Bitdefender zeigte Virendatei an, die aber nicht vorhanden war.

Traxxcell · 08.05.2013, 21:25

Hallo Forum,

Bitdefender zeigte im Ordner C:/Benutzer/xxx/AppData/Local/Temp eine *.exe Datei als Virus an, die angeblich nicht gelöscht werden konnte. Im angegebenen Ordner war diese Datei nicht zu sehen. Ein Scan mit Bitdefender hat auch nichts gefunden. Da auf der Festplatte Win7 und XP installiert sind, habe ich Win7 von XP aus nochmal mit Bitdefender scannen lassen, ebenso ohne Fund. Mbam hat auch nichts gefunden. Da es sich bei dieser Datei um eine "exe" gehandelt haben soll, bin ich jetzt etwas unsicher. Ich stelle mal die Protokolle von Mbam und OTL rein. Es wäre sehr nett, wenn ihr euch die mal anseht, ob was verdächtiges zu sehen ist.
Danke schon mal im voraus.

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.05.08.04

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16540
Fujitsu :: FUJITSU-PC [Administrator]

08.05.2013 17:26:06
mbam-log-2013-05-08 (17-26-06).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 265443
Laufzeit: 32 Minute(n), 35 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Zitat:

OTL logfile created on: 08.05.2013 20:23:36 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Fujitsu\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,99 Gb Total Physical Memory | 1,20 Gb Available Physical Memory | 60,18% Memory free
3,98 Gb Paging File | 2,89 Gb Available in Paging File | 72,53% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 48,83 Gb Total Space | 30,17 Gb Free Space | 61,79% Space Free | Partition Type: NTFS
Drive D: | 19,53 Gb Total Space | 9,64 Gb Free Space | 49,37% Space Free | Partition Type: NTFS
Drive E: | 97,65 Gb Total Space | 93,92 Gb Free Space | 96,17% Space Free | Partition Type: NTFS
Drive F: | 66,86 Gb Total Space | 63,60 Gb Free Space | 95,13% Space Free | Partition Type: NTFS

Computer Name: FUJITSU-PC | User Name: Fujitsu | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Fujitsu\Desktop\otl.exe (OldTimer Tools)
PRC - C:\Programme\Bitdefender\Bitdefender 2013\bdagent.exe (Bitdefender)
PRC - C:\Programme\Bitdefender\Bitdefender 2013\vsserv.exe (Bitdefender)
PRC - C:\Programme\Bitdefender\Bitdefender 2013\updatesrv.exe (Bitdefender)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Secunia\PSI\psia.exe (Secunia)
PRC - C:\Programme\Secunia\PSI\sua.exe (Secunia)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - F:\ZonerPhoto15\Photo Studio 15\Program32\ZPSTray.exe (ZONER software)
PRC - F:\TuneUp\TuneUpUtilitiesApp32.exe (TuneUp Software)
PRC - F:\TuneUp\TuneUpUtilitiesService32.exe (TuneUp Software)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.)
PRC - F:\Nitro PDF\NitroPDFDriverService2.exe (Nitro PDF Software)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - c:\Programme\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
PRC - C:\Programme\FSC\Wireless Utility\WirelessSelector.exe (ITE Tech Inc.)

========== Modules (No Company Name) ==========

MOD - C:\Programme\Bitdefender\Bitdefender 2013\txmlutil.dll ()
MOD - C:\Programme\Bitdefender\Bitdefender 2013\bdmetrics.dll ()
MOD - F:\Nitro PDF\NPShellExtension.dll ()

========== Services (SafeList) ==========

SRV - (VSSERV) -- C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe (Bitdefender)
SRV - (UPDATESRV) -- C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe (Bitdefender)
SRV - (BdDesktopParental) -- C:\Programme\Bitdefender\Bitdefender 2013\bdparentalservice.exe (Bitdefender)
SRV - (SkypeUpdate) -- F:\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (Secunia PSI Agent) -- C:\Programme\Secunia\PSI\psia.exe (Secunia)
SRV - (Secunia Update Agent) -- C:\Programme\Secunia\PSI\sua.exe (Secunia)
SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (TuneUp.UtilitiesSvc) -- F:\TuneUp\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (wlidsvc) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (NitroDriverReadSpool2) -- F:\Nitro PDF\NitroPDFDriverService2.exe (Nitro PDF Software)
SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (PSI_SVC_2) -- c:\Programme\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (BdfNdisf) -- c:\Programme\Common Files\Bitdefender\Bitdefender Firewall\bdfndisf6.sys (BitDefender LLC)
DRV - (avckf) -- C:\Windows\System32\drivers\avckf.sys (BitDefender)
DRV - (avc3) -- C:\Windows\System32\drivers\avc3.sys (BitDefender)
DRV - (gzflt) -- C:\Windows\System32\drivers\gzflt.sys (BitDefender LLC)
DRV - (tbhsd) -- C:\Windows\System32\drivers\tbhsd.sys (RapidSolution Software AG)
DRV - (RRNetCapMP) -- C:\Windows\System32\drivers\rrnetcap.sys (RapidSolution Software AG)
DRV - (RRNetCap) -- C:\Windows\System32\drivers\rrnetcap.sys (RapidSolution Software AG)
DRV - (IT9135BDA) -- C:\Windows\System32\drivers\IT9135BDA.sys (ITE )
DRV - (GT72UBUS) -- C:\Windows\System32\drivers\gt72ubus.sys (Option N.V.)
DRV - (GTPTSER) -- C:\Windows\System32\drivers\gtptser.sys (Option N.V.)
DRV - (GT72NDISIPXP) -- C:\Windows\System32\drivers\Gt51Ip.sys (Option N.V.)
DRV - (BDSandBox) -- C:\Windows\System32\drivers\bdsandbox.sys (BitDefender SRL)
DRV - (avchv) -- C:\Windows\System32\drivers\avchv.sys (BitDefender)
DRV - (trufos) -- C:\Windows\System32\drivers\trufos.sys (BitDefender S.R.L.)
DRV - (bdselfpr) -- C:\Programme\Bitdefender\Bitdefender 2013\bdselfpr.sys (BitDefender LLC)
DRV - (TuneUpUtilitiesDrv) -- F:\TuneUp\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (TsUsbGD) -- C:\Windows\System32\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (bdfwfpf) -- C:\Programme\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys (BitDefender LLC)
DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (dmvsc) -- C:\Windows\System32\drivers\dmvsc.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (PSI) -- C:\Windows\System32\drivers\psi_mf.sys (Secunia)
DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (Serial) -- C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.)
DRV - (yukonw7) -- C:\Windows\System32\drivers\yk62x86.sys (Marvell)
DRV - (netw5v32) -- C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation)
DRV - (zntport) -- C:\Windows\System32\drivers\zntport.sys (Zeal SoftStudio)
DRV - (DCamUSBEMPIA) -- C:\Windows\System32\drivers\emDevice.sys (eMPIA Technology, Inc.)
DRV - (FiltUSBEMPIA) -- C:\Windows\System32\drivers\emFilter.sys (eMPIA Technology, Inc.)
DRV - (ScanUSBEMPIA) -- C:\Windows\System32\drivers\emScan.sys (eMPIA Technology, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 26 09 A8 2A F3 C4 CD 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{00C93BEF-5717-4446-BAD9-025A94D80801}: "URL" = hxxp://suche.web.de/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de"
FF - prefs.js..extensions.enabledAddons: %7Bdf4e4df5-5cb7-46b0-9aef-6c784c3249f8%7D:1.2.0
FF - prefs.js..extensions.enabledAddons: %7Bd40f5e7b-d2cf-4856-b441-cc613eeffbe3%7D:1.68
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.14
FF - prefs.js..extensions.enabledAddons: %7B1018e4d6-728f-4b20-ad56-37578a4de76b%7D:4.2.8
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: F:\VLC-Player\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: F:\FireFox\components [2013.04.11 21:41:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\bdThunderbird@bitdefender.com: C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext [2013.02.16 09:28:21 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: F:\FireFox\components [2013.04.11 21:41:58 | 000,000,000 | ---D | M]

[2012.11.17 20:56:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fujitsu\AppData\Roaming\mozilla\Extensions
[2013.04.16 07:55:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fujitsu\AppData\Roaming\mozilla\Firefox\Profiles\q0csvptr.default\extensions
[2013.04.16 07:55:12 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Fujitsu\AppData\Roaming\mozilla\Firefox\Profiles\q0csvptr.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2013.02.23 23:09:38 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Fujitsu\AppData\Roaming\mozilla\Firefox\Profiles\q0csvptr.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2013.02.15 15:16:54 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\Fujitsu\AppData\Roaming\mozilla\firefox\profiles\q0csvptr.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.02.21 14:12:01 | 000,138,614 | ---- | M] () (No name found) -- C:\Users\Fujitsu\AppData\Roaming\mozilla\firefox\profiles\q0csvptr.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
[2012.11.18 13:25:26 | 000,026,136 | ---- | M] () (No name found) -- C:\Users\Fujitsu\AppData\Roaming\mozilla\firefox\profiles\q0csvptr.default\extensions\{df4e4df5-5cb7-46b0-9aef-6c784c3249f8}.xpi

O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKCU..\Run: [Zoner Photo Studio Autoupdate] F:\ZonerPhoto15\Photo Studio 15\Program32\ZPSTray.exe (ZONER software)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - F:\MS-Office\Office12\EXCEL.EXE (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{460E4A91-B261-4109-A4FE-202F621323C8}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\livecall - No CLSID value found
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2012.11.17 17:31:30 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{c22fbbe1-4ff2-11e2-ada9-00f1d000f1d0}\Shell - "" = AutoRun
O33 - MountPoints2\{c22fbbe1-4ff2-11e2-ada9-00f1d000f1d0}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -a
O33 - MountPoints2\{c22fbbea-4ff2-11e2-ada9-00f1d000f1d0}\Shell - "" = AutoRun
O33 - MountPoints2\{c22fbbea-4ff2-11e2-ada9-00f1d000f1d0}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -a
O33 - MountPoints2\I\Shell - "" = AutoRun
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\LaunchU3.exe -a
O33 - MountPoints2\K\Shell - "" = AutoRun
O33 - MountPoints2\K\Shell\AutoRun\command - "" = K:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (sdnclean.exe)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013.05.08 17:51:36 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Fujitsu\Desktop\OTL.exe
[2013.05.08 17:17:34 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\Fujitsu\Desktop\HiJackThis204.exe
[2013.05.06 09:33:00 | 000,000,000 | ---D | C] -- C:\Users\Fujitsu\Desktop\Fotos
[2013.05.02 21:19:28 | 000,000,000 | ---D | C] -- C:\Users\Fujitsu\AppData\Roaming\NetSpeedMonitor
[2013.04.29 17:40:14 | 000,486,536 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\avckf.sys
[2013.04.29 17:40:13 | 000,633,344 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\avc3.sys
[2013.04.29 11:01:11 | 000,000,000 | ---D | C] -- C:\Users\Fujitsu\Desktop\Neuer Ordner
[2013.04.18 13:25:20 | 000,000,000 | ---D | C] -- C:\Users\Fujitsu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Skat-Online
[2013.04.18 11:26:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2013.04.18 11:17:25 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2013.04.18 11:17:15 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2013.04.18 11:17:15 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2013.04.18 11:17:15 | 000,094,112 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
[2013.04.15 08:25:27 | 000,253,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\Setup1.exe
[2013.04.15 08:25:26 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\ST6UNST.EXE
[2013.04.10 07:17:23 | 002,706,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013.04.10 07:17:22 | 002,877,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013.04.10 07:17:22 | 000,039,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013.04.10 07:17:21 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013.04.10 07:17:21 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2013.04.10 07:17:20 | 000,493,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013.04.10 07:17:20 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2013.04.10 07:17:20 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2013.04.10 07:17:20 | 000,042,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2013.04.10 07:17:20 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2013.04.10 07:13:52 | 003,968,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2013.04.10 07:13:52 | 003,913,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2013.04.10 07:13:51 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll
[2013.04.10 07:13:50 | 002,347,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011.04.18 23:51:20 | 000,653,136 | ---- | C] (Microsoft Corporation) -- C:\Program Files\Common Files\MSVCR90.dll
[2011.04.18 23:51:20 | 000,569,680 | ---- | C] (Microsoft Corporation) -- C:\Program Files\Common Files\MSVCP90.dll
[2010.12.16 22:39:36 | 000,302,592 | ---- | C] (Google) -- C:\Program Files\Common Files\webmmux.dll
[2010.12.16 22:39:16 | 000,701,440 | ---- | C] (Google) -- C:\Program Files\Common Files\vp8encoder.dll
[2010.12.16 22:39:16 | 000,412,672 | ---- | C] (Google) -- C:\Program Files\Common Files\vp8decoder.dll
[2010.12.16 22:39:14 | 000,292,352 | ---- | C] (Google) -- C:\Program Files\Common Files\webmsplit.dll
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013.05.08 20:20:22 | 000,021,904 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.08 20:20:22 | 000,021,904 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.08 20:17:30 | 000,696,870 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.05.08 20:17:30 | 000,652,148 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.05.08 20:17:30 | 000,148,134 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.05.08 20:17:30 | 000,121,080 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.05.08 20:12:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.08 17:51:37 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Fujitsu\Desktop\OTL.exe
[2013.05.08 17:17:34 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Fujitsu\Desktop\HiJackThis204.exe
[2013.04.29 21:36:58 | 000,000,969 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013.04.29 17:40:14 | 000,486,536 | ---- | M] (BitDefender) -- C:\Windows\System32\drivers\avckf.sys
[2013.04.29 17:40:13 | 000,633,344 | ---- | M] (BitDefender) -- C:\Windows\System32\drivers\avc3.sys
[2013.04.21 08:03:18 | 000,281,936 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.04.18 13:25:20 | 000,002,400 | ---- | M] () -- C:\Users\Fujitsu\Desktop\Skat-Online V9.lnk
[2013.04.18 11:22:51 | 000,691,592 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.04.18 11:22:51 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.04.15 08:28:33 | 000,253,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\Setup1.exe
[2013.04.15 08:28:32 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\ST6UNST.EXE
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013.04.21 08:02:53 | 000,281,936 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.04.18 13:25:20 | 000,002,400 | ---- | C] () -- C:\Users\Fujitsu\Desktop\Skat-Online V9.lnk
[2013.04.01 11:40:08 | 000,125,440 | ---- | C] () -- C:\Windows\System32\lua5.1a.dll
[2013.03.05 23:46:31 | 000,007,601 | ---- | C] () -- C:\Users\Fujitsu\AppData\Local\Resmon.ResmonCfg
[2013.02.17 17:50:54 | 000,004,509 | ---- | C] () -- C:\Users\Fujitsu\AppData\Roaming\CamStudio.cfg
[2013.02.17 17:50:54 | 000,000,408 | ---- | C] () -- C:\Users\Fujitsu\AppData\Roaming\CamShapes.ini
[2013.02.17 17:50:54 | 000,000,408 | ---- | C] () -- C:\Users\Fujitsu\AppData\Roaming\CamLayout.ini
[2013.02.17 17:50:54 | 000,000,096 | ---- | C] () -- C:\Users\Fujitsu\AppData\Roaming\Camdata.ini
[2013.02.16 09:29:40 | 001,098,914 | ---- | C] () -- C:\ProgramData\1360998461.bdinstall.bin
[2013.01.30 13:13:21 | 000,000,418 | ---- | C] () -- C:\Windows\wiso.ini
[2013.01.01 14:16:06 | 000,000,101 | ---- | C] () -- C:\Windows\System32\ud-boot-time.ini
[2012.11.19 12:41:35 | 000,373,513 | ---- | C] () -- C:\Windows\System32\drivers\RTAIODAT.DAT
[2012.11.18 15:15:29 | 000,000,014 | ---- | C] () -- C:\Windows\System32\SysInfo_6.dll
[2012.11.18 15:13:22 | 000,000,245 | ---- | C] () -- C:\Windows\System32\AF15IRTBL.bin
[2012.11.18 12:03:30 | 000,140,288 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll
[2012.10.29 17:44:56 | 000,315,392 | ---- | C] () -- C:\Windows\System32\EMRegSys.dll
[2012.05.11 15:16:16 | 000,171,520 | ---- | C] () -- C:\Program Files\Common Files\dsfOggDemux2.dll
[2011.01.12 03:00:44 | 000,030,208 | ---- | C] () -- C:\Program Files\Common Files\wmpinfo.dll
[2011.01.12 03:00:42 | 000,240,128 | ---- | C] () -- C:\Program Files\Common Files\dsfVorbisDecoder.dll
[2011.01.12 03:00:42 | 000,146,944 | ---- | C] () -- C:\Program Files\Common Files\dsfFLACDecoder.dll
[2011.01.12 03:00:40 | 000,221,184 | ---- | C] () -- C:\Program Files\Common Files\dsfFLACEncoder.dll
[2011.01.12 03:00:40 | 000,204,800 | ---- | C] () -- C:\Program Files\Common Files\dsfNativeFLACSource.dll

========== ZeroAccess Check ==========

[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 23:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

Zitat:

OTL Extras logfile created on: 08.05.2013 20:23:36 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Fujitsu\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,99 Gb Total Physical Memory | 1,20 Gb Available Physical Memory | 60,18% Memory free
3,98 Gb Paging File | 2,89 Gb Available in Paging File | 72,53% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 48,83 Gb Total Space | 30,17 Gb Free Space | 61,79% Space Free | Partition Type: NTFS
Drive D: | 19,53 Gb Total Space | 9,64 Gb Free Space | 49,37% Space Free | Partition Type: NTFS
Drive E: | 97,65 Gb Total Space | 93,92 Gb Free Space | 96,17% Space Free | Partition Type: NTFS
Drive F: | 66,86 Gb Total Space | 63,60 Gb Free Space | 95,13% Space Free | Partition Type: NTFS

Computer Name: FUJITSU-PC | User Name: Fujitsu | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- F:\FireFox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "F:\MS-Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "F:\MS-Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "F:\VLC-Player\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [Digital Photo Professional] -- C:\Program Files\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Mit Corel PaintShop Pro X4 durchsuchen] -- "F:\PaintShop\Corel PaintShop Pro X4\Corel PaintShop Pro.exe" "%L" (Corel, Inc.)
Directory [PlayWithVLC] -- "F:\VLC-Player\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{027EED35-4076-4F44-82CB-F28DEAE0BAE2}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{18748310-B32B-452F-9C5C-B60B84EDCB6D}" = lport=31931 | protocol=6 | dir=in | name=audials localhttpserver 31931 |
"{30CE9969-1030-4035-B69F-EE218141FD3E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{326DDBE2-350A-4874-ADBF-F130DFF2AB82}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6C9B985D-EDD5-4BF3-B5A7-8FE7D3BD3F58}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{712ED333-0903-4A8D-9049-E06125CB209C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{805339A0-C93D-4554-B531-25033877A58D}" = lport=2869 | protocol=6 | dir=in | app=system |
"{86B6C3A3-3DCA-4306-8638-204A905873F6}" = rport=10243 | protocol=6 | dir=out | app=system |
"{A52765A5-CD6A-4C43-B4A2-32C7440AA110}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{CBEAF140-F02F-4BE3-8FE8-8AA3D93AA140}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{D92571B8-C17F-48A1-8CE9-ED165418D0F3}" = lport=10243 | protocol=6 | dir=in | app=system |
"{DB9CFB16-9821-46F2-9CD7-9F1DEBE557D3}" = lport=12972 | protocol=6 | dir=in | name=audials localhttpserver 12972 |
"{E2D11A1E-8017-42A0-9F0C-C62FE1414EF1}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe |
"{F9D0D684-553F-4500-B3BB-09010407BEBB}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FF9E81E2-8B49-423E-ABB7-F3C77AB4EDB8}" = lport=14714 | protocol=6 | dir=in | name=audials localhttpserver 14714 |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{013E4DC0-1AE1-4AC9-928E-148ADB194889}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{205D183C-4A47-4848-9811-EEE4E0A70973}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{2D1FF28D-5A5C-41B9-A00E-005FA934C4CB}" = protocol=6 | dir=in | app=f:\maxthon3\bin\mxup.exe |
"{32069C4B-73DA-4DF9-BDC7-5F1C867E7045}" = protocol=17 | dir=in | app=f:\maxthon3\bin\mxup.exe |
"{3AB1218C-8D32-45FF-AD74-FEB5FB1F91F8}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{4400908B-6A00-4BC6-A6C8-A16D64FC7937}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{49BD0CA3-7BC4-4126-B873-F77829F1FF4E}" = dir=in | app=f:\skype\phone\skype.exe |
"{59023592-6680-499B-BFD2-FD95276192CC}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6273396A-7E12-481E-A975-05F571F3491B}" = protocol=6 | dir=in | app=f:\maxthon3\bin\maxthon.exe |
"{6F832B96-D77B-4C39-83DE-C23B98A60C0C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{74F41D34-46CA-4AFC-9EA0-2B383001E206}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{945BF5E1-58C1-4B35-8257-F917B61AC20F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B6CEAA28-9B93-45DF-AFF7-F06D8AB0E1E0}" = protocol=6 | dir=out | app=system |
"{B8EBA7AD-F397-4768-9F9E-81D1A8A567D8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{C5AE1185-93CF-4B54-9262-0974B501973D}" = protocol=17 | dir=in | app=f:\maxthon3\bin\maxthon.exe |
"{D708CE33-0292-49C4-A0AC-71BE978878FB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{E2398916-089E-4622-87E8-30C9B449EFC3}" = dir=in | app=f:\radiotracker\audials.exe |
"{EE5A817B-43F9-47CE-A432-EE69A90E7B30}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F0F846FB-027F-4525-B70C-32C6BB9F1B52}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{00580795-581C-4587-B9F2-37320D7AB37F}" = Corel PaintShop Pro X4
"{003CD4FD-DB3E-4D12-9A34-8C00FA8A680F}" = WirelessControl
"{00580795-581C-4587-B9F2-37320D7AB37F}" = ICA
"{006CAAEF-CA96-4181-AC22-FE56D61432E4}" = PSPPContent
"{00AE1A2D-7BC2-4359-A0EC-E19F36E391BB}" = Corel PaintShop Pro X4
"{00BEE329-BAAB-49FF-9B66-55E4B12B9ADD}" = IPM_PSP_COM
"{00D13418-7DDF-4D3D-A237-E297B103BB6B}" = Setup
"{00D74A7A-F7AD-4D00-ABD2-0973836292C7}" = PSPPHelp
"{0454BB9A-2A7A-4214-BDFF-937F7A711A44}" = Windows Live Communications Platform
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0D8C5BCA-6133-4C96-A81E-B901E60F0E1E}" = GlobeTrotter Connect
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 21
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CCBD1F4-CEEC-452A-9CB8-46564B501315}" = Windows Live UX Platform
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{690F5BA3-5DEB-42CD-962B-F687EE59FAA7}" = Windows Live Essentials
"{6A8DB215-7BCD-4377-B015-2E4541A3E7C6}" = Windows Live PIMT Platform
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{8256F87F-8554-4457-8C3D-3F3324697D9F}" = Windows Live ID Sign-in Assistant
"{86501894-E722-4385-A792-B7C2F28FAE7B}" = NetSpeedMonitor 2.5.4.0 x86
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A642ACD-CE3A-4A23-A8B1-A0F7EB12B214}" = Windows Live SOXE Definitions
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.02) - Deutsch
"{AE364ACC-B9DF-466B-B4EA-AEECD0CD581E}" = Windows Live Messenger
"{B0897D06-68ED-4EB2-0001-2F36270D8621}" = DVR Converter 3.0
"{B727564C-47D3-473A-AC9E-F4BE7B1BD5D3}" = Windows Live UX Platform Language Pack
"{C424CD5E-EA05-4D3E-B5DA-F9F149E1D3AC}" = Windows Live Installer
"{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}" = TuneUp Utilities 2013
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{C9B6EFD0-4F01-4BBA-8374-39AD99A3ED72}" = Windows Live Photo Common
"{CE61E024-462A-4E06-A886-660F09C12E28}" = Nitro Pro 7
"{D6CC2FAF-F827-4091-96A1-D32CC9B69C79}" = WISO Steuer-Sparbuch 2013
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1203F8C-FF34-4968-A4A5-B4F1F8533DAB}" = Photo Common
"{EB99ED57-FF42-4272-8EDA-E367DFF29596}" = Audials
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2235E5E-7881-4293-9B6F-04B2609FBFF0}" = Windows Live Messenger
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F4811919-F252-4B25-9AB2-8859A85810B5}" = TuneUp Utilities Language Pack (de-DE)
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FE7C0B3D-50B9-4951-BE78-A321CBF86552}" = Windows Live SOXE
"7-Zip" = 7-Zip 9.22beta
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Ashampoo Burning Studio 2012_is1" = Ashampoo Burning Studio 2012 v10.0.15
"Ashampoo Photo Optimizer 4_is1" = Ashampoo Photo Optimizer 4 v.4.0.3
"Audacity_is1" = Audacity 2.0.3
"Bitdefender" = Bitdefender Internet Security 2013
"BlazeDTV 6.0_is1" = BlazeDTV 6.0
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon MOV Decoder" = Canon MOV Decoder
"Canon MOV Encoder" = Canon MOV Encoder
"Canon RAW Codec" = Canon RAW Codec
"CCleaner" = CCleaner
"CrystalDiskInfo_is1" = CrystalDiskInfo 5.4.2
"Digital Photo Professional" = Canon Utilities Digital Photo Professional
"Driver Genius Professional Edition_is1" = Driver Genius Professional Edition
"EasyBCD" = EasyBCD 2.2
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EOS USB WIA Driver" = EOS USB WIA Driver
"EOS Utility" = Canon Utilities EOS Utility
"EOS Video Snapshot Task" = Canon Utilities EOS Video Snapshot Task for ZoomBrowser EX
"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v5.50
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"Maxthon3" = Maxthon 3
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox 16.0.2 (x86 de)" = Mozilla Firefox 16.0.2 (x86 de)
"MyCamera" = Canon Utilities MyCamera
"MyCamera Download Plugin" = CANON iMAGE GATEWAY MyCamera Download Plugin
"Original Data Security Tools" = Canon Utilities Original Data Security Tools
"PhotoStitch" = Canon Utilities PhotoStitch
"Picture Style Editor" = Canon Utilities Picture Style Editor
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"Secunia PSI" = Secunia PSI (3.0.0.6001)
"SMSERIAL" = Motorola SM56 Speakerphone Modem
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TuneUp Utilities 2013" = TuneUp Utilities 2013
"TVWiz" = Intel(R) TV Wizard
"UltraDefrag" = Ultra Defragmenter
"VLC media player" = VLC media player 2.0.6
"WFTK" = Canon Utilities WFT-E1/E2/E3 Utility
"WinLiveSuite" = Windows Live Essentials
"ZonerPhotoStudio15_DE_is1" = Zoner Photo Studio 15
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Mozilla Firefox 20.0.1 (x86 de)" = Mozilla Firefox 20.0.1 (x86 de)

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 06.05.2013 10:13:07 | Computer Name = Fujitsu-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 20.0.1.4847,
Zeitstempel: 0x51650aee Name des fehlerhaften Moduls: xul.dll, Version: 20.0.1.4847,
Zeitstempel: 0x51650a09 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000b10e8 ID des fehlerhaften
Prozesses: 0xcf8 Startzeit der fehlerhaften Anwendung: 0x01ce4a62c2f148d1 Pfad der
fehlerhaften Anwendung: F:\FireFox\firefox.exe Pfad des fehlerhaften Moduls: F:\FireFox\xul.dll
Berichtskennung:
12ae2d5f-b657-11e2-b979-00f1d000f1d0

Error - 07.05.2013 01:24:29 | Computer Name = Fujitsu-PC | Source = WinMgmt | ID = 10
Description =

Error - 07.05.2013 02:35:46 | Computer Name = Fujitsu-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: zps.exe, Version: 15.0.1.3, Zeitstempel:
0x50802372 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel:
0x4ec49b60 Ausnahmecode: 0xc0000374 Fehleroffset: 0x000c380b ID des fehlerhaften Prozesses:
0xe30 Startzeit der fehlerhaften Anwendung: 0x01ce4aec66415d1a Pfad der fehlerhaften
Anwendung: F:\ZonerPhoto15\Photo Studio 15\Program32\zps.exe Pfad des fehlerhaften
Moduls: C:\Windows\SYSTEM32\ntdll.dll Berichtskennung: 58b52989-b6e0-11e2-9051-00f1d000f1d0

Error - 07.05.2013 04:30:37 | Computer Name = Fujitsu-PC | Source = WinMgmt | ID = 10
Description =

Error - 07.05.2013 05:26:42 | Computer Name = Fujitsu-PC | Source = WinMgmt | ID = 10
Description =

Error - 07.05.2013 13:25:33 | Computer Name = Fujitsu-PC | Source = WinMgmt | ID = 10
Description =

Error - 08.05.2013 02:10:52 | Computer Name = Fujitsu-PC | Source = WinMgmt | ID = 10
Description =

Error - 08.05.2013 04:39:06 | Computer Name = Fujitsu-PC | Source = WinMgmt | ID = 10
Description =

Error - 08.05.2013 11:59:04 | Computer Name = Fujitsu-PC | Source = Application Hang | ID = 1002
Description = Programm otl.exe, Version 3.2.69.0 kann nicht mehr unter Windows ausgeführt
werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 13a0 Startzeit:
01ce4c040f8a0269 Endzeit: 16 Anwendungspfad: C:\Users\Fujitsu\Desktop\otl.exe Berichts-ID:

Error - 08.05.2013 14:14:27 | Computer Name = Fujitsu-PC | Source = WinMgmt | ID = 10
Description =

[ Media Center Events ]
Error - 20.12.2012 05:46:59 | Computer Name = Fujitsu-PC | Source = MCUpdate | ID = 0
Description = 10:46:27 - Fehler beim Herstellen der Internetverbindung. 10:46:27
- Serververbindung konnte nicht hergestellt werden..

Error - 20.12.2012 06:52:33 | Computer Name = Fujitsu-PC | Source = MCUpdate | ID = 0
Description = 11:52:32 - Fehler beim Herstellen der Internetverbindung. 11:52:32
- Serververbindung konnte nicht hergestellt werden..

Error - 20.12.2012 06:52:50 | Computer Name = Fujitsu-PC | Source = MCUpdate | ID = 0
Description = 11:52:38 - Fehler beim Herstellen der Internetverbindung. 11:52:38
- Serververbindung konnte nicht hergestellt werden..

Error - 20.12.2012 07:53:21 | Computer Name = Fujitsu-PC | Source = MCUpdate | ID = 0
Description = 12:53:21 - Fehler beim Herstellen der Internetverbindung. 12:53:21
- Serververbindung konnte nicht hergestellt werden..

Error - 20.12.2012 07:53:42 | Computer Name = Fujitsu-PC | Source = MCUpdate | ID = 0
Description = 12:53:26 - Fehler beim Herstellen der Internetverbindung. 12:53:26
- Serververbindung konnte nicht hergestellt werden..

Error - 20.12.2012 08:54:11 | Computer Name = Fujitsu-PC | Source = MCUpdate | ID = 0
Description = 13:54:11 - Fehler beim Herstellen der Internetverbindung. 13:54:11
- Serververbindung konnte nicht hergestellt werden..

Error - 20.12.2012 08:54:26 | Computer Name = Fujitsu-PC | Source = MCUpdate | ID = 0
Description = 13:54:16 - Fehler beim Herstellen der Internetverbindung. 13:54:16
- Serververbindung konnte nicht hergestellt werden..

Error - 23.12.2012 04:28:04 | Computer Name = Fujitsu-PC | Source = MCUpdate | ID = 0
Description = 09:28:03 - Fehler beim Herstellen der Internetverbindung. 09:28:04
- Serververbindung konnte nicht hergestellt werden..

Error - 23.12.2012 04:28:24 | Computer Name = Fujitsu-PC | Source = MCUpdate | ID = 0
Description = 09:28:09 - Fehler beim Herstellen der Internetverbindung. 09:28:09
- Serververbindung konnte nicht hergestellt werden..

Error - 21.02.2013 01:59:41 | Computer Name = Fujitsu-PC | Source = MCUpdate | ID = 0
Description = 06:59:37 - Fehler beim Herstellen der Internetverbindung. 06:59:40
- Serververbindung konnte nicht hergestellt werden..

[ System Events ]
Error - 25.01.2013 08:37:21 | Computer Name = Fujitsu-PC | Source = volsnap | ID = 393245
Description = Die Schattenkopien von Volume "C:" wurde während der Ermittlung abgebrochen.

Error - 26.01.2013 04:02:10 | Computer Name = Fujitsu-PC | Source = Schannel | ID = 36887
Description = Es wurde eine schwerwiegende Warnung empfangen: 80.

Error - 28.01.2013 05:00:01 | Computer Name = Fujitsu-PC | Source = DCOM | ID = 10000
Description =

Error - 28.01.2013 17:56:02 | Computer Name = Fujitsu-PC | Source = volsnap | ID = 393245
Description = Die Schattenkopien von Volume "C:" wurde während der Ermittlung abgebrochen.

Error - 28.01.2013 17:56:23 | Computer Name = Fujitsu-PC | Source = DCOM | ID = 10000
Description =

Error - 30.01.2013 08:47:36 | Computer Name = Fujitsu-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error - 31.01.2013 03:12:28 | Computer Name = Fujitsu-PC | Source = DCOM | ID = 10010
Description =

Error - 01.02.2013 01:38:34 | Computer Name = Fujitsu-PC | Source = DCOM | ID = 10010
Description =

Error - 04.02.2013 05:00:02 | Computer Name = Fujitsu-PC | Source = DCOM | ID = 10000
Description =

Error - 08.02.2013 07:36:05 | Computer Name = Fujitsu-PC | Source = volsnap | ID = 393245
Description = Die Schattenkopien von Volume "C:" wurde während der Ermittlung abgebrochen.

< End of report >

cosinus · 08.05.2013, 23:12

Hallo und

Zitat:

Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Warum hast du eine Professional-Edition von Windows, brauchst du das als Heimanwender?
Oder ist das rein zufällig ein Büro-/Firmen-PC bzw. ein Uni-Rechner?

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die jemals vorher fündig geworden?
Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs posten!

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Traxxcell · 09.05.2013, 06:10

Hallo cosinus,

es ist ein Fujitsu Esprimo D9500 den ich gebraucht mit Vista gekauft habe. In der Bucht gab es günstig die Win7 Prof Version. Es hat also keinen besonderen Grund und ist auch ein absolut privater Rechner.
Weitere Log-Dateien habe ich nicht.

Gruß Heinz

cosinus · 09.05.2013, 16:47

Ok, danke für die Erklärung, ich muss danach fragen, weil bei gewerblichen Einsatz eines Rechner besondere Hinweise gepostet werden müssen

Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.

Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.
Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.
Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!
Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!
Die Logs der aufgegebenen Tools wie zB Malwarebytes sind immer zu posten - egal ob ein Fund dabei war oder nicht!
Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.

Rootkitscan mit GMER

Bitte lade dir

GMER herunter: (Dateiname zufällig)

Schließe alle anderen Programme, deaktiviere deinen Virenscanner und trenne den Rechner vom Internet bevor du GMER startest.
Sollte sich nach dem Start ein Fenster mit folgender Warnung öffnen:
WARNING !!!
GMER has found system modification, which might have been caused by ROOTKIT activity.
Do you want to fully scan your system ?

Unbedingt auf "No" klicken.
Entferne rechts den Haken bei: IAT/EAT und Show All
Setze den Haken bei Quickscan und entferne ihn bei allen anderen Laufwerken.
Starte den Scan mit "Scan".
Mache nichts am Computer während der Scan läuft.
Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt auf deinem Desktop. Mit "Ok" wird GMER beendet.

Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!

Tauchen Probleme auf?

Probiere alternativ den abgesicherten Modus.
Erhältst du einen Bluescreen, dann entferne den Haken vor Devices.

Anschließend bitte MBAR ausführen:

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Traxxcell · 09.05.2013, 19:22

Hallo cosinus, hier die beiden Logfiles.

Mbar hat nichts gefunden.

Gmer blieb so mittendrin mit der Meldung stehen:

Zitat:

Es befindet sich kein Datenträger im Laufwerk. Legen Sie einen Datenträger in Laufwerk\Device\Harddisk1\DR1 ein

Nach mehrmaligem Drücken auf Weiter, wurde der Scan fortgesetzt.

Der GMER Log ist 425 KB und wohl zu groß, um mit Code angezeigt zu werden und hängt als 7z Datei dran.

Gruß Heinz

Code:

ATTFilter

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.05.0.1001

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x86

Account is Administrative

Internet Explorer version: 10.0.9200.16540

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, E:\ DRIVE_FIXED, F:\ DRIVE_FIXED
CPU speed: 1.995000 GHz
Memory total: 2137120768, free: 1081475072

------------ Kernel report ------------
     05/09/2013 19:11:36
------------ Loaded modules -----------
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\halmacpi.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\intelide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\avc3.sys
\SystemRoot\system32\DRIVERS\gzflt.sys
\SystemRoot\system32\DRIVERS\trufos.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\??\c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys
\??\C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\??\C:\Program Files\Bitdefender\Bitdefender 2013\bdselfpr.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\igdkmd32.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\yk62x86.sys
\SystemRoot\system32\DRIVERS\netw5v32.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\drivers\tbhsd.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ks.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\rrnetcap.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\avchv.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\RTKVHDA.sys
\SystemRoot\system32\DRIVERS\smserial.sys
\SystemRoot\system32\drivers\modem.sys
\SystemRoot\system32\drivers\MODEMCSA.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\gt72ubus.sys
\SystemRoot\system32\DRIVERS\Gt51Ip.sys
\SystemRoot\system32\DRIVERS\gtptser.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_msahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\avckf.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\DRIVERS\parvdm.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\??\C:\Windows\system32\drivers\zntport.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\psi_mf.sys
\??\F:\TuneUp\TuneUpUtilitiesDriver32.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\??\C:\Users\Fujitsu\AppData\Local\Temp\fxtiyfod.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xffffffff917e4ac8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000007f\
Lower Device Object: 0xffffffff916bd498
Lower Device Driver Name: \Driver\USBSTOR\
Driver name found: USBSTOR
Initialization returned 0x0
Load Function returned 0x0
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff85cdb948
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-4\
Lower Device Object: 0xffffffff85b77030
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
Initialization returned 0x0
Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0)
Load Function returned 0x0
Downloaded database version: v2013.05.09.05
Downloaded database version: v2013.05.07.01
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 2
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff85cdb948, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff85cdb5e0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff85cdb948, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff85b77030, DeviceName: \Device\Ide\IdeDeviceP2T0L0-4\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0xffffffffaf4d8a38, 0xffffffff85cdb948, 0xffffffffc6a817e0
Lower DeviceData: 0xffffffffc62e2400, 0xffffffff85b77030, 0xffffffffc65f74f8
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\Windows\system32\drivers...
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 7ED8D8FB

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 63  Numsec = 40965687
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Extended with LBA (0xf)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 40965750  Numsec = 447410250

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

Disk Size: 250059350016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-488377168-488397168)...
Physical Sector Size: 0
Drive: 1, DevicePointer: 0xffffffff917e4ac8, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff916bc500, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff917e4ac8, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff916bd498, DeviceName: \Device\0000007f\, DriverName: \Driver\USBSTOR\
------------ End ----------
Done!
Performing system, memory and registry scan...
Done!
Scan finished
=======================================

Traxxcell · 09.05.2013, 20:55

Sorry, da oben ist die System-Log.

Hier die mbar-log-2013-05-09

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 1.05.0.1001
www.malwarebytes.org

Database version: v2013.05.09.05

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16540
Fujitsu :: FUJITSU-PC [administrator]

09.05.2013 19:37:23
mbar-log-2013-05-09 (19-37-23).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled: 
Objects scanned: 25448
Time elapsed: 7 minute(s), 23 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

cosinus · 09.05.2013, 21:40

aswMBR

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

TDSS-Killer

Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Traxxcell · 09.05.2013, 22:26

Hier die Log-Dateien von aswMBR und TDSSKiller

Code:

ATTFilter

aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-05-09 22:54:18
-----------------------------
22:54:18.152    OS Version: Windows 6.1.7601 Service Pack 1
22:54:18.152    Number of processors: 2 586 0xF0D
22:54:18.155    ComputerName: FUJITSU-PC  UserName: Fujitsu
22:54:23.805    Initialize success
23:01:27.249    AVAST engine defs: 13050900
23:01:52.802    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-4
23:01:52.802    Disk 0 Vendor: WDC_WD2500BEVS-60UST0 01.01A01 Size: 238475MB BusType: 11
23:01:53.317    Disk 0 MBR read successfully
23:01:53.317    Disk 0 MBR scan
23:01:53.426    Disk 0 Windows 7 default MBR code
23:01:53.442    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        20002 MB offset 63
23:01:53.457    Disk 0 Partition - 00     0F Extended LBA            218462 MB offset 40965750
23:01:53.504    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS        49999 MB offset 40965813
23:01:53.520    Disk 0 Partition - 00     05     Extended             99998 MB offset 143364060
23:01:53.598    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        99998 MB offset 143364123
23:01:53.613    Disk 0 Partition - 00     05     Extended             68464 MB offset 450558990
23:01:53.645    Disk 0 Partition 4 00     07    HPFS/NTFS NTFS        68464 MB offset 348160743
23:01:53.676    Disk 0 scanning sectors +488376000
23:01:54.113    Disk 0 scanning C:\Windows\system32\drivers
23:02:54.578    Service scanning
23:02:57.043    Service BdfNdisf c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys **LOCKED** 5
23:02:57.152    Service bdfwfpf C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys **LOCKED** 5
23:02:57.386    Service bdselfpr C:\Program Files\Bitdefender\Bitdefender 2013\bdselfpr.sys **LOCKED** 5
23:03:16.886    Modules scanning
23:04:16.525    Disk 0 trace - called modules:
23:04:16.556    
23:04:17.227    AVAST engine scan C:\Windows
23:04:41.719    AVAST engine scan C:\Windows\system32
23:13:38.028    AVAST engine scan C:\Windows\system32\drivers
23:14:00.414    AVAST engine scan C:\Users\Fujitsu
23:15:24.592    AVAST engine scan C:\ProgramData
23:16:21.485    Scan finished successfully
23:16:42.998    Disk 0 MBR has been saved successfully to "C:\Users\Fujitsu\Desktop\Trojanerboard\MBR.dat"
23:16:43.091    The log file has been saved successfully to "C:\Users\Fujitsu\Desktop\Trojanerboard\aswMBR.txt"

Code:

ATTFilter

23:18:08.0826 2296  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
23:18:10.0870 2296  ============================================================
23:18:10.0870 2296  Current date / time: 2013/05/09 23:18:10.0870
23:18:10.0870 2296  SystemInfo:
23:18:10.0870 2296  
23:18:10.0870 2296  OS Version: 6.1.7601 ServicePack: 1.0
23:18:10.0870 2296  Product type: Workstation
23:18:10.0870 2296  ComputerName: FUJITSU-PC
23:18:10.0870 2296  UserName: Fujitsu
23:18:10.0870 2296  Windows directory: C:\Windows
23:18:10.0870 2296  System windows directory: C:\Windows
23:18:10.0870 2296  Processor architecture: Intel x86
23:18:10.0870 2296  Number of processors: 2
23:18:10.0870 2296  Page size: 0x1000
23:18:10.0870 2296  Boot type: Normal boot
23:18:10.0870 2296  ============================================================
23:18:12.0431 2296  Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
23:18:12.0446 2296  ============================================================
23:18:12.0446 2296  \Device\Harddisk0\DR0:
23:18:12.0446 2296  MBR partitions:
23:18:12.0462 2296  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2711637
23:18:12.0477 2296  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x27116B5, BlocksNum 0x61A7927
23:18:12.0493 2296  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x88B901B, BlocksNum 0xC34F28D
23:18:12.0509 2296  \Device\Harddisk0\DR0\Partition4: MBR, Type 0x7, StartLBA 0x14C082E7, BlocksNum 0x85B83D9
23:18:12.0509 2296  ============================================================
23:18:12.0555 2296  C: <-> \Device\Harddisk0\DR0\Partition2
23:18:12.0587 2296  D: <-> \Device\Harddisk0\DR0\Partition1
23:18:12.0618 2296  E: <-> \Device\Harddisk0\DR0\Partition3
23:18:12.0649 2296  F: <-> \Device\Harddisk0\DR0\Partition4
23:18:12.0649 2296  ============================================================
23:18:12.0649 2296  Initialize success
23:18:12.0649 2296  ============================================================
23:18:44.0224 3244  ============================================================
23:18:44.0224 3244  Scan started
23:18:44.0224 3244  Mode: Manual; SigCheck; TDLFS; 
23:18:44.0224 3244  ============================================================
23:18:45.0035 3244  ================ Scan system memory ========================
23:18:45.0035 3244  System memory - ok
23:18:45.0035 3244  ================ Scan services =============================
23:18:45.0175 3244  [ 1B133875B8AA8AC48969BD3458AFE9F5 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
23:18:45.0300 3244  1394ohci - ok
23:18:45.0316 3244  [ CEA80C80BED809AA0DA6FEBC04733349 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
23:18:45.0347 3244  ACPI - ok
23:18:45.0362 3244  [ 1EFBC664ABFF416D1D07DB115DCB264F ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
23:18:45.0456 3244  AcpiPmi - ok
23:18:45.0518 3244  [ 3927397AC60D943DAF8808AFFED582B7 ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
23:18:45.0581 3244  AdobeARMservice - ok
23:18:45.0612 3244  [ 21E785EBD7DC90A06391141AAC7892FB ] adp94xx         C:\Windows\system32\drivers\adp94xx.sys
23:18:45.0628 3244  adp94xx - ok
23:18:45.0659 3244  [ 0C676BC278D5B59FF5ABD57BBE9123F2 ] adpahci         C:\Windows\system32\drivers\adpahci.sys
23:18:45.0690 3244  adpahci - ok
23:18:45.0706 3244  [ 7C7B5EE4B7B822EC85321FE23A27DB33 ] adpu320         C:\Windows\system32\drivers\adpu320.sys
23:18:45.0721 3244  adpu320 - ok
23:18:45.0752 3244  [ 8B5EEFEEC1E6D1A72A06C526628AD161 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
23:18:45.0877 3244  AeLookupSvc - ok
23:18:45.0908 3244  [ 9EBBBA55060F786F0FCAA3893BFA2806 ] AFD             C:\Windows\system32\drivers\afd.sys
23:18:46.0018 3244  AFD - ok
23:18:46.0033 3244  [ 507812C3054C21CEF746B6EE3D04DD6E ] agp440          C:\Windows\system32\drivers\agp440.sys
23:18:46.0064 3244  agp440 - ok
23:18:46.0080 3244  [ 8B30250D573A8F6B4BD23195160D8707 ] aic78xx         C:\Windows\system32\drivers\djsvs.sys
23:18:46.0096 3244  aic78xx - ok
23:18:46.0111 3244  [ 18A54E132947CD98FEA9ACCC57F98F13 ] ALG             C:\Windows\System32\alg.exe
23:18:46.0189 3244  ALG - ok
23:18:46.0205 3244  [ 0D40BCF52EA90FC7DF2AEAB6503DEA44 ] aliide          C:\Windows\system32\drivers\aliide.sys
23:18:46.0220 3244  aliide - ok
23:18:46.0236 3244  [ 3C6600A0696E90A463771C7422E23AB5 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
23:18:46.0252 3244  amdagp - ok
23:18:46.0267 3244  [ CD5914170297126B6266860198D1D4F0 ] amdide          C:\Windows\system32\drivers\amdide.sys
23:18:46.0283 3244  amdide - ok
23:18:46.0283 3244  [ 00DDA200D71BAC534BF56A9DB5DFD666 ] AmdK8           C:\Windows\system32\drivers\amdk8.sys
23:18:46.0330 3244  AmdK8 - ok
23:18:46.0345 3244  [ 3CBF30F5370FDA40DD3E87DF38EA53B6 ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys
23:18:46.0376 3244  AmdPPM - ok
23:18:46.0408 3244  [ D320BF87125326F996D4904FE24300FC ] amdsata         C:\Windows\system32\drivers\amdsata.sys
23:18:46.0439 3244  amdsata - ok
23:18:46.0454 3244  [ EA43AF0C423FF267355F74E7A53BDABA ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
23:18:46.0470 3244  amdsbs - ok
23:18:46.0486 3244  [ 46387FB17B086D16DEA267D5BE23A2F2 ] amdxata         C:\Windows\system32\drivers\amdxata.sys
23:18:46.0501 3244  amdxata - ok
23:18:46.0532 3244  [ AEA177F783E20150ACE5383EE368DA19 ] AppID           C:\Windows\system32\drivers\appid.sys
23:18:46.0579 3244  AppID - ok
23:18:46.0610 3244  [ 62A9C86CB6085E20DB4823E4E97826F5 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
23:18:46.0642 3244  AppIDSvc - ok
23:18:46.0673 3244  [ FB1959012294D6AD43E5304DF65E3C26 ] Appinfo         C:\Windows\System32\appinfo.dll
23:18:46.0735 3244  Appinfo - ok
23:18:46.0751 3244  [ A45D184DF6A8803DA13A0B329517A64A ] AppMgmt         C:\Windows\System32\appmgmts.dll
23:18:46.0829 3244  AppMgmt - ok
23:18:46.0860 3244  [ 2932004F49677BD84DBC72EDB754FFB3 ] arc             C:\Windows\system32\drivers\arc.sys
23:18:46.0891 3244  arc - ok
23:18:46.0907 3244  [ 5D6F36C46FD283AE1B57BD2E9FEB0BC7 ] arcsas          C:\Windows\system32\drivers\arcsas.sys
23:18:46.0922 3244  arcsas - ok
23:18:47.0016 3244  [ 776ACEFA0CA9DF0FAA51A5FB2F435705 ] aspnet_state    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
23:18:47.0078 3244  aspnet_state - ok
23:18:47.0094 3244  [ ADD2ADE1C2B285AB8378D2DAAF991481 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
23:18:47.0219 3244  AsyncMac - ok
23:18:47.0250 3244  [ 338C86357871C167A96AB976519BF59E ] atapi           C:\Windows\system32\drivers\atapi.sys
23:18:47.0281 3244  atapi - ok
23:18:47.0312 3244  [ CE3B4E731638D2EF62FCB419BE0D39F0 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
23:18:47.0359 3244  AudioEndpointBuilder - ok
23:18:47.0390 3244  [ CE3B4E731638D2EF62FCB419BE0D39F0 ] Audiosrv        C:\Windows\System32\Audiosrv.dll
23:18:47.0437 3244  Audiosrv - ok
23:18:47.0468 3244  [ B5B8FC2C4D520F1F1EED52A980ED5091 ] avc3            C:\Windows\system32\DRIVERS\avc3.sys
23:18:47.0562 3244  avc3 - ok
23:18:47.0593 3244  [ 7F9B99B564E7C9FBB6729ED95B5BBB24 ] avchv           C:\Windows\system32\DRIVERS\avchv.sys
23:18:47.0624 3244  avchv - ok
23:18:47.0656 3244  [ 818E7E029DB594DCB8D6218A7D6FA575 ] avckf           C:\Windows\system32\DRIVERS\avckf.sys
23:18:47.0687 3244  avckf - ok
23:18:47.0702 3244  [ 6E30D02AAC9CAC84F421622E3A2F6178 ] AxInstSV        C:\Windows\System32\AxInstSV.dll
23:18:47.0765 3244  AxInstSV - ok
23:18:47.0796 3244  [ 1A231ABEC60FD316EC54C66715543CEC ] b06bdrv         C:\Windows\system32\drivers\bxvbdx.sys
23:18:47.0843 3244  b06bdrv - ok
23:18:47.0858 3244  [ BD8869EB9CDE6BBE4508D869929869EE ] b57nd60x        C:\Windows\system32\DRIVERS\b57nd60x.sys
23:18:47.0905 3244  b57nd60x - ok
23:18:47.0952 3244  [ A624841BECEE1B0FCAB28BF2E4CB317A ] BdDesktopParental C:\Program Files\Bitdefender\Bitdefender 2013\bdparentalservice.exe
23:18:48.0014 3244  BdDesktopParental - ok
23:18:48.0014 3244  [ EE1E9C3BB8228AE423DD38DB69128E71 ] BDESVC          C:\Windows\System32\bdesvc.dll
23:18:48.0092 3244  BDESVC - ok
23:18:48.0170 3244  [ 6743A3C33E8B3BFC2D9B55E15500BB13 ] BdfNdisf        c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys
23:18:48.0217 3244  BdfNdisf - ok
23:18:48.0248 3244  [ 2F66C9DF34134419928BAC00E21E2679 ] bdfwfpf         C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys
23:18:48.0280 3244  bdfwfpf - ok
23:18:48.0295 3244  [ B6CBFC9D825BB2D955620CD4D8EF07F9 ] BDSandBox       C:\Windows\system32\drivers\bdsandbox.sys
23:18:48.0326 3244  BDSandBox - ok
23:18:48.0342 3244  [ A7478F77584F8DB6AD74B2BBE1144886 ] bdselfpr        C:\Program Files\Bitdefender\Bitdefender 2013\bdselfpr.sys
23:18:48.0373 3244  bdselfpr - ok
23:18:48.0404 3244  [ 505506526A9D467307B3C393DEDAF858 ] Beep            C:\Windows\system32\drivers\Beep.sys
23:18:48.0451 3244  Beep - ok
23:18:48.0498 3244  [ 1E2BAC209D184BB851E1A187D8A29136 ] BFE             C:\Windows\System32\bfe.dll
23:18:48.0545 3244  BFE - ok
23:18:48.0592 3244  [ E585445D5021971FAE10393F0F1C3961 ] BITS            C:\Windows\System32\qmgr.dll
23:18:48.0638 3244  BITS - ok
23:18:48.0654 3244  [ 2287078ED48FCFC477B05B20CF38F36F ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
23:18:48.0701 3244  blbdrive - ok
23:18:48.0716 3244  [ 8F2DA3028D5FCBD1A060A3DE64CD6506 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
23:18:48.0763 3244  bowser - ok
23:18:48.0779 3244  [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
23:18:48.0810 3244  BrFiltLo - ok
23:18:48.0826 3244  [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
23:18:48.0857 3244  BrFiltUp - ok
23:18:48.0888 3244  [ 3DAA727B5B0A45039B0E1C9A211B8400 ] Browser         C:\Windows\System32\browser.dll
23:18:48.0935 3244  Browser - ok
23:18:48.0950 3244  [ 845B8CE732E67F3B4133164868C666EA ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
23:18:48.0982 3244  Brserid - ok
23:18:49.0013 3244  [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
23:18:49.0044 3244  BrSerWdm - ok
23:18:49.0060 3244  [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
23:18:49.0091 3244  BrUsbMdm - ok
23:18:49.0091 3244  [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
23:18:49.0138 3244  BrUsbSer - ok
23:18:49.0138 3244  [ ED3DF7C56CE0084EB2034432FC56565A ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
23:18:49.0169 3244  BTHMODEM - ok
23:18:49.0200 3244  [ 1DF19C96EEF6C29D1C3E1A8678E07190 ] bthserv         C:\Windows\system32\bthserv.dll
23:18:49.0247 3244  bthserv - ok
23:18:49.0262 3244  [ 77EA11B065E0A8AB902D78145CA51E10 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
23:18:49.0309 3244  cdfs - ok
23:18:49.0340 3244  [ BE167ED0FDB9C1FA1133953C18D5A6C9 ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
23:18:49.0372 3244  cdrom - ok
23:18:49.0387 3244  [ 319C6B309773D063541D01DF8AC6F55F ] CertPropSvc     C:\Windows\System32\certprop.dll
23:18:49.0434 3244  CertPropSvc - ok
23:18:49.0450 3244  [ 3FE3FE94A34DF6FB06E6418D0F6A0060 ] circlass        C:\Windows\system32\drivers\circlass.sys
23:18:49.0465 3244  circlass - ok
23:18:49.0496 3244  [ 635181E0E9BBF16871BF5380D71DB02D ] CLFS            C:\Windows\system32\CLFS.sys
23:18:49.0512 3244  CLFS - ok
23:18:49.0559 3244  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
23:18:49.0574 3244  clr_optimization_v2.0.50727_32 - ok
23:18:49.0606 3244  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
23:18:49.0684 3244  clr_optimization_v4.0.30319_32 - ok
23:18:49.0699 3244  [ DEA805815E587DAD1DD2C502220B5616 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
23:18:49.0730 3244  CmBatt - ok
23:18:49.0762 3244  [ C537B1DB64D495B9B4717B4D6D9EDBF2 ] cmdide          C:\Windows\system32\drivers\cmdide.sys
23:18:49.0777 3244  cmdide - ok
23:18:49.0808 3244  [ 42F158036BD4C2FF3122BF142E60E6FD ] CNG             C:\Windows\system32\Drivers\cng.sys
23:18:49.0855 3244  CNG - ok
23:18:49.0855 3244  [ A6023D3823C37043986713F118A89BEE ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
23:18:49.0886 3244  Compbatt - ok
23:18:49.0886 3244  [ CBE8C58A8579CFE5FCCF809E6F114E89 ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
23:18:49.0918 3244  CompositeBus - ok
23:18:49.0918 3244  COMSysApp - ok
23:18:49.0949 3244  [ 2C4EBCFC84A9B44F209DFF6C6E6C61D1 ] crcdisk         C:\Windows\system32\drivers\crcdisk.sys
23:18:49.0964 3244  crcdisk - ok
23:18:49.0996 3244  [ 96C0E38905CFD788313BE8E11DAE3F2F ] CryptSvc        C:\Windows\system32\cryptsvc.dll
23:18:50.0027 3244  CryptSvc - ok
23:18:50.0074 3244  [ 3C2177A897B4CA2788C6FB0C3FD81D4B ] CSC             C:\Windows\system32\drivers\csc.sys
23:18:50.0120 3244  CSC - ok
23:18:50.0136 3244  [ 15F93B37F6801943360D9EB42485D5D3 ] CscService      C:\Windows\System32\cscsvc.dll
23:18:50.0183 3244  CscService - ok
23:18:50.0214 3244  [ 08B45998ADCECFECCD076A37022B56CB ] DCamUSBEMPIA    C:\Windows\system32\DRIVERS\emDevice.sys
23:18:50.0276 3244  DCamUSBEMPIA - ok
23:18:50.0323 3244  [ 7660F01D3B38ACA1747E397D21D790AF ] DcomLaunch      C:\Windows\system32\rpcss.dll
23:18:50.0370 3244  DcomLaunch - ok
23:18:50.0401 3244  [ 8D6E10A2D9A5EED59562D9B82CF804E1 ] defragsvc       C:\Windows\System32\defragsvc.dll
23:18:50.0448 3244  defragsvc - ok
23:18:50.0464 3244  [ F024449C97EC1E464AAFFDA18593DB88 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
23:18:50.0495 3244  DfsC - ok
23:18:50.0526 3244  [ E9E01EB683C132F7FA27CD607B8A2B63 ] Dhcp            C:\Windows\system32\dhcpcore.dll
23:18:50.0573 3244  Dhcp - ok
23:18:50.0588 3244  [ 1A050B0274BFB3890703D490F330C0DA ] discache        C:\Windows\system32\drivers\discache.sys
23:18:50.0620 3244  discache - ok
23:18:50.0635 3244  [ 565003F326F99802E68CA78F2A68E9FF ] Disk            C:\Windows\system32\drivers\disk.sys
23:18:50.0651 3244  Disk - ok
23:18:50.0682 3244  [ 2A958EF85DB1B61FFCA65044FA4BCE9E ] dmvsc           C:\Windows\system32\drivers\dmvsc.sys
23:18:50.0729 3244  dmvsc - ok
23:18:50.0744 3244  [ 33EF4861F19A0736B11314AAD9AE28D0 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
23:18:50.0822 3244  Dnscache - ok
23:18:50.0854 3244  [ 366BA8FB4B7BB7435E3B9EACB3843F67 ] dot3svc         C:\Windows\System32\dot3svc.dll
23:18:50.0916 3244  dot3svc - ok
23:18:50.0947 3244  [ 8EC04CA86F1D68DA9E11952EB85973D6 ] DPS             C:\Windows\system32\dps.dll
23:18:50.0994 3244  DPS - ok
23:18:51.0010 3244  [ B918E7C5F9BF77202F89E1A9539F2EB4 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
23:18:51.0041 3244  drmkaud - ok
23:18:51.0088 3244  [ 23F5D28378A160352BA8F817BD8C71CB ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
23:18:51.0134 3244  DXGKrnl - ok
23:18:51.0150 3244  [ 8600142FA91C1B96367D3300AD0F3F3A ] EapHost         C:\Windows\System32\eapsvc.dll
23:18:51.0197 3244  EapHost - ok
23:18:51.0306 3244  [ 024E1B5CAC09731E4D868E64DBFB4AB0 ] ebdrv           C:\Windows\system32\drivers\evbdx.sys
23:18:51.0446 3244  ebdrv - ok
23:18:51.0478 3244  [ 81951F51E318AECC2D68559E47485CC4 ] EFS             C:\Windows\System32\lsass.exe
23:18:51.0524 3244  EFS - ok
23:18:51.0587 3244  [ A8C362018EFC87BEB013EE28F29C0863 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
23:18:51.0680 3244  ehRecvr - ok
23:18:51.0696 3244  [ D389BFF34F80CAEDE417BF9D1507996A ] ehSched         C:\Windows\ehome\ehsched.exe
23:18:51.0727 3244  ehSched - ok
23:18:51.0774 3244  [ 0ED67910C8C326796FAA00B2BF6D9D3C ] elxstor         C:\Windows\system32\drivers\elxstor.sys
23:18:51.0836 3244  elxstor - ok
23:18:51.0852 3244  [ 8FC3208352DD3912C94367A206AB3F11 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
23:18:51.0883 3244  ErrDev - ok
23:18:51.0914 3244  [ F6916EFC29D9953D5D0DF06882AE8E16 ] EventSystem     C:\Windows\system32\es.dll
23:18:51.0961 3244  EventSystem - ok
23:18:51.0977 3244  [ 2DC9108D74081149CC8B651D3A26207F ] exfat           C:\Windows\system32\drivers\exfat.sys
23:18:52.0024 3244  exfat - ok
23:18:52.0039 3244  [ 7E0AB74553476622FB6AE36F73D97D35 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
23:18:52.0086 3244  fastfat - ok
23:18:52.0133 3244  [ 967EA5B213E9984CBE270205DF37755B ] Fax             C:\Windows\system32\fxssvc.exe
23:18:52.0180 3244  Fax - ok
23:18:52.0180 3244  [ E817A017F82DF2A1F8CFDBDA29388B29 ] fdc             C:\Windows\system32\drivers\fdc.sys
23:18:52.0211 3244  fdc - ok
23:18:52.0242 3244  [ F3222C893BD2F5821A0179E5C71E88FB ] fdPHost         C:\Windows\system32\fdPHost.dll
23:18:52.0273 3244  fdPHost - ok
23:18:52.0289 3244  [ 7DBE8CBFE79EFBDEB98C9FB08D3A9A5B ] FDResPub        C:\Windows\system32\fdrespub.dll
23:18:52.0336 3244  FDResPub - ok
23:18:52.0336 3244  [ 6CF00369C97F3CF563BE99BE983D13D8 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
23:18:52.0367 3244  FileInfo - ok
23:18:52.0382 3244  [ 42C51DC94C91DA21CB9196EB64C45DB9 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
23:18:52.0429 3244  Filetrace - ok
23:18:52.0460 3244  [ 8E80BBA4D77247A03A145163F849A231 ] FiltUSBEMPIA    C:\Windows\system32\DRIVERS\emFilter.sys
23:18:52.0492 3244  FiltUSBEMPIA - ok
23:18:52.0492 3244  [ 87907AA70CB3C56600F1C2FB8841579B ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys
23:18:52.0523 3244  flpydisk - ok
23:18:52.0538 3244  [ 7520EC808E0C35E0EE6F841294316653 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
23:18:52.0554 3244  FltMgr - ok
23:18:52.0601 3244  [ E12C4928B32ACE04610259647F072635 ] FontCache       C:\Windows\system32\FntCache.dll
23:18:52.0663 3244  FontCache - ok
23:18:52.0710 3244  [ E56F39F6B7FDA0AC77A79B0FD3DE1A2F ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
23:18:52.0741 3244  FontCache3.0.0.0 - ok
23:18:52.0757 3244  [ 1A16B57943853E598CFF37FE2B8CBF1D ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
23:18:52.0772 3244  FsDepends - ok
23:18:52.0804 3244  [ 7DAE5EBCC80E45D3253F4923DC424D05 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
23:18:52.0819 3244  Fs_Rec - ok
23:18:52.0850 3244  [ E306A24D9694C724FA2491278BF50FDB ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
23:18:52.0882 3244  fvevol - ok
23:18:52.0897 3244  [ 65EE0C7A58B65E74AE05637418153938 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
23:18:52.0913 3244  gagp30kx - ok
23:18:52.0944 3244  [ E897EAF5ED6BA41E081060C9B447A673 ] gpsvc           C:\Windows\System32\gpsvc.dll
23:18:52.0991 3244  gpsvc - ok
23:18:53.0022 3244  [ 0E551490A3C196B55C31B433091EDA3A ] GT72NDISIPXP    C:\Windows\system32\DRIVERS\Gt51Ip.sys
23:18:53.0069 3244  GT72NDISIPXP - ok
23:18:53.0100 3244  [ 60A174CDEAA68FFA09BA683B3F6C5CCB ] GT72UBUS        C:\Windows\system32\DRIVERS\gt72ubus.sys
23:18:53.0162 3244  GT72UBUS - ok
23:18:53.0178 3244  [ 4E51CEE318A34DD888943461530AE40D ] GTPTSER         C:\Windows\system32\DRIVERS\gtptser.sys
23:18:53.0240 3244  GTPTSER - ok
23:18:53.0272 3244  [ 9C1E3F5A672EDB0831AAF3E36B6876A6 ] gzflt           C:\Windows\system32\DRIVERS\gzflt.sys
23:18:53.0303 3244  gzflt - ok
23:18:53.0334 3244  [ C44E3C2BAB6837DB337DDEE7544736DB ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
23:18:53.0396 3244  hcw85cir - ok
23:18:53.0428 3244  [ A5EF29D5315111C80A5C1ABAD14C8972 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
23:18:53.0490 3244  HdAudAddService - ok
23:18:53.0506 3244  [ 9036377B8A6C15DC2EEC53E489D159B5 ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
23:18:53.0521 3244  HDAudBus - ok
23:18:53.0537 3244  [ 1D58A7F3E11A9731D0EAAAA8405ACC36 ] HidBatt         C:\Windows\system32\drivers\HidBatt.sys
23:18:53.0568 3244  HidBatt - ok
23:18:53.0599 3244  [ 89448F40E6DF260C206A193A4683BA78 ] HidBth          C:\Windows\system32\drivers\hidbth.sys
23:18:53.0662 3244  HidBth - ok
23:18:53.0693 3244  [ CF50B4CF4A4F229B9F3C08351F99CA5E ] HidIr           C:\Windows\system32\drivers\hidir.sys
23:18:53.0724 3244  HidIr - ok
23:18:53.0755 3244  [ 2BC6F6A1992B3A77F5F41432CA6B3B6B ] hidserv         C:\Windows\system32\hidserv.dll
23:18:53.0802 3244  hidserv - ok
23:18:53.0818 3244  [ 10C19F8290891AF023EAEC0832E1EB4D ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
23:18:53.0833 3244  HidUsb - ok
23:18:53.0864 3244  [ 196B4E3F4CCCC24AF836CE58FACBB699 ] hkmsvc          C:\Windows\system32\kmsvc.dll
23:18:53.0911 3244  hkmsvc - ok
23:18:53.0942 3244  [ 6658F4404DE03D75FE3BA09F7ABA6A30 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
23:18:53.0989 3244  HomeGroupListener - ok
23:18:54.0020 3244  [ DBC02D918FFF1CAD628ACBE0C0EAA8E8 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
23:18:54.0067 3244  HomeGroupProvider - ok
23:18:54.0083 3244  [ 295FDC419039090EB8B49FFDBB374549 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
23:18:54.0098 3244  HpSAMD - ok
23:18:54.0130 3244  [ 871917B07A141BFF43D76D8844D48106 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
23:18:54.0176 3244  HTTP - ok
23:18:54.0192 3244  [ 0C4E035C7F105F1299258C90886C64C5 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
23:18:54.0208 3244  hwpolicy - ok
23:18:54.0223 3244  [ F151F0BDC47F4A28B1B20A0818EA36D6 ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
23:18:54.0254 3244  i8042prt - ok
23:18:54.0270 3244  [ 5CD5F9A5444E6CDCB0AC89BD62D8B76E ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
23:18:54.0301 3244  iaStorV - ok
23:18:54.0379 3244  [ C521D7EB6497BB1AF6AFA89E322FB43C ] idsvc           C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
23:18:54.0442 3244  idsvc - ok
23:18:54.0598 3244  [ 9467514EA189475A6E7FDC5D7BDE9D3F ] igfx            C:\Windows\system32\DRIVERS\igdkmd32.sys
23:18:54.0816 3244  igfx - ok
23:18:54.0847 3244  [ 4173FF5708F3236CF25195FECD742915 ] iirsp           C:\Windows\system32\drivers\iirsp.sys
23:18:54.0863 3244  iirsp - ok
23:18:54.0910 3244  [ F95622F161474511B8D80D6B093AA610 ] IKEEXT          C:\Windows\System32\ikeext.dll
23:18:55.0003 3244  IKEEXT - ok
23:18:55.0128 3244  [ 2A7F1574F8AC8F35F153937FAA9A8BEB ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
23:18:55.0300 3244  IntcAzAudAddService - ok
23:18:55.0393 3244  [ A0F12F2C9BA6C72F3987CE780E77C130 ] intelide        C:\Windows\system32\drivers\intelide.sys
23:18:55.0424 3244  intelide - ok
23:18:55.0440 3244  [ 3B514D27BFC4ACCB4037BC6685F766E0 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
23:18:55.0456 3244  intelppm - ok
23:18:55.0471 3244  [ ACB364B9075A45C0736E5C47BE5CAE19 ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
23:18:55.0502 3244  IPBusEnum - ok
23:18:55.0518 3244  [ 709D1761D3B19A932FF0238EA6D50200 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
23:18:55.0565 3244  IpFilterDriver - ok
23:18:55.0596 3244  [ 58F67245D041FBE7AF88F4EAF79DF0FA ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
23:18:55.0658 3244  iphlpsvc - ok
23:18:55.0674 3244  [ 4BD7134618C1D2A27466A099062547BF ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
23:18:55.0690 3244  IPMIDRV - ok
23:18:55.0721 3244  [ A5FA468D67ABCDAA36264E463A7BB0CD ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
23:18:55.0752 3244  IPNAT - ok
23:18:55.0768 3244  [ 42996CFF20A3084A56017B7902307E9F ] IRENUM          C:\Windows\system32\drivers\irenum.sys
23:18:55.0799 3244  IRENUM - ok
23:18:55.0814 3244  [ 1F32BB6B38F62F7DF1A7AB7292638A35 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
23:18:55.0830 3244  isapnp - ok
23:18:55.0861 3244  [ CB7A9ABB12B8415BCE5D74994C7BA3AE ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
23:18:55.0877 3244  iScsiPrt - ok
23:18:55.0908 3244  [ 961DF04B80BC9046DE34B7C65D97A941 ] IT9135BDA       C:\Windows\system32\Drivers\IT9135BDA.sys
23:18:55.0939 3244  IT9135BDA - ok
23:18:55.0970 3244  [ ADEF52CA1AEAE82B50DF86B56413107E ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
23:18:55.0986 3244  kbdclass - ok
23:18:56.0002 3244  [ 9E3CED91863E6EE98C24794D05E27A71 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
23:18:56.0033 3244  kbdhid - ok
23:18:56.0048 3244  [ 81951F51E318AECC2D68559E47485CC4 ] KeyIso          C:\Windows\system32\lsass.exe
23:18:56.0064 3244  KeyIso - ok
23:18:56.0095 3244  [ B7895B4182C0D16F6EFADEB8081E8D36 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
23:18:56.0111 3244  KSecDD - ok
23:18:56.0142 3244  [ 5FE1ABF1AF591A3458C9CF24ED9A4D35 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
23:18:56.0173 3244  KSecPkg - ok
23:18:56.0204 3244  [ 89A7B9CC98D0D80C6F31B91C0A310FCD ] KtmRm           C:\Windows\system32\msdtckrm.dll
23:18:56.0251 3244  KtmRm - ok
23:18:56.0267 3244  [ D64AF876D53ECA3668BB97B51B4E70AB ] LanmanServer    C:\Windows\system32\srvsvc.dll
23:18:56.0314 3244  LanmanServer - ok
23:18:56.0345 3244  [ 58405E4F68BA8E4057C6E914F326ABA2 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
23:18:56.0376 3244  LanmanWorkstation - ok
23:18:56.0407 3244  [ F7611EC07349979DA9B0AE1F18CCC7A6 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
23:18:56.0454 3244  lltdio - ok
23:18:56.0516 3244  [ 5700673E13A2117FA3B9020C852C01E2 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
23:18:56.0548 3244  lltdsvc - ok
23:18:56.0563 3244  [ 55CA01BA19D0006C8F2639B6C045E08B ] lmhosts         C:\Windows\System32\lmhsvc.dll
23:18:56.0610 3244  lmhosts - ok
23:18:56.0626 3244  [ EB119A53CCF2ACC000AC71B065B78FEF ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
23:18:56.0657 3244  LSI_FC - ok
23:18:56.0672 3244  [ 8ADE1C877256A22E49B75D1CC9161F9C ] LSI_SAS         C:\Windows\system32\drivers\lsi_sas.sys
23:18:56.0688 3244  LSI_SAS - ok
23:18:56.0719 3244  [ DC9DC3D3DAA0E276FD2EC262E38B11E9 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
23:18:56.0735 3244  LSI_SAS2 - ok
23:18:56.0750 3244  [ 0A036C7D7CAB643A7F07135AC47E0524 ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
23:18:56.0766 3244  LSI_SCSI - ok
23:18:56.0782 3244  [ 6703E366CC18D3B6E534F5CF7DF39CEE ] luafv           C:\Windows\system32\drivers\luafv.sys
23:18:56.0813 3244  luafv - ok
23:18:56.0844 3244  [ BFB9EE8EE977EFE85D1A3105ABEF6DD1 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
23:18:56.0875 3244  Mcx2Svc - ok
23:18:56.0891 3244  [ 0FFF5B045293002AB38EB1FD1FC2FB74 ] megasas         C:\Windows\system32\drivers\megasas.sys
23:18:56.0906 3244  megasas - ok
23:18:56.0938 3244  [ DCBAB2920C75F390CAF1D29F675D03D6 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
23:18:56.0953 3244  MegaSR - ok
23:18:56.0984 3244  [ 146B6F43A673379A3C670E86D89BE5EA ] MMCSS           C:\Windows\system32\mmcss.dll
23:18:57.0031 3244  MMCSS - ok
23:18:57.0047 3244  [ F001861E5700EE84E2D4E52C712F4964 ] Modem           C:\Windows\system32\drivers\modem.sys
23:18:57.0094 3244  Modem - ok
23:18:57.0109 3244  [ 25483F9D590D5F00BD951E1181453EC2 ] MODEMCSA        C:\Windows\system32\drivers\MODEMCSA.sys
23:18:57.0156 3244  MODEMCSA - ok
23:18:57.0172 3244  [ 79D10964DE86B292320E9DFE02282A23 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
23:18:57.0203 3244  monitor - ok
23:18:57.0218 3244  [ FB18CC1D4C2E716B6B903B0AC0CC0609 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
23:18:57.0234 3244  mouclass - ok
23:18:57.0250 3244  [ 2C388D2CD01C9042596CF3C8F3C7B24D ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
23:18:57.0296 3244  mouhid - ok
23:18:57.0312 3244  [ FC8771F45ECCCFD89684E38842539B9B ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
23:18:57.0328 3244  mountmgr - ok
23:18:57.0343 3244  [ 2D699FB6E89CE0D8DA14ECC03B3EDFE0 ] mpio            C:\Windows\system32\drivers\mpio.sys
23:18:57.0359 3244  mpio - ok
23:18:57.0374 3244  [ AD2723A7B53DD1AACAE6AD8C0BFBF4D0 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
23:18:57.0406 3244  mpsdrv - ok
23:18:57.0452 3244  [ 9835584E999D25004E1EE8E5F3E3B881 ] MpsSvc          C:\Windows\system32\mpssvc.dll
23:18:57.0530 3244  MpsSvc - ok
23:18:57.0562 3244  [ CEB46AB7C01C9F825F8CC6BABC18166A ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
23:18:57.0593 3244  MRxDAV - ok
23:18:57.0608 3244  [ 5D16C921E3671636C0EBA3BBAAC5FD25 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
23:18:57.0655 3244  mrxsmb - ok
23:18:57.0671 3244  [ 6D17A4791ACA19328C685D256349FEFC ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
23:18:57.0702 3244  mrxsmb10 - ok
23:18:57.0702 3244  [ B81F204D146000BE76651A50670A5E9E ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
23:18:57.0733 3244  mrxsmb20 - ok
23:18:57.0749 3244  [ 012C5F4E9349E711E11E0F19A8589F0A ] msahci          C:\Windows\system32\drivers\msahci.sys
23:18:57.0764 3244  msahci - ok
23:18:57.0796 3244  [ 55055F8AD8BE27A64C831322A780A228 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
23:18:57.0811 3244  msdsm - ok
23:18:57.0827 3244  [ E1BCE74A3BD9902B72599C0192A07E27 ] MSDTC           C:\Windows\System32\msdtc.exe
23:18:57.0858 3244  MSDTC - ok
23:18:57.0874 3244  [ DAEFB28E3AF5A76ABCC2C3078C07327F ] Msfs            C:\Windows\system32\drivers\Msfs.sys
23:18:57.0905 3244  Msfs - ok
23:18:57.0920 3244  [ 3E1E5767043C5AF9367F0056295E9F84 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
23:18:57.0967 3244  mshidkmdf - ok
23:18:57.0967 3244  [ 0A4E5757AE09FA9622E3158CC1AEF114 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
23:18:57.0998 3244  msisadrv - ok
23:18:58.0014 3244  [ 90F7D9E6B6F27E1A707D4A297F077828 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
23:18:58.0061 3244  MSiSCSI - ok
23:18:58.0076 3244  msiserver - ok
23:18:58.0092 3244  [ 8C0860D6366AAFFB6C5BB9DF9448E631 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
23:18:58.0123 3244  MSKSSRV - ok
23:18:58.0139 3244  [ 3EA8B949F963562CEDBB549EAC0C11CE ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
23:18:58.0170 3244  MSPCLOCK - ok
23:18:58.0186 3244  [ F456E973590D663B1073E9C463B40932 ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
23:18:58.0232 3244  MSPQM - ok
23:18:58.0264 3244  [ 0E008FC4819D238C51D7C93E7B41E560 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
23:18:58.0279 3244  MsRPC - ok
23:18:58.0295 3244  [ FC6B9FF600CC585EA38B12589BD4E246 ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
23:18:58.0310 3244  mssmbios - ok
23:18:58.0342 3244  [ B42C6B921F61A6E55159B8BE6CD54A36 ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
23:18:58.0373 3244  MSTEE - ok
23:18:58.0388 3244  [ 33599130F44E1F34631CEA241DE8AC84 ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
23:18:58.0420 3244  MTConfig - ok
23:18:58.0435 3244  [ 159FAD02F64E6381758C990F753BCC80 ] Mup             C:\Windows\system32\Drivers\mup.sys
23:18:58.0451 3244  Mup - ok
23:18:58.0482 3244  [ 61D57A5D7C6D9AFE10E77DAE6E1B445E ] napagent        C:\Windows\system32\qagentRT.dll
23:18:58.0544 3244  napagent - ok
23:18:58.0560 3244  [ 26384429FCD85D83746F63E798AB1480 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
23:18:58.0622 3244  NativeWifiP - ok
23:18:58.0654 3244  [ 8C9C922D71F1CD4DEF73F186416B7896 ] NDIS            C:\Windows\system32\drivers\ndis.sys
23:18:58.0700 3244  NDIS - ok
23:18:58.0716 3244  [ 0E1787AA6C9191D3D319E8BAFE86F80C ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
23:18:58.0763 3244  NdisCap - ok
23:18:58.0778 3244  [ E4A8AEC125A2E43A9E32AFEEA7C9C888 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
23:18:58.0825 3244  NdisTapi - ok
23:18:58.0841 3244  [ D8A65DAFB3EB41CBB622745676FCD072 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
23:18:58.0888 3244  Ndisuio - ok
23:18:58.0903 3244  [ 38FBE267E7E6983311179230FACB1017 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
23:18:58.0950 3244  NdisWan - ok
23:18:58.0966 3244  [ A4BDC541E69674FBFF1A8FF00BE913F2 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
23:18:58.0997 3244  NDProxy - ok
23:18:59.0012 3244  [ 80B275B1CE3B0E79909DB7B39AF74D51 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
23:18:59.0059 3244  NetBIOS - ok
23:18:59.0075 3244  [ 280122DDCF04B378EDD1AD54D71C1E54 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
23:18:59.0122 3244  NetBT - ok
23:18:59.0137 3244  [ 81951F51E318AECC2D68559E47485CC4 ] Netlogon        C:\Windows\system32\lsass.exe
23:18:59.0153 3244  Netlogon - ok
23:18:59.0200 3244  [ 7CCCFCA7510684768DA22092D1FA4DB2 ] Netman          C:\Windows\System32\netman.dll
23:18:59.0231 3244  Netman - ok
23:18:59.0262 3244  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
23:18:59.0309 3244  NetMsmqActivator - ok
23:18:59.0309 3244  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
23:18:59.0340 3244  NetPipeActivator - ok
23:18:59.0356 3244  [ 8C338238C16777A802D6A9211EB2BA50 ] netprofm        C:\Windows\System32\netprofm.dll
23:18:59.0418 3244  netprofm - ok
23:18:59.0418 3244  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
23:18:59.0434 3244  NetTcpActivator - ok
23:18:59.0434 3244  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
23:18:59.0449 3244  NetTcpPortSharing - ok
23:18:59.0605 3244  [ 58218EC6B61B1169CF54AAB0D00F5FE2 ] netw5v32        C:\Windows\system32\DRIVERS\netw5v32.sys
23:18:59.0792 3244  netw5v32 - ok
23:18:59.0824 3244  [ 1D85C4B390B0EE09C7A46B91EFB2C097 ] nfrd960         C:\Windows\system32\drivers\nfrd960.sys
23:18:59.0839 3244  nfrd960 - ok
23:18:59.0902 3244  [ 4DF040B616601996E6CAD18F24311A9F ] NitroDriverReadSpool2 F:\Nitro PDF\NitroPDFDriverService2.exe
23:18:59.0933 3244  NitroDriverReadSpool2 - ok
23:18:59.0980 3244  [ 374071043F9E4231EE43BE2BB48DD36D ] NlaSvc          C:\Windows\System32\nlasvc.dll
23:19:00.0042 3244  NlaSvc - ok
23:19:00.0058 3244  [ 1DB262A9F8C087E8153D89BEF3D2235F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
23:19:00.0089 3244  Npfs - ok
23:19:00.0120 3244  [ BA387E955E890C8A88306D9B8D06BF17 ] nsi             C:\Windows\system32\nsisvc.dll
23:19:00.0151 3244  nsi - ok
23:19:00.0167 3244  [ E9A0A4D07E53D8FEA2BB8387A3293C58 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
23:19:00.0214 3244  nsiproxy - ok
23:19:00.0276 3244  [ 5E43D2B0EE64123D4880DFA6626DEFDE ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
23:19:00.0354 3244  Ntfs - ok
23:19:00.0385 3244  [ F9756A98D69098DCA8945D62858A812C ] Null            C:\Windows\system32\drivers\Null.sys
23:19:00.0416 3244  Null - ok
23:19:00.0448 3244  [ B3E25EE28883877076E0E1FF877D02E0 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
23:19:00.0463 3244  nvraid - ok
23:19:00.0494 3244  [ 4380E59A170D88C4F1022EFF6719A8A4 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
23:19:00.0510 3244  nvstor - ok
23:19:00.0526 3244  [ 5A0983915F02BAE73267CC2A041F717D ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
23:19:00.0541 3244  nv_agp - ok
23:19:00.0588 3244  [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv          C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
23:19:00.0635 3244  odserv - ok
23:19:00.0650 3244  [ 08A70A1F2CDDE9BB49B885CB817A66EB ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
23:19:00.0682 3244  ohci1394 - ok
23:19:00.0728 3244  [ 5A432A042DAE460ABE7199B758E8606C ] ose             C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
23:19:00.0744 3244  ose - ok
23:19:00.0775 3244  [ 82A8521DDC60710C3D3D3E7325209BEC ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
23:19:00.0822 3244  p2pimsvc - ok
23:19:00.0869 3244  [ 59C3DDD501E39E006DAC31BF55150D91 ] p2psvc          C:\Windows\system32\p2psvc.dll
23:19:00.0900 3244  p2psvc - ok
23:19:00.0931 3244  [ 2EA877ED5DD9713C5AC74E8EA7348D14 ] Parport         C:\Windows\system32\DRIVERS\parport.sys
23:19:00.0947 3244  Parport - ok
23:19:00.0962 3244  [ 3F34A1B4C5F6475F320C275E63AFCE9B ] partmgr         C:\Windows\system32\drivers\partmgr.sys
23:19:00.0978 3244  partmgr - ok
23:19:01.0009 3244  [ EB0A59F29C19B86479D36B35983DAADC ] Parvdm          C:\Windows\system32\DRIVERS\parvdm.sys
23:19:01.0025 3244  Parvdm - ok
23:19:01.0040 3244  [ 358AB7956D3160000726574083DFC8A6 ] PcaSvc          C:\Windows\System32\pcasvc.dll
23:19:01.0072 3244  PcaSvc - ok
23:19:01.0072 3244  [ 673E55C3498EB970088E812EA820AA8F ] pci             C:\Windows\system32\drivers\pci.sys
23:19:01.0087 3244  pci - ok
23:19:01.0103 3244  [ AFE86F419014DB4E5593F69FFE26CE0A ] pciide          C:\Windows\system32\drivers\pciide.sys
23:19:01.0118 3244  pciide - ok
23:19:01.0150 3244  [ F396431B31693E71E8A80687EF523506 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
23:19:01.0165 3244  pcmcia - ok
23:19:01.0165 3244  [ 250F6B43D2B613172035C6747AEEB19F ] pcw             C:\Windows\system32\drivers\pcw.sys
23:19:01.0181 3244  pcw - ok
23:19:01.0212 3244  [ 9E0104BA49F4E6973749A02BF41344ED ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
23:19:01.0274 3244  PEAUTH - ok
23:19:01.0321 3244  [ AF4D64D2A57B9772CF3801950B8058A6 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll
23:19:01.0430 3244  PeerDistSvc - ok
23:19:01.0680 3244  [ 414BBA67A3DED1D28437EB66AEB8A720 ] pla             C:\Windows\system32\pla.dll
23:19:01.0758 3244  pla - ok
23:19:01.0820 3244  [ EC7BC28D207DA09E79B3E9FAF8B232CA ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
23:19:01.0867 3244  PlugPlay - ok
23:19:01.0883 3244  [ 63FF8572611249931EB16BB8EED6AFC8 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
23:19:01.0914 3244  PNRPAutoReg - ok
23:19:01.0930 3244  [ 82A8521DDC60710C3D3D3E7325209BEC ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
23:19:01.0961 3244  PNRPsvc - ok
23:19:01.0992 3244  [ 53946B69BA0836BD95B03759530C81EC ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
23:19:02.0039 3244  PolicyAgent - ok
23:19:02.0054 3244  [ F87D30E72E03D579A5199CCB3831D6EA ] Power           C:\Windows\system32\umpo.dll
23:19:02.0101 3244  Power - ok
23:19:02.0132 3244  [ 631E3E205AD6D86F2AED6A4A8E69F2DB ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
23:19:02.0179 3244  PptpMiniport - ok
23:19:02.0195 3244  [ 85B1E3A0C7585BC4AAE6899EC6FCF011 ] Processor       C:\Windows\system32\drivers\processr.sys
23:19:02.0210 3244  Processor - ok
23:19:02.0242 3244  [ CADEFAC453040E370A1BDFF3973BE00D ] ProfSvc         C:\Windows\system32\profsvc.dll
23:19:02.0288 3244  ProfSvc - ok
23:19:02.0320 3244  [ 81951F51E318AECC2D68559E47485CC4 ] ProtectedStorage C:\Windows\system32\lsass.exe
23:19:02.0335 3244  ProtectedStorage - ok
23:19:02.0351 3244  [ 6270CCAE2A86DE6D146529FE55B3246A ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
23:19:02.0382 3244  Psched - ok
23:19:02.0413 3244  [ D24DFD16A1E2A76034DF5AA18125C35D ] PSI             C:\Windows\system32\DRIVERS\psi_mf.sys
23:19:02.0429 3244  PSI - ok
23:19:02.0476 3244  [ 543A4EF0923BF70D126625B034EF25AF ] PSI_SVC_2       c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
23:19:02.0507 3244  PSI_SVC_2 - ok
23:19:02.0569 3244  [ AB95ECF1F6659A60DDC166D8315B0751 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
23:19:02.0632 3244  ql2300 - ok
23:19:02.0647 3244  [ B4DD51DD25182244B86737DC51AF2270 ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
23:19:02.0678 3244  ql40xx - ok
23:19:02.0710 3244  [ 31AC809E7707EB580B2BDB760390765A ] QWAVE           C:\Windows\system32\qwave.dll
23:19:02.0741 3244  QWAVE - ok
23:19:02.0756 3244  [ 584078CA1B95CA72DF2A27C336F9719D ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
23:19:02.0803 3244  QWAVEdrv - ok
23:19:02.0803 3244  [ 30A81B53C766D0133BB86D234E5556AB ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
23:19:02.0850 3244  RasAcd - ok
23:19:02.0866 3244  [ 57EC4AEF73660166074D8F7F31C0D4FD ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
23:19:02.0897 3244  RasAgileVpn - ok
23:19:02.0912 3244  [ A60F1839849C0C00739787FD5EC03F13 ] RasAuto         C:\Windows\System32\rasauto.dll
23:19:02.0959 3244  RasAuto - ok
23:19:02.0990 3244  [ D9F91EAFEC2815365CBE6D167E4E332A ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
23:19:03.0037 3244  Rasl2tp - ok
23:19:03.0068 3244  [ CB9E04DC05EACF5B9A36CA276D475006 ] RasMan          C:\Windows\System32\rasmans.dll
23:19:03.0115 3244  RasMan - ok
23:19:03.0131 3244  [ 0FE8B15916307A6AC12BFB6A63E45507 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
23:19:03.0162 3244  RasPppoe - ok
23:19:03.0193 3244  [ 44101F495A83EA6401D886E7FD70096B ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
23:19:03.0240 3244  RasSstp - ok
23:19:03.0256 3244  [ D528BC58A489409BA40334EBF96A311B ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
23:19:03.0302 3244  rdbss - ok
23:19:03.0318 3244  [ 0D8F05481CB76E70E1DA06EE9F0DA9DF ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
23:19:03.0334 3244  rdpbus - ok
23:19:03.0349 3244  [ 23DAE03F29D253AE74C44F99E515F9A1 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
23:19:03.0396 3244  RDPCDD - ok
23:19:03.0427 3244  [ B973FCFC50DC1434E1970A146F7E3885 ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
23:19:03.0490 3244  RDPDR - ok
23:19:03.0505 3244  [ 5A53CA1598DD4156D44196D200C94B8A ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
23:19:03.0536 3244  RDPENCDD - ok
23:19:03.0568 3244  [ 44B0A53CD4F27D50ED461DAE0C0B4E1F ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
23:19:03.0614 3244  RDPREFMP - ok
23:19:03.0661 3244  [ 65375DF758CA1872AB7EBBBA457FD5E6 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
23:19:03.0708 3244  RdpVideoMiniport - ok
23:19:03.0739 3244  [ F031683E6D1FEA157ABB2FF260B51E61 ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
23:19:03.0770 3244  RDPWD - ok
23:19:03.0786 3244  [ 518395321DC96FE2C9F0E96AC743B656 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
23:19:03.0802 3244  rdyboost - ok
23:19:03.0848 3244  [ 7B5E1419717FAC363A31CC302895217A ] RemoteAccess    C:\Windows\System32\mprdim.dll
23:19:03.0880 3244  RemoteAccess - ok
23:19:03.0911 3244  [ CB9A8683F4EF2BF99E123D79950D7935 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
23:19:03.0942 3244  RemoteRegistry - ok
23:19:03.0958 3244  [ 78D072F35BC45D9E4E1B61895C152234 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
23:19:04.0004 3244  RpcEptMapper - ok
23:19:04.0036 3244  [ 94D36C0E44677DD26981D2BFEEF2A29D ] RpcLocator      C:\Windows\system32\locator.exe
23:19:04.0067 3244  RpcLocator - ok
23:19:04.0098 3244  [ 7660F01D3B38ACA1747E397D21D790AF ] RpcSs           C:\Windows\system32\rpcss.dll
23:19:04.0129 3244  RpcSs - ok
23:19:04.0160 3244  [ 43110C2A2C5ED32EAD96C440718E4452 ] RRNetCap        C:\Windows\system32\DRIVERS\rrnetcap.sys
23:19:04.0192 3244  RRNetCap - ok
23:19:04.0192 3244  [ 43110C2A2C5ED32EAD96C440718E4452 ] RRNetCapMP      C:\Windows\system32\DRIVERS\rrnetcap.sys
23:19:04.0207 3244  RRNetCapMP - ok
23:19:04.0238 3244  [ 032B0D36AD92B582D869879F5AF5B928 ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
23:19:04.0285 3244  rspndr - ok
23:19:04.0316 3244  [ 7FA7F2E249A5DCBB7970630E15E1F482 ] s3cap           C:\Windows\system32\drivers\vms3cap.sys
23:19:04.0363 3244  s3cap - ok
23:19:04.0394 3244  [ 81951F51E318AECC2D68559E47485CC4 ] SamSs           C:\Windows\system32\lsass.exe
23:19:04.0410 3244  SamSs - ok
23:19:04.0441 3244  [ 05D860DA1040F111503AC416CCEF2BCA ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
23:19:04.0457 3244  sbp2port - ok
23:19:04.0472 3244  [ 08E99184E95A0F03902E46D810A9A10C ] ScanUSBEMPIA    C:\Windows\system32\DRIVERS\emScan.sys
23:19:04.0504 3244  ScanUSBEMPIA - ok
23:19:04.0535 3244  [ 8FC518FFE9519C2631D37515A68009C4 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
23:19:04.0582 3244  SCardSvr - ok
23:19:04.0597 3244  [ 0693B5EC673E34DC147E195779A4DCF6 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
23:19:04.0644 3244  scfilter - ok
23:19:04.0675 3244  [ A04BB13F8A72F8B6E8B4071723E4E336 ] Schedule        C:\Windows\system32\schedsvc.dll
23:19:04.0769 3244  Schedule - ok
23:19:04.0784 3244  [ 319C6B309773D063541D01DF8AC6F55F ] SCPolicySvc     C:\Windows\System32\certprop.dll
23:19:04.0816 3244  SCPolicySvc - ok
23:19:04.0831 3244  [ 08236C4BCE5EDD0A0318A438AF28E0F7 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
23:19:04.0878 3244  SDRSVC - ok
23:19:04.0894 3244  [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
23:19:04.0940 3244  secdrv - ok
23:19:04.0972 3244  [ A59B3A4442C52060CC7A85293AA3546F ] seclogon        C:\Windows\system32\seclogon.dll
23:19:05.0018 3244  seclogon - ok
23:19:05.0096 3244  [ 306F9390976E41063D21AB9AB6D48122 ] Secunia PSI Agent C:\Program Files\Secunia\PSI\PSIA.exe
23:19:05.0315 3244  Secunia PSI Agent - ok
23:19:05.0346 3244  [ 29C852880E9634F8C6BD77A4E68B5B34 ] Secunia Update Agent C:\Program Files\Secunia\PSI\sua.exe
23:19:05.0408 3244  Secunia Update Agent - ok
23:19:05.0424 3244  [ DCB7FCDCC97F87360F75D77425B81737 ] SENS            C:\Windows\System32\sens.dll
23:19:05.0471 3244  SENS - ok
23:19:05.0486 3244  [ 50087FE1EE447009C9CC2997B90DE53F ] SensrSvc        C:\Windows\system32\sensrsvc.dll
23:19:05.0549 3244  SensrSvc - ok
23:19:05.0549 3244  [ 9AD8B8B515E3DF6ACD4212EF465DE2D1 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
23:19:05.0580 3244  Serenum - ok
23:19:05.0611 3244  [ 5FB7FCEA0490D821F26F39CC5EA3D1E2 ] Serial          C:\Windows\system32\DRIVERS\serial.sys
23:19:05.0642 3244  Serial - ok
23:19:05.0658 3244  [ 79BFFB520327FF916A582DFEA17AA813 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
23:19:05.0674 3244  sermouse - ok
23:19:05.0705 3244  [ 4AE380F39A0032EAB7DD953030B26D28 ] SessionEnv      C:\Windows\system32\sessenv.dll
23:19:05.0752 3244  SessionEnv - ok
23:19:05.0767 3244  [ 9F976E1EB233DF46FCE808D9DEA3EB9C ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
23:19:05.0783 3244  sffdisk - ok
23:19:05.0798 3244  [ 932A68EE27833CFD57C1639D375F2731 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
23:19:05.0814 3244  sffp_mmc - ok
23:19:05.0830 3244  [ 6D4CCAEDC018F1CF52866BBBAA235982 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
23:19:05.0845 3244  sffp_sd - ok
23:19:05.0861 3244  [ DB96666CC8312EBC45032F30B007A547 ] sfloppy         C:\Windows\system32\drivers\sfloppy.sys
23:19:05.0876 3244  sfloppy - ok
23:19:05.0923 3244  [ D1A079A0DE2EA524513B6930C24527A2 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
23:19:05.0970 3244  SharedAccess - ok
23:19:06.0001 3244  [ 414DA952A35BF5D50192E28263B40577 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
23:19:06.0048 3244  ShellHWDetection - ok
23:19:06.0048 3244  [ 2565CAC0DC9FE0371BDCE60832582B2E ] sisagp          C:\Windows\system32\drivers\sisagp.sys
23:19:06.0064 3244  sisagp - ok
23:19:06.0079 3244  [ A9F0486851BECB6DDA1D89D381E71055 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
23:19:06.0095 3244  SiSRaid2 - ok
23:19:06.0126 3244  [ 3727097B55738E2F554972C3BE5BC1AA ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
23:19:06.0142 3244  SiSRaid4 - ok
23:19:06.0173 3244  [ FF0DB4D9A08864A5C7B67477CD8E3B2A ] SkypeUpdate     F:\Skype\Updater\Updater.exe
23:19:06.0313 3244  SkypeUpdate - ok
23:19:06.0329 3244  [ 3E21C083B8A01CB70BA1F09303010FCE ] Smb             C:\Windows\system32\DRIVERS\smb.sys
23:19:06.0391 3244  Smb - ok
23:19:06.0438 3244  [ 859E3ADC59D1C89A66AA6492C14D379E ] smserial        C:\Windows\system32\DRIVERS\smserial.sys
23:19:06.0532 3244  smserial - ok
23:19:06.0563 3244  [ 6A984831644ECA1A33FFEAE4126F4F37 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
23:19:06.0578 3244  SNMPTRAP - ok
23:19:06.0610 3244  [ 95CF1AE7527FB70F7816563CBC09D942 ] spldr           C:\Windows\system32\drivers\spldr.sys
23:19:06.0656 3244  spldr - ok
23:19:06.0719 3244  [ 9AEA093B8F9C37CF45538382CABA2475 ] Spooler         C:\Windows\System32\spoolsv.exe
23:19:06.0797 3244  Spooler - ok
23:19:06.0922 3244  [ CF87A1DE791347E75B98885214CED2B8 ] sppsvc          C:\Windows\system32\sppsvc.exe
23:19:07.0078 3244  sppsvc - ok
23:19:07.0093 3244  [ B0180B20B065D89232A78A40FE56EAA6 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
23:19:07.0140 3244  sppuinotify - ok
23:19:07.0171 3244  [ E4C2764065D66EA1D2D3EBC28FE99C46 ] srv             C:\Windows\system32\DRIVERS\srv.sys
23:19:07.0202 3244  srv - ok
23:19:07.0202 3244  [ 03F0545BD8D4C77FA0AE1CEEDFCC71AB ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
23:19:07.0249 3244  srv2 - ok
23:19:07.0249 3244  [ BE6BD660CAA6F291AE06A718A4FA8ABC ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
23:19:07.0280 3244  srvnet - ok
23:19:07.0312 3244  [ D887C9FD02AC9FA880F6E5027A43E118 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
23:19:07.0343 3244  SSDPSRV - ok
23:19:07.0374 3244  [ D318F23BE45D5E3A107469EB64815B50 ] SstpSvc         C:\Windows\system32\sstpsvc.dll
23:19:07.0405 3244  SstpSvc - ok
23:19:07.0436 3244  [ DB32D325C192B801DF274BFD12A7E72B ] stexstor        C:\Windows\system32\drivers\stexstor.sys
23:19:07.0452 3244  stexstor - ok
23:19:07.0499 3244  [ E1FB3706030FB4578A0D72C2FC3689E4 ] StiSvc          C:\Windows\System32\wiaservc.dll
23:19:07.0561 3244  StiSvc - ok
23:19:07.0592 3244  [ 472AF0311073DCECEAA8FA18BA2BDF89 ] storflt         C:\Windows\system32\drivers\vmstorfl.sys
23:19:07.0608 3244  storflt - ok
23:19:07.0639 3244  [ 0BF669F0A910BEDA4A32258D363AF2A5 ] StorSvc         C:\Windows\system32\storsvc.dll
23:19:07.0670 3244  StorSvc - ok
23:19:07.0686 3244  [ DCAFFD62259E0BDB433DD67B5BB37619 ] storvsc         C:\Windows\system32\drivers\storvsc.sys
23:19:07.0702 3244  storvsc - ok
23:19:07.0702 3244  [ E58C78A848ADD9610A4DB6D214AF5224 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
23:19:07.0733 3244  swenum - ok
23:19:07.0764 3244  [ A28BD92DF340E57B024BA433165D34D7 ] swprv           C:\Windows\System32\swprv.dll
23:19:07.0842 3244  swprv - ok
23:19:07.0873 3244  [ 70534D1E4F9AC990536D5FB5B550B3DE ] SynTP           C:\Windows\system32\DRIVERS\SynTP.sys
23:19:07.0904 3244  SynTP - ok
23:19:07.0951 3244  [ 36650D618CA34C9D357DFD3D89B2C56F ] SysMain         C:\Windows\system32\sysmain.dll
23:19:08.0029 3244  SysMain - ok
23:19:08.0060 3244  [ 763FECDC3D30C815FE72DD57936C6CD1 ] TabletInputService C:\Windows\System32\TabSvc.dll
23:19:08.0092 3244  TabletInputService - ok
23:19:08.0123 3244  [ 613BF4820361543956909043A265C6AC ] TapiSrv         C:\Windows\System32\tapisrv.dll
23:19:08.0154 3244  TapiSrv - ok
23:19:08.0201 3244  [ 4780C35A37DE77E0248C6C7AD99DA267 ] tbhsd           C:\Windows\system32\drivers\tbhsd.sys
23:19:08.0216 3244  tbhsd - ok
23:19:08.0232 3244  [ B799D9FDB26111737F58288D8DC172D9 ] TBS             C:\Windows\System32\tbssvc.dll
23:19:08.0279 3244  TBS - ok
23:19:08.0326 3244  [ 7C0507D2391AF5933600CBCED799F277 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
23:19:08.0388 3244  Tcpip - ok
23:19:08.0435 3244  [ 7C0507D2391AF5933600CBCED799F277 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
23:19:08.0466 3244  TCPIP6 - ok
23:19:08.0497 3244  [ 3EEBD3BD93DA46A26E89893C7AB2FF3B ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
23:19:08.0513 3244  tcpipreg - ok
23:19:08.0544 3244  [ 1CB91B2BD8F6DD367DFC2EF26FD751B2 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
23:19:08.0575 3244  TDPIPE - ok
23:19:08.0606 3244  [ 2C2C5AFE7EE4F620D69C23C0617651A8 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
23:19:08.0622 3244  TDTCP - ok
23:19:08.0638 3244  [ B459575348C20E8121D6039DA063C704 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
23:19:08.0669 3244  tdx - ok
23:19:08.0700 3244  [ 04DBF4B01EA4BF25A9A3E84AFFAC9B20 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
23:19:08.0716 3244  TermDD - ok
23:19:08.0747 3244  [ 382C804C92811BE57829D8E550A900E2 ] TermService     C:\Windows\System32\termsrv.dll
23:19:08.0794 3244  TermService - ok
23:19:08.0809 3244  [ 42FB6AFD6B79D9FE07381609172E7CA4 ] Themes          C:\Windows\system32\themeservice.dll
23:19:08.0840 3244  Themes - ok
23:19:08.0856 3244  [ 146B6F43A673379A3C670E86D89BE5EA ] THREADORDER     C:\Windows\system32\mmcss.dll
23:19:08.0887 3244  THREADORDER - ok
23:19:08.0887 3244  [ 4792C0378DB99A9BC2AE2DE6CFFF0C3A ] TrkWks          C:\Windows\System32\trkwks.dll
23:19:08.0950 3244  TrkWks - ok
23:19:08.0981 3244  [ F2AEE22231046CAD8D2F94D2C0F9BEFB ] trufos          C:\Windows\system32\DRIVERS\trufos.sys
23:19:09.0012 3244  trufos - ok
23:19:09.0074 3244  [ 2C49B175AEE1D4364B91B531417FE583 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
23:19:09.0121 3244  TrustedInstaller - ok
23:19:09.0152 3244  [ 254BB140EEE3C59D6114C1A86B636877 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
23:19:09.0199 3244  tssecsrv - ok
23:19:09.0230 3244  [ 9CE253214ACAA5A7D323327D2055EFAA ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
23:19:09.0324 3244  TsUsbFlt - ok
23:19:09.0340 3244  [ 57C527AF84748B5C2F5178C499C0B81F ] TsUsbGD         C:\Windows\system32\drivers\TsUsbGD.sys
23:19:09.0355 3244  TsUsbGD - ok
23:19:09.0449 3244  [ 7D133CB3A08BDFAE656A6580D4A6ED14 ] TuneUp.UtilitiesSvc F:\TuneUp\TuneUpUtilitiesService32.exe
23:19:09.0605 3244  TuneUp.UtilitiesSvc - ok
23:19:09.0620 3244  [ 94C4CD2D19B8C4137A46261F229FEC24 ] TuneUpUtilitiesDrv F:\TuneUp\TuneUpUtilitiesDriver32.sys
23:19:09.0636 3244  TuneUpUtilitiesDrv - ok
23:19:09.0667 3244  [ B2FA25D9B17A68BB93D58B0556E8C90D ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
23:19:09.0714 3244  tunnel - ok
23:19:09.0730 3244  [ 750FBCB269F4D7DD2E420C56B795DB6D ] uagp35          C:\Windows\system32\drivers\uagp35.sys
23:19:09.0745 3244  uagp35 - ok
23:19:09.0761 3244  [ EE43346C7E4B5E63E54F927BABBB32FF ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
23:19:09.0823 3244  udfs - ok
23:19:09.0854 3244  [ 8344FD4FCE927880AA1AA7681D4927E5 ] UI0Detect       C:\Windows\system32\UI0Detect.exe
23:19:09.0886 3244  UI0Detect - ok
23:19:09.0901 3244  [ 44E8048ACE47BEFBFDC2E9BE4CBC8880 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
23:19:09.0917 3244  uliagpkx - ok
23:19:09.0932 3244  [ D295BED4B898F0FD999FCFA9B32B071B ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
23:19:09.0948 3244  umbus - ok
23:19:09.0964 3244  [ 7550AD0C6998BA1CB4843E920EE0FEAC ] UmPass          C:\Windows\system32\drivers\umpass.sys
23:19:09.0995 3244  UmPass - ok
23:19:10.0026 3244  [ 409994A8EACEEE4E328749C0353527A0 ] UmRdpService    C:\Windows\System32\umrdp.dll
23:19:10.0057 3244  UmRdpService - ok
23:19:10.0104 3244  [ 1C5835420F2A8F6D683FD6BDFFA2FFDD ] UPDATESRV       C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe
23:19:10.0166 3244  UPDATESRV - ok
23:19:10.0198 3244  [ 833FBB672460EFCE8011D262175FAD33 ] upnphost        C:\Windows\System32\upnphost.dll
23:19:10.0260 3244  upnphost - ok
23:19:10.0307 3244  [ 1D9F2BD026E8E2D45033A4DF3F16B78C ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
23:19:10.0322 3244  usbaudio - ok
23:19:10.0354 3244  [ BD9C55D7023C5DE374507ACC7A14E2AC ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
23:19:10.0385 3244  usbccgp - ok
23:19:10.0416 3244  [ 04EC7CEC62EC3B6D9354EEE93327FC82 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
23:19:10.0432 3244  usbcir - ok
23:19:10.0447 3244  [ F92DE757E4B7CE9C07C5E65423F3AE3B ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys
23:19:10.0478 3244  usbehci - ok
23:19:10.0510 3244  [ 8DC94AEC6A7E644A06135AE7506DC2E9 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
23:19:10.0525 3244  usbhub - ok
23:19:10.0541 3244  [ E185D44FAC515A18D9DEDDC23C2CDF44 ] usbohci         C:\Windows\system32\drivers\usbohci.sys
23:19:10.0556 3244  usbohci - ok
23:19:10.0572 3244  [ 797D862FE0875E75C7CC4C1AD7B30252 ] usbprint        C:\Windows\system32\drivers\usbprint.sys
23:19:10.0603 3244  usbprint - ok
23:19:10.0619 3244  [ F991AB9CC6B908DB552166768176896A ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
23:19:10.0666 3244  USBSTOR - ok
23:19:10.0681 3244  [ 68DF884CF41CDADA664BEB01DAF67E3D ] usbuhci         C:\Windows\system32\DRIVERS\usbuhci.sys
23:19:10.0712 3244  usbuhci - ok
23:19:10.0744 3244  [ 081E6E1C91AEC36758902A9F727CD23C ] UxSms           C:\Windows\System32\uxsms.dll
23:19:10.0775 3244  UxSms - ok
23:19:10.0806 3244  [ 81951F51E318AECC2D68559E47485CC4 ] VaultSvc        C:\Windows\system32\lsass.exe
23:19:10.0822 3244  VaultSvc - ok
23:19:10.0837 3244  [ A059C4C3EDB09E07D21A8E5C0AABD3CB ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
23:19:10.0853 3244  vdrvroot - ok
23:19:10.0884 3244  [ C3CD30495687C2A2F66A65CA6FD89BE9 ] vds             C:\Windows\System32\vds.exe
23:19:10.0962 3244  vds - ok
23:19:10.0978 3244  [ 17C408214EA61696CEC9C66E388B14F3 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
23:19:11.0009 3244  vga - ok
23:19:11.0024 3244  [ 8E38096AD5C8570A6F1570A61E251561 ] VgaSave         C:\Windows\System32\drivers\vga.sys
23:19:11.0056 3244  VgaSave - ok
23:19:11.0087 3244  [ 5461686CCA2FDA57B024547733AB42E3 ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
23:19:11.0102 3244  vhdmp - ok
23:19:11.0102 3244  [ C829317A37B4BEA8F39735D4B076E923 ] viaagp          C:\Windows\system32\drivers\viaagp.sys
23:19:11.0118 3244  viaagp - ok
23:19:11.0134 3244  [ E02F079A6AA107F06B16549C6E5C7B74 ] ViaC7           C:\Windows\system32\drivers\viac7.sys
23:19:11.0165 3244  ViaC7 - ok
23:19:11.0180 3244  [ E43574F6A56A0EE11809B48C09E4FD3C ] viaide          C:\Windows\system32\drivers\viaide.sys
23:19:11.0196 3244  viaide - ok
23:19:11.0243 3244  [ C2F2911156FDC7817C52829C86DA494E ] vmbus           C:\Windows\system32\drivers\vmbus.sys
23:19:11.0258 3244  vmbus - ok
23:19:11.0274 3244  [ D4D77455211E204F370D08F4963063CE ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
23:19:11.0305 3244  VMBusHID - ok
23:19:11.0321 3244  [ 4C63E00F2F4B5F86AB48A58CD990F212 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
23:19:11.0352 3244  volmgr - ok
23:19:11.0352 3244  [ B5BB72067DDDDBBFB04B2F89FF8C3C87 ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
23:19:11.0383 3244  volmgrx - ok
23:19:11.0399 3244  [ F497F67932C6FA693D7DE2780631CFE7 ] volsnap         C:\Windows\system32\drivers\volsnap.sys
23:19:11.0414 3244  volsnap - ok
23:19:11.0430 3244  [ 9DFA0CC2F8855A04816729651175B631 ] vsmraid         C:\Windows\system32\drivers\vsmraid.sys
23:19:11.0446 3244  vsmraid - ok
23:19:11.0508 3244  [ 209A3B1901B83AEB8527ED211CCE9E4C ] VSS             C:\Windows\system32\vssvc.exe
23:19:11.0602 3244  VSS - ok
23:19:11.0680 3244  [ F92F8B40FA98A631ADAA772ABA7FA7EE ] VSSERV          C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe
23:19:11.0742 3244  VSSERV - ok
23:19:11.0758 3244  [ 90567B1E658001E79D7C8BBD3DDE5AA6 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
23:19:11.0820 3244  vwifibus - ok
23:19:11.0836 3244  [ 55187FD710E27D5095D10A472C8BAF1C ] W32Time         C:\Windows\system32\w32time.dll
23:19:11.0898 3244  W32Time - ok
23:19:11.0914 3244  [ DE3721E89C653AA281428C8A69745D90 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
23:19:11.0945 3244  WacomPen - ok
23:19:11.0960 3244  [ 3C3C78515F5AB448B022BDF5B8FFDD2E ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
23:19:11.0992 3244  WANARP - ok
23:19:11.0992 3244  [ 3C3C78515F5AB448B022BDF5B8FFDD2E ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
23:19:12.0023 3244  Wanarpv6 - ok
23:19:12.0085 3244  [ 353A04C273EC58475D8633E75CCD5604 ] WatAdminSvc     C:\Windows\system32\Wat\WatAdminSvc.exe
23:19:12.0210 3244  WatAdminSvc - ok
23:19:12.0257 3244  [ 691E3285E53DCA558E1A84667F13E15A ] wbengine        C:\Windows\system32\wbengine.exe
23:19:12.0319 3244  wbengine - ok
23:19:12.0350 3244  [ 9614B5D29DC76AC3C29F6D2D3AA70E67 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
23:19:12.0382 3244  WbioSrvc - ok
23:19:12.0413 3244  [ 34EEE0DFAADB4F691D6D5308A51315DC ] wcncsvc         C:\Windows\System32\wcncsvc.dll
23:19:12.0444 3244  wcncsvc - ok
23:19:12.0460 3244  [ 5D930B6357A6D2AF4D7653BDABBF352F ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
23:19:12.0506 3244  WcsPlugInService - ok
23:19:12.0538 3244  [ 1112A9BADACB47B7C0BB0392E3158DFF ] Wd              C:\Windows\system32\drivers\wd.sys
23:19:12.0553 3244  Wd - ok
23:19:12.0584 3244  [ A840213F1ACDCC175B4D1D5AAEAC0D7A ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
23:19:12.0616 3244  Wdf01000 - ok
23:19:12.0631 3244  [ 46EF9DC96265FD0B423DB72E7C38C2A5 ] WdiServiceHost  C:\Windows\system32\wdi.dll
23:19:12.0678 3244  WdiServiceHost - ok
23:19:12.0694 3244  [ 46EF9DC96265FD0B423DB72E7C38C2A5 ] WdiSystemHost   C:\Windows\system32\wdi.dll
23:19:12.0709 3244  WdiSystemHost - ok
23:19:12.0725 3244  [ A9D880F97530D5B8FEE278923349929D ] WebClient       C:\Windows\System32\webclnt.dll
23:19:12.0756 3244  WebClient - ok
23:19:12.0787 3244  [ 760F0AFE937A77CFF27153206534F275 ] Wecsvc          C:\Windows\system32\wecsvc.dll
23:19:12.0818 3244  Wecsvc - ok
23:19:12.0834 3244  [ AC804569BB2364FB6017370258A4091B ] wercplsupport   C:\Windows\System32\wercplsupport.dll
23:19:12.0865 3244  wercplsupport - ok
23:19:12.0881 3244  [ 08E420D873E4FD85241EE2421B02C4A4 ] WerSvc          C:\Windows\System32\WerSvc.dll
23:19:12.0928 3244  WerSvc - ok
23:19:12.0959 3244  [ 8B9A943F3B53861F2BFAF6C186168F79 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
23:19:12.0990 3244  WfpLwf - ok
23:19:13.0006 3244  [ 5CF95B35E59E2A38023836FFF31BE64C ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
23:19:13.0021 3244  WIMMount - ok
23:19:13.0084 3244  [ 3FAE8F94296001C32EAB62CD7D82E0FD ] WinDefend       C:\Program Files\Windows Defender\mpsvc.dll
23:19:13.0146 3244  WinDefend - ok
23:19:13.0162 3244  WinHttpAutoProxySvc - ok
23:19:13.0208 3244  [ F62E510B6AD4C21EB9FE8668ED251826 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
23:19:13.0255 3244  Winmgmt - ok
23:19:13.0411 3244  [ 1B91CD34EA3A90AB6A4EF0550174F4CC ] WinRM           C:\Windows\system32\WsmSvc.dll
23:19:13.0552 3244  WinRM - ok
23:19:13.0598 3244  [ A67E5F9A400F3BD1BE3D80613B45F708 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
23:19:13.0630 3244  WinUsb - ok
23:19:13.0676 3244  [ 16935C98FF639D185086A3529B1F2067 ] Wlansvc         C:\Windows\System32\wlansvc.dll
23:19:13.0739 3244  Wlansvc - ok
23:19:13.0832 3244  [ 5E7C103F8475C4289847D15E129C20F7 ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
23:19:13.0942 3244  wlidsvc - ok
23:19:13.0957 3244  [ 0217679B8FCA58714C3BF2726D2CA84E ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
23:19:13.0988 3244  WmiAcpi - ok
23:19:14.0020 3244  [ 6EB6B66517B048D87DC1856DDF1F4C3F ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
23:19:14.0051 3244  wmiApSrv - ok
23:19:14.0129 3244  [ 3B40D3A61AA8C21B88AE57C58AB3122E ] WMPNetworkSvc   C:\Program Files\Windows Media Player\wmpnetwk.exe
23:19:14.0238 3244  WMPNetworkSvc - ok
23:19:14.0269 3244  [ A2F0EC770A92F2B3F9DE6D518E11409C ] WPCSvc          C:\Windows\System32\wpcsvc.dll
23:19:14.0316 3244  WPCSvc - ok
23:19:14.0332 3244  [ AA53356D60AF47EACC85BC617A4F3F66 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
23:19:14.0378 3244  WPDBusEnum - ok
23:19:14.0410 3244  [ 6DB3276587B853BF886B69528FDB048C ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
23:19:14.0472 3244  ws2ifsl - ok
23:19:14.0488 3244  [ 6F5D49EFE0E7164E03AE773A3FE25340 ] wscsvc          C:\Windows\System32\wscsvc.dll
23:19:14.0519 3244  wscsvc - ok
23:19:14.0519 3244  WSearch - ok
23:19:14.0612 3244  [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv        C:\Windows\system32\wuaueng.dll
23:19:14.0722 3244  wuauserv - ok
23:19:14.0753 3244  [ 06E6F32C8D0A3F66D956F57B43A2E070 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
23:19:14.0768 3244  WudfPf - ok
23:19:14.0784 3244  [ 867C301E8B790040AE9CF6486E8041DF ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
23:19:14.0815 3244  WUDFRd - ok
23:19:14.0846 3244  [ FE47B7BC8EA320C2D9B5E5BF6E303765 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
23:19:14.0878 3244  wudfsvc - ok
23:19:14.0909 3244  [ FF2D745B560F7C71B31F30F4D49F73D2 ] WwanSvc         C:\Windows\System32\wwansvc.dll
23:19:14.0940 3244  WwanSvc - ok
23:19:15.0002 3244  [ B07C5B7EFDF936FF93D4F540938725BE ] yukonw7         C:\Windows\system32\DRIVERS\yk62x86.sys
23:19:15.0018 3244  yukonw7 - ok
23:19:15.0049 3244  [ BDFA6A3A7CE1D083889B316A484A356A ] zntport         C:\Windows\system32\drivers\zntport.sys
23:19:15.0080 3244  zntport - ok
23:19:15.0096 3244  ================ Scan global ===============================
23:19:15.0174 3244  [ DAB748AE0439955ED2FA22357533DDDB ] C:\Windows\system32\basesrv.dll
23:19:15.0205 3244  [ 1F5F07091D50244F17DD8D5147A628CC ] C:\Windows\system32\winsrv.dll
23:19:15.0221 3244  [ 1F5F07091D50244F17DD8D5147A628CC ] C:\Windows\system32\winsrv.dll
23:19:15.0252 3244  [ 364455805E64882844EE9ACB72522830 ] C:\Windows\system32\sxssrv.dll
23:19:15.0299 3244  [ 5F1B6A9C35D3D5CA72D6D6FDEF9747D6 ] C:\Windows\system32\services.exe
23:19:15.0314 3244  [Global] - ok
23:19:15.0314 3244  ================ Scan MBR ==================================
23:19:15.0346 3244  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
23:19:15.0751 3244  \Device\Harddisk0\DR0 - ok
23:19:15.0751 3244  ================ Scan VBR ==================================
23:19:15.0767 3244  [ F4BDB14AD1FCEA1D3808FDCBE2F94226 ] \Device\Harddisk0\DR0\Partition1
23:19:15.0767 3244  \Device\Harddisk0\DR0\Partition1 - ok
23:19:15.0767 3244  [ 7E6F7A2B5F1C6F2352C34D353243EED1 ] \Device\Harddisk0\DR0\Partition2
23:19:15.0782 3244  \Device\Harddisk0\DR0\Partition2 - ok
23:19:15.0814 3244  [ 5DBA922ACBDE5A36533D3822A086B028 ] \Device\Harddisk0\DR0\Partition3
23:19:15.0814 3244  \Device\Harddisk0\DR0\Partition3 - ok
23:19:15.0829 3244  [ 216E4D2BF02866C0D700DBEF4088796A ] \Device\Harddisk0\DR0\Partition4
23:19:15.0829 3244  \Device\Harddisk0\DR0\Partition4 - ok
23:19:15.0829 3244  ============================================================
23:19:15.0829 3244  Scan finished
23:19:15.0829 3244  ============================================================
23:19:15.0860 3180  Detected object count: 0
23:19:15.0860 3180  Actual detected object count: 0
23:20:01.0334 1328  Deinitialize success

cosinus · 09.05.2013, 22:39

unauffällig

JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Im Anschluss:

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Danach eine Kontrolle mit OTL bitte:

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Setze oben mittig den Haken bei Scanne alle Benutzer
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles in CODE-Tags hier in den Thread.

Traxxcell · 10.05.2013, 08:16

Hier die Log-Dateien von JRT - adwCleaner und OTL

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Professional x86
Ran by Fujitsu on 10.05.2013 at  8:39:51,72
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] "C:\Windows\system32\turegopt.exe"



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Fujitsu\AppData\Roaming\software informer"
Successfully deleted: [Folder] "C:\Windows\system32\ai_recyclebin"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 10.05.2013 at  8:43:07,25
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Code:

ATTFilter

# AdwCleaner v2.300 - Datei am 10/05/2013 um 08:48:50 erstellt
# Aktualisiert am 28/04/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzer : Fujitsu - FUJITSU-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Fujitsu\Desktop\Trojanerboard\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16537

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v16.0.2 (de)

Datei : C:\Users\Fujitsu\AppData\Roaming\Mozilla\Firefox\Profiles\q0csvptr.default\prefs.js

C:\Users\Fujitsu\AppData\Roaming\Mozilla\Firefox\Profiles\q0csvptr.default\user.js ... Gelöscht !

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [1131 octets] - [10/05/2013 08:48:50]

########## EOF - C:\AdwCleaner[S1].txt - [1191 octets] ##########

Code:

ATTFilter

OTL logfile created on: 10.05.2013 08:55:43 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Fujitsu\Desktop\Trojanerboard
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,27 Gb Available Physical Memory | 63,69% Memory free
3,98 Gb Paging File | 2,96 Gb Available in Paging File | 74,25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 48,83 Gb Total Space | 29,94 Gb Free Space | 61,32% Space Free | Partition Type: NTFS
Drive D: | 19,53 Gb Total Space | 9,61 Gb Free Space | 49,20% Space Free | Partition Type: NTFS
Drive E: | 97,65 Gb Total Space | 93,99 Gb Free Space | 96,25% Space Free | Partition Type: NTFS
Drive F: | 66,86 Gb Total Space | 63,60 Gb Free Space | 95,13% Space Free | Partition Type: NTFS
 
Computer Name: FUJITSU-PC | User Name: Fujitsu | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Fujitsu\Desktop\Trojanerboard\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Bitdefender\Bitdefender 2013\bdagent.exe (Bitdefender)
PRC - C:\Programme\Bitdefender\Bitdefender 2013\vsserv.exe (Bitdefender)
PRC - C:\Programme\Bitdefender\Bitdefender 2013\updatesrv.exe (Bitdefender)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Secunia\PSI\psia.exe (Secunia)
PRC - C:\Programme\Secunia\PSI\sua.exe (Secunia)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - F:\TuneUp\TuneUpUtilitiesApp32.exe (TuneUp Software)
PRC - F:\TuneUp\TuneUpUtilitiesService32.exe (TuneUp Software)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.)
PRC - F:\Nitro PDF\NitroPDFDriverService2.exe (Nitro PDF Software)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - c:\Programme\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
PRC - C:\Programme\FSC\Wireless Utility\WirelessSelector.exe (ITE Tech Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Bitdefender\Bitdefender 2013\txmlutil.dll ()
MOD - C:\Programme\Bitdefender\Bitdefender 2013\bdmetrics.dll ()
MOD - F:\Nitro PDF\NPShellExtension.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (VSSERV) -- C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe (Bitdefender)
SRV - (UPDATESRV) -- C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe (Bitdefender)
SRV - (BdDesktopParental) -- C:\Programme\Bitdefender\Bitdefender 2013\bdparentalservice.exe (Bitdefender)
SRV - (SkypeUpdate) -- F:\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (Secunia PSI Agent) -- C:\Programme\Secunia\PSI\psia.exe (Secunia)
SRV - (Secunia Update Agent) -- C:\Programme\Secunia\PSI\sua.exe (Secunia)
SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (TuneUp.UtilitiesSvc) -- F:\TuneUp\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (wlidsvc) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (NitroDriverReadSpool2) -- F:\Nitro PDF\NitroPDFDriverService2.exe (Nitro PDF Software)
SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (PSI_SVC_2) -- c:\Programme\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (BdfNdisf) -- c:\Programme\Common Files\Bitdefender\Bitdefender Firewall\bdfndisf6.sys (BitDefender LLC)
DRV - (avckf) -- C:\Windows\System32\drivers\avckf.sys (BitDefender)
DRV - (avc3) -- C:\Windows\System32\drivers\avc3.sys (BitDefender)
DRV - (gzflt) -- C:\Windows\System32\drivers\gzflt.sys (BitDefender LLC)
DRV - (tbhsd) -- C:\Windows\System32\drivers\tbhsd.sys (RapidSolution Software AG)
DRV - (RRNetCapMP) -- C:\Windows\System32\drivers\rrnetcap.sys (RapidSolution Software AG)
DRV - (RRNetCap) -- C:\Windows\System32\drivers\rrnetcap.sys (RapidSolution Software AG)
DRV - (IT9135BDA) -- C:\Windows\System32\drivers\IT9135BDA.sys (ITE                      )
DRV - (GT72UBUS) -- C:\Windows\System32\drivers\gt72ubus.sys (Option N.V.)
DRV - (GTPTSER) -- C:\Windows\System32\drivers\gtptser.sys (Option N.V.)
DRV - (GT72NDISIPXP) -- C:\Windows\System32\drivers\Gt51Ip.sys (Option N.V.)
DRV - (BDSandBox) -- C:\Windows\System32\drivers\bdsandbox.sys (BitDefender SRL)
DRV - (avchv) -- C:\Windows\System32\drivers\avchv.sys (BitDefender)
DRV - (trufos) -- C:\Windows\System32\drivers\trufos.sys (BitDefender S.R.L.)
DRV - (bdselfpr) -- C:\Programme\Bitdefender\Bitdefender 2013\bdselfpr.sys (BitDefender LLC)
DRV - (TuneUpUtilitiesDrv) -- F:\TuneUp\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (TsUsbGD) -- C:\Windows\System32\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (bdfwfpf) -- C:\Programme\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys (BitDefender LLC)
DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (dmvsc) -- C:\Windows\System32\drivers\dmvsc.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (PSI) -- C:\Windows\System32\drivers\psi_mf.sys (Secunia)
DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (Serial) -- C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.)
DRV - (yukonw7) -- C:\Windows\System32\drivers\yk62x86.sys (Marvell)
DRV - (netw5v32) -- C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation)
DRV - (zntport) -- C:\Windows\System32\drivers\zntport.sys (Zeal SoftStudio)
DRV - (DCamUSBEMPIA) -- C:\Windows\System32\drivers\emDevice.sys (eMPIA Technology, Inc.)
DRV - (FiltUSBEMPIA) -- C:\Windows\System32\drivers\emFilter.sys (eMPIA Technology, Inc.)
DRV - (ScanUSBEMPIA) -- C:\Windows\System32\drivers\emScan.sys (eMPIA Technology, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-2669550064-1252959950-52234001-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-2669550064-1252959950-52234001-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-2669550064-1252959950-52234001-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-2669550064-1252959950-52234001-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 26 09 A8 2A F3 C4 CD 01  [binary data]
IE - HKU\S-1-5-21-2669550064-1252959950-52234001-1000\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-21-2669550064-1252959950-52234001-1000\..\SearchScopes\{00C93BEF-5717-4446-BAD9-025A94D80801}: "URL" = hxxp://suche.web.de/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin
IE - HKU\S-1-5-21-2669550064-1252959950-52234001-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKU\S-1-5-21-2669550064-1252959950-52234001-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-2669550064-1252959950-52234001-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de"
FF - prefs.js..extensions.enabledAddons: %7Bdf4e4df5-5cb7-46b0-9aef-6c784c3249f8%7D:1.2.0
FF - prefs.js..extensions.enabledAddons: %7Bd40f5e7b-d2cf-4856-b441-cc613eeffbe3%7D:1.68
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.14
FF - prefs.js..extensions.enabledAddons: %7B1018e4d6-728f-4b20-ad56-37578a4de76b%7D:4.2.8
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: F:\VLC-Player\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: F:\FireFox\components [2013.04.11 21:41:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\bdThunderbird@bitdefender.com: C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext [2013.02.16 09:28:21 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: F:\FireFox\components [2013.04.11 21:41:58 | 000,000,000 | ---D | M]
 
[2012.11.17 20:56:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fujitsu\AppData\Roaming\mozilla\Extensions
[2013.05.08 21:23:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fujitsu\AppData\Roaming\mozilla\Firefox\Profiles\q0csvptr.default\extensions
[2013.04.16 07:55:12 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Fujitsu\AppData\Roaming\mozilla\Firefox\Profiles\q0csvptr.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2013.02.23 23:09:38 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Fujitsu\AppData\Roaming\mozilla\Firefox\Profiles\q0csvptr.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2013.05.08 21:23:43 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\Fujitsu\AppData\Roaming\mozilla\firefox\profiles\q0csvptr.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.02.21 14:12:01 | 000,138,614 | ---- | M] () (No name found) -- C:\Users\Fujitsu\AppData\Roaming\mozilla\firefox\profiles\q0csvptr.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
[2012.11.18 13:25:26 | 000,026,136 | ---- | M] () (No name found) -- C:\Users\Fujitsu\AppData\Roaming\mozilla\firefox\profiles\q0csvptr.default\extensions\{df4e4df5-5cb7-46b0-9aef-6c784c3249f8}.xpi
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - F:\MS-Office\Office12\EXCEL.EXE (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{460E4A91-B261-4109-A4FE-202F621323C8}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\livecall - No CLSID value found
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2012.11.17 17:31:30 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{c22fbbe1-4ff2-11e2-ada9-00f1d000f1d0}\Shell - "" = AutoRun
O33 - MountPoints2\{c22fbbe1-4ff2-11e2-ada9-00f1d000f1d0}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -a
O33 - MountPoints2\{c22fbbea-4ff2-11e2-ada9-00f1d000f1d0}\Shell - "" = AutoRun
O33 - MountPoints2\{c22fbbea-4ff2-11e2-ada9-00f1d000f1d0}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -a
O33 - MountPoints2\I\Shell - "" = AutoRun
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\LaunchU3.exe -a
O33 - MountPoints2\K\Shell - "" = AutoRun
O33 - MountPoints2\K\Shell\AutoRun\command - "" = K:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (sdnclean.exe)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.05.10 08:39:48 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.05.10 08:39:35 | 000,000,000 | ---D | C] -- C:\JRT
[2013.05.09 18:34:58 | 000,000,000 | ---D | C] -- C:\Users\Fujitsu\Desktop\Trojanerboard
[2013.05.08 17:17:34 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\Fujitsu\Desktop\HiJackThis204.exe
[2013.05.06 09:33:00 | 000,000,000 | ---D | C] -- C:\Users\Fujitsu\Desktop\Fotos
[2013.05.02 21:19:28 | 000,000,000 | ---D | C] -- C:\Users\Fujitsu\AppData\Roaming\NetSpeedMonitor
[2013.04.29 17:40:14 | 000,486,536 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\avckf.sys
[2013.04.29 17:40:13 | 000,633,344 | ---- | C] (BitDefender) -- C:\Windows\System32\drivers\avc3.sys
[2013.04.29 11:01:11 | 000,000,000 | ---D | C] -- C:\Users\Fujitsu\Desktop\Neuer Ordner
[2013.04.18 13:25:20 | 000,000,000 | ---D | C] -- C:\Users\Fujitsu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Skat-Online
[2013.04.18 11:26:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2013.04.18 11:17:25 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2013.04.18 11:17:15 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2013.04.18 11:17:15 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2013.04.18 11:17:15 | 000,094,112 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
[2013.04.15 08:25:27 | 000,253,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\Setup1.exe
[2013.04.15 08:25:26 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\ST6UNST.EXE
[2011.04.18 23:51:20 | 000,653,136 | ---- | C] (Microsoft Corporation) -- C:\Program Files\Common Files\MSVCR90.dll
[2011.04.18 23:51:20 | 000,569,680 | ---- | C] (Microsoft Corporation) -- C:\Program Files\Common Files\MSVCP90.dll
[2010.12.16 22:39:36 | 000,302,592 | ---- | C] (Google) -- C:\Program Files\Common Files\webmmux.dll
[2010.12.16 22:39:16 | 000,701,440 | ---- | C] (Google) -- C:\Program Files\Common Files\vp8encoder.dll
[2010.12.16 22:39:16 | 000,412,672 | ---- | C] (Google) -- C:\Program Files\Common Files\vp8decoder.dll
[2010.12.16 22:39:14 | 000,292,352 | ---- | C] (Google) -- C:\Program Files\Common Files\webmsplit.dll
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.05.10 08:58:12 | 000,021,904 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.10 08:58:12 | 000,021,904 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.10 08:55:26 | 000,696,870 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.05.10 08:55:26 | 000,652,148 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.05.10 08:55:26 | 000,148,134 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.05.10 08:55:26 | 000,121,080 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.05.10 08:50:39 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.08 17:17:34 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Fujitsu\Desktop\HiJackThis204.exe
[2013.04.29 21:36:58 | 000,000,969 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013.04.29 17:40:14 | 000,486,536 | ---- | M] (BitDefender) -- C:\Windows\System32\drivers\avckf.sys
[2013.04.29 17:40:13 | 000,633,344 | ---- | M] (BitDefender) -- C:\Windows\System32\drivers\avc3.sys
[2013.04.21 08:03:18 | 000,281,936 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.04.18 13:25:20 | 000,002,400 | ---- | M] () -- C:\Users\Fujitsu\Desktop\Skat-Online V9.lnk
[2013.04.18 11:22:51 | 000,691,592 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.04.18 11:22:51 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.04.15 08:28:33 | 000,253,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\Setup1.exe
[2013.04.15 08:28:32 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\ST6UNST.EXE
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.04.21 08:02:53 | 000,281,936 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.04.18 13:25:20 | 000,002,400 | ---- | C] () -- C:\Users\Fujitsu\Desktop\Skat-Online V9.lnk
[2013.04.01 11:40:08 | 000,125,440 | ---- | C] () -- C:\Windows\System32\lua5.1a.dll
[2013.03.05 23:46:31 | 000,007,601 | ---- | C] () -- C:\Users\Fujitsu\AppData\Local\Resmon.ResmonCfg
[2013.02.17 17:50:54 | 000,004,509 | ---- | C] () -- C:\Users\Fujitsu\AppData\Roaming\CamStudio.cfg
[2013.02.17 17:50:54 | 000,000,408 | ---- | C] () -- C:\Users\Fujitsu\AppData\Roaming\CamShapes.ini
[2013.02.17 17:50:54 | 000,000,408 | ---- | C] () -- C:\Users\Fujitsu\AppData\Roaming\CamLayout.ini
[2013.02.17 17:50:54 | 000,000,096 | ---- | C] () -- C:\Users\Fujitsu\AppData\Roaming\Camdata.ini
[2013.02.16 09:29:40 | 001,098,914 | ---- | C] () -- C:\ProgramData\1360998461.bdinstall.bin
[2013.01.30 13:13:21 | 000,000,418 | ---- | C] () -- C:\Windows\wiso.ini
[2013.01.01 14:16:06 | 000,000,101 | ---- | C] () -- C:\Windows\System32\ud-boot-time.ini
[2012.11.19 12:41:35 | 000,373,513 | ---- | C] () -- C:\Windows\System32\drivers\RTAIODAT.DAT
[2012.11.18 15:15:29 | 000,000,014 | ---- | C] () -- C:\Windows\System32\SysInfo_6.dll
[2012.11.18 15:13:22 | 000,000,245 | ---- | C] () -- C:\Windows\System32\AF15IRTBL.bin
[2012.11.18 12:03:30 | 000,140,288 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll
[2012.10.29 17:44:56 | 000,315,392 | ---- | C] () -- C:\Windows\System32\EMRegSys.dll
[2012.05.11 15:16:16 | 000,171,520 | ---- | C] () -- C:\Program Files\Common Files\dsfOggDemux2.dll
[2011.01.12 03:00:44 | 000,030,208 | ---- | C] () -- C:\Program Files\Common Files\wmpinfo.dll
[2011.01.12 03:00:42 | 000,240,128 | ---- | C] () -- C:\Program Files\Common Files\dsfVorbisDecoder.dll
[2011.01.12 03:00:42 | 000,146,944 | ---- | C] () -- C:\Program Files\Common Files\dsfFLACDecoder.dll
[2011.01.12 03:00:40 | 000,221,184 | ---- | C] () -- C:\Program Files\Common Files\dsfFLACEncoder.dll
[2011.01.12 03:00:40 | 000,204,800 | ---- | C] () -- C:\Program Files\Common Files\dsfNativeFLACSource.dll
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 23:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

Code:

ATTFilter

OTL Extras logfile created on: 10.05.2013 08:55:43 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Fujitsu\Desktop\Trojanerboard
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,27 Gb Available Physical Memory | 63,69% Memory free
3,98 Gb Paging File | 2,96 Gb Available in Paging File | 74,25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 48,83 Gb Total Space | 29,94 Gb Free Space | 61,32% Space Free | Partition Type: NTFS
Drive D: | 19,53 Gb Total Space | 9,61 Gb Free Space | 49,20% Space Free | Partition Type: NTFS
Drive E: | 97,65 Gb Total Space | 93,99 Gb Free Space | 96,25% Space Free | Partition Type: NTFS
Drive F: | 66,86 Gb Total Space | 63,60 Gb Free Space | 95,13% Space Free | Partition Type: NTFS
 
Computer Name: FUJITSU-PC | User Name: Fujitsu | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-2669550064-1252959950-52234001-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- F:\FireFox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "F:\MS-Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "F:\MS-Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "F:\VLC-Player\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [Digital Photo Professional] -- C:\Program Files\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Mit Corel PaintShop Pro X4 durchsuchen] -- "F:\PaintShop\Corel PaintShop Pro X4\Corel PaintShop Pro.exe" "%L" (Corel, Inc.)
Directory [PlayWithVLC] -- "F:\VLC-Player\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{027EED35-4076-4F44-82CB-F28DEAE0BAE2}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{18748310-B32B-452F-9C5C-B60B84EDCB6D}" = lport=31931 | protocol=6 | dir=in | name=audials localhttpserver 31931 | 
"{30CE9969-1030-4035-B69F-EE218141FD3E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{326DDBE2-350A-4874-ADBF-F130DFF2AB82}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{6C9B985D-EDD5-4BF3-B5A7-8FE7D3BD3F58}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{712ED333-0903-4A8D-9049-E06125CB209C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{805339A0-C93D-4554-B531-25033877A58D}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{86B6C3A3-3DCA-4306-8638-204A905873F6}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{A52765A5-CD6A-4C43-B4A2-32C7440AA110}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{CBEAF140-F02F-4BE3-8FE8-8AA3D93AA140}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{D92571B8-C17F-48A1-8CE9-ED165418D0F3}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{DB9CFB16-9821-46F2-9CD7-9F1DEBE557D3}" = lport=12972 | protocol=6 | dir=in | name=audials localhttpserver 12972 | 
"{E2D11A1E-8017-42A0-9F0C-C62FE1414EF1}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe | 
"{F9D0D684-553F-4500-B3BB-09010407BEBB}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{FF9E81E2-8B49-423E-ABB7-F3C77AB4EDB8}" = lport=14714 | protocol=6 | dir=in | name=audials localhttpserver 14714 | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{013E4DC0-1AE1-4AC9-928E-148ADB194889}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{205D183C-4A47-4848-9811-EEE4E0A70973}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{2D1FF28D-5A5C-41B9-A00E-005FA934C4CB}" = protocol=6 | dir=in | app=f:\maxthon3\bin\mxup.exe | 
"{32069C4B-73DA-4DF9-BDC7-5F1C867E7045}" = protocol=17 | dir=in | app=f:\maxthon3\bin\mxup.exe | 
"{3AB1218C-8D32-45FF-AD74-FEB5FB1F91F8}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | 
"{4400908B-6A00-4BC6-A6C8-A16D64FC7937}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{49BD0CA3-7BC4-4126-B873-F77829F1FF4E}" = dir=in | app=f:\skype\phone\skype.exe | 
"{59023592-6680-499B-BFD2-FD95276192CC}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{6273396A-7E12-481E-A975-05F571F3491B}" = protocol=6 | dir=in | app=f:\maxthon3\bin\maxthon.exe | 
"{6F832B96-D77B-4C39-83DE-C23B98A60C0C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{74F41D34-46CA-4AFC-9EA0-2B383001E206}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{945BF5E1-58C1-4B35-8257-F917B61AC20F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{B6CEAA28-9B93-45DF-AFF7-F06D8AB0E1E0}" = protocol=6 | dir=out | app=system | 
"{B8EBA7AD-F397-4768-9F9E-81D1A8A567D8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{C5AE1185-93CF-4B54-9262-0974B501973D}" = protocol=17 | dir=in | app=f:\maxthon3\bin\maxthon.exe | 
"{D708CE33-0292-49C4-A0AC-71BE978878FB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{E2398916-089E-4622-87E8-30C9B449EFC3}" = dir=in | app=f:\radiotracker\audials.exe | 
"{EE5A817B-43F9-47CE-A432-EE69A90E7B30}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{F0F846FB-027F-4525-B70C-32C6BB9F1B52}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{00580795-581C-4587-B9F2-37320D7AB37F}" = Corel PaintShop Pro X4
"{003CD4FD-DB3E-4D12-9A34-8C00FA8A680F}" = WirelessControl
"{00580795-581C-4587-B9F2-37320D7AB37F}" = ICA
"{006CAAEF-CA96-4181-AC22-FE56D61432E4}" = PSPPContent
"{00AE1A2D-7BC2-4359-A0EC-E19F36E391BB}" = Corel PaintShop Pro X4
"{00BEE329-BAAB-49FF-9B66-55E4B12B9ADD}" = IPM_PSP_COM
"{00D13418-7DDF-4D3D-A237-E297B103BB6B}" = Setup
"{00D74A7A-F7AD-4D00-ABD2-0973836292C7}" = PSPPHelp
"{0454BB9A-2A7A-4214-BDFF-937F7A711A44}" = Windows Live Communications Platform
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0D8C5BCA-6133-4C96-A81E-B901E60F0E1E}" = GlobeTrotter Connect
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 21
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CCBD1F4-CEEC-452A-9CB8-46564B501315}" = Windows Live UX Platform
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{690F5BA3-5DEB-42CD-962B-F687EE59FAA7}" = Windows Live Essentials
"{6A8DB215-7BCD-4377-B015-2E4541A3E7C6}" = Windows Live PIMT Platform
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{8256F87F-8554-4457-8C3D-3F3324697D9F}" = Windows Live ID Sign-in Assistant
"{86501894-E722-4385-A792-B7C2F28FAE7B}" = NetSpeedMonitor 2.5.4.0 x86
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A642ACD-CE3A-4A23-A8B1-A0F7EB12B214}" = Windows Live SOXE Definitions
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.02) - Deutsch
"{AE364ACC-B9DF-466B-B4EA-AEECD0CD581E}" = Windows Live Messenger
"{B0897D06-68ED-4EB2-0001-2F36270D8621}" = DVR Converter 3.0
"{B727564C-47D3-473A-AC9E-F4BE7B1BD5D3}" = Windows Live UX Platform Language Pack
"{C424CD5E-EA05-4D3E-B5DA-F9F149E1D3AC}" = Windows Live Installer
"{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}" = TuneUp Utilities 2013
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{C9B6EFD0-4F01-4BBA-8374-39AD99A3ED72}" = Windows Live Photo Common
"{CE61E024-462A-4E06-A886-660F09C12E28}" = Nitro Pro 7
"{D6CC2FAF-F827-4091-96A1-D32CC9B69C79}" = WISO Steuer-Sparbuch 2013
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1203F8C-FF34-4968-A4A5-B4F1F8533DAB}" = Photo Common
"{EB99ED57-FF42-4272-8EDA-E367DFF29596}" = Audials
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2235E5E-7881-4293-9B6F-04B2609FBFF0}" = Windows Live Messenger
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F4811919-F252-4B25-9AB2-8859A85810B5}" = TuneUp Utilities Language Pack (de-DE)
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FE7C0B3D-50B9-4951-BE78-A321CBF86552}" = Windows Live SOXE
"7-Zip" = 7-Zip 9.22beta
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Ashampoo Burning Studio 2012_is1" = Ashampoo Burning Studio 2012 v10.0.15
"Ashampoo Photo Optimizer 4_is1" = Ashampoo Photo Optimizer 4 v.4.0.3
"Audacity_is1" = Audacity 2.0.3
"Bitdefender" = Bitdefender Internet Security 2013
"BlazeDTV 6.0_is1" = BlazeDTV 6.0
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon MOV Decoder" = Canon MOV Decoder
"Canon MOV Encoder" = Canon MOV Encoder
"Canon RAW Codec" = Canon RAW Codec
"CCleaner" = CCleaner
"CrystalDiskInfo_is1" = CrystalDiskInfo 5.4.2
"Digital Photo Professional" = Canon Utilities Digital Photo Professional
"Driver Genius Professional Edition_is1" = Driver Genius Professional Edition
"EasyBCD" = EasyBCD 2.2
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EOS USB WIA Driver" = EOS USB WIA Driver
"EOS Utility" = Canon Utilities EOS Utility
"EOS Video Snapshot Task" = Canon Utilities EOS Video Snapshot Task for ZoomBrowser EX
"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v5.50
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"Maxthon3" = Maxthon 3
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox 16.0.2 (x86 de)" = Mozilla Firefox 16.0.2 (x86 de)
"MyCamera" = Canon Utilities MyCamera
"MyCamera Download Plugin" = CANON iMAGE GATEWAY MyCamera Download Plugin
"Original Data Security Tools" = Canon Utilities Original Data Security Tools
"PhotoStitch" = Canon Utilities PhotoStitch
"Picture Style Editor" = Canon Utilities Picture Style Editor
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"Secunia PSI" = Secunia PSI (3.0.0.6001)
"SMSERIAL" = Motorola SM56 Speakerphone Modem
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TuneUp Utilities 2013" = TuneUp Utilities 2013
"TVWiz" = Intel(R) TV Wizard
"UltraDefrag" = Ultra Defragmenter
"VLC media player" = VLC media player 2.0.6
"WFTK" = Canon Utilities WFT-E1/E2/E3 Utility
"WinLiveSuite" = Windows Live Essentials
"ZonerPhotoStudio15_DE_is1" = Zoner Photo Studio 15
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-2669550064-1252959950-52234001-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Mozilla Firefox 20.0.1 (x86 de)" = Mozilla Firefox 20.0.1 (x86 de)
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 10.05.2013 02:52:20 | Computer Name = Fujitsu-PC | Source = WinMgmt | ID = 10
Description = 
 
 
< End of report >

cosinus · 10.05.2013, 19:03

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Vollscan mit Malwarebytes - denk bitte vorher daran, Malwarebytes über den Updatebutton zu aktualisieren

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Traxxcell · 11.05.2013, 12:45

Hier die Logs vom Mbam und ESET.

Ist es normal, dass ESET so lange scannt? Es hat knapp über 2 Stunden gedauert.

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.05.11.02

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16540
Fujitsu :: FUJITSU-PC [Administrator]

11.05.2013 09:34:31
mbam-log-2013-05-11 (09-34-31).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 312571
Laufzeit: 1 Stunde(n), 47 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=1dab6269315a314ca7dda63662a26257
# engine=13805
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-05-11 11:30:43
# local_time=2013-05-11 01:30:43 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 10389546 119903034 0 0
# scanned=122662
# found=0
# cleaned=0
# scan_time=7371

cosinus · 12.05.2013, 20:13

Sieht soweit ok aus

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Traxxcell · 13.05.2013, 09:08

Hallo cosinus, ich danke dir für deine umfassende Hilfe.

Es ist nichts weiter auffälliges hinzugekommen. Mir ist aber immer noch nicht ganz klar, was Bitdefender da angezeigt hat, obwohl diese angemeckerte Datei in dem angegebenen Ordner nicht zu finden war. Kann es eine Falschmeldung gewesen sein, oder hast du eine Erklärung dafür?

Gruß Heinz

cosinus · 13.05.2013, 10:50

Welche Relevanz hat das denn noch? Die Datei wurde erkannt, später wurde der tempordner geleert.

Dann wären wir durch!

Falls du noch Lob oder Kritik loswerden möchtest => http://www.trojaner-board.de/lob-kritik-wuensche/

Die Programme, die hier zum Einsatz kamen, können alle wieder runter.

Combofix entfernen (nur relevant wenn es hier benutzt wurde!) : Start/Ausführen (Tastenkombination WIN+R), dort den Befehl combofix /uninstall eintippen und ausführen

Mit Hilfe von OTL kannst du auch viele andere Tools entfernen: Starte dazu einfach OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate
Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.
Windows Vista/7: Start, Systemsteuerung, Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks findest du hier => Browsers and Plugins - FilePony.de

Alle Plugins im Firefox-Browser kannst du auch ganz einfach hier auf Aktualität prüfen => https://www.mozilla.org/de/plugincheck

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Bitdefender zeigte Virendatei an, die aber nicht vorhanden war.

Plagegeister aller Art und deren Bekämpfung: Bitdefender zeigte Virendatei an, die aber nicht vorhanden war.