21:25:23 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Reallusion
[2012.04.18 18:00:16 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Roxio
[2012.04.18 17:32:56 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Roxio Burn
[2012.05.27 12:55:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Samsung
[2012.06.25 21:08:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Skype
[2012.04.26 19:32:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\SoftGrid Client
[2012.04.18 17:45:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Thunderbird
[2012.04.24 14:30:25 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TP
[2012.06.26 07:19:55 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\vlc
[2012.05.03 21:07:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2011.01.13 03:51:44 | 000,439,320 | ---- | M] (Intel Corporation) MD5=D469B77687E12FE43E344806740B624D -- C:\Drivers\Chipset_IRST\f6flpy-x64\iaStor.sys
[2011.01.13 03:51:44 | 000,439,320 | ---- | M] (Intel Corporation) MD5=D469B77687E12FE43E344806740B624D -- C:\Windows\SysNative\drivers\iaStor.sys
[2011.01.13 03:51:44 | 000,439,320 | ---- | M] (Intel Corporation) MD5=D469B77687E12FE43E344806740B624D -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_a36325196df56f7d\iaStor.sys
[2011.01.13 03:51:44 | 000,439,320 | ---- | M] (Intel Corporation) MD5=D469B77687E12FE43E344806740B624D -- C:\Windows\SysNative\DriverStore\FileRepository\iastor.inf_amd64_neutral_e3082ac13af8d3bf\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2012.03.22 16:53:45 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2012.03.22 16:53:45 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2012.03.22 16:53:45 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2012.03.22 16:53:45 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2012.03.22 16:53:45 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2012.03.22 16:53:45 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2012.03.22 16:53:45 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2012.03.22 16:53:45 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<           >

< End of report >
         

Alt 04.07.2012, 16:24   #8
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden - Standard

Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden



Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
ATTFilter
:OTL
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [IR_SERVER] C:\PROGRA~2\Realtek\REALTE~1\IR_SERVER.exe File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
:Files
C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U
C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\@
C:\Users\***\AppData\Local\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\@
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
         
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 04.07.2012, 19:35   #9
nimbu
 
Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden - Standard

Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden



Fix durchgefüht. Hier die OTL-Datei

Code:
ATTFilter
All processes killed
========== OTL ==========
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\IR_SERVER deleted successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
========== FILES ==========
C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U folder moved successfully.
C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\@ moved successfully.
C:\Users\***\AppData\Local\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\@ moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: ***
->Temp folder emptied: 165760745 bytes
->Temporary Internet Files folder emptied: 60671824 bytes
->Java cache emptied: 1489512 bytes
->FireFox cache emptied: 1160658714 bytes
->Flash cache emptied: 10855 bytes
 
User: ***
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: ***
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: ***
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 170465552 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 52113068 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 1.537,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: ***
->Flash cache emptied: 0 bytes
 
User: ***
 
User: ***
 
User: ***
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.53.1 log created on 07042012_195151

Files\Folders moved on Reboot...
C:\Users\***\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...
File C:\Users\***\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot...
         
Nach dem Neustart lief er jetzt für 20 min ohne einen erneuten Fund

Allerdings besteht immer noch das Problem mit der Firewall, genauer ich kann keine Änderungen an der Windows-Firewall vornehmen (wie bereits oben beschrieben). Die Fehlermeldung findest du im Anhang. Was bleibt noch zu tun?
Miniaturansicht angehängter Grafiken
Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden-firewall.jpg  

Alt 05.07.2012, 10:08   #10
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden - Standard

Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden



Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

__________________
Logfiles bitte immer in CODE-Tags posten

Alt 05.07.2012, 22:09   #11
nimbu
 
Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden - Standard

Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden



Hi,
der TDSS-Killer hat nix gefunden. Hier der Report:

Code:
ATTFilter
23:02:23.0151 3312	TDSS rootkit removing tool 2.7.44.0 Jul  2 2012 20:01:08
23:02:23.0463 3312	============================================================
23:02:23.0463 3312	Current date / time: 2012/07/05 23:02:23.0463
23:02:23.0463 3312	SystemInfo:
23:02:23.0463 3312	
23:02:23.0463 3312	OS Version: 6.1.7601 ServicePack: 1.0
23:02:23.0463 3312	Product type: Workstation
23:02:23.0463 3312	ComputerName: ***-LAPTOP
23:02:23.0463 3312	UserName: ***
23:02:23.0463 3312	Windows directory: C:\Windows
23:02:23.0463 3312	System windows directory: C:\Windows
23:02:23.0463 3312	Running under WOW64
23:02:23.0463 3312	Processor architecture: Intel x64
23:02:23.0463 3312	Number of processors: 4
23:02:23.0463 3312	Page size: 0x1000
23:02:23.0463 3312	Boot type: Normal boot
23:02:23.0463 3312	============================================================
23:02:24.0274 3312	Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
23:02:24.0290 3312	============================================================
23:02:24.0290 3312	\Device\Harddisk0\DR0:
23:02:24.0290 3312	MBR partitions:
23:02:24.0290 3312	\Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x34000, BlocksNum 0x2710000
23:02:24.0290 3312	\Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x2744000, BlocksNum 0x124F7800
23:02:24.0290 3312	\Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x14C3B800, BlocksNum 0x2574A800
23:02:24.0290 3312	============================================================
23:02:24.0321 3312	C: <-> \Device\Harddisk0\DR0\Partition1
23:02:24.0352 3312	E: <-> \Device\Harddisk0\DR0\Partition2
23:02:24.0352 3312	============================================================
23:02:24.0352 3312	Initialize success
23:02:24.0352 3312	============================================================
23:04:02.0757 5884	============================================================
23:04:02.0757 5884	Scan started
23:04:02.0757 5884	Mode: Manual; SigCheck; TDLFS; 
23:04:02.0757 5884	============================================================
23:04:03.0678 5884	1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
23:04:03.0912 5884	1394ohci - ok
23:04:03.0959 5884	Acceler         (aedb94a49236f5ff060c90e09e70281f) C:\Windows\system32\DRIVERS\Accelern.sys
23:04:04.0005 5884	Acceler - ok
23:04:04.0115 5884	ACDaemon        (adc420616c501b45d26c0fd3ef1e54e4) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
23:04:04.0130 5884	ACDaemon - ok
23:04:04.0177 5884	ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
23:04:04.0208 5884	ACPI - ok
23:04:04.0239 5884	AcpiPmi         (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
23:04:04.0317 5884	AcpiPmi - ok
23:04:04.0395 5884	AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
23:04:04.0411 5884	AdobeARMservice - ok
23:04:04.0536 5884	AdobeFlashPlayerUpdateSvc (f3cd7b20b27d1772c946df993ff3635c) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
23:04:04.0551 5884	AdobeFlashPlayerUpdateSvc - ok
23:04:04.0614 5884	adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\drivers\adp94xx.sys
23:04:04.0661 5884	adp94xx - ok
23:04:04.0707 5884	adpahci         (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\drivers\adpahci.sys
23:04:04.0739 5884	adpahci - ok
23:04:04.0770 5884	adpu320         (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\drivers\adpu320.sys
23:04:04.0801 5884	adpu320 - ok
23:04:04.0848 5884	AeLookupSvc     (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
23:04:05.0019 5884	AeLookupSvc - ok
23:04:05.0113 5884	AERTFilters     (d1e343bc00136ce03c4d403194d06a80) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
23:04:05.0129 5884	AERTFilters - ok
23:04:05.0222 5884	Afc             (0d0e5281784c2c526ba43c2ecd374288) C:\Windows\syswow64\drivers\Afc.sys
23:04:05.0238 5884	Afc - ok
23:04:05.0300 5884	AFD             (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
23:04:05.0378 5884	AFD - ok
23:04:05.0409 5884	agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
23:04:05.0441 5884	agp440 - ok
23:04:05.0472 5884	ALG             (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
23:04:05.0534 5884	ALG - ok
23:04:05.0550 5884	aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
23:04:05.0581 5884	aliide - ok
23:04:05.0612 5884	AMD External Events Utility (bf25b0b9355f735dad171e4366d77018) C:\Windows\system32\atiesrxx.exe
23:04:05.0721 5884	AMD External Events Utility - ok
23:04:05.0737 5884	amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
23:04:05.0753 5884	amdide - ok
23:04:05.0784 5884	AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\drivers\amdk8.sys
23:04:05.0799 5884	AmdK8 - ok
23:04:06.0252 5884	amdkmdag        (5e2bc632d187b6b8e5d8565813bb3c93) C:\Windows\system32\DRIVERS\atikmdag.sys
23:04:06.0533 5884	amdkmdag - ok
23:04:06.0657 5884	amdkmdap        (e25e26f6f97ae1b625bd4cbceaf88c91) C:\Windows\system32\DRIVERS\atikmpag.sys
23:04:06.0704 5884	amdkmdap - ok
23:04:06.0735 5884	AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\drivers\amdppm.sys
23:04:06.0782 5884	AmdPPM - ok
23:04:06.0813 5884	amdsata         (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
23:04:06.0829 5884	amdsata - ok
23:04:06.0860 5884	amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\drivers\amdsbs.sys
23:04:06.0891 5884	amdsbs - ok
23:04:06.0907 5884	amdxata         (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
23:04:06.0923 5884	amdxata - ok
23:04:06.0954 5884	AppID           (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
23:04:07.0141 5884	AppID - ok
23:04:07.0157 5884	AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
23:04:07.0203 5884	AppIDSvc - ok
23:04:07.0235 5884	Appinfo         (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
23:04:07.0328 5884	Appinfo - ok
23:04:07.0375 5884	AppMgmt         (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll
23:04:07.0406 5884	AppMgmt - ok
23:04:07.0437 5884	arc             (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\drivers\arc.sys
23:04:07.0469 5884	arc - ok
23:04:07.0484 5884	arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\drivers\arcsas.sys
23:04:07.0515 5884	arcsas - ok
23:04:07.0609 5884	aspnet_state    (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
23:04:07.0656 5884	aspnet_state - ok
23:04:07.0687 5884	AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
23:04:07.0781 5884	AsyncMac - ok
23:04:07.0827 5884	atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
23:04:07.0827 5884	atapi - ok
23:04:07.0905 5884	AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
23:04:07.0999 5884	AudioEndpointBuilder - ok
23:04:07.0999 5884	AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
23:04:08.0061 5884	AudioSrv - ok
23:04:08.0077 5884	AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
23:04:08.0155 5884	AxInstSV - ok
23:04:08.0202 5884	b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\drivers\bxvbda.sys
23:04:08.0280 5884	b06bdrv - ok
23:04:08.0327 5884	b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
23:04:08.0373 5884	b57nd60a - ok
23:04:08.0623 5884	BCM43XX         (783f1c7ed6b39454a8d1028d4f30768d) C:\Windows\system32\DRIVERS\bcmwl664.sys
23:04:08.0701 5884	BCM43XX - ok
23:04:08.0795 5884	BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
23:04:08.0841 5884	BDESVC - ok
23:04:08.0857 5884	Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
23:04:08.0935 5884	Beep - ok
23:04:08.0951 5884	blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
23:04:08.0997 5884	blbdrive - ok
23:04:09.0029 5884	bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
23:04:09.0075 5884	bowser - ok
23:04:09.0107 5884	BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\BrFiltLo.sys
23:04:09.0153 5884	BrFiltLo - ok
23:04:09.0153 5884	BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\BrFiltUp.sys
23:04:09.0200 5884	BrFiltUp - ok
23:04:09.0231 5884	Browser         (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
23:04:09.0341 5884	Browser - ok
23:04:09.0372 5884	Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
23:04:09.0419 5884	Brserid - ok
23:04:09.0419 5884	BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
23:04:09.0465 5884	BrSerWdm - ok
23:04:09.0481 5884	BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
23:04:09.0543 5884	BrUsbMdm - ok
23:04:09.0543 5884	BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
23:04:09.0575 5884	BrUsbSer - ok
23:04:09.0606 5884	BthEnum         (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\DRIVERS\BthEnum.sys
23:04:09.0684 5884	BthEnum - ok
23:04:09.0699 5884	BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
23:04:09.0731 5884	BTHMODEM - ok
23:04:09.0762 5884	BthPan          (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys
23:04:09.0809 5884	BthPan - ok
23:04:09.0871 5884	BTHPORT         (64c198198501f7560ee41d8d1efa7952) C:\Windows\system32\Drivers\BTHport.sys
23:04:09.0933 5884	BTHPORT - ok
23:04:09.0965 5884	bthserv         (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
23:04:10.0027 5884	bthserv - ok
23:04:10.0058 5884	BTHUSB          (f188b7394d81010767b6df3178519a37) C:\Windows\system32\Drivers\BTHUSB.sys
23:04:10.0074 5884	BTHUSB - ok
23:04:10.0136 5884	BTWAMPFL        (a0dfb69ade3444c78b17636fcf28e898) C:\Windows\system32\DRIVERS\btwampfl.sys
23:04:10.0167 5884	BTWAMPFL - ok
23:04:10.0199 5884	btwaudio        (f6135859a582a7294ba7a3336e08baa1) C:\Windows\system32\drivers\btwaudio.sys
23:04:10.0214 5884	btwaudio - ok
23:04:10.0245 5884	btwavdt         (3def2370e414b4e299673558ba171a51) C:\Windows\system32\DRIVERS\btwavdt.sys
23:04:10.0245 5884	btwavdt - ok
23:04:10.0355 5884	btwdins         (b7dea77ee893806859072274ee8ec8fc) c:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
23:04:10.0417 5884	btwdins - ok
23:04:10.0448 5884	btwl2cap        (9ad0fa253ed531d39fb2d74fe12a5fa9) C:\Windows\system32\DRIVERS\btwl2cap.sys
23:04:10.0464 5884	btwl2cap - ok
23:04:10.0479 5884	btwrchid        (9937e0e4dfc0030560a6dfe9d3a94b39) C:\Windows\system32\DRIVERS\btwrchid.sys
23:04:10.0495 5884	btwrchid - ok
23:04:10.0542 5884	cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
23:04:10.0635 5884	cdfs - ok
23:04:10.0667 5884	cdrom           (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
23:04:10.0682 5884	cdrom - ok
23:04:10.0713 5884	CertPropSvc     (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
23:04:10.0791 5884	CertPropSvc - ok
23:04:10.0823 5884	circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\drivers\circlass.sys
23:04:10.0854 5884	circlass - ok
23:04:10.0885 5884	CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
23:04:10.0932 5884	CLFS - ok
23:04:11.0010 5884	clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
23:04:11.0041 5884	clr_optimization_v2.0.50727_32 - ok
23:04:11.0088 5884	clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
23:04:11.0119 5884	clr_optimization_v2.0.50727_64 - ok
23:04:11.0181 5884	clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
23:04:11.0275 5884	clr_optimization_v4.0.30319_32 - ok
23:04:11.0306 5884	clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
23:04:11.0353 5884	clr_optimization_v4.0.30319_64 - ok
23:04:11.0369 5884	CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
23:04:11.0415 5884	CmBatt - ok
23:04:11.0431 5884	cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
23:04:11.0462 5884	cmdide - ok
23:04:11.0525 5884	CNG             (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
23:04:11.0587 5884	CNG - ok
23:04:11.0603 5884	Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
23:04:11.0618 5884	Compbatt - ok
23:04:11.0634 5884	CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\DRIVERS\CompositeBus.sys
23:04:11.0665 5884	CompositeBus - ok
23:04:11.0681 5884	COMSysApp - ok
23:04:11.0696 5884	crcdisk         (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\drivers\crcdisk.sys
23:04:11.0712 5884	crcdisk - ok
23:04:11.0743 5884	CryptSvc        (4f5414602e2544a4554d95517948b705) C:\Windows\system32\cryptsvc.dll
23:04:11.0774 5884	CryptSvc - ok
23:04:11.0821 5884	CSC             (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
23:04:11.0883 5884	CSC - ok
23:04:11.0946 5884	CscService      (3ab183ab4d2c79dcf459cd2c1266b043) C:\Windows\System32\cscsvc.dll
23:04:12.0008 5884	CscService - ok
23:04:12.0055 5884	CtClsFlt        (bc3d4f90978cd7c8eabd1baf3bf7873a) C:\Windows\system32\DRIVERS\CtClsFlt.sys
23:04:12.0102 5884	CtClsFlt - ok
23:04:12.0351 5884	cvhsvc          (72794d112cbaff3bc0c29bf7350d4741) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
23:04:12.0398 5884	cvhsvc - ok
23:04:12.0539 5884	DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
23:04:12.0617 5884	DcomLaunch - ok
23:04:12.0695 5884	defragsvc       (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
23:04:12.0788 5884	defragsvc - ok
23:04:12.0835 5884	DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
23:04:12.0913 5884	DfsC - ok
23:04:12.0960 5884	Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
23:04:13.0038 5884	Dhcp - ok
23:04:13.0069 5884	discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
23:04:13.0116 5884	discache - ok
23:04:13.0178 5884	Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\drivers\disk.sys
23:04:13.0209 5884	Disk - ok
23:04:13.0241 5884	dmvsc           (5db085a8a6600be6401f2b24eecb5415) C:\Windows\system32\drivers\dmvsc.sys
23:04:13.0287 5884	dmvsc - ok
23:04:13.0350 5884	Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
23:04:13.0412 5884	Dnscache - ok
23:04:13.0459 5884	dot3svc         (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
23:04:13.0568 5884	dot3svc - ok
23:04:13.0693 5884	DpHost          (c43618154fc0c8480f53b04ba7a2f371) C:\Program Files\DigitalPersona\Bin\DpHostW.exe
23:04:13.0724 5884	DpHost - ok
23:04:13.0802 5884	DPS             (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
23:04:13.0880 5884	DPS - ok
23:04:13.0911 5884	drmkaud         (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
23:04:13.0958 5884	drmkaud - ok
23:04:14.0052 5884	DXGKrnl         (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
23:04:14.0114 5884	DXGKrnl - ok
23:04:14.0223 5884	EapHost         (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
23:04:14.0286 5884	EapHost - ok
23:04:14.0613 5884	ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\drivers\evbda.sys
23:04:14.0691 5884	ebdrv - ok
23:04:15.0003 5884	EFS             (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
23:04:15.0050 5884	EFS - ok
23:04:15.0487 5884	ehRecvr         (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
23:04:15.0549 5884	ehRecvr - ok
23:04:15.0549 5884	ehSched         (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
23:04:15.0581 5884	ehSched - ok
23:04:15.0721 5884	elxstor         (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\drivers\elxstor.sys
23:04:15.0768 5884	elxstor - ok
23:04:15.0783 5884	ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
23:04:15.0799 5884	ErrDev - ok
23:04:15.0846 5884	EventSystem     (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
23:04:15.0908 5884	EventSystem - ok
23:04:15.0939 5884	exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
23:04:16.0002 5884	exfat - ok
23:04:16.0080 5884	fastfat         (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
23:04:16.0158 5884	fastfat - ok
23:04:16.0220 5884	Fax             (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
23:04:16.0298 5884	Fax - ok
23:04:16.0314 5884	fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\drivers\fdc.sys
23:04:16.0361 5884	fdc - ok
23:04:16.0392 5884	fdPHost         (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
23:04:16.0454 5884	fdPHost - ok
23:04:16.0470 5884	FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
23:04:16.0501 5884	FDResPub - ok
23:04:16.0517 5884	FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
23:04:16.0532 5884	FileInfo - ok
23:04:16.0532 5884	Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
23:04:16.0595 5884	Filetrace - ok
23:04:16.0626 5884	flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\drivers\flpydisk.sys
23:04:16.0657 5884	flpydisk - ok
23:04:16.0719 5884	FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
23:04:16.0751 5884	FltMgr - ok
23:04:16.0797 5884	FLxHCIc         (f910874e4789dc95f37d2cf6285a85fa) C:\Windows\system32\DRIVERS\FLxHCIc.sys
23:04:16.0813 5884	FLxHCIc - ok
23:04:16.0844 5884	FLxHCIh         (b957f9a14f696dbc0dc65497aafd0ca4) C:\Windows\system32\DRIVERS\FLxHCIh.sys
23:04:16.0860 5884	FLxHCIh - ok
23:04:16.0938 5884	FontCache       (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
23:04:17.0047 5884	FontCache - ok
23:04:17.0109 5884	FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
23:04:17.0125 5884	FontCache3.0.0.0 - ok
23:04:17.0156 5884	FsDepends       (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
23:04:17.0172 5884	FsDepends - ok
23:04:17.0203 5884	Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
23:04:17.0234 5884	Fs_Rec - ok
23:04:17.0265 5884	fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
23:04:17.0312 5884	fvevol - ok
23:04:17.0359 5884	gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\drivers\gagp30kx.sys
23:04:17.0375 5884	gagp30kx - ok
23:04:17.0437 5884	gpsvc           (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
23:04:17.0531 5884	gpsvc - ok
23:04:17.0562 5884	hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
23:04:17.0609 5884	hcw85cir - ok
23:04:17.0655 5884	HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
23:04:17.0718 5884	HdAudAddService - ok
23:04:17.0749 5884	HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\DRIVERS\HDAudBus.sys
23:04:17.0796 5884	HDAudBus - ok
23:04:17.0811 5884	HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\drivers\HidBatt.sys
23:04:17.0827 5884	HidBatt - ok
23:04:17.0858 5884	HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
23:04:17.0874 5884	HidBth - ok
23:04:17.0889 5884	HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\drivers\hidir.sys
23:04:17.0921 5884	HidIr - ok
23:04:17.0952 5884	hidserv         (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
23:04:18.0045 5884	hidserv - ok
23:04:18.0077 5884	HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
23:04:18.0108 5884	HidUsb - ok
23:04:18.0155 5884	hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
23:04:18.0248 5884	hkmsvc - ok
23:04:18.0264 5884	HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
23:04:18.0295 5884	HomeGroupListener - ok
23:04:18.0326 5884	HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
23:04:18.0357 5884	HomeGroupProvider - ok
23:04:18.0404 5884	HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
23:04:18.0420 5884	HpSAMD - ok
23:04:18.0467 5884	HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
23:04:18.0560 5884	HTTP - ok
23:04:18.0576 5884	hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
23:04:18.0591 5884	hwpolicy - ok
23:04:18.0607 5884	i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys
23:04:18.0623 5884	i8042prt - ok
23:04:18.0654 5884	iaStor          (d469b77687e12fe43e344806740b624d) C:\Windows\system32\drivers\iaStor.sys
23:04:18.0654 5884	iaStor - ok
23:04:18.0701 5884	iaStorV         (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
23:04:18.0747 5884	iaStorV - ok
23:04:18.0857 5884	idsvc           (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
23:04:18.0919 5884	idsvc - ok
23:04:18.0950 5884	iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\drivers\iirsp.sys
23:04:18.0981 5884	iirsp - ok
23:04:19.0059 5884	IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
23:04:19.0200 5884	IKEEXT - ok
23:04:19.0340 5884	IntcAzAudAddService (1b491f385ee96f9d9ee4cb430c8cd29e) C:\Windows\system32\drivers\RTKVHD64.sys
23:04:19.0403 5884	IntcAzAudAddService - ok
23:04:19.0512 5884	IntcDAud        (fc727061c0f47c8059e88e05d5c8e381) C:\Windows\system32\DRIVERS\IntcDAud.sys
23:04:19.0574 5884	IntcDAud - ok
23:04:19.0590 5884	intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
23:04:19.0621 5884	intelide - ok
23:04:20.0073 5884	intelkmd        (33faa40b288002c89529dbd14f3ab72c) C:\Windows\system32\DRIVERS\igdpmd64.sys
23:04:20.0370 5884	intelkmd - ok
23:04:20.0479 5884	intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
23:04:20.0510 5884	intelppm - ok
23:04:20.0541 5884	IPBusEnum       (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
23:04:20.0635 5884	IPBusEnum - ok
23:04:20.0666 5884	IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
23:04:20.0697 5884	IpFilterDriver - ok
23:04:20.0713 5884	IPMIDRV         (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
23:04:20.0713 5884	IPMIDRV - ok
23:04:20.0744 5884	IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
23:04:20.0807 5884	IPNAT - ok
23:04:20.0838 5884	IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
23:04:20.0869 5884	IRENUM - ok
23:04:20.0885 5884	isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
23:04:20.0900 5884	isapnp - ok
23:04:20.0916 5884	iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
23:04:20.0931 5884	iScsiPrt - ok
23:04:20.0963 5884	kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
23:04:20.0978 5884	kbdclass - ok
23:04:21.0009 5884	kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
23:04:21.0041 5884	kbdhid - ok
23:04:21.0087 5884	KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
23:04:21.0103 5884	KeyIso - ok
23:04:21.0134 5884	KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
23:04:21.0150 5884	KSecDD - ok
23:04:21.0181 5884	KSecPkg         (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
23:04:21.0197 5884	KSecPkg - ok
23:04:21.0228 5884	ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
23:04:21.0306 5884	ksthunk - ok
23:04:21.0337 5884	KtmRm           (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
23:04:21.0431 5884	KtmRm - ok
23:04:21.0462 5884	LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
23:04:21.0524 5884	LanmanServer - ok
23:04:21.0571 5884	LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
23:04:21.0649 5884	LanmanWorkstation - ok
23:04:21.0680 5884	lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
23:04:21.0711 5884	lltdio - ok
23:04:21.0758 5884	lltdsvc         (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
23:04:21.0852 5884	lltdsvc - ok
23:04:21.0852 5884	lmhosts         (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
23:04:21.0883 5884	lmhosts - ok
23:04:21.0992 5884	LMS             (7f32d4c47a50e7223491e8fb9359907d) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
23:04:22.0023 5884	LMS - ok
23:04:22.0055 5884	LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\drivers\lsi_fc.sys
23:04:22.0086 5884	LSI_FC - ok
23:04:22.0117 5884	LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\drivers\lsi_sas.sys
23:04:22.0148 5884	LSI_SAS - ok
23:04:22.0164 5884	LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\drivers\lsi_sas2.sys
23:04:22.0179 5884	LSI_SAS2 - ok
23:04:22.0211 5884	LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\drivers\lsi_scsi.sys
23:04:22.0211 5884	LSI_SCSI - ok
23:04:22.0226 5884	luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
23:04:22.0273 5884	luafv - ok
23:04:22.0304 5884	MBAMProtector   (dbc08862a71459e74f7538b432c114cc) C:\Windows\system32\drivers\mbam.sys
23:04:22.0320 5884	MBAMProtector - ok
23:04:22.0367 5884	MBAMService     (ba400ed640bca1eae5c727ae17c10207) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
23:04:22.0413 5884	MBAMService - ok
23:04:22.0445 5884	Mcx2Svc         (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
23:04:22.0476 5884	Mcx2Svc - ok
23:04:22.0507 5884	megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\drivers\megasas.sys
23:04:22.0538 5884	megasas - ok
23:04:22.0569 5884	MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\drivers\MegaSR.sys
23:04:22.0601 5884	MegaSR - ok
23:04:22.0647 5884	MEIx64          (a6518dcc42f7a6e999bb3bea8fd87567) C:\Windows\system32\DRIVERS\HECIx64.sys
23:04:22.0663 5884	MEIx64 - ok
23:04:22.0694 5884	MMCSS           (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
23:04:22.0757 5884	MMCSS - ok
23:04:22.0772 5884	Modem           (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
23:04:22.0803 5884	Modem - ok
23:04:22.0850 5884	monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
23:04:22.0881 5884	monitor - ok
23:04:22.0913 5884	mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
23:04:22.0928 5884	mouclass - ok
23:04:22.0944 5884	mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
23:04:22.0959 5884	mouhid - ok
23:04:22.0991 5884	mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
23:04:23.0022 5884	mountmgr - ok
23:04:23.0115 5884	MozillaMaintenance (15d5398eed42c2504bb3d4fc875c15d1) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
23:04:23.0147 5884	MozillaMaintenance - ok
23:04:23.0162 5884	mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
23:04:23.0193 5884	mpio - ok
23:04:23.0209 5884	mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
23:04:23.0256 5884	mpsdrv - ok
23:04:23.0271 5884	MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
23:04:23.0287 5884	MRxDAV - ok
23:04:23.0412 5884	mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
23:04:23.0474 5884	mrxsmb - ok
23:04:23.0552 5884	mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
23:04:23.0599 5884	mrxsmb10 - ok
23:04:23.0630 5884	mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
23:04:23.0661 5884	mrxsmb20 - ok
23:04:23.0708 5884	msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
23:04:23.0739 5884	msahci - ok
23:04:23.0895 5884	msdsm           (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
23:04:23.0927 5884	msdsm - ok
23:04:24.0036 5884	MSDTC           (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
23:04:24.0083 5884	MSDTC - ok
23:04:24.0129 5884	Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
23:04:24.0161 5884	Msfs - ok
23:04:24.0176 5884	mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
23:04:24.0223 5884	mshidkmdf - ok
23:04:24.0254 5884	msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
23:04:24.0254 5884	msisadrv - ok
23:04:24.0301 5884	MSiSCSI         (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
23:04:24.0379 5884	MSiSCSI - ok
23:04:24.0379 5884	msiserver - ok
23:04:24.0426 5884	MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
23:04:24.0504 5884	MSKSSRV - ok
23:04:24.0551 5884	MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
23:04:24.0644 5884	MSPCLOCK - ok
23:04:24.0660 5884	MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
23:04:24.0691 5884	MSPQM - ok
23:04:24.0722 5884	MsRPC           (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
23:04:24.0738 5884	MsRPC - ok
23:04:24.0753 5884	mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys
23:04:24.0769 5884	mssmbios - ok
23:04:24.0785 5884	MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
23:04:24.0816 5884	MSTEE - ok
23:04:24.0816 5884	MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\drivers\MTConfig.sys
23:04:24.0831 5884	MTConfig - ok
23:04:24.0831 5884	Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
23:04:24.0847 5884	Mup - ok
23:04:24.0894 5884	napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
23:04:24.0987 5884	napagent - ok
23:04:25.0050 5884	NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
23:04:25.0112 5884	NativeWifiP - ok
23:04:25.0175 5884	NDIS            (c38b8ae57f78915905064a9a24dc1586) C:\Windows\system32\drivers\ndis.sys
23:04:25.0237 5884	NDIS - ok
23:04:25.0268 5884	NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
23:04:25.0331 5884	NdisCap - ok
23:04:25.0346 5884	NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
23:04:25.0362 5884	NdisTapi - ok
23:04:25.0377 5884	Ndisuio         (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
23:04:25.0409 5884	Ndisuio - ok
23:04:25.0409 5884	NdisWan         (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
23:04:25.0455 5884	NdisWan - ok
23:04:25.0455 5884	NDProxy         (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
23:04:25.0487 5884	NDProxy - ok
23:04:25.0502 5884	NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
23:04:25.0549 5884	NetBIOS - ok
23:04:25.0565 5884	NetBT           (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
23:04:25.0596 5884	NetBT - ok
23:04:25.0611 5884	Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
23:04:25.0611 5884	Netlogon - ok
23:04:25.0658 5884	Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
23:04:25.0705 5884	Netman - ok
23:04:25.0814 5884	NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
23:04:25.0845 5884	NetMsmqActivator - ok
23:04:25.0861 5884	NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
23:04:25.0877 5884	NetPipeActivator - ok
23:04:25.0908 5884	netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
23:04:26.0001 5884	netprofm - ok
23:04:26.0017 5884	NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
23:04:26.0033 5884	NetTcpActivator - ok
23:04:26.0048 5884	NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
23:04:26.0048 5884	NetTcpPortSharing - ok
23:04:26.0111 5884	netvsc          (73ce12b8bdd747b0063cb0a7ef44cea7) C:\Windows\system32\DRIVERS\netvsc60.sys
23:04:26.0157 5884	netvsc - ok
23:04:26.0189 5884	nfrd960         (77889813be4d166cdab78ddba990da92) C:\Windows\system32\drivers\nfrd960.sys
23:04:26.0220 5884	nfrd960 - ok
23:04:26.0267 5884	NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
23:04:26.0360 5884	NlaSvc - ok
23:04:26.0563 5884	NOBU            (b9b72faaaa41d59b73b88fe3dd737ed1) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
23:04:26.0688 5884	NOBU - ok
23:04:26.0781 5884	Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
23:04:26.0859 5884	Npfs - ok
23:04:26.0891 5884	nsi             (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
23:04:26.0922 5884	nsi - ok
23:04:26.0937 5884	nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
23:04:27.0015 5884	nsiproxy - ok
23:04:27.0109 5884	Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
23:04:27.0234 5884	Ntfs - ok
23:04:27.0390 5884	ntrtscan        (f632dd8aa5c388d1d0528a876a71320d) c:\Program Files (x86)\Trend Micro\Client Server Security Agent\ntrtscan.exe
23:04:27.0499 5884	ntrtscan - ok
23:04:27.0577 5884	Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
23:04:27.0671 5884	Null - ok
23:04:27.0686 5884	nusb3hub        (d584abb6a308933a5f72b46c9e5a783f) C:\Windows\system32\drivers\nusb3hub.sys
23:04:27.0717 5884	nusb3hub - ok
23:04:27.0749 5884	nusb3xhc        (345b9c04e2036da4346e3249a5bdfd06) C:\Windows\system32\drivers\nusb3xhc.sys
23:04:27.0795 5884	nusb3xhc - ok
23:04:27.0842 5884	nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
23:04:27.0873 5884	nvraid - ok
23:04:27.0905 5884	nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
23:04:27.0951 5884	nvstor - ok
23:04:27.0967 5884	nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
23:04:27.0983 5884	nv_agp - ok
23:04:27.0983 5884	ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
23:04:28.0014 5884	ohci1394 - ok
23:04:28.0092 5884	ose             (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
23:04:28.0123 5884	ose - ok
23:04:28.0388 5884	osppsvc         (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
23:04:28.0591 5884	osppsvc - ok
23:04:28.0685 5884	p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
23:04:28.0716 5884	p2pimsvc - ok
23:04:28.0763 5884	p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
23:04:28.0809 5884	p2psvc - ok
23:04:28.0856 5884	Parport         (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\drivers\parport.sys
23:04:28.0887 5884	Parport - ok
23:04:28.0919 5884	partmgr         (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
23:04:28.0950 5884	partmgr - ok
23:04:28.0981 5884	PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
23:04:29.0043 5884	PcaSvc - ok
23:04:29.0153 5884	PCDSRVC{1E208CE0-FB7451FF-06020101}_0 (7317a0b550f7ac0223b7070897670476) c:\program files\dell support center\pcdsrvc_x64.pkms
23:04:29.0199 5884	PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - ok
23:04:29.0231 5884	pci             (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
23:04:29.0246 5884	pci - ok
23:04:29.0277 5884	pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
23:04:29.0293 5884	pciide - ok
23:04:29.0340 5884	pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\drivers\pcmcia.sys
23:04:29.0371 5884	pcmcia - ok
23:04:29.0402 5884	pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
23:04:29.0418 5884	pcw - ok
23:04:29.0465 5884	PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
23:04:29.0589 5884	PEAUTH - ok
23:04:29.0667 5884	PeerDistSvc     (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll
23:04:29.0761 5884	PeerDistSvc - ok
23:04:29.0839 5884	PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
23:04:29.0870 5884	PerfHost - ok
23:04:30.0011 5884	pla             (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
23:04:30.0135 5884	pla - ok
23:04:30.0182 5884	PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
23:04:30.0245 5884	PlugPlay - ok
23:04:30.0260 5884	PNRPAutoReg     (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
23:04:30.0291 5884	PNRPAutoReg - ok
23:04:30.0323 5884	PNRPsvc         (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
23:04:30.0369 5884	PNRPsvc - ok
23:04:30.0416 5884	PolicyAgent     (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
23:04:30.0525 5884	PolicyAgent - ok
23:04:30.0572 5884	Power           (a2cca4fb273e6050f17a0a416cff2fcd) C:\Windows\system32\umpo.dll
23:04:30.0588 5884	Power - ok
23:04:30.0635 5884	PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
23:04:30.0728 5884	PptpMiniport - ok
23:04:30.0744 5884	Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\drivers\processr.sys
23:04:30.0775 5884	Processor - ok
23:04:30.0806 5884	ProfSvc         (53e83f1f6cf9d62f32801cf66d8352a8) C:\Windows\system32\profsvc.dll
23:04:30.0853 5884	ProfSvc - ok
23:04:30.0884 5884	ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
23:04:30.0915 5884	ProtectedStorage - ok
23:04:30.0962 5884	Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
23:04:31.0040 5884	Psched - ok
23:04:31.0071 5884	PxHlpa64        (87b04878a6d59d6c79251dc960c674c1) C:\Windows\system32\Drivers\PxHlpa64.sys
23:04:31.0087 5884	PxHlpa64 - ok
23:04:31.0181 5884	ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\drivers\ql2300.sys
23:04:31.0274 5884	ql2300 - ok
23:04:31.0368 5884	ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\drivers\ql40xx.sys
23:04:31.0399 5884	ql40xx - ok
23:04:31.0430 5884	QWAVE           (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
23:04:31.0477 5884	QWAVE - ok
23:04:31.0493 5884	QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
23:04:31.0539 5884	QWAVEdrv - ok
23:04:31.0617 5884	RapiMgr         (a55e7d0d873b2c97585b3b5926ac6ade) C:\Windows\WindowsMobile\rapimgr.dll
23:04:31.0649 5884	RapiMgr - ok
23:04:31.0680 5884	RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
23:04:31.0758 5884	RasAcd - ok
23:04:31.0789 5884	RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
23:04:31.0820 5884	RasAgileVpn - ok
23:04:31.0851 5884	RasAuto         (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
23:04:31.0945 5884	RasAuto - ok
23:04:31.0961 5884	Rasl2tp         (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
23:04:32.0039 5884	Rasl2tp - ok
23:04:32.0070 5884	RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
23:04:32.0085 5884	RasMan - ok
23:04:32.0117 5884	RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
23:04:32.0210 5884	RasPppoe - ok
23:04:32.0226 5884	RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
23:04:32.0257 5884	RasSstp - ok
23:04:32.0288 5884	rdbss           (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
23:04:32.0319 5884	rdbss - ok
23:04:32.0335 5884	rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
23:04:32.0351 5884	rdpbus - ok
23:04:32.0366 5884	RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
23:04:32.0382 5884	RDPCDD - ok
23:04:32.0413 5884	RDPDR           (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
23:04:32.0460 5884	RDPDR - ok
23:04:32.0491 5884	RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
23:04:32.0585 5884	RDPENCDD - ok
23:04:32.0600 5884	RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
23:04:32.0631 5884	RDPREFMP - ok
23:04:32.0663 5884	RDPWD           (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys
23:04:32.0709 5884	RDPWD - ok
23:04:32.0756 5884	rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
23:04:32.0787 5884	rdyboost - ok
23:04:32.0819 5884	RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
23:04:32.0897 5884	RemoteAccess - ok
23:04:32.0943 5884	RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
23:04:33.0006 5884	RemoteRegistry - ok
23:04:33.0053 5884	RFCOMM          (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys
23:04:33.0084 5884	RFCOMM - ok
23:04:33.0255 5884	RoxMediaDB12OEM (3c957189b31c34d3ad21967b12b6aed7) C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe
23:04:33.0333 5884	RoxMediaDB12OEM - ok
23:04:33.0380 5884	RoxWatch12      (2b73088cc2ca757a172b425c9398e5bc) C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe
23:04:33.0411 5884	RoxWatch12 - ok
23:04:33.0489 5884	RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
23:04:33.0583 5884	RpcEptMapper - ok
23:04:33.0599 5884	RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
23:04:33.0630 5884	RpcLocator - ok
23:04:33.0692 5884	RpcSs           (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
23:04:33.0739 5884	RpcSs - ok
23:04:33.0786 5884	rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
23:04:33.0848 5884	rspndr - ok
23:04:33.0895 5884	RSUSBSTOR       (135a64530d7699ad48f29d73a658dd11) C:\Windows\system32\Drivers\RtsUStor.sys
23:04:33.0911 5884	RSUSBSTOR - ok
23:04:33.0957 5884	RTL2832UBDA     (0bc1f83dc9cd93e233d7a5c0dfab9a12) C:\Windows\system32\drivers\RTL2832UBDA.sys
23:04:33.0973 5884	RTL2832UBDA - ok
23:04:34.0020 5884	RTL2832UUSB     (06560c03cac954b02cdda6aea1ba530c) C:\Windows\system32\Drivers\RTL2832UUSB.sys
23:04:34.0035 5884	RTL2832UUSB - ok
23:04:34.0098 5884	RTL2832U_IRHID  (ed0504e312ca3db775beabd47b49c660) C:\Windows\system32\DRIVERS\RTL2832U_IRHID.sys
23:04:34.0113 5884	RTL2832U_IRHID - ok
23:04:34.0176 5884	RTL8167         (9140db0911de035fed0a9a77a2d156ea) C:\Windows\system32\DRIVERS\Rt64win7.sys
23:04:34.0207 5884	RTL8167 - ok
23:04:34.0223 5884	s3cap           (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
23:04:34.0254 5884	s3cap - ok
23:04:34.0269 5884	SamSs           (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
23:04:34.0301 5884	SamSs - ok
23:04:34.0332 5884	sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
23:04:34.0347 5884	sbp2port - ok
23:04:34.0379 5884	SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
23:04:34.0457 5884	SCardSvr - ok
23:04:34.0472 5884	scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
23:04:34.0550 5884	scfilter - ok
23:04:34.0597 5884	Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
23:04:34.0691 5884	Schedule - ok
23:04:34.0722 5884	SCPolicySvc     (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
23:04:34.0737 5884	SCPolicySvc - ok
23:04:34.0769 5884	SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
23:04:34.0815 5884	SDRSVC - ok
23:04:34.0862 5884	secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
23:04:34.0940 5884	secdrv - ok
23:04:34.0956 5884	seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
23:04:34.0971 5884	seclogon - ok
23:04:34.0987 5884	SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
23:04:35.0018 5884	SENS - ok
23:04:35.0034 5884	SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
23:04:35.0049 5884	SensrSvc - ok
23:04:35.0081 5884	Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\drivers\serenum.sys
23:04:35.0112 5884	Serenum - ok
23:04:35.0127 5884	Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\drivers\serial.sys
23:04:35.0174 5884	Serial - ok
23:04:35.0190 5884	sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\drivers\sermouse.sys
23:04:35.0237 5884	sermouse - ok
23:04:35.0283 5884	SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
23:04:35.0346 5884	SessionEnv - ok
23:04:35.0346 5884	sffdisk         (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
23:04:35.0361 5884	sffdisk - ok
23:04:35.0361 5884	sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
23:04:35.0393 5884	sffp_mmc - ok
23:04:35.0393 5884	sffp_sd         (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
23:04:35.0408 5884	sffp_sd - ok
23:04:35.0408 5884	sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\drivers\sfloppy.sys
23:04:35.0439 5884	sfloppy - ok
23:04:35.0486 5884	Sftfs           (c6cc9297bd53e5229653303e556aa539) C:\Windows\system32\DRIVERS\Sftfslh.sys
23:04:35.0533 5884	Sftfs - ok
23:04:35.0627 5884	sftlist         (13693b6354dd6e72dc5131da7d764b90) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
23:04:35.0673 5884	sftlist - ok
23:04:35.0705 5884	Sftplay         (390aa7bc52cee43f6790cdea1e776703) C:\Windows\system32\DRIVERS\Sftplaylh.sys
23:04:35.0736 5884	Sftplay - ok
23:04:35.0751 5884	Sftredir        (617e29a0b0a2807466560d4c4e338d3e) C:\Windows\system32\DRIVERS\Sftredirlh.sys
23:04:35.0767 5884	Sftredir - ok
23:04:35.0783 5884	Sftvol          (8f571f016fa1976f445147e9e6c8ae9b) C:\Windows\system32\DRIVERS\Sftvollh.sys
23:04:35.0783 5884	Sftvol - ok
23:04:35.0814 5884	sftvsa          (c3cddd18f43d44ab713cf8c4916f7696) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
23:04:35.0814 5884	sftvsa - ok
23:04:35.0861 5884	ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
23:04:35.0892 5884	ShellHWDetection - ok
23:04:35.0923 5884	SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\drivers\SiSRaid2.sys
23:04:35.0923 5884	SiSRaid2 - ok
23:04:35.0939 5884	SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\drivers\sisraid4.sys
23:04:35.0954 5884	SiSRaid4 - ok
23:04:35.0985 5884	SkypeUpdate     (6128e98eaaed364ed1a32708d2fd22cb) C:\Program Files (x86)\Skype\Updater\Updater.exe
23:04:36.0017 5884	SkypeUpdate - ok
23:04:36.0032 5884	Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
23:04:36.0110 5884	Smb - ok
23:04:36.0141 5884	SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
23:04:36.0157 5884	SNMPTRAP - ok
23:04:36.0173 5884	spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
23:04:36.0173 5884	spldr - ok
23:04:36.0219 5884	Spooler         (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
23:04:36.0313 5884	Spooler - ok
23:04:36.0453 5884	sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
23:04:36.0578 5884	sppsvc - ok
23:04:36.0672 5884	sppuinotify     (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
23:04:36.0750 5884	sppuinotify - ok
23:04:36.0828 5884	srv             (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
23:04:36.0890 5884	srv - ok
23:04:36.0921 5884	srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
23:04:36.0968 5884	srv2 - ok
23:04:36.0999 5884	srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
23:04:37.0031 5884	srvnet - ok
23:04:37.0093 5884	SSDPSRV         (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
23:04:37.0187 5884	SSDPSRV - ok
23:04:37.0249 5884	SSPORT          (0211ab46b73a2623b86c1cfcb30579ab) C:\Windows\system32\Drivers\SSPORT.sys
23:04:37.0265 5884	SSPORT - ok
23:04:37.0280 5884	SstpSvc         (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
23:04:37.0343 5884	SstpSvc - ok
23:04:37.0358 5884	stdcfltn        (92e7f6666633d2dd91d527503daa7be0) C:\Windows\system32\DRIVERS\stdcfltn.sys
23:04:37.0374 5884	stdcfltn - ok
23:04:37.0389 5884	stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\drivers\stexstor.sys
23:04:37.0421 5884	stexstor - ok
23:04:37.0467 5884	stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
23:04:37.0545 5884	stisvc - ok
23:04:37.0608 5884	stllssvr        (7731f46ec0d687a931cba063e8f90ef0) C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
23:04:37.0639 5884	stllssvr - ok
23:04:37.0655 5884	StorSvc         (c40841817ef57d491f22eb103da587cc) C:\Windows\system32\storsvc.dll
23:04:37.0717 5884	StorSvc - ok
23:04:37.0733 5884	storvsc         (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
23:04:37.0764 5884	storvsc - ok
23:04:37.0826 5884	svcGenericHost  (15323ae5d254aa1d389522166e6f4244) c:\Program Files (x86)\Trend Micro\Client Server Security Agent\HostedAgent\svcGenericHost.exe
23:04:37.0842 5884	svcGenericHost - ok
23:04:37.0873 5884	swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys
23:04:37.0904 5884	swenum - ok
23:04:37.0951 5884	swprv           (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
23:04:38.0060 5884	swprv - ok
23:04:38.0091 5884	SynthVid        (4cdd7df58730d23ba9cb5829a6e2ecea) C:\Windows\system32\DRIVERS\VMBusVideoM.sys
23:04:38.0123 5884	SynthVid - ok
23:04:38.0232 5884	SynTP           (aad83760a0887975d8f524b4d2c86060) C:\Windows\system32\DRIVERS\SynTP.sys
23:04:38.0294 5884	SynTP - ok
23:04:38.0466 5884	SysMain         (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
23:04:38.0575 5884	SysMain - ok
23:04:38.0637 5884	TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
23:04:38.0684 5884	TabletInputService - ok
23:04:38.0715 5884	TapiSrv         (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
23:04:38.0825 5884	TapiSrv - ok
23:04:38.0856 5884	TBS             (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
23:04:38.0871 5884	TBS - ok
23:04:39.0012 5884	Tcpip           (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
23:04:39.0137 5884	Tcpip - ok
23:04:39.0277 5884	TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
23:04:39.0371 5884	TCPIP6 - ok
23:04:39.0433 5884	tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
23:04:39.0527 5884	tcpipreg - ok
23:04:39.0542 5884	TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
23:04:39.0573 5884	TDPIPE - ok
23:04:39.0589 5884	TDTCP           (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
23:04:39.0605 5884	TDTCP - ok
23:04:39.0636 5884	tdx             (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
23:04:39.0683 5884	tdx - ok
23:04:39.0714 5884	TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\DRIVERS\termdd.sys
23:04:39.0729 5884	TermDD - ok
23:04:39.0776 5884	TermService     (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
23:04:39.0885 5884	TermService - ok
23:04:39.0901 5884	Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
23:04:39.0917 5884	Themes - ok
23:04:39.0932 5884	THREADORDER     (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
23:04:39.0963 5884	THREADORDER - ok
23:04:40.0057 5884	TMBMServer      (963c903e5176c5cdcae321d48635b21f) c:\Program Files (x86)\Trend Micro\BM\TMBMSRV.exe
23:04:40.0104 5884	TMBMServer - ok
23:04:40.0182 5884	TmFilter        (8b97ba7e28bd39a2bc4a2bb66a83fec0) c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmXPFlt.sys
23:04:40.0213 5884	TmFilter - ok
23:04:40.0322 5884	tmlisten        (e5f23152b394fdebc53b07e2b2e64c62) c:\Program Files (x86)\Trend Micro\Client Server Security Agent\tmlisten.exe
23:04:40.0400 5884	tmlisten - ok
23:04:40.0525 5884	tmlwf           (b5c00fc8786a237937c33aabee68ca26) C:\Windows\system32\DRIVERS\tmlwf.sys
23:04:40.0541 5884	tmlwf - ok
23:04:40.0665 5884	TmPfw           (48d09383511757645c0a828622ef5ab3) c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmPfw.exe
23:04:40.0728 5884	TmPfw - ok
23:04:40.0728 5884	TmPreFilter     (1889f49a828b1cf0e2866cdd325875b0) c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmPreFlt.sys
23:04:40.0759 5884	TmPreFilter - ok
23:04:40.0806 5884	TmProxy         (19d6f618802f93c0ed9ea89e5cd6e12e) c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmProxy.exe
23:04:40.0868 5884	TmProxy - ok
23:04:40.0977 5884	tmtdi           (a42e6780c52b248af54c6010a9a93384) C:\Windows\system32\DRIVERS\tmtdi.sys
23:04:40.0993 5884	tmtdi - ok
23:04:41.0055 5884	tmwfp           (5d38c32a4b093bc8190cf3fb9078c9cd) C:\Windows\system32\DRIVERS\tmwfp.sys
23:04:41.0087 5884	tmwfp - ok
23:04:41.0118 5884	TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
23:04:41.0180 5884	TrkWks - ok
23:04:41.0243 5884	TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
23:04:41.0321 5884	TrustedInstaller - ok
23:04:41.0352 5884	tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
23:04:41.0383 5884	tssecsrv - ok
23:04:41.0414 5884	TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
23:04:41.0461 5884	TsUsbFlt - ok
23:04:41.0461 5884	TsUsbGD         (9cc2ccae8a84820eaecb886d477cbcb8) C:\Windows\system32\drivers\TsUsbGD.sys
23:04:41.0492 5884	TsUsbGD - ok
23:04:41.0508 5884	tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
23:04:41.0586 5884	tunnel - ok
23:04:41.0601 5884	TurboB          (fd24f98d2898be093fe926604be7db99) C:\Windows\system32\DRIVERS\TurboB.sys
23:04:41.0601 5884	TurboB - ok
23:04:41.0648 5884	TurboBoost      (600b406a04d90f577fea8a88d7379f08) C:\Program Files\Intel\TurboBoost\TurboBoost.exe
23:04:41.0679 5884	TurboBoost - ok
23:04:41.0711 5884	uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\drivers\uagp35.sys
23:04:41.0726 5884	uagp35 - ok
23:04:41.0742 5884	udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
23:04:41.0835 5884	udfs - ok
23:04:41.0851 5884	UI0Detect       (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
23:04:41.0882 5884	UI0Detect - ok
23:04:41.0898 5884	uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
23:04:41.0929 5884	uliagpkx - ok
23:04:41.0945 5884	umbus           (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
23:04:41.0991 5884	umbus - ok
23:04:42.0007 5884	UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\drivers\umpass.sys
23:04:42.0038 5884	UmPass - ok
23:04:42.0085 5884	UmRdpService    (a293dcd756d04d8492a750d03b9a297c) C:\Windows\System32\umrdp.dll
23:04:42.0132 5884	UmRdpService - ok
23:04:42.0303 5884	UNS             (2c16648a12999ae69a9ebf41974b0ba2) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
23:04:42.0444 5884	UNS - ok
23:04:42.0537 5884	upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
23:04:42.0647 5884	upnphost - ok
23:04:42.0709 5884	usbccgp         (19ad7990c0b67e48dac5b26f99628223) C:\Windows\system32\DRIVERS\usbccgp.sys
23:04:42.0725 5884	usbccgp - ok
23:04:42.0756 5884	usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
23:04:42.0787 5884	usbcir - ok
23:04:42.0803 5884	usbehci         (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
23:04:42.0834 5884	usbehci - ok
23:04:42.0865 5884	usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
23:04:42.0912 5884	usbhub - ok
23:04:42.0927 5884	usbohci         (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
23:04:42.0974 5884	usbohci - ok
23:04:42.0990 5884	usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\drivers\usbprint.sys
23:04:43.0037 5884	usbprint - ok
23:04:43.0052 5884	USBSTOR         (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
23:04:43.0083 5884	USBSTOR - ok
23:04:43.0115 5884	usbuhci         (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
23:04:43.0161 5884	usbuhci - ok
23:04:43.0208 5884	usbvideo        (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\system32\Drivers\usbvideo.sys
23:04:43.0255 5884	usbvideo - ok
23:04:43.0286 5884	UxSms           (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
23:04:43.0333 5884	UxSms - ok
23:04:43.0349 5884	VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
23:04:43.0364 5884	VaultSvc - ok
23:04:43.0520 5884	vcsFPService    (20bf96c13db4ba085d98f4700f3b05fe) C:\Windows\system32\vcsFPService.exe
23:04:43.0645 5884	vcsFPService - ok
23:04:43.0739 5884	vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
23:04:43.0754 5884	vdrvroot - ok
23:04:43.0801 5884	vds             (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
23:04:43.0910 5884	vds - ok
23:04:43.0926 5884	vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
23:04:43.0941 5884	vga - ok
23:04:43.0957 5884	VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
23:04:43.0988 5884	VgaSave - ok
23:04:44.0019 5884	vhdmp           (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
23:04:44.0035 5884	vhdmp - ok
23:04:44.0035 5884	viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
23:04:44.0051 5884	viaide - ok
23:04:44.0082 5884	VMBusHID        (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
23:04:44.0113 5884	VMBusHID - ok
23:04:44.0129 5884	volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
23:04:44.0144 5884	volmgr - ok
23:04:44.0191 5884	volmgrx         (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
23:04:44.0222 5884	volmgrx - ok
23:04:44.0253 5884	volsnap         (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
23:04:44.0285 5884	volsnap - ok
23:04:44.0456 5884	VSApiNt         (3a5862d9a4fe4bbb2ffa1700e2b21b9b) c:\Program Files (x86)\Trend Micro\Client Server Security Agent\VSApiNt.sys
23:04:44.0534 5884	VSApiNt - ok
23:04:44.0628 5884	vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\drivers\vsmraid.sys
23:04:44.0659 5884	vsmraid - ok
23:04:44.0768 5884	VSS             (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
23:04:44.0893 5884	VSS - ok
23:04:44.0940 5884	vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
23:04:44.0987 5884	vwifibus - ok
23:04:45.0018 5884	vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
23:04:45.0065 5884	vwififlt - ok
23:04:45.0127 5884	W32Time         (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
23:04:45.0189 5884	W32Time - ok
23:04:45.0221 5884	WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\drivers\wacompen.sys
23:04:45.0236 5884	WacomPen - ok
23:04:45.0267 5884	WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
23:04:45.0345 5884	WANARP - ok
23:04:45.0361 5884	Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
23:04:45.0392 5884	Wanarpv6 - ok
23:04:45.0470 5884	wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
23:04:45.0579 5884	wbengine - ok
23:04:45.0673 5884	WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
23:04:45.0720 5884	WbioSrvc - ok
23:04:45.0813 5884	WcesComm        (8bda6db43aa54e8bb5e0794541ddc209) C:\Windows\WindowsMobile\wcescomm.dll
23:04:45.0845 5884	WcesComm - ok
23:04:45.0876 5884	wcncsvc         (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
23:04:45.0954 5884	wcncsvc - ok
23:04:45.0969 5884	WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
23:04:46.0016 5884	WcsPlugInService - ok
23:04:46.0063 5884	Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\drivers\wd.sys
23:04:46.0094 5884	Wd - ok
23:04:46.0125 5884	Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
23:04:46.0188 5884	Wdf01000 - ok
23:04:46.0219 5884	WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
23:04:46.0313 5884	WdiServiceHost - ok
23:04:46.0328 5884	WdiSystemHost   (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
23:04:46.0359 5884	WdiSystemHost - ok
23:04:46.0391 5884	WebClient       (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
23:04:46.0422 5884	WebClient - ok
23:04:46.0437 5884	Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
23:04:46.0515 5884	Wecsvc - ok
23:04:46.0531 5884	wercplsupport   (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
23:04:46.0562 5884	wercplsupport - ok
23:04:46.0578 5884	WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
23:04:46.0609 5884	WerSvc - ok
23:04:46.0656 5884	WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
23:04:46.0718 5884	WfpLwf - ok
23:04:46.0734 5884	WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
23:04:46.0749 5884	WIMMount - ok
23:04:46.0749 5884	WinHttpAutoProxySvc - ok
23:04:46.0796 5884	Winmgmt         (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
23:04:46.0890 5884	Winmgmt - ok
23:04:46.0983 5884	WinRM           (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
23:04:47.0124 5884	WinRM - ok
23:04:47.0249 5884	WinUSB          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUSB.sys
23:04:47.0295 5884	WinUSB - ok
23:04:47.0358 5884	Wlansvc         (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
23:04:47.0436 5884	Wlansvc - ok
23:04:47.0498 5884	wlcrasvc        (06c8fa1cf39de6a735b54d906ba791c6) C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
23:04:47.0514 5884	wlcrasvc - ok
23:04:47.0701 5884	wlidsvc         (2bacd71123f42cea603f4e205e1ae337) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
23:04:47.0826 5884	wlidsvc - ok
23:04:47.0919 5884	WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys
23:04:47.0951 5884	WmiAcpi - ok
23:04:48.0013 5884	wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
23:04:48.0060 5884	wmiApSrv - ok
23:04:48.0107 5884	WMPNetworkSvc - ok
23:04:48.0153 5884	WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
23:04:48.0185 5884	WPCSvc - ok
23:04:48.0200 5884	WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
23:04:48.0247 5884	WPDBusEnum - ok
23:04:48.0263 5884	ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
23:04:48.0341 5884	ws2ifsl - ok
23:04:48.0356 5884	WSearch - ok
23:04:48.0387 5884	WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
23:04:48.0419 5884	WudfPf - ok
23:04:48.0450 5884	WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
23:04:48.0481 5884	WUDFRd - ok
23:04:48.0497 5884	wudfsvc         (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
23:04:48.0512 5884	wudfsvc - ok
23:04:48.0543 5884	WwanSvc         (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
23:04:48.0559 5884	WwanSvc - ok
23:04:48.0590 5884	MBR (0x1B8)     (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
23:04:48.0871 5884	\Device\Harddisk0\DR0 - ok
23:04:48.0887 5884	Boot (0x1200)   (c3a300e8db7622e6f74ceb12e4bc07ce) \Device\Harddisk0\DR0\Partition0
23:04:48.0887 5884	\Device\Harddisk0\DR0\Partition0 - ok
23:04:48.0918 5884	Boot (0x1200)   (080b07f6917fde64ced87bde719a2e87) \Device\Harddisk0\DR0\Partition1
23:04:48.0918 5884	\Device\Harddisk0\DR0\Partition1 - ok
23:04:48.0949 5884	Boot (0x1200)   (5cc295ec1bbcecb5c6e1577a0f39123b) \Device\Harddisk0\DR0\Partition2
23:04:48.0949 5884	\Device\Harddisk0\DR0\Partition2 - ok
23:04:48.0949 5884	============================================================
23:04:48.0949 5884	Scan finished
23:04:48.0949 5884	============================================================
23:04:48.0980 5440	Detected object count: 0
23:04:48.0980 5440	Actual detected object count: 0
         
Firewall geht weiterhin nicht!

Alt 06.07.2012, 09:30   #12
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden - Standard

Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden



Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 07.07.2012, 07:23   #13
nimbu
 
Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden - Standard

Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden



Hi,
Combofix lief. Die Fehlermeldungen kamen auch, allerdings sind sie nach dem Neustart verschwunden. Die Firewall funzt auch wieder!
Hier noch das Logfile vom COmbofix

Code:
ATTFilter
ComboFix 12-07-06.02 - *** 07.07.2012   0:44.1.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3990.2560 [GMT 2:00]
ausgeführt von:: c:\users\***\Desktop\ComboFix.exe
AV: Trend Micro Client/Server Security Agent *Enabled/Updated* {7193B549-236F-55EE-9AEC-F65279E59A92}
FW: Trend Micro Personal Firewall *Enabled* {50C2E989-60CF-0845-AFD3-290B7D301E79}
SP: Trend Micro Client/Server Security Agent Anti-Spyware *Enabled/Updated* {CAF254AD-0555-5A60-A05C-CD200262D02F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\PCDr\5907\Downloads\16ab6978-b6b5-41fa-81a1-8bffc55a69b9.dll
c:\programdata\PCDr\5907\Downloads\9a727e3b-3b75-44f1-aa0c-b5b6cd760030.dll
c:\programdata\PCDr\5907\Downloads\a31dcb19-c462-4b91-b5af-0c0196d8d501.dll
c:\programdata\PCDr\5907\Downloads\eb1a169a-7868-4b2c-ae46-52b55b4db151.dll
.
Infizierte Kopie von c:\windows\system32\Services.exe wurde gefunden und desinfiziert 
Kopie von - c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe wurde wiederhergestellt 
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-06-06 bis 2012-07-06  ))))))))))))))))))))))))))))))
.
.
2012-07-06 22:49 . 2012-07-06 22:49	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-07-04 17:51 . 2012-07-04 17:51	--------	d-----w-	C:\_OTL
2012-07-03 05:18 . 2012-07-03 05:18	--------	d-sh--w-	c:\windows\system32\%APPDATA%
2012-07-03 05:14 . 2012-07-03 05:14	--------	d-----w-	c:\program files (x86)\ESET
2012-07-02 19:52 . 2012-07-02 19:52	--------	d-----w-	c:\users\***\AppData\Roaming\Malwarebytes
2012-07-02 19:52 . 2012-07-02 19:52	--------	d-----w-	c:\programdata\Malwarebytes
2012-07-02 19:52 . 2012-07-02 19:52	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2012-07-02 19:52 . 2012-04-04 13:56	24904	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-06-25 21:07 . 2012-06-26 05:18	--------	d-----w-	c:\users\***\AppData\Roaming\dvdcss
2012-06-25 21:07 . 2012-06-26 05:19	--------	d-----w-	c:\users\***\AppData\Roaming\vlc
2012-06-25 21:05 . 2012-06-25 21:05	--------	d-----w-	c:\program files (x86)\VideoLAN
2012-06-25 18:41 . 2012-06-25 18:41	--------	d-----w-	c:\program files (x86)\DVD Shrink
2012-06-24 17:18 . 2012-06-24 17:18	770384	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcr100.dll
2012-06-24 17:18 . 2012-06-24 17:18	421200	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcp100.dll
2012-06-24 15:56 . 2012-07-05 06:13	--------	d-----w-	c:\programdata\DVD Shrink
2012-06-21 06:31 . 2012-06-02 22:19	57880	----a-w-	c:\windows\system32\wuauclt.exe
2012-06-21 06:31 . 2012-06-02 22:19	44056	----a-w-	c:\windows\system32\wups2.dll
2012-06-21 06:31 . 2012-06-02 22:15	2622464	----a-w-	c:\windows\system32\wucltux.dll
2012-06-21 06:31 . 2012-06-02 22:19	2428952	----a-w-	c:\windows\system32\wuaueng.dll
2012-06-21 06:31 . 2012-06-02 22:19	38424	----a-w-	c:\windows\system32\wups.dll
2012-06-21 06:31 . 2012-06-02 22:19	701976	----a-w-	c:\windows\system32\wuapi.dll
2012-06-21 06:31 . 2012-06-02 22:15	99840	----a-w-	c:\windows\system32\wudriver.dll
2012-06-21 06:31 . 2012-06-02 13:19	186752	----a-w-	c:\windows\system32\wuwebv.dll
2012-06-21 06:31 . 2012-06-02 13:15	36864	----a-w-	c:\windows\system32\wuapp.exe
2012-06-14 18:37 . 2012-04-26 05:41	77312	----a-w-	c:\windows\system32\rdpwsx.dll
2012-06-11 19:28 . 2012-06-11 19:28	--------	d-----w-	c:\users\***\AppData\Local\Macromedia
2012-06-07 20:53 . 2012-06-07 20:54	--------	d-----w-	c:\program files (x86)\USB Media Adaptor
2012-06-07 20:52 . 1998-10-29 14:45	306688	----a-w-	c:\windows\IsUninst.exe
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-01 17:49 . 2012-04-21 21:17	426184	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-01 17:49 . 2012-03-22 12:10	70344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-04-22 11:16 . 2010-06-24 16:33	19352	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-17 343168]
"OfficeScanNT Monitor"="c:\program files (x86)\Trend Micro\Client Server Security Agent\pccntmon.exe" [2012-01-09 1712656]
"Dell DataSafe Online"="c:\program files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe" [2010-08-26 1117528]
"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2011-02-23 371200]
"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"STO Backup Service"="c:\program files (x86)\SmarThru Office\BackUpSvr.exe" [2011-09-15 199760]
"STO Launcher Service"="c:\program files (x86)\SmarThru Office\x64\LegacyLauncher.exe" [2011-09-15 405584]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2011-1-13 1138464]
TMMonitor.lnk - c:\program files (x86)\ArcSoft\TotalMedia 3.5\TMMonitor.exe [2012-5-5 268864]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	DPPassFilter scecli
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-01 257224]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-24 113120]
R3 netvsc;netvsc;c:\windows\system32\DRIVERS\netvsc60.sys [2010-11-21 168448]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [2011-09-14 95744]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [2011-09-14 212992]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2012-04-10 25072]
R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-12-01 250984]
R3 RTL2832U_IRHID;HID Infrared Remote Receiver;c:\windows\system32\DRIVERS\RTL2832U_IRHID.sys [2011-06-13 48488]
R3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys [2011-05-17 225256]
R3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\Drivers\RTL2832UUSB.sys [2011-05-17 39016]
R3 SynthVid;SynthVid;c:\windows\system32\DRIVERS\VMBusVideoM.sys [2010-11-21 22528]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-11-29 149504]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]
S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys [2010-08-20 21616]
S1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;c:\windows\system32\DRIVERS\tmlwf.sys [2010-11-08 196688]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-03 63928]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-10-17 203264]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S2 NOBU;Dell DataSafe Online;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2011-03-14 11576]
S2 svcGenericHost;Trend Micro Client/Server Security Agent;c:\program files (x86)\Trend Micro\Client Server Security Agent\HostedAgent\svcGenericHost.exe [2012-02-07 50704]
S2 TmFilter;Trend Micro Filter;c:\program files (x86)\Trend Micro\Client Server Security Agent\TmXPFlt.sys [2011-07-12 342288]
S2 TmPreFilter;Trend Micro PreFilter;c:\program files (x86)\Trend Micro\Client Server Security Agent\TmPreFlt.sys [2011-07-12 42768]
S2 tmwfp;Trend Micro WFP Callout Driver;c:\windows\system32\DRIVERS\tmwfp.sys [2010-11-08 338000]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2010-11-29 16120]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-20 2656280]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2010-10-07 3137840]
S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Accelern.sys [2010-09-29 27760]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-10-17 9319424]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-10-17 304128]
S3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys [2011-01-14 349736]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2011-01-14 39464]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2011-01-20 176096]
S3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;c:\windows\system32\DRIVERS\FLxHCIc.sys [2011-09-05 212544]
S3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver;c:\windows\system32\DRIVERS\FLxHCIh.sys [2011-09-05 69184]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys [2011-08-09 12289472]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 24904]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-20 56344]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-08-24 565352]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
S3 TmPfw;Trend Micro Client/Server Security Agent Personal Firewall;c:\program files (x86)\Trend Micro\Client Server Security Agent\TmPfw.exe [2010-07-21 596032]
S3 TmProxy;Trend Micro Client/Server Security Agent Proxy-Dienst;c:\program files (x86)\Trend Micro\Client Server Security Agent\TmProxy.exe [2012-04-26 918032]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - TMWFP
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2012-07-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 17:49]
.
2012-06-23 c:\windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
- c:\program files\Dell Support Center\uaclauncher.exe [2012-04-13 06:11]
.
2012-06-24 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2012-04-13 06:11]
.
2012-07-06 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\Dell Support Center\uaclauncher.exe [2012-04-13 06:11]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-08-09 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-08-09 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-08-09 416024]
"FreeFallProtection"="c:\program files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe" [2010-10-01 727664]
"QuickSet"="c:\program files\Dell\QuickSet\QuickSet.exe" [2011-03-11 4500640]
"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]
"DBRMTray"="c:\dell\DBRM\Reminder\DbrmTrayIcon.exe" [2011-03-08 227328]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]
"CDAServer"="c:\program files\Common Files\Common Desktop Agent\CDASrv.exe" [2010-12-17 438784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: samsungsetup.com\www
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\9lp1iowa.default\
FF - prefs.js: network.proxy.type - 0
.
.
------- Dateityp-Verknüpfung -------
.
JSEFile=%SystemRoot%\SysWow64\CScript.exe "%1" %*
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-SunJavaUpdateSched - c:\program files (x86)\Java\jre7\bin\jusched.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020101}_0]
"ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files (x86)\DigitalPersona\Bin\DPAgent.exe
c:\program files (x86)\Trend Micro\Client Server Security Agent\HostedAgent\HostedAgent.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-07-07  01:00:08 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-07-06 23:00
.
Vor Suchlauf: 13 Verzeichnis(se), 101.626.404.864 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 101.315.457.024 Bytes frei
.
- - End Of File - - D1BFFFD07D7753D796F57339B5681410
         
Ist der Rechner jetzt wieder clean?

Und noch eine Frage. Mein Laptop ist per WLAN mit einer externen Festplatte verbunden. Kann sich die Malware auch dort eingenistet haben?

Alt 08.07.2012, 08:07   #14
nimbu
 
Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden - Standard

Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden



Hi,
gestern hatte Trend Micro wieder einen Fudn gemeldet. Ich war mir aber nciht sicher ob, das womöglich nur eine Datei aus einer der Quarantänen war. Ich habe daraufhin nochmal Malwarebytes und Eset scannen lassen, wie beim ersten mal beschrieben. Hier die Log-files.

Trendmicro

Code:
ATTFilter
20120701<;>1948<;>TROJ_GEN.RFFCDG1<;>10<;>1<;>0<;>C:\Users\***\AppData\Local\Temp\2222125.exe<;>
20120701<;>1948<;>TROJ_SIREF64.SM<;>1<;>1<;>0<;>C:\Users\***\AppData\Local\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\n<;>
20120701<;>1949<;>TROJ_SIREF64.SM<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\n<;>
20120701<;>1949<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>1953<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>1957<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2002<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2006<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2010<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2015<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2019<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2023<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2027<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2032<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2036<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2040<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2044<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2049<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2053<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2057<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2101<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2106<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2110<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2114<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2119<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2123<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2127<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2131<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2136<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2140<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2144<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2149<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2153<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2157<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2201<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2205<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2211<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2215<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2219<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2224<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2228<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2232<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2237<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2241<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2245<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2249<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2254<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2258<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2302<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120701<;>2306<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2151<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2156<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2200<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2204<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2209<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2213<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2217<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2221<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2226<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2230<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2234<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2238<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2243<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2247<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2251<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2255<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2300<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2304<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2308<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2313<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2317<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2321<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2325<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2330<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2334<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2338<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2342<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2347<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2351<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2355<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120702<;>2359<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>4<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>8<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>12<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>16<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>21<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>25<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>29<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>34<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>38<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>42<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>46<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>51<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>55<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>59<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>103<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>108<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>112<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>116<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>121<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>125<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>129<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>133<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>138<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>142<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>146<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>150<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>155<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>159<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>203<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>207<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>212<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>216<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>220<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>225<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>229<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>233<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>237<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>242<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>246<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>250<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>254<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>259<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>303<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>307<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>311<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>316<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>320<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>324<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>329<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>333<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>337<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>341<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>346<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>350<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>354<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>359<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>403<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>407<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>411<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>415<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>420<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>424<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>428<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>433<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>437<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>441<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>445<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>450<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>454<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>458<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>502<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>507<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>511<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>515<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>519<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>524<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>528<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>532<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>536<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>541<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>545<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>549<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>554<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>558<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>602<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>606<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>611<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>615<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>619<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>623<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>628<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>632<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>636<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>641<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>645<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>649<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>653<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>658<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>702<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>706<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>710<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>1022<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>1022<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>1022<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>1022<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>1027<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>1027<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2016<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2016<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2020<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2020<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2024<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2024<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2028<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2029<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2033<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2033<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2037<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2037<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2041<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2042<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2046<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2046<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2050<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2050<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2054<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2054<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2058<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2058<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2103<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2103<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2107<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2107<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2111<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2113<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2115<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2116<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2120<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2120<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2124<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2124<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2128<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2128<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2132<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2133<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2138<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2139<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2141<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2141<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2145<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2146<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2150<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2150<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2154<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2154<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2158<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2158<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2202<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2202<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2207<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2207<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2211<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2212<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2215<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2215<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2219<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2220<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2224<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2224<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2228<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2228<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2232<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2233<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2237<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2237<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2241<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2241<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2245<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2246<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2249<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2249<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2254<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2254<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2258<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2258<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2302<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2302<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2306<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2306<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2311<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2311<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2315<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2315<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2319<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2319<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2323<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2324<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120703<;>2328<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120703<;>2328<;>TROJ_SIREFEF.TS<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@<;>
20120704<;>758<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120704<;>802<;>BKDR_ZACCESS.FU<;>1<;>1<;>0<;>C:\Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@<;>
20120707<;>2038<;>TROJ_GEN.FC5CBG7<;>10<;>1<;>0<;>C:\DELL\DBRM\Reminder\TrayApp.exe<;>
         
Malwarebytes Quickscan
Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.07.07.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
*** :: ***-LAPTOP [Administrator]

Schutz: Aktiviert

07.07.2012 20:49:07
mbam-log-2012-07-07 (20-49-07).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 211751
Laufzeit: 2 Minute(n), 7 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         
Malwarebytes Full Scan

Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.07.07.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
*** :: ***-LAPTOP [Administrator]

Schutz: Aktiviert

07.07.2012 20:54:30
mbam-log-2012-07-07 (21-50-03).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 365464
Laufzeit: 43 Minute(n), 56 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\_OTL\MovedFiles\07042012_195151\C_Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\800000cb.@ (Rootkit.0Access) -> Keine Aktion durchgeführt.

(Ende)
         
Eset
Code:
ATTFilter
C:\Qoobox\Quarantine\C\Windows\System32\Services.exe.vir	Win64/Patched.B.Gen trojan
C:\_OTL\MovedFiles\07042012_195151\C_Windows\Installer\{fe69c990-4be5-0d3b-b25c-52e84df55c9c}\U\80000000.@	Win64/Sirefef.AL trojan
         

Alt 09.07.2012, 11:35   #15
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden - Standard

Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden



Sagmal, ist das rein zufällig ein Büro-PC?
__________________
Logfiles bitte immer in CODE-Tags posten

Antwort

Themen zu Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden
800000cb.@, anhang, appdata, c:\windows, code, entfernen, fund, funktioniert, logfile, malware, meldung, micro, min, neue, neuen, quarantäne, rechner, scan, sirefef.ts, temp, trend, trojana, verhindert, windows, windows 7, windows 7 64bit, zugriff




Ähnliche Themen: Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden


  1. Trend Micro kauft Tipping Point
    Nachrichten - 21.10.2015 (0)
  2. SaveSenseLive - Trend Micro brachte Bedrohung
    Log-Analyse und Auswertung - 16.09.2014 (6)
  3. Trend Micro Mobile Security & Antivirus
    Smartphone, Tablet & Handy Security - 10.10.2013 (0)
  4. Trend Micro öffnet nicht
    Log-Analyse und Auswertung - 09.06.2013 (10)
  5. Trend Micro findet JAVA_BLACOLE.SMO
    Plagegeister aller Art und deren Bekämpfung - 09.01.2013 (16)
  6. SQL Injection bei Trend Micro Control Manager
    Nachrichten - 01.10.2012 (0)
  7. [2x] Logfile of Trend Micro HijackThis v2.0.2
    Mülltonne - 12.02.2012 (1)
  8. Trend Micro Internet Security 2008
    Antiviren-, Firewall- und andere Schutzprogramme - 23.01.2012 (42)
  9. Trend Micro - Hijack This -Log Files
    Log-Analyse und Auswertung - 14.01.2011 (1)
  10. Erfahrung mit Trend Micro Internet Security?
    Antiviren-, Firewall- und andere Schutzprogramme - 11.10.2009 (4)
  11. Problem mit Trend Micro Internet Security 2009
    Antiviren-, Firewall- und andere Schutzprogramme - 04.03.2009 (0)
  12. Erfahrungen mit Trend Micro IS 2009
    Antiviren-, Firewall- und andere Schutzprogramme - 17.11.2008 (1)
  13. NetWorm-i.Virus@fp_Logfile of Trend Micro HijackThis
    Log-Analyse und Auswertung - 03.05.2008 (1)
  14. Warnung vor angeblichem Antispywareprogramm von Trend Micro!
    Plagegeister aller Art und deren Bekämpfung - 05.09.2007 (0)
  15. Info: Trend Micro HijackThis 2.00 Beta
    Antiviren-, Firewall- und andere Schutzprogramme - 12.03.2007 (1)
  16. Trend Micro
    Antiviren-, Firewall- und andere Schutzprogramme - 03.06.2003 (27)
  17. trend micro
    Antiviren-, Firewall- und andere Schutzprogramme - 30.03.2003 (6)

Zum Thema Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden - Hallo, auf meinem noch recht neuen Dell Vostro (64bit-System, Windows 7) kommt seit heute Abend alle 5 min Minuten von Trend Micro die Meldung über einen Fund des Trojaners Sirefef.ts - Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden...
Archiv
Du betrachtest: Alle 5 min wird Trojana Sirefef.ts von trend micro gefunden auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.