Windows wurde aus Sicherheitsgründen blockiert

Manfred81

Liebes Trojaner-Board-Team,

bekomme seit gestern kurz nach dem Start des Rechners eine Meldung
"Ihr Windows wurde aus Sicherheitsgründen gesperrt". Anscheinend konnte mir da selbst die aktuelle Vollversion von McAffee Antivir nicht helfen.

Über den Task-Manager kann ich mich immerhin noch abmelden und mein Zweit-Benutzerkonto unter Windows funktioniert bislang auch noch. Würde aber auf jeden Fall gerne mit Eurer Hilfe den PC wieder bereinigen.

Über Google habe ich diverse Beiträge zu dem Thema gefunden, aber wenn ich das richtig verstehe, wirkt sich diese Malware ja jedes Mal anders aus.

Habe wie beschrieben Defogger und DDS laufen lassen (Gmer nicht wg. 64 Bit-System), die Logs habe ich angehängt.

Vielen Dank im Voraus!



DDS:

.
DDS (Ver_2011-08-26.01) - NTFSAMD64 MINIMAL
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29
Run by Manfred at 11:40:27 on 2012-03-25
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8086.7269 [GMT 2:00]
.
AV: McAfee Anti-Virus und Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee Anti-Virus und Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\SysWOW64\NOTEPAD.EXE
C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
mWinlogon: Userinit=userinit.exe
uWindows: Load=C:\Users\Manfred\LOCALS~1\Temp\mstuoey.bat
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120105205954.dll
BHO: Windows Live ID-Anmelde-Hilfsprogramm: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll
uRun: [Userinit] C:\Users\Manfred\AppData\Roaming\appconf32.exe
uRun: [SkypePM] C:\Users\Manfred\AppData\Local\Skype\SkypePM.exe
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
mRun: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe
mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
mRun: [<NO NAME>]
mRun: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
mRun: [NeroLauncher] C:\Program Files (x86)\Nero\SyncUP\NeroLauncher.exe 900
mRun: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup
StartupFolder: C:\Users\Manfred\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\BERWAC~1.LNK - C:\Program Files (x86)\Intel\TurboBoost\SignalIslandUi.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: An OneNote s&enden - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
TCP: DhcpNameServer = 80.69.100.174 80.69.100.206 192.168.0.1
TCP: Interfaces\{F0652E56-6A6A-488A-BE98-F789EF8C2313} : DhcpNameServer = 80.69.100.174 80.69.100.206 192.168.0.1
TCP: Interfaces\{F0652E56-6A6A-488A-BE98-F789EF8C2313}\75C414E4D2031353632393 : DhcpNameServer = 192.168.2.1
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\McAfee\msc\McSnIePl.dll
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
{27B4851A-3207-45A2-B947-BE8AFE6163AB}
{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}
{7DB2D5A0-7241-4E79-B68D-6309F01C5231}
{9030D464-4C02-4ABF-8ECC-5164760863C6}
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
{B4F3A835-0E21-4959-BA22-42B3008E02FF}
{d2ce3e00-f94a-4740-988e-03dc2f38c34f}
{DBC80044-A445-435b-BC74-9C25C1C588A9}
{8dcb7100-df86-4384-8842-8fa844297b3f}
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
mRun-x64: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe
mRun-x64: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
mRun-x64: [(Standard)]
mRun-x64: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
mRun-x64: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
mRun-x64: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
mRun-x64: [NeroLauncher] C:\Program Files (x86)\Nero\SyncUP\NeroLauncher.exe 900
mRun-x64: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup
AppInit_DLLs-X64: C:\Windows\SysWOW64\nvinit.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\ddqsdbyy.default\
FF - plugin: c:\progra~2\mcafee\msc\npMcSnFFPl.dll
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R0 hotcore3;hc3ServiceName;C:\Windows\system32\DRIVERS\hotcore3.sys --> C:\Windows\system32\DRIVERS\hotcore3.sys [?]
R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\system32\drivers\mfewfpk.sys --> C:\Windows\system32\drivers\mfewfpk.sys [?]
R0 nvpciflt;nvpciflt;C:\Windows\system32\DRIVERS\nvpciflt.sys --> C:\Windows\system32\DRIVERS\nvpciflt.sys [?]
R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
R0 stdcfltn;Disk Class Filter Driver for Accelerometer;C:\Windows\system32\DRIVERS\stdcfltn.sys --> C:\Windows\system32\DRIVERS\stdcfltn.sys [?]
R3 Acceler;Accelerometer Service;C:\Windows\system32\DRIVERS\Accelern.sys --> C:\Windows\system32\DRIVERS\Accelern.sys [?]
R3 MEIx64;Intel(R) Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\system32\DRIVERS\nusb3hub.sys --> C:\Windows\system32\DRIVERS\nusb3hub.sys [?]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\system32\DRIVERS\nusb3xhc.sys --> C:\Windows\system32\DRIVERS\nusb3xhc.sys [?]
S0 mfehidk;McAfee Inc. mfehidk;C:\Windows\system32\drivers\mfehidk.sys --> C:\Windows\system32\drivers\mfehidk.sys [?]
S1 mfenlfk;McAfee NDIS Light Filter;C:\Windows\system32\DRIVERS\mfenlfk.sys --> C:\Windows\system32\DRIVERS\mfenlfk.sys [?]
S1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
S2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-9-5 64952]
S2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2011-10-6 98208]
S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-8-8 1166848]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-5-19 921664]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2011-5-19 995392]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-6-3 134928]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 McMPFSvc;McAfee Personal Firewall Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2011-11-21 249936]
S2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2011-11-21 249936]
S2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2011-11-21 249936]
S2 McShield;McAfee McShield;C:\Program Files\Common Files\mcafee\systemcore\mcshield.exe [2011-10-6 199272]
S2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe [2011-10-6 208536]
S2 mfevtp;McAfee Validation Trust Protection Service;"C:\Windows\system32\mfevtps.exe" --> C:\Windows\system32\mfevtps.exe [?]
S2 NAUpdate;Nero Update;C:\Program Files (x86)\Nero\Update\NASvc.exe [2010-5-4 503080]
S2 NOBU;Dell DataSafe Online;C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe [2010-8-26 2823000]
S2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-6 2009704]
S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
S2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2011-10-6 1692480]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-4-21 378472]
S2 TurboB;Turbo Boost UI Monitor driver;C:\Windows\system32\DRIVERS\TurboB.sys --> C:\Windows\system32\DRIVERS\TurboB.sys [?]
S2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-10-6 2656280]
S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed - Virtueller Adapter;C:\Windows\system32\DRIVERS\AMPPAL.sys --> C:\Windows\system32\DRIVERS\AMPPAL.sys [?]
S3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protokoll;C:\Windows\system32\DRIVERS\amppal.sys --> C:\Windows\system32\DRIVERS\amppal.sys [?]
S3 Bluetooth Media Service;Bluetooth Media Service;C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2011-5-19 1335360]
S3 btmaudio;Intel Bluetooth Audio Service;C:\Windows\system32\drivers\btmaud.sys --> C:\Windows\system32\drivers\btmaud.sys [?]
S3 btmaux;Intel Bluetooth Auxiliary Service;C:\Windows\system32\DRIVERS\btmaux.sys --> C:\Windows\system32\DRIVERS\btmaux.sys [?]
S3 btmhsf;btmhsf;C:\Windows\system32\DRIVERS\btmhsf.sys --> C:\Windows\system32\DRIVERS\btmhsf.sys [?]
S3 cfwids;McAfee Inc. cfwids;C:\Windows\system32\drivers\cfwids.sys --> C:\Windows\system32\drivers\cfwids.sys [?]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\system32\DRIVERS\CtClsFlt.sys --> C:\Windows\system32\DRIVERS\CtClsFlt.sys [?]
S3 epmntdrv;epmntdrv;C:\Windows\System32\epmntdrv.sys [2011-10-16 14216]
S3 EuGdiDrv;EuGdiDrv;C:\Windows\System32\EuGdiDrv.sys [2011-10-16 8456]
S3 iBtFltCoex;iBtFltCoex;C:\Windows\system32\DRIVERS\iBtFltCoex.sys --> C:\Windows\system32\DRIVERS\iBtFltCoex.sys [?]
S3 Impcd;Impcd;C:\Windows\system32\drivers\Impcd.sys --> C:\Windows\system32\drivers\Impcd.sys [?]
S3 IntcDAud;Intel(R) Display-Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]
S3 JMCR;JMCR;C:\Windows\system32\DRIVERS\jmcr.sys --> C:\Windows\system32\DRIVERS\jmcr.sys [?]
S3 McAWFwk;McAfee Activation Service;C:\PROGRA~1\mcafee\msc\mcawfwk.exe [2011-10-6 220528]
S3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\system32\drivers\mfeavfk.sys --> C:\Windows\system32\drivers\mfeavfk.sys [?]
S3 mfefirek;McAfee Inc. mfefirek;C:\Windows\system32\drivers\mfefirek.sys --> C:\Windows\system32\drivers\mfefirek.sys [?]
S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\system32\drivers\mferkdet.sys --> C:\Windows\system32\drivers\mferkdet.sys [?]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2011-7-28 340240]
S3 NETwNs64;___ Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 64-Bit;C:\Windows\system32\DRIVERS\NETwNs64.sys --> C:\Windows\system32\DRIVERS\NETwNs64.sys [?]
S3 NvStUSB;NVIDIA Stereoscopic 3D USB driver;C:\Windows\system32\drivers\nvstusb.sys --> C:\Windows\system32\drivers\nvstusb.sys [?]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 qicflt;upper Device Filter Driver;C:\Windows\system32\DRIVERS\qicflt.sys --> C:\Windows\system32\DRIVERS\qicflt.sys [?]
S3 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2011.SP5\RpcAgentSrv.exe [2011-10-14 93848]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]
S3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2010-11-29 149504]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
S4 McOobeSv;McAfee OOBE Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2011-11-21 249936]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-23 57184]
.
=============== Created Last 30 ================
.
2012-03-23 22:35:48 5624 ----a-w- C:\Users\Manfred\AppData\Roaming\BAcroIEHelpe091.dll
2012-03-23 22:35:48 280056 ----a-w- C:\Users\Manfred\AppData\Roaming\AcroIEHelpe091.dll
2012-03-23 22:35:41 -------- d-----w- C:\Users\Manfred\AppData\Roaming\10020
2012-03-23 22:34:59 -------- d-----w- C:\Users\Manfred\AppData\Local\{B2AB5436-D132-43D1-AD85-2ADBDCC7BA27}
2012-03-23 22:34:48 -------- d-----w- C:\Users\Manfred\AppData\Local\{1C6BFA00-9B25-4F77-A9F1-D0C969A560CD}
2012-03-21 21:55:17 -------- d-----w- C:\Users\Manfred\AppData\Local\{2936EEB9-9503-4598-BA3F-DB571FE69C41}
2012-03-21 21:55:03 -------- d-----w- C:\Users\Manfred\AppData\Local\{93905684-9587-4B3D-8B00-DD4114D7C0E5}
2012-03-21 20:22:57 -------- d-----w- C:\Users\Manfred\AppData\Roaming\10019
2012-03-20 22:35:40 -------- d-----w- C:\Users\Manfred\AppData\Local\{6FFE4F60-5964-46E3-B348-6CC525D933EE}
2012-03-20 22:35:19 -------- d-----w- C:\Users\Manfred\AppData\Local\{3BE8D487-B6D0-4345-85A4-F0A5A014DD31}
2012-03-18 19:37:45 -------- d-----w- C:\Users\Manfred\AppData\Local\{23A23DA6-2566-4C65-8461-F9C494C1316C}
2012-03-18 19:37:25 -------- d-----w- C:\Users\Manfred\AppData\Local\{16B45FEB-9F42-446B-B397-048122425214}
2012-03-17 18:36:49 -------- d-----w- C:\Users\Manfred\AppData\Roaming\10017
2012-03-17 18:32:27 -------- d-----w- C:\Users\Manfred\AppData\Local\{7F13C5A9-7916-40DD-A11B-DA3281C1CD3E}
2012-03-17 18:32:16 -------- d-----w- C:\Users\Manfred\AppData\Local\{E76A5944-D697-4616-8D6D-94544EC66F3C}
2012-03-15 21:41:13 -------- d-----w- C:\Users\Manfred\AppData\Local\{2C472BAA-8DA3-4927-B7B4-40B0929E2032}
2012-03-15 21:41:02 -------- d-----w- C:\Users\Manfred\AppData\Local\{3F2BCF5C-1AB4-4E19-8AB6-191B82907425}
2012-03-15 21:32:06 -------- d-----w- C:\Users\Manfred\AppData\Roaming\UAs
2012-03-15 21:07:55 -------- d-----w- C:\Users\Manfred\AppData\Local\{B1C39816-0DB7-4260-AB47-F2BCA90D2FC7}
2012-03-15 21:07:41 -------- d-----w- C:\Users\Manfred\AppData\Local\{64911D30-E90D-4A77-B4D7-270166EDB5CD}
2012-03-14 23:14:10 5559152 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-03-14 23:14:09 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-03-14 23:14:09 3913584 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-03-14 21:27:23 -------- d-----w- C:\Users\Manfred\AppData\Roaming\10016
2012-03-14 21:27:15 136 ----a-w- C:\Users\Manfred\AppData\Roaming\srvblck2.tmp
2012-03-14 21:27:09 -------- d-----w- C:\Users\Manfred\AppData\Roaming\xmldm
2012-03-14 21:27:05 -------- d-----w- C:\Users\Manfred\AppData\Roaming\kock
2012-03-14 20:38:47 3145728 ----a-w- C:\Windows\System32\win32k.sys
2012-03-14 20:38:45 1544192 ----a-w- C:\Windows\System32\DWrite.dll
2012-03-14 20:38:44 1077248 ----a-w- C:\Windows\SysWow64\DWrite.dll
2012-03-14 20:37:16 9216 ----a-w- C:\Windows\System32\rdrmemptylst.exe
2012-03-14 20:37:16 826880 ----a-w- C:\Windows\SysWow64\rdpcore.dll
2012-03-14 20:37:16 77312 ----a-w- C:\Windows\System32\rdpwsx.dll
2012-03-14 20:37:16 210944 ----a-w- C:\Windows\System32\drivers\rdpwd.sys
2012-03-14 20:37:16 149504 ----a-w- C:\Windows\System32\rdpcorekmts.dll
2012-03-14 20:37:16 1031680 ----a-w- C:\Windows\System32\rdpcore.dll
2012-03-14 20:37:15 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys
2012-03-14 20:34:29 -------- d-----w- C:\Users\Manfred\AppData\Local\{962EDDF9-61BE-404C-B5BF-AE5BABC95A7D}
2012-03-14 20:34:06 -------- d-----w- C:\Users\Manfred\AppData\Local\{F19C30B1-D9F2-4F01-B80F-6462695EE55C}
2012-03-13 21:21:12 -------- d-----w- C:\Users\Manfred\AppData\Local\{8DBF8247-D5E2-45DD-9801-1CC40444CDDA}
2012-03-13 21:21:01 -------- d-----w- C:\Users\Manfred\AppData\Local\{5055B7B1-218C-4624-A559-C2AB6801A16A}
2012-03-12 22:52:50 -------- d-----w- C:\Users\Manfred\AppData\Local\{498986A3-5351-4A84-A18B-6B1FDC2B865A}
2012-03-12 22:52:39 -------- d-----w- C:\Users\Manfred\AppData\Local\{92A6D6FB-0C05-4A47-B362-58B594FC3F06}
2012-03-11 17:00:07 -------- d-----w- C:\Users\Manfred\AppData\Local\{B26DC553-B39D-4098-BFCE-BEE73E84C553}
2012-03-11 16:59:55 -------- d-----w- C:\Users\Manfred\AppData\Local\{E155AD94-AD75-479A-BC9D-C720B2FA011D}
2012-03-09 21:15:24 -------- d-----w- C:\Users\Manfred\AppData\Local\{6AA709FB-2173-415F-B82D-34817A3521D2}
2012-03-09 21:15:12 -------- d-----w- C:\Users\Manfred\AppData\Local\{6615D508-85BD-42BA-B4A2-7158ABCF7593}
2012-03-07 20:37:04 -------- d-----w- C:\Users\Manfred\AppData\Local\{8E4F186C-4404-4B94-BAAB-6C22232CA74B}
2012-03-07 20:36:41 -------- d-----w- C:\Users\Manfred\AppData\Local\{7F275FE1-17DB-4E2C-B764-6044C3582AF5}
2012-03-05 19:56:59 -------- d-----w- C:\Users\Manfred\AppData\Local\{BA52324B-87B0-4460-A34C-BD3F93D7303E}
2012-03-05 19:56:47 -------- d-----w- C:\Users\Manfred\AppData\Local\{163569F5-4056-4806-878D-BE478F0C39FA}
2012-03-05 19:31:55 -------- d-----w- C:\Users\Manfred\AppData\Local\{F4A89963-5FAE-42DA-964A-866A59DAB8A2}
2012-03-05 19:31:44 -------- d-----w- C:\Users\Manfred\AppData\Local\{B0B0137E-D620-4D8A-A364-B4D01F4BD3FF}
2012-03-04 22:06:43 -------- d-----w- C:\Users\Manfred\AppData\Local\{26DA5003-8BE0-42BD-BE71-0417D521203B}
2012-03-04 22:06:17 -------- d-----w- C:\Users\Manfred\AppData\Local\{1D2EE423-FE08-40CF-B3C5-135B1F68EAB6}
2012-03-03 16:51:20 -------- d-----w- C:\Users\Manfred\AppData\Local\{E09E1733-2E6D-4132-8BAC-1789F97959A3}
2012-03-03 16:51:09 -------- d-----w- C:\Users\Manfred\AppData\Local\{F8EF9B69-B2FF-4C35-868E-9B65117069A2}
2012-03-02 19:58:19 -------- d-----w- C:\Users\Manfred\AppData\Local\{A85D2547-9E0F-469D-8D7F-F9F661002CE8}
2012-03-02 19:58:08 -------- d-----w- C:\Users\Manfred\AppData\Local\{DF892788-38A1-4DE1-AD26-14768AD13221}
2012-03-01 21:06:13 -------- d-----w- C:\Users\Manfred\AppData\Local\{2A8746E3-5E1F-46BF-AAEE-CAE7FA6F9B14}
2012-03-01 21:06:02 -------- d-----w- C:\Users\Manfred\AppData\Local\{44F25A3C-CF3B-4965-8641-F8D5B7CA175D}
2012-02-29 22:21:59 -------- d-----w- C:\Users\Manfred\AppData\Local\{40B44ADE-26E9-4D41-B57A-D88662A6C3D7}
2012-02-29 22:21:41 -------- d-----w- C:\Users\Manfred\AppData\Local\{AAAE3093-8852-4C8B-80C5-A8735E361B5A}
2012-02-28 11:54:24 -------- d-----w- C:\Users\Manfred\AppData\Local\{C65FA023-B830-436E-A3AC-E58E2BAE4EA1}
2012-02-28 11:54:01 -------- d-----w- C:\Users\Manfred\AppData\Local\{4777AACB-9AEE-4D96-B656-25469AD28BA7}
2012-02-27 19:42:44 -------- d-----w- C:\Users\Manfred\AppData\Local\{EAD6F2F0-C74A-40D7-B433-CBB6A2B535E2}
2012-02-27 19:42:21 -------- d-----w- C:\Users\Manfred\AppData\Local\{0F1EC83B-1659-42D6-BFDD-0462BAEECD1D}
2012-02-26 15:44:32 -------- d-----w- C:\Users\Manfred\AppData\Local\{073D6696-8AC3-41CD-9C6A-9A001CDEFC43}
2012-02-26 15:44:21 -------- d-----w- C:\Users\Manfred\AppData\Local\{A92A223F-0308-4740-80DB-C33D53471814}
2012-02-26 15:08:01 -------- d-----w- C:\Users\Manfred\AppData\Local\{F40C434B-A512-47DC-9AAB-23C4DED9814C}
2012-02-26 15:07:49 -------- d-----w- C:\Users\Manfred\AppData\Local\{7E59766B-2545-454E-8C84-4F801CD15DC6}
2012-02-25 20:01:21 -------- d-----w- C:\Users\Manfred\AppData\Local\{19AF82C1-08A4-4E6B-B7A2-1BAA933A1E5A}
2012-02-25 20:01:09 -------- d-----w- C:\Users\Manfred\AppData\Local\{6EB5A196-AF80-43AE-8076-AC14BBACC02A}
2012-02-24 15:48:49 -------- d-----w- C:\Users\Manfred\AppData\Local\{F8264627-247D-43F6-9123-10F33D218798}
2012-02-24 15:48:37 -------- d-----w- C:\Users\Manfred\AppData\Local\{21D71EC9-0057-4D2D-B679-E15F23FF1AEC}
2012-02-24 15:46:04 -------- d-----w- C:\Users\Manfred\AppData\Local\{20DE8D83-D083-452E-AF93-564240AFFF44}
2012-02-24 15:45:53 -------- d-----w- C:\Users\Manfred\AppData\Local\{8F26A7B8-5115-405A-ADD9-B6806841225F}
.
==================== Find3M ====================
.
2012-02-18 19:11:10 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-01-04 10:44:20 509952 ----a-w- C:\Windows\System32\ntshrui.dll
2012-01-04 08:58:41 442880 ----a-w- C:\Windows\SysWow64\ntshrui.dll
2011-12-30 06:26:08 515584 ----a-w- C:\Windows\System32\timedate.cpl
2011-12-30 05:27:56 478720 ----a-w- C:\Windows\SysWow64\timedate.cpl
2011-12-28 03:59:24 498688 ----a-w- C:\Windows\System32\drivers\afd.sys
.
============= FINISH: 11:40:37,42 ===============