Dabei ist mir eine Datei aufgefallen. FF_Protection.exe *32
Sagt mir so gar nichts...

Über Gogoe findet man ja auch garnix => FF_Protection.exe Windows Prozess - Was ist das?

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

 hier steht das Log
         

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

• Starte bitte die OTL.exe.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Setze oben mittig den Haken bei Scanne alle Benutzer
• Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Klick auf .
• Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Das Ergebnis:

OTL logfile created on: 25.09.2012 18:02:34 - Run 3
OTL by OldTimer - Version 3.2.68.0     Folder = C:\Users\***\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,91 Gb Total Physical Memory | 2,40 Gb Available Physical Memory | 61,46% Memory free
7,82 Gb Paging File | 6,00 Gb Available in Paging File | 76,73% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 451,01 Gb Total Space | 335,46 Gb Free Space | 74,38% Space Free | Partition Type: NTFS
Drive F: | 1,84 Gb Total Space | 1,21 Gb Free Space | 65,78% Space Free | Partition Type: FAT
 
Computer Name: JWN-PC | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.09.25 17:54:50 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL (2).exe
PRC - [2012.08.24 13:01:40 | 002,735,528 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
PRC - [2012.08.08 11:44:22 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.08 19:16:19 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 19:16:19 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2011.11.08 12:54:25 | 000,554,160 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) -- C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe
PRC - [2011.08.03 15:23:54 | 000,828,944 | ---- | M] (GlavSoft LLC.) -- C:\Program Files (x86)\TightVNC\tvnserver.exe
PRC - [2011.05.20 19:16:10 | 000,146,592 | ---- | M] (Atheros) -- C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe
PRC - [2010.11.06 07:54:22 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.10.06 05:04:12 | 002,655,768 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2010.10.06 05:04:08 | 000,325,656 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010.09.30 14:00:28 | 000,253,264 | ---- | M] () -- C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe
PRC - [2010.04.15 12:51:02 | 000,261,256 | ---- | M] (NovaStor) -- C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\nsService.exe
PRC - [2009.05.15 21:36:50 | 000,251,184 | R--- | M] (BUFFALO INC.) -- C:\Program Files (x86)\BUFFALO\NASNAVI\nassvc.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2011.05.12 08:53:46 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010.12.03 18:26:34 | 003,143,472 | ---- | M] (Validity Sensors, Inc.) [Auto | Running] -- C:\Windows\SysNative\vcsFPService.exe -- (vcsFPService)
SRV - [2012.09.04 22:26:53 | 000,250,568 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.08.24 13:01:40 | 002,735,528 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2012.08.04 16:36:06 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.05.08 19:16:19 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.08 19:16:19 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.01.18 14:38:28 | 000,155,320 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion)
SRV - [2011.11.08 12:54:25 | 000,554,160 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) [Auto | Running] -- C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe -- (StarMoney 7.0 OnlineUpdate)
SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2011.08.03 15:23:54 | 000,828,944 | ---- | M] (GlavSoft LLC.) [Auto | Running] -- C:\Program Files (x86)\TightVNC\tvnserver.exe -- (tvnserver)
SRV - [2011.05.20 19:16:10 | 000,146,592 | ---- | M] (Atheros) [Auto | Running] -- C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe -- (Atheros Bt&Wlan Coex Agent)
SRV - [2011.05.20 19:15:20 | 000,080,032 | ---- | M] (Atheros Commnucations) [Auto | Running] -- C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AdminService.exe -- (AtherosSvc)
SRV - [2011.03.28 22:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2011.01.25 11:57:18 | 000,296,448 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Programme\IDT\WDM\stacsv64.exe -- (STacSV)
SRV - [2010.12.29 21:54:24 | 000,440,144 | ---- | M] (DigitalPersona, Inc.) [Auto | Running] -- C:\Programme\DigitalPersona\Bin\DpHostW.exe -- (DpHost)
SRV - [2010.12.03 18:14:58 | 002,696,496 | ---- | M] (Validity Sensors, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vcsFPService.exe -- (vcsFPService)
SRV - [2010.11.25 13:34:18 | 000,219,632 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe -- (RoxWatch12)
SRV - [2010.11.25 13:33:18 | 001,116,656 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe -- (RoxMediaDB12OEM)
SRV - [2010.11.06 07:54:22 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.10.06 05:04:12 | 002,655,768 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010.10.06 05:04:08 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010.09.30 14:00:28 | 000,253,264 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe -- (UI Assistant Service)
SRV - [2010.09.23 02:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.04.15 12:51:02 | 000,261,256 | ---- | M] (NovaStor) [Auto | Running] -- C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\nsService.exe -- (nsService)
SRV - [2010.03.18 21:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.05.15 21:36:50 | 000,251,184 | R--- | M] (BUFFALO INC.) [Auto | Running] -- C:\Program Files (x86)\BUFFALO\NASNAVI\nassvc.exe -- (NasPmService)
SRV - [2009.03.03 12:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Programme\IDT\WDM\AESTSr64.exe -- (AESTFilters)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.05.08 19:16:19 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.08 19:16:19 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.12.09 13:40:20 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2011.08.09 18:32:02 | 012,289,472 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdpmd64.sys -- (intelkmd)
DRV:64bit: - [2011.07.20 15:58:22 | 000,044,032 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys -- (RimVSerPort)
DRV:64bit: - [2011.06.16 15:40:20 | 000,176,000 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV:64bit: - [2011.06.10 07:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.05.20 19:15:34 | 000,282,272 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btfilter.sys -- (BtFilter)
DRV:64bit: - [2011.05.20 19:15:34 | 000,201,376 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_hcrp.sys -- (BTATH_HCRP)
DRV:64bit: - [2011.05.20 19:15:34 | 000,154,272 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_rcp.sys -- (BTATH_RCP)
DRV:64bit: - [2011.05.20 19:15:34 | 000,055,456 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_lwflt.sys -- (BTATH_LWFLT)
DRV:64bit: - [2011.05.20 19:15:34 | 000,036,000 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_flt.sys -- (AthBTPort)
DRV:64bit: - [2011.05.20 19:15:34 | 000,029,344 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_bus.sys -- (BTATH_BUS)
DRV:64bit: - [2011.05.20 19:15:32 | 000,298,656 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_a2dp.sys -- (BTATH_A2DP)
DRV:64bit: - [2011.05.12 12:16:38 | 009,319,424 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011.05.12 08:16:54 | 000,304,128 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011.04.22 04:17:10 | 002,727,424 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.01.25 11:57:18 | 000,520,192 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2010.12.16 05:56:06 | 001,402,416 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2010.12.13 17:34:14 | 000,027,760 | ---- | M] (ST Microelectronics) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelern.sys -- (Acceler)
DRV:64bit: - [2010.12.10 23:50:36 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010.12.10 23:50:36 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.11.07 01:45:48 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.10.30 02:11:42 | 000,250,984 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010.10.22 03:00:00 | 000,460,800 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fwlanusb.sys -- (FWLANUSB)
DRV:64bit: - [2010.10.22 03:00:00 | 000,014,120 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avmeject.sys -- (avmeject)
DRV:64bit: - [2010.10.20 00:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.10.15 11:28:16 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2010.08.20 19:05:12 | 000,021,616 | ---- | M] (ST Microelectronics) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stdcfltn.sys -- (stdcfltn)
DRV:64bit: - [2010.03.19 11:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2009.10.29 19:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV:64bit: - [2009.10.29 19:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV:64bit: - [2009.10.29 19:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV:64bit: - [2009.10.29 19:28:24 | 000,011,776 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\massfilter.sys -- (massfilter)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rootmdm.sys -- (ROOTMODEM)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2002.07.17 16:20:32 | 000,084,832 | ---- | M] (Adaptec) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\ASPI32.SYS -- (ASPI)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{2F1E335A-858A-4BE9-8F6B-D0AF1D018B53}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLSDF8&pc=MDDS&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{2F1E335A-858A-4BE9-8F6B-D0AF1D018B53}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLSDF8&pc=MDDS&src=IE-SearchBox
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
 
IE - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
IE - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com
IE - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://www.google.com
IE - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 29 78 36 3F 96 39 CD 01  [binary data]
IE - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com
IE - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - No CLSID value found
IE - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\..\SearchScopes\{D143B2A6-E12C-462D-91A0-529F2BABB055}: "URL" = hxxp://de.yhs4.search.yahoo.com/yhs/search?hsimp=yhs-affiliate_a&hspart=greentree&type=386496_yhs2tst&p={searchTerms}
IE - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "ACPro"
FF - prefs.js..browser.search.defaultenginename: "ACPro"
FF - prefs.js..browser.search.order.1: "ACPro"
FF - prefs.js..browser.search.param.yahoo-fr: "&hsimp=yhs-affiliate_a_ff&hspart=greentree&type=386496_yhs2tst"
FF - prefs.js..browser.search.useDBForOrder: false
FF - prefs.js..network.proxy.http: "94.249.183.209"
FF - prefs.js..network.proxy.http_port: 80
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@playstation.com/PsndlCheck,version=1.00: C:\Program Files (x86)\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101727.dll (Amazon.com, Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\otis@digitalpersona.com: C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt\ [2011.11.15 02:40:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.04 16:36:07 | 000,000,000 | ---D | M]
 
[2011.12.09 19:26:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2012.09.23 19:47:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\oah3w4pc.default\extensions
[2012.07.13 16:22:53 | 000,000,000 | ---D | M] ("Vid-Saver") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\oah3w4pc.default\extensions\crossriderapp3491@crossrider.com
[2012.09.01 22:17:53 | 000,000,000 | ---D | M] (loadtbs) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\oah3w4pc.default\extensions\software@loadtubes.com
[2012.08.20 19:27:35 | 000,000,000 | ---D | M] ("AutocompletePro - Your handy search suggestions tool") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\oah3w4pc.default\extensions\support@predictad.com
[2012.06.30 11:07:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012.06.30 11:07:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012.08.04 16:36:07 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.08.20 19:27:35 | 000,003,189 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\acpro.xml
[2012.07.12 15:51:09 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.07.12 15:51:09 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.07.12 15:51:09 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.07.12 15:51:09 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.07.12 15:51:09 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.07.12 15:51:09 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms},
CHR - homepage: hxxp://www.google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\***\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: RIM Handheld Application Loader (Enabled) = C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: CANON iMAGE GATEWAY Album Plugin Utility for IJ (Enabled) = C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - Extension: Angry Birds = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.5.0.7_0\
CHR - Extension: YouTube = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Skyrama = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlehaidnnmjjkhgbbiombcdifogolhap\1.0.2_0\
CHR - Extension: Google Mail = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [AthBtTray] C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)
O4:64bit: - HKLM..\Run: [AtherosBtStack] C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe (Atheros Communications)
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [QuickSet] C:\Programme\Dell\QuickSet\quickset.exe (Dell Inc.)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Desktop Disc Tool] c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe ()
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [PDVD9LanguageShortcut] C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RemoteControl9] C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RoxWatchTray] c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe (Sonic Solutions)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [tvncontrol] C:\Program Files (x86)\TightVNC\tvnserver.exe (GlavSoft LLC.)
O4 - HKLM..\Run: [UIExec] C:\Program Files (x86)\1&1 Surf-Stick\UIExec.exe ()
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003..\Run: [HW_OPENEYE_OUC_Telekom Internet Manager] "C:\Program Files (x86)\Telekom\InternetManager_H\UpdateDog\ouc.exe" File not found
O4 - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003..\Run: [Optimizer Pro] C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\JWN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BUFFALO NAS Navigator2.lnk = C:\Program Files (x86)\BUFFALO\NASNAVI\NasNavi.exe (BUFFALO INC.)
O4 - Startup: C:\Users\JWN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NAS Scheduler.lnk = C:\Program Files (x86)\BUFFALO\NASNAVI\nassche.exe (BUFFALO INC.)
O4 - Startup: C:\Users\JWN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RazossUpdater.lnk =  File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun =  [binary data]
O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {299385F1-1977-426F-8CE3-07A2407E4498} hxxp://192.168.178.26/IPCamPluginMJPEG.cab (IPCamPluginDPT Control)
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab (Creative Software AutoUpdate)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5207EF73-E842-4569-AC24-78C8F6B82D30}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Program Files (x86)\DigitalPersona\Bin\DPAgent.exe) - C:\Program Files (x86)\DigitalPersona\Bin\DPAgent.exe (DigitalPersona, Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{8e8a7dc2-7973-11e1-92b2-60d819219980}\Shell - "" = AutoRun
O33 - MountPoints2\{8e8a7dc2-7973-11e1-92b2-60d819219980}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{8e8a7dc9-7973-11e1-92b2-60d819219980}\Shell - "" = AutoRun
O33 - MountPoints2\{8e8a7dc9-7973-11e1-92b2-60d819219980}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{8e8a7dd4-7973-11e1-92b2-60d819219980}\Shell - "" = AutoRun
O33 - MountPoints2\{8e8a7dd4-7973-11e1-92b2-60d819219980}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{ec5a3a4e-c0f2-11e1-adf0-60d819219980}\Shell - "" = AutoRun
O33 - MountPoints2\{ec5a3a4e-c0f2-11e1-adf0-60d819219980}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{ec5a3a5c-c0f2-11e1-adf0-60d819219980}\Shell - "" = AutoRun
O33 - MountPoints2\{ec5a3a5c-c0f2-11e1-adf0-60d819219980}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{ec5a3baf-c0f2-11e1-adf0-60d819219980}\Shell - "" = AutoRun
O33 - MountPoints2\{ec5a3baf-c0f2-11e1-adf0-60d819219980}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
 
MsConfig:64bit - StartUpReg: Sweetpacks Communicator - hkey= - key= -  File not found
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: DpHost - C:\Programme\DigitalPersona\Bin\DpHostW.exe (DigitalPersona, Inc.)
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\windows\SysWow64\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.25 17:54:48 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL (2).exe
[2012.09.25 17:53:20 | 000,000,000 | R--D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
[2012.09.22 19:27:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.09.21 00:11:55 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Rechnungen und Etiketten
[2012.09.20 21:18:59 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\PCDr
[2012.09.20 21:18:44 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Dell
[2012.09.20 20:40:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012.09.20 20:39:55 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2012.09.20 20:31:40 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Neuer Ordner
[2012.09.20 17:35:47 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2012.09.20 17:33:55 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys
[2012.09.20 17:33:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.09.20 17:33:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.09.20 17:33:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.09.19 16:53:54 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Amazon MP3
[2012.09.19 16:53:54 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Amazon
[2012.09.19 06:43:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon
[2012.09.19 06:43:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Amazon
[2012.09.16 18:13:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\dangerdeep
[2012.09.16 13:01:53 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{A8044473-79DF-4164-981C-DE8B4A7869A4}
[2012.09.09 23:28:22 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\IDT
[2012.09.09 15:28:49 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\AKVIS
[2012.09.09 15:21:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AKVIS
[2012.09.09 15:21:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AKVIS
[2012.09.09 14:22:20 | 000,000,000 | ---D | C] -- C:\windows\MSSecurityNi
[2012.09.09 13:10:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Razoss
[2012.09.07 17:29:41 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{6F617B66-1DA1-48A6-AE53-C508CFF6640E}
[2012.09.06 16:31:59 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\dvdcss
[2012.09.04 22:26:55 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2012.09.04 12:13:25 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{F130C804-E4A2-43BD-BEE1-1378C3CC34E3}
[2012.08.30 10:56:38 | 000,000,000 | -HSD | C] -- C:\Users\***\Documents\cache
[2012.08.30 10:56:33 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\webex
[2012.08.30 10:56:20 | 000,000,000 | ---D | C] -- C:\ProgramData\WebEx
[2012.08.29 16:45:50 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Turbo Lister
[2012.08.27 20:24:55 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{7E6CFCC6-4CA4-46B5-90A5-027328291332}
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.25 18:02:00 | 000,001,104 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.09.25 17:56:19 | 001,621,242 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2012.09.25 17:56:19 | 000,700,408 | ---- | M] () -- C:\windows\SysNative\perfh007.dat
[2012.09.25 17:56:19 | 000,655,090 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2012.09.25 17:56:19 | 000,149,190 | ---- | M] () -- C:\windows\SysNative\perfc007.dat
[2012.09.25 17:56:19 | 000,121,962 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2012.09.25 17:54:50 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL (2).exe
[2012.09.25 17:52:41 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012.09.25 17:52:32 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012.09.24 22:02:00 | 000,001,100 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.09.24 21:50:26 | 000,020,928 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.24 21:50:26 | 000,020,928 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.24 21:42:35 | 3148,214,272 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.24 17:55:15 | 000,513,501 | ---- | M] () -- C:\Users\***\Desktop\adwcleaner.exe
[2012.09.20 18:04:12 | 000,000,000 | ---- | M] () -- C:\Users\***\defogger_reenable
[2012.09.20 17:33:56 | 000,001,075 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.09.20 16:56:04 | 287,714,424 | ---- | M] () -- C:\Users\***\Desktop\Sich.reg
[2012.09.20 06:12:05 | 001,641,654 | ---- | M] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2012.09.20 05:52:07 | 083,023,306 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012.09.07 17:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys
[2012.09.04 12:13:57 | 000,182,160 | ---- | M] () -- C:\Users\***\Desktop\DSC00118.jpg
 
========== Files Created - No Company Name ==========
 
[2012.09.23 17:45:54 | 000,513,501 | ---- | C] () -- C:\Users\***\Desktop\adwcleaner.exe
[2012.09.20 18:04:12 | 000,000,000 | ---- | C] () -- C:\Users\***\defogger_reenable
[2012.09.20 17:33:56 | 000,001,075 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.09.20 16:55:50 | 287,714,424 | ---- | C] () -- C:\Users\***\Desktop\Sich.reg
[2012.09.20 05:49:45 | 083,023,306 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012.09.04 12:12:00 | 000,182,160 | ---- | C] () -- C:\Users\***\Desktop\DSC00118.jpg
[2012.08.19 23:05:36 | 000,000,073 | ---- | C] () -- C:\windows\cdplayer.ini
[2012.08.19 23:04:48 | 000,001,534 | ---- | C] () -- C:\ProgramData\ss.ini
[2012.01.24 21:10:08 | 000,011,275 | ---- | C] () -- C:\windows\SysWow64\vgittsd.dll
[2012.01.09 21:28:04 | 000,000,772 | ---- | C] () -- C:\windows\ODBCINST.INI
[2011.12.09 19:23:51 | 000,003,584 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.12.09 16:37:50 | 000,000,168 | ---- | C] () -- C:\windows\{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}.ini
[2011.12.09 16:37:50 | 000,000,000 | ---- | C] () -- C:\windows\SysWow64\{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}.ini
[2011.12.09 12:29:33 | 000,000,400 | ---- | C] () -- C:\windows\ODBC.INI
[2011.11.15 03:02:46 | 000,066,856 | ---- | C] () -- C:\windows\SysWow64\SynTPEnhPS.dll
[2011.11.15 03:02:21 | 000,963,116 | ---- | C] () -- C:\windows\SysWow64\igkrng600.bin
[2011.11.15 03:02:20 | 013,903,872 | ---- | C] () -- C:\windows\SysWow64\ig4icd32.dll
[2011.11.15 03:02:20 | 000,216,000 | ---- | C] () -- C:\windows\SysWow64\igfcg600m.bin
[2011.11.15 03:02:20 | 000,145,804 | ---- | C] () -- C:\windows\SysWow64\igcompkrng600.bin
[2011.11.15 03:02:20 | 000,056,832 | ---- | C] () -- C:\windows\SysWow64\igdde32.dll
[2011.11.15 03:02:20 | 000,003,914 | ---- | C] () -- C:\windows\SysWow64\atipblag.dat
[2011.11.15 03:00:34 | 000,000,096 | ---- | C] () -- C:\windows\LaunApp.ini
[2011.11.15 03:00:29 | 000,000,324 | ---- | C] () -- C:\windows\Prelaunch.ini
[2011.11.15 03:00:29 | 000,000,271 | ---- | C] () -- C:\windows\WisPriority.ini
[2011.11.15 03:00:29 | 000,000,032 | ---- | C] () -- C:\windows\WisHWDest.ini
[2011.11.15 03:00:29 | 000,000,028 | ---- | C] () -- C:\windows\WisLangCode.ini
[2011.11.15 03:00:29 | 000,000,023 | ---- | C] () -- C:\windows\WisSysInfo.ini
[2011.11.15 01:57:35 | 000,000,000 | ---- | C] () -- C:\windows\ativpsrm.bin
[2011.11.15 01:51:47 | 000,003,914 | ---- | C] () -- C:\windows\SysWow64\atipblup.dat
[2011.11.15 01:46:31 | 001,641,654 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2011.11.15 01:43:19 | 000,008,192 | ---- | C] () -- C:\windows\SysWow64\drivers\IntelMEFWVer.dll
[2011.07.29 13:40:44 | 000,000,035 | ---- | C] () -- C:\windows\DELL_LANGCODE.ini
[2011.07.29 13:40:44 | 000,000,033 | ---- | C] () -- C:\windows\DELL_OSTYPE.ini
[2011.05.12 07:57:52 | 000,059,904 | ---- | C] () -- C:\windows\SysWow64\OVDecode.dll
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.07.16 16:00:16 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\4Free
[2012.09.19 06:44:03 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\Amazon
[2012.06.12 20:09:55 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\Canon
[2011.12.09 11:17:40 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\DigitalPersona
[2012.01.29 14:03:08 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\DVDVideoSoft
[2012.01.29 13:58:55 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.05.18 12:53:27 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\elsterformular
[2012.09.09 21:52:40 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\FileZilla
[2012.07.28 19:52:46 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\Foxit Software
[2011.12.31 14:21:35 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\FRITZ!
[2012.01.24 21:10:15 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\GAEB-Viewer 2009
[2012.01.24 21:10:23 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\GKsrv
[2011.12.15 07:33:35 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\IDT
[2012.06.10 18:41:34 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\IrfanView
[2012.04.08 15:40:46 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\Leadertech
[2011.12.09 19:40:03 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\Lexware
[2011.12.09 12:14:26 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\NASNaviator2
[2012.08.09 20:42:49 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\OpenOffice.org
[2011.12.10 17:37:16 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\PCDr
[2012.04.11 22:48:45 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\PhotoScape
[2012.06.17 11:58:30 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\Sony
[2011.12.31 18:09:40 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\TeamViewer
[2012.06.30 16:59:05 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\Telekom
[2012.06.30 17:05:39 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\Telekom Internet Manager
[2012.09.19 20:04:16 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\TightVNC
[2012.06.16 15:57:14 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\Titanium
[2012.08.12 12:58:56 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\TuneUp Software
[2012.07.14 15:34:42 | 000,000,000 | ---D | M] -- C:\Users\JWN\AppData\Roaming\XnView
[2012.09.19 16:53:54 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Amazon
[2012.08.19 23:07:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\BrowserCompanion
[2012.08.19 23:10:32 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\convert
[2011.12.09 20:17:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DataDesign
[2011.12.09 18:47:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DigitalPersona
[2012.08.19 23:17:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\EAC
[2011.12.09 19:09:41 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\elsterformular
[2012.09.04 13:59:23 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FileZilla
[2012.07.29 19:24:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Foxit Software
[2011.12.31 13:51:26 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FreePDF
[2011.12.31 14:00:28 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FRITZ!
[2011.12.31 13:57:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FRITZ!fax für FRITZ!Box
[2012.09.09 23:28:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\IDT
[2012.06.11 15:54:03 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\IrfanView
[2011.12.09 18:55:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Lexware
[2011.12.09 20:10:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org
[2012.09.20 21:18:59 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PCDr
[2012.08.19 21:57:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Sony
[2012.07.03 18:39:41 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Telekom
[2012.07.03 18:38:24 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Telekom Internet Manager
[2012.04.26 18:31:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TightVNC
[2012.06.16 16:27:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Titanium
[2012.08.12 17:37:20 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software
[2012.06.19 09:39:54 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\uTorrent
[2012.08.30 10:56:39 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\webex
[2012.06.08 16:46:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Windows Live Writer
[2012.07.13 16:53:26 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\YCanPDF
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.08.27 19:47:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\AccurateRip
[2011.12.09 19:03:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Adobe
[2012.09.19 16:53:54 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Amazon
[2012.06.16 16:29:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Apple Computer
[2011.12.09 18:47:52 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ATI
[2011.12.09 19:26:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Avira
[2012.08.19 23:07:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\BrowserCompanion
[2012.08.19 23:10:32 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\convert
[2012.01.05 11:59:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Corel
[2011.12.31 13:01:02 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Creative
[2011.12.09 20:17:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DataDesign
[2012.09.20 21:18:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dell
[2011.12.09 18:47:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DigitalPersona
[2012.09.06 16:31:59 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\dvdcss
[2012.08.19 23:17:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\EAC
[2011.12.09 19:09:41 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\elsterformular
[2012.09.04 13:59:23 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FileZilla
[2012.01.31 23:05:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FLEXnet
[2012.07.29 19:24:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Foxit Software
[2011.12.31 13:51:26 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FreePDF
[2011.12.31 14:00:28 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FRITZ!
[2011.12.31 13:57:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FRITZ!fax für FRITZ!Box
[2011.12.09 18:47:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Identities
[2012.09.09 23:28:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\IDT
[2011.12.09 18:56:32 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\InstallShield
[2011.12.09 18:47:53 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Intel Corporation
[2012.06.11 15:54:03 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\IrfanView
[2011.12.09 18:55:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Lexware
[2012.04.09 12:34:26 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Logitech
[2011.12.09 18:58:32 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Macromedia
[2012.09.20 17:35:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2011.11.15 03:26:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Media Center Programs
[2012.09.08 00:49:43 | 000,000,000 | --SD | M] -- C:\Users\***\AppData\Roaming\Microsoft
[2012.08.30 10:56:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Mozilla
[2011.12.09 20:10:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org
[2012.09.20 21:18:59 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PCDr
[2012.02.01 14:51:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Roxio
[2011.12.09 18:48:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Roxio Burn
[2012.07.31 13:13:52 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Skype
[2012.08.19 21:57:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Sony
[2012.07.03 18:39:41 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Telekom
[2012.07.03 18:38:24 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Telekom Internet Manager
[2012.04.26 18:31:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TightVNC
[2012.06.16 16:27:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Titanium
[2012.08.12 17:37:20 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software
[2012.06.19 09:39:54 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\uTorrent
[2012.09.19 21:09:40 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\vlc
[2012.08.30 10:56:39 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\webex
[2012.06.08 16:46:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Windows Live Writer
[2012.07.13 16:53:26 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\YCanPDF
 
< %APPDATA%\*.exe /s >
[2012.08.19 23:10:28 | 012,697,088 | ---- | M] () -- C:\Users\***\AppData\Roaming\convert\convert.exe
[2012.04.09 14:46:27 | 005,199,792 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\install_dfv12.exe
[2012.05.11 11:38:51 | 009,841,336 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\install_est09.exe
[2012.05.11 11:38:40 | 009,333,576 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\install_est10.exe
[2012.04.09 14:45:40 | 009,812,368 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\install_est11.exe
[2012.04.09 14:45:49 | 006,232,600 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\install_eur11.exe
[2012.04.09 14:46:05 | 005,933,392 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\install_gst11.exe
[2012.04.09 14:45:57 | 005,861,512 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\install_gstz11.exe
[2012.04.09 14:46:34 | 005,268,168 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\install_lsta12.exe
[2012.04.09 14:46:42 | 005,430,704 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\install_lstb12.exe
[2012.04.09 14:46:13 | 005,836,552 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\install_par34a11.exe
[2012.04.09 14:46:20 | 005,368,520 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\install_ust11.exe
[2012.04.09 14:46:49 | 005,276,584 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\install_ustva12.exe
[2011.12.31 14:49:22 | 004,051,632 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_10_7094_7699.exe
[2012.04.09 14:05:41 | 004,793,200 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_10_7699_8531.exe
[2012.05.11 11:38:58 | 004,278,000 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_10_8531_8623.exe
[2011.12.31 14:49:46 | 004,048,168 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_11_7094_7699.exe
[2012.04.09 14:06:14 | 004,795,360 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_11_7699_8531.exe
[2012.05.11 11:39:05 | 004,275,272 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_11_8531_8623.exe
[2012.05.11 11:39:12 | 004,263,360 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_12_8531_8623.exe
[2012.05.11 11:39:21 | 005,933,016 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_est_11_8531_8623.exe
[2011.12.31 14:50:11 | 004,067,576 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_09_7094_7699.exe
[2012.04.09 14:06:47 | 004,886,128 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_09_7699_8531.exe
[2012.05.11 11:39:29 | 004,315,152 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_09_8531_8623.exe
[2012.04.09 14:07:22 | 004,898,656 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_10_7094_8531.exe
[2012.05.11 11:39:36 | 004,306,704 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_10_8531_8623.exe
[2012.05.11 11:39:44 | 004,590,272 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_11_8531_8623.exe
[2012.04.09 14:09:05 | 004,819,648 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_09_7094_8531.exe
[2012.05.11 11:40:12 | 004,265,144 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_09_8531_8623.exe
[2012.04.09 14:09:36 | 004,818,640 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_10_7094_8531.exe
[2012.05.11 11:40:19 | 004,267,696 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_10_8531_8623.exe
[2012.05.11 11:40:26 | 004,503,744 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_11_8531_8623.exe
[2012.04.09 14:07:59 | 004,825,976 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_09_7094_8531.exe
[2012.05.11 11:39:51 | 004,273,960 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_09_8531_8623.exe
[2012.04.09 14:08:33 | 004,826,344 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_10_7094_8531.exe
[2012.05.11 11:39:58 | 004,274,784 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_10_8531_8623.exe
[2012.05.11 11:40:05 | 004,502,088 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_11_8531_8623.exe
[2011.12.31 14:50:35 | 004,058,240 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_10_7094_7699.exe
[2012.04.09 14:10:07 | 004,811,992 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_10_7699_8531.exe
[2012.05.11 11:40:33 | 004,268,496 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_10_8531_8623.exe
[2011.12.31 14:51:00 | 004,052,104 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_11_7094_7699.exe
[2012.04.09 14:10:38 | 004,807,168 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_11_7699_8531.exe
[2012.05.11 11:40:40 | 004,287,048 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_11_8531_8623.exe
[2012.05.11 11:40:48 | 004,266,888 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_12_8531_8623.exe
[2012.04.09 14:11:10 | 004,874,784 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_10_7094_8531.exe
[2012.05.11 11:40:55 | 004,300,392 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_10_8531_8623.exe
[2012.04.09 14:11:42 | 004,885,384 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_11_7094_8531.exe
[2012.05.11 11:41:01 | 004,301,672 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_11_8531_8623.exe
[2012.05.11 11:41:08 | 004,317,752 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_12_8531_8623.exe
[2012.04.09 14:12:15 | 005,222,624 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_09_7094_8531.exe
[2012.05.11 11:41:15 | 004,275,736 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_09_8531_8623.exe
[2012.04.09 14:12:47 | 005,222,440 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_10_7094_8531.exe
[2012.05.11 11:41:22 | 004,285,528 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_10_8531_8623.exe
[2012.05.11 11:41:29 | 004,276,464 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_11_8531_8623.exe
[2011.12.31 14:48:55 | 003,885,584 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_pica_0_7094_7699.exe
[2012.04.09 14:04:59 | 012,347,880 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_pica_0_7699_8531.exe
[2012.05.11 11:38:23 | 005,575,752 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_pica_0_8531_8623.exe
[2011.12.31 14:51:25 | 004,049,248 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_10_7094_7699.exe
[2012.04.09 14:14:23 | 004,824,504 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_10_7699_8531.exe
[2012.05.11 11:41:57 | 004,272,464 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_10_8531_8623.exe
[2011.12.31 14:51:49 | 004,051,088 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_11_7094_7699.exe
[2012.04.09 14:14:54 | 004,836,664 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_11_7699_8531.exe
[2012.05.11 11:42:04 | 004,272,624 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_11_8531_8623.exe
[2012.05.11 11:42:11 | 004,288,952 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_12_8531_8623.exe
[2012.04.09 14:13:19 | 004,845,432 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_09_7094_8531.exe
[2012.05.11 11:41:36 | 004,286,664 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_09_8531_8623.exe
[2012.04.09 14:13:51 | 004,858,144 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_10_7094_8531.exe
[2012.05.11 11:41:43 | 004,283,280 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_10_8531_8623.exe
[2012.05.11 11:41:50 | 004,288,336 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\***\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_11_8531_8623.exe
[2010.12.28 14:43:30 | 000,116,064 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Users\***\AppData\Roaming\Telekom Internet Manager\ouc.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2010.11.07 01:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\windows\SysNative\drivers\iaStor.sys
[2010.11.07 01:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_710b330fb3531234\iaStor.sys
[2010.11.07 01:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\windows\SysNative\DriverStore\FileRepository\iastor.inf_amd64_neutral_05602dde0a28e7f4\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\windows\SysNative\netlogon.dll
[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\windows\SysNative\scecli.dll
[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\windows\SysNative\user32.dll
[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\windows\SysNative\userinit.exe
[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\windows\SysNative\winlogon.exe
[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2012.09.07 17:04:42 | 000,218,696 | ---- | M] () MD5=4E0D8C9F83B7FD82393F7D8CCC27E7AE -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<           >
[2009.07.14 07:08:49 | 000,000,006 | -H-- | C] () -- C:\windows\Tasks\SA.DAT
[2009.07.14 07:08:49 | 000,032,620 | ---- | C] () -- C:\windows\Tasks\SCHEDLGU.TXT
[2011.12.15 22:36:49 | 000,001,100 | ---- | C] () -- C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
[2011.12.15 22:36:50 | 000,001,104 | ---- | C] () -- C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
[2012.04.06 16:55:08 | 000,000,884 | ---- | C] () -- C:\windows\Tasks\Adobe Flash Player Updater.job
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:04853F41

< End of report >
         

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

:OTL
IE - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - No CLSID value found
IE - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\..\SearchScopes\{D143B2A6-E12C-462D-91A0-529F2BABB055}: "URL" = http://de.yhs4.search.yahoo.com/yhs/search?hsimp=yhs-affiliate_a&hspart=greentree&type=386496_yhs2tst&p={searchTerms}
FF - prefs.js..browser.search.defaultengine: "ACPro"
FF - prefs.js..browser.search.defaultenginename: "ACPro"
FF - prefs.js..browser.search.order.1: "ACPro"
FF - prefs.js..browser.search.param.yahoo-fr: "&hsimp=yhs-affiliate_a_ff&hspart=greentree&type=386496_yhs2tst"
FF - prefs.js..browser.search.useDBForOrder: false
FF - prefs.js..network.proxy.http: "94.249.183.209"
FF - prefs.js..network.proxy.http_port: 80
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
[2012.07.13 16:22:53 | 000,000,000 | ---D | M] ("Vid-Saver") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\oah3w4pc.default\extensions\crossriderapp3491@crossrider.com
[2012.09.01 22:17:53 | 000,000,000 | ---D | M] (loadtbs) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\oah3w4pc.default\extensions\software@loadtubes.com
O4 - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003..\Run: [Optimizer Pro] C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\JWN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RazossUpdater.lnk =  File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2725837831-1970508661-3027973908-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun =  [binary data]
O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{8e8a7dc2-7973-11e1-92b2-60d819219980}\Shell - "" = AutoRun
O33 - MountPoints2\{8e8a7dc2-7973-11e1-92b2-60d819219980}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{8e8a7dc9-7973-11e1-92b2-60d819219980}\Shell - "" = AutoRun
O33 - MountPoints2\{8e8a7dc9-7973-11e1-92b2-60d819219980}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{8e8a7dd4-7973-11e1-92b2-60d819219980}\Shell - "" = AutoRun
O33 - MountPoints2\{8e8a7dd4-7973-11e1-92b2-60d819219980}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{ec5a3a4e-c0f2-11e1-adf0-60d819219980}\Shell - "" = AutoRun
O33 - MountPoints2\{ec5a3a4e-c0f2-11e1-adf0-60d819219980}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{ec5a3a5c-c0f2-11e1-adf0-60d819219980}\Shell - "" = AutoRun
O33 - MountPoints2\{ec5a3a5c-c0f2-11e1-adf0-60d819219980}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{ec5a3baf-c0f2-11e1-adf0-60d819219980}\Shell - "" = AutoRun
O33 - MountPoints2\{ec5a3baf-c0f2-11e1-adf0-60d819219980}\Shell\AutoRun\command - "" = E:\AutoRun.exe
@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:04853F41
:Files
C:\Users\JWN\Downloads\FLVPlayerSetup (1).exe
C:\Users\JWN\Downloads\FLVPlayerSetup.exe
C:\Users\JWN\Downloads\SoftonicDownloader_fuer_4free-video-converter.exe
C:\Users\JWN\Downloads\SoftonicDownloader_fuer_hamster-free-video-converter.exe
C:\Users\***\AppData\Local\{*
C:\ProgramData\*.pad
C:\ProgramData\*.dat
C:\Program Files (x86)\Optimizer Pro
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
         

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Das kam nach einem neustart.
Nach dem Scan sagte er kritischer Fehler. Rechner wird gleich neu gestartet.

LOgFile

Files\Folders moved on Reboot...
File\Folder C:\Users\JWN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RazossUpdater.lnk not found!

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
         

Den Fix bitte wiederholen

Jetzt hat es geklappt. Ich hatte es als erstes nicht als Admin ausgeführt.

Hier das Ergebnis:

All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-2725837831-1970508661-3027973908-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\{40c3cc16-7269-4b32-9531-17f2950fb06f} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40c3cc16-7269-4b32-9531-17f2950fb06f}\ not found.
HKEY_USERS\S-1-5-21-2725837831-1970508661-3027973908-1003\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-2725837831-1970508661-3027973908-1003\Software\Microsoft\Internet Explorer\SearchScopes\{D143B2A6-E12C-462D-91A0-529F2BABB055}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D143B2A6-E12C-462D-91A0-529F2BABB055}\ not found.
Prefs.js: "ACPro" removed from browser.search.defaultengine
Prefs.js: "ACPro" removed from browser.search.defaultenginename
Prefs.js: "ACPro" removed from browser.search.order.1
Prefs.js: "&hsimp=yhs-affiliate_a_ff&hspart=greentree&type=386496_yhs2tst" removed from browser.search.param.yahoo-fr
Prefs.js: false removed from browser.search.useDBForOrder
Prefs.js: "94.249.183.209" removed from network.proxy.http
Prefs.js: 80 removed from network.proxy.http_port
Prefs.js: 0 removed from network.proxy.type
Folder C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\oah3w4pc.default\extensions\crossriderapp3491@crossrider.com\ not found.
Folder C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\oah3w4pc.default\extensions\software@loadtubes.com\ not found.
Registry value HKEY_USERS\S-1-5-21-2725837831-1970508661-3027973908-1003\Software\Microsoft\Windows\CurrentVersion\Run\\Optimizer Pro not found.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin not found.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin not found.
File move failed. C:\Users\JWN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RazossUpdater.lnk scheduled to be moved on reboot.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\SoftwareSASGeneration not found.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-21-2725837831-1970508661-3027973908-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry value HKEY_USERS\S-1-5-21-2725837831-1970508661-3027973908-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{7815BE26-237D-41A8-A98F-F7BD75F71086}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7815BE26-237D-41A8-A98F-F7BD75F71086}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e8a7dc2-7973-11e1-92b2-60d819219980}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e8a7dc2-7973-11e1-92b2-60d819219980}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e8a7dc2-7973-11e1-92b2-60d819219980}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e8a7dc2-7973-11e1-92b2-60d819219980}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e8a7dc9-7973-11e1-92b2-60d819219980}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e8a7dc9-7973-11e1-92b2-60d819219980}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e8a7dc9-7973-11e1-92b2-60d819219980}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e8a7dc9-7973-11e1-92b2-60d819219980}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e8a7dd4-7973-11e1-92b2-60d819219980}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e8a7dd4-7973-11e1-92b2-60d819219980}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e8a7dd4-7973-11e1-92b2-60d819219980}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e8a7dd4-7973-11e1-92b2-60d819219980}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec5a3a4e-c0f2-11e1-adf0-60d819219980}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec5a3a4e-c0f2-11e1-adf0-60d819219980}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec5a3a4e-c0f2-11e1-adf0-60d819219980}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec5a3a4e-c0f2-11e1-adf0-60d819219980}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec5a3a5c-c0f2-11e1-adf0-60d819219980}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec5a3a5c-c0f2-11e1-adf0-60d819219980}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec5a3a5c-c0f2-11e1-adf0-60d819219980}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec5a3a5c-c0f2-11e1-adf0-60d819219980}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec5a3baf-c0f2-11e1-adf0-60d819219980}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec5a3baf-c0f2-11e1-adf0-60d819219980}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec5a3baf-c0f2-11e1-adf0-60d819219980}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec5a3baf-c0f2-11e1-adf0-60d819219980}\ not found.
File E:\AutoRun.exe not found.
Unable to delete ADS C:\ProgramData\Temp:04853F41 .
========== FILES ==========
File\Folder C:\Users\JWN\Downloads\FLVPlayerSetup (1).exe not found.
File\Folder C:\Users\JWN\Downloads\FLVPlayerSetup.exe not found.
File\Folder C:\Users\JWN\Downloads\SoftonicDownloader_fuer_4free-video-converter.exe not found.
File\Folder C:\Users\JWN\Downloads\SoftonicDownloader_fuer_hamster-free-video-converter.exe not found.
File\Folder C:\Users\***\AppData\Local\{* not found.
File\Folder C:\ProgramData\*.pad not found.
File\Folder C:\ProgramData\*.dat not found.
File\Folder C:\Program Files (x86)\Optimizer Pro not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\***\Desktop\cmd.bat deleted successfully.
C:\Users\***\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: JWN
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 265399199 bytes
->Google Chrome cache emptied: 6443820 bytes
->Flash cache emptied: 946 bytes
 
User: Public
 
User: ***
->Temp folder emptied: 386044691 bytes
->Temporary Internet Files folder emptied: 173599662 bytes
->Java cache emptied: 2462736 bytes
->FireFox cache emptied: 84905428 bytes
->Google Chrome cache emptied: 383905581 bytes
->Flash cache emptied: 1703 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 96254 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67899 bytes
RecycleBin emptied: 26309307653 bytes
 
Total Files Cleaned = 26.333,00 mb
 
C:\windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.68.0 log created on 09272012_214817

Files\Folders moved on Reboot...
File\Folder C:\Users\JWN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RazossUpdater.lnk not found!
C:\Users\***\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
         

Info:
Die Datei RazossUpdater ist im OTL Ordner verschoben worden. Warum not found weiß ich nicht.

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

Scan durchgeführt und hier das Ergebnis:

22:18:52.0550 3320  TDSS rootkit removing tool 2.8.10.0 Sep 17 2012 19:23:24
22:18:52.0878 3320  ============================================================
22:18:52.0878 3320  Current date / time: 2012/09/27 22:18:52.0878
22:18:52.0878 3320  SystemInfo:
22:18:52.0878 3320  
22:18:52.0878 3320  OS Version: 6.1.7601 ServicePack: 1.0
22:18:52.0878 3320  Product type: Workstation
22:18:52.0878 3320  ComputerName: JWN-PC
22:18:52.0879 3320  UserName: ***
22:18:52.0879 3320  Windows directory: C:\windows
22:18:52.0879 3320  System windows directory: C:\windows
22:18:52.0879 3320  Running under WOW64
22:18:52.0879 3320  Processor architecture: Intel x64
22:18:52.0879 3320  Number of processors: 4
22:18:52.0879 3320  Page size: 0x1000
22:18:52.0879 3320  Boot type: Normal boot
22:18:52.0879 3320  ============================================================
22:18:53.0301 3320  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
22:18:53.0309 3320  Drive \Device\Harddisk1\DR1 - Size: 0xF1800000 (3.77 Gb), SectorSize: 0x200, Cylinders: 0x1EC, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
22:18:53.0312 3320  Drive \Device\Harddisk2\DR2 - Size: 0x75E00000 (1.84 Gb), SectorSize: 0x200, Cylinders: 0xF0, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
22:18:53.0317 3320  ============================================================
22:18:53.0317 3320  \Device\Harddisk0\DR0:
22:18:53.0317 3320  MBR partitions:
22:18:53.0317 3320  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x1D4C000
22:18:53.0317 3320  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1D7E800, BlocksNum 0x38607030
22:18:53.0317 3320  \Device\Harddisk1\DR1:
22:18:53.0318 3320  MBR partitions:
22:18:53.0318 3320  \Device\Harddisk1\DR1\Partition1: MBR, Type 0xC, StartLBA 0x20, BlocksNum 0x78BFE0
22:18:53.0318 3320  \Device\Harddisk2\DR2:
22:18:53.0320 3320  MBR partitions:
22:18:53.0320 3320  \Device\Harddisk2\DR2\Partition1: MBR, Type 0x6, StartLBA 0x87, BlocksNum 0x3AE039
22:18:53.0320 3320  ============================================================
22:18:53.0379 3320  C: <-> \Device\Harddisk0\DR0\Partition2
22:18:53.0379 3320  ============================================================
22:18:53.0379 3320  Initialize success
22:18:53.0379 3320  ============================================================
22:20:35.0834 3444  ============================================================
22:20:35.0834 3444  Scan started
22:20:35.0834 3444  Mode: Manual; SigCheck; TDLFS; 
22:20:35.0834 3444  ============================================================
22:20:35.0958 3444  ================ Scan system memory ========================
22:20:35.0958 3444  System memory - ok
22:20:35.0958 3444  ================ Scan services =============================
22:20:36.0114 3444  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\windows\system32\drivers\1394ohci.sys
22:20:36.0224 3444  1394ohci - ok
22:20:36.0302 3444  [ E0065CBF1A25C015C218457D2CD522B9 ] Acceler         C:\windows\system32\DRIVERS\Accelern.sys
22:20:36.0692 3444  Acceler - ok
22:20:36.0707 3444  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\windows\system32\drivers\ACPI.sys
22:20:36.0723 3444  ACPI - ok
22:20:36.0738 3444  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi         C:\windows\system32\drivers\acpipmi.sys
22:20:36.0816 3444  AcpiPmi - ok
22:20:36.0941 3444  [ B2B64AF436FACCFA854DD397027C5360 ] AdobeFlashPlayerUpdateSvc C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
22:20:36.0972 3444  AdobeFlashPlayerUpdateSvc - ok
22:20:37.0019 3444  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx         C:\windows\system32\drivers\adp94xx.sys
22:20:37.0066 3444  adp94xx - ok
22:20:37.0097 3444  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci         C:\windows\system32\drivers\adpahci.sys
22:20:37.0128 3444  adpahci - ok
22:20:37.0175 3444  [ E109549C90F62FB570B9540C4B148E54 ] adpu320         C:\windows\system32\drivers\adpu320.sys
22:20:37.0206 3444  adpu320 - ok
22:20:37.0222 3444  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc     C:\windows\System32\aelupsvc.dll
22:20:37.0394 3444  AeLookupSvc - ok
22:20:37.0472 3444  [ A6FB9DB8F1A86861D955FD6975977AE0 ] AESTFilters     C:\Program Files\IDT\WDM\AESTSr64.exe
22:20:37.0518 3444  AESTFilters - ok
22:20:37.0581 3444  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD             C:\windows\system32\drivers\afd.sys
22:20:37.0628 3444  AFD - ok
22:20:37.0659 3444  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\windows\system32\drivers\agp440.sys
22:20:37.0690 3444  agp440 - ok
22:20:37.0721 3444  [ 3290D6946B5E30E70414990574883DDB ] ALG             C:\windows\System32\alg.exe
22:20:37.0768 3444  ALG - ok
22:20:37.0799 3444  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\windows\system32\drivers\aliide.sys
22:20:37.0815 3444  aliide - ok
22:20:37.0846 3444  [ E6CE56BE2C8BFF7464554629829A1271 ] AMD External Events Utility C:\windows\system32\atiesrxx.exe
22:20:37.0955 3444  AMD External Events Utility - ok
22:20:37.0986 3444  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\windows\system32\drivers\amdide.sys
22:20:38.0018 3444  amdide - ok
22:20:38.0033 3444  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8           C:\windows\system32\drivers\amdk8.sys
22:20:38.0080 3444  AmdK8 - ok
22:20:38.0298 3444  [ E3CC08F03C55A284FBFD79071822DF43 ] amdkmdag        C:\windows\system32\DRIVERS\atikmdag.sys
22:20:38.0486 3444  amdkmdag - ok
22:20:38.0564 3444  [ F8976E22AFD861CF67B6E2D3B4995CDB ] amdkmdap        C:\windows\system32\DRIVERS\atikmpag.sys
22:20:38.0626 3444  amdkmdap - ok
22:20:38.0657 3444  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\windows\system32\drivers\amdppm.sys
22:20:38.0720 3444  AmdPPM - ok
22:20:38.0751 3444  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata         C:\windows\system32\drivers\amdsata.sys
22:20:38.0782 3444  amdsata - ok
22:20:38.0798 3444  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\windows\system32\drivers\amdsbs.sys
22:20:38.0813 3444  amdsbs - ok
22:20:38.0844 3444  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata         C:\windows\system32\drivers\amdxata.sys
22:20:38.0844 3444  amdxata - ok
22:20:38.0938 3444  [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
22:20:38.0969 3444  AntiVirSchedulerService - ok
22:20:38.0985 3444  [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
22:20:39.0000 3444  AntiVirService - ok
22:20:39.0032 3444  [ 89A69C3F2F319B43379399547526D952 ] AppID           C:\windows\system32\drivers\appid.sys
22:20:39.0188 3444  AppID - ok
22:20:39.0219 3444  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\windows\System32\appidsvc.dll
22:20:39.0297 3444  AppIDSvc - ok
22:20:39.0297 3444  [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo         C:\windows\System32\appinfo.dll
22:20:39.0344 3444  Appinfo - ok
22:20:39.0375 3444  [ C484F8CEB1717C540242531DB7845C4E ] arc             C:\windows\system32\drivers\arc.sys
22:20:39.0390 3444  arc - ok
22:20:39.0390 3444  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\windows\system32\drivers\arcsas.sys
22:20:39.0406 3444  arcsas - ok
22:20:39.0453 3444  ASPI - ok
22:20:39.0515 3444  [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state    C:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
22:20:39.0562 3444  aspnet_state - ok
22:20:39.0593 3444  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\windows\system32\DRIVERS\asyncmac.sys
22:20:39.0671 3444  AsyncMac - ok
22:20:39.0687 3444  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi           C:\windows\system32\drivers\atapi.sys
22:20:39.0702 3444  atapi - ok
22:20:39.0734 3444  [ CBE61B4494165F458BD87E37181EE934 ] AthBTPort       C:\windows\system32\DRIVERS\btath_flt.sys
22:20:39.0749 3444  AthBTPort - ok
22:20:39.0827 3444  [ 650F111D5CDA64C10AE4B9D1BA9D4FFF ] Atheros Bt&Wlan Coex Agent C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe
22:20:39.0843 3444  Atheros Bt&Wlan Coex Agent - ok
22:20:39.0890 3444  [ 44FB485B94A8332D877F659366CEDBC8 ] AtherosSvc      C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe
22:20:39.0905 3444  AtherosSvc - ok
22:20:39.0983 3444  [ 5493ED5D300AFC7A9A0A87FCA08E5381 ] athr            C:\windows\system32\DRIVERS\athrx.sys
22:20:40.0077 3444  athr - ok
22:20:40.0155 3444  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\windows\System32\Audiosrv.dll
22:20:40.0248 3444  AudioEndpointBuilder - ok
22:20:40.0264 3444  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\windows\System32\Audiosrv.dll
22:20:40.0295 3444  AudioSrv - ok
22:20:40.0295 3444  [ 26E38B5A58C6C55FAFBC563EEDDB0867 ] avgntflt        C:\windows\system32\DRIVERS\avgntflt.sys
22:20:40.0311 3444  avgntflt - ok
22:20:40.0342 3444  [ 9D1F00BEFF84CBBF46D7F052BC7E0565 ] avipbb          C:\windows\system32\DRIVERS\avipbb.sys
22:20:40.0358 3444  avipbb - ok
22:20:40.0373 3444  [ 248DB59FC86DE44D2779F4C7FB1A567D ] avkmgr          C:\windows\system32\DRIVERS\avkmgr.sys
22:20:40.0389 3444  avkmgr - ok
22:20:40.0420 3444  [ 1DC2F715792CF33428AD7993ACBD224D ] avmeject        C:\windows\system32\drivers\avmeject.sys
22:20:40.0451 3444  avmeject - ok
22:20:40.0498 3444  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\windows\System32\AxInstSV.dll
22:20:40.0560 3444  AxInstSV - ok
22:20:40.0623 3444  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv         C:\windows\system32\drivers\bxvbda.sys
22:20:40.0670 3444  b06bdrv - ok
22:20:40.0716 3444  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\windows\system32\DRIVERS\b57nd60a.sys
22:20:40.0779 3444  b57nd60a - ok
22:20:40.0794 3444  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\windows\System32\bdesvc.dll
22:20:40.0826 3444  BDESVC - ok
22:20:40.0872 3444  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\windows\system32\drivers\Beep.sys
22:20:40.0950 3444  Beep - ok
22:20:41.0028 3444  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE             C:\windows\System32\bfe.dll
22:20:41.0075 3444  BFE - ok
22:20:41.0122 3444  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\windows\System32\qmgr.dll
22:20:41.0200 3444  BITS - ok
22:20:41.0216 3444  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\windows\system32\DRIVERS\blbdrive.sys
22:20:41.0247 3444  blbdrive - ok
22:20:41.0262 3444  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\windows\system32\DRIVERS\bowser.sys
22:20:41.0340 3444  bowser - ok
22:20:41.0356 3444  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\windows\system32\drivers\BrFiltLo.sys
22:20:41.0403 3444  BrFiltLo - ok
22:20:41.0418 3444  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\windows\system32\drivers\BrFiltUp.sys
22:20:41.0434 3444  BrFiltUp - ok
22:20:41.0450 3444  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser         C:\windows\System32\browser.dll
22:20:41.0481 3444  Browser - ok
22:20:41.0512 3444  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid         C:\windows\System32\Drivers\Brserid.sys
22:20:41.0559 3444  Brserid - ok
22:20:41.0574 3444  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\windows\System32\Drivers\BrSerWdm.sys
22:20:41.0621 3444  BrSerWdm - ok
22:20:41.0621 3444  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\windows\System32\Drivers\BrUsbMdm.sys
22:20:41.0637 3444  BrUsbMdm - ok
22:20:41.0652 3444  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\windows\System32\Drivers\BrUsbSer.sys
22:20:41.0668 3444  BrUsbSer - ok
22:20:41.0746 3444  [ FE70889A85C57A9268101B2DB0474509 ] BTATH_A2DP      C:\windows\system32\drivers\btath_a2dp.sys
22:20:41.0777 3444  BTATH_A2DP - ok
22:20:41.0808 3444  [ A9DF22429E8D69ED849B0BBBE16BD327 ] BTATH_BUS       C:\windows\system32\DRIVERS\btath_bus.sys
22:20:41.0824 3444  BTATH_BUS - ok
22:20:41.0840 3444  [ C864FF85EE16D61C2BDD5EF76824625F ] BTATH_HCRP      C:\windows\system32\DRIVERS\btath_hcrp.sys
22:20:41.0840 3444  BTATH_HCRP - ok
22:20:41.0871 3444  [ 0DEA505EFB5D771826D177EF8B8A208F ] BTATH_LWFLT     C:\windows\system32\DRIVERS\btath_lwflt.sys
22:20:41.0886 3444  BTATH_LWFLT - ok
22:20:41.0918 3444  [ 724C8088C96EFE7A3E63FEC21D4681C0 ] BTATH_RCP       C:\windows\system32\DRIVERS\btath_rcp.sys
22:20:41.0918 3444  BTATH_RCP - ok
22:20:42.0011 3444  [ FF59EE1DDAC776246F43BF434194650F ] BtFilter        C:\windows\system32\DRIVERS\btfilter.sys
22:20:42.0027 3444  BtFilter - ok
22:20:42.0074 3444  [ CF98190A94F62E405C8CB255018B2315 ] BthEnum         C:\windows\system32\drivers\BthEnum.sys
22:20:42.0152 3444  BthEnum - ok
22:20:42.0183 3444  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\windows\system32\DRIVERS\bthmodem.sys
22:20:42.0230 3444  BTHMODEM - ok
22:20:42.0261 3444  [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan          C:\windows\system32\DRIVERS\bthpan.sys
22:20:42.0292 3444  BthPan - ok
22:20:42.0370 3444  [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT         C:\windows\System32\Drivers\BTHport.sys
22:20:42.0417 3444  BTHPORT - ok
22:20:42.0479 3444  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv         C:\windows\system32\bthserv.dll
22:20:42.0542 3444  bthserv - ok
22:20:42.0557 3444  [ F188B7394D81010767B6DF3178519A37 ] BTHUSB          C:\windows\System32\Drivers\BTHUSB.sys
22:20:42.0620 3444  BTHUSB - ok
22:20:42.0651 3444  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\windows\system32\DRIVERS\cdfs.sys
22:20:42.0713 3444  cdfs - ok
22:20:42.0744 3444  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom           C:\windows\system32\DRIVERS\cdrom.sys
22:20:42.0760 3444  cdrom - ok
22:20:42.0791 3444  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc     C:\windows\System32\certprop.dll
22:20:42.0838 3444  CertPropSvc - ok
22:20:42.0854 3444  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\windows\system32\drivers\circlass.sys
22:20:42.0885 3444  circlass - ok
22:20:42.0900 3444  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\windows\system32\CLFS.sys
22:20:42.0916 3444  CLFS - ok
22:20:42.0963 3444  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
22:20:42.0994 3444  clr_optimization_v2.0.50727_32 - ok
22:20:43.0025 3444  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
22:20:43.0056 3444  clr_optimization_v2.0.50727_64 - ok
22:20:43.0119 3444  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
22:20:43.0181 3444  clr_optimization_v4.0.30319_32 - ok
22:20:43.0197 3444  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
22:20:43.0212 3444  clr_optimization_v4.0.30319_64 - ok
22:20:43.0228 3444  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\windows\system32\DRIVERS\CmBatt.sys
22:20:43.0259 3444  CmBatt - ok
22:20:43.0275 3444  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\windows\system32\drivers\cmdide.sys
22:20:43.0290 3444  cmdide - ok
22:20:43.0353 3444  [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG             C:\windows\system32\Drivers\cng.sys
22:20:43.0384 3444  CNG - ok
22:20:43.0415 3444  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\windows\system32\drivers\compbatt.sys
22:20:43.0415 3444  Compbatt - ok
22:20:43.0431 3444  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\windows\system32\DRIVERS\CompositeBus.sys
22:20:43.0446 3444  CompositeBus - ok
22:20:43.0446 3444  COMSysApp - ok
22:20:43.0478 3444  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk         C:\windows\system32\drivers\crcdisk.sys
22:20:43.0493 3444  crcdisk - ok
22:20:43.0524 3444  [ 4F5414602E2544A4554D95517948B705 ] CryptSvc        C:\windows\system32\cryptsvc.dll
22:20:43.0602 3444  CryptSvc - ok
22:20:43.0649 3444  [ DF214BFF646880D0EB31BDC86136B29B ] CtClsFlt        C:\windows\system32\DRIVERS\CtClsFlt.sys
22:20:43.0696 3444  CtClsFlt - ok
22:20:43.0743 3444  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\windows\system32\rpcss.dll
22:20:43.0790 3444  DcomLaunch - ok
22:20:43.0821 3444  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc       C:\windows\System32\defragsvc.dll
22:20:43.0883 3444  defragsvc - ok
22:20:43.0899 3444  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\windows\system32\Drivers\dfsc.sys
22:20:43.0930 3444  DfsC - ok
22:20:43.0961 3444  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\windows\system32\dhcpcore.dll
22:20:44.0008 3444  Dhcp - ok
22:20:44.0024 3444  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\windows\system32\drivers\discache.sys
22:20:44.0055 3444  discache - ok
22:20:44.0070 3444  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\windows\system32\drivers\disk.sys
22:20:44.0086 3444  Disk - ok
22:20:44.0117 3444  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\windows\System32\dnsrslvr.dll
22:20:44.0133 3444  Dnscache - ok
22:20:44.0148 3444  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc         C:\windows\System32\dot3svc.dll
22:20:44.0211 3444  dot3svc - ok
22:20:44.0289 3444  [ C43618154FC0C8480F53B04BA7A2F371 ] DpHost          C:\Program Files\DigitalPersona\Bin\DpHostW.exe
22:20:44.0320 3444  DpHost - ok
22:20:44.0336 3444  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS             C:\windows\system32\dps.dll
22:20:44.0398 3444  DPS - ok
22:20:44.0445 3444  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud         C:\windows\system32\drivers\drmkaud.sys
22:20:44.0492 3444  drmkaud - ok
22:20:44.0523 3444  [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl         C:\windows\System32\drivers\dxgkrnl.sys
22:20:44.0538 3444  DXGKrnl - ok
22:20:44.0585 3444  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost         C:\windows\System32\eapsvc.dll
22:20:44.0632 3444  EapHost - ok
22:20:44.0710 3444  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv           C:\windows\system32\drivers\evbda.sys
22:20:44.0772 3444  ebdrv - ok
22:20:44.0804 3444  [ C118A82CD78818C29AB228366EBF81C3 ] EFS             C:\windows\System32\lsass.exe
22:20:44.0882 3444  EFS - ok
22:20:44.0960 3444  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr         C:\windows\ehome\ehRecvr.exe
22:20:45.0069 3444  ehRecvr - ok
22:20:45.0084 3444  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched         C:\windows\ehome\ehsched.exe
22:20:45.0131 3444  ehSched - ok
22:20:45.0178 3444  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor         C:\windows\system32\drivers\elxstor.sys
22:20:45.0209 3444  elxstor - ok
22:20:45.0240 3444  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\windows\system32\drivers\errdev.sys
22:20:45.0272 3444  ErrDev - ok
22:20:45.0303 3444  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem     C:\windows\system32\es.dll
22:20:45.0350 3444  EventSystem - ok
22:20:45.0412 3444  ew_hwusbdev - ok
22:20:45.0443 3444  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat           C:\windows\system32\drivers\exfat.sys
22:20:45.0506 3444  exfat - ok
22:20:45.0521 3444  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat         C:\windows\system32\drivers\fastfat.sys
22:20:45.0552 3444  fastfat - ok
22:20:45.0599 3444  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax             C:\windows\system32\fxssvc.exe
22:20:45.0662 3444  Fax - ok
22:20:45.0677 3444  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc             C:\windows\system32\drivers\fdc.sys
22:20:45.0693 3444  fdc - ok
22:20:45.0724 3444  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost         C:\windows\system32\fdPHost.dll
22:20:45.0802 3444  fdPHost - ok
22:20:45.0802 3444  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\windows\system32\fdrespub.dll
22:20:45.0849 3444  FDResPub - ok
22:20:45.0864 3444  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\windows\system32\drivers\fileinfo.sys
22:20:45.0864 3444  FileInfo - ok
22:20:45.0880 3444  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace       C:\windows\system32\drivers\filetrace.sys
22:20:45.0927 3444  Filetrace - ok
22:20:45.0942 3444  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\windows\system32\drivers\flpydisk.sys
22:20:45.0958 3444  flpydisk - ok
22:20:45.0989 3444  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\windows\system32\drivers\fltmgr.sys
22:20:45.0989 3444  FltMgr - ok
22:20:46.0036 3444  [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache       C:\windows\system32\FntCache.dll
22:20:46.0114 3444  FontCache - ok
22:20:46.0161 3444  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
22:20:46.0176 3444  FontCache3.0.0.0 - ok
22:20:46.0192 3444  [ D43703496149971890703B4B1B723EAC ] FsDepends       C:\windows\system32\drivers\FsDepends.sys
22:20:46.0208 3444  FsDepends - ok
22:20:46.0223 3444  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\windows\system32\drivers\Fs_Rec.sys
22:20:46.0239 3444  Fs_Rec - ok
22:20:46.0270 3444  [ 1F7B25B858FA27015169FE95E54108ED ] fvevol          C:\windows\system32\DRIVERS\fvevol.sys
22:20:46.0301 3444  fvevol - ok
22:20:46.0332 3444  [ 444534CBA693DD23C1CC589681E01656 ] FWLANUSB        C:\windows\system32\DRIVERS\fwlanusb.sys
22:20:46.0364 3444  FWLANUSB ( UnsignedFile.Multi.Generic ) - warning
22:20:46.0364 3444  FWLANUSB - detected UnsignedFile.Multi.Generic (1)
22:20:46.0379 3444  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\windows\system32\drivers\gagp30kx.sys
22:20:46.0410 3444  gagp30kx - ok
22:20:46.0442 3444  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc           C:\windows\System32\gpsvc.dll
22:20:46.0504 3444  gpsvc - ok
22:20:46.0566 3444  [ F02A533F517EB38333CB12A9E8963773 ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
22:20:46.0582 3444  gupdate - ok
22:20:46.0598 3444  [ F02A533F517EB38333CB12A9E8963773 ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
22:20:46.0598 3444  gupdatem - ok
22:20:46.0613 3444  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\windows\system32\drivers\hcw85cir.sys
22:20:46.0644 3444  hcw85cir - ok
22:20:46.0691 3444  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\windows\system32\drivers\HdAudio.sys
22:20:46.0738 3444  HdAudAddService - ok
22:20:46.0769 3444  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\windows\system32\DRIVERS\HDAudBus.sys
22:20:46.0800 3444  HDAudBus - ok
22:20:46.0832 3444  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt         C:\windows\system32\drivers\HidBatt.sys
22:20:46.0863 3444  HidBatt - ok
22:20:46.0878 3444  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\windows\system32\DRIVERS\hidbth.sys
22:20:46.0925 3444  HidBth - ok
22:20:46.0941 3444  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr           C:\windows\system32\drivers\hidir.sys
22:20:46.0972 3444  HidIr - ok
22:20:47.0003 3444  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv         C:\windows\system32\hidserv.dll
22:20:47.0081 3444  hidserv - ok
22:20:47.0112 3444  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\windows\system32\DRIVERS\hidusb.sys
22:20:47.0128 3444  HidUsb - ok
22:20:47.0237 3444  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\windows\system32\kmsvc.dll
22:20:47.0300 3444  hkmsvc - ok
22:20:47.0315 3444  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\windows\system32\ListSvc.dll
22:20:47.0331 3444  HomeGroupListener - ok
22:20:47.0362 3444  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\windows\system32\provsvc.dll
22:20:47.0393 3444  HomeGroupProvider - ok
22:20:47.0424 3444  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\windows\system32\drivers\HpSAMD.sys
22:20:47.0440 3444  HpSAMD - ok
22:20:47.0456 3444  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\windows\system32\drivers\HTTP.sys
22:20:47.0534 3444  HTTP - ok
22:20:47.0549 3444  huawei_cdcacm - ok
22:20:47.0565 3444  huawei_enumerator - ok
22:20:47.0580 3444  hwdatacard - ok
22:20:47.0627 3444  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\windows\system32\drivers\hwpolicy.sys
22:20:47.0658 3444  hwpolicy - ok
22:20:47.0690 3444  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\windows\system32\DRIVERS\i8042prt.sys
22:20:47.0690 3444  i8042prt - ok
22:20:47.0705 3444  [ D7921D5A870B11CC1ADAB198A519D50A ] iaStor          C:\windows\system32\DRIVERS\iaStor.sys
22:20:47.0721 3444  iaStor - ok
22:20:47.0799 3444  [ 8FFF9083252C16FE3960173722605E9E ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
22:20:47.0814 3444  IAStorDataMgrSvc - ok
22:20:47.0846 3444  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV         C:\windows\system32\drivers\iaStorV.sys
22:20:47.0861 3444  iaStorV - ok
22:20:47.0939 3444  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc           C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
22:20:47.0986 3444  idsvc - ok
22:20:48.0002 3444  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp           C:\windows\system32\drivers\iirsp.sys
22:20:48.0002 3444  iirsp - ok
22:20:48.0048 3444  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\windows\System32\ikeext.dll
22:20:48.0095 3444  IKEEXT - ok
22:20:48.0142 3444  [ FC727061C0F47C8059E88E05D5C8E381 ] IntcDAud        C:\windows\system32\DRIVERS\IntcDAud.sys
22:20:48.0189 3444  IntcDAud - ok
22:20:48.0220 3444  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\windows\system32\drivers\intelide.sys
22:20:48.0236 3444  intelide - ok
22:20:48.0470 3444  [ 33FAA40B288002C89529DBD14F3AB72C ] intelkmd        C:\windows\system32\DRIVERS\igdpmd64.sys
22:20:48.0766 3444  intelkmd - ok
22:20:48.0797 3444  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\windows\system32\DRIVERS\intelppm.sys
22:20:48.0813 3444  intelppm - ok
22:20:48.0860 3444  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum       C:\windows\system32\ipbusenum.dll
22:20:48.0922 3444  IPBusEnum - ok
22:20:48.0953 3444  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\windows\system32\DRIVERS\ipfltdrv.sys
22:20:48.0984 3444  IpFilterDriver - ok
22:20:49.0016 3444  [ A34A587FFFD45FA649FBA6D03784D257 ] iphlpsvc        C:\windows\System32\iphlpsvc.dll
22:20:49.0094 3444  iphlpsvc - ok
22:20:49.0125 3444  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV         C:\windows\system32\drivers\IPMIDrv.sys
22:20:49.0140 3444  IPMIDRV - ok
22:20:49.0156 3444  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT           C:\windows\system32\drivers\ipnat.sys
22:20:49.0250 3444  IPNAT - ok
22:20:49.0265 3444  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\windows\system32\drivers\irenum.sys
22:20:49.0281 3444  IRENUM - ok
22:20:49.0296 3444  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\windows\system32\drivers\isapnp.sys
22:20:49.0312 3444  isapnp - ok
22:20:49.0328 3444  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\windows\system32\drivers\msiscsi.sys
22:20:49.0390 3444  iScsiPrt - ok
22:20:49.0390 3444  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\windows\system32\DRIVERS\kbdclass.sys
22:20:49.0390 3444  kbdclass - ok
22:20:49.0406 3444  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\windows\system32\DRIVERS\kbdhid.sys
22:20:49.0437 3444  kbdhid - ok
22:20:49.0468 3444  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\windows\system32\lsass.exe
22:20:49.0484 3444  KeyIso - ok
22:20:49.0530 3444  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\windows\system32\Drivers\ksecdd.sys
22:20:49.0546 3444  KSecDD - ok
22:20:49.0577 3444  [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg         C:\windows\system32\Drivers\ksecpkg.sys
22:20:49.0608 3444  KSecPkg - ok
22:20:49.0624 3444  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk         C:\windows\system32\drivers\ksthunk.sys
22:20:49.0655 3444  ksthunk - ok
22:20:49.0686 3444  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm           C:\windows\system32\msdtckrm.dll
22:20:49.0764 3444  KtmRm - ok
22:20:49.0796 3444  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\windows\system32\srvsvc.dll
22:20:49.0858 3444  LanmanServer - ok
22:20:49.0874 3444  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\windows\System32\wkssvc.dll
22:20:49.0920 3444  LanmanWorkstation - ok
22:20:50.0014 3444  [ 7772DFAB22611050B79504E671B06E6E ] LBTServ         C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
22:20:50.0045 3444  LBTServ - ok
22:20:50.0092 3444  [ 241F2648ADF090E2A10095BD6D6F5DCB ] LHidFilt        C:\windows\system32\DRIVERS\LHidFilt.Sys
22:20:50.0108 3444  LHidFilt - ok
22:20:50.0139 3444  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\windows\system32\DRIVERS\lltdio.sys
22:20:50.0186 3444  lltdio - ok
22:20:50.0217 3444  [ C1185803384AB3FEED115F79F109427F ] lltdsvc         C:\windows\System32\lltdsvc.dll
22:20:50.0279 3444  lltdsvc - ok
22:20:50.0295 3444  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts         C:\windows\System32\lmhsvc.dll
22:20:50.0326 3444  lmhosts - ok
22:20:50.0342 3444  [ 342ED5A4B3326014438F36D22D803737 ] LMouFilt        C:\windows\system32\DRIVERS\LMouFilt.Sys
22:20:50.0342 3444  LMouFilt - ok
22:20:50.0404 3444  [ 0803906D607A9B83184447B75B60ECC2 ] LMS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
22:20:50.0435 3444  LMS - ok
22:20:50.0482 3444  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\windows\system32\drivers\lsi_fc.sys
22:20:50.0513 3444  LSI_FC - ok
22:20:50.0560 3444  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS         C:\windows\system32\drivers\lsi_sas.sys
22:20:50.0591 3444  LSI_SAS - ok
22:20:50.0591 3444  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\windows\system32\drivers\lsi_sas2.sys
22:20:50.0607 3444  LSI_SAS2 - ok
22:20:50.0607 3444  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\windows\system32\drivers\lsi_scsi.sys
22:20:50.0622 3444  LSI_SCSI - ok
22:20:50.0654 3444  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv           C:\windows\system32\drivers\luafv.sys
22:20:50.0700 3444  luafv - ok
22:20:50.0716 3444  [ 23488767CB18FC3FF39E3AF1DB3FB02C ] massfilter      C:\windows\system32\drivers\massfilter.sys
22:20:50.0763 3444  massfilter - ok
22:20:50.0794 3444  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc         C:\windows\system32\Mcx2Svc.dll
22:20:50.0841 3444  Mcx2Svc - ok
22:20:50.0856 3444  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas         C:\windows\system32\drivers\megasas.sys
22:20:50.0872 3444  megasas - ok
22:20:50.0903 3444  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\windows\system32\drivers\MegaSR.sys
22:20:50.0934 3444  MegaSR - ok
22:20:50.0981 3444  [ A6518DCC42F7A6E999BB3BEA8FD87567 ] MEIx64          C:\windows\system32\DRIVERS\HECIx64.sys
22:20:51.0012 3444  MEIx64 - ok
22:20:51.0028 3444  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS           C:\windows\system32\mmcss.dll
22:20:51.0090 3444  MMCSS - ok
22:20:51.0106 3444  [ 800BA92F7010378B09F9ED9270F07137 ] Modem           C:\windows\system32\drivers\modem.sys
22:20:51.0168 3444  Modem - ok
22:20:51.0200 3444  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor         C:\windows\system32\DRIVERS\monitor.sys
22:20:51.0231 3444  monitor - ok
22:20:51.0246 3444  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\windows\system32\DRIVERS\mouclass.sys
22:20:51.0262 3444  mouclass - ok
22:20:51.0278 3444  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\windows\system32\DRIVERS\mouhid.sys
22:20:51.0324 3444  mouhid - ok
22:20:51.0340 3444  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\windows\system32\drivers\mountmgr.sys
22:20:51.0371 3444  mountmgr - ok
22:20:51.0434 3444  [ 46297FA8E30A6007F14118FC2B942FBC ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
22:20:51.0465 3444  MozillaMaintenance - ok
22:20:51.0480 3444  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\windows\system32\drivers\mpio.sys
22:20:51.0496 3444  mpio - ok
22:20:51.0512 3444  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\windows\system32\drivers\mpsdrv.sys
22:20:51.0574 3444  mpsdrv - ok
22:20:51.0605 3444  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\windows\system32\mpssvc.dll
22:20:51.0652 3444  MpsSvc - ok
22:20:51.0668 3444  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\windows\system32\drivers\mrxdav.sys
22:20:51.0714 3444  MRxDAV - ok
22:20:51.0730 3444  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\windows\system32\DRIVERS\mrxsmb.sys
22:20:51.0792 3444  mrxsmb - ok
22:20:51.0808 3444  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\windows\system32\DRIVERS\mrxsmb10.sys
22:20:51.0824 3444  mrxsmb10 - ok
22:20:51.0839 3444  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\windows\system32\DRIVERS\mrxsmb20.sys
22:20:51.0855 3444  mrxsmb20 - ok
22:20:51.0855 3444  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\windows\system32\drivers\msahci.sys
22:20:51.0870 3444  msahci - ok
22:20:51.0886 3444  [ DB801A638D011B9633829EB6F663C900 ] msdsm           C:\windows\system32\drivers\msdsm.sys
22:20:51.0902 3444  msdsm - ok
22:20:51.0917 3444  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC           C:\windows\System32\msdtc.exe
22:20:51.0933 3444  MSDTC - ok
22:20:51.0948 3444  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\windows\system32\drivers\Msfs.sys
22:20:51.0995 3444  Msfs - ok
22:20:51.0995 3444  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf       C:\windows\System32\drivers\mshidkmdf.sys
22:20:52.0042 3444  mshidkmdf - ok
22:20:52.0042 3444  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\windows\system32\drivers\msisadrv.sys
22:20:52.0042 3444  msisadrv - ok
22:20:52.0073 3444  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI         C:\windows\system32\iscsiexe.dll
22:20:52.0136 3444  MSiSCSI - ok
22:20:52.0136 3444  msiserver - ok
22:20:52.0151 3444  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV         C:\windows\system32\drivers\MSKSSRV.sys
22:20:52.0182 3444  MSKSSRV - ok
22:20:52.0198 3444  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\windows\system32\drivers\MSPCLOCK.sys
22:20:52.0245 3444  MSPCLOCK - ok
22:20:52.0260 3444  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM           C:\windows\system32\drivers\MSPQM.sys
22:20:52.0307 3444  MSPQM - ok
22:20:52.0323 3444  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC           C:\windows\system32\drivers\MsRPC.sys
22:20:52.0338 3444  MsRPC - ok
22:20:52.0354 3444  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\windows\system32\DRIVERS\mssmbios.sys
22:20:52.0354 3444  mssmbios - ok
22:20:52.0370 3444  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE           C:\windows\system32\drivers\MSTEE.sys
22:20:52.0401 3444  MSTEE - ok
22:20:52.0416 3444  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\windows\system32\drivers\MTConfig.sys
22:20:52.0432 3444  MTConfig - ok
22:20:52.0432 3444  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup             C:\windows\system32\Drivers\mup.sys
22:20:52.0448 3444  Mup - ok
22:20:52.0479 3444  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\windows\system32\qagentRT.dll
22:20:52.0572 3444  napagent - ok
22:20:52.0635 3444  NasPmService - ok
22:20:52.0666 3444  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP     C:\windows\system32\DRIVERS\nwifi.sys
22:20:52.0728 3444  NativeWifiP - ok
22:20:52.0791 3444  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\windows\system32\drivers\ndis.sys
22:20:52.0838 3444  NDIS - ok
22:20:52.0853 3444  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap         C:\windows\system32\DRIVERS\ndiscap.sys
22:20:52.0884 3444  NdisCap - ok
22:20:52.0900 3444  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\windows\system32\DRIVERS\ndistapi.sys
22:20:52.0931 3444  NdisTapi - ok
22:20:52.0947 3444  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio         C:\windows\system32\DRIVERS\ndisuio.sys
22:20:52.0994 3444  Ndisuio - ok
22:20:52.0994 3444  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan         C:\windows\system32\DRIVERS\ndiswan.sys
22:20:53.0040 3444  NdisWan - ok
22:20:53.0072 3444  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy         C:\windows\system32\drivers\NDProxy.sys
22:20:53.0103 3444  NDProxy - ok
22:20:53.0103 3444  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS         C:\windows\system32\DRIVERS\netbios.sys
22:20:53.0150 3444  NetBIOS - ok
22:20:53.0165 3444  [ 09594D1089C523423B32A4229263F068 ] NetBT           C:\windows\system32\DRIVERS\netbt.sys
22:20:53.0196 3444  NetBT - ok
22:20:53.0212 3444  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\windows\system32\lsass.exe
22:20:53.0228 3444  Netlogon - ok
22:20:53.0274 3444  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\windows\System32\netman.dll
22:20:53.0337 3444  Netman - ok
22:20:53.0368 3444  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
22:20:53.0399 3444  NetMsmqActivator - ok
22:20:53.0415 3444  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
22:20:53.0430 3444  NetPipeActivator - ok
22:20:53.0462 3444  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\windows\System32\netprofm.dll
22:20:53.0524 3444  netprofm - ok
22:20:53.0524 3444  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
22:20:53.0524 3444  NetTcpActivator - ok
22:20:53.0540 3444  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
22:20:53.0540 3444  NetTcpPortSharing - ok
22:20:53.0571 3444  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960         C:\windows\system32\drivers\nfrd960.sys
22:20:53.0571 3444  nfrd960 - ok
22:20:53.0602 3444  [ 1EE99A89CC788ADA662441D1E9830529 ] NlaSvc          C:\windows\System32\nlasvc.dll
22:20:53.0680 3444  NlaSvc - ok
22:20:53.0696 3444  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\windows\system32\drivers\Npfs.sys
22:20:53.0727 3444  Npfs - ok
22:20:53.0758 3444  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi             C:\windows\system32\nsisvc.dll
22:20:53.0789 3444  nsi - ok
22:20:53.0789 3444  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\windows\system32\drivers\nsiproxy.sys
22:20:53.0820 3444  nsiproxy - ok
22:20:53.0914 3444  [ 27A5C13432315277FAFC268512B99FF5 ] nsService       C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\nsService.exe
22:20:53.0945 3444  nsService ( UnsignedFile.Multi.Generic ) - warning
22:20:53.0945 3444  nsService - detected UnsignedFile.Multi.Generic (1)
22:20:53.0992 3444  [ A2F74975097F52A00745F9637451FDD8 ] Ntfs            C:\windows\system32\drivers\Ntfs.sys
22:20:54.0039 3444  Ntfs - ok
22:20:54.0054 3444  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\windows\system32\drivers\Null.sys
22:20:54.0086 3444  Null - ok
22:20:54.0117 3444  [ 158AD24745BD85BA9BE3C51C38F48C32 ] nusb3hub        C:\windows\system32\DRIVERS\nusb3hub.sys
22:20:54.0148 3444  nusb3hub - ok
22:20:54.0195 3444  [ D40A13B2C0891E218F9523B376955DB6 ] nusb3xhc        C:\windows\system32\DRIVERS\nusb3xhc.sys
22:20:54.0257 3444  nusb3xhc - ok
22:20:54.0288 3444  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\windows\system32\drivers\nvraid.sys
22:20:54.0320 3444  nvraid - ok
22:20:54.0335 3444  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\windows\system32\drivers\nvstor.sys
22:20:54.0335 3444  nvstor - ok
22:20:54.0366 3444  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\windows\system32\drivers\nv_agp.sys
22:20:54.0382 3444  nv_agp - ok
22:20:54.0413 3444  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\windows\system32\drivers\ohci1394.sys
22:20:54.0444 3444  ohci1394 - ok
22:20:54.0507 3444  [ 7A56CF3E3F12E8AF599963B16F50FB6A ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
22:20:54.0522 3444  ose - ok
22:20:54.0554 3444  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\windows\system32\pnrpsvc.dll
22:20:54.0600 3444  p2pimsvc - ok
22:20:54.0616 3444  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\windows\system32\p2psvc.dll
22:20:54.0632 3444  p2psvc - ok
22:20:54.0663 3444  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport         C:\windows\system32\drivers\parport.sys
22:20:54.0694 3444  Parport - ok
22:20:54.0710 3444  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr         C:\windows\system32\drivers\partmgr.sys
22:20:54.0741 3444  partmgr - ok
22:20:54.0756 3444  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\windows\System32\pcasvc.dll
22:20:54.0788 3444  PcaSvc - ok
22:20:54.0788 3444  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci             C:\windows\system32\drivers\pci.sys
22:20:54.0803 3444  pci - ok
22:20:54.0834 3444  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\windows\system32\drivers\pciide.sys
22:20:54.0834 3444  pciide - ok
22:20:54.0850 3444  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\windows\system32\drivers\pcmcia.sys
22:20:54.0866 3444  pcmcia - ok
22:20:54.0866 3444  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw             C:\windows\system32\drivers\pcw.sys
22:20:54.0881 3444  pcw - ok
22:20:54.0912 3444  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\windows\system32\drivers\peauth.sys
22:20:54.0975 3444  PEAUTH - ok
22:20:55.0053 3444  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\windows\SysWow64\perfhost.exe
22:20:55.0068 3444  PerfHost - ok
22:20:55.0100 3444  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla             C:\windows\system32\pla.dll
22:20:55.0178 3444  pla - ok
22:20:55.0224 3444  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\windows\system32\umpnpmgr.dll
22:20:55.0271 3444  PlugPlay - ok
22:20:55.0287 3444  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg     C:\windows\system32\pnrpauto.dll
22:20:55.0318 3444  PNRPAutoReg - ok
22:20:55.0334 3444  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc         C:\windows\system32\pnrpsvc.dll
22:20:55.0365 3444  PNRPsvc - ok
22:20:55.0396 3444  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent     C:\windows\System32\ipsecsvc.dll
22:20:55.0458 3444  PolicyAgent - ok
22:20:55.0490 3444  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power           C:\windows\system32\umpo.dll
22:20:55.0552 3444  Power - ok
22:20:55.0583 3444  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\windows\system32\DRIVERS\raspptp.sys
22:20:55.0646 3444  PptpMiniport - ok
22:20:55.0661 3444  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor       C:\windows\system32\drivers\processr.sys
22:20:55.0677 3444  Processor - ok
22:20:55.0708 3444  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc         C:\windows\system32\profsvc.dll
22:20:55.0770 3444  ProfSvc - ok
22:20:55.0786 3444  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\windows\system32\lsass.exe
22:20:55.0786 3444  ProtectedStorage - ok
22:20:55.0817 3444  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\windows\system32\DRIVERS\pacer.sys
22:20:55.0864 3444  Psched - ok
22:20:55.0895 3444  [ 87B04878A6D59D6C79251DC960C674C1 ] PxHlpa64        C:\windows\system32\Drivers\PxHlpa64.sys
22:20:55.0911 3444  PxHlpa64 - ok
22:20:55.0958 3444  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\windows\system32\drivers\ql2300.sys
22:20:56.0020 3444  ql2300 - ok
22:20:56.0036 3444  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\windows\system32\drivers\ql40xx.sys
22:20:56.0051 3444  ql40xx - ok
22:20:56.0098 3444  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE           C:\windows\system32\qwave.dll
22:20:56.0145 3444  QWAVE - ok
22:20:56.0145 3444  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\windows\system32\drivers\qwavedrv.sys
22:20:56.0160 3444  QWAVEdrv - ok
22:20:56.0176 3444  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\windows\system32\DRIVERS\rasacd.sys
22:20:56.0207 3444  RasAcd - ok
22:20:56.0238 3444  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn     C:\windows\system32\DRIVERS\AgileVpn.sys
22:20:56.0301 3444  RasAgileVpn - ok
22:20:56.0316 3444  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto         C:\windows\System32\rasauto.dll
22:20:56.0348 3444  RasAuto - ok
22:20:56.0363 3444  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp         C:\windows\system32\DRIVERS\rasl2tp.sys
22:20:56.0394 3444  Rasl2tp - ok
22:20:56.0426 3444  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\windows\System32\rasmans.dll
22:20:56.0488 3444  RasMan - ok
22:20:56.0488 3444  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\windows\system32\DRIVERS\raspppoe.sys
22:20:56.0535 3444  RasPppoe - ok
22:20:56.0550 3444  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp         C:\windows\system32\DRIVERS\rassstp.sys
22:20:56.0613 3444  RasSstp - ok
22:20:56.0628 3444  [ 77F665941019A1594D887A74F301FA2F ] rdbss           C:\windows\system32\DRIVERS\rdbss.sys
22:20:56.0691 3444  rdbss - ok
22:20:56.0706 3444  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\windows\system32\drivers\rdpbus.sys
22:20:56.0738 3444  rdpbus - ok
22:20:56.0769 3444  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\windows\system32\DRIVERS\RDPCDD.sys
22:20:56.0800 3444  RDPCDD - ok
22:20:56.0800 3444  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\windows\system32\drivers\rdpencdd.sys
22:20:56.0847 3444  RDPENCDD - ok
22:20:56.0862 3444  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\windows\system32\drivers\rdprefmp.sys
22:20:56.0894 3444  RDPREFMP - ok
22:20:56.0925 3444  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD           C:\windows\system32\drivers\RDPWD.sys
22:20:56.0972 3444  RDPWD - ok
22:20:57.0003 3444  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\windows\system32\drivers\rdyboost.sys
22:20:57.0003 3444  rdyboost - ok
22:20:57.0050 3444  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\windows\System32\mprdim.dll
22:20:57.0112 3444  RemoteAccess - ok
22:20:57.0143 3444  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\windows\system32\regsvc.dll
22:20:57.0206 3444  RemoteRegistry - ok
22:20:57.0237 3444  [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM          C:\windows\system32\DRIVERS\rfcomm.sys
22:20:57.0252 3444  RFCOMM - ok
22:20:57.0252 3444  RimUsb - ok
22:20:57.0284 3444  [ 4AAFFFA67AC4DFA3D9985D78573887E2 ] RimVSerPort     C:\windows\system32\DRIVERS\RimSerial_AMD64.sys
22:20:57.0362 3444  RimVSerPort - ok
22:20:57.0377 3444  [ 388D3DD1A6457280F3BADBA9F3ACD6B1 ] ROOTMODEM       C:\windows\system32\Drivers\RootMdm.sys
22:20:57.0440 3444  ROOTMODEM - ok
22:20:57.0549 3444  [ 3C957189B31C34D3AD21967B12B6AED7 ] RoxMediaDB12OEM c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe
22:20:57.0596 3444  RoxMediaDB12OEM - ok
22:20:57.0611 3444  [ 2B73088CC2CA757A172B425C9398E5BC ] RoxWatch12      c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe
22:20:57.0627 3444  RoxWatch12 - ok
22:20:57.0642 3444  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\windows\System32\RpcEpMap.dll
22:20:57.0689 3444  RpcEptMapper - ok
22:20:57.0705 3444  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\windows\system32\locator.exe
22:20:57.0736 3444  RpcLocator - ok
22:20:57.0752 3444  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs           C:\windows\system32\rpcss.dll
22:20:57.0798 3444  RpcSs - ok
22:20:57.0814 3444  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\windows\system32\DRIVERS\rspndr.sys
22:20:57.0892 3444  rspndr - ok
22:20:57.0939 3444  [ BE29B0A3AC1E8BD02FFAB8CEE86BADFA ] RSUSBSTOR       C:\windows\system32\Drivers\RtsUStor.sys
22:20:57.0970 3444  RSUSBSTOR - ok
22:20:58.0032 3444  [ EE082E06A82FF630351D1E0EBBD3D8D0 ] RTL8167         C:\windows\system32\DRIVERS\Rt64win7.sys
22:20:58.0064 3444  RTL8167 - ok
22:20:58.0079 3444  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs           C:\windows\system32\lsass.exe
22:20:58.0079 3444  SamSs - ok
22:20:58.0095 3444  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\windows\system32\drivers\sbp2port.sys
22:20:58.0110 3444  sbp2port - ok
22:20:58.0142 3444  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\windows\System32\SCardSvr.dll
22:20:58.0204 3444  SCardSvr - ok
22:20:58.0220 3444  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\windows\system32\DRIVERS\scfilter.sys
22:20:58.0282 3444  scfilter - ok
22:20:58.0298 3444  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\windows\system32\schedsvc.dll
22:20:58.0360 3444  Schedule - ok
22:20:58.0376 3444  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc     C:\windows\System32\certprop.dll
22:20:58.0407 3444  SCPolicySvc - ok
22:20:58.0422 3444  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\windows\System32\SDRSVC.dll
22:20:58.0454 3444  SDRSVC - ok
22:20:58.0469 3444  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\windows\system32\drivers\secdrv.sys
22:20:58.0500 3444  secdrv - ok
22:20:58.0516 3444  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\windows\system32\seclogon.dll
22:20:58.0547 3444  seclogon - ok
22:20:58.0563 3444  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\windows\System32\sens.dll
22:20:58.0656 3444  SENS - ok
22:20:58.0688 3444  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\windows\system32\sensrsvc.dll
22:20:58.0750 3444  SensrSvc - ok
22:20:58.0766 3444  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum         C:\windows\system32\drivers\serenum.sys
22:20:58.0812 3444  Serenum - ok
22:20:58.0844 3444  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\windows\system32\drivers\serial.sys
22:20:58.0890 3444  Serial - ok
22:20:58.0937 3444  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\windows\system32\drivers\sermouse.sys
22:20:58.0984 3444  sermouse - ok
22:20:59.0000 3444  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\windows\system32\sessenv.dll
22:20:59.0046 3444  SessionEnv - ok
22:20:59.0062 3444  [ A554811BCD09279536440C964AE35BBF ] sffdisk         C:\windows\system32\drivers\sffdisk.sys
22:20:59.0062 3444  sffdisk - ok
22:20:59.0093 3444  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\windows\system32\drivers\sffp_mmc.sys
22:20:59.0124 3444  sffp_mmc - ok
22:20:59.0140 3444  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd         C:\windows\system32\drivers\sffp_sd.sys
22:20:59.0156 3444  sffp_sd - ok
22:20:59.0171 3444  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy         C:\windows\system32\drivers\sfloppy.sys
22:20:59.0187 3444  sfloppy - ok
22:20:59.0234 3444  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\windows\System32\ipnathlp.dll
22:20:59.0280 3444  SharedAccess - ok
22:20:59.0312 3444  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\windows\System32\shsvcs.dll
22:20:59.0343 3444  ShellHWDetection - ok
22:20:59.0374 3444  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\windows\system32\drivers\SiSRaid2.sys
22:20:59.0405 3444  SiSRaid2 - ok
22:20:59.0405 3444  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\windows\system32\drivers\sisraid4.sys
22:20:59.0421 3444  SiSRaid4 - ok
22:20:59.0452 3444  [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate     C:\Program Files (x86)\Skype\Updater\Updater.exe
22:20:59.0452 3444  SkypeUpdate - ok
22:20:59.0499 3444  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb             C:\windows\system32\DRIVERS\smb.sys
22:20:59.0577 3444  Smb - ok
22:20:59.0592 3444  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\windows\System32\snmptrap.exe
22:20:59.0608 3444  SNMPTRAP - ok
22:20:59.0702 3444  [ 5177D14A78E60FD61DCFC6B388E7E971 ] Sony PC Companion C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe
22:20:59.0733 3444  Sony PC Companion - ok
22:20:59.0748 3444  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr           C:\windows\system32\drivers\spldr.sys
22:20:59.0780 3444  spldr - ok
22:20:59.0811 3444  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler         C:\windows\System32\spoolsv.exe
22:20:59.0858 3444  Spooler - ok
22:20:59.0951 3444  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\windows\system32\sppsvc.exe
22:21:00.0045 3444  sppsvc - ok
22:21:00.0060 3444  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify     C:\windows\system32\sppuinotify.dll
22:21:00.0123 3444  sppuinotify - ok
22:21:00.0138 3444  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv             C:\windows\system32\DRIVERS\srv.sys
22:21:00.0201 3444  srv - ok
22:21:00.0216 3444  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\windows\system32\DRIVERS\srv2.sys
22:21:00.0248 3444  srv2 - ok
22:21:00.0248 3444  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\windows\system32\DRIVERS\srvnet.sys
22:21:00.0263 3444  srvnet - ok
22:21:00.0294 3444  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV         C:\windows\System32\ssdpsrv.dll
22:21:00.0357 3444  SSDPSRV - ok
22:21:00.0372 3444  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc         C:\windows\system32\sstpsvc.dll
22:21:00.0404 3444  SstpSvc - ok
22:21:00.0497 3444  [ B2D8B364A831427A5741F6C408FA8AE3 ] STacSV          C:\Program Files\IDT\WDM\STacSV64.exe
22:21:00.0528 3444  STacSV - ok
22:21:00.0591 3444  [ E8606BF6BE3B7481D95F1DD2E4F3FCBA ] StarMoney 7.0 OnlineUpdate C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe
22:21:00.0606 3444  StarMoney 7.0 OnlineUpdate - ok
22:21:00.0622 3444  [ 92E7F6666633D2DD91D527503DAA7BE0 ] stdcfltn        C:\windows\system32\DRIVERS\stdcfltn.sys
22:21:00.0622 3444  stdcfltn - ok
22:21:00.0653 3444  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\windows\system32\drivers\stexstor.sys
22:21:00.0653 3444  stexstor - ok
22:21:00.0684 3444  [ EF5ACDE92BA3F691BBFEF781CB063501 ] STHDA           C:\windows\system32\DRIVERS\stwrt64.sys
22:21:00.0747 3444  STHDA - ok
22:21:00.0778 3444  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\windows\System32\wiaservc.dll
22:21:00.0825 3444  stisvc - ok
22:21:00.0872 3444  [ 7731F46EC0D687A931CBA063E8F90EF0 ] stllssvr        c:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
22:21:00.0872 3444  stllssvr - ok
22:21:00.0903 3444  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\windows\system32\DRIVERS\swenum.sys
22:21:00.0918 3444  swenum - ok
22:21:00.0950 3444  [ E08E46FDD841B7184194011CA1955A0B ] swprv           C:\windows\System32\swprv.dll
22:21:00.0996 3444  swprv - ok
22:21:01.0090 3444  [ 09E811486038F1C06F9E00DFFAAB7A4E ] SynTP           C:\windows\system32\DRIVERS\SynTP.sys
22:21:01.0137 3444  SynTP - ok
22:21:01.0184 3444  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain         C:\windows\system32\sysmain.dll
22:21:01.0246 3444  SysMain - ok
22:21:01.0262 3444  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\windows\System32\TabSvc.dll
22:21:01.0308 3444  TabletInputService - ok
22:21:01.0324 3444  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv         C:\windows\System32\tapisrv.dll
22:21:01.0355 3444  TapiSrv - ok
22:21:01.0371 3444  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS             C:\windows\System32\tbssvc.dll
22:21:01.0402 3444  TBS - ok
22:21:01.0480 3444  [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] Tcpip           C:\windows\system32\drivers\tcpip.sys
22:21:01.0542 3444  Tcpip - ok
22:21:01.0574 3444  [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] TCPIP6          C:\windows\system32\DRIVERS\tcpip.sys
22:21:01.0652 3444  TCPIP6 - ok
22:21:01.0667 3444  [ DF687E3D8836BFB04FCC0615BF15A519 ] tcpipreg        C:\windows\system32\drivers\tcpipreg.sys
22:21:01.0714 3444  tcpipreg - ok
22:21:01.0730 3444  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\windows\system32\drivers\tdpipe.sys
22:21:01.0761 3444  TDPIPE - ok
22:21:01.0792 3444  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP           C:\windows\system32\drivers\tdtcp.sys
22:21:01.0823 3444  TDTCP - ok
22:21:01.0839 3444  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx             C:\windows\system32\DRIVERS\tdx.sys
22:21:01.0870 3444  tdx - ok
22:21:01.0995 3444  [ 9C1F776825207C203CB44CA3C63B5A6E ] TeamViewer7     C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
22:21:02.0042 3444  TeamViewer7 - ok
22:21:02.0057 3444  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\windows\system32\DRIVERS\termdd.sys
22:21:02.0073 3444  TermDD - ok
22:21:02.0104 3444  [ 2E648163254233755035B46DD7B89123 ] TermService     C:\windows\System32\termsrv.dll
22:21:02.0166 3444  TermService - ok
22:21:02.0182 3444  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\windows\system32\themeservice.dll
22:21:02.0198 3444  Themes - ok
22:21:02.0229 3444  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER     C:\windows\system32\mmcss.dll
22:21:02.0260 3444  THREADORDER - ok
22:21:02.0276 3444  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\windows\System32\trkwks.dll
22:21:02.0338 3444  TrkWks - ok
22:21:02.0400 3444  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\windows\servicing\TrustedInstaller.exe
22:21:02.0463 3444  TrustedInstaller - ok
22:21:02.0478 3444  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\windows\system32\DRIVERS\tssecsrv.sys
22:21:02.0556 3444  tssecsrv - ok
22:21:02.0588 3444  [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt        C:\windows\system32\drivers\tsusbflt.sys
22:21:02.0619 3444  TsUsbFlt - ok
22:21:02.0634 3444  [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD         C:\windows\system32\drivers\TsUsbGD.sys
22:21:02.0650 3444  TsUsbGD - ok
22:21:02.0666 3444  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\windows\system32\DRIVERS\tunnel.sys
22:21:02.0744 3444  tunnel - ok
22:21:02.0806 3444  [ AAF458CC200326BEF602B5339400BF86 ] tvnserver       C:\Program Files (x86)\TightVNC\tvnserver.exe
22:21:02.0837 3444  tvnserver - ok
22:21:02.0853 3444  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\windows\system32\drivers\uagp35.sys
22:21:02.0853 3444  uagp35 - ok
22:21:02.0884 3444  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\windows\system32\DRIVERS\udfs.sys
22:21:02.0946 3444  udfs - ok
22:21:02.0978 3444  [ 13BFF97E926BF8D9C1230CECC371A0C0 ] UI Assistant Service C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe
22:21:03.0009 3444  UI Assistant Service - ok
22:21:03.0024 3444  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect       C:\windows\system32\UI0Detect.exe
22:21:03.0040 3444  UI0Detect - ok
22:21:03.0056 3444  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\windows\system32\drivers\uliagpkx.sys
22:21:03.0056 3444  uliagpkx - ok
22:21:03.0087 3444  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus           C:\windows\system32\DRIVERS\umbus.sys
22:21:03.0118 3444  umbus - ok
22:21:03.0134 3444  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\windows\system32\drivers\umpass.sys
22:21:03.0180 3444  UmPass - ok
22:21:03.0321 3444  [ EB79C6C91A99930015EF29AE7FA802D1 ] UNS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
22:21:03.0383 3444  UNS - ok
22:21:03.0399 3444  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\windows\System32\upnphost.dll
22:21:03.0492 3444  upnphost - ok
22:21:03.0508 3444  [ 19AD7990C0B67E48DAC5B26F99628223 ] usbccgp         C:\windows\system32\DRIVERS\usbccgp.sys
22:21:03.0555 3444  usbccgp - ok
22:21:03.0586 3444  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\windows\system32\drivers\usbcir.sys
22:21:03.0617 3444  usbcir - ok
22:21:03.0633 3444  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci         C:\windows\system32\DRIVERS\usbehci.sys
22:21:03.0680 3444  usbehci - ok
22:21:03.0726 3444  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\windows\system32\DRIVERS\usbhub.sys
22:21:03.0758 3444  usbhub - ok
22:21:03.0773 3444  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci         C:\windows\system32\drivers\usbohci.sys
22:21:03.0804 3444  usbohci - ok
22:21:03.0820 3444  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\windows\system32\drivers\usbprint.sys
22:21:03.0867 3444  usbprint - ok
22:21:03.0882 3444  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR         C:\windows\system32\DRIVERS\USBSTOR.SYS
22:21:03.0914 3444  USBSTOR - ok
22:21:03.0929 3444  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci         C:\windows\system32\drivers\usbuhci.sys
22:21:03.0960 3444  usbuhci - ok
22:21:03.0992 3444  [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo        C:\windows\system32\Drivers\usbvideo.sys
22:21:04.0038 3444  usbvideo - ok
22:21:04.0101 3444  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms           C:\windows\System32\uxsms.dll
22:21:04.0163 3444  UxSms - ok
22:21:04.0163 3444  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\windows\system32\lsass.exe
22:21:04.0179 3444  VaultSvc - ok
22:21:04.0272 3444  [ 8C51E58D59CBF2639832484EC9ED8DDA ] vcsFPService    C:\Windows\system32\vcsFPService.exe
22:21:04.0335 3444  vcsFPService - ok
22:21:04.0366 3444  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\windows\system32\drivers\vdrvroot.sys
22:21:04.0382 3444  vdrvroot - ok
22:21:04.0397 3444  [ 8D6B481601D01A456E75C3210F1830BE ] vds             C:\windows\System32\vds.exe
22:21:04.0460 3444  vds - ok
22:21:04.0506 3444  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga             C:\windows\system32\DRIVERS\vgapnp.sys
22:21:04.0538 3444  vga - ok
22:21:04.0553 3444  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave         C:\windows\System32\drivers\vga.sys
22:21:04.0631 3444  VgaSave - ok
22:21:04.0647 3444  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp           C:\windows\system32\drivers\vhdmp.sys
22:21:04.0662 3444  vhdmp - ok
22:21:04.0694 3444  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\windows\system32\drivers\viaide.sys
22:21:04.0694 3444  viaide - ok
22:21:04.0725 3444  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\windows\system32\drivers\volmgr.sys
22:21:04.0740 3444  volmgr - ok
22:21:04.0740 3444  [ A255814907C89BE58B79EF2F189B843B ] volmgrx         C:\windows\system32\drivers\volmgrx.sys
22:21:04.0756 3444  volmgrx - ok
22:21:04.0772 3444  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap         C:\windows\system32\drivers\volsnap.sys
22:21:04.0787 3444  volsnap - ok
22:21:04.0818 3444  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid         C:\windows\system32\drivers\vsmraid.sys
22:21:04.0818 3444  vsmraid - ok
22:21:04.0896 3444  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS             C:\windows\system32\vssvc.exe
22:21:04.0943 3444  VSS - ok
22:21:04.0959 3444  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\windows\system32\DRIVERS\vwifibus.sys
22:21:05.0006 3444  vwifibus - ok
22:21:05.0021 3444  [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt        C:\windows\system32\DRIVERS\vwififlt.sys
22:21:05.0052 3444  vwififlt - ok
22:21:05.0052 3444  [ 6A638FC4BFDDC4D9B186C28C91BD1A01 ] vwifimp         C:\windows\system32\DRIVERS\vwifimp.sys
22:21:05.0068 3444  vwifimp - ok
22:21:05.0130 3444  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time         C:\windows\system32\w32time.dll
22:21:05.0193 3444  W32Time - ok
22:21:05.0208 3444  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\windows\system32\drivers\wacompen.sys
22:21:05.0271 3444  WacomPen - ok
22:21:05.0286 3444  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\windows\system32\DRIVERS\wanarp.sys
22:21:05.0333 3444  WANARP - ok
22:21:05.0333 3444  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\windows\system32\DRIVERS\wanarp.sys
22:21:05.0380 3444  Wanarpv6 - ok
22:21:05.0427 3444  [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc     C:\windows\system32\Wat\WatAdminSvc.exe
22:21:05.0458 3444  WatAdminSvc - ok
22:21:05.0505 3444  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\windows\system32\wbengine.exe
22:21:05.0552 3444  wbengine - ok
22:21:05.0567 3444  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\windows\System32\wbiosrvc.dll
22:21:05.0583 3444  WbioSrvc - ok
22:21:05.0630 3444  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc         C:\windows\System32\wcncsvc.dll
22:21:05.0692 3444  wcncsvc - ok
22:21:05.0708 3444  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\windows\System32\WcsPlugInService.dll
22:21:05.0754 3444  WcsPlugInService - ok
22:21:05.0786 3444  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\windows\system32\drivers\wd.sys
22:21:05.0786 3444  Wd - ok
22:21:05.0817 3444  [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000        C:\windows\system32\drivers\Wdf01000.sys
22:21:05.0879 3444  Wdf01000 - ok
22:21:05.0895 3444  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\windows\system32\wdi.dll
22:21:05.0957 3444  WdiServiceHost - ok
22:21:05.0957 3444  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost   C:\windows\system32\wdi.dll
22:21:05.0973 3444  WdiSystemHost - ok
22:21:05.0988 3444  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient       C:\windows\System32\webclnt.dll
22:21:06.0051 3444  WebClient - ok
22:21:06.0066 3444  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\windows\system32\wecsvc.dll
22:21:06.0098 3444  Wecsvc - ok
22:21:06.0113 3444  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport   C:\windows\System32\wercplsupport.dll
22:21:06.0160 3444  wercplsupport - ok
22:21:06.0160 3444  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\windows\System32\WerSvc.dll
22:21:06.0191 3444  WerSvc - ok
22:21:06.0222 3444  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\windows\system32\DRIVERS\wfplwf.sys
22:21:06.0269 3444  WfpLwf - ok
22:21:06.0300 3444  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\windows\system32\drivers\wimmount.sys
22:21:06.0300 3444  WIMMount - ok
22:21:06.0332 3444  WinDefend - ok
22:21:06.0332 3444  WinHttpAutoProxySvc - ok
22:21:06.0410 3444  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt         C:\windows\system32\wbem\WMIsvc.dll
22:21:06.0488 3444  Winmgmt - ok
22:21:06.0566 3444  [ BCB1310604AA415C4508708975B3931E ] WinRM           C:\windows\system32\WsmSvc.dll
22:21:06.0644 3444  WinRM - ok
22:21:06.0690 3444  [ FE88B288356E7B47B74B13372ADD906D ] WinUSB          C:\windows\system32\DRIVERS\WinUSB.sys
22:21:06.0737 3444  WinUSB - ok
22:21:06.0784 3444  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc         C:\windows\System32\wlansvc.dll
22:21:06.0815 3444  Wlansvc - ok
22:21:06.0893 3444  [ 06C8FA1CF39DE6A735B54D906BA791C6 ] wlcrasvc        C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
22:21:06.0909 3444  wlcrasvc - ok
22:21:07.0002 3444  [ 2BACD71123F42CEA603F4E205E1AE337 ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
22:21:07.0065 3444  wlidsvc - ok
22:21:07.0080 3444  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi         C:\windows\system32\DRIVERS\wmiacpi.sys
22:21:07.0096 3444  WmiAcpi - ok
22:21:07.0112 3444  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\windows\system32\wbem\WmiApSrv.exe
22:21:07.0174 3444  wmiApSrv - ok
22:21:07.0190 3444  WMPNetworkSvc - ok
22:21:07.0205 3444  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\windows\System32\wpcsvc.dll
22:21:07.0236 3444  WPCSvc - ok
22:21:07.0252 3444  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\windows\system32\wpdbusenum.dll
22:21:07.0268 3444  WPDBusEnum - ok
22:21:07.0299 3444  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl         C:\windows\system32\drivers\ws2ifsl.sys
22:21:07.0346 3444  ws2ifsl - ok
22:21:07.0346 3444  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\windows\System32\wscsvc.dll
22:21:07.0377 3444  wscsvc - ok
22:21:07.0377 3444  WSearch - ok
22:21:07.0455 3444  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\windows\system32\wuaueng.dll
22:21:07.0502 3444  wuauserv - ok
22:21:07.0517 3444  [ D3381DC54C34D79B22CEE0D65BA91B7C ] WudfPf          C:\windows\system32\drivers\WudfPf.sys
22:21:07.0580 3444  WudfPf - ok
22:21:07.0595 3444  [ CF8D590BE3373029D57AF80914190682 ] WUDFRd          C:\windows\system32\DRIVERS\WUDFRd.sys
22:21:07.0658 3444  WUDFRd - ok
22:21:07.0689 3444  [ 7A95C95B6C4CF292D689106BCAE49543 ] wudfsvc         C:\windows\System32\WUDFSvc.dll
22:21:07.0720 3444  wudfsvc - ok
22:21:07.0736 3444  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc         C:\windows\System32\wwansvc.dll
22:21:07.0767 3444  WwanSvc - ok
22:21:07.0814 3444  [ FF5A03A65B68DB7E02A12880399D40D4 ] ZTEusbmdm6k     C:\windows\system32\DRIVERS\ZTEusbmdm6k.sys
22:21:07.0845 3444  ZTEusbmdm6k - ok
22:21:07.0860 3444  [ FF5A03A65B68DB7E02A12880399D40D4 ] ZTEusbnmea      C:\windows\system32\DRIVERS\ZTEusbnmea.sys
22:21:07.0876 3444  ZTEusbnmea - ok
22:21:07.0892 3444  [ FF5A03A65B68DB7E02A12880399D40D4 ] ZTEusbser6k     C:\windows\system32\DRIVERS\ZTEusbser6k.sys
22:21:07.0907 3444  ZTEusbser6k - ok
22:21:07.0923 3444  ================ Scan global ===============================
22:21:07.0954 3444  [ BA0CD8C393E8C9F83354106093832C7B ] C:\windows\system32\basesrv.dll
22:21:07.0985 3444  [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\windows\system32\winsrv.dll
22:21:08.0001 3444  [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\windows\system32\winsrv.dll
22:21:08.0032 3444  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\windows\system32\sxssrv.dll
22:21:08.0079 3444  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\windows\system32\services.exe
22:21:08.0079 3444  [Global] - ok
22:21:08.0079 3444  ================ Scan MBR ==================================
22:21:08.0094 3444  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
22:21:08.0484 3444  \Device\Harddisk0\DR0 - ok
22:21:08.0484 3444  [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk1\DR1
22:21:11.0417 3444  \Device\Harddisk1\DR1 - ok
22:21:12.0322 3444  [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk2\DR2
22:21:12.0572 3444  \Device\Harddisk2\DR2 - ok
22:21:12.0572 3444  ================ Scan VBR ==================================
22:21:12.0572 3444  [ DE4CFC9A6BCEAC4DB23F9F39B2598578 ] \Device\Harddisk0\DR0\Partition1
22:21:12.0572 3444  \Device\Harddisk0\DR0\Partition1 - ok
22:21:12.0603 3444  [ 9353CF31A6EC515E78353D1600509A2F ] \Device\Harddisk0\DR0\Partition2
22:21:12.0603 3444  \Device\Harddisk0\DR0\Partition2 - ok
22:21:12.0603 3444  [ 0F9846B92AA647EFD6B2604C86CB2D10 ] \Device\Harddisk1\DR1\Partition1
22:21:12.0603 3444  \Device\Harddisk1\DR1\Partition1 - ok
22:21:12.0618 3444  [ D512C7F9E8647429EE71CB6A2D103A8F ] \Device\Harddisk2\DR2\Partition1
22:21:12.0618 3444  \Device\Harddisk2\DR2\Partition1 - ok
22:21:12.0618 3444  ============================================================
22:21:12.0618 3444  Scan finished
22:21:12.0618 3444  ============================================================
22:21:12.0634 2256  Detected object count: 2
22:21:12.0634 2256  Actual detected object count: 2
22:21:23.0164 2256  FWLANUSB ( UnsignedFile.Multi.Generic ) - skipped by user
22:21:23.0164 2256  FWLANUSB ( UnsignedFile.Multi.Generic ) - User select action: Skip 
22:21:23.0164 2256  nsService ( UnsignedFile.Multi.Generic ) - skipped by user
22:21:23.0164 2256  nsService ( UnsignedFile.Multi.Generic ) - User select action: Skip
         

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

• Lade dir ComboFix hier herunter auf deinen Desktop.

• Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

• Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
  Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

• Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.