Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Ist das ein gefährlicher Trojaner Trj/CI.A

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 15.11.2011, 19:40   #16
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Ist das ein gefährlicher Trojaner Trj/CI.A - Standard

Ist das ein gefährlicher Trojaner Trj/CI.A



Kannst du bitte endlich mal anfangen die Anleitungen sorgfältiger umzusetzen!?

Du hast das Log von ESET in das OTL-Fenster hineinkopiert

Was steht in der Anleitung?!
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 15.11.2011, 19:51   #17
kessemaus1
 
Ist das ein gefährlicher Trojaner Trj/CI.A - Standard

Ist das ein gefährlicher Trojaner Trj/CI.A



ich finde es ja super nett, dass du mir versuchst zu helfen, aber deine art wie du mit mir sprichst finde ich nicht so klasse. bin ja kein kleines kind mehr. hatte genau nach deiner anweisung gehandeltOTL Logfile:
Code:
ATTFilter
OTL logfile created on: 15.11.2011 19:44:36 - Run 2
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\WirBeide\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
5,93 Gb Total Physical Memory | 4,46 Gb Available Physical Memory | 75,29% Memory free
11,86 Gb Paging File | 10,29 Gb Available in Paging File | 86,83% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 455,95 Gb Total Space | 413,17 Gb Free Space | 90,62% Space Free | Partition Type: NTFS
Drive D: | 456,46 Gb Total Space | 455,79 Gb Free Space | 99,85% Space Free | Partition Type: NTFS
 
Computer Name: WIRBEIDE-PC | User Name: WirBeide | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.11.15 16:27:04 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\WirBeide\Desktop\OTL.exe
PRC - [2009.12.22 19:28:16 | 000,128,296 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
PRC - [2009.12.22 19:11:42 | 000,181,480 | ---- | M] (Acer Corp.) -- C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
PRC - [2009.12.09 10:24:16 | 000,076,320 | ---- | M] () -- C:\OEM\USBDECTION\USBS3S4Detection.exe
PRC - [2009.10.13 19:25:54 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2009.10.13 19:25:30 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
PRC - [2009.09.30 19:34:22 | 002,314,240 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2009.09.30 19:33:08 | 000,262,144 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2009.09.10 14:42:30 | 000,349,480 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
PRC - [2009.08.28 10:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
PRC - [2009.08.18 08:27:26 | 000,629,280 | ---- | M] () -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
PRC - [2009.08.12 23:04:44 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2009.08.12 22:58:28 | 000,261,888 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
PRC - [2009.08.04 06:09:34 | 000,199,464 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
PRC - [2009.07.18 04:12:12 | 000,257,440 | R--- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10c.exe
PRC - [2009.07.04 02:47:12 | 000,240,160 | ---- | M] (Acer) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe
PRC - [2009.05.14 16:07:12 | 000,759,048 | ---- | M] (ABBYY) -- C:\Program Files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008.10.25 00:35:44 | 000,128,296 | ---- | M] () -- C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2009.08.18 08:31:22 | 000,163,840 | ---- | M] () -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyHook.dll
MOD - [2009.08.18 08:27:26 | 000,629,280 | ---- | M] () -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
MOD - [2009.02.03 01:33:56 | 000,460,199 | ---- | M] () -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010.01.13 15:04:08 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2009.12.09 10:24:16 | 000,076,320 | ---- | M] () [Auto | Running] -- C:\OEM\USBDECTION\USBS3S4Detection.exe -- (USBS3S4Detection)
SRV - [2009.10.13 19:25:30 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMON) Intel(R)
SRV - [2009.09.30 19:34:22 | 002,314,240 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2009.09.30 19:33:08 | 000,262,144 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009.09.10 14:42:46 | 000,305,448 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService)
SRV - [2009.08.28 10:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2009.08.12 23:04:44 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2009.07.04 02:47:12 | 000,240,160 | ---- | M] (Acer) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.05.14 16:07:12 | 000,759,048 | ---- | M] (ABBYY) [Auto | Running] -- C:\Program Files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe -- (ABBYY.Licensing.PDFTransformer.Site License.3.0)
SRV - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2008.10.25 00:35:44 | 000,128,296 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe -- (AAV UpdateService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2010.01.13 15:26:00 | 006,327,296 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag)
DRV:64bit: - [2010.01.13 14:10:56 | 000,185,344 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2009.10.29 09:14:38 | 000,115,824 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID)
DRV:64bit: - [2009.10.13 19:16:40 | 000,409,624 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009.09.30 02:34:30 | 000,121,872 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009.09.23 10:11:04 | 000,283,824 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1k62x64.sys -- (e1kexpress) Intel(R)
DRV:64bit: - [2009.09.17 05:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009.07.14 02:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009.07.14 02:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.30 10:37:16 | 000,033,800 | ---- | M] (Panda Security, S.L.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\pavboot64.sys -- (pavboot)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.02 12:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009.06.02 12:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009.06.02 12:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009.05.06 00:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2009.05.06 00:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\3.0.40624.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandasecurity.com/activescan: C:\Program Files (x86)\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security, S.L.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.14 21:54:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.11.14 21:54:00 | 000,000,000 | ---D | M]
 
[2011.11.14 21:54:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\WirBeide\AppData\Roaming\mozilla\Extensions
[2011.11.14 21:54:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\WirBeide\AppData\Roaming\mozilla\Firefox\Profiles\gk512yjg.default\extensions
[2011.11.14 21:54:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.11.03 16:21:59 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.11.03 16:21:59 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.11.03 16:21:59 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.11.03 16:21:59 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.11.03 16:21:59 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [Hotkey Utility] C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe ()
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [PlayMovie] C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{32D33DE0-981E-4996-9D7A-848F55219933}: DhcpNameServer = 192.168.2.1 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
 
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: mcmscsvc - Service
SafeBootMin:64bit: MCODS - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: mcmscsvc - Service
SafeBootMin: MCODS - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: mcmscsvc - Service
SafeBootNet:64bit: MCODS - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: MpfService - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: mcmscsvc - Service
SafeBootNet: MCODS - Service
SafeBootNet: Messenger - Service
SafeBootNet: MpfService - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT 
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.11.15 16:27:01 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\WirBeide\Desktop\OTL.exe
[2011.11.15 12:46:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2011.11.15 12:42:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.11.15 12:42:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.11.15 05:26:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\XPSViewer
[2011.11.15 05:26:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\de-DE
[2011.11.15 05:26:21 | 000,000,000 | ---D | C] -- C:\Windows\de-DE
[2011.11.15 05:26:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\de
[2011.11.15 05:26:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0407
[2011.11.15 05:26:20 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\de-DE
[2011.11.15 05:26:20 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\de
[2011.11.15 05:26:20 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0407
[2011.11.15 05:25:48 | 000,011,776 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerId.sys.mui
[2011.11.15 05:25:48 | 000,011,776 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerIb.sys.mui
[2011.11.15 05:25:47 | 000,004,096 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\de-DE\pscr.sys.mui
[2011.11.15 05:25:47 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrParwdm.sys.mui
[2011.11.15 05:20:25 | 000,000,000 | ---D | C] -- C:\Windows\NAPP_Dism_Log
[2011.11.14 22:40:38 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\TS3Client
[2011.11.14 22:31:16 | 000,254,400 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2011.11.14 22:30:21 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2011.11.14 22:30:21 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2011.11.14 22:25:47 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Malwarebytes
[2011.11.14 22:25:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.11.14 22:25:17 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.11.14 22:05:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011.11.14 22:05:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2011.11.14 22:05:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2011.11.14 21:54:06 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Mozilla
[2011.11.14 21:54:06 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\Mozilla
[2011.11.14 21:54:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox
[2011.11.14 21:53:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2011.11.14 21:51:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2011.11.14 21:51:53 | 000,000,000 | ---D | C] -- C:\Program Files\TeamSpeak 3 Client
[2011.11.14 21:48:47 | 000,033,800 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysNative\drivers\pavboot64.sys
[2011.11.14 21:48:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Panda Security
[2011.11.14 21:30:43 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Screensaver
[2011.11.14 21:30:43 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Macromedia
[2011.11.14 21:28:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works
[2011.11.14 21:26:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 8
[2011.11.14 21:25:59 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\Microsoft Help
[2011.11.14 21:24:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
[2011.11.14 21:23:38 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Adobe
[2011.11.14 21:23:33 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Google
[2011.11.14 21:23:32 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\Google
[2011.11.14 21:23:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft
[2011.11.14 21:23:13 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\microsoft
[2011.11.14 21:23:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live SkyDrive
[2011.11.14 21:23:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
[2011.11.14 21:22:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live
[2011.11.14 21:21:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Windows Live
[2011.11.14 21:20:16 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer Arcade Deluxe
[2011.11.14 21:20:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cyberlink
[2011.11.14 21:18:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Acer Arcade Deluxe
[2011.11.14 21:18:37 | 000,000,000 | ---D | C] -- C:\ProgramData\CyberLink
[2011.11.14 21:18:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Temp
[2011.11.14 21:17:09 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\InstallShield
[2011.11.14 21:16:22 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\ATI
[2011.11.14 21:16:22 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\ATI
[2011.11.14 21:16:22 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2011.11.14 21:16:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\postureAgent
[2011.11.14 21:15:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AcerSystem
[2011.11.14 21:15:40 | 000,000,000 | ---D | C] -- C:\ProgramData\McQcModifier-5c47-a7b0
[2011.11.14 21:15:40 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\EgisTec
[2011.11.14 21:15:40 | 000,000,000 | ---D | C] -- C:\ProgramData\EgisTec
[2011.11.14 21:15:40 | 000,000,000 | ---D | C] -- C:\book
[2011.11.14 21:15:22 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011.11.14 21:15:22 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Searches
[2011.11.14 21:15:22 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011.11.14 21:15:14 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Identities
[2011.11.14 21:15:12 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\Apple
[2011.11.14 21:15:11 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Contacts
[2011.11.14 21:15:09 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\VirtualStore
[2011.11.14 21:06:50 | 000,000,000 | ---D | C] -- C:\Program Files\Acer Accessory Store
[2011.11.14 21:06:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OEM
[2011.11.14 21:06:32 | 000,000,000 | --SD | C] -- C:\Users\WirBeide\AppData\Roaming\Microsoft
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Videos
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Saved Games
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Pictures
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Music
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Links
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Favorites
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Downloads
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Documents
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Desktop
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Vorlagen
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\AppData\Local\Verlauf
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\AppData\Local\Temporary Internet Files
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Startmenü
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\SendTo
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Recent
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Netzwerkumgebung
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Lokale Einstellungen
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Documents\Eigene Videos
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Documents\Eigene Musik
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Eigene Dateien
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Documents\Eigene Bilder
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Druckumgebung
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Cookies
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\AppData\Local\Anwendungsdaten
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Anwendungsdaten
[2011.11.14 21:06:32 | 000,000,000 | -H-D | C] -- C:\Users\WirBeide\AppData
[2011.11.14 21:06:32 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\Temp
[2011.11.14 21:06:32 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\Microsoft
[2011.11.14 21:06:32 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Media Center Programs
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Recovery
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Programme
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2011.11.14 20:52:05 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM
[2011.11.14 20:52:05 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2011.11.14 20:52:01 | 000,513,536 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll
[2011.11.14 20:52:01 | 000,363,008 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll
[2011.11.14 20:52:01 | 000,304,640 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll
[2011.11.14 20:52:01 | 000,304,640 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll
[2011.11.14 20:52:01 | 000,211,376 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll
[2011.11.14 20:52:01 | 000,198,656 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll
[2011.11.14 20:52:01 | 000,193,536 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll
[2011.11.14 20:52:01 | 000,150,528 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll
[2011.11.14 20:52:01 | 000,095,744 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll
[2011.11.14 20:52:01 | 000,073,216 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll
[2011.11.14 20:52:00 | 000,320,512 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll
[2011.11.14 20:52:00 | 000,310,784 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll
[2011.11.14 20:52:00 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Temp
[2011.11.14 20:52:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek
[2011.11.14 20:49:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies
[2011.11.14 20:49:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2011.11.14 20:49:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies
[2011.11.14 20:49:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2011.11.14 20:49:08 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2011.11.14 20:48:36 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2011.11.14 20:45:46 | 000,000,000 | -HSD | C] -- C:\System Volume Information
 
========== Files - Modified Within 30 Days ==========
 
[2011.11.15 19:30:01 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\Acer Registration Reminder.job
[2011.11.15 18:47:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.11.15 16:27:04 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\WirBeide\Desktop\OTL.exe
[2011.11.15 12:47:39 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.11.15 12:47:39 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.11.15 12:47:18 | 001,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.11.15 12:47:18 | 000,643,628 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.11.15 12:47:18 | 000,606,992 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.11.15 12:47:18 | 000,126,188 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.11.15 12:47:18 | 000,103,370 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.11.15 12:42:45 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.11.15 12:40:32 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.11.15 12:40:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.11.15 12:40:03 | 479,510,527 | -HS- | M] () -- C:\hiberfil.sys
[2011.11.15 05:26:14 | 000,295,922 | ---- | M] () -- C:\Windows\SysNative\perfi007.dat
[2011.11.15 05:26:14 | 000,038,104 | ---- | M] () -- C:\Windows\SysNative\perfd007.dat
[2011.11.15 05:25:48 | 000,011,776 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerId.sys.mui
[2011.11.15 05:25:48 | 000,011,776 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerIb.sys.mui
[2011.11.15 05:25:47 | 000,004,096 | ---- | M] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\de-DE\pscr.sys.mui
[2011.11.15 05:25:47 | 000,002,560 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrParwdm.sys.mui
[2011.11.15 05:20:24 | 000,011,453 | ---- | M] () -- C:\Windows\ChangeLang_Done.tag
[2011.11.14 22:31:17 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2011.11.14 22:05:16 | 000,001,258 | ---- | M] () -- C:\Users\WirBeide\Desktop\Spybot - Search & Destroy.lnk
[2011.11.14 21:54:07 | 000,000,000 | ---- | M] () -- C:\Windows\nsreg.dat
[2011.11.14 21:54:01 | 000,001,939 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.11.14 21:51:56 | 000,000,971 | ---- | M] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2011.11.14 21:39:21 | 000,361,696 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.11.14 21:24:03 | 000,000,020 | ---- | M] () -- C:\Windows\Àù·
[2011.11.14 21:06:50 | 000,001,962 | ---- | M] () -- C:\Users\Public\Desktop\Acer Zubehör Shop.lnk
[2011.11.14 21:06:47 | 000,002,609 | ---- | M] () -- C:\Users\Public\Desktop\eBay.lnk
[2011.11.14 21:05:19 | 000,052,953 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2011.11.14 21:05:19 | 000,052,953 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2011.11.14 20:54:29 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2011.11.14 20:53:31 | 000,000,003 | ---- | M] () -- C:\Windows\SysNative\PLD_Framework.cmd
 
========== Files Created - No Company Name ==========
 
[2011.11.15 12:42:45 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.11.15 05:29:17 | 000,011,453 | ---- | C] () -- C:\Windows\ChangeLang_Done.tag
[2011.11.15 05:26:43 | 000,643,628 | ---- | C] () -- C:\Windows\SysNative\perfh007.dat
[2011.11.15 05:26:43 | 000,295,922 | ---- | C] () -- C:\Windows\SysNative\perfi007.dat
[2011.11.15 05:26:43 | 000,126,188 | ---- | C] () -- C:\Windows\SysNative\perfc007.dat
[2011.11.15 05:26:43 | 000,038,104 | ---- | C] () -- C:\Windows\SysNative\perfd007.dat
[2011.11.15 01:05:24 | 000,000,350 | ---- | C] () -- C:\Windows\tasks\Acer Registration Reminder.job
[2011.11.14 22:31:16 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\config.nt
[2011.11.14 22:05:16 | 000,001,258 | ---- | C] () -- C:\Users\WirBeide\Desktop\Spybot - Search & Destroy.lnk
[2011.11.14 21:54:07 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011.11.14 21:54:01 | 000,001,939 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.11.14 21:51:56 | 000,000,971 | ---- | C] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2011.11.14 21:37:35 | 000,001,110 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.11.14 21:37:35 | 000,001,106 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.11.14 21:28:21 | 000,002,569 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office PowerPoint Viewer 2007.lnk
[2011.11.14 21:28:13 | 000,001,193 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works-Start.lnk
[2011.11.14 21:24:02 | 000,000,020 | ---- | C] () -- C:\Windows\Àù·
[2011.11.14 21:15:30 | 000,001,405 | ---- | C] () -- C:\Users\WirBeide\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2011.11.14 21:15:25 | 000,001,439 | ---- | C] () -- C:\Users\WirBeide\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011.11.14 21:06:57 | 000,002,495 | ---- | C] () -- C:\Users\Public\Desktop\Serif WEBPLUS X4.lnk
[2011.11.14 21:06:57 | 000,001,833 | ---- | C] () -- C:\Users\Public\Desktop\RADIOTRACKER.lnk
[2011.11.14 21:06:57 | 000,001,656 | ---- | C] () -- C:\Users\Public\Desktop\PDF Transformer.lnk
[2011.11.14 21:06:50 | 000,001,962 | ---- | C] () -- C:\Users\Public\Desktop\Acer Zubehör Shop.lnk
[2011.11.14 21:06:47 | 000,002,609 | ---- | C] () -- C:\Users\Public\Desktop\eBay.lnk
[2011.11.14 20:54:29 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.11.14 20:53:31 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\PLD_Framework.cmd
[2011.11.14 20:45:46 | 479,510,527 | -HS- | C] () -- C:\hiberfil.sys
[2010.03.23 16:35:44 | 000,001,035 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2010.03.23 16:03:34 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2011.11.14 23:19:22 | 000,000,000 | ---D | M] -- C:\Users\WirBeide\AppData\Roaming\TS3Client
[2011.11.15 19:30:01 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\Acer Registration Reminder.job
[2009.07.14 06:08:49 | 000,004,142 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die  Textbox von OTL - wenn OTL auf deutsch ist wird sie mit  beschriftet  >
 
< Code:Alles kopierenAlles auswählenLarusso Modus  >
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.11.14 21:23:38 | 000,000,000 | ---D | M] -- C:\Users\WirBeide\AppData\Roaming\Adobe
[2011.11.14 21:16:22 | 000,000,000 | ---D | M] -- C:\Users\WirBeide\AppData\Roaming\ATI
[2011.11.14 21:23:33 | 000,000,000 | ---D | M] -- C:\Users\WirBeide\AppData\Roaming\Google
[2011.11.14 21:15:14 | 000,000,000 | ---D | M] -- C:\Users\WirBeide\AppData\Roaming\Identities
[2011.11.14 21:17:09 | 000,000,000 | ---D | M] -- C:\Users\WirBeide\AppData\Roaming\InstallShield
[2011.11.14 21:30:43 | 000,000,000 | ---D | M] -- C:\Users\WirBeide\AppData\Roaming\Macromedia
[2011.11.14 22:25:47 | 000,000,000 | ---D | M] -- C:\Users\WirBeide\AppData\Roaming\Malwarebytes
[2009.07.14 08:44:38 | 000,000,000 | ---D | M] -- C:\Users\WirBeide\AppData\Roaming\Media Center Programs
[2011.11.15 13:36:04 | 000,000,000 | --SD | M] -- C:\Users\WirBeide\AppData\Roaming\Microsoft
[2011.11.14 21:54:11 | 000,000,000 | ---D | M] -- C:\Users\WirBeide\AppData\Roaming\Mozilla
[2011.11.14 23:19:22 | 000,000,000 | ---D | M] -- C:\Users\WirBeide\AppData\Roaming\TS3Client
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2009.10.13 19:09:36 | 000,331,288 | ---- | M] (Intel Corporation) MD5=0BAA4115DFFFD6A6D809A89D65E1281A -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2009.10.13 19:16:40 | 000,409,624 | ---- | M] (Intel Corporation) MD5=BE7D72FCF442C26975942007E0831241 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2009.10.13 19:16:40 | 000,409,624 | ---- | M] (Intel Corporation) MD5=BE7D72FCF442C26975942007E0831241 -- C:\Windows\SysNative\drivers\iaStor.sys
[2009.10.13 19:16:40 | 000,409,624 | ---- | M] (Intel Corporation) MD5=BE7D72FCF442C26975942007E0831241 -- C:\Windows\SysNative\DriverStore\FileRepository\iastor.inf_amd64_neutral_b02a0635da01252b\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\SysNative\netlogon.dll
[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysNative\drivers\nvstor.sys
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\SysNative\scecli.dll
[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\SysNative\user32.dll
[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\SysNative\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\SysNative\winlogon.exe
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >
         
--- --- ---
__________________


Alt 15.11.2011, 20:31   #18
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Ist das ein gefährlicher Trojaner Trj/CI.A - Standard

Ist das ein gefährlicher Trojaner Trj/CI.A



Zitat:
aber deine art wie du mit mir sprichst finde ich nicht so klasse. bin ja kein kleines kind mehr.
Wir machen uns hier Mühe so genau wie möglich die Anleitung zu verfassen und du hast jetzt schon 2-3x nicht richtig gelesen oder umgesetzt! Wenn du kein kleines Kind bist, dann arbeie auch bitte etwas sorgfältiger, bei so manchem Tool kannst du dir nämlich sonst das System schrotten!

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!




Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen!
__________________
__________________

Alt 15.11.2011, 21:12   #19
kessemaus1
 
Ist das ein gefährlicher Trojaner Trj/CI.A - Standard

Ist das ein gefährlicher Trojaner Trj/CI.A



Hier das Ergebnis:

21:10:34.0294 3132 TDSS rootkit removing tool 2.6.18.0 Nov 11 2011 15:47:15
21:10:34.0450 3132 ============================================================
21:10:34.0450 3132 Current date / time: 2011/11/15 21:10:34.0450
21:10:34.0450 3132 SystemInfo:
21:10:34.0450 3132
21:10:34.0450 3132 OS Version: 6.1.7600 ServicePack: 0.0
21:10:34.0450 3132 Product type: Workstation
21:10:34.0450 3132 ComputerName: WIRBEIDE-PC
21:10:34.0450 3132 UserName: WirBeide
21:10:34.0450 3132 Windows directory: C:\Windows
21:10:34.0450 3132 System windows directory: C:\Windows
21:10:34.0450 3132 Running under WOW64
21:10:34.0450 3132 Processor architecture: Intel x64
21:10:34.0450 3132 Number of processors: 4
21:10:34.0450 3132 Page size: 0x1000
21:10:34.0450 3132 Boot type: Normal boot
21:10:34.0450 3132 ============================================================
21:10:34.0835 3132 Initialize success
21:11:05.0582 4444 ============================================================
21:11:05.0582 4444 Scan started
21:11:05.0582 4444 Mode: Manual; SigCheck; TDLFS;
21:11:05.0582 4444 ============================================================
21:11:06.0298 4444 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys
21:11:06.0348 4444 1394ohci - ok
21:11:06.0375 4444 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys
21:11:06.0390 4444 ACPI - ok
21:11:06.0402 4444 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys
21:11:06.0436 4444 AcpiPmi - ok
21:11:06.0458 4444 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
21:11:06.0475 4444 adp94xx - ok
21:11:06.0488 4444 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
21:11:06.0504 4444 adpahci - ok
21:11:06.0512 4444 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
21:11:06.0525 4444 adpu320 - ok
21:11:06.0562 4444 AFD (b9384e03479d2506bc924c16a3db87bc) C:\Windows\system32\drivers\afd.sys
21:11:06.0674 4444 AFD - ok
21:11:06.0700 4444 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys
21:11:06.0708 4444 agp440 - ok
21:11:06.0717 4444 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys
21:11:06.0724 4444 aliide - ok
21:11:06.0744 4444 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys
21:11:06.0753 4444 amdide - ok
21:11:06.0762 4444 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
21:11:06.0784 4444 AmdK8 - ok
21:11:06.0902 4444 amdkmdag (9673319070166e26660eba4edf316fa2) C:\Windows\system32\DRIVERS\atipmdag.sys
21:11:07.0088 4444 amdkmdag - ok
21:11:07.0120 4444 amdkmdap (430d06d63952848e64cbbf23b5c1479e) C:\Windows\system32\DRIVERS\atikmpag.sys
21:11:07.0156 4444 amdkmdap - ok
21:11:07.0163 4444 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
21:11:07.0173 4444 AmdPPM - ok
21:11:07.0183 4444 amdsata (7a4b413614c055935567cf88a9734d38) C:\Windows\system32\DRIVERS\amdsata.sys
21:11:07.0192 4444 amdsata - ok
21:11:07.0202 4444 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
21:11:07.0214 4444 amdsbs - ok
21:11:07.0229 4444 amdxata (b4ad0cacbab298671dd6f6ef7e20679d) C:\Windows\system32\DRIVERS\amdxata.sys
21:11:07.0236 4444 amdxata - ok
21:11:07.0248 4444 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys
21:11:07.0306 4444 AppID - ok
21:11:07.0316 4444 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
21:11:07.0326 4444 arc - ok
21:11:07.0334 4444 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
21:11:07.0341 4444 arcsas - ok
21:11:07.0351 4444 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
21:11:07.0400 4444 AsyncMac - ok
21:11:07.0430 4444 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys
21:11:07.0438 4444 atapi - ok
21:11:07.0484 4444 AtiHdmiService (fb7602c5c508be281368aae0b61b51c6) C:\Windows\system32\drivers\AtiHdmi.sys
21:11:07.0501 4444 AtiHdmiService - ok
21:11:07.0544 4444 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
21:11:07.0564 4444 b06bdrv - ok
21:11:07.0579 4444 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
21:11:07.0602 4444 b57nd60a - ok
21:11:07.0624 4444 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
21:11:07.0665 4444 Beep - ok
21:11:07.0692 4444 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
21:11:07.0725 4444 blbdrive - ok
21:11:07.0733 4444 bowser (91ce0d3dc57dd377e690a2d324022b08) C:\Windows\system32\DRIVERS\bowser.sys
21:11:07.0768 4444 bowser - ok
21:11:07.0776 4444 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
21:11:07.0802 4444 BrFiltLo - ok
21:11:07.0809 4444 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
21:11:07.0824 4444 BrFiltUp - ok
21:11:07.0845 4444 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
21:11:07.0862 4444 Brserid - ok
21:11:07.0869 4444 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
21:11:07.0887 4444 BrSerWdm - ok
21:11:07.0894 4444 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
21:11:07.0915 4444 BrUsbMdm - ok
21:11:07.0922 4444 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
21:11:07.0936 4444 BrUsbSer - ok
21:11:07.0947 4444 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
21:11:07.0961 4444 BTHMODEM - ok
21:11:07.0979 4444 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
21:11:08.0011 4444 cdfs - ok
21:11:08.0035 4444 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys
21:11:08.0047 4444 cdrom - ok
21:11:08.0057 4444 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
21:11:08.0083 4444 circlass - ok
21:11:08.0116 4444 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
21:11:08.0128 4444 CLFS - ok
21:11:08.0139 4444 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
21:11:08.0149 4444 CmBatt - ok
21:11:08.0156 4444 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys
21:11:08.0164 4444 cmdide - ok
21:11:08.0174 4444 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys
21:11:08.0193 4444 CNG - ok
21:11:08.0216 4444 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
21:11:08.0223 4444 Compbatt - ok
21:11:08.0230 4444 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys
21:11:08.0252 4444 CompositeBus - ok
21:11:08.0261 4444 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
21:11:08.0270 4444 crcdisk - ok
21:11:08.0288 4444 DfsC (3f1dc527070acb87e40afe46ef6da749) C:\Windows\system32\Drivers\dfsc.sys
21:11:08.0336 4444 DfsC - ok
21:11:08.0346 4444 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
21:11:08.0387 4444 discache - ok
21:11:08.0395 4444 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
21:11:08.0404 4444 Disk - ok
21:11:08.0424 4444 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
21:11:08.0445 4444 drmkaud - ok
21:11:08.0470 4444 DXGKrnl (ebce0b0924835f635f620d19f0529dce) C:\Windows\System32\drivers\dxgkrnl.sys
21:11:08.0496 4444 DXGKrnl - ok
21:11:08.0534 4444 e1kexpress (52a482dc61f24b498c8268866b90bb44) C:\Windows\system32\DRIVERS\e1k62x64.sys
21:11:08.0544 4444 e1kexpress - ok
21:11:08.0607 4444 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
21:11:08.0682 4444 ebdrv - ok
21:11:08.0704 4444 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
21:11:08.0722 4444 elxstor - ok
21:11:08.0731 4444 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys
21:11:08.0748 4444 ErrDev - ok
21:11:08.0763 4444 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
21:11:08.0801 4444 exfat - ok
21:11:08.0810 4444 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
21:11:08.0846 4444 fastfat - ok
21:11:08.0854 4444 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
21:11:08.0866 4444 fdc - ok
21:11:08.0874 4444 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
21:11:08.0881 4444 FileInfo - ok
21:11:08.0892 4444 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
21:11:08.0936 4444 Filetrace - ok
21:11:08.0942 4444 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
21:11:08.0952 4444 flpydisk - ok
21:11:08.0973 4444 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys
21:11:08.0985 4444 FltMgr - ok
21:11:08.0992 4444 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
21:11:09.0000 4444 FsDepends - ok
21:11:09.0021 4444 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
21:11:09.0027 4444 Fs_Rec - ok
21:11:09.0052 4444 fvevol (b8b2a6e1558f8f5de5ce431c5b2c7b09) C:\Windows\system32\DRIVERS\fvevol.sys
21:11:09.0065 4444 fvevol - ok
21:11:09.0074 4444 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
21:11:09.0083 4444 gagp30kx - ok
21:11:09.0147 4444 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
21:11:09.0163 4444 hcw85cir - ok
21:11:09.0190 4444 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys
21:11:09.0225 4444 HdAudAddService - ok
21:11:09.0232 4444 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys
21:11:09.0255 4444 HDAudBus - ok
21:11:09.0285 4444 HECIx64 (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\DRIVERS\HECIx64.sys
21:11:09.0290 4444 HECIx64 - ok
21:11:09.0300 4444 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
21:11:09.0325 4444 HidBatt - ok
21:11:09.0332 4444 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
21:11:09.0354 4444 HidBth - ok
21:11:09.0362 4444 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
21:11:09.0396 4444 HidIr - ok
21:11:09.0405 4444 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys
21:11:09.0414 4444 HidUsb - ok
21:11:09.0424 4444 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys
21:11:09.0431 4444 HpSAMD - ok
21:11:09.0453 4444 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys
21:11:09.0506 4444 HTTP - ok
21:11:09.0513 4444 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys
21:11:09.0520 4444 hwpolicy - ok
21:11:09.0539 4444 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys
21:11:09.0549 4444 i8042prt - ok
21:11:09.0585 4444 iaStor (be7d72fcf442c26975942007e0831241) C:\Windows\system32\DRIVERS\iaStor.sys
21:11:09.0597 4444 iaStor - ok
21:11:09.0625 4444 iaStorV (d83efb6fd45df9d55e9a1afc63640d50) C:\Windows\system32\DRIVERS\iaStorV.sys
21:11:09.0637 4444 iaStorV - ok
21:11:09.0645 4444 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
21:11:09.0652 4444 iirsp - ok
21:11:09.0708 4444 IntcAzAudAddService (42943bb3ab7a405b30eff7c8283cc129) C:\Windows\system32\drivers\RTKVHD64.sys
21:11:09.0767 4444 IntcAzAudAddService - ok
21:11:09.0773 4444 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys
21:11:09.0780 4444 intelide - ok
21:11:09.0803 4444 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
21:11:09.0819 4444 intelppm - ok
21:11:09.0828 4444 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys
21:11:09.0862 4444 IpFilterDriver - ok
21:11:09.0870 4444 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys
21:11:09.0884 4444 IPMIDRV - ok
21:11:09.0891 4444 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
21:11:09.0936 4444 IPNAT - ok
21:11:09.0955 4444 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
21:11:09.0981 4444 IRENUM - ok
21:11:09.0988 4444 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys
21:11:09.0994 4444 isapnp - ok
21:11:10.0018 4444 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys
21:11:10.0028 4444 iScsiPrt - ok
21:11:10.0061 4444 JRAID (75ddb94a2a24f9f7037d10a2dda06d36) C:\Windows\system32\DRIVERS\jraid.sys
21:11:10.0067 4444 JRAID - ok
21:11:10.0083 4444 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
21:11:10.0090 4444 kbdclass - ok
21:11:10.0098 4444 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys
21:11:10.0108 4444 kbdhid - ok
21:11:10.0121 4444 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys
21:11:10.0129 4444 KSecDD - ok
21:11:10.0137 4444 KSecPkg (bbe1bf6d9b661c354d4857d5fadb943b) C:\Windows\system32\Drivers\ksecpkg.sys
21:11:10.0145 4444 KSecPkg - ok
21:11:10.0153 4444 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
21:11:10.0199 4444 ksthunk - ok
21:11:10.0227 4444 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
21:11:10.0266 4444 lltdio - ok
21:11:10.0311 4444 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
21:11:10.0320 4444 LSI_FC - ok
21:11:10.0328 4444 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
21:11:10.0335 4444 LSI_SAS - ok
21:11:10.0342 4444 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
21:11:10.0351 4444 LSI_SAS2 - ok
21:11:10.0359 4444 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
21:11:10.0369 4444 LSI_SCSI - ok
21:11:10.0378 4444 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
21:11:10.0410 4444 luafv - ok
21:11:10.0417 4444 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
21:11:10.0427 4444 megasas - ok
21:11:10.0436 4444 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
21:11:10.0447 4444 MegaSR - ok
21:11:10.0455 4444 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
21:11:10.0492 4444 Modem - ok
21:11:10.0499 4444 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
21:11:10.0520 4444 monitor - ok
21:11:10.0526 4444 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
21:11:10.0534 4444 mouclass - ok
21:11:10.0540 4444 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
21:11:10.0551 4444 mouhid - ok
21:11:10.0558 4444 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys
21:11:10.0568 4444 mountmgr - ok
21:11:10.0578 4444 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys
21:11:10.0588 4444 mpio - ok
21:11:10.0595 4444 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
21:11:10.0640 4444 mpsdrv - ok
21:11:10.0658 4444 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys
21:11:10.0677 4444 MRxDAV - ok
21:11:10.0685 4444 mrxsmb (cfdcd8ca87c2a657debc150ac35b5e08) C:\Windows\system32\DRIVERS\mrxsmb.sys
21:11:10.0734 4444 mrxsmb - ok
21:11:10.0745 4444 mrxsmb10 (1bee517b220b7f024f411aec1571dd5a) C:\Windows\system32\DRIVERS\mrxsmb10.sys
21:11:10.0784 4444 mrxsmb10 - ok
21:11:10.0792 4444 mrxsmb20 (6b2d5fef385828b6e485c1c90afb8195) C:\Windows\system32\DRIVERS\mrxsmb20.sys
21:11:10.0829 4444 mrxsmb20 - ok
21:11:10.0843 4444 msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys
21:11:10.0852 4444 msahci - ok
21:11:10.0862 4444 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys
21:11:10.0871 4444 msdsm - ok
21:11:10.0879 4444 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
21:11:10.0910 4444 Msfs - ok
21:11:10.0925 4444 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
21:11:10.0977 4444 mshidkmdf - ok
21:11:10.0984 4444 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys
21:11:10.0991 4444 msisadrv - ok
21:11:11.0010 4444 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
21:11:11.0043 4444 MSKSSRV - ok
21:11:11.0054 4444 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
21:11:11.0100 4444 MSPCLOCK - ok
21:11:11.0107 4444 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
21:11:11.0152 4444 MSPQM - ok
21:11:11.0162 4444 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys
21:11:11.0177 4444 MsRPC - ok
21:11:11.0185 4444 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys
21:11:11.0191 4444 mssmbios - ok
21:11:11.0199 4444 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
21:11:11.0240 4444 MSTEE - ok
21:11:11.0249 4444 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
21:11:11.0262 4444 MTConfig - ok
21:11:11.0280 4444 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
21:11:11.0287 4444 Mup - ok
21:11:11.0301 4444 mwlPSDFilter (6ffecc25b39dc7652a0cec0ada9db589) C:\Windows\system32\DRIVERS\mwlPSDFilter.sys
21:11:11.0306 4444 mwlPSDFilter - ok
21:11:11.0324 4444 mwlPSDNServ (0befe32ca56d6ee89d58175725596a85) C:\Windows\system32\DRIVERS\mwlPSDNServ.sys
21:11:11.0328 4444 mwlPSDNServ - ok
21:11:11.0339 4444 mwlPSDVDisk (d43bc633b8660463e446e28e14a51262) C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys
21:11:11.0346 4444 mwlPSDVDisk - ok
21:11:11.0384 4444 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
21:11:11.0415 4444 NativeWifiP - ok
21:11:11.0442 4444 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys
21:11:11.0466 4444 NDIS - ok
21:11:11.0475 4444 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
21:11:11.0510 4444 NdisCap - ok
21:11:11.0525 4444 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
21:11:11.0573 4444 NdisTapi - ok
21:11:11.0589 4444 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys
21:11:11.0640 4444 Ndisuio - ok
21:11:11.0648 4444 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys
21:11:11.0689 4444 NdisWan - ok
21:11:11.0698 4444 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys
21:11:11.0734 4444 NDProxy - ok
21:11:11.0743 4444 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
21:11:11.0789 4444 NetBIOS - ok
21:11:11.0813 4444 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys
21:11:11.0867 4444 NetBT - ok
21:11:11.0895 4444 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
21:11:11.0904 4444 nfrd960 - ok
21:11:11.0921 4444 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
21:11:11.0970 4444 Npfs - ok
21:11:11.0978 4444 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
21:11:12.0012 4444 nsiproxy - ok
21:11:12.0051 4444 Ntfs (356698a13c4630d5b31c37378d469196) C:\Windows\system32\drivers\Ntfs.sys
21:11:12.0086 4444 Ntfs - ok
21:11:12.0102 4444 NTIDrvr (64ddd0dee976302f4bd93e5efcc2f013) C:\Windows\system32\drivers\NTIDrvr.sys
21:11:12.0106 4444 NTIDrvr - ok
21:11:12.0122 4444 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
21:11:12.0152 4444 Null - ok
21:11:12.0208 4444 nvraid (3e38712941e9bb4ddbee00affe3fed3d) C:\Windows\system32\DRIVERS\nvraid.sys
21:11:12.0217 4444 nvraid - ok
21:11:12.0237 4444 nvstor (477dc4d6deb99be37084c9ac6d013da1) C:\Windows\system32\DRIVERS\nvstor.sys
21:11:12.0245 4444 nvstor - ok
21:11:12.0257 4444 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys
21:11:12.0266 4444 nv_agp - ok
21:11:12.0279 4444 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys
21:11:12.0289 4444 ohci1394 - ok
21:11:12.0310 4444 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
21:11:12.0320 4444 Parport - ok
21:11:12.0328 4444 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys
21:11:12.0335 4444 partmgr - ok
21:11:12.0388 4444 pavboot (8a0f8a9580d9f2fc512a35d5709088a9) C:\Windows\system32\drivers\pavboot64.sys
21:11:12.0393 4444 pavboot - ok
21:11:12.0407 4444 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys
21:11:12.0417 4444 pci - ok
21:11:12.0423 4444 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys
21:11:12.0430 4444 pciide - ok
21:11:12.0439 4444 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
21:11:12.0449 4444 pcmcia - ok
21:11:12.0457 4444 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
21:11:12.0463 4444 pcw - ok
21:11:12.0475 4444 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
21:11:12.0514 4444 PEAUTH - ok
21:11:12.0536 4444 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys
21:11:12.0589 4444 PptpMiniport - ok
21:11:12.0599 4444 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
21:11:12.0621 4444 Processor - ok
21:11:12.0640 4444 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys
21:11:12.0692 4444 Psched - ok
21:11:12.0732 4444 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
21:11:12.0770 4444 ql2300 - ok
21:11:12.0778 4444 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
21:11:12.0786 4444 ql40xx - ok
21:11:12.0799 4444 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
21:11:12.0814 4444 QWAVEdrv - ok
21:11:12.0821 4444 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
21:11:12.0867 4444 RasAcd - ok
21:11:12.0881 4444 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
21:11:12.0912 4444 RasAgileVpn - ok
21:11:12.0920 4444 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys
21:11:12.0962 4444 Rasl2tp - ok
21:11:12.0970 4444 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
21:11:13.0001 4444 RasPppoe - ok
21:11:13.0009 4444 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
21:11:13.0061 4444 RasSstp - ok
21:11:13.0085 4444 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys
21:11:13.0134 4444 rdbss - ok
21:11:13.0154 4444 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
21:11:13.0169 4444 rdpbus - ok
21:11:13.0184 4444 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
21:11:13.0216 4444 RDPCDD - ok
21:11:13.0224 4444 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
21:11:13.0279 4444 RDPENCDD - ok
21:11:13.0286 4444 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
21:11:13.0321 4444 RDPREFMP - ok
21:11:13.0329 4444 RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys
21:11:13.0369 4444 RDPWD - ok
21:11:13.0378 4444 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys
21:11:13.0387 4444 rdyboost - ok
21:11:13.0424 4444 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
21:11:13.0467 4444 rspndr - ok
21:11:13.0475 4444 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys
21:11:13.0484 4444 sbp2port - ok
21:11:13.0504 4444 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys
21:11:13.0536 4444 scfilter - ok
21:11:13.0545 4444 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
21:11:13.0585 4444 secdrv - ok
21:11:13.0595 4444 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
21:11:13.0603 4444 Serenum - ok
21:11:13.0612 4444 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
21:11:13.0632 4444 Serial - ok
21:11:13.0638 4444 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
21:11:13.0654 4444 sermouse - ok
21:11:13.0663 4444 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys
21:11:13.0674 4444 sffdisk - ok
21:11:13.0682 4444 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys
21:11:13.0694 4444 sffp_mmc - ok
21:11:13.0700 4444 sffp_sd (5588b8c6193eb1522490c122eb94dffa) C:\Windows\system32\DRIVERS\sffp_sd.sys
21:11:13.0713 4444 sffp_sd - ok
21:11:13.0720 4444 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
21:11:13.0729 4444 sfloppy - ok
21:11:13.0751 4444 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
21:11:13.0759 4444 SiSRaid2 - ok
21:11:13.0766 4444 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
21:11:13.0774 4444 SiSRaid4 - ok
21:11:13.0782 4444 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
21:11:13.0813 4444 Smb - ok
21:11:13.0821 4444 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
21:11:13.0828 4444 spldr - ok
21:11:13.0857 4444 srv (ec8f67289105bf270498095f14963464) C:\Windows\system32\DRIVERS\srv.sys
21:11:13.0894 4444 srv - ok
21:11:13.0906 4444 srv2 (f773d2ed090b7baa1c1a034f3ca476c8) C:\Windows\system32\DRIVERS\srv2.sys
21:11:13.0953 4444 srv2 - ok
21:11:13.0963 4444 srvnet (26e84d3649019c3244622e654dfcd75b) C:\Windows\system32\DRIVERS\srvnet.sys
21:11:14.0011 4444 srvnet - ok
21:11:14.0033 4444 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
21:11:14.0042 4444 stexstor - ok
21:11:14.0058 4444 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys
21:11:14.0066 4444 swenum - ok
21:11:14.0106 4444 Tcpip (912107716bab424c7870e8e6af5e07e1) C:\Windows\system32\drivers\tcpip.sys
21:11:14.0148 4444 Tcpip - ok
21:11:14.0181 4444 TCPIP6 (912107716bab424c7870e8e6af5e07e1) C:\Windows\system32\DRIVERS\tcpip.sys
21:11:14.0213 4444 TCPIP6 - ok
21:11:14.0221 4444 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys
21:11:14.0258 4444 tcpipreg - ok
21:11:14.0266 4444 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
21:11:14.0308 4444 TDPIPE - ok
21:11:14.0314 4444 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
21:11:14.0350 4444 TDTCP - ok
21:11:14.0358 4444 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys
21:11:14.0410 4444 tdx - ok
21:11:14.0418 4444 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys
21:11:14.0425 4444 TermDD - ok
21:11:14.0438 4444 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys
21:11:14.0480 4444 tssecsrv - ok
21:11:14.0496 4444 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys
21:11:14.0543 4444 tunnel - ok
21:11:14.0550 4444 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
21:11:14.0558 4444 uagp35 - ok
21:11:14.0590 4444 UBHelper (2e22c1fd397a5a9ffef55e9d1fc96c00) C:\Windows\system32\drivers\UBHelper.sys
21:11:14.0595 4444 UBHelper - ok
21:11:14.0614 4444 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys
21:11:14.0656 4444 udfs - ok
21:11:14.0671 4444 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys
21:11:14.0679 4444 uliagpkx - ok
21:11:14.0693 4444 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys
21:11:14.0703 4444 umbus - ok
21:11:14.0711 4444 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
21:11:14.0723 4444 UmPass - ok
21:11:14.0744 4444 usbccgp (b26afb54a534d634523c4fb66765b026) C:\Windows\system32\DRIVERS\usbccgp.sys
21:11:14.0764 4444 usbccgp - ok
21:11:14.0776 4444 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys
21:11:14.0788 4444 usbcir - ok
21:11:14.0796 4444 usbehci (2ea4aff7be7eb4632e3aa8595b0803b5) C:\Windows\system32\DRIVERS\usbehci.sys
21:11:14.0805 4444 usbehci - ok
21:11:14.0815 4444 usbhub (4c9042b8df86c1e8e6240c218b99b39b) C:\Windows\system32\DRIVERS\usbhub.sys
21:11:14.0836 4444 usbhub - ok
21:11:14.0849 4444 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys
21:11:14.0858 4444 usbohci - ok
21:11:14.0866 4444 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
21:11:14.0890 4444 usbprint - ok
21:11:14.0912 4444 USBSTOR (080d3820da6c046be82fc8b45a893e83) C:\Windows\system32\DRIVERS\USBSTOR.SYS
21:11:14.0928 4444 USBSTOR - ok
21:11:14.0935 4444 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\DRIVERS\usbuhci.sys
21:11:14.0944 4444 usbuhci - ok
21:11:14.0954 4444 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys
21:11:14.0960 4444 vdrvroot - ok
21:11:14.0968 4444 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
21:11:14.0980 4444 vga - ok
21:11:14.0986 4444 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
21:11:15.0025 4444 VgaSave - ok
21:11:15.0034 4444 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys
21:11:15.0044 4444 vhdmp - ok
21:11:15.0053 4444 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys
21:11:15.0061 4444 viaide - ok
21:11:15.0068 4444 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys
21:11:15.0076 4444 volmgr - ok
21:11:15.0097 4444 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys
21:11:15.0111 4444 volmgrx - ok
21:11:15.0121 4444 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys
21:11:15.0134 4444 volsnap - ok
21:11:15.0150 4444 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
21:11:15.0160 4444 vsmraid - ok
21:11:15.0168 4444 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
21:11:15.0179 4444 vwifibus - ok
21:11:15.0187 4444 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
21:11:15.0205 4444 WacomPen - ok
21:11:15.0219 4444 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
21:11:15.0268 4444 WANARP - ok
21:11:15.0270 4444 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
21:11:15.0305 4444 Wanarpv6 - ok
21:11:15.0319 4444 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
21:11:15.0326 4444 Wd - ok
21:11:15.0338 4444 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
21:11:15.0355 4444 Wdf01000 - ok
21:11:15.0385 4444 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
21:11:15.0421 4444 WfpLwf - ok
21:11:15.0428 4444 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
21:11:15.0434 4444 WIMMount - ok
21:11:15.0455 4444 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys
21:11:15.0470 4444 WmiAcpi - ok
21:11:15.0482 4444 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
21:11:15.0525 4444 ws2ifsl - ok
21:11:15.0536 4444 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys
21:11:15.0584 4444 WudfPf - ok
21:11:15.0607 4444 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys
21:11:15.0651 4444 WUDFRd - ok
21:11:15.0674 4444 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
21:11:15.0760 4444 \Device\Harddisk0\DR0 - ok
21:11:15.0761 4444 Boot (0x1200) (ee3a95752d5ceb6260a355551ddad892) \Device\Harddisk0\DR0\Partition0
21:11:15.0762 4444 \Device\Harddisk0\DR0\Partition0 - ok
21:11:15.0772 4444 Boot (0x1200) (6a913ee0d539b7653928e4510476d4a4) \Device\Harddisk0\DR0\Partition1
21:11:15.0773 4444 \Device\Harddisk0\DR0\Partition1 - ok
21:11:15.0794 4444 Boot (0x1200) (8c7c62ec2cba5e6a4f9b9276e3f87def) \Device\Harddisk0\DR0\Partition2
21:11:15.0795 4444 \Device\Harddisk0\DR0\Partition2 - ok
21:11:15.0796 4444 ============================================================
21:11:15.0796 4444 Scan finished
21:11:15.0796 4444 ============================================================
21:11:15.0801 4952 Detected object count: 0
21:11:15.0801 4952 Actual detected object count: 0

Alt 16.11.2011, 09:22   #20
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Ist das ein gefährlicher Trojaner Trj/CI.A - Standard

Ist das ein gefährlicher Trojaner Trj/CI.A



Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

__________________
Logfiles bitte immer in CODE-Tags posten

Alt 16.11.2011, 20:31   #21
kessemaus1
 
Ist das ein gefährlicher Trojaner Trj/CI.A - Standard

Ist das ein gefährlicher Trojaner Trj/CI.A



hier der Log

Combofix Logfile:
Code:
ATTFilter
ComboFix 11-11-16.01 - WirBeide 16.11.2011  20:23:21.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.6071.4654 [GMT 1:00]
ausgeführt von:: c:\users\WirBeide\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\FullRemove.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-10-16 bis 2011-11-16  ))))))))))))))))))))))))))))))
.
.
2011-11-16 19:26 . 2011-11-16 19:26	69000	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{14376F22-CFF4-418E-B1ED-8B5FA79B1F5A}\offreg.dll
2011-11-16 19:25 . 2011-11-16 19:25	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-11-16 13:49 . 2011-10-06 20:16	8570192	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-11-16 13:49 . 2011-10-06 20:16	8570192	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{14376F22-CFF4-418E-B1ED-8B5FA79B1F5A}\mpengine.dll
2011-11-16 07:12 . 2010-03-04 04:32	243712	----a-w-	c:\windows\system32\drivers\ks.sys
2011-11-16 07:09 . 2011-11-16 07:08	917840	------w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{723A5020-320B-4CAD-BEB4-AC1EC0D050AA}\gapaengine.dll
2011-11-16 07:07 . 2011-11-16 07:07	--------	d-----w-	c:\program files (x86)\Microsoft Security Client
2011-11-16 07:07 . 2011-11-16 07:07	--------	d-----w-	c:\program files\Microsoft Security Client
2011-11-16 07:07 . 2010-04-09 11:06	1898376	----a-w-	c:\windows\system32\drivers\tcpip.sys
2011-11-16 07:07 . 2010-04-09 11:06	374664	----a-w-	c:\windows\system32\drivers\netio.sys
2011-11-15 11:46 . 2011-11-15 11:46	--------	d-----w-	c:\program files (x86)\ESET
2011-11-15 04:26 . 2011-11-15 04:26	--------	d-----w-	c:\windows\SysWow64\XPSViewer
2011-11-15 04:26 . 2011-11-15 04:26	--------	d-----w-	c:\windows\SysWow64\wbem\de-DE
2011-11-15 04:26 . 2011-11-15 04:26	--------	d-----w-	c:\windows\SysWow64\drivers\UMDF\de-DE
2011-11-15 04:26 . 2011-11-15 04:26	--------	d-----w-	c:\windows\SysWow64\drivers\de-DE
2011-11-15 04:26 . 2011-11-15 04:26	--------	d-----w-	c:\windows\SysWow64\de
2011-11-15 04:26 . 2011-11-15 04:26	--------	d-----w-	c:\windows\SysWow64\0407
2011-11-15 04:26 . 2011-11-15 04:26	--------	d-----w-	c:\windows\de-DE
2011-11-15 04:26 . 2011-11-15 04:26	--------	d-----w-	c:\windows\system32\wbem\de-DE
2011-11-15 04:26 . 2011-11-15 04:26	--------	d-----w-	c:\windows\system32\drivers\UMDF\de-DE
2011-11-15 04:26 . 2011-11-15 04:26	--------	d-----w-	c:\windows\system32\drivers\de-DE
2011-11-15 04:26 . 2011-11-15 04:26	--------	d-----w-	c:\windows\system32\de
2011-11-15 04:26 . 2011-11-15 04:26	--------	d-----w-	c:\windows\system32\0407
2011-11-15 04:25 . 2011-11-15 04:25	3584	----a-w-	c:\windows\system32\Spool\prtprocs\x64\de-DE\LXKPTPRC.DLL.mui
2011-11-15 04:20 . 2011-11-15 04:20	--------	d-----w-	c:\windows\NAPP_Dism_Log
2011-11-14 21:31 . 2011-09-06 21:45	254400	----a-w-	c:\windows\system32\aswBoot.exe
2011-11-14 21:30 . 2011-11-15 11:39	--------	d-----w-	c:\programdata\AVAST Software
2011-11-14 21:30 . 2011-11-14 21:30	--------	d-----w-	c:\program files\AVAST Software
2011-11-14 21:25 . 2011-11-14 21:25	--------	d-----w-	c:\programdata\Malwarebytes
2011-11-14 21:25 . 2011-08-31 16:00	25416	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-11-14 21:05 . 2011-11-15 22:21	--------	d-----w-	c:\program files (x86)\Spybot - Search & Destroy
2011-11-14 21:05 . 2011-11-15 22:21	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2011-11-14 20:59 . 2011-11-14 20:59	404640	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-14 20:56 . 2011-10-18 00:27	8570192	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{1F2BC340-72C5-4632-B4A1-86AFF8F68D5F}\mpengine.dll
2011-11-14 20:56 . 2010-10-19 20:51	270720	------w-	c:\windows\system32\MpSigStub.exe
2011-11-14 20:51 . 2011-11-14 20:51	--------	d-----w-	c:\program files\TeamSpeak 3 Client
2011-11-14 20:48 . 2011-11-15 22:20	--------	d-----w-	c:\program files (x86)\Panda Security
2011-11-14 20:26 . 2011-11-14 20:26	--------	d-----w-	c:\program files (x86)\Microsoft Visual Studio 8
2011-11-14 20:24 . 2006-11-29 12:06	4398360	----a-w-	c:\windows\system32\d3dx9_32.dll
2011-11-14 20:24 . 2006-11-29 12:06	3426072	----a-w-	c:\windows\SysWow64\d3dx9_32.dll
2011-11-14 20:24 . 2011-11-14 20:24	--------	d-----w-	c:\program files (x86)\Microsoft SQL Server Compact Edition
2011-11-14 20:23 . 2011-11-14 20:23	--------	d-----w-	c:\program files (x86)\Microsoft
2011-11-14 20:23 . 2011-11-14 20:23	--------	d-----w-	c:\program files (x86)\Windows Live SkyDrive
2011-11-14 20:22 . 2011-11-14 20:24	--------	d-----w-	c:\program files (x86)\Windows Live
2011-11-14 20:21 . 2011-11-14 20:21	--------	d-----w-	c:\program files (x86)\Common Files\Windows Live
2011-11-14 20:21 . 2009-09-25 09:48	44544	----a-w-	c:\windows\SysWow64\msxml4a.dll
2011-11-14 20:20 . 2007-03-13 12:54	610436	----a-w-	c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
2011-11-14 20:20 . 2001-09-05 03:18	77824	----a-w-	c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
2011-11-14 20:20 . 2001-09-05 03:18	225280	----a-w-	c:\program files (x86)\Common Files\InstallShield\IScript\iscript.dll
2011-11-14 20:20 . 2001-09-05 03:14	176128	----a-w-	c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
2011-11-14 20:20 . 2001-09-05 03:13	32768	----a-w-	c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
2011-11-14 20:20 . 2011-11-14 20:20	--------	d-----w-	c:\program files (x86)\Cyberlink
2011-11-14 20:18 . 2011-11-14 20:21	--------	d-----w-	c:\program files (x86)\Acer Arcade Deluxe
2011-11-14 20:18 . 2011-11-14 20:20	--------	d-----w-	c:\programdata\CyberLink
2011-11-14 20:16 . 2011-11-14 20:16	--------	d-----w-	c:\programdata\ATI
2011-11-14 20:16 . 2011-11-14 20:16	--------	d-----w-	c:\program files (x86)\Common Files\postureAgent
2011-11-14 20:15 . 2011-11-14 20:15	--------	d---a-w-	C:\book
2011-11-14 20:15 . 2011-11-14 20:15	--------	d-----w-	c:\programdata\McQcModifier-5c47-a7b0
2011-11-14 20:15 . 2011-11-14 20:15	--------	d-----w-	c:\programdata\EgisTec
2011-11-14 20:08 . 2010-01-09 07:19	139264	----a-w-	c:\windows\system32\cabview.dll
2011-11-14 20:08 . 2010-01-09 06:52	132608	----a-w-	c:\windows\SysWow64\cabview.dll
2011-11-14 20:08 . 2009-12-29 08:03	220672	----a-w-	c:\windows\system32\wintrust.dll
2011-11-14 20:08 . 2009-12-29 06:55	172032	----a-w-	c:\windows\SysWow64\wintrust.dll
2011-11-14 19:54 . 2011-11-14 19:54	0	----a-w-	c:\windows\ativpsrm.bin
2011-11-14 19:53 . 2011-11-14 19:53	3	----a-w-	c:\windows\system32\PLD_Framework.cmd
2011-11-14 19:51 . 2011-11-14 19:51	331908	----a-w-	c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\setup.dll
2011-11-14 19:49 . 2011-11-14 19:49	--------	d-----w-	c:\program files (x86)\Common Files\ATI Technologies
2011-11-14 19:49 . 2011-11-14 19:49	--------	d-----w-	c:\program files\Common Files\ATI Technologies
2011-11-14 19:49 . 2011-11-14 19:49	--------	d-----w-	c:\program files (x86)\ATI Technologies
2011-11-14 19:49 . 2011-11-14 19:49	--------	d-----w-	c:\program files\ATI
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-15 04:25 . 2011-11-15 04:25	2560	----a-w-	c:\windows\SysWow64\drivers\de-DE\qwavedrv.sys.mui
2011-11-15 04:25 . 2011-11-15 04:25	5632	----a-w-	c:\windows\SysWow64\drivers\de-DE\ndiscap.sys.mui
2011-11-15 04:25 . 2011-11-15 04:25	2560	----a-w-	c:\windows\SysWow64\drivers\de-DE\scfilter.sys.mui
2011-11-15 04:25 . 2011-11-15 04:25	51712	----a-w-	c:\windows\SysWow64\drivers\de-DE\tcpip.sys.mui
2011-11-15 04:25 . 2011-11-15 04:25	29696	----a-w-	c:\windows\SysWow64\drivers\de-DE\bfe.dll.mui
2011-11-15 04:25 . 2011-11-15 04:25	16896	----a-w-	c:\windows\SysWow64\drivers\de-DE\pacer.sys.mui
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-10 13:41	120104	----a-w-	c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-08-12 261888]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2009-01-05 413696]
"Hotkey Utility"="c:\program files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe" [2009-08-18 629280]
"EgisTecLiveUpdate"="c:\program files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-01-13 98304]
"ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-12-22 128296]
"PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-12-22 181480]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-14 135664]
R2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2314240]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-14 135664]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-09-10 305448]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]
S2 AAV UpdateService;AAV UpdateService;c:\program files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [2008-10-24 128296]
S2 ABBYY.Licensing.PDFTransformer.Site License.3.0;ABBYY PDF Transformer 3.0 Licensing Service;c:\program files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [2009-05-14 759048]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-08-28 1150496]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-08-12 62208]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]
S2 USBS3S4Detection;USBS3S4Detection;c:\oem\USBDECTION\USBS3S4Detection.exe [2009-12-09 76320]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2011-11-16 c:\windows\Tasks\Acer Registration Reminder.job
- c:\program files (x86)\Acer\Registration\GREG.exe [2009-08-28 09:40]
.
2011-11-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-14 20:37]
.
2011-11-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-14 20:37]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-10 13:44	137512	----a-w-	c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-10-13 186904]
"mwlDaemon"="c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-09-10 349480]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-28 8312352]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1 192.168.2.1
FF - ProfilePath - c:\users\WirBeide\AppData\Roaming\Mozilla\Firefox\Profiles\gk512yjg.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
Toolbar-Locked - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-11-16  20:28:51 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-11-16 19:28
.
Vor Suchlauf: 9 Verzeichnis(se), 437.762.260.992 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 437.712.855.040 Bytes frei
.
- - End Of File - - CD53AB09D02F435D80D45459182C3429
         
--- --- ---

Alt 16.11.2011, 21:14   #22
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Ist das ein gefährlicher Trojaner Trj/CI.A - Standard

Ist das ein gefährlicher Trojaner Trj/CI.A



Alles bislang recht unauffällig.

Zitat:
Habe mit Panda online den PC gescannt und dieser hat was gefunden. Trj/CI.A hätte ich wohl.
Den angeblichen Trj/CI.A hab ich in deinem Panda-Log oben nicht gefunden! Wie kommt das zusatnde? Falsch notiert biw. im Gedächtnis oder hast du was Wesentliches wieder vergessen zu posten?
__________________
Logfiles bitte immer in CODE-Tags posten

Antwort

Themen zu Ist das ein gefährlicher Trojaner Trj/CI.A
angeschlossen, aufgesetzt, explorer, gefährlicher, gescannt, geschlossen, google, interne, internetseite, komische, mozilla, neu, neu aufgesetzt, nicht mehr, online, panda, plötzlich, screenshot, seite, setzt, trj/ci.a, troja, trojaner, wirklich, zocken, öffnet



Ähnliche Themen: Ist das ein gefährlicher Trojaner Trj/CI.A


  1. Windows 10: Gefährlicher Zertifikats-Wirrwarr
    Nachrichten - 14.08.2015 (0)
  2. Sehr gefährlicher Trojaner unter Win7 Ultimate
    Plagegeister aller Art und deren Bekämpfung - 01.07.2015 (9)
  3. EXTREM GEFÄHRLICHER VIRUS: c6ubmmri.exe
    Plagegeister aller Art und deren Bekämpfung - 04.10.2014 (34)
  4. TR/Crypt.ZPACK.Gen2 - Avira Fehlalarm oder gefährlicher Trojaner?
    Plagegeister aller Art und deren Bekämpfung - 08.12.2013 (5)
  5. Web-Seiten von Bund und BSI mit gefährlicher Verschlüsselung
    Nachrichten - 12.11.2013 (0)
  6. Gefährlicher Hackerangriff?
    Plagegeister aller Art und deren Bekämpfung - 02.08.2012 (9)
  7. gefährlicher virus oder nicht?
    Plagegeister aller Art und deren Bekämpfung - 03.07.2012 (35)
  8. Av AntiRootkit scan - gefährlicher Fund?
    Log-Analyse und Auswertung - 18.01.2010 (13)
  9. Gefährlicher Keylogger
    Plagegeister aller Art und deren Bekämpfung - 18.08.2009 (15)
  10. Gefährlicher Backdoor Trojaner
    Log-Analyse und Auswertung - 29.04.2009 (7)
  11. Hilfe sehr gefährlicher trojaner
    Plagegeister aller Art und deren Bekämpfung - 13.04.2009 (15)
  12. Gefährlicher Virus oder nicht?
    Mülltonne - 18.07.2008 (0)
  13. Virenscanner stürzen alle ab, gefährlicher Trojaner ?
    Log-Analyse und Auswertung - 09.06.2008 (9)
  14. gefährlicher backdoor-trojaner
    Log-Analyse und Auswertung - 19.12.2006 (2)
  15. Gefährlicher CIA Trojaner!!!
    Log-Analyse und Auswertung - 29.01.2006 (12)
  16. Gefährlicher Trojaner?
    Plagegeister aller Art und deren Bekämpfung - 07.10.2005 (9)
  17. Gefährlicher Dialer, oder was?
    Plagegeister aller Art und deren Bekämpfung - 26.05.2005 (4)

Zum Thema Ist das ein gefährlicher Trojaner Trj/CI.A - Kannst du bitte endlich mal anfangen die Anleitungen sorgfältiger umzusetzen!? Du hast das Log von ESET in das OTL-Fenster hineinkopiert Was steht in der Anleitung?! - Ist das ein gefährlicher Trojaner Trj/CI.A...
Archiv
Du betrachtest: Ist das ein gefährlicher Trojaner Trj/CI.A auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.