Auf merkwürdige Seite weitergeleitet worden - Malwarebytes hat was gefunden

condi · 22.06.2012, 19:11

Hallo liebe Forenmitglieder!

Ich habe den Verdacht, mir eventuell irgendwas Unschönes eingefangen zu haben.

Ich war neulich auf einer Internetseite (seriöse Seite, nix Dubioses!) und wurde von dieser plötzlich auf irgendeine andere, sonderbare Seite weitergeleitet. Habe diese gleich zugeklickt, weiß also nicht mehr genau wie sie hieß.

Jedenfalls habe ich danach einen Malwarebytes Scan durchgeführt und bekam dieses Ergebnis:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.09.02

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus)
Internet Explorer 9.0.8112.16421
Vicky :: VICKY-LAPTOP [Administrator]

09.06.2012 10:36:07
mbam-log-2012-06-09 (10-36-07).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 350032
Laufzeit: 38 Minute(n), 37 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc|Start (Disabled.Cryptsvc) -> Bösartig: (4) Gut: (2) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

Das gefundene Objekt habe ich gelöscht - hätte ich wohl nicht machen sollen, ich weiß. :/

Beim nächsten Durchlauf wurde dann nichts mehr gefunden:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.09.02

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus)
Internet Explorer 9.0.8112.16421
Vicky :: VICKY-LAPTOP [Administrator]

09.06.2012 15:17:17
mbam-log-2012-06-09 (15-17-17).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 342178
Laufzeit: 33 Minute(n), 1 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Heißt das, dass jetzt alles gut ist? Ich habe immernoch ein blödes Gefühl bei der Sache.

Leider bin ich auch erst jetzt auf die Idee gekommen, hier zu posten.

Ansonsten habe ich keine Probleme mit dem Rechner.
Nur Angst, dass vielleicht doch irgendwas sein könnte.

Vielleicht könnt ihr mir ja weiterhelfen.

Einen schönen Freitag Abend noch!

Grüße,

condi

cosinus · 25.06.2012, 18:33

Bitte routinemäßig einen neuen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

ATTFilter

 hier steht das Log

condi · 27.06.2012, 16:45

Hi,

danke für deine Antwort. Jetzt komme ich endlich zum Antworten.

Also gut, erstmal malwarebytes.

Das hier ist der aktuellste Scan von gestern Abend:

Code:

ATTFilter

  Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.26.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Vicky :: VICKY-LAPTOP [Administrator]

26.06.2012 16:32:36
mbam-log-2012-06-26 (16-32-36).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 350588
Laufzeit: 1 Stunde(n), 17 Minute(n), 29 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Von davor gibt es dann noch:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.09.02

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus)
Internet Explorer 9.0.8112.16421
Vicky :: VICKY-LAPTOP [Administrator]

09.06.2012 15:17:17
mbam-log-2012-06-09 (15-17-17).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 342178
Laufzeit: 33 Minute(n), 1 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

und

Code:

ATTFilter

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.09.02

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus)
Internet Explorer 9.0.8112.16421
Vicky :: VICKY-LAPTOP [Administrator]

09.06.2012 10:36:07
mbam-log-2012-06-09 (10-36-07).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 350032
Laufzeit: 38 Minute(n), 37 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc|Start (Disabled.Cryptsvc) -> Bösartig: (4) Gut: (2) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

sowie

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 911122602

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

26.12.2011 14:26:49
mbam-log-2011-12-26 (14-26-49).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 297795
Laufzeit: 35 Minute(n), 17 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Jetzt kommen wir zu eset:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
Can not read file from internet.ESETSmartInstaller@High as downloader log:
Can not read file from internet.Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=60bac82c0a090d4b9ff7d9d3a5234e1b
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-06-26 08:17:59
# local_time=2012-06-26 10:17:59 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 20821957 20821957 0 0
# compatibility_mode=5893 16776573 100 94 15993 92366267 0 0
# compatibility_mode=8192 67108863 100 0 443 443 0 0
# scanned=155972
# found=1
# cleaned=0
# scan_time=5462
D:\downloads\Setups\dell_webcam_central.exe	a variant of Win32/SWInformer application (unable to clean)	00000000000000000000000000000000	I

Hmm....man darf gespannt sein.

cosinus · 28.06.2012, 09:54

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

ATTFilter

 hier steht das Log

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet

Code:

ATTFilter

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf .
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

condi · 28.06.2012, 17:18

Bitteschön

Code:

ATTFilter

OTL logfile created on: 28.06.2012 17:51:53 - Run 1
OTL by OldTimer - Version 3.2.53.0     Folder = C:\Users\xxx\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,86 Gb Total Physical Memory | 2,42 Gb Available Physical Memory | 62,61% Memory free
7,73 Gb Paging File | 6,29 Gb Available in Paging File | 81,36% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97,66 Gb Total Space | 64,31 Gb Free Space | 65,85% Space Free | Partition Type: NTFS
Drive D: | 185,75 Gb Total Space | 65,87 Gb Free Space | 35,46% Space Free | Partition Type: NTFS
 
Computer Name: VICKY-LAPTOP | User Name: xxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.28 17:18:13 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\xxx\Desktop\OTL.exe
PRC - [2012.03.07 01:15:17 | 004,241,512 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastUI.exe
PRC - [2012.03.07 01:15:14 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe
PRC - [2011.04.19 08:44:40 | 000,993,848 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe
PRC - [2011.04.19 08:44:40 | 000,399,416 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\sua.exe
PRC - [2010.10.22 02:00:00 | 002,105,344 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
PRC - [2010.10.22 02:00:00 | 000,376,832 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
PRC - [2010.09.23 16:46:14 | 001,125,376 | ---- | M] (Luis Cobian, CobianSoft) -- C:\Program Files (x86)\Cobian Backup 10\cbService.exe
PRC - [2009.11.26 11:53:44 | 000,447,488 | R--- | M] () -- C:\Program Files (x86)\Dell\Dell WWAN\WMCore\mini_WMCore.exe
PRC - [2009.09.30 20:01:32 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2009.09.30 20:01:30 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2009.07.22 08:52:12 | 002,384,896 | ---- | M] () -- C:\Program Files (x86)\STMicroelectronics\Accelerometer\FF_Protection.exe
PRC - [2009.06.24 17:21:38 | 000,409,744 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
PRC - [2009.03.05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2009.07.22 08:52:12 | 002,384,896 | ---- | M] () -- C:\Program Files (x86)\STMicroelectronics\Accelerometer\FF_Protection.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009.12.14 13:28:54 | 000,244,736 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_42d83e1760b1e973\stacsv64.exe -- (STacSV)
SRV:64bit: - [2009.08.18 02:36:20 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.03.03 02:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_42d83e1760b1e973\AESTSr64.exe -- (AESTFilters)
SRV - [2012.06.17 10:16:30 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.06.10 10:07:25 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.03.07 01:15:14 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Programme\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2011.04.19 08:44:40 | 000,993,848 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent)
SRV - [2011.04.19 08:44:40 | 000,399,416 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files (x86)\Secunia\PSI\sua.exe -- (Secunia Update Agent)
SRV - [2010.10.22 13:08:18 | 001,039,360 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2010.10.22 02:00:00 | 000,376,832 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe -- (AVM WLAN Connection Service)
SRV - [2010.09.23 16:46:14 | 001,125,376 | ---- | M] (Luis Cobian, CobianSoft) [Auto | Running] -- C:\Program Files (x86)\Cobian Backup 10\cbService.exe -- (CobianBackup10)
SRV - [2010.09.23 09:49:08 | 000,067,584 | ---- | M] (CobianSoft, Luis Cobian) [Auto | Running] -- C:\Program Files (x86)\Cobian Backup 10\cbVSCService.exe -- (cbVSCService)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.12.14 13:28:54 | 000,244,736 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_42d83e1760b1e973\STacSV64.exe -- (STacSV)
SRV - [2009.11.26 11:53:44 | 000,447,488 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\Dell\Dell WWAN\WMCore\mini_WMCore.exe -- (WMCoreService)
SRV - [2009.09.30 20:01:32 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2009.09.30 20:01:30 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009.09.21 16:24:40 | 001,420,560 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) Intel(R)
SRV - [2009.09.21 16:03:06 | 000,315,664 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)
SRV - [2009.09.21 16:00:44 | 000,831,760 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) Intel(R)
SRV - [2009.06.23 16:02:42 | 000,060,928 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\STMicroelectronics\Accelerometer\InstallFilterService.exe -- (InstallFilterService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.03.03 02:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_42d83e1760b1e973\AESTSr64.exe -- (AESTFilters)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2011.SP4c\WNt500x64\Sandra.sys -- (SANDRA)
DRV:64bit: - [2012.03.07 01:04:06 | 000,819,032 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2012.03.07 01:04:04 | 000,337,240 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2012.03.07 01:02:20 | 000,053,080 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2012.03.07 01:01:57 | 000,059,224 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2012.03.07 01:01:52 | 000,069,976 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2012.03.07 01:01:32 | 000,024,408 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.06.10 06:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.10.22 02:00:00 | 000,460,800 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fwlanusb.sys -- (FWLANUSB)
DRV:64bit: - [2010.10.22 02:00:00 | 000,014,120 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avmeject.sys -- (avmeject)
DRV:64bit: - [2010.09.01 10:30:58 | 000,017,976 | ---- | M] (Secunia) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\psi_mf.sys -- (PSI)
DRV:64bit: - [2009.12.14 13:28:54 | 000,505,856 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2009.09.17 12:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009.09.15 12:40:42 | 006,952,960 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64) Intel(R)
DRV:64bit: - [2009.08.18 03:48:48 | 006,037,504 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009.07.23 13:05:54 | 000,023,912 | ---- | M] (ST Microelectronics) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Acceler.sys -- (Acceler)
DRV:64bit: - [2009.07.23 12:57:48 | 000,018,792 | ---- | M] (ST Microelectronics) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stdflt.sys -- (stdflt)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.04 19:27:02 | 000,055,808 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rixdpe64.sys -- (rixdpcie)
DRV:64bit: - [2009.07.02 08:54:52 | 000,060,416 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimspe64.sys -- (rimspci)
DRV:64bit: - [2009.07.01 18:31:58 | 000,080,896 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\risdpe64.sys -- (risdpcie)
DRV:64bit: - [2009.06.15 14:06:42 | 000,172,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009.12.18 11:58:52 | 000,017,864 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys -- (cpudrv64)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1973132618-1650621722-1435852045-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1973132618-1650621722-1435852045-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1973132618-1650621722-1435852045-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "Google Deutschland"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:home"
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_257.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\xxx\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\xxx\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.17 10:16:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.06.22 18:08:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.02.05 20:49:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.17 10:16:30 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.06.22 18:08:58 | 000,000,000 | ---D | M]
 
[2011.11.01 14:26:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Extensions
[2012.06.27 17:25:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\p4q2uynp.default\extensions
[2012.05.31 17:39:17 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\p4q2uynp.default\extensions\ich@maltegoetz.de
[2012.06.22 16:00:58 | 000,002,400 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\p4q2uynp.default\searchplugins\google-deutschland.xml
[2012.06.22 18:09:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.06.22 18:09:00 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2011.12.20 18:09:33 | 000,275,540 | ---- | M] () (No name found) -- C:\USERS\VICKY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\EXTENSIONS\{64161300-E22B-11DB-8314-0800200C9A66}.XPI
[2012.06.13 21:08:56 | 000,525,301 | ---- | M] () (No name found) -- C:\USERS\VICKY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
[2011.12.22 17:09:42 | 000,145,352 | ---- | M] () (No name found) -- C:\USERS\VICKY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\EXTENSIONS\{C0C9A2C7-2E5C-4447-BC53-97718BC91E1B}.XPI
[2012.01.06 12:29:19 | 000,634,964 | ---- | M] () (No name found) -- C:\USERS\VICKY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.11.01 14:37:01 | 000,434,392 | ---- | M] () (No name found) -- C:\USERS\VICKY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI
[2012.05.18 18:30:34 | 000,697,058 | ---- | M] () (No name found) -- C:\USERS\VICKY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\EXTENSIONS\{DC572301-7619-498C-A57D-39143191B318}.XPI
[2012.05.23 21:13:29 | 000,053,803 | ---- | M] () (No name found) -- C:\USERS\VICKY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\EXTENSIONS\EXTENSION@HIDEMYASS.COM.XPI
[2012.06.17 10:16:30 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.05.10 16:22:35 | 000,001,525 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazon-en-GB.xml
[2012.05.10 16:22:35 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.05.10 16:22:35 | 000,000,935 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\chambers-en-GB.xml
[2012.05.10 16:22:35 | 000,001,166 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-en-GB.xml
[2012.05.10 16:22:35 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml
[2012.05.10 16:22:35 | 000,001,121 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-en-GB.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\xxx\AppData\Local\Google\Chrome\Application\16.0.912.63\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\xxx\AppData\Local\Google\Chrome\Application\16.0.912.63\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\xxx\AppData\Local\Google\Chrome\Application\16.0.912.63\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Google Update (Enabled) = C:\Users\xxx\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\
CHR - Extension: Google-Suche = C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_1\
CHR - Extension: Google Mail = C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_1\
 
O1 HOSTS File: ([2011.10.17 18:59:53 | 000,437,925 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1	www.007guard.com
O1 - Hosts: 127.0.0.1	007guard.com
O1 - Hosts: 127.0.0.1	008i.com
O1 - Hosts: 127.0.0.1	www.008k.com
O1 - Hosts: 127.0.0.1	008k.com
O1 - Hosts: 127.0.0.1	www.00hq.com
O1 - Hosts: 127.0.0.1	00hq.com
O1 - Hosts: 127.0.0.1	010402.com
O1 - Hosts: 127.0.0.1	www.032439.com
O1 - Hosts: 127.0.0.1	032439.com
O1 - Hosts: 127.0.0.1	www.0scan.com
O1 - Hosts: 127.0.0.1	0scan.com
O1 - Hosts: 127.0.0.1	1000gratisproben.com
O1 - Hosts: 127.0.0.1	www.1000gratisproben.com
O1 - Hosts: 127.0.0.1	1001namen.com
O1 - Hosts: 127.0.0.1	www.1001namen.com
O1 - Hosts: 127.0.0.1	100888290cs.com
O1 - Hosts: 127.0.0.1	www.100888290cs.com
O1 - Hosts: 127.0.0.1	www.100sexlinks.com
O1 - Hosts: 127.0.0.1	100sexlinks.com
O1 - Hosts: 127.0.0.1	10sek.com
O1 - Hosts: 127.0.0.1	www.10sek.com
O1 - Hosts: 127.0.0.1	www.1-2005-search.com
O1 - Hosts: 127.0.0.1	1-2005-search.com
O1 - Hosts: 127.0.0.1	123fporn.info
O1 - Hosts: 15060 more lines...
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4:64bit: - HKLM..\Run: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\Accelerometer\FF_Protection.exe ()
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [QuickSet] C:\Programme\Dell\QuickSet\quickset.exe (Dell Inc.)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [dellsupportcenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter File not found
O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1973132618-1650621722-1435852045-1000..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{09DFD51B-28BF-4DFD-ADB3-EB967ABA3EE1}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{42C0D989-8FF0-4477-B7C4-974F759D4040}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{0d6469c5-f733-11e0-9de2-b8ac6f614305}\Shell - "" = AutoRun
O33 - MountPoints2\{0d6469c5-f733-11e0-9de2-b8ac6f614305}\Shell\AutoRun\command - "" = G:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.28 17:18:07 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\xxx\Desktop\OTL.exe
[2012.06.27 21:05:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mp3tag
[2012.06.26 20:39:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.06.25 21:13:37 | 002,322,184 | ---- | C] (ESET) -- C:\Users\xxx\Desktop\esetsmartinstaller_enu.exe
[2012.06.23 15:28:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BurnAware Free
[2012.06.23 15:28:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BurnAware Free
[2012.06.23 14:23:55 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\sun
[2012.06.22 18:08:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2012.06.22 17:38:04 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4
[2012.06.20 17:04:22 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\Macromedia
[2012.06.14 18:04:20 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\PDF24
[2012.06.14 18:03:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
[2012.06.14 18:03:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDF24
[2012.06.14 17:58:22 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Nitro PDF
[2012.06.14 17:58:22 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\FileOpen
[2012.06.14 17:58:22 | 000,000,000 | ---D | C] -- C:\ProgramData\FileOpen
[2012.06.14 17:57:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Nitro PDF
[2012.06.14 17:56:21 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Downloaded Installations
[2012.06.13 19:10:47 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Amazon
[2012.06.13 19:08:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon
[2012.06.13 19:08:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Amazon
[2012.06.09 10:19:36 | 000,000,000 | ---D | C] -- C:\Program Files\GIMP 2
[2012.06.09 10:12:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.28 17:24:01 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1973132618-1650621722-1435852045-1000UA.job
[2012.06.28 17:24:00 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1973132618-1650621722-1435852045-1000Core.job
[2012.06.28 17:18:13 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\xxx\Desktop\OTL.exe
[2012.06.28 17:10:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.06.28 17:10:00 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.06.28 16:38:51 | 000,019,312 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.28 16:38:51 | 000,019,312 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.28 16:29:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.28 16:29:53 | 3111,534,592 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.26 17:24:47 | 002,322,184 | ---- | M] (ESET) -- C:\Users\xxx\Desktop\esetsmartinstaller_enu.exe
[2012.06.24 09:33:11 | 001,526,766 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.06.24 09:33:11 | 000,668,778 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.06.24 09:33:11 | 000,620,290 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.06.24 09:33:11 | 000,134,562 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.06.24 09:33:11 | 000,110,478 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.06.23 16:15:40 | 000,000,339 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\burnaware.ini
[2012.06.22 18:14:09 | 000,297,904 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.06.02 12:19:24 | 000,004,608 | ---- | M] () -- C:\Users\xxx\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== Files Created - No Company Name ==========
 
[2012.06.23 15:29:54 | 000,000,339 | ---- | C] () -- C:\Users\xxx\AppData\Roaming\burnaware.ini
[2012.06.09 15:53:49 | 000,001,110 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2012.06.09 10:20:48 | 000,000,892 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
[2012.06.02 12:18:23 | 000,004,608 | ---- | C] () -- C:\Users\xxx\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.04.12 21:44:01 | 000,000,881 | ---- | C] () -- C:\Users\xxx\.recently-used.xbel
[2012.03.09 18:28:31 | 000,239,021 | ---- | C] () -- C:\Windows\hpwins26.dat
[2012.03.03 11:02:43 | 000,111,932 | ---- | C] () -- C:\Windows\SysWow64\EPPICPrinterDB.dat
[2012.03.03 11:02:43 | 000,031,053 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern131.dat
[2012.03.03 11:02:43 | 000,027,417 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern121.dat
[2012.03.03 11:02:43 | 000,026,154 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern1.dat
[2012.03.03 11:02:43 | 000,024,903 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern3.dat
[2012.03.03 11:02:43 | 000,021,390 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern5.dat
[2012.03.03 11:02:43 | 000,020,148 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern2.dat
[2012.03.03 11:02:43 | 000,011,811 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern4.dat
[2012.03.03 11:02:43 | 000,004,943 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern6.dat
[2012.03.03 11:02:43 | 000,001,146 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_DU.dat
[2012.03.03 11:02:43 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_PT.dat
[2012.03.03 11:02:43 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_BP.dat
[2012.03.03 11:02:43 | 000,001,136 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_ES.dat
[2012.03.03 11:02:43 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_FR.dat
[2012.03.03 11:02:43 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_CF.dat
[2012.03.03 11:02:43 | 000,001,120 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_IT.dat
[2012.03.03 11:02:43 | 000,001,107 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_GE.dat
[2012.03.03 11:02:43 | 000,001,104 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_EN.dat
[2012.03.03 11:02:43 | 000,000,097 | ---- | C] () -- C:\Windows\SysWow64\PICSDK.ini
[2011.10.15 14:00:32 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
 
========== LOP Check ==========
 
[2012.06.13 19:10:47 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Amazon
[2012.06.14 17:56:21 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Downloaded Installations
[2012.06.14 17:58:22 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\FileOpen
[2012.06.24 12:52:18 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\foobar2000
[2011.10.27 21:11:00 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Foxit Software
[2012.04.12 21:44:01 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\gtk-2.0
[2011.10.18 19:34:01 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Miranda
[2012.06.27 21:30:25 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Mp3tag
[2012.06.14 17:58:22 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Nitro PDF
[2011.11.20 19:32:42 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\OpenOffice.org
[2011.10.15 18:46:02 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Thunderbird
[2011.10.29 21:03:35 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2011.10.15 15:35:17 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\WirelessManager
[2011.10.15 15:35:21 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\WMCore
[2012.05.18 18:28:23 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.10.29 21:01:50 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Adobe
[2012.06.13 19:10:47 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Amazon
[2011.11.04 21:23:06 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Creative
[2012.06.14 17:56:21 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Downloaded Installations
[2012.06.14 17:58:22 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\FileOpen
[2012.06.24 12:52:18 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\foobar2000
[2011.10.27 21:11:00 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Foxit Software
[2012.04.12 21:44:01 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\gtk-2.0
[2012.04.14 13:25:28 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\HP
[2012.05.20 20:18:27 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\HpUpdate
[2011.10.15 14:06:34 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Identities
[2012.03.03 11:02:41 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\InstallShield
[2011.10.16 11:11:55 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Intel
[2011.10.16 09:58:16 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Macromedia
[2011.10.16 18:52:07 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Malwarebytes
[2009.07.14 09:44:38 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Media Center Programs
[2012.06.23 10:09:40 | 000,000,000 | --SD | M] -- C:\Users\xxx\AppData\Roaming\Microsoft
[2011.10.18 19:34:01 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Miranda
[2011.11.01 14:26:56 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Mozilla
[2012.06.27 21:30:25 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Mp3tag
[2012.06.14 17:58:22 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Nitro PDF
[2011.11.20 19:32:42 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\OpenOffice.org
[2011.11.12 13:24:12 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Reallusion
[2012.06.27 21:06:51 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Skype
[2011.10.15 18:46:02 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Thunderbird
[2011.10.29 21:03:35 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2011.10.29 20:31:15 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\WinRAR
[2011.10.15 15:35:17 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\WirelessManager
[2011.10.15 15:35:21 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\WMCore
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<           >

< End of report >

cosinus · 29.06.2012, 11:23

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

ATTFilter

:OTL
O4 - HKU\S-1-5-21-1973132618-1650621722-1435852045-1000..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{0d6469c5-f733-11e0-9de2-b8ac6f614305}\Shell - "" = AutoRun
O33 - MountPoints2\{0d6469c5-f733-11e0-9de2-b8ac6f614305}\Shell\AutoRun\command - "" = G:\pushinst.exe
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

condi · 29.06.2012, 20:16

Hier der Log vom OTL-Fix:

Code:

ATTFilter

All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-1973132618-1650621722-1435852045-1000\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer deleted successfully.
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe moved successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0d6469c5-f733-11e0-9de2-b8ac6f614305}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0d6469c5-f733-11e0-9de2-b8ac6f614305}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0d6469c5-f733-11e0-9de2-b8ac6f614305}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0d6469c5-f733-11e0-9de2-b8ac6f614305}\ not found.
File G:\pushinst.exe not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
User: xxx
->Temp folder emptied: 333960104 bytes
->Temporary Internet Files folder emptied: 15268429 bytes
->Java cache emptied: 60204 bytes
->FireFox cache emptied: 1359088435 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 2680 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 177818 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67832 bytes
RecycleBin emptied: 1457023035 bytes
 
Total Files Cleaned = 3.019,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Public
 
User: xxx
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.53.0 log created on 06292012_192123

Files\Folders moved on Reboot...
C:\Users\xxx\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...
File C:\Users\xxx\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot...

cosinus · 01.07.2012, 14:30

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C

nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

condi · 01.07.2012, 17:46

Hallo,

hier der Log:

Code:

ATTFilter

18:41:52.0829 1212	TDSS rootkit removing tool 2.7.43.0 Jun 29 2012 17:54:22
18:41:52.0954 1212	============================================================
18:41:52.0954 1212	Current date / time: 2012/07/01 18:41:52.0954
18:41:52.0954 1212	SystemInfo:
18:41:52.0954 1212	
18:41:52.0954 1212	OS Version: 6.1.7601 ServicePack: 1.0
18:41:52.0954 1212	Product type: Workstation
18:41:52.0954 1212	ComputerName: VICKY-LAPTOP
18:41:52.0954 1212	UserName: Vicky
18:41:52.0954 1212	Windows directory: C:\Windows
18:41:52.0954 1212	System windows directory: C:\Windows
18:41:52.0954 1212	Running under WOW64
18:41:52.0954 1212	Processor architecture: Intel x64
18:41:52.0954 1212	Number of processors: 4
18:41:52.0954 1212	Page size: 0x1000
18:41:52.0954 1212	Boot type: Normal boot
18:41:52.0954 1212	============================================================
18:41:54.0327 1212	Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
18:41:54.0358 1212	============================================================
18:41:54.0358 1212	\Device\Harddisk0\DR0:
18:41:54.0358 1212	MBR partitions:
18:41:54.0358 1212	\Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x139C5, BlocksNum 0x1D4C000
18:41:54.0358 1212	\Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1D5F9C5, BlocksNum 0xC3500EB
18:41:54.0374 1212	\Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0xE0B0800, BlocksNum 0x1737D800
18:41:54.0374 1212	============================================================
18:41:54.0405 1212	C: <-> \Device\Harddisk0\DR0\Partition1
18:41:54.0452 1212	D: <-> \Device\Harddisk0\DR0\Partition2
18:41:54.0452 1212	============================================================
18:41:54.0452 1212	Initialize success
18:41:54.0452 1212	============================================================
18:42:06.0401 1144	============================================================
18:42:06.0401 1144	Scan started
18:42:06.0401 1144	Mode: Manual; SigCheck; TDLFS; 
18:42:06.0401 1144	============================================================
18:42:07.0665 1144	1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
18:42:07.0774 1144	1394ohci - ok
18:42:07.0805 1144	Acceler         (c49c56b35bfc6cda8d1fdcad2885568f) C:\Windows\system32\DRIVERS\Acceler.sys
18:42:07.0821 1144	Acceler - ok
18:42:07.0883 1144	ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
18:42:07.0914 1144	ACPI - ok
18:42:07.0961 1144	AcpiPmi         (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
18:42:08.0024 1144	AcpiPmi - ok
18:42:08.0117 1144	adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
18:42:08.0148 1144	adp94xx - ok
18:42:08.0195 1144	adpahci         (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
18:42:08.0226 1144	adpahci - ok
18:42:08.0289 1144	adpu320         (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
18:42:08.0304 1144	adpu320 - ok
18:42:08.0336 1144	AeLookupSvc     (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
18:42:08.0398 1144	AeLookupSvc - ok
18:42:08.0492 1144	AESTFilters     (a6fb9db8f1a86861d955fd6975977ae0) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_42d83e1760b1e973\AESTSr64.exe
18:42:08.0538 1144	AESTFilters - ok
18:42:08.0616 1144	AFD             (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
18:42:08.0694 1144	AFD - ok
18:42:08.0757 1144	agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
18:42:08.0788 1144	agp440 - ok
18:42:08.0819 1144	ALG             (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
18:42:08.0866 1144	ALG - ok
18:42:08.0897 1144	aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
18:42:08.0913 1144	aliide - ok
18:42:08.0975 1144	AMD External Events Utility (d696f317bd465a602566f8e1dcce15f7) C:\Windows\system32\atiesrxx.exe
18:42:09.0038 1144	AMD External Events Utility - ok
18:42:09.0053 1144	amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
18:42:09.0069 1144	amdide - ok
18:42:09.0116 1144	AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
18:42:09.0178 1144	AmdK8 - ok
18:42:09.0194 1144	AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
18:42:09.0241 1144	AmdPPM - ok
18:42:09.0287 1144	amdsata         (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
18:42:09.0319 1144	amdsata - ok
18:42:09.0350 1144	amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
18:42:09.0365 1144	amdsbs - ok
18:42:09.0397 1144	amdxata         (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
18:42:09.0412 1144	amdxata - ok
18:42:09.0459 1144	AppID           (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
18:42:09.0568 1144	AppID - ok
18:42:09.0599 1144	AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
18:42:09.0693 1144	AppIDSvc - ok
18:42:09.0740 1144	Appinfo         (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
18:42:09.0802 1144	Appinfo - ok
18:42:09.0849 1144	arc             (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
18:42:09.0865 1144	arc - ok
18:42:09.0896 1144	arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
18:42:09.0911 1144	arcsas - ok
18:42:09.0958 1144	aswFsBlk        (b9da213b5271db5fce962d827e6d620d) C:\Windows\system32\drivers\aswFsBlk.sys
18:42:10.0005 1144	aswFsBlk - ok
18:42:10.0021 1144	aswMonFlt       (21c9835d0e5ad2ff0f16134bcb32cc71) C:\Windows\system32\drivers\aswMonFlt.sys
18:42:10.0036 1144	aswMonFlt - ok
18:42:10.0083 1144	aswRdr          (1b96a5867abd4fa6135d8298fcccf9c6) C:\Windows\System32\Drivers\aswrdr2.sys
18:42:10.0099 1144	aswRdr - ok
18:42:10.0177 1144	aswSnx          (6e98bb288696777a3a8a07a52b0eaee9) C:\Windows\system32\drivers\aswSnx.sys
18:42:10.0208 1144	aswSnx - ok
18:42:10.0255 1144	aswSP           (d9fb49f16e4eb02efecae8cbfe4bcb4c) C:\Windows\system32\drivers\aswSP.sys
18:42:10.0270 1144	aswSP - ok
18:42:10.0301 1144	aswTdi          (7352bb9a564b94bbd7c9cbf165f55006) C:\Windows\system32\drivers\aswTdi.sys
18:42:10.0317 1144	aswTdi - ok
18:42:10.0348 1144	AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
18:42:10.0411 1144	AsyncMac - ok
18:42:10.0442 1144	atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
18:42:10.0457 1144	atapi - ok
18:42:10.0910 1144	atikmdag        (52bd95caa9cae8977fe043e9ad6d2d0e) C:\Windows\system32\DRIVERS\atikmdag.sys
18:42:11.0128 1144	atikmdag - ok
18:42:11.0315 1144	AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
18:42:11.0440 1144	AudioEndpointBuilder - ok
18:42:11.0456 1144	AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
18:42:11.0503 1144	AudioSrv - ok
18:42:11.0581 1144	avast! Antivirus (4041d31508a2a084dfb42c595854090f) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
18:42:11.0612 1144	avast! Antivirus - ok
18:42:11.0705 1144	AVM WLAN Connection Service (c6f4c466b654c1be98af31418bb5ac30) C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
18:42:11.0752 1144	AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - warning
18:42:11.0752 1144	AVM WLAN Connection Service - detected UnsignedFile.Multi.Generic (1)
18:42:11.0799 1144	avmeject        (1dc2f715792cf33428ad7993acbd224d) C:\Windows\system32\drivers\avmeject.sys
18:42:11.0830 1144	avmeject - ok
18:42:11.0877 1144	AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
18:42:11.0924 1144	AxInstSV - ok
18:42:12.0002 1144	b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
18:42:12.0064 1144	b06bdrv - ok
18:42:12.0111 1144	b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
18:42:12.0173 1144	b57nd60a - ok
18:42:12.0251 1144	BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
18:42:12.0283 1144	BDESVC - ok
18:42:12.0298 1144	Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
18:42:12.0361 1144	Beep - ok
18:42:12.0454 1144	BFE             (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
18:42:12.0532 1144	BFE - ok
18:42:12.0610 1144	BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
18:42:12.0704 1144	BITS - ok
18:42:12.0782 1144	blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
18:42:12.0829 1144	blbdrive - ok
18:42:12.0875 1144	bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
18:42:12.0922 1144	bowser - ok
18:42:12.0953 1144	BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
18:42:13.0000 1144	BrFiltLo - ok
18:42:13.0000 1144	BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
18:42:13.0031 1144	BrFiltUp - ok
18:42:13.0094 1144	Browser         (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
18:42:13.0187 1144	Browser - ok
18:42:13.0219 1144	Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
18:42:13.0265 1144	Brserid - ok
18:42:13.0265 1144	BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
18:42:13.0312 1144	BrSerWdm - ok
18:42:13.0328 1144	BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
18:42:13.0359 1144	BrUsbMdm - ok
18:42:13.0359 1144	BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
18:42:13.0390 1144	BrUsbSer - ok
18:42:13.0421 1144	BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
18:42:13.0468 1144	BTHMODEM - ok
18:42:13.0515 1144	bthserv         (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
18:42:13.0593 1144	bthserv - ok
18:42:13.0687 1144	cbVSCService    (ed5411a69c5bac78d245c893af64352a) C:\Program Files (x86)\Cobian Backup 10\cbVSCService.exe
18:42:13.0718 1144	cbVSCService ( UnsignedFile.Multi.Generic ) - warning
18:42:13.0718 1144	cbVSCService - detected UnsignedFile.Multi.Generic (1)
18:42:13.0749 1144	cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
18:42:13.0811 1144	cdfs - ok
18:42:13.0874 1144	cdrom           (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
18:42:13.0905 1144	cdrom - ok
18:42:13.0967 1144	CertPropSvc     (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
18:42:14.0077 1144	CertPropSvc - ok
18:42:14.0123 1144	circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
18:42:14.0170 1144	circlass - ok
18:42:14.0233 1144	CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
18:42:14.0264 1144	CLFS - ok
18:42:14.0357 1144	clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
18:42:14.0373 1144	clr_optimization_v2.0.50727_32 - ok
18:42:14.0435 1144	clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
18:42:14.0467 1144	clr_optimization_v2.0.50727_64 - ok
18:42:14.0545 1144	clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
18:42:14.0560 1144	clr_optimization_v4.0.30319_32 - ok
18:42:14.0623 1144	clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
18:42:14.0654 1144	clr_optimization_v4.0.30319_64 - ok
18:42:14.0685 1144	CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
18:42:14.0732 1144	CmBatt - ok
18:42:14.0763 1144	cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
18:42:14.0779 1144	cmdide - ok
18:42:14.0857 1144	CNG             (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
18:42:14.0888 1144	CNG - ok
18:42:15.0059 1144	CobianBackup10  (06302ea7eda9dcdd7f82cec2a03d2015) C:\Program Files (x86)\Cobian Backup 10\cbService.exe
18:42:15.0106 1144	CobianBackup10 ( UnsignedFile.Multi.Generic ) - warning
18:42:15.0106 1144	CobianBackup10 - detected UnsignedFile.Multi.Generic (1)
18:42:15.0262 1144	Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
18:42:15.0293 1144	Compbatt - ok
18:42:15.0356 1144	CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
18:42:15.0403 1144	CompositeBus - ok
18:42:15.0418 1144	COMSysApp - ok
18:42:15.0465 1144	cpudrv64        (3ca734ce373e5675fbc15ca2c45228e5) C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys
18:42:15.0481 1144	cpudrv64 - ok
18:42:15.0496 1144	crcdisk         (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
18:42:15.0512 1144	crcdisk - ok
18:42:15.0559 1144	CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
18:42:15.0621 1144	CryptSvc - ok
18:42:15.0668 1144	CtClsFlt        (ed5cf92396a62f4c15110dcdb5e854d9) C:\Windows\system32\DRIVERS\CtClsFlt.sys
18:42:15.0715 1144	CtClsFlt - ok
18:42:15.0808 1144	DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
18:42:15.0886 1144	DcomLaunch - ok
18:42:15.0949 1144	defragsvc       (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
18:42:16.0027 1144	defragsvc - ok
18:42:16.0073 1144	DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
18:42:16.0136 1144	DfsC - ok
18:42:16.0198 1144	Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
18:42:16.0292 1144	Dhcp - ok
18:42:16.0339 1144	discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
18:42:16.0417 1144	discache - ok
18:42:16.0463 1144	Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
18:42:16.0479 1144	Disk - ok
18:42:16.0510 1144	Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
18:42:16.0557 1144	Dnscache - ok
18:42:16.0619 1144	dot3svc         (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
18:42:16.0697 1144	dot3svc - ok
18:42:16.0744 1144	Dot4            (b42ed0320c6e41102fde0005154849bb) C:\Windows\system32\DRIVERS\Dot4.sys
18:42:16.0791 1144	Dot4 - ok
18:42:16.0838 1144	Dot4Print       (e9f5969233c5d89f3c35e3a66a52a361) C:\Windows\system32\DRIVERS\Dot4Prt.sys
18:42:16.0869 1144	Dot4Print - ok
18:42:16.0885 1144	dot4usb         (fd05a02b0370bc3000f402e543ca5814) C:\Windows\system32\DRIVERS\dot4usb.sys
18:42:16.0931 1144	dot4usb - ok
18:42:16.0963 1144	DPS             (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
18:42:17.0041 1144	DPS - ok
18:42:17.0087 1144	drmkaud         (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
18:42:17.0119 1144	drmkaud - ok
18:42:17.0212 1144	DXGKrnl         (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
18:42:17.0259 1144	DXGKrnl - ok
18:42:17.0306 1144	EapHost         (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
18:42:17.0368 1144	EapHost - ok
18:42:17.0618 1144	ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
18:42:17.0711 1144	ebdrv - ok
18:42:17.0836 1144	EFS             (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
18:42:17.0899 1144	EFS - ok
18:42:18.0039 1144	ehRecvr         (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
18:42:18.0117 1144	ehRecvr - ok
18:42:18.0164 1144	ehSched         (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
18:42:18.0195 1144	ehSched - ok
18:42:18.0320 1144	elxstor         (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
18:42:18.0351 1144	elxstor - ok
18:42:18.0398 1144	ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
18:42:18.0445 1144	ErrDev - ok
18:42:18.0523 1144	EventSystem     (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
18:42:18.0601 1144	EventSystem - ok
18:42:18.0819 1144	EvtEng          (51643ee2712d9212e1e53ca7e8d8eb4a) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
18:42:18.0866 1144	EvtEng - ok
18:42:19.0053 1144	exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
18:42:19.0115 1144	exfat - ok
18:42:19.0162 1144	fastfat         (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
18:42:19.0225 1144	fastfat - ok
18:42:19.0318 1144	Fax             (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
18:42:19.0381 1144	Fax - ok
18:42:19.0396 1144	fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
18:42:19.0427 1144	fdc - ok
18:42:19.0474 1144	fdPHost         (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
18:42:19.0537 1144	fdPHost - ok
18:42:19.0552 1144	FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
18:42:19.0615 1144	FDResPub - ok
18:42:19.0661 1144	FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
18:42:19.0693 1144	FileInfo - ok
18:42:19.0708 1144	Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
18:42:19.0755 1144	Filetrace - ok
18:42:19.0771 1144	flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
18:42:19.0786 1144	flpydisk - ok
18:42:19.0833 1144	FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
18:42:19.0849 1144	FltMgr - ok
18:42:19.0958 1144	FontCache       (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
18:42:20.0020 1144	FontCache - ok
18:42:20.0145 1144	FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
18:42:20.0176 1144	FontCache3.0.0.0 - ok
18:42:20.0239 1144	FsDepends       (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
18:42:20.0270 1144	FsDepends - ok
18:42:20.0301 1144	Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
18:42:20.0317 1144	Fs_Rec - ok
18:42:20.0348 1144	fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
18:42:20.0379 1144	fvevol - ok
18:42:20.0426 1144	FWLANUSB        (444534cba693dd23c1cc589681e01656) C:\Windows\system32\DRIVERS\fwlanusb.sys
18:42:20.0488 1144	FWLANUSB - ok
18:42:20.0535 1144	gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
18:42:20.0551 1144	gagp30kx - ok
18:42:20.0644 1144	gpsvc           (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
18:42:20.0738 1144	gpsvc - ok
18:42:20.0894 1144	gupdate         (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
18:42:20.0909 1144	gupdate - ok
18:42:20.0956 1144	gupdatem        (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
18:42:20.0972 1144	gupdatem - ok
18:42:21.0003 1144	hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
18:42:21.0034 1144	hcw85cir - ok
18:42:21.0112 1144	HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
18:42:21.0175 1144	HdAudAddService - ok
18:42:21.0237 1144	HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
18:42:21.0284 1144	HDAudBus - ok
18:42:21.0315 1144	HECIx64         (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\DRIVERS\HECIx64.sys
18:42:21.0331 1144	HECIx64 - ok
18:42:21.0346 1144	HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
18:42:21.0393 1144	HidBatt - ok
18:42:21.0393 1144	HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
18:42:21.0440 1144	HidBth - ok
18:42:21.0440 1144	HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
18:42:21.0487 1144	HidIr - ok
18:42:21.0518 1144	hidserv         (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
18:42:21.0580 1144	hidserv - ok
18:42:21.0627 1144	HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
18:42:21.0689 1144	HidUsb - ok
18:42:21.0752 1144	hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
18:42:21.0814 1144	hkmsvc - ok
18:42:21.0845 1144	HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
18:42:21.0892 1144	HomeGroupListener - ok
18:42:21.0955 1144	HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
18:42:22.0001 1144	HomeGroupProvider - ok
18:42:22.0142 1144	hpqcxs08        (0a3c6aa4a9fc38c20ba4eac2c3351c05) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll
18:42:22.0157 1144	hpqcxs08 ( UnsignedFile.Multi.Generic ) - warning
18:42:22.0157 1144	hpqcxs08 - detected UnsignedFile.Multi.Generic (1)
18:42:22.0189 1144	hpqddsvc        (f3f72a2a86c22610bca5439fa789dd52) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll
18:42:22.0220 1144	hpqddsvc ( UnsignedFile.Multi.Generic ) - warning
18:42:22.0220 1144	hpqddsvc - detected UnsignedFile.Multi.Generic (1)
18:42:22.0282 1144	HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
18:42:22.0298 1144	HpSAMD - ok
18:42:22.0423 1144	HPSLPSVC        (f37882f128efacefe353e0bae2766909) C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL
18:42:22.0469 1144	HPSLPSVC ( UnsignedFile.Multi.Generic ) - warning
18:42:22.0469 1144	HPSLPSVC - detected UnsignedFile.Multi.Generic (1)
18:42:22.0547 1144	HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
18:42:22.0641 1144	HTTP - ok
18:42:22.0657 1144	hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
18:42:22.0672 1144	hwpolicy - ok
18:42:22.0719 1144	i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
18:42:22.0750 1144	i8042prt - ok
18:42:22.0813 1144	iaStorV         (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
18:42:22.0844 1144	iaStorV - ok
18:42:23.0031 1144	idsvc           (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
18:42:23.0062 1144	idsvc - ok
18:42:23.0125 1144	iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
18:42:23.0140 1144	iirsp - ok
18:42:23.0234 1144	IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
18:42:23.0296 1144	IKEEXT - ok
18:42:23.0390 1144	InstallFilterService (fd5ef1d0210cb9c0773bba7ca360d762) C:\Program Files (x86)\STMicroelectronics\Accelerometer\InstallFilterService.exe
18:42:23.0405 1144	InstallFilterService ( UnsignedFile.Multi.Generic ) - warning
18:42:23.0405 1144	InstallFilterService - detected UnsignedFile.Multi.Generic (1)
18:42:23.0437 1144	intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
18:42:23.0452 1144	intelide - ok
18:42:23.0499 1144	intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
18:42:23.0546 1144	intelppm - ok
18:42:23.0608 1144	IPBusEnum       (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
18:42:23.0686 1144	IPBusEnum - ok
18:42:23.0702 1144	IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
18:42:23.0780 1144	IpFilterDriver - ok
18:42:23.0842 1144	iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
18:42:23.0920 1144	iphlpsvc - ok
18:42:23.0951 1144	IPMIDRV         (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
18:42:23.0998 1144	IPMIDRV - ok
18:42:24.0045 1144	IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
18:42:24.0123 1144	IPNAT - ok
18:42:24.0154 1144	IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
18:42:24.0185 1144	IRENUM - ok
18:42:24.0217 1144	isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
18:42:24.0248 1144	isapnp - ok
18:42:24.0279 1144	iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
18:42:24.0310 1144	iScsiPrt - ok
18:42:24.0341 1144	kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
18:42:24.0357 1144	kbdclass - ok
18:42:24.0388 1144	kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
18:42:24.0419 1144	kbdhid - ok
18:42:24.0466 1144	KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
18:42:24.0497 1144	KeyIso - ok
18:42:24.0513 1144	KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
18:42:24.0529 1144	KSecDD - ok
18:42:24.0560 1144	KSecPkg         (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
18:42:24.0591 1144	KSecPkg - ok
18:42:24.0622 1144	ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
18:42:24.0669 1144	ksthunk - ok
18:42:24.0716 1144	KtmRm           (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
18:42:24.0794 1144	KtmRm - ok
18:42:24.0825 1144	LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
18:42:24.0887 1144	LanmanServer - ok
18:42:24.0934 1144	LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
18:42:24.0997 1144	LanmanWorkstation - ok
18:42:25.0043 1144	lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
18:42:25.0106 1144	lltdio - ok
18:42:25.0153 1144	lltdsvc         (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
18:42:25.0231 1144	lltdsvc - ok
18:42:25.0246 1144	lmhosts         (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
18:42:25.0309 1144	lmhosts - ok
18:42:25.0449 1144	LMS             (7485fbcef9136f530953575e2977859d) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
18:42:25.0480 1144	LMS - ok
18:42:25.0527 1144	LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
18:42:25.0543 1144	LSI_FC - ok
18:42:25.0558 1144	LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
18:42:25.0574 1144	LSI_SAS - ok
18:42:25.0589 1144	LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
18:42:25.0605 1144	LSI_SAS2 - ok
18:42:25.0636 1144	LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
18:42:25.0652 1144	LSI_SCSI - ok
18:42:25.0683 1144	luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
18:42:25.0745 1144	luafv - ok
18:42:25.0777 1144	Mcx2Svc         (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
18:42:25.0808 1144	Mcx2Svc - ok
18:42:25.0823 1144	megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
18:42:25.0839 1144	megasas - ok
18:42:25.0870 1144	MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
18:42:25.0901 1144	MegaSR - ok
18:42:25.0917 1144	MMCSS           (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
18:42:25.0995 1144	MMCSS - ok
18:42:26.0011 1144	Modem           (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
18:42:26.0057 1144	Modem - ok
18:42:26.0089 1144	monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
18:42:26.0135 1144	monitor - ok
18:42:26.0182 1144	mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
18:42:26.0198 1144	mouclass - ok
18:42:26.0229 1144	mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
18:42:26.0260 1144	mouhid - ok
18:42:26.0291 1144	mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
18:42:26.0307 1144	mountmgr - ok
18:42:26.0416 1144	MozillaMaintenance (15d5398eed42c2504bb3d4fc875c15d1) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
18:42:26.0447 1144	MozillaMaintenance - ok
18:42:26.0494 1144	mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
18:42:26.0510 1144	mpio - ok
18:42:26.0541 1144	mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
18:42:26.0588 1144	mpsdrv - ok
18:42:26.0681 1144	MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
18:42:26.0759 1144	MpsSvc - ok
18:42:26.0806 1144	MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
18:42:26.0884 1144	MRxDAV - ok
18:42:26.0931 1144	mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
18:42:26.0962 1144	mrxsmb - ok
18:42:26.0993 1144	mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
18:42:27.0040 1144	mrxsmb10 - ok
18:42:27.0071 1144	mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
18:42:27.0103 1144	mrxsmb20 - ok
18:42:27.0118 1144	msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
18:42:27.0134 1144	msahci - ok
18:42:27.0181 1144	msdsm           (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
18:42:27.0212 1144	msdsm - ok
18:42:27.0243 1144	MSDTC           (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
18:42:27.0274 1144	MSDTC - ok
18:42:27.0321 1144	Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
18:42:27.0368 1144	Msfs - ok
18:42:27.0368 1144	mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
18:42:27.0430 1144	mshidkmdf - ok
18:42:27.0446 1144	msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
18:42:27.0461 1144	msisadrv - ok
18:42:27.0524 1144	MSiSCSI         (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
18:42:27.0586 1144	MSiSCSI - ok
18:42:27.0586 1144	msiserver - ok
18:42:27.0617 1144	MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
18:42:27.0695 1144	MSKSSRV - ok
18:42:27.0727 1144	MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
18:42:27.0773 1144	MSPCLOCK - ok
18:42:27.0773 1144	MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
18:42:27.0836 1144	MSPQM - ok
18:42:27.0883 1144	MsRPC           (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
18:42:27.0914 1144	MsRPC - ok
18:42:27.0945 1144	mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
18:42:27.0961 1144	mssmbios - ok
18:42:27.0992 1144	MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
18:42:28.0070 1144	MSTEE - ok
18:42:28.0070 1144	MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
18:42:28.0101 1144	MTConfig - ok
18:42:28.0117 1144	Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
18:42:28.0132 1144	Mup - ok
18:42:28.0257 1144	MyWiFiDHCPDNS   (d285d0539016be299a55ff997b44da33) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
18:42:28.0273 1144	MyWiFiDHCPDNS - ok
18:42:28.0335 1144	napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
18:42:28.0413 1144	napagent - ok
18:42:28.0491 1144	NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
18:42:28.0538 1144	NativeWifiP - ok
18:42:28.0663 1144	NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
18:42:28.0709 1144	NDIS - ok
18:42:28.0756 1144	NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
18:42:28.0834 1144	NdisCap - ok
18:42:28.0850 1144	NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
18:42:28.0897 1144	NdisTapi - ok
18:42:28.0959 1144	Ndisuio         (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
18:42:29.0021 1144	Ndisuio - ok
18:42:29.0053 1144	NdisWan         (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
18:42:29.0131 1144	NdisWan - ok
18:42:29.0162 1144	NDProxy         (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
18:42:29.0224 1144	NDProxy - ok
18:42:29.0271 1144	Net Driver HPZ12 (2334dc48997ba203b794df3ee70521db) C:\Windows\system32\HPZinw12.dll
18:42:29.0302 1144	Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
18:42:29.0302 1144	Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
18:42:29.0349 1144	NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
18:42:29.0411 1144	NetBIOS - ok
18:42:29.0474 1144	NetBT           (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
18:42:29.0567 1144	NetBT - ok
18:42:29.0599 1144	Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
18:42:29.0614 1144	Netlogon - ok
18:42:29.0692 1144	Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
18:42:29.0786 1144	Netman - ok
18:42:29.0817 1144	netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
18:42:29.0895 1144	netprofm - ok
18:42:30.0020 1144	NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
18:42:30.0051 1144	NetTcpPortSharing - ok
18:42:30.0581 1144	NETw5s64        (4d85a450edef10c38882182753a49aae) C:\Windows\system32\DRIVERS\NETw5s64.sys
18:42:30.0815 1144	NETw5s64 - ok
18:42:30.0987 1144	nfrd960         (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
18:42:31.0018 1144	nfrd960 - ok
18:42:31.0081 1144	NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
18:42:31.0159 1144	NlaSvc - ok
18:42:31.0174 1144	Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
18:42:31.0221 1144	Npfs - ok
18:42:31.0237 1144	nsi             (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
18:42:31.0299 1144	nsi - ok
18:42:31.0315 1144	nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
18:42:31.0377 1144	nsiproxy - ok
18:42:31.0533 1144	Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
18:42:31.0595 1144	Ntfs - ok
18:42:31.0736 1144	Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
18:42:31.0829 1144	Null - ok
18:42:31.0892 1144	nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
18:42:31.0907 1144	nvraid - ok
18:42:31.0923 1144	nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
18:42:31.0939 1144	nvstor - ok
18:42:31.0985 1144	nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
18:42:32.0001 1144	nv_agp - ok
18:42:32.0048 1144	ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
18:42:32.0079 1144	ohci1394 - ok
18:42:32.0126 1144	p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
18:42:32.0188 1144	p2pimsvc - ok
18:42:32.0235 1144	p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
18:42:32.0266 1144	p2psvc - ok
18:42:32.0297 1144	Parport         (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
18:42:32.0313 1144	Parport - ok
18:42:32.0344 1144	partmgr         (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
18:42:32.0360 1144	partmgr - ok
18:42:32.0407 1144	PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
18:42:32.0453 1144	PcaSvc - ok
18:42:32.0500 1144	pci             (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
18:42:32.0516 1144	pci - ok
18:42:32.0531 1144	pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
18:42:32.0547 1144	pciide - ok
18:42:32.0594 1144	pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
18:42:32.0609 1144	pcmcia - ok
18:42:32.0625 1144	pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
18:42:32.0641 1144	pcw - ok
18:42:32.0703 1144	PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
18:42:32.0797 1144	PEAUTH - ok
18:42:32.0906 1144	PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
18:42:32.0953 1144	PerfHost - ok
18:42:33.0171 1144	pla             (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
18:42:33.0265 1144	pla - ok
18:42:33.0327 1144	PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
18:42:33.0389 1144	PlugPlay - ok
18:42:33.0452 1144	Pml Driver HPZ12 (ac78df349f0e4cfb8b667c0cfff83cce) C:\Windows\system32\HPZipm12.dll
18:42:33.0483 1144	Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
18:42:33.0483 1144	Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
18:42:33.0514 1144	PNRPAutoReg     (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
18:42:33.0561 1144	PNRPAutoReg - ok
18:42:33.0608 1144	PNRPsvc         (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
18:42:33.0639 1144	PNRPsvc - ok
18:42:33.0701 1144	PolicyAgent     (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
18:42:33.0779 1144	PolicyAgent - ok
18:42:33.0811 1144	Power           (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
18:42:33.0889 1144	Power - ok
18:42:33.0951 1144	PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
18:42:34.0045 1144	PptpMiniport - ok
18:42:34.0076 1144	Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
18:42:34.0107 1144	Processor - ok
18:42:34.0138 1144	ProfSvc         (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
18:42:34.0201 1144	ProfSvc - ok
18:42:34.0232 1144	ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
18:42:34.0247 1144	ProtectedStorage - ok
18:42:34.0279 1144	Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
18:42:34.0341 1144	Psched - ok
18:42:34.0388 1144	PSI             (fb46e9a827a8799ebd7bfa9128c91f37) C:\Windows\system32\DRIVERS\psi_mf.sys
18:42:34.0419 1144	PSI - ok
18:42:34.0559 1144	ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
18:42:34.0622 1144	ql2300 - ok
18:42:34.0793 1144	ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
18:42:34.0825 1144	ql40xx - ok
18:42:34.0871 1144	QWAVE           (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
18:42:34.0918 1144	QWAVE - ok
18:42:34.0949 1144	QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
18:42:34.0965 1144	QWAVEdrv - ok
18:42:34.0996 1144	RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
18:42:35.0090 1144	RasAcd - ok
18:42:35.0121 1144	RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
18:42:35.0183 1144	RasAgileVpn - ok
18:42:35.0215 1144	RasAuto         (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
18:42:35.0277 1144	RasAuto - ok
18:42:35.0308 1144	Rasl2tp         (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
18:42:35.0386 1144	Rasl2tp - ok
18:42:35.0449 1144	RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
18:42:35.0511 1144	RasMan - ok
18:42:35.0527 1144	RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
18:42:35.0605 1144	RasPppoe - ok
18:42:35.0636 1144	RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
18:42:35.0698 1144	RasSstp - ok
18:42:35.0745 1144	rdbss           (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
18:42:35.0823 1144	rdbss - ok
18:42:35.0839 1144	rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
18:42:35.0870 1144	rdpbus - ok
18:42:35.0870 1144	RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
18:42:35.0932 1144	RDPCDD - ok
18:42:35.0979 1144	RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
18:42:36.0057 1144	RDPENCDD - ok
18:42:36.0057 1144	RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
18:42:36.0104 1144	RDPREFMP - ok
18:42:36.0151 1144	RDPWD           (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys
18:42:36.0182 1144	RDPWD - ok
18:42:36.0229 1144	rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
18:42:36.0260 1144	rdyboost - ok
18:42:36.0416 1144	RegSrvc         (3b71b5b91e7dca93585d5a86c897adc4) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
18:42:36.0447 1144	RegSrvc - ok
18:42:36.0478 1144	RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
18:42:36.0541 1144	RemoteAccess - ok
18:42:36.0587 1144	RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
18:42:36.0650 1144	RemoteRegistry - ok
18:42:36.0712 1144	rimspci         (e20b1907fc72a3664ece21e3c20fc63d) C:\Windows\system32\DRIVERS\rimspe64.sys
18:42:36.0759 1144	rimspci - ok
18:42:36.0790 1144	risdpcie        (a6da2b0c8f5bb3f9f5423cff8d6a02d9) C:\Windows\system32\DRIVERS\risdpe64.sys
18:42:36.0821 1144	risdpcie - ok
18:42:36.0837 1144	rixdpcie        (6a1cd4674505e6791390a1ab71da1fbe) C:\Windows\system32\DRIVERS\rixdpe64.sys
18:42:36.0868 1144	rixdpcie - ok
18:42:36.0899 1144	RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
18:42:36.0962 1144	RpcEptMapper - ok
18:42:36.0977 1144	RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
18:42:37.0024 1144	RpcLocator - ok
18:42:37.0087 1144	RpcSs           (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
18:42:37.0149 1144	RpcSs - ok
18:42:37.0180 1144	rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
18:42:37.0243 1144	rspndr - ok
18:42:37.0321 1144	RTL8167         (ee082e06a82ff630351d1e0ebbd3d8d0) C:\Windows\system32\DRIVERS\Rt64win7.sys
18:42:37.0367 1144	RTL8167 - ok
18:42:37.0383 1144	SamSs           (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
18:42:37.0399 1144	SamSs - ok
18:42:37.0445 1144	SANDRA - ok
18:42:37.0477 1144	sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
18:42:37.0492 1144	sbp2port - ok
18:42:37.0555 1144	SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
18:42:37.0633 1144	SCardSvr - ok
18:42:37.0664 1144	scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
18:42:37.0742 1144	scfilter - ok
18:42:37.0867 1144	Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
18:42:37.0945 1144	Schedule - ok
18:42:37.0991 1144	SCPolicySvc     (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
18:42:38.0038 1144	SCPolicySvc - ok
18:42:38.0069 1144	sdbus           (111e0ebc0ad79cb0fa014b907b231cf0) C:\Windows\system32\drivers\sdbus.sys
18:42:38.0132 1144	sdbus - ok
18:42:38.0179 1144	SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
18:42:38.0225 1144	SDRSVC - ok
18:42:38.0257 1144	secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
18:42:38.0303 1144	secdrv - ok
18:42:38.0350 1144	seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
18:42:38.0413 1144	seclogon - ok
18:42:38.0569 1144	Secunia PSI Agent (2d0599dd0124764fc939c59985c860de) C:\Program Files (x86)\Secunia\PSI\PSIA.exe
18:42:38.0615 1144	Secunia PSI Agent - ok
18:42:38.0662 1144	Secunia Update Agent (20b9e1adbc58958b480933e4da005dfb) C:\Program Files (x86)\Secunia\PSI\sua.exe
18:42:38.0693 1144	Secunia Update Agent - ok
18:42:38.0849 1144	SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
18:42:38.0943 1144	SENS - ok
18:42:38.0943 1144	SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
18:42:38.0974 1144	SensrSvc - ok
18:42:39.0037 1144	Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
18:42:39.0068 1144	Serenum - ok
18:42:39.0115 1144	Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
18:42:39.0161 1144	Serial - ok
18:42:39.0193 1144	sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
18:42:39.0239 1144	sermouse - ok
18:42:39.0286 1144	SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
18:42:39.0364 1144	SessionEnv - ok
18:42:39.0395 1144	sffdisk         (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
18:42:39.0411 1144	sffdisk - ok
18:42:39.0427 1144	sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
18:42:39.0458 1144	sffp_mmc - ok
18:42:39.0473 1144	sffp_sd         (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
18:42:39.0489 1144	sffp_sd - ok
18:42:39.0505 1144	sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
18:42:39.0536 1144	sfloppy - ok
18:42:39.0598 1144	SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
18:42:39.0692 1144	SharedAccess - ok
18:42:39.0754 1144	ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
18:42:39.0832 1144	ShellHWDetection - ok
18:42:39.0863 1144	SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
18:42:39.0879 1144	SiSRaid2 - ok
18:42:39.0910 1144	SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
18:42:39.0926 1144	SiSRaid4 - ok
18:42:39.0973 1144	Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
18:42:40.0019 1144	Smb - ok
18:42:40.0051 1144	SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
18:42:40.0082 1144	SNMPTRAP - ok
18:42:40.0082 1144	spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
18:42:40.0097 1144	spldr - ok
18:42:40.0175 1144	Spooler         (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
18:42:40.0238 1144	Spooler - ok
18:42:40.0519 1144	sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
18:42:40.0628 1144	sppsvc - ok
18:42:40.0768 1144	sppuinotify     (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
18:42:40.0862 1144	sppuinotify - ok
18:42:40.0940 1144	srv             (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
18:42:41.0002 1144	srv - ok
18:42:41.0033 1144	srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
18:42:41.0080 1144	srv2 - ok
18:42:41.0096 1144	srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
18:42:41.0143 1144	srvnet - ok
18:42:41.0189 1144	SSDPSRV         (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
18:42:41.0252 1144	SSDPSRV - ok
18:42:41.0283 1144	SstpSvc         (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
18:42:41.0330 1144	SstpSvc - ok
18:42:41.0439 1144	STacSV          (7aa12db4bb2cb414c3525e1c02da911f) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_42d83e1760b1e973\STacSV64.exe
18:42:41.0470 1144	STacSV - ok
18:42:41.0501 1144	stdflt          (c48e0745d33897c7a73394214f2b9b4f) C:\Windows\system32\DRIVERS\stdflt.sys
18:42:41.0517 1144	stdflt - ok
18:42:41.0595 1144	Steam Client Service - ok
18:42:41.0626 1144	stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
18:42:41.0642 1144	stexstor - ok
18:42:41.0720 1144	STHDA           (2d7c3ca0fdb0f438671c89fa1804674f) C:\Windows\system32\DRIVERS\stwrt64.sys
18:42:41.0782 1144	STHDA - ok
18:42:41.0876 1144	stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
18:42:41.0938 1144	stisvc - ok
18:42:41.0969 1144	swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
18:42:41.0969 1144	swenum - ok
18:42:42.0047 1144	swprv           (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
18:42:42.0125 1144	swprv - ok
18:42:42.0266 1144	SysMain         (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
18:42:42.0344 1144	SysMain - ok
18:42:42.0469 1144	TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
18:42:42.0515 1144	TabletInputService - ok
18:42:42.0562 1144	TapiSrv         (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
18:42:42.0656 1144	TapiSrv - ok
18:42:42.0671 1144	TBS             (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
18:42:42.0734 1144	TBS - ok
18:42:42.0905 1144	Tcpip           (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
18:42:42.0968 1144	Tcpip - ok
18:42:43.0264 1144	TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
18:42:43.0311 1144	TCPIP6 - ok
18:42:43.0483 1144	tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
18:42:43.0561 1144	tcpipreg - ok
18:42:43.0592 1144	TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
18:42:43.0623 1144	TDPIPE - ok
18:42:43.0654 1144	TDTCP           (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
18:42:43.0670 1144	TDTCP - ok
18:42:43.0717 1144	tdx             (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
18:42:43.0795 1144	tdx - ok
18:42:43.0826 1144	TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
18:42:43.0841 1144	TermDD - ok
18:42:43.0919 1144	TermService     (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
18:42:43.0997 1144	TermService - ok
18:42:44.0029 1144	Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
18:42:44.0075 1144	Themes - ok
18:42:44.0107 1144	THREADORDER     (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
18:42:44.0169 1144	THREADORDER - ok
18:42:44.0185 1144	TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
18:42:44.0247 1144	TrkWks - ok
18:42:44.0325 1144	TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
18:42:44.0387 1144	TrustedInstaller - ok
18:42:44.0419 1144	tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
18:42:44.0481 1144	tssecsrv - ok
18:42:44.0512 1144	TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
18:42:44.0559 1144	TsUsbFlt - ok
18:42:44.0621 1144	tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
18:42:44.0699 1144	tunnel - ok
18:42:44.0731 1144	uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
18:42:44.0762 1144	uagp35 - ok
18:42:44.0809 1144	udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
18:42:44.0887 1144	udfs - ok
18:42:44.0918 1144	UI0Detect       (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
18:42:44.0949 1144	UI0Detect - ok
18:42:44.0996 1144	uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
18:42:45.0011 1144	uliagpkx - ok
18:42:45.0058 1144	umbus           (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
18:42:45.0074 1144	umbus - ok
18:42:45.0105 1144	UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
18:42:45.0121 1144	UmPass - ok
18:42:45.0401 1144	UNS             (765f2dd351ba064f657751d8d75e58c0) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
18:42:45.0464 1144	UNS - ok
18:42:45.0604 1144	upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
18:42:45.0667 1144	upnphost - ok
18:42:45.0745 1144	usbccgp         (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
18:42:45.0776 1144	usbccgp - ok
18:42:45.0807 1144	usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
18:42:45.0838 1144	usbcir - ok
18:42:45.0869 1144	usbehci         (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys
18:42:45.0901 1144	usbehci - ok
18:42:45.0979 1144	usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
18:42:46.0025 1144	usbhub - ok
18:42:46.0041 1144	usbohci         (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
18:42:46.0103 1144	usbohci - ok
18:42:46.0135 1144	usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
18:42:46.0166 1144	usbprint - ok
18:42:46.0213 1144	usbscan         (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
18:42:46.0259 1144	usbscan - ok
18:42:46.0291 1144	USBSTOR         (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
18:42:46.0322 1144	USBSTOR - ok
18:42:46.0353 1144	usbuhci         (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
18:42:46.0369 1144	usbuhci - ok
18:42:46.0415 1144	usbvideo        (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys
18:42:46.0447 1144	usbvideo - ok
18:42:46.0478 1144	UxSms           (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
18:42:46.0556 1144	UxSms - ok
18:42:46.0587 1144	VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
18:42:46.0603 1144	VaultSvc - ok
18:42:46.0649 1144	vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
18:42:46.0665 1144	vdrvroot - ok
18:42:46.0727 1144	vds             (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
18:42:46.0805 1144	vds - ok
18:42:46.0852 1144	vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
18:42:46.0868 1144	vga - ok
18:42:46.0899 1144	VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
18:42:46.0946 1144	VgaSave - ok
18:42:46.0993 1144	vhdmp           (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
18:42:47.0008 1144	vhdmp - ok
18:42:47.0039 1144	viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
18:42:47.0055 1144	viaide - ok
18:42:47.0071 1144	volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
18:42:47.0086 1144	volmgr - ok
18:42:47.0133 1144	volmgrx         (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
18:42:47.0164 1144	volmgrx - ok
18:42:47.0211 1144	volsnap         (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
18:42:47.0242 1144	volsnap - ok
18:42:47.0305 1144	vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
18:42:47.0320 1144	vsmraid - ok
18:42:47.0461 1144	VSS             (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
18:42:47.0570 1144	VSS - ok
18:42:47.0726 1144	vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
18:42:47.0773 1144	vwifibus - ok
18:42:47.0788 1144	vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
18:42:47.0835 1144	vwififlt - ok
18:42:47.0866 1144	vwifimp         (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys
18:42:47.0897 1144	vwifimp - ok
18:42:47.0960 1144	W32Time         (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
18:42:48.0022 1144	W32Time - ok
18:42:48.0038 1144	WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
18:42:48.0069 1144	WacomPen - ok
18:42:48.0116 1144	WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
18:42:48.0163 1144	WANARP - ok
18:42:48.0163 1144	Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
18:42:48.0209 1144	Wanarpv6 - ok
18:42:48.0365 1144	wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
18:42:48.0412 1144	wbengine - ok
18:42:48.0553 1144	WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
18:42:48.0584 1144	WbioSrvc - ok
18:42:48.0646 1144	wcncsvc         (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
18:42:48.0709 1144	wcncsvc - ok
18:42:48.0755 1144	WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
18:42:48.0771 1144	WcsPlugInService - ok
18:42:48.0833 1144	Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
18:42:48.0865 1144	Wd - ok
18:42:48.0927 1144	Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
18:42:48.0974 1144	Wdf01000 - ok
18:42:49.0021 1144	WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
18:42:49.0067 1144	WdiServiceHost - ok
18:42:49.0067 1144	WdiSystemHost   (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
18:42:49.0099 1144	WdiSystemHost - ok
18:42:49.0145 1144	WebClient       (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
18:42:49.0208 1144	WebClient - ok
18:42:49.0239 1144	Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
18:42:49.0301 1144	Wecsvc - ok
18:42:49.0317 1144	wercplsupport   (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
18:42:49.0395 1144	wercplsupport - ok
18:42:49.0442 1144	WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
18:42:49.0535 1144	WerSvc - ok
18:42:49.0598 1144	WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
18:42:49.0660 1144	WfpLwf - ok
18:42:49.0676 1144	WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
18:42:49.0691 1144	WIMMount - ok
18:42:49.0723 1144	WinDefend - ok
18:42:49.0738 1144	WinHttpAutoProxySvc - ok
18:42:49.0832 1144	Winmgmt         (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
18:42:49.0894 1144	Winmgmt - ok
18:42:50.0081 1144	WinRM           (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
18:42:50.0175 1144	WinRM - ok
18:42:50.0378 1144	Wlansvc         (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
18:42:50.0425 1144	Wlansvc - ok
18:42:50.0518 1144	WMCoreService - ok
18:42:50.0581 1144	WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
18:42:50.0627 1144	WmiAcpi - ok
18:42:50.0721 1144	wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
18:42:50.0768 1144	wmiApSrv - ok
18:42:50.0799 1144	WMPNetworkSvc - ok
18:42:50.0830 1144	WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
18:42:50.0861 1144	WPCSvc - ok
18:42:50.0893 1144	WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
18:42:50.0924 1144	WPDBusEnum - ok
18:42:50.0955 1144	ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
18:42:51.0002 1144	ws2ifsl - ok
18:42:51.0033 1144	wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
18:42:51.0064 1144	wscsvc - ok
18:42:51.0080 1144	WSearch - ok
18:42:51.0283 1144	wuauserv        (d9ef901dca379cfe914e9fa13b73b4c4) C:\Windows\system32\wuaueng.dll
18:42:51.0345 1144	wuauserv - ok
18:42:51.0501 1144	WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
18:42:51.0595 1144	WudfPf - ok
18:42:51.0641 1144	WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
18:42:51.0704 1144	WUDFRd - ok
18:42:51.0735 1144	wudfsvc         (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
18:42:51.0782 1144	wudfsvc - ok
18:42:51.0844 1144	WwanSvc         (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
18:42:51.0891 1144	WwanSvc - ok
18:42:51.0938 1144	MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
18:42:52.0390 1144	\Device\Harddisk0\DR0 - ok
18:42:52.0406 1144	Boot (0x1200)   (3a54154d4875af3b870b770cd81d786d) \Device\Harddisk0\DR0\Partition0
18:42:52.0406 1144	\Device\Harddisk0\DR0\Partition0 - ok
18:42:52.0421 1144	Boot (0x1200)   (770091e322796509457e7426b16b2112) \Device\Harddisk0\DR0\Partition1
18:42:52.0437 1144	\Device\Harddisk0\DR0\Partition1 - ok
18:42:52.0453 1144	Boot (0x1200)   (a2d6965dfcf22c03aa4937ce050872b2) \Device\Harddisk0\DR0\Partition2
18:42:52.0453 1144	\Device\Harddisk0\DR0\Partition2 - ok
18:42:52.0453 1144	============================================================
18:42:52.0453 1144	Scan finished
18:42:52.0453 1144	============================================================
18:42:52.0468 3604	Detected object count: 9
18:42:52.0468 3604	Actual detected object count: 9
18:44:58.0875 3604	AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - skipped by user
18:44:58.0875 3604	AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 
18:44:58.0875 3604	cbVSCService ( UnsignedFile.Multi.Generic ) - skipped by user
18:44:58.0875 3604	cbVSCService ( UnsignedFile.Multi.Generic ) - User select action: Skip 
18:44:58.0875 3604	CobianBackup10 ( UnsignedFile.Multi.Generic ) - skipped by user
18:44:58.0875 3604	CobianBackup10 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
18:44:58.0875 3604	hpqcxs08 ( UnsignedFile.Multi.Generic ) - skipped by user
18:44:58.0875 3604	hpqcxs08 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
18:44:58.0891 3604	hpqddsvc ( UnsignedFile.Multi.Generic ) - skipped by user
18:44:58.0891 3604	hpqddsvc ( UnsignedFile.Multi.Generic ) - User select action: Skip 
18:44:58.0891 3604	HPSLPSVC ( UnsignedFile.Multi.Generic ) - skipped by user
18:44:58.0891 3604	HPSLPSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip 
18:44:58.0891 3604	InstallFilterService ( UnsignedFile.Multi.Generic ) - skipped by user
18:44:58.0891 3604	InstallFilterService ( UnsignedFile.Multi.Generic ) - User select action: Skip 
18:44:58.0891 3604	Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
18:44:58.0891 3604	Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
18:44:58.0891 3604	Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
18:44:58.0891 3604	Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus · 02.07.2012, 10:33

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

condi · 03.07.2012, 16:37

Hallo,

hier der ComboFix Log:

Code:

ATTFilter

ComboFix 12-07-02.01 - Vicky 03.07.2012  17:19:31.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3957.2605 [GMT 2:00]
ausgeführt von:: c:\users\Vicky\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-06-03 bis 2012-07-03  ))))))))))))))))))))))))))))))
.
.
2012-07-03 15:24 . 2012-07-03 15:24	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-07-03 14:59 . 2012-05-31 04:04	9013136	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{1D8C52B1-1607-463C-AE8D-0C1973B5A360}\mpengine.dll
2012-06-29 17:21 . 2012-06-29 17:21	--------	d-----w-	C:\_OTL
2012-06-28 17:45 . 2012-06-30 21:06	--------	d-----w-	c:\users\Vicky\AppData\Roaming\vlc
2012-06-26 18:39 . 2012-06-26 18:39	--------	d-----w-	c:\program files (x86)\ESET
2012-06-23 13:28 . 2012-06-23 13:28	--------	d-----w-	c:\program files (x86)\BurnAware Free
2012-06-22 16:08 . 2012-06-22 16:08	476936	----a-w-	c:\windows\SysWow64\npdeployJava1.dll
2012-06-22 16:08 . 2012-06-22 16:08	--------	d-----w-	c:\program files (x86)\Java
2012-06-22 14:02 . 2012-06-02 22:19	2428952	----a-w-	c:\windows\system32\wuaueng.dll
2012-06-22 14:02 . 2012-06-02 22:19	57880	----a-w-	c:\windows\system32\wuauclt.exe
2012-06-22 14:02 . 2012-06-02 22:19	44056	----a-w-	c:\windows\system32\wups2.dll
2012-06-22 14:02 . 2012-06-02 22:15	2622464	----a-w-	c:\windows\system32\wucltux.dll
2012-06-22 14:01 . 2012-06-02 22:19	38424	----a-w-	c:\windows\system32\wups.dll
2012-06-22 14:01 . 2012-06-02 22:19	701976	----a-w-	c:\windows\system32\wuapi.dll
2012-06-22 14:01 . 2012-06-02 22:15	99840	----a-w-	c:\windows\system32\wudriver.dll
2012-06-22 14:01 . 2012-06-02 13:19	186752	----a-w-	c:\windows\system32\wuwebv.dll
2012-06-22 14:01 . 2012-06-02 13:15	36864	----a-w-	c:\windows\system32\wuapp.exe
2012-06-20 15:04 . 2012-06-20 15:04	--------	d-----w-	c:\users\Vicky\AppData\Local\Macromedia
2012-06-14 16:04 . 2012-06-14 16:04	--------	d-----w-	c:\users\Vicky\AppData\Local\PDF24
2012-06-14 16:03 . 2012-06-14 16:04	--------	d-----w-	c:\program files (x86)\PDF24
2012-06-14 15:58 . 2012-06-14 15:58	--------	d-----w-	c:\users\Vicky\AppData\Roaming\Nitro PDF
2012-06-14 15:58 . 2012-06-14 15:58	--------	d-----w-	c:\users\Vicky\AppData\Roaming\FileOpen
2012-06-14 15:58 . 2012-06-14 15:58	--------	d-----w-	c:\programdata\FileOpen
2012-06-14 15:57 . 2012-06-14 15:57	--------	d-----w-	c:\programdata\Nitro PDF
2012-06-14 15:56 . 2012-06-14 15:56	--------	d-----w-	c:\users\Vicky\AppData\Roaming\Downloaded Installations
2012-06-14 15:41 . 2012-04-26 05:41	77312	----a-w-	c:\windows\system32\rdpwsx.dll
2012-06-14 15:41 . 2012-04-26 05:41	149504	----a-w-	c:\windows\system32\rdpcorekmts.dll
2012-06-14 15:41 . 2012-04-26 05:34	9216	----a-w-	c:\windows\system32\rdrmemptylst.exe
2012-06-14 15:41 . 2012-05-04 11:06	5559664	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-06-14 15:41 . 2012-05-04 10:03	3913072	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2012-06-14 15:41 . 2012-05-04 10:03	3968368	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2012-06-14 15:41 . 2012-05-15 01:32	3146752	----a-w-	c:\windows\system32\win32k.sys
2012-06-14 15:41 . 2012-04-28 03:55	210944	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-06-13 17:10 . 2012-06-13 17:10	--------	d-----w-	c:\users\Vicky\AppData\Roaming\Amazon
2012-06-13 17:08 . 2012-06-13 17:08	--------	d-----w-	c:\program files (x86)\Amazon
2012-06-09 08:19 . 2012-06-09 08:20	--------	d-----w-	c:\program files\GIMP 2
2012-06-07 15:33 . 2012-06-07 15:33	770384	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcr100.dll
2012-06-07 15:33 . 2012-06-07 15:33	421200	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcp100.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-22 16:08 . 2011-10-15 17:08	472840	----a-w-	c:\windows\SysWow64\deployJava1.dll
2012-06-20 14:09 . 2012-04-01 08:51	426184	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-06-20 14:09 . 2011-10-16 07:56	70344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-06 4241512]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]
"AVMWlanClient"="c:\program files (x86)\avmwlanstick\wlangui.exe" [2010-10-22 2105344]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2012-05-22 160872]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2011-4-19 291896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-07 136176]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [2010-10-22 14120]
R3 cpudrv64;cpudrv64;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys [2009-12-18 17864]
R3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\DRIVERS\fwlanusb.sys [2010-10-22 460800]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-07 136176]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-17 113120]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2009-09-21 315664]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S0 stdflt;Disk Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdflt.sys [2009-07-23 18792]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_42d83e1760b1e973\AESTSr64.exe [2009-03-03 89600]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 203264]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-03-06 69976]
S2 cbVSCService;Cobian Backup 10 Volume Shadow Copy service;c:\program files (x86)\Cobian Backup 10\cbVSCService.exe [2010-09-23 67584]
S2 CobianBackup10;Cobian Backup 10;c:\program files (x86)\Cobian Backup 10\cbService.exe [2010-09-23 1125376]
S2 InstallFilterService;FF Install Filter Service;c:\program files (x86)\STMicroelectronics\Accelerometer\InstallFilterService.exe [2009-06-23 60928]
S2 rimspci;rimspci;c:\windows\system32\DRIVERS\rimspe64.sys [2009-07-02 60416]
S2 risdpcie;risdpcie;c:\windows\system32\DRIVERS\risdpe64.sys [2009-07-01 80896]
S2 rixdpcie;rixdpcie;c:\windows\system32\DRIVERS\rixdpe64.sys [2009-07-04 55808]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2011-04-19 993848]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2011-04-19 399416]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2320920]
S2 WMCoreService;Mobile Broadband Service;c:\program files (x86)\Dell\Dell WWAN\WMCore\mini_WMCore.exe servicemode [x]
S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Acceler.sys [2009-07-23 23912]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2009-06-15 172704]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
S3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2009-09-15 6952960]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 17976]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2012-07-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-07 09:54]
.
2012-07-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-07 09:54]
.
2012-07-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1973132618-1650621722-1435852045-1000Core.job
- c:\users\Vicky\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-02 12:26]
.
2012-07-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1973132618-1650621722-1435852045-1000UA.job
- c:\users\Vicky\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-02 12:26]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-06 23:15	135408	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-12-14 487424]
"QuickSet"="c:\program files\Dell\QuickSet\QuickSet.exe" [2009-10-01 3189016]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2009-09-21 1926928]
"FreeFallProtection"="c:\program files (x86)\STMicroelectronics\Accelerometer\FF_Protection.exe" [2009-07-22 2384896]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Vicky\AppData\Roaming\Mozilla\Firefox\Profiles\p4q2uynp.default\
FF - prefs.js: browser.startup.homepage - about:home
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-dellsupportcenter - c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10zb_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10zb_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10zb.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10zb.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10zb.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10zb.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\avmwlanstick\WlanNetService.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Dell\Dell WWAN\WMCore\mini_WMCore.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-07-03  17:32:00 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-07-03 15:31
.
Vor Suchlauf: 10 Verzeichnis(se), 67.392.798.720 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 66.975.318.016 Bytes frei
.
- - End Of File - - F639A7E16F2EE6A469A16710F8FB9221

cosinus · 04.07.2012, 14:48

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

condi · 05.07.2012, 17:57

Und weiter geht's.....

Gmer will mir leider kein log geben - ich bekomme nur die Meldung, dass nichts gefunden wurde.

Hier das Osam Log:

Code:

ATTFilter

Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 17:13:57 on 05.07.2012

OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 64-bit
Default Browser: Mozilla Corporation Firefox 13.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskUserS-1-5-21-1973132618-1650621722-1435852045-1000Core.job" - "Google Inc." - C:\Users\Vicky\AppData\Local\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskUserS-1-5-21-1973132618-1650621722-1435852045-1000UA.job" - "Google Inc." - C:\Users\Vicky\AppData\Local\Google\Update\GoogleUpdate.exe

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"aswFsBlk" (aswFsBlk) - "AVAST Software" - C:\Windows\system32\drivers\aswFsBlk.sys
"aswMonFlt" (aswMonFlt) - "AVAST Software" - C:\Windows\system32\drivers\aswMonFlt.sys
"aswRdr" (aswRdr) - "AVAST Software" - C:\Windows\System32\Drivers\aswrdr2.sys
"aswSnx" (aswSnx) - "AVAST Software" - C:\Windows\system32\drivers\aswSnx.sys
"aswSP" (aswSP) - "AVAST Software" - C:\Windows\system32\drivers\aswSP.sys
"avast! Network Shield Support" (aswTdi) - "AVAST Software" - C:\Windows\system32\drivers\aswTdi.sys
"AVM Eject" (avmeject) - "AVM Berlin" - C:\Windows\System32\drivers\avmeject.sys
"cpudrv64" (cpudrv64) - ? - C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys  (File found, but it contains no detailed information)
"PSI" (PSI) - "Secunia" - C:\Windows\System32\DRIVERS\psi_mf.sys
"SANDRA" (SANDRA) - ? - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2011.SP4c\WNt500x64\Sandra.sys  (File not found)

[Explorer]
-----( HKLM\Software\Classes\Protocols\Handler )-----
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{472083B0-C522-11CF-8763-00608CC02F24} "avast" - "AVAST Software" - C:\Program Files\AVAST Software\Avast\ashShell.dll

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{555D4D79-4BD2-4094-A395-CFC534424A05} "{555D4D79-4BD2-4094-A395-CFC534424A05}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_33" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} "Java Plug-in 1.6.0_33" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_33" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\npjpi160_33.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Vicky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Secunia PSI Tray.lnk" - "Secunia" - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe  (Shortcut exists | File exists)
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avast" - "AVAST Software" - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
"AVMWlanClient" - "AVM Berlin" - C:\Program Files (x86)\avmwlanstick\wlangui.exe
"Dell Webcam Central" - "Creative Technology Ltd" - "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
"PDFPrint" - "Geek Software GmbH" - C:\Program Files (x86)\PDF24\pdf24.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)
"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)
"avast! Antivirus" (avast! Antivirus) - "AVAST Software" - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
"AVM WLAN Connection Service" (AVM WLAN Connection Service) - "AVM Berlin" - C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
"Cobian Backup 10" (CobianBackup10) - "Luis Cobian, CobianSoft" - C:\Program Files (x86)\Cobian Backup 10\cbService.exe
"Cobian Backup 10 Volume Shadow Copy service" (cbVSCService) - "CobianSoft, Luis Cobian" - C:\Program Files (x86)\Cobian Backup 10\cbVSCService.exe
"FF Install Filter Service" (InstallFilterService) - ? - C:\Program Files (x86)\STMicroelectronics\Accelerometer\InstallFilterService.exe  (File found, but it contains no detailed information)
"Google Update-Dienst (gupdate)" (gupdate) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"HP CUE DeviceDiscovery Service" (hpqddsvc) - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll
"HP Network Devices Support" (HPSLPSVC) - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL
"hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll
"Intel(R) Management & Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
"Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
"Intel(R) PROSet/Wireless Event Log" (EvtEng) - "Intel(R) Corporation" - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
"Intel(R) PROSet/Wireless Registry Service" (RegSrvc) - "Intel(R) Corporation" - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Mobile Broadband Service" (WMCoreService) - ? - C:\Program Files (x86)\Dell\Dell WWAN\WMCore\mini_WMCore.exe  (File found, but it contains no detailed information)
"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll
"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll
"Secunia PSI Agent" (Secunia PSI Agent) - "Secunia" - C:\Program Files (x86)\Secunia\PSI\PSIA.exe
"Secunia Update Agent" (Secunia Update Agent) - "Secunia" - C:\Program Files (x86)\Secunia\PSI\sua.exe
"Steam Client Service" (Steam Client Service) - "Valve Corporation" - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
"Wireless PAN DHCP Server" (MyWiFiDHCPDNS) - ? - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Und hier aswMBR:

Code:

ATTFilter

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-07-05 17:16:46
-----------------------------
17:16:46.795    OS Version: Windows x64 6.1.7601 Service Pack 1
17:16:46.795    Number of processors: 4 586 0x2502
17:16:46.795    ComputerName: VICKY-LAPTOP  UserName: Vicky
17:16:47.575    Initialize success
17:16:47.700    AVAST engine defs: 12070400
17:16:58.948    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
17:16:58.948    Disk 0 Vendor: SAMSUNG_HM320II 2AC101C4 Size: 305245MB BusType: 11
17:16:58.979    Disk 0 MBR read successfully
17:16:58.979    Disk 0 MBR scan
17:16:58.979    Disk 0 Windows 7 default MBR code
17:16:58.994    Disk 0 Partition 1 00     DE Dell Utility Dell 8.0       39 MB offset 63
17:16:59.010    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        15000 MB offset 80325
17:16:59.026    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       100000 MB offset 30800325
17:16:59.026    Disk 0 Partition - 00     0F Extended LBA            190204 MB offset 235601920
17:16:59.057    Disk 0 Partition 4 00     07    HPFS/NTFS NTFS       190203 MB offset 235603968
17:16:59.088    Disk 0 scanning C:\Windows\system32\drivers
17:17:07.746    Service scanning
17:17:25.842    Modules scanning
17:17:26.357    Disk 0 trace - called modules:
17:17:26.388    ntoskrnl.exe CLASSPNP.SYS disk.sys stdflt.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys 
17:17:26.404    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004bad060]
17:17:26.404    3 CLASSPNP.SYS[fffff8800165143f] -> nt!IofCallDriver -> [0xfffffa8004a4f960]
17:17:26.419    5 stdflt.sys[fffff88001965a4a] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa80048fa680]
17:17:26.934    AVAST engine scan C:\Windows
17:17:29.009    AVAST engine scan C:\Windows\system32
17:19:34.542    AVAST engine scan C:\Windows\system32\drivers
17:19:44.760    AVAST engine scan C:\Users\Vicky
17:22:24.473    AVAST engine scan C:\ProgramData
17:23:06.235    Scan finished successfully
17:23:48.912    Disk 0 MBR has been saved successfully to "C:\Users\Vicky\Desktop\MBR.dat"
17:23:48.912    The log file has been saved successfully to "C:\Users\Vicky\Desktop\aswMBR.txt"

cosinus · 05.07.2012, 20:07

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

condi · 06.07.2012, 21:34

Na dann......

erstmal mbam:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.07.06.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
xxx :: xxx-LAPTOP [Administrator]

06.07.2012 19:03:02
mbam-log-2012-07-06 (19-03-02).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 348332
Laufzeit: 50 Minute(n), 49 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Und SuperAntispyware:

Code:

ATTFilter

*SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 07/06/2012 at 10:15 PM

Application Version : 5.5.1006

Core Rules Database Version : 8857
Trace Rules Database Version: 6669

Scan type       : Complete Scan
Total Scan Time : 01:59:32

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 595
Memory threats detected   : 0
Registry items scanned    : 64584
Registry threats detected : 0
File items scanned        : 141281
File threats detected     : 85

Adware.Tracking Cookie
	C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Cookies\23YLIZJ7.txt [ /serving-sys.com ]
	C:\USERS\xxx\Cookies\23YLIZJ7.txt [ Cookie:xxx@serving-sys.com/ ]
	accounts.youtube.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.imrworldwide.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.imrworldwide.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.doubleclick.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	www.elitepvpers.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	www.elitepvpers.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	www.elitepvpers.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.apmebf.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.mediaplex.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.xiti.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.atdmt.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.tracking.quisma.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	de.sitestat.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	stats.computecmedia.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.webmasterplan.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.webmasterplan.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	accounts.youtube.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	mpegmedia.abc.net.au [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	tracking.sim-technik.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	counters.gigya.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	statse.webtrendslive.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.histats.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.histats.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.statcounter.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.smartadserver.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.smartadserver.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.smartadserver.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.smartadserver.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.smartadserver.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.smartadserver.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.revsci.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.revsci.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.revsci.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	ad2.adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.webmasterplan.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	www.googleadservices.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.tradedoubler.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.tradedoubler.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	ad.zanox.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.amazon-adsystem.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	ad.yieldmanager.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.loyaltypartner.122.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	ad.yieldmanager.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.adtech.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.webstats4u.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.atdmt.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.h.atdmt.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.h.atdmt.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.atdmt.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.atdmt.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.h.atdmt.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.h.atdmt.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	track.adform.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	track.adform.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.adform.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.media6degrees.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	www1.addfreestats.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.doubleclick.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	ad3.adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	accounts.youtube.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	accounts.google.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]
	accounts.google.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P4Q2UYNP.DEFAULT\COOKIES.SQLITE ]

Adware.SoftwareInformer
	D:\DOWNLOADS\SETUPS\DELL_WEBCAM_CENTRAL.EXE

05.07.2012, 20:07	#14
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Auf merkwürdige Seite weitergeleitet worden - Malwarebytes hat was gefunden Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!! __________________ Logfiles bitte immer in CODE-Tags posten

Auf merkwürdige Seite weitergeleitet worden - Malwarebytes hat was gefunden

Plagegeister aller Art und deren Bekämpfung: Auf merkwürdige Seite weitergeleitet worden - Malwarebytes hat was gefunden