Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: www.searchnu.com/406 wird bei jedem neuen Tab geöffnet

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 12.02.2013, 20:23   #1
DonBenni82
 
www.searchnu.com/406 wird bei jedem neuen Tab geöffnet - Icon27

www.searchnu.com/406 wird bei jedem neuen Tab geöffnet



Hallo liebes Forum,

seit dem Wochenende schlage ich mich mit dem Search rum und werde ihn nicht los. Alle neuen Tabs starten auf dieser Seite, egal welchen Browser ich verwende. Beim Mozilla habe ich bei den Suchmaschinen alle entfernt und der ICQ-Search taucht im Handumdrehen immer wieder auf. Ich vermute das hängt auch mit dem serchnu zusammen.

In einem anderen Thread habe ich von Malwarebytes Anti-Malware gelesen und diesen mal durchlaufen und die gefundene Malware entfernen lassen. Jetzt läuft das Programm immer mit und verhindert dass „schädlich“ Tabs geöffnet werden. Ein 2ter vollständiger Scan hat keine schädliche Software mehr gefunden.

Da ich das Problem allein nicht unter Kontrolle bekomme wende ich mich an euch Experten hier im Forum.

Gmer, OTL und Defogger.exe habe ich herunter geladen und nach Anleitung ausgeführt.

Gmer:
GMER 2.0.18454 - GMER - Rootkit Detector and Remover
Rootkit scan 2013-02-12 17:51:41
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_HM080HI rev.AB100-16 74,53GB
Running: gmer_2.0.18454.exe; Driver: C:\Users\Alex\AppData\Local\Temp\kxldrpog.sys


---- System - GMER 2.0 ----

SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0x8AC6BB60]
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0x8AC6BE28]
SSDT \SystemRoot\system32\drivers\TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwTerminateProcess [0x8ADB1DC0]
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateUserProcess [0x8AC6C124]

---- Kernel code sections - GMER 2.0 ----

.text ntoskrnl.exe!KeInsertQueue + 3F9 858AEA30 8 Bytes [60, BB, C6, 8A, 28, BE, C6, ...]
.text ntoskrnl.exe!KeInsertQueue + 811 858AEE48 4 Bytes [C0, 1D, DB, 8A]
.text ntoskrnl.exe!KeInsertQueue + 8D5 858AEF0C 4 Bytes [24, C1, C6, 8A]
? \ArcName\multi(0)disk(0)rdisk(0)partition(1)\Windows\system32\drivers\PctWfpFilter.sys Das System kann den angegebenen Pfad nicht finden. !

---- User code sections - GMER 2.0 ----

.text C:\Program Files\PC Tools\PC Tools Security\pctsSvc.exe[2100] kernel32.dll!CreateThread + 1A 75DBCB28 4 Bytes CALL 00450055 C:\Program Files\PC Tools\PC Tools Security\pctsSvc.exe (PC Tools Security Component/PC Tools)
.text C:\Program Files\PC Tools\PC Tools Security\pctsGui.exe[2752] kernel32.dll!CreateThread + 1A 75DBCB28 4 Bytes CALL 004508F9 C:\Program Files\PC Tools\PC Tools Security\pctsGui.exe (PC Tools Security Component/PC Tools)

---- Registry - GMER 2.0 ----

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DAEF98CA-0290-A9AC-A86E-27C82EE4EDB9}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DAEF98CA-0290-A9AC-A86E-27C82EE4EDB9}@gajkeijknegeeg 0x61 0x63 0x68 0x6E ...

---- EOF - GMER 2.0 ----

Defogger:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:15 on 11/02/2013 (Alex)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

OTL
OTL logfile created on: 11.02.2013 21:26:09 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Alex\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,75 Gb Total Physical Memory | 0,85 Gb Available Physical Memory | 48,85% Memory free
3,73 Gb Paging File | 2,49 Gb Available in Paging File | 66,70% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 39,06 Gb Total Space | 5,13 Gb Free Space | 13,13% Space Free | Partition Type: NTFS
Drive D: | 35,47 Gb Total Space | 15,39 Gb Free Space | 43,40% Space Free | Partition Type: NTFS

Computer Name: ALEX-PC | User Name: Alex | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013.02.11 21:14:50 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Alex\Desktop\OTL.exe
PRC - [2013.02.07 13:19:12 | 001,683,456 | ---- | M] (Bandoo Media Inc) -- C:\Programme\Search Results Toolbar\Datamngr\datamngrUI.exe
PRC - [2013.02.06 19:25:19 | 000,213,384 | ---- | M] (Google Inc.) -- C:\Programme\Google\Update\1.3.21.135\GoogleCrashHandler.exe
PRC - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.12.14 16:49:28 | 000,512,360 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012.11.01 15:34:30 | 001,162,360 | ---- | M] (PC Tools) -- C:\Programme\PC Tools\PC Tools Security\pctsSvc.exe
PRC - [2012.11.01 15:34:28 | 002,717,816 | ---- | M] (PC Tools) -- C:\Programme\PC Tools\PC Tools Security\pctsGui.exe
PRC - [2012.10.31 09:19:52 | 000,403,416 | ---- | M] (PC Tools) -- C:\Programme\PC Tools\PC Tools Security\pctsAuxs.exe
PRC - [2012.10.31 09:19:48 | 000,072,824 | ---- | M] (PC Tools) -- C:\Programme\PC Tools\PC Tools Security\TFEngine\TFService.exe
PRC - [2012.10.23 17:40:06 | 000,580,728 | ---- | M] (Threat Expert Ltd.) -- C:\Programme\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe
PRC - [2011.03.07 14:33:08 | 000,089,456 | ---- | M] (Elaborate Bytes AG) -- D:\d2\VirtualCloneDrive\VCDDaemon.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2006.10.05 17:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe


========== Modules (No Company Name) ==========

MOD - [2007.01.18 23:54:48 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll


========== Services (SafeList) ==========

SRV - [2013.02.09 14:29:53 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.02.09 14:23:53 | 000,251,248 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.01.08 12:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.11.01 15:34:30 | 001,162,360 | ---- | M] (PC Tools) [Auto | Running] -- C:\Programme\PC Tools\PC Tools Security\pctsSvc.exe -- (sdCoreService)
SRV - [2012.10.31 09:19:52 | 000,403,416 | ---- | M] (PC Tools) [Auto | Running] -- C:\Programme\PC Tools\PC Tools Security\pctsAuxs.exe -- (sdAuxService)
SRV - [2012.10.31 09:19:48 | 000,072,824 | ---- | M] (PC Tools) [On_Demand | Running] -- C:\Program Files\PC Tools\PC Tools Security\TFEngine\TFService.exe -- (ThreatFire)
SRV - [2012.10.23 17:40:06 | 000,580,728 | ---- | M] (Threat Expert Ltd.) [Auto | Running] -- C:\Programme\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe -- (Browser Defender Update Service)
SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2007.05.31 15:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 15:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2006.10.05 17:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012.12.14 16:49:28 | 000,021,104 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.11.01 15:35:20 | 000,068,272 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pctplsm.sys -- (pctplsm)
DRV - [2012.11.01 15:35:18 | 000,071,752 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pctplsg.sys -- (pctplsg)
DRV - [2012.11.01 15:35:14 | 000,202,280 | ---- | M] (PC Tools) [Kernel | System | Running] -- C:\Windows\System32\drivers\PCTSD.sys -- (PCTSD)
DRV - [2012.10.31 14:21:28 | 000,260,760 | ---- | M] (PC Tools) [Kernel | System | Running] -- C:\Windows\System32\drivers\pctgntdi.sys -- (pctgntdi)
DRV - [2012.10.31 09:19:50 | 000,577,176 | --S- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\TfSysMon.sys -- (TFSysMon)
DRV - [2012.10.31 09:19:48 | 000,055,008 | --S- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\TfFsMon.sys -- (TfFsMon)
DRV - [2012.10.31 09:19:48 | 000,036,456 | --S- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\TfNetMon.sys -- (TfNetMon)
DRV - [2012.10.23 17:40:32 | 000,062,688 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\PCTBD.sys -- (PCTBD)
DRV - [2012.10.22 16:38:28 | 000,368,616 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\PCTCore.sys -- (PCTCore)
DRV - [2012.02.28 11:43:06 | 000,909,728 | ---- | M] (PC Tools) [File_System | Boot | Running] -- C:\Windows\System32\drivers\pctEFA.sys -- (pctEFA)
DRV - [2012.02.28 11:43:00 | 000,342,168 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\pctDS.sys -- (pctDS)
DRV - [2011.05.17 15:44:44 | 000,035,776 | ---- | M] (libusb-Win32) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\libusb0.sys -- (libusb0)
DRV - [2009.12.17 15:02:20 | 001,203,712 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009.04.11 05:42:52 | 000,031,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (winusb)
DRV - [2008.02.22 14:33:02 | 000,114,304 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm)
DRV - [2008.02.22 14:33:02 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl)
DRV - [2008.02.22 14:33:00 | 000,087,936 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus)
DRV - [2007.01.19 00:03:24 | 002,314,752 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2007.01.18 13:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2006.11.28 20:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006.11.28 10:30:10 | 000,341,632 | ---- | M] (Liteon) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Ltn_stk7700pc.sys -- (Ltn_stk7700pc)
DRV - [2006.07.24 15:05:00 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2005.12.07 10:45:00 | 000,031,232 | ---- | M] (LITE-ON) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbdtv.sys -- (usbdtv)
DRV - [2005.12.07 10:13:00 | 000,022,016 | ---- | M] (LITE-ON) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dtvfw.sys -- (DTVFW)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Yahoo! Deutschland
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Yahoo! Suche
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Yahoo! Suche
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Yahoo! Deutschland
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=350&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=8300259353924636&q={searchTerms}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Yahoo! Suche
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Programme\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{440CF5EA-8546-4F9F-AC64-64313173BB5A}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=05DFAD36-9F5F-4168-AF00-71A255E82C0A&apn_sauid=32751371-0662-4686-BCC8-96017E7D7992
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{67C121FA-F5C8-4CC4-AA38-87BD6FC467B9}: "URL" = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=350&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=8300259353924636&q={searchTerms}
IE - HKCU\..\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredibar.com/mb138/?search={searchTerms}&loc=IB_DS&a=6R8uKLa6Qm&i=26
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..extensions.enabledAddons: %7B1FD91A9C-410C-4090-BBCC-55D3450EF433%7D:1.0
FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0033-ABCDEFFEDCBA%7D:6.0.33
FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0035-ABCDEFFEDCBA%7D:6.0.35
FF - prefs.js..extensions.enabledAddons: %7B1FD91A9C-410C-4090-BBCC-55D3450EF433%7D:1.0
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.2
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..extensions.enabledItems: {fd048119-78ee-487f-8fb1-1668d3a6859b}:2.6.1
FF - prefs.js..extensions.enabledItems: {9d1f059c-cada-4111-9696-41a62d64e3ba}:0.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {7E77F5DF-8022-40e3-9122-F03DEBEFC43B}:1.0.25
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.foxtrick.prefs.module.YouthSkillHideUnknown.HideMaximalKeyWord.enabled: true
FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&gct=ds&appid=350&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&apn_uid=8300259353924636&o=APN10645&q="


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_149.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Program Files\DivX\DivX Content Uploader\npUpload.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.13.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.13.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Alex\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: D:\Programme\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2008.02.09 15:53:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\ [2013.02.11 19:09:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.09 14:29:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.02.09 14:29:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Components: D:\Programme\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins [2013.01.18 17:15:25 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.09 14:29:54 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.02.09 14:29:41 | 000,000,000 | ---D | M]

[2013.02.09 14:12:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Alex\AppData\Roaming\mozilla\Extensions
[2013.02.10 11:22:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Alex\AppData\Roaming\mozilla\Firefox\Profiles\3osy0i74.default\extensions
[2012.11.18 16:06:26 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\Alex\AppData\Roaming\mozilla\Firefox\Profiles\3osy0i74.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2013.01.12 12:14:41 | 000,000,000 | ---D | M] (FoxTrick) -- C:\Users\Alex\AppData\Roaming\mozilla\Firefox\Profiles\3osy0i74.default\extensions\{9d1f059c-cada-4111-9696-41a62d64e3ba}
[2012.12.09 21:30:50 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2008.08.22 07:56:25 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-13.xml
[2008.08.22 08:21:29 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-14.xml
[2008.08.22 10:17:23 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-15.xml
[2008.08.22 19:53:53 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-16.xml
[2008.02.11 22:01:13 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-2.xml
[2008.03.04 22:40:11 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-3.xml
[2008.03.04 23:50:27 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-4.xml
[2008.03.06 11:37:26 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-5.xml
[2008.03.22 05:52:10 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-6.xml
[2008.03.27 10:17:32 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-7.xml
[2008.06.05 08:34:01 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-8.xml
[2008.06.19 13:32:31 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-9.xml
[2009.03.01 13:02:44 | 000,000,944 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin.xml
[2013.02.09 14:29:39 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013.02.09 14:29:39 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2013.02.09 14:29:39 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013.02.09 14:29:40 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013.02.09 14:29:39 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013.02.09 14:29:40 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013.02.09 14:12:52 | 000,000,000 | ---D | M] (DataMngr) -- C:\PROGRAM FILES\SEARCH RESULTS TOOLBAR\DATAMNGR\FIREFOXEXTENSION
[2013.02.09 14:29:54 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.10.26 19:49:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2012.02.14 19:48:14 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.05.14 20:53:46 | 000,003,659 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012.09.01 19:11:23 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.14 19:48:14 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.14 19:48:14 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.02.09 14:12:19 | 000,002,687 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2012.02.14 19:48:14 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.14 19:48:14 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

========== Chrome ==========

CHR - homepage: Google
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:assistedQueryStats}{google:se archFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter},
CHR - homepage: Google
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\24.0.1312.57\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\24.0.1312.57\pdf.dll
CHR - plugin: Free Studio (Enabled) = C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.1_0\np_dvs_plugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: DivX\u00AE Content Upload Plugin (Enabled) = C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
CHR - plugin: Garmin Communicator Plug-In (Enabled) = C:\Program Files\Garmin GPS Plugin\npGarmin.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U9 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\Alex\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll
CHR - plugin: Java Deployment Toolkit 7.0.90.5 (Enabled) = C:\Windows\system32\npDeployJava1.dll
CHR - plugin: AmazonMP3DownloaderPlugin (Enabled) = D:\Programme\npAmazonMP3DownloaderPlugin101753.dll
CHR - Extension: Google Drive = C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Super Monkey Ball = C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjpneodhhegapgagpdeeahiomeiagidi\3_0\
CHR - Extension: Google Mail = C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Programme\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Programme\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O4 - HKLM..\Run: [DATAMNGR] C:\Programme\Search Results Toolbar\Datamngr\datamngrUI.exe (Bandoo Media Inc)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [ISTray] C:\Program Files\PC Tools\PC Tools Security\pctsGui.exe (PC Tools)
O4 - HKLM..\Run: [VirtualCloneDrive] D:\d2\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 10.13.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{01535634-6163-473B-98D3-142D47E20654}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7A0C9220-4183-4B3B-85A1-F4F6CF7D76BA}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (C:\PROGRA~2\Wincert\WIN32C~1.DLL) - C:\ProgramData\Wincert\win32cert.dll ()
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll) - C:\Programme\Search Results Toolbar\Datamngr\datamngr.dll (Bandoo Media Inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll) - C:\Programme\Search Results Toolbar\Datamngr\IEBHO.dll (Bandoo Media Inc)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\SYSTEM32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
O24 - Desktop BackupWallPaper: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{2786ce3f-f3f0-11de-83e4-806e6f6e6963}\Shell\AutoRun\command - "" = G:\setup.exe
O33 - MountPoints2\{284c4306-b2ff-11e1-9001-0013773bdcc7}\Shell - "" = AutoRun
O33 - MountPoints2\{284c4306-b2ff-11e1-9001-0013773bdcc7}\Shell\AutoRun\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{cdc32c42-c3e3-11df-910a-0013773bdcc7}\Shell - "" = AutoRun
O33 - MountPoints2\{cdc32c42-c3e3-11df-910a-0013773bdcc7}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013.02.11 21:14:49 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Alex\Desktop\OTL.exe
[2013.02.11 21:00:18 | 000,000,000 | ---D | C] -- C:\Users\Alex\AppData\Roaming\Malwarebytes
[2013.02.11 20:59:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.02.11 20:59:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.02.11 20:59:53 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013.02.11 20:59:53 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013.02.11 20:59:08 | 010,156,344 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Alex\Desktop\mbam-setup-1.70.0.1100.exe
[2013.02.11 20:09:13 | 000,577,176 | --S- | C] (PC Tools) -- C:\Windows\System32\drivers\TfSysMon.sys
[2013.02.11 20:09:13 | 000,055,008 | --S- | C] (PC Tools) -- C:\Windows\System32\drivers\TfFsMon.sys
[2013.02.11 20:09:13 | 000,036,456 | --S- | C] (PC Tools) -- C:\Windows\System32\drivers\TfNetMon.sys
[2013.02.11 19:09:33 | 000,062,688 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTBD.sys
[2013.02.11 19:09:32 | 000,150,648 | ---- | C] (PC Tools) -- C:\Windows\SGDetectionTool.dll
[2013.02.11 19:09:31 | 002,280,568 | ---- | C] (Threat Expert Ltd.) -- C:\Windows\PCTBDCore.dll
[2013.02.11 19:09:31 | 001,690,744 | ---- | C] (Threat Expert Ltd.) -- C:\Windows\PCTBDRes.dll
[2013.02.11 19:06:24 | 000,260,760 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctgntdi.sys
[2013.02.11 19:06:24 | 000,178,584 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctwfpfilter.sys
[2013.02.11 19:06:14 | 000,019,464 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctBTFix.sys
[2013.02.11 19:06:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Tools Security
[2013.02.11 19:06:04 | 000,071,752 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctplsg.sys
[2013.02.11 19:06:04 | 000,068,272 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctplsm.sys
[2013.02.11 19:05:49 | 000,000,000 | ---D | C] -- C:\Program Files\PC Tools
[2013.02.11 18:58:38 | 000,909,728 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctEFA.sys
[2013.02.11 18:58:38 | 000,342,168 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctDS.sys
[2013.02.11 18:58:35 | 000,368,616 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTCore.sys
[2013.02.11 18:58:35 | 000,163,288 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTAppEvent.sys
[2013.02.11 18:58:32 | 000,202,280 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTSD.sys
[2013.02.11 18:58:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2013.02.11 18:57:52 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2013.02.11 18:57:49 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2013.02.11 18:57:48 | 000,000,000 | ---D | C] -- C:\Users\Alex\AppData\Roaming\TestApp
[2013.02.11 18:57:25 | 004,125,336 | ---- | C] (PC Tools) -- C:\Users\Alex\Desktop\PCTools_Safe_Install_SD.exe
[2013.02.09 14:29:38 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013.02.09 14:12:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Wincert
[2013.02.09 14:12:29 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess
[2013.02.09 14:12:14 | 000,000,000 | ---D | C] -- C:\Program Files\Search Results Toolbar
[2013.01.28 18:45:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.01.28 18:45:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2013.01.28 18:45:23 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2013.01.18 17:33:04 | 000,000,000 | ---D | C] -- C:\Users\Alex\Desktop\UNS
[2010.03.12 03:28:59 | 001,100,664 | ---- | C] (Microsoft Corporation) -- C:\Users\Alex\setup.exe

========== Files - Modified Within 30 Days ==========

[2013.02.11 21:30:02 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.02.11 21:24:58 | 000,002,623 | ---- | M] () -- C:\Users\Alex\Desktop\Microsoft Word.lnk
[2013.02.11 21:24:42 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.02.11 21:24:42 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.02.11 21:24:42 | 000,126,260 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.02.11 21:24:42 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.02.11 21:23:10 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.02.11 21:21:26 | 003,416,140 | ---- | M] () -- C:\Windows\System32\drivers\Cat.DB
[2013.02.11 21:18:11 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.02.11 21:18:09 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.11 21:18:09 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.11 21:17:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.02.11 21:14:50 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Alex\Desktop\OTL.exe
[2013.02.11 21:14:36 | 000,050,477 | ---- | M] () -- C:\Users\Alex\Desktop\Defogger.exe
[2013.02.11 20:59:56 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.02.11 20:59:19 | 010,156,344 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Alex\Desktop\mbam-setup-1.70.0.1100.exe
[2013.02.11 20:36:15 | 000,000,000 | ---- | M] () -- C:\Users\Alex\defogger_reenable
[2013.02.11 19:06:14 | 000,001,949 | ---- | M] () -- C:\Users\Public\Desktop\PC Tools Spyware Doctor.lnk
[2013.02.11 18:57:36 | 004,125,336 | ---- | M] (PC Tools) -- C:\Users\Alex\Desktop\PCTools_Safe_Install_SD.exe
[2013.01.18 17:34:59 | 000,014,663 | ---- | M] () -- C:\Users\Alex\Desktop\20130118 Stromrechnung.pdf

========== Files Created - No Company Name ==========

[2013.02.11 21:14:35 | 000,050,477 | ---- | C] () -- C:\Users\Alex\Desktop\Defogger.exe
[2013.02.11 20:59:56 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.02.11 20:36:15 | 000,000,000 | ---- | C] () -- C:\Users\Alex\defogger_reenable
[2013.02.11 19:09:32 | 000,769,144 | ---- | C] () -- C:\Windows\BDTSupport.dll
[2013.02.11 19:09:32 | 000,003,488 | ---- | C] () -- C:\Windows\UDB.zip
[2013.02.11 19:09:32 | 000,000,882 | ---- | C] () -- C:\Windows\RegSDImport.xml
[2013.02.11 19:09:32 | 000,000,879 | ---- | C] () -- C:\Windows\RegISSImport.xml
[2013.02.11 19:09:32 | 000,000,131 | ---- | C] () -- C:\Windows\IDB.zip
[2013.02.11 19:06:14 | 000,001,949 | ---- | C] () -- C:\Users\Public\Desktop\PC Tools Spyware Doctor.lnk
[2013.02.11 18:58:41 | 003,416,140 | ---- | C] () -- C:\Windows\System32\drivers\Cat.DB
[2013.01.18 17:34:58 | 000,014,663 | ---- | C] () -- C:\Users\Alex\Desktop\20130118 Stromrechnung.pdf
[2012.06.10 14:22:50 | 000,000,041 | -HS- | C] () -- C:\ProgramData\.zreglib
[2012.05.28 16:32:14 | 000,003,861 | ---- | C] () -- C:\Users\Alex\.TransferManager.db
[2012.05.14 21:00:09 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2012.04.26 08:29:48 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll
[2012.04.26 08:29:48 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe
[2012.04.24 12:21:09 | 000,010,639 | ---- | C] () -- C:\Users\Alex\Benjamin_elster_2048.pfx
[2012.04.24 10:47:04 | 000,010,639 | ---- | C] () -- C:\Users\Alex\ReginaPf_elster_2048.pfx
[2012.04.07 16:31:42 | 000,091,930 | ---- | C] () -- C:\Users\Alex\ESt2011_Pfarr_Regina.elfo
[2012.03.16 21:56:36 | 000,047,104 | ---- | C] () -- C:\Windows\System32\AntUsbCIv2.dll
[2011.12.25 18:33:05 | 000,000,040 | ---- | C] () -- C:\Users\Alex\AppData\Roaming\cdr.ini
[2011.07.20 08:52:48 | 000,026,999 | ---- | C] () -- C:\Windows\DIIUnin.dat
[2011.07.06 17:27:53 | 000,097,961 | ---- | C] () -- C:\Users\Alex\ESt2010 Regina Pfarr.elfo
[2011.01.22 15:54:07 | 000,006,447 | -HS- | C] () -- C:\Users\Alex\Folder.jpg
[2011.01.22 15:54:07 | 000,001,928 | -HS- | C] () -- C:\Users\Alex\AlbumArtSmall.jpg
[2010.07.19 18:54:49 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.07.12 20:19:26 | 000,000,015 | ---- | C] () -- C:\Users\Alex\ho.dir
[2008.04.21 20:08:41 | 000,007,484 | ---- | C] () -- C:\Users\Alex\AppData\Local\d3d9caps.dat
[2008.02.23 11:39:36 | 000,021,504 | ---- | C] () -- C:\Users\Alex\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2011.01.22 15:49:17 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\Amazon
[2013.01.01 15:42:22 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\calibre
[2012.11.26 21:04:25 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\de.myphotobook.creator.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1
[2011.06.30 08:04:01 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\Dropbox
[2013.02.11 18:36:30 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\DVDVideoSoft
[2012.04.07 15:40:51 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\elsterformular
[2012.04.26 08:29:46 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\FreePDF
[2012.05.14 20:46:22 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\Garmin
[2012.06.08 20:04:31 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\GetRightToGo
[2013.02.11 18:37:36 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\GlarySoft
[2008.02.09 16:21:28 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\ICQ Toolbar
[2008.04.21 19:56:03 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\LiteOn
[2012.05.14 20:51:16 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\OpenCandy
[2010.07.19 13:27:16 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\OpenOffice.org
[2012.05.14 21:16:16 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\Samsung
[2008.05.29 22:39:40 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\temp
[2013.02.11 18:57:48 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\TestApp
[2008.06.04 18:07:37 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\Thinstall
[2012.01.16 19:20:12 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\René's Homepage

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 24 bytes -> C:\Windows:EE5474176155704A
@Alternate Data Stream - 186 bytes -> C:\ProgramData\TEMPFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84

< End of report >

OTL Extras logfile created on: 11.02.2013 21:26:09 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Alex\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,75 Gb Total Physical Memory | 0,85 Gb Available Physical Memory | 48,85% Memory free
3,73 Gb Paging File | 2,49 Gb Available in Paging File | 66,70% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 39,06 Gb Total Space | 5,13 Gb Free Space | 13,13% Space Free | Partition Type: NTFS
Drive D: | 35,47 Gb Total Space | 15,39 Gb Free Space | 43,40% Space Free | Partition Type: NTFS

Computer Name: ALEX-PC | User Name: Alex | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{32C34BAF-E482-49EE-9629-E7DB03659050}" = protocol=6 | dir=in | app=c:\program files\search results toolbar\datamngr\srtool~1\dtuser.exe |
"{44FDBDD3-0242-4D3F-9B6A-5A4712F77B66}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{4C8234DE-EACA-4DF8-AA2C-962441AAD923}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{776F490A-F044-4667-BE7C-91BC469E49CF}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{AA16EE69-A046-4503-B91A-16E2A80AD3A1}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{E90B8152-E4BE-40A9-ADE6-A016EAFDE5B7}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{EB5D6008-CC9A-4147-AECC-DE50B704C017}" = protocol=17 | dir=in | app=c:\program files\search results toolbar\datamngr\srtool~1\dtuser.exe |
"{FDDC9297-15BE-4E35-9A5E-77EFE11CEE1E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{11FE6EF0-F5C1-4E7A-9CFC-6D02BCAE3DA9}D:\diablo ii\game.exe" = protocol=6 | dir=in | app=d:\diablo ii\game.exe |
"TCP Query User{14096228-7B2C-4AB9-9C95-46B4D2C0E152}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"TCP Query User{4856B7E8-76AF-4FE3-ACCB-84FDACAB74C9}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{4AE458A5-DC9F-48EB-9790-B1A8CAFF5758}D:\programme\kav7.0\german\setup.exe" = protocol=6 | dir=in | app=d:\programme\kav7.0\german\setup.exe |
"TCP Query User{ACC23A67-DE2D-4817-9F0D-C6FEED007606}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"TCP Query User{DCA2FEDA-6D3D-4FB8-9D03-C75CC9BD3101}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe |
"TCP Query User{E1CFD2AE-899E-4A3A-9F93-7A04067908A2}D:\diablo ii\game.exe" = protocol=6 | dir=in | app=d:\diablo ii\game.exe |
"TCP Query User{F3BE6F32-6674-474E-A99C-F91F53EB1820}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe |
"UDP Query User{23711B4D-C355-4D7B-9A6D-5C523510F55B}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe |
"UDP Query User{38282681-D9E9-40A1-A131-59EC548ACB79}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{69E2E8AB-BB45-4D0A-9935-B0EFF5503485}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{6E006C96-8668-4D81-8F58-D83C08D666E3}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"UDP Query User{9BF37AB2-C4DE-4A5E-B8DC-6EC323DF270C}D:\diablo ii\game.exe" = protocol=17 | dir=in | app=d:\diablo ii\game.exe |
"UDP Query User{AD876FC0-F41A-4647-8E6A-D3D9BE076868}D:\programme\kav7.0\german\setup.exe" = protocol=17 | dir=in | app=d:\programme\kav7.0\german\setup.exe |
"UDP Query User{B6C638B5-2AA3-46C6-8D08-4B4336AFCE17}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe |
"UDP Query User{FC772F0E-AD2D-4D1B-937F-E36D8BAAA2F5}D:\diablo ii\game.exe" = protocol=17 | dir=in | app=d:\diablo ii\game.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{1752D07B-9BEB-414F-9B51-AA529101F0E5}" = calibre
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{251FE1B1-3227-4CC2-953E-B027BDD248F4}" = Tuner Driver
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 35
"{26A24AE4-039D-4CA4-87B4-2F83217013FF}" = Java 7 Update 13
"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
"{2E4EA28A-7F64-44E4-81C5-7BDF656E3B1D}" = Samsung PC Studio 3
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java(TM) 6 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5C6F884D-680C-448B-B4C9-22296EE1B206}" = Logitech Harmony Remote Software 7
"{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}" = Garmin USB Drivers
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7A21C722-F259-4976-B7AA-6658E5FDEDAF}" = Google Drive
"{80F19EAA-44C4-47C2-AE87-1C7628E858D6}" = Logitech Harmony Remote Software 7
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8471021C-F529-43DE-84DF-3612E10F58C4}" = Remote Control USB Driver
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ED02445-D491-414C-A56D-2ED6BBB7239A}" = Garmin Communicator Plugin
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile-Gerätecenter
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.5) - Deutsch
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{B6D17D97-44CE-402E-BBF2-B38492CBFED7}" = Garmin ANT Agent
"{C491CA52-B4DA-2753-5B4F-0CC9F1C89E6C}" = myphotobook.de
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}" = WinZip 11.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"24DA573F901348FFDFF7717497830D45BE0C362E" = Windows Driver Package - Dynastream Innovations (libusb0) LibUsbDevices (07/07/2009 1.12.2)
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"8FBA55A78723E5046E54FECA5BAB62E8C99ACD3C" = Windows-Treiberpaket - LITEON (Ltn_stk7700pc) Media (11/28/2006 3.0.0.7)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.17
"Browser Defender_is1" = Browser Guard 4.0
"de.myphotobook.creator.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1" = myphotobook.de
"Diablo II" = Diablo II
"ElsterFormular für Privatanwender 12.2.2.6665p" = ElsterFormular für Privatanwender
"FreePDF_XP" = FreePDF (Remove only)
"Google Chrome" = Google Chrome
"GPL Ghostscript 9.04" = GPL Ghostscript
"Kalender-Excel_is1" = Kalender-Excel-8.7
"Kobo" = Kobo
"Magic Workstation_is1" = Magic Workstation 0.94f
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 18.0.2 (x86 de)" = Mozilla Firefox 18.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"PDFTK Builder_is1" = PDFTK Builder 3.5.3
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"RTPatch_is1" = RTPatch Update
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"Spyware Doctor" = PC Tools Spyware Doctor 9.1
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VideoLAN VLC media player 0.8.6c
"Winamp" = Winamp
"WinRAR archiver" = WinRAR

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"UnityWebPlayer" = Unity Web Player
"Winamp Detect" = Winamp Erkennungs-Plug-in

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 08.12.2012 04:38:20 | Computer Name = Alex-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 08.12.2012 04:38:20 | Computer Name = Alex-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 08.12.2012 04:38:21 | Computer Name = Alex-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 08.12.2012 04:38:21 | Computer Name = Alex-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 08.12.2012 04:38:21 | Computer Name = Alex-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 08.12.2012 04:38:21 | Computer Name = Alex-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 01.01.2013 10:23:56 | Computer Name = Alex-PC | Source = Application Hang | ID = 1002
Description = Programm wmplayer.exe, Version 11.0.6002.18311 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen. Prozess-ID: f64 Anfangszeit: 01cde82b95284b33 Zeitpunkt
der Beendigung: 15

Error - 01.01.2013 10:42:24 | Computer Name = Alex-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 10.02.2013 06:29:56 | Computer Name = Alex-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung avguard.exe, Version 12.3.0.15, Zeitstempel
0x4fa05b53, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18541, Zeitstempel 0x4ec3e3d5,
Ausnahmecode 0xc0000374, Fehleroffset 0x000b06b7, Prozess-ID 0x1d8, Anwendungsstartzeit
01ce0777f52da8bf.

Error - 11.02.2013 16:21:34 | Computer Name = Alex-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung fpassist.exe, Version 3.20.0.95, Zeitstempel
0x4e5009ca, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
Ausnahmecode 0xc0000005, Fehleroffset 0x00000000, Prozess-ID 0xe68, Anwendungsstartzeit
01ce089532140e6d.

[ System Events ]
Error - 10.02.2013 06:56:59 | Computer Name = Alex-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 10.02.2013 07:14:51 | Computer Name = Alex-PC | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.0.100 für die Netzwerkkarte mit der Netzwerkadresse
001B9E428C03 wurde durch den DHCP-Server 192.168.0.1 abgelehnt (der DHCP-Server
hat eine DHCPNACK-Meldung gesendet).

Error - 10.02.2013 14:08:01 | Computer Name = Alex-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 10.02.2013 15:28:15 | Computer Name = Alex-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 11.02.2013 11:59:10 | Computer Name = Alex-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 11.02.2013 14:10:29 | Computer Name = Alex-PC | Source = PCTCore | ID = 327960
Description = The item store is corrupted: @5644.

Error - 11.02.2013 14:10:29 | Computer Name = Alex-PC | Source = PCTCore | ID = 327960
Description = The item store is corrupted: @5644.

Error - 11.02.2013 15:07:21 | Computer Name = Alex-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 11.02.2013 15:09:17 | Computer Name = Alex-PC | Source = Service Control Manager | ID = 7030
Description =

Error - 11.02.2013 16:19:17 | Computer Name = Alex-PC | Source = Service Control Manager | ID = 7000
Description =


< End of report >


Ich bin für jede Hilfe dankbar.

Grüße
Benni

Alt 13.02.2013, 10:51   #2
markusg
/// Malware-holic
 
www.searchnu.com/406 wird bei jedem neuen Tab geöffnet - Standard

www.searchnu.com/406 wird bei jedem neuen Tab geöffnet



hi
und die Malwarebytes Funde sollen wir raten?
http://www.trojaner-board.de/125889-...en-posten.html
bitte poste das Log
__________________

__________________

Alt 13.02.2013, 16:40   #3
DonBenni82
 
www.searchnu.com/406 wird bei jedem neuen Tab geöffnet - Standard

www.searchnu.com/406 wird bei jedem neuen Tab geöffnet



Ich bin mir nicht schlüssig ob alle oder nur die neuesten, daher poste ich mal lieber mehr als zu wenig.

Zitat:
Malwarebytes Anti-Malware (Test) 1.70.0.1100
Malwarebytes : Free Anti-Malware download

Datenbank Version: v2013.02.11.09

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Alex :: ALEX-PC [Administrator]

Schutz: Aktiviert

11.02.2013 21:02:46
mbam-log-2013-02-11 (21-02-46).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 191998
Laufzeit: 7 Minute(n), 26 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 8
HKCR\CLSID\{C1ED9DA0-AFD0-4b90-AC6A-D3874F591014} (PUP.Datamngr) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{1FDC0B61-91AC-4157-9B27-CAD9A09AB67E} (PUP.Datamngr) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\BrowserConnection.Loader.1 (PUP.Datamngr) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\BrowserConnection.Loader (PUP.Datamngr) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1ED9DA0-AFD0-4B90-AC6A-D3874F591014} (PUP.Datamngr) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{C1ED9DA0-AFD0-4B90-AC6A-D3874F591014} (PUP.Datamngr) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C1ED9DA0-AFD0-4B90-AC6A-D3874F591014} (PUP.Datamngr) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\System\CurrentControlSet\Services\Windows Tribute Service (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Program Files\Search Results Toolbar\Datamngr\BrowserConnection.dll (PUP.Datamngr) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Zitat:
Malwarebytes Anti-Malware (Test) 1.70.0.1100
Malwarebytes : Free Anti-Malware download

Datenbank Version: v2013.02.11.09

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Alex :: ALEX-PC [Administrator]

Schutz: Aktiviert

12.02.2013 17:59:23
mbam-log-2013-02-12 (17-59-23).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 318568
Laufzeit: 1 Stunde(n), 10 Minute(n), 11 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Die Protectionlogs kann ich anscheind hier nicht reinkopieren. Ich nehme an die sind aber sowieso nicht interessant, sehen zumindest für mich nicht so aus.
__________________

Alt 13.02.2013, 18:03   #4
markusg
/// Malware-holic
 
www.searchnu.com/406 wird bei jedem neuen Tab geöffnet - Standard

www.searchnu.com/406 wird bei jedem neuen Tab geöffnet



das passt.
Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 13.02.2013, 18:54   #5
DonBenni82
 
www.searchnu.com/406 wird bei jedem neuen Tab geöffnet - Standard

www.searchnu.com/406 wird bei jedem neuen Tab geöffnet



Hallo,

es sieht ein kleinwenig anders aus als beschrieben, aber den Report (ist nehme ich an die Logfile) konnte ich direkt dem Programm entnehmen.

Zitat:
18:50:30.0095 4000 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
18:50:30.0268 4000 ============================================================
18:50:30.0268 4000 Current date / time: 2013/02/13 18:50:30.0268
18:50:30.0268 4000 SystemInfo:
18:50:30.0268 4000
18:50:30.0268 4000 OS Version: 6.0.6002 ServicePack: 2.0
18:50:30.0268 4000 Product type: Workstation
18:50:30.0269 4000 ComputerName: ALEX-PC
18:50:30.0269 4000 UserName: Alex
18:50:30.0269 4000 Windows directory: C:\Windows
18:50:30.0269 4000 System windows directory: C:\Windows
18:50:30.0269 4000 Processor architecture: Intel x86
18:50:30.0269 4000 Number of processors: 2
18:50:30.0269 4000 Page size: 0x1000
18:50:30.0269 4000 Boot type: Normal boot
18:50:30.0269 4000 ============================================================
18:50:34.0075 4000 Drive \Device\Harddisk0\DR0 - Size: 0x12A1F16000 (74.53 Gb), SectorSize: 0x200, Cylinders: 0x2601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
18:50:34.0092 4000 ============================================================
18:50:34.0092 4000 \Device\Harddisk0\DR0:
18:50:34.0092 4000 MBR partitions:
18:50:34.0092 4000 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x4E20000
18:50:34.0093 4000 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x4E20800, BlocksNum 0x46EE800
18:50:34.0093 4000 ============================================================
18:50:34.0156 4000 C: <-> \Device\Harddisk0\DR0\Partition1
18:50:34.0259 4000 D: <-> \Device\Harddisk0\DR0\Partition2
18:50:34.0259 4000 ============================================================
18:50:34.0260 4000 Initialize success
18:50:34.0260 4000 ============================================================
18:50:52.0152 3408 ============================================================
18:50:52.0152 3408 Scan started
18:50:52.0153 3408 Mode: Manual; SigCheck; TDLFS;
18:50:52.0153 3408 ============================================================
18:50:53.0193 3408 ================ Scan system memory ========================
18:50:53.0194 3408 System memory - ok
18:50:53.0194 3408 ================ Scan services =============================
18:50:53.0555 3408 [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI C:\Windows\system32\drivers\acpi.sys
18:50:53.0775 3408 ACPI - ok
18:50:53.0899 3408 [ 3927397AC60D943DAF8808AFFED582B7 ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
18:50:53.0920 3408 AdobeARMservice - ok
18:50:53.0997 3408 [ EC807244904FA170C299AB06D87FBDBE ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
18:50:54.0019 3408 AdobeFlashPlayerUpdateSvc - ok
18:50:54.0065 3408 [ 2EDC5BBAC6C651ECE337BDE8ED97C9FB ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
18:50:54.0100 3408 adp94xx - ok
18:50:54.0132 3408 [ B84088CA3CDCA97DA44A984C6CE1CCAD ] adpahci C:\Windows\system32\drivers\adpahci.sys
18:50:54.0160 3408 adpahci - ok
18:50:54.0179 3408 [ 7880C67BCCC27C86FD05AA2AFB5EA469 ] adpu160m C:\Windows\system32\drivers\adpu160m.sys
18:50:54.0200 3408 adpu160m - ok
18:50:54.0220 3408 [ 9AE713F8E30EFC2ABCCD84904333DF4D ] adpu320 C:\Windows\system32\drivers\adpu320.sys
18:50:54.0239 3408 adpu320 - ok
18:50:54.0290 3408 [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
18:50:54.0371 3408 AeLookupSvc - ok
18:50:54.0433 3408 [ 3911B972B55FEA0478476B2E777B29FA ] AFD C:\Windows\system32\drivers\afd.sys
18:50:54.0481 3408 AFD - ok
18:50:54.0530 3408 [ 39E435C90C9C4F780FA0ED05CA3C3A1B ] AgereModemAudio C:\Windows\system32\agrsmsvc.exe
18:50:54.0571 3408 AgereModemAudio - ok
18:50:54.0647 3408 [ CE91B158FA490CF4C4D487A4130F4660 ] AgereSoftModem C:\Windows\system32\DRIVERS\AGRSM.sys
18:50:54.0755 3408 AgereSoftModem - ok
18:50:54.0846 3408 [ EF23439CDD587F64C2C1B8825CEAD7D8 ] agp440 C:\Windows\system32\drivers\agp440.sys
18:50:54.0865 3408 agp440 - ok
18:50:54.0905 3408 [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx C:\Windows\system32\drivers\djsvs.sys
18:50:54.0926 3408 aic78xx - ok
18:50:54.0959 3408 [ A1545B731579895D8CC44FC0481C1192 ] ALG C:\Windows\System32\alg.exe
18:50:55.0048 3408 ALG - ok
18:50:55.0091 3408 [ 3A99CB23A2D326FD532618705D6E3048 ] aliide C:\Windows\system32\drivers\aliide.sys
18:50:55.0109 3408 aliide - ok
18:50:55.0128 3408 [ 2B13E304C9DFDFA5EB582F6A149FA2C7 ] amdagp C:\Windows\system32\drivers\amdagp.sys
18:50:55.0156 3408 amdagp - ok
18:50:55.0180 3408 [ 4333C133DBD71C7D7FE4FB1B83F9EE3E ] amdide C:\Windows\system32\drivers\amdide.sys
18:50:55.0222 3408 amdide - ok
18:50:55.0260 3408 [ DC487885BCEF9F28EECE6FAC0E5DDFC5 ] AmdK7 C:\Windows\system32\drivers\amdk7.sys
18:50:55.0335 3408 AmdK7 - ok
18:50:55.0363 3408 [ 0CA0071DA4315B00FC1328CA86B425DA ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
18:50:55.0460 3408 AmdK8 - ok
18:50:55.0518 3408 [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo C:\Windows\System32\appinfo.dll
18:50:55.0606 3408 Appinfo - ok
18:50:55.0670 3408 [ 5F673180268BB1FDB69C99B6619FE379 ] arc C:\Windows\system32\drivers\arc.sys
18:50:55.0707 3408 arc - ok
18:50:55.0756 3408 [ 957F7540B5E7F602E44648C7DE5A1C05 ] arcsas C:\Windows\system32\drivers\arcsas.sys
18:50:55.0801 3408 arcsas - ok
18:50:55.0863 3408 [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
18:50:55.0967 3408 AsyncMac - ok
18:50:56.0007 3408 [ 1F05B78AB91C9075565A9D8A4B880BC4 ] atapi C:\Windows\system32\drivers\atapi.sys
18:50:56.0027 3408 atapi - ok
18:50:56.0114 3408 [ F32FEE7CB2EE32C1F808409BC8019701 ] athr C:\Windows\system32\DRIVERS\athr.sys
18:50:56.0255 3408 athr - ok
18:50:56.0322 3408 [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
18:50:56.0389 3408 AudioEndpointBuilder - ok
18:50:56.0418 3408 [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv C:\Windows\System32\Audiosrv.dll
18:50:56.0476 3408 Audiosrv - ok
18:50:56.0557 3408 [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep C:\Windows\system32\drivers\Beep.sys
18:50:56.0647 3408 Beep - ok
18:50:56.0729 3408 [ C789AF0F724FDA5852FB9A7D3A432381 ] BFE C:\Windows\System32\bfe.dll
18:50:56.0778 3408 BFE - ok
18:50:56.0857 3408 [ 93952506C6D67330367F7E7934B6A02F ] BITS C:\Windows\System32\qmgr.dll
18:50:56.0918 3408 BITS - ok
18:50:56.0926 3408 blbdrive - ok
18:50:56.0958 3408 [ 35F376253F687BDE63976CCB3F2108CA ] bowser C:\Windows\system32\DRIVERS\bowser.sys
18:50:56.0991 3408 bowser - ok
18:50:57.0012 3408 [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo C:\Windows\system32\drivers\brfiltlo.sys
18:50:57.0064 3408 BrFiltLo - ok
18:50:57.0087 3408 [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp C:\Windows\system32\drivers\brfiltup.sys
18:50:57.0128 3408 BrFiltUp - ok
18:50:57.0171 3408 [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser C:\Windows\System32\browser.dll
18:50:57.0235 3408 Browser - ok
18:50:57.0367 3408 [ 52C724DAC8ADDC50F593E331A9863979 ] Browser Defender Update Service C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe
18:50:57.0405 3408 Browser Defender Update Service - ok
18:50:57.0475 3408 [ B304E75CFF293029EDDF094246747113 ] Brserid C:\Windows\system32\drivers\brserid.sys
18:50:57.0583 3408 Brserid - ok
18:50:57.0605 3408 [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm C:\Windows\system32\drivers\brserwdm.sys
18:50:57.0688 3408 BrSerWdm - ok
18:50:57.0706 3408 [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm C:\Windows\system32\drivers\brusbmdm.sys
18:50:57.0790 3408 BrUsbMdm - ok
18:50:57.0799 3408 [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer C:\Windows\system32\drivers\brusbser.sys
18:50:57.0871 3408 BrUsbSer - ok
18:50:57.0910 3408 [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
18:50:58.0037 3408 BTHMODEM - ok
18:50:58.0133 3408 [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
18:50:58.0249 3408 cdfs - ok
18:50:58.0317 3408 [ 6B4BFFB9BECD728097024276430DB314 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
18:50:58.0385 3408 cdrom - ok
18:50:58.0515 3408 [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc C:\Windows\System32\certprop.dll
18:50:58.0574 3408 CertPropSvc - ok
18:50:58.0608 3408 [ DA8E0AFC7BAA226C538EF53AC2F90897 ] circlass C:\Windows\system32\drivers\circlass.sys
18:50:58.0679 3408 circlass - ok
18:50:58.0721 3408 [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS C:\Windows\system32\CLFS.sys
18:50:58.0749 3408 CLFS - ok
18:50:58.0808 3408 [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
18:50:58.0827 3408 clr_optimization_v2.0.50727_32 - ok
18:50:58.0919 3408 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
18:50:58.0979 3408 clr_optimization_v4.0.30319_32 - ok
18:50:59.0051 3408 [ 99AFC3795B58CC478FBBBCDC658FCB56 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
18:50:59.0170 3408 CmBatt - ok
18:50:59.0236 3408 [ DFB94A6FC3A26972B0461AB5F1D8272B ] cmdide C:\Windows\system32\drivers\cmdide.sys
18:50:59.0278 3408 cmdide - ok
18:50:59.0356 3408 [ 6AFEF0B60FA25DE07C0968983EE4F60A ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
18:50:59.0393 3408 Compbatt - ok
18:50:59.0415 3408 COMSysApp - ok
18:50:59.0463 3408 [ 2A213AE086BBEC5E937553C7D9A2B22C ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
18:50:59.0483 3408 crcdisk - ok
18:50:59.0505 3408 [ 22A7F883508176489F559EE745B5BF5D ] Crusoe C:\Windows\system32\drivers\crusoe.sys
18:50:59.0598 3408 Crusoe - ok
18:50:59.0685 3408 [ F1E8C34892336D33EDDCDFE44E474F64 ] CryptSvc C:\Windows\system32\cryptsvc.dll
18:50:59.0865 3408 CryptSvc - ok
18:50:59.0944 3408 [ B5ECADF7708960F1818C7FA015F4C239 ] CVirtA C:\Windows\system32\DRIVERS\CVirtA.sys
18:50:59.0980 3408 CVirtA - ok
18:51:00.0132 3408 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch C:\Windows\system32\rpcss.dll
18:51:00.0201 3408 DcomLaunch - ok
18:51:00.0249 3408 [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC C:\Windows\system32\Drivers\dfsc.sys
18:51:00.0342 3408 DfsC - ok
18:51:00.0756 3408 [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR C:\Windows\system32\DFSR.exe
18:51:01.0021 3408 DFSR - ok
18:51:01.0126 3408 [ 9028559C132146FB75EB7ACF384B086A ] Dhcp C:\Windows\System32\dhcpcsvc.dll
18:51:01.0187 3408 Dhcp - ok
18:51:01.0248 3408 [ 5D4AEFC3386920236A548271F8F1AF6A ] disk C:\Windows\system32\drivers\disk.sys
18:51:01.0286 3408 disk - ok
18:51:01.0351 3408 [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache C:\Windows\System32\dnsrslvr.dll
18:51:01.0399 3408 Dnscache - ok
18:51:01.0443 3408 [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc C:\Windows\System32\dot3svc.dll
18:51:01.0495 3408 dot3svc - ok
18:51:01.0559 3408 [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS C:\Windows\system32\dps.dll
18:51:01.0615 3408 DPS - ok
18:51:01.0682 3408 [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
18:51:01.0740 3408 drmkaud - ok
18:51:01.0843 3408 [ 2B76BB072234EFCC4C495A05E384AF49 ] DTVFW C:\Windows\system32\DRIVERS\dtvfw.sys
18:51:01.0883 3408 DTVFW - ok
18:51:02.0006 3408 [ C68AC676B0EF30CFBB1080ADCE49EB1F ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
18:51:02.0073 3408 DXGKrnl - ok
18:51:02.0138 3408 [ F88FB26547FD2CE6D0A5AF2985892C48 ] E1G60 C:\Windows\system32\DRIVERS\E1G60I32.sys
18:51:02.0218 3408 E1G60 - ok
18:51:02.0283 3408 [ C0B95E40D85CD807D614E264248A45B9 ] EapHost C:\Windows\System32\eapsvc.dll
18:51:02.0336 3408 EapHost - ok
18:51:02.0447 3408 [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache C:\Windows\system32\drivers\ecache.sys
18:51:02.0472 3408 Ecache - ok
18:51:02.0573 3408 [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
18:51:02.0602 3408 ehRecvr - ok
18:51:02.0651 3408 [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched C:\Windows\ehome\ehsched.exe
18:51:02.0710 3408 ehSched - ok
18:51:02.0751 3408 [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart C:\Windows\ehome\ehstart.dll
18:51:02.0792 3408 ehstart - ok
18:51:02.0913 3408 [ D71233D7CCC2E64F8715A20428D5A33B ] ElbyCDIO C:\Windows\system32\Drivers\ElbyCDIO.sys
18:51:02.0998 3408 ElbyCDIO - ok
18:51:03.0098 3408 [ E8F3F21A71720C84BCF423B80028359F ] elxstor C:\Windows\system32\drivers\elxstor.sys
18:51:03.0130 3408 elxstor - ok
18:51:03.0226 3408 [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt C:\Windows\system32\emdmgmt.dll
18:51:03.0322 3408 EMDMgmt - ok
18:51:03.0394 3408 [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem C:\Windows\system32\es.dll
18:51:03.0439 3408 EventSystem - ok
18:51:03.0511 3408 [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat C:\Windows\system32\drivers\exfat.sys
18:51:03.0719 3408 exfat - ok
18:51:03.0819 3408 [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat C:\Windows\system32\drivers\fastfat.sys
18:51:03.0975 3408 fastfat - ok
18:51:04.0050 3408 [ 63BDADA84951B9C03E641800E176898A ] fdc C:\Windows\system32\DRIVERS\fdc.sys
18:51:04.0130 3408 fdc - ok
18:51:04.0174 3408 [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost C:\Windows\system32\fdPHost.dll
18:51:04.0233 3408 fdPHost - ok
18:51:04.0288 3408 [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub C:\Windows\system32\fdrespub.dll
18:51:04.0374 3408 FDResPub - ok
18:51:04.0415 3408 [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
18:51:04.0446 3408 FileInfo - ok
18:51:04.0486 3408 [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace C:\Windows\system32\drivers\filetrace.sys
18:51:04.0527 3408 Filetrace - ok
18:51:04.0568 3408 [ 6603957EFF5EC62D25075EA8AC27DE68 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
18:51:04.0652 3408 flpydisk - ok
18:51:04.0732 3408 [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
18:51:04.0759 3408 FltMgr - ok
18:51:04.0941 3408 [ 8CE364388C8ECA59B14B539179276D44 ] FontCache C:\Windows\system32\FntCache.dll
18:51:05.0016 3408 FontCache - ok
18:51:05.0141 3408 [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
18:51:05.0186 3408 FontCache3.0.0.0 - ok
18:51:05.0243 3408 [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
18:51:05.0304 3408 Fs_Rec - ok
18:51:05.0364 3408 [ 4E1CD0A45C50A8882616CAE5BF82F3C5 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
18:51:05.0395 3408 gagp30kx - ok
18:51:05.0518 3408 [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc C:\Windows\System32\gpsvc.dll
18:51:05.0608 3408 gpsvc - ok
18:51:05.0741 3408 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe
18:51:05.0758 3408 gupdate - ok
18:51:05.0795 3408 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
18:51:05.0815 3408 gupdatem - ok
18:51:05.0911 3408 [ 3F90E001369A07243763BD5A523D8722 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
18:51:05.0972 3408 HdAudAddService - ok
18:51:06.0072 3408 [ 062452B7FFD68C8C042A6261FE8DFF4A ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
18:51:06.0229 3408 HDAudBus - ok
18:51:06.0305 3408 [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth C:\Windows\system32\drivers\hidbth.sys
18:51:06.0373 3408 HidBth - ok
18:51:06.0390 3408 [ FF3160C3A2445128C5A6D9B076DA519E ] HidIr C:\Windows\system32\drivers\hidir.sys
18:51:06.0486 3408 HidIr - ok
18:51:06.0533 3408 [ 84067081F3318162797385E11A8F0582 ] hidserv C:\Windows\system32\hidserv.dll
18:51:06.0570 3408 hidserv - ok
18:51:06.0600 3408 [ CCA4B519B17E23A00B826C55716809CC ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
18:51:06.0659 3408 HidUsb - ok
18:51:06.0698 3408 [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc C:\Windows\system32\kmsvc.dll
18:51:06.0765 3408 hkmsvc - ok
18:51:06.0791 3408 [ DF353B401001246853763C4B7AAA6F50 ] HpCISSs C:\Windows\system32\drivers\hpcisss.sys
18:51:06.0816 3408 HpCISSs - ok
18:51:06.0943 3408 [ F870AA3E254628EBEAFE754108D664DE ] HTTP C:\Windows\system32\drivers\HTTP.sys
18:51:07.0032 3408 HTTP - ok
18:51:07.0050 3408 [ 324C2152FF2C61ABAE92D09F3CCA4D63 ] i2omp C:\Windows\system32\drivers\i2omp.sys
18:51:07.0069 3408 i2omp - ok
18:51:07.0157 3408 [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
18:51:07.0217 3408 i8042prt - ok
18:51:07.0270 3408 [ C957BF4B5D80B46C5017BF0101E6C906 ] iaStorV C:\Windows\system32\drivers\iastorv.sys
18:51:07.0302 3408 iaStorV - ok
18:51:07.0510 3408 [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
18:51:07.0785 3408 idsvc - ok
18:51:07.0813 3408 [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp C:\Windows\system32\drivers\iirsp.sys
18:51:07.0845 3408 iirsp - ok
18:51:07.0919 3408 [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT C:\Windows\System32\ikeext.dll
18:51:08.0020 3408 IKEEXT - ok
18:51:08.0144 3408 [ 1C60617D54BC9F035671A44B75D9F7CC ] intelide C:\Windows\system32\drivers\intelide.sys
18:51:08.0170 3408 intelide - ok
18:51:08.0223 3408 [ 224191001E78C89DFA78924C3EA595FF ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
18:51:08.0310 3408 intelppm - ok
18:51:08.0352 3408 [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum C:\Windows\system32\ipbusenum.dll
18:51:08.0428 3408 IPBusEnum - ok
18:51:08.0461 3408 [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
18:51:08.0524 3408 IpFilterDriver - ok
18:51:08.0565 3408 [ 1998BD97F950680BB55F55A7244679C2 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
18:51:08.0608 3408 iphlpsvc - ok
18:51:08.0617 3408 IpInIp - ok
18:51:08.0653 3408 [ 40F34F8ABA2A015D780E4B09138B6C17 ] IPMIDRV C:\Windows\system32\drivers\ipmidrv.sys
18:51:08.0785 3408 IPMIDRV - ok
18:51:08.0847 3408 [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT C:\Windows\system32\DRIVERS\ipnat.sys
18:51:08.0946 3408 IPNAT - ok
18:51:08.0980 3408 [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
18:51:09.0034 3408 IRENUM - ok
18:51:09.0199 3408 [ 350FCA7E73CF65BCEF43FAE1E4E91293 ] isapnp C:\Windows\system32\drivers\isapnp.sys
18:51:09.0221 3408 isapnp - ok
18:51:09.0286 3408 [ 232FA340531D940AAC623B121A595034 ] iScsiPrt C:\Windows\system32\DRIVERS\msiscsi.sys
18:51:09.0317 3408 iScsiPrt - ok
18:51:09.0345 3408 [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi C:\Windows\system32\drivers\iteatapi.sys
18:51:09.0365 3408 iteatapi - ok
18:51:09.0388 3408 [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid C:\Windows\system32\drivers\iteraid.sys
18:51:09.0406 3408 iteraid - ok
18:51:09.0443 3408 [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
18:51:09.0463 3408 kbdclass - ok
18:51:09.0487 3408 [ D2600CB17B7408B4A83F231DC9A11AC3 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys
18:51:09.0560 3408 kbdhid - ok
18:51:09.0616 3408 [ A3E186B4B935905B829219502557314E ] KeyIso C:\Windows\system32\lsass.exe
18:51:09.0655 3408 KeyIso - ok
18:51:09.0757 3408 [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
18:51:09.0815 3408 KSecDD - ok
18:51:09.0910 3408 [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm C:\Windows\system32\msdtckrm.dll
18:51:10.0007 3408 KtmRm - ok
18:51:10.0086 3408 [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer C:\Windows\system32\srvsvc.dll
18:51:10.0130 3408 LanmanServer - ok
18:51:10.0241 3408 [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
18:51:10.0267 3408 LanmanWorkstation - ok
18:51:10.0357 3408 [ CB5D13966F74D7F000724A907F614193 ] libusb0 C:\Windows\system32\DRIVERS\libusb0.sys
18:51:10.0389 3408 libusb0 - ok
18:51:10.0444 3408 [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
18:51:10.0537 3408 lltdio - ok
18:51:10.0598 3408 [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc C:\Windows\System32\lltdsvc.dll
18:51:10.0705 3408 lltdsvc - ok
18:51:10.0747 3408 [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts C:\Windows\System32\lmhsvc.dll
18:51:10.0867 3408 lmhosts - ok
18:51:10.0919 3408 [ A2262FB9F28935E862B4DB46438C80D2 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
18:51:10.0962 3408 LSI_FC - ok
18:51:10.0998 3408 [ 30D73327D390F72A62F32C103DAF1D6D ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
18:51:11.0046 3408 LSI_SAS - ok
18:51:11.0080 3408 [ E1E36FEFD45849A95F1AB81DE0159FE3 ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
18:51:11.0106 3408 LSI_SCSI - ok
18:51:11.0205 3408 [ D11DBA1438D4BFC44E6E1554127877EB ] Ltn_stk7700pc C:\Windows\system32\Drivers\Ltn_stk7700pc.sys
18:51:11.0261 3408 Ltn_stk7700pc - ok
18:51:11.0300 3408 [ 8F5C7426567798E62A3B3614965D62CC ] luafv C:\Windows\system32\drivers\luafv.sys
18:51:11.0380 3408 luafv - ok
18:51:11.0481 3408 [ 629CABB0421668C9D3D402A3C3D77E14 ] MBAMProtector C:\Windows\system32\drivers\mbam.sys
18:51:11.0498 3408 MBAMProtector - ok
18:51:11.0651 3408 [ 1ACAA67676E9E7BDA5E0C41B6E0DECAF ] MBAMScheduler C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
18:51:11.0685 3408 MBAMScheduler - ok
18:51:11.0742 3408 [ 916B8954AC3E06DC9E898AFFB41F3FB6 ] MBAMService C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
18:51:11.0776 3408 MBAMService - ok
18:51:11.0833 3408 [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
18:51:11.0883 3408 Mcx2Svc - ok
18:51:11.0932 3408 [ D153B14FC6598EAE8422A2037553ADCE ] megasas C:\Windows\system32\drivers\megasas.sys
18:51:11.0966 3408 megasas - ok
18:51:12.0022 3408 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS C:\Windows\system32\mmcss.dll
18:51:12.0088 3408 MMCSS - ok
18:51:12.0117 3408 [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem C:\Windows\system32\drivers\modem.sys
18:51:12.0171 3408 Modem - ok
18:51:12.0230 3408 [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
18:51:12.0286 3408 monitor - ok
18:51:12.0872 3408 [ 5BF6A1326A335C5298477754A506D263 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
18:51:12.0890 3408 mouclass - ok
18:51:13.0182 3408 [ 93B8D4869E12CFBE663915502900876F ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
18:51:13.0252 3408 mouhid - ok
18:51:13.0292 3408 [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr C:\Windows\system32\drivers\mountmgr.sys
18:51:13.0312 3408 MountMgr - ok
18:51:13.0380 3408 [ 51A84B690DF519DCF656F780243D953E ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
18:51:13.0486 3408 MozillaMaintenance - ok
18:51:13.0572 3408 [ 583A41F26278D9E0EA548163D6139397 ] mpio C:\Windows\system32\drivers\mpio.sys
18:51:13.0591 3408 mpio - ok
18:51:13.0653 3408 [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
18:51:13.0718 3408 mpsdrv - ok
18:51:13.0825 3408 [ 5DE62C6E9108F14F6794060A9BDECAEC ] MpsSvc C:\Windows\system32\mpssvc.dll
18:51:14.0056 3408 MpsSvc - ok
18:51:14.0101 3408 [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x C:\Windows\system32\drivers\mraid35x.sys
18:51:14.0127 3408 Mraid35x - ok
18:51:14.0176 3408 [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
18:51:14.0244 3408 MRxDAV - ok
18:51:14.0297 3408 [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
18:51:14.0377 3408 mrxsmb - ok
18:51:14.0422 3408 [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
18:51:14.0644 3408 mrxsmb10 - ok
18:51:14.0671 3408 [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
18:51:14.0742 3408 mrxsmb20 - ok
18:51:14.0781 3408 [ F0EC3A4E0693A34B148723B4DA31668C ] msahci C:\Windows\system32\drivers\msahci.sys
18:51:14.0806 3408 msahci - ok
18:51:14.0842 3408 [ 3FC82A2AE4CC149165A94699183D3028 ] msdsm C:\Windows\system32\drivers\msdsm.sys
18:51:14.0872 3408 msdsm - ok
18:51:14.0927 3408 [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC C:\Windows\System32\msdtc.exe
18:51:15.0020 3408 MSDTC - ok
18:51:15.0087 3408 [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs C:\Windows\system32\drivers\Msfs.sys
18:51:15.0166 3408 Msfs - ok
18:51:15.0222 3408 [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
18:51:15.0241 3408 msisadrv - ok
18:51:15.0272 3408 [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
18:51:15.0350 3408 MSiSCSI - ok
18:51:15.0365 3408 msiserver - ok
18:51:15.0405 3408 [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
18:51:15.0477 3408 MSKSSRV - ok
18:51:15.0524 3408 [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
18:51:15.0600 3408 MSPCLOCK - ok
18:51:15.0635 3408 [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
18:51:15.0693 3408 MSPQM - ok
18:51:15.0726 3408 [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
18:51:15.0751 3408 MsRPC - ok
18:51:15.0770 3408 [ E384487CB84BE41D09711C30CA79646C ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
18:51:15.0790 3408 mssmbios - ok
18:51:15.0798 3408 [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
18:51:15.0838 3408 MSTEE - ok
18:51:15.0879 3408 [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup C:\Windows\system32\Drivers\mup.sys
18:51:15.0907 3408 Mup - ok
18:51:15.0982 3408 [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent C:\Windows\system32\qagentRT.dll
18:51:16.0039 3408 napagent - ok
18:51:16.0105 3408 [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
18:51:16.0143 3408 NativeWifiP - ok
18:51:16.0193 3408 [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS C:\Windows\system32\drivers\ndis.sys
18:51:16.0236 3408 NDIS - ok
18:51:16.0274 3408 [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
18:51:16.0321 3408 NdisTapi - ok
18:51:16.0355 3408 [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
18:51:16.0408 3408 Ndisuio - ok
18:51:16.0460 3408 [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
18:51:16.0495 3408 NdisWan - ok
18:51:16.0532 3408 [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
18:51:16.0574 3408 NDProxy - ok
18:51:16.0631 3408 [ 51C6D8BFBD4EA5B62A1BA7F4469250D3 ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
18:51:16.0649 3408 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
18:51:16.0649 3408 Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
18:51:16.0688 3408 [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
18:51:16.0737 3408 NetBIOS - ok
18:51:16.0790 3408 [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt C:\Windows\system32\DRIVERS\netbt.sys
18:51:16.0851 3408 netbt - ok
18:51:16.0882 3408 [ A3E186B4B935905B829219502557314E ] Netlogon C:\Windows\system32\lsass.exe
18:51:16.0916 3408 Netlogon - ok
18:51:16.0975 3408 [ C8052711DAECC48B982434C5116CA401 ] Netman C:\Windows\System32\netman.dll
18:51:17.0029 3408 Netman - ok
18:51:17.0085 3408 [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm C:\Windows\System32\netprofm.dll
18:51:17.0163 3408 netprofm - ok
18:51:17.0219 3408 [ D6C4E4A39A36029AC0813D476FBD0248 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
18:51:17.0250 3408 NetTcpPortSharing - ok
18:51:17.0293 3408 [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
18:51:17.0330 3408 nfrd960 - ok
18:51:17.0394 3408 [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc C:\Windows\System32\nlasvc.dll
18:51:17.0448 3408 NlaSvc - ok
18:51:17.0518 3408 [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs C:\Windows\system32\drivers\Npfs.sys
18:51:17.0568 3408 Npfs - ok
18:51:17.0611 3408 [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi C:\Windows\system32\nsisvc.dll
18:51:17.0660 3408 nsi - ok
18:51:17.0712 3408 [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
18:51:17.0776 3408 nsiproxy - ok
18:51:17.0920 3408 [ 6A4A98CEE84CF9E99564510DDA4BAA47 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
18:51:18.0157 3408 Ntfs - ok
18:51:18.0208 3408 [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi C:\Windows\system32\drivers\ntrigdigi.sys
18:51:18.0292 3408 ntrigdigi - ok
18:51:18.0346 3408 [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null C:\Windows\system32\drivers\Null.sys
18:51:18.0396 3408 Null - ok
18:51:18.0437 3408 [ E69E946F80C1C31C53003BFBF50CBB7C ] nvraid C:\Windows\system32\drivers\nvraid.sys
18:51:18.0456 3408 nvraid - ok
18:51:18.0480 3408 [ 9E0BA19A28C498A6D323D065DB76DFFC ] nvstor C:\Windows\system32\drivers\nvstor.sys
18:51:18.0517 3408 nvstor - ok
18:51:18.0549 3408 [ 07C186427EB8FCC3D8D7927187F260F7 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
18:51:18.0570 3408 nv_agp - ok
18:51:18.0578 3408 NwlnkFlt - ok
18:51:18.0588 3408 NwlnkFwd - ok
18:51:18.0665 3408 [ BE32DA025A0BE1878F0EE8D6D9386CD5 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
18:51:18.0763 3408 ohci1394 - ok
18:51:18.0851 3408 [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc C:\Windows\system32\p2psvc.dll
18:51:18.0967 3408 p2pimsvc - ok
18:51:18.0991 3408 [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc C:\Windows\system32\p2psvc.dll
18:51:19.0049 3408 p2psvc - ok
18:51:19.0094 3408 [ 0FA9B5055484649D63C303FE404E5F4D ] Parport C:\Windows\system32\drivers\parport.sys
18:51:19.0187 3408 Parport - ok
18:51:19.0236 3408 [ B9C2B89F08670E159F7181891E449CD9 ] partmgr C:\Windows\system32\drivers\partmgr.sys
18:51:19.0272 3408 partmgr - ok
18:51:19.0339 3408 [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm C:\Windows\system32\drivers\parvdm.sys
18:51:19.0440 3408 Parvdm - ok
18:51:19.0516 3408 [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc C:\Windows\System32\pcasvc.dll
18:51:19.0539 3408 PcaSvc - ok
18:51:19.0591 3408 [ 941DC1D19E7E8620F40BBC206981EFDB ] pci C:\Windows\system32\drivers\pci.sys
18:51:19.0613 3408 pci - ok
18:51:19.0644 3408 [ 1636D43F10416AEB483BC6001097B26C ] pciide C:\Windows\system32\drivers\pciide.sys
18:51:19.0666 3408 pciide - ok
18:51:19.0763 3408 [ E6F3FB1B86AA519E7698AD05E58B04E5 ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
18:51:19.0788 3408 pcmcia - ok
18:51:19.0840 3408 [ 9DCE45B0DC51EBB7CD7063F8C3B086D0 ] PCTBD C:\Windows\system32\Drivers\PCTBD.sys
18:51:19.0874 3408 PCTBD - ok
18:51:19.0990 3408 [ 07D9D16537B6969F2BBE00485F10D5BA ] PCTCore C:\Windows\system32\drivers\PCTCore.sys
18:51:20.0049 3408 PCTCore - ok
18:51:20.0118 3408 [ 3C9FD593E95B98C642B4486CD122C2FB ] pctDS C:\Windows\system32\drivers\pctDS.sys
18:51:20.0164 3408 pctDS - ok
18:51:20.0278 3408 [ DB6B6E47165B9647B215CEEB4DB33B87 ] pctEFA C:\Windows\system32\drivers\pctEFA.sys
18:51:20.0479 3408 pctEFA - ok
18:51:20.0542 3408 [ AE500FF14A222636CD10D346C37A52C4 ] pctgntdi C:\Windows\System32\drivers\pctgntdi.sys
18:51:20.0563 3408 pctgntdi - ok
18:51:20.0607 3408 [ 2E1A727C2B68ED6D4B0CAF6E7565AE50 ] pctplsg C:\Windows\System32\drivers\pctplsg.sys
18:51:20.0653 3408 pctplsg - ok
18:51:20.0682 3408 [ 53CE0E9078360553FAB0BFFF1C1ECF4F ] pctplsm C:\Windows\System32\drivers\pctplsm.sys
18:51:20.0740 3408 pctplsm - ok
18:51:20.0845 3408 [ 9A073A09F22C63247964B946F04CB8A4 ] PCTSD C:\Windows\system32\Drivers\PCTSD.sys
18:51:20.0865 3408 PCTSD - ok
18:51:20.0984 3408 [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH C:\Windows\system32\drivers\peauth.sys
18:51:21.0111 3408 PEAUTH - ok
18:51:21.0250 3408 [ B1689DF169143F57053F795390C99DB3 ] pla C:\Windows\system32\pla.dll
18:51:21.0356 3408 pla - ok
18:51:21.0452 3408 [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay C:\Windows\system32\umpnpmgr.dll
18:51:21.0507 3408 PlugPlay - ok
18:51:21.0555 3408 [ 79834AA2FBF9FE81EEBB229024F6F7FC ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
18:51:21.0570 3408 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
18:51:21.0570 3408 Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
18:51:21.0603 3408 [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg C:\Windows\system32\p2psvc.dll
18:51:21.0682 3408 PNRPAutoReg - ok
18:51:21.0706 3408 [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc C:\Windows\system32\p2psvc.dll
18:51:21.0748 3408 PNRPsvc - ok
18:51:21.0804 3408 [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
18:51:21.0908 3408 PolicyAgent - ok
18:51:21.0964 3408 [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
18:51:22.0184 3408 PptpMiniport - ok
18:51:22.0253 3408 [ 0E3CEF5D28B40CF273281D620C50700A ] Processor C:\Windows\system32\drivers\processr.sys
18:51:22.0334 3408 Processor - ok
18:51:22.0359 3408 [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc C:\Windows\system32\profsvc.dll
18:51:22.0408 3408 ProfSvc - ok
18:51:22.0438 3408 [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\Windows\system32\lsass.exe
18:51:22.0459 3408 ProtectedStorage - ok
18:51:22.0490 3408 [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched C:\Windows\system32\DRIVERS\pacer.sys
18:51:22.0522 3408 PSched - ok
18:51:22.0583 3408 [ CCDAC889326317792480C0A67156A1EC ] ql2300 C:\Windows\system32\drivers\ql2300.sys
18:51:22.0674 3408 ql2300 - ok
18:51:22.0714 3408 [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
18:51:22.0735 3408 ql40xx - ok
18:51:22.0778 3408 [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE C:\Windows\system32\qwave.dll
18:51:22.0827 3408 QWAVE - ok
18:51:22.0866 3408 [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
18:51:22.0947 3408 QWAVEdrv - ok
18:51:23.0297 3408 [ 9AFA62DB7F553A0F1F52C70B738B0064 ] R300 C:\Windows\system32\DRIVERS\atikmdag.sys
18:51:23.0436 3408 R300 - ok
18:51:23.0531 3408 [ 8F97D374AD1857E1EED85A79F29A1D3D ] RapiMgr C:\Windows\WindowsMobile\rapimgr.dll
18:51:23.0551 3408 RapiMgr - ok
18:51:23.0593 3408 [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
18:51:23.0646 3408 RasAcd - ok
18:51:23.0683 3408 [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto C:\Windows\System32\rasauto.dll
18:51:23.0734 3408 RasAuto - ok
18:51:23.0763 3408 [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
18:51:23.0817 3408 Rasl2tp - ok
18:51:23.0856 3408 [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan C:\Windows\System32\rasmans.dll
18:51:23.0942 3408 RasMan - ok
18:51:23.0989 3408 [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
18:51:24.0051 3408 RasPppoe - ok
18:51:24.0090 3408 [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
18:51:24.0143 3408 RasSstp - ok
18:51:24.0194 3408 [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
18:51:24.0258 3408 rdbss - ok
18:51:24.0314 3408 [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
18:51:24.0367 3408 RDPCDD - ok
18:51:24.0430 3408 [ E8BD98D46F2ED77132BA927FCCB47D8B ] rdpdr C:\Windows\system32\drivers\rdpdr.sys
18:51:24.0553 3408 rdpdr - ok
18:51:24.0562 3408 [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
18:51:24.0601 3408 RDPENCDD - ok
18:51:24.0650 3408 [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
18:51:24.0694 3408 RDPWD - ok
18:51:24.0742 3408 [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess C:\Windows\System32\mprdim.dll
18:51:24.0783 3408 RemoteAccess - ok
18:51:24.0842 3408 [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry C:\Windows\system32\regsvc.dll
18:51:24.0926 3408 RemoteRegistry - ok
18:51:25.0078 3408 [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator C:\Windows\system32\locator.exe
18:51:26.0423 3408 RpcLocator - ok
18:51:26.0623 3408 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs C:\Windows\system32\rpcss.dll
18:51:26.0716 3408 RpcSs - ok
18:51:26.0754 3408 [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
18:51:26.0811 3408 rspndr - ok
18:51:26.0838 3408 [ A3E186B4B935905B829219502557314E ] SamSs C:\Windows\system32\lsass.exe
18:51:26.0860 3408 SamSs - ok
18:51:26.0894 3408 [ 3CE8F073A557E172B330109436984E30 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
18:51:26.0913 3408 sbp2port - ok
18:51:26.0952 3408 [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr C:\Windows\System32\SCardSvr.dll
18:51:26.0993 3408 SCardSvr - ok
18:51:27.0137 3408 [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule C:\Windows\system32\schedsvc.dll
18:51:27.0253 3408 Schedule - ok
18:51:27.0303 3408 [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc C:\Windows\System32\certprop.dll
18:51:27.0334 3408 SCPolicySvc - ok
18:51:27.0410 3408 [ AE88672774DF12BEDF76768E52D23424 ] sdAuxService C:\Program Files\PC Tools\PC Tools Security\pctsAuxs.exe
18:51:27.0439 3408 sdAuxService - ok
18:51:27.0492 3408 [ 5FC31ADB3B47E00349B92E57117D2C07 ] sdCoreService C:\Program Files\PC Tools\PC Tools Security\pctsSvc.exe
18:51:27.0550 3408 sdCoreService - ok
18:51:27.0616 3408 [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC C:\Windows\System32\SDRSVC.dll
18:51:27.0659 3408 SDRSVC - ok
18:51:27.0685 3408 [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv C:\Windows\system32\drivers\secdrv.sys
18:51:27.0791 3408 secdrv - ok
18:51:27.0824 3408 [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon C:\Windows\system32\seclogon.dll
18:51:27.0871 3408 seclogon - ok
18:51:27.0904 3408 [ A9BBAB5759771E523F55563D6CBE140F ] SENS C:\Windows\System32\sens.dll
18:51:27.0966 3408 SENS - ok
18:51:28.0010 3408 [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum C:\Windows\system32\drivers\serenum.sys
18:51:28.0080 3408 Serenum - ok
18:51:28.0101 3408 [ C70D69A918B178D3C3B06339B40C2E1B ] Serial C:\Windows\system32\drivers\serial.sys
18:51:28.0183 3408 Serial - ok
18:51:28.0223 3408 [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse C:\Windows\system32\drivers\sermouse.sys
18:51:28.0261 3408 sermouse - ok
18:51:28.0314 3408 [ D2193326F729B163125610DBF3E17D57 ] SessionEnv C:\Windows\system32\sessenv.dll
18:51:28.0354 3408 SessionEnv - ok
18:51:28.0373 3408 [ 103B79418DA647736EE95645F305F68A ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
18:51:28.0452 3408 sffdisk - ok
18:51:28.0469 3408 [ 8FD08A310645FE872EEEC6E08C6BF3EE ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
18:51:28.0540 3408 sffp_mmc - ok
18:51:28.0560 3408 [ 9CFA05FCFCB7124E69CFC812B72F9614 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
18:51:28.0629 3408 sffp_sd - ok
18:51:28.0646 3408 [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
18:51:28.0742 3408 sfloppy - ok
18:51:28.0784 3408 [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess C:\Windows\System32\ipnathlp.dll
18:51:28.0832 3408 SharedAccess - ok
18:51:28.0871 3408 [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
18:51:28.0909 3408 ShellHWDetection - ok
18:51:28.0935 3408 [ D2A595D6EEBEEAF4334F8E50EFBC9931 ] sisagp C:\Windows\system32\drivers\sisagp.sys
18:51:28.0956 3408 sisagp - ok
18:51:28.0977 3408 [ CEDD6F4E7D84E9F98B34B3FE988373AA ] SiSRaid2 C:\Windows\system32\drivers\sisraid2.sys
18:51:28.0996 3408 SiSRaid2 - ok
18:51:29.0011 3408 [ DF843C528C4F69D12CE41CE462E973A7 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
18:51:29.0032 3408 SiSRaid4 - ok
18:51:29.0096 3408 [ 8C4F0DCC6A5100D48F9B2F950CDD220F ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe
18:51:29.0119 3408 SkypeUpdate - ok
18:51:29.0341 3408 [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc C:\Windows\system32\SLsvc.exe
18:51:29.0502 3408 slsvc - ok
18:51:29.0585 3408 [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify C:\Windows\system32\SLUINotify.dll
18:51:29.0626 3408 SLUINotify - ok
18:51:29.0670 3408 [ 7B75299A4D201D6A6533603D6914AB04 ] Smb C:\Windows\system32\DRIVERS\smb.sys
18:51:29.0724 3408 Smb - ok
18:51:29.0764 3408 [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
18:51:29.0786 3408 SNMPTRAP - ok
18:51:29.0823 3408 [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr C:\Windows\system32\drivers\spldr.sys
18:51:29.0842 3408 spldr - ok
18:51:29.0881 3408 [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler C:\Windows\System32\spoolsv.exe
18:51:29.0924 3408 Spooler - ok
18:51:29.0972 3408 [ 41987F9FC0E61ADF54F581E15029AD91 ] srv C:\Windows\system32\DRIVERS\srv.sys
18:51:30.0019 3408 srv - ok
18:51:30.0056 3408 [ FF33AFF99564B1AA534F58868CBE41EF ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
18:51:30.0099 3408 srv2 - ok
18:51:30.0124 3408 [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
18:51:30.0216 3408 srvnet - ok
18:51:30.0264 3408 [ 92B69020FC480219683D429DCA068D71 ] sscdbus C:\Windows\system32\DRIVERS\sscdbus.sys
18:51:30.0283 3408 sscdbus - ok
18:51:30.0323 3408 [ 77A2869D40CC84AF711C321F9B0C7A78 ] sscdmdfl C:\Windows\system32\DRIVERS\sscdmdfl.sys
18:51:30.0338 3408 sscdmdfl - ok
18:51:30.0359 3408 [ B4255635195A8413FCDE7AF5B7C4E382 ] sscdmdm C:\Windows\system32\DRIVERS\sscdmdm.sys
18:51:30.0378 3408 sscdmdm - ok
18:51:30.0405 3408 [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
18:51:30.0461 3408 SSDPSRV - ok
18:51:30.0521 3408 [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc C:\Windows\system32\sstpsvc.dll
18:51:30.0559 3408 SstpSvc - ok
18:51:30.0608 3408 [ 306521935042FC0A6988D528643619B3 ] StarOpen C:\Windows\system32\drivers\StarOpen.sys
18:51:30.0626 3408 StarOpen ( UnsignedFile.Multi.Generic ) - warning
18:51:30.0626 3408 StarOpen - detected UnsignedFile.Multi.Generic (1)
18:51:30.0708 3408 [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc C:\Windows\System32\wiaservc.dll
18:51:30.0756 3408 stisvc - ok
18:51:30.0774 3408 [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
18:51:30.0795 3408 swenum - ok
18:51:30.0839 3408 [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv C:\Windows\System32\swprv.dll
18:51:30.0891 3408 swprv - ok
18:51:30.0919 3408 [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx C:\Windows\system32\drivers\symc8xx.sys
18:51:30.0938 3408 Symc8xx - ok
18:51:30.0965 3408 [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi C:\Windows\system32\drivers\sym_hi.sys
18:51:30.0983 3408 Sym_hi - ok
18:51:31.0004 3408 [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3 C:\Windows\system32\drivers\sym_u3.sys
18:51:31.0023 3408 Sym_u3 - ok
18:51:31.0077 3408 [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain C:\Windows\system32\sysmain.dll
18:51:31.0149 3408 SysMain - ok
18:51:31.0195 3408 [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll
18:51:31.0224 3408 TabletInputService - ok
18:51:31.0269 3408 [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv C:\Windows\System32\tapisrv.dll
18:51:31.0307 3408 TapiSrv - ok
18:51:31.0347 3408 [ CB05822CD9CC6C688168E113C603DBE7 ] TBS C:\Windows\System32\tbssvc.dll
18:51:31.0387 3408 TBS - ok
18:51:31.0448 3408 [ 27D470DABC77BC60D0A3B0E4DEB6CB91 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
18:51:31.0528 3408 Tcpip - ok
18:51:31.0553 3408 [ 27D470DABC77BC60D0A3B0E4DEB6CB91 ] Tcpip6 C:\Windows\system32\DRIVERS\tcpip.sys
18:51:31.0600 3408 Tcpip6 - ok
18:51:31.0646 3408 [ 608C345A255D82A6289C2D468EB41FD7 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
18:51:31.0694 3408 tcpipreg - ok
18:51:31.0803 3408 [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
18:51:31.0859 3408 TDPIPE - ok
18:51:31.0900 3408 [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
18:51:31.0940 3408 TDTCP - ok
18:51:31.0964 3408 [ 76B06EB8A01FC8624D699E7045303E54 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
18:51:32.0002 3408 tdx - ok
18:51:32.0044 3408 [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
18:51:32.0065 3408 TermDD - ok
18:51:32.0093 3408 [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService C:\Windows\System32\termsrv.dll
18:51:32.0184 3408 TermService - ok
18:51:32.0224 3408 [ 440DF6E6C0BCCCE98E7669D682F167C8 ] TfFsMon C:\Windows\system32\drivers\TfFsMon.sys
18:51:32.0241 3408 TfFsMon - ok
18:51:32.0323 3408 [ BFE9F5978111BE86B1121BC1EBA6450D ] TfNetMon C:\Windows\system32\drivers\TfNetMon.sys
18:51:32.0340 3408 TfNetMon - ok
18:51:32.0378 3408 [ 9FB58E9111D3437B382ED5601ABDAE5D ] TFSysMon C:\Windows\system32\drivers\TfSysMon.sys
18:51:32.0417 3408 TFSysMon - ok
18:51:32.0448 3408 [ C7230FBEE14437716701C15BE02C27B8 ] Themes C:\Windows\system32\shsvcs.dll
18:51:32.0476 3408 Themes - ok
18:51:32.0488 3408 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER C:\Windows\system32\mmcss.dll
18:51:32.0528 3408 THREADORDER - ok
18:51:32.0562 3408 ThreatFire - ok
18:51:32.0599 3408 [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks C:\Windows\System32\trkwks.dll
18:51:32.0655 3408 TrkWks - ok
18:51:32.0717 3408 [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
18:51:32.0787 3408 TrustedInstaller - ok
18:51:32.0834 3408 [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
18:51:32.0881 3408 tssecsrv - ok
18:51:32.0916 3408 [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp C:\Windows\system32\DRIVERS\tunmp.sys
18:51:32.0952 3408 tunmp - ok
18:51:32.0997 3408 [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
18:51:33.0019 3408 tunnel - ok
18:51:33.0058 3408 [ C3ADE15414120033A36C0F293D4A4121 ] uagp35 C:\Windows\system32\drivers\uagp35.sys
18:51:33.0077 3408 uagp35 - ok
18:51:33.0104 3408 [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
18:51:33.0142 3408 udfs - ok
18:51:33.0202 3408 [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect C:\Windows\system32\UI0Detect.exe
18:51:33.0244 3408 UI0Detect - ok
18:51:33.0265 3408 [ 75E6890EBFCE0841D3291B02E7A8BDB0 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
18:51:33.0284 3408 uliagpkx - ok
18:51:33.0309 3408 [ 3CD4EA35A6221B85DCC25DAA46313F8D ] uliahci C:\Windows\system32\drivers\uliahci.sys
18:51:33.0334 3408 uliahci - ok
18:51:33.0353 3408 [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata C:\Windows\system32\drivers\ulsata.sys
18:51:33.0375 3408 UlSata - ok
18:51:33.0394 3408 [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2 C:\Windows\system32\drivers\ulsata2.sys
18:51:33.0416 3408 ulsata2 - ok
18:51:33.0450 3408 [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
18:51:33.0500 3408 umbus - ok
18:51:33.0537 3408 [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost C:\Windows\System32\upnphost.dll
18:51:33.0581 3408 upnphost - ok
18:51:33.0618 3408 [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
18:51:33.0664 3408 usbccgp - ok
18:51:33.0692 3408 [ E9476E6C486E76BC4898074768FB7131 ] usbcir C:\Windows\system32\drivers\usbcir.sys
18:51:33.0764 3408 usbcir - ok
18:51:33.0798 3408 [ B74F53FEDA52CCAB5394F5EE9903EBA5 ] usbdtv C:\Windows\system32\Drivers\usbdtv.sys
18:51:33.0828 3408 usbdtv - ok
18:51:33.0883 3408 [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
18:51:33.0922 3408 usbehci - ok
18:51:33.0948 3408 [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
18:51:33.0987 3408 usbhub - ok
18:51:34.0005 3408 [ CE697FEE0D479290D89BEC80DFE793B7 ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys
18:51:34.0052 3408 usbohci - ok
18:51:34.0068 3408 [ E75C4B5269091D15A2E7DC0B6D35F2F5 ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
18:51:34.0114 3408 usbprint - ok
18:51:34.0139 3408 [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
18:51:34.0194 3408 USBSTOR - ok
18:51:34.0277 3408 [ 325DBBACB8A36AF9988CCF40EAC228CC ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
18:51:34.0359 3408 usbuhci - ok
18:51:34.0395 3408 [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms C:\Windows\System32\uxsms.dll
18:51:34.0441 3408 UxSms - ok
18:51:34.0473 3408 [ FCE98C43B5C5DB8E0DA8EA0E2B45E044 ] VClone C:\Windows\system32\DRIVERS\VClone.sys
18:51:34.0509 3408 VClone - ok
18:51:34.0557 3408 [ CD88D1B7776DC17A119049742EC07EB4 ] vds C:\Windows\System32\vds.exe
18:51:34.0605 3408 vds - ok
18:51:34.0625 3408 [ 7D92BE0028ECDEDEC74617009084B5EF ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
18:51:34.0703 3408 vga - ok
18:51:34.0740 3408 [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave C:\Windows\System32\drivers\vga.sys
18:51:34.0790 3408 VgaSave - ok
18:51:34.0837 3408 [ 045D9961E591CF0674A920B6BA3BA5CB ] viaagp C:\Windows\system32\drivers\viaagp.sys
18:51:34.0857 3408 viaagp - ok
18:51:34.0870 3408 [ 56A4DE5F02F2E88182B0981119B4DD98 ] ViaC7 C:\Windows\system32\drivers\viac7.sys
18:51:34.0958 3408 ViaC7 - ok
18:51:34.0992 3408 [ 58C8D5AC5C3EEF40E7E704A5CED7987D ] viaide C:\Windows\system32\drivers\viaide.sys
18:51:35.0011 3408 viaide - ok
18:51:35.0030 3408 [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr C:\Windows\system32\drivers\volmgr.sys
18:51:35.0051 3408 volmgr - ok
18:51:35.0104 3408 [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
18:51:35.0136 3408 volmgrx - ok
18:51:35.0215 3408 [ 786DB5771F05EF300390399F626BF30A ] volsnap C:\Windows\system32\drivers\volsnap.sys
18:51:35.0248 3408 volsnap - ok
18:51:35.0266 3408 [ D984439746D42B30FC65A4C3546C6829 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
18:51:35.0289 3408 vsmraid - ok
18:51:35.0353 3408 [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS C:\Windows\system32\vssvc.exe
18:51:35.0424 3408 VSS - ok
18:51:35.0483 3408 [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time C:\Windows\system32\w32time.dll
18:51:35.0524 3408 W32Time - ok
18:51:35.0546 3408 [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen C:\Windows\system32\drivers\wacompen.sys
18:51:35.0618 3408 WacomPen - ok
18:51:35.0654 3408 [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp C:\Windows\system32\DRIVERS\wanarp.sys
18:51:35.0698 3408 Wanarp - ok
18:51:35.0704 3408 [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
18:51:35.0738 3408 Wanarpv6 - ok
18:51:35.0780 3408 [ 59E19BD13C3BDB857646B9E436BA27F7 ] WcesComm C:\Windows\WindowsMobile\wcescomm.dll
18:51:35.0807 3408 WcesComm - ok
18:51:35.0835 3408 [ A3CD60FD826381B49F03832590E069AF ] wcncsvc C:\Windows\System32\wcncsvc.dll
18:51:35.0904 3408 wcncsvc - ok
18:51:35.0945 3408 [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
18:51:35.0979 3408 WcsPlugInService - ok
18:51:35.0987 3408 [ AFC5AD65B991C1E205CF25CFDBF7A6F4 ] Wd C:\Windows\system32\drivers\wd.sys
18:51:36.0008 3408 Wd - ok
18:51:36.0066 3408 [ B6F0A7AD6D4BD325FBCD8BAC96CD8D96 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
18:51:36.0105 3408 Wdf01000 - ok
18:51:36.0136 3408 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost C:\Windows\system32\wdi.dll
18:51:36.0243 3408 WdiServiceHost - ok
18:51:36.0254 3408 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost C:\Windows\system32\wdi.dll
18:51:36.0294 3408 WdiSystemHost - ok
18:51:36.0338 3408 [ 04C37D8107320312FBAE09926103D5E2 ] WebClient C:\Windows\System32\webclnt.dll
18:51:36.0364 3408 WebClient - ok
18:51:36.0405 3408 [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc C:\Windows\system32\wecsvc.dll
18:51:36.0462 3408 Wecsvc - ok
18:51:36.0494 3408 [ 670FF720071ED741206D69BD995EA453 ] wercplsupport C:\Windows\System32\wercplsupport.dll
18:51:36.0532 3408 wercplsupport - ok
18:51:36.0567 3408 [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc C:\Windows\System32\WerSvc.dll
18:51:36.0609 3408 WerSvc - ok
18:51:36.0684 3408 [ 4575AA12561C5648483403541D0D7F2B ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll
18:51:36.0711 3408 WinDefend - ok
18:51:36.0722 3408 WinHttpAutoProxySvc - ok
18:51:36.0773 3408 [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
18:51:36.0808 3408 Winmgmt - ok
18:51:37.0043 3408 [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM C:\Windows\system32\WsmSvc.dll
18:51:37.0232 3408 WinRM - ok
18:51:37.0291 3408 [ 676F4B665BDD8053EAA53AC1695B8074 ] winusb C:\Windows\system32\DRIVERS\winusb.sys
18:51:37.0344 3408 winusb - ok
18:51:37.0400 3408 [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc C:\Windows\System32\wlansvc.dll
18:51:37.0444 3408 Wlansvc - ok
18:51:37.0475 3408 [ 701A9F884A294327E9141D73746EE279 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
18:51:37.0556 3408 WmiAcpi - ok
18:51:37.0600 3408 [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
18:51:37.0634 3408 wmiApSrv - ok
18:51:37.0704 3408 [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
18:51:37.0790 3408 WMPNetworkSvc - ok
18:51:37.0853 3408 [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc C:\Windows\System32\wpcsvc.dll
18:51:37.0898 3408 WPCSvc - ok
18:51:37.0944 3408 [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
18:51:37.0968 3408 WPDBusEnum - ok
18:51:38.0007 3408 [ DE9D36F91A4DF3D911626643DEBF11EA ] WpdUsb C:\Windows\system32\DRIVERS\wpdusb.sys
18:51:38.0056 3408 WpdUsb - ok
18:51:38.0247 3408 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
18:51:38.0294 3408 WPFFontCache_v0400 - ok
18:51:38.0331 3408 [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
18:51:38.0369 3408 ws2ifsl - ok
18:51:38.0428 3408 [ 1CA6C40261DDC0425987980D0CD2AAAB ] wscsvc C:\Windows\System32\wscsvc.dll
18:51:38.0453 3408 wscsvc - ok
18:51:38.0460 3408 WSearch - ok
18:51:38.0570 3408 [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv C:\Windows\system32\wuaueng.dll
18:51:38.0672 3408 wuauserv - ok
18:51:38.0717 3408 [ AC13CB789D93412106B0FB6C7EB2BCB6 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
18:51:38.0772 3408 WUDFRd - ok
18:51:38.0806 3408 [ 575A4190D989F64732119E4114045A4F ] wudfsvc C:\Windows\System32\WUDFSvc.dll
18:51:38.0863 3408 wudfsvc - ok
18:51:38.0934 3408 [ 04E268ADFC81964C49DC0C082D520F7E ] yukonwlh C:\Windows\system32\DRIVERS\yk60x86.sys
18:51:38.0979 3408 yukonwlh - ok
18:51:38.0988 3408 ================ Scan global ===============================
18:51:39.0003 3408 [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll
18:51:39.0053 3408 [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
18:51:39.0069 3408 [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
18:51:39.0126 3408 [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\system32\services.exe
18:51:39.0143 3408 [Global] - ok
18:51:39.0143 3408 ================ Scan MBR ==================================
18:51:39.0186 3408 [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk0\DR0
18:51:39.0565 3408 \Device\Harddisk0\DR0 - ok
18:51:39.0566 3408 ================ Scan VBR ==================================
18:51:39.0596 3408 [ 68A5B2368735762F2FB130963D75FEA3 ] \Device\Harddisk0\DR0\Partition1
18:51:39.0599 3408 \Device\Harddisk0\DR0\Partition1 - ok
18:51:39.0624 3408 [ 544D17138426B7B4B54DBE66F2B5641B ] \Device\Harddisk0\DR0\Partition2
18:51:39.0626 3408 \Device\Harddisk0\DR0\Partition2 - ok
18:51:39.0627 3408 ============================================================
18:51:39.0627 3408 Scan finished
18:51:39.0627 3408 ============================================================
18:51:39.0649 3200 Detected object count: 3
18:51:39.0649 3200 Actual detected object count: 3
18:53:20.0550 3200 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
18:53:20.0551 3200 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:53:20.0555 3200 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
18:53:20.0555 3200 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:53:20.0559 3200 StarOpen ( UnsignedFile.Multi.Generic ) - skipped by user
18:53:20.0559 3200 StarOpen ( UnsignedFile.Multi.Generic ) - User select action: Skip


Alt 13.02.2013, 19:38   #6
markusg
/// Malware-holic
 
www.searchnu.com/406 wird bei jedem neuen Tab geöffnet - Standard

www.searchnu.com/406 wird bei jedem neuen Tab geöffnet



Hi,
passt.
Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

__________________
--> www.searchnu.com/406 wird bei jedem neuen Tab geöffnet

Alt 13.02.2013, 20:11   #7
DonBenni82
 
www.searchnu.com/406 wird bei jedem neuen Tab geöffnet - Standard

www.searchnu.com/406 wird bei jedem neuen Tab geöffnet



Zitat:
Zitat von markusg Beitrag anzeigen
Hi,
passt.
Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.
Hallo,

ich habe Combofix.exe runter geladen und ausgeführt.

Er hatte auch einen Fund, aber ich finde keine Logdatei. Ich habe die Suche laufen lassen, es gibt keine Combofix.txt. :/

Der Rechner ist neu gestartet. Ich hatte die Hoffnung dass erst dann die txt erstellt wird.

Alt 13.02.2013, 20:12   #8
markusg
/// Malware-holic
 
www.searchnu.com/406 wird bei jedem neuen Tab geöffnet - Standard

www.searchnu.com/406 wird bei jedem neuen Tab geöffnet



auf c: entweder combofix bzw log.txt
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 13.02.2013, 20:14   #9
DonBenni82
 
www.searchnu.com/406 wird bei jedem neuen Tab geöffnet - Standard

www.searchnu.com/406 wird bei jedem neuen Tab geöffnet



Zitat:
Zitat von markusg Beitrag anzeigen
auf c: entweder combofix bzw log.txt
Leider nix. Ich hab nach Erstellungsdatum sortiert und da ist keine Datei so neu. Hätte man den Log irgendwo aktivieren müssen? Ich hatte nen Haken bei "speichern" gemacht, so nannte sich die Option glaube ich.

Alt 13.02.2013, 20:15   #10
markusg
/// Malware-holic
 
www.searchnu.com/406 wird bei jedem neuen Tab geöffnet - Standard

www.searchnu.com/406 wird bei jedem neuen Tab geöffnet



ne geht automatisch.
starte mal neu, drücke f8 wähle abgesicherter Modus, melde dich in deinem Konto an, führe combofix noch mal aus, speichere das Log und dann wieder in den normalen Modus, Log posten
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 13.02.2013, 20:46   #11
DonBenni82
 
www.searchnu.com/406 wird bei jedem neuen Tab geöffnet - Standard

www.searchnu.com/406 wird bei jedem neuen Tab geöffnet



Hier die log.txt.

Combofix Logfile:
Code:
ATTFilter
ComboFix 13-02-13.01 - Alex 13.02.2013  20:30:29.1.2 - x86 MINIMAL
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.1789.1372 [GMT 1:00]
ausgeführt von:: c:\users\Alex\Desktop\ComboFix.exe
AV: PC Tools Spyware Doctor with AntiVirus *Disabled/Updated* {2F668A56-D5E0-2DF1-A0AE-CB1284F42AB2}
SP: PC Tools Spyware Doctor *Enabled/Updated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
 ADS - Windows: deleted 24 bytes in 1 streams. 
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
D:\resycled
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-01-13 bis 2013-02-13  ))))))))))))))))))))))))))))))
.
.
2013-02-13 19:36 . 2013-02-13 19:36	--------	d-----w-	c:\users\Alex\AppData\Local\temp
2013-02-12 19:25 . 2013-02-13 15:47	768	----a-w-	c:\windows\DeleteOnReboot.bat
2013-02-11 20:00 . 2013-02-11 20:00	--------	d-----w-	c:\users\Alex\AppData\Roaming\Malwarebytes
2013-02-11 19:59 . 2013-02-11 19:59	--------	d-----w-	c:\programdata\Malwarebytes
2013-02-11 19:59 . 2013-02-11 20:00	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2013-02-11 19:59 . 2012-12-14 15:49	21104	----a-w-	c:\windows\system32\drivers\mbam.sys
2013-02-11 19:09 . 2012-10-31 08:19	577176	--s---w-	c:\windows\system32\drivers\TfSysMon.sys
2013-02-11 19:09 . 2012-10-31 08:19	55008	--s---w-	c:\windows\system32\drivers\TfFsMon.sys
2013-02-11 19:09 . 2012-10-31 08:19	36456	--s---w-	c:\windows\system32\drivers\TfNetMon.sys
2013-02-11 18:09 . 2012-10-23 16:40	62688	----a-w-	c:\windows\system32\drivers\PCTBD.sys
2013-02-11 18:09 . 2012-10-23 16:40	150648	----a-w-	c:\windows\SGDetectionTool.dll
2013-02-11 18:09 . 2012-10-23 16:40	769144	----a-w-	c:\windows\BDTSupport.dll
2013-02-11 17:58 . 2012-11-01 14:35	202280	----a-w-	c:\windows\system32\drivers\PCTSD.sys
2013-02-11 17:57 . 2013-02-11 19:09	--------	d-----w-	c:\programdata\PC Tools
2013-02-11 17:57 . 2013-02-11 17:57	--------	d-----w-	c:\users\Alex\AppData\Roaming\TestApp
2013-02-09 13:12 . 2013-02-09 13:12	--------	d-----w-	c:\programdata\Wincert
2013-02-09 13:12 . 2013-02-12 19:25	--------	d-----w-	c:\program files\Search Results Toolbar
2013-02-08 17:31 . 2013-01-08 04:57	6991832	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{3316801B-907B-4A03-8068-F084FEB81212}\mpengine.dll
2013-02-06 20:12 . 2013-02-06 20:12	94112	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2013-01-28 17:45 . 2013-01-28 17:45	--------	d-----w-	c:\program files\Common Files\Skype
2013-01-28 17:45 . 2013-01-28 17:45	--------	d-----r-	c:\program files\Skype
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-09 13:23 . 2012-03-31 13:35	697712	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-02-09 13:23 . 2011-09-25 18:58	74096	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-06 20:12 . 2012-07-01 10:42	861088	----a-w-	c:\windows\system32\npdeployJava1.dll
2013-02-06 20:12 . 2010-06-07 15:27	782240	----a-w-	c:\windows\system32\deployJava1.dll
2013-01-17 00:28 . 2009-10-11 09:07	232336	------w-	c:\windows\system32\MpSigStub.exe
2012-12-16 13:12 . 2012-12-20 21:13	34304	----a-w-	c:\windows\system32\atmlib.dll
2012-12-16 10:50 . 2012-12-20 21:13	293376	----a-w-	c:\windows\system32\atmfd.dll
2012-11-23 01:35 . 2013-01-09 20:41	2048000	----a-w-	c:\windows\system32\win32k.sys
2012-11-20 04:22 . 2013-01-09 20:40	204288	----a-w-	c:\windows\system32\ncrypt.dll
2013-02-09 13:29 . 2013-02-09 13:29	262552	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2012-12-17 18:50	556648	----a-w-	c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2012-12-17 18:50	556648	----a-w-	c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2012-12-17 18:50	556648	----a-w-	c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2012-12-17 18:50	556648	----a-w-	c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2011-02-23 371200]
"VirtualCloneDrive"="d:\d2\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"ISTray"="c:\program files\PC Tools\PC Tools Security\pctsGui.exe" [2012-11-01 2717816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=   c:\progra~2\Wincert\WIN32C~1.DLL
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-12-03 07:35	946352	----a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANT Agent]
2012-03-23 13:09	14749544	----a-w-	c:\program files\Garmin\ANT Agent\ANT Agent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-19 07:33	125952	----a-w-	c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 07:38	1008184	----a-w-	c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]
2007-05-31 07:21	648072	----a-w-	c:\windows\WindowsMobile\wmdc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-19 07:33	202240	----a-w-	c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - ECACHE
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-02-04 18:25	1607120	----a-w-	c:\program files\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-02-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 13:23]
.
2013-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-22 11:31]
.
2013-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-22 11:31]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
mStart Page = hxxp://de.yahoo.com
uSearchURL,(Default) = hxxp://de.rd.yahoo.com/customize/ie/defaults/su/msgr9/*Yahoo! Suche
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\3osy0i74.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&gct=ds&appid=350&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&apn_uid=8300259353924636&o=APN10645&q=
FF - ExtSQL: 2013-02-11 19:09; {cb84136f-9c44-433a-9048-c5cd9df1dc16}; c:\program files\PC Tools\PC Tools Security\BDT\Firefox
FF - ExtSQL: !HIDDEN! 2013-02-09 14:12; {1FD91A9C-410C-4090-BBCC-55D3450EF433}; c:\program files\Search Results Toolbar\Datamngr\FirefoxExtension
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8uKLa6Qm&loc=IB_TB&i=26&search=
FF - user.js: extensions.incredibar_i.id - cca26c2c000000000000001b9e428c03
FF - user.js: extensions.incredibar_i.instlDay - 15493
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.148:51
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef - 
FF - user.js: extensions.incredibar_i.dfltLng - 
FF - user.js: extensions.incredibar_i.excTlbr - false
FF - user.js: extensions.incredibar_i.ms_url_id - 
FF - user.js: extensions.incredibar_i.upn2 - 6R8uKLa6Qm
FF - user.js: extensions.incredibar_i.upn2n - 92824464636505638
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10646
FF - user.js: extensions.incredibar_i.ppd - 
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-10 - (no file)
MSConfigStartUp-Garmin Lifetime Updater - c:\program files\Garmin\Lifetime Updater\GarminLifetime.exe
MSConfigStartUp-PDFPrint - c:\program files\pdf24\pdf24.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2013-02-13 20:36
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1223423791-1231596254-678561435-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DAEF98CA-0290-A9AC-A86E-27C82EE4EDB9}*]
@Allowed: (Read) (RestrictedCode)
"gajkeijknegeeg"=hex:61,63,68,6e,65,65,61,6f,62,6f,6e,6c,62,6e,66,6d,6a,66,67,
   63,66,66,6e,68,70,64,70,6b,70,6f,6c,6d,63,66,65,6e,63,6c,6c,6d,70,6e,6b,6b,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2013-02-13  20:39:27
ComboFix-quarantined-files.txt  2013-02-13 19:39
.
Vor Suchlauf: 5.352.558.592 Bytes frei
Nach Suchlauf: 5.146.796.032 Bytes frei
.
- - End Of File - - 49B2F835BAAFCB9E4BC583B547113D92
         
--- --- ---

Alt 13.02.2013, 20:49   #12
markusg
/// Malware-holic
 
www.searchnu.com/406 wird bei jedem neuen Tab geöffnet - Standard

www.searchnu.com/406 wird bei jedem neuen Tab geöffnet



otl fix

Fixen mit OTL

  • Starte bitte die OTL.exe.
  • Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:
ATTFilter
:OTL
O20 - AppInit_DLLs: (C:\PROGRA~2\Wincert\WIN32C~1.DLL) - C:\ProgramData\Wincert\win32cert.dll ()
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll) - C:\Programme\Search Results Toolbar\Datamngr\datamngr.dll (Bandoo Media Inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll) - C:\Programme\Search Results Toolbar\Datamngr\IEBHO.dll (Bandoo Media Inc)
:files
:Commands
[emptytemp]
         
  • Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
  • Schließe bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 13.02.2013, 20:49   #13
DonBenni82
 
www.searchnu.com/406 wird bei jedem neuen Tab geöffnet - Standard

www.searchnu.com/406 wird bei jedem neuen Tab geöffnet



doppelpost

Alt 13.02.2013, 20:50   #14
markusg
/// Malware-holic
 
www.searchnu.com/406 wird bei jedem neuen Tab geöffnet - Standard

www.searchnu.com/406 wird bei jedem neuen Tab geöffnet



hi das war jetzt 2x, sieh e meinen Post über deinem :-)
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 13.02.2013, 20:58   #15
DonBenni82
 
www.searchnu.com/406 wird bei jedem neuen Tab geöffnet - Standard

www.searchnu.com/406 wird bei jedem neuen Tab geöffnet



doppelpost

Geändert von DonBenni82 (13.02.2013 um 21:11 Uhr)

Antwort

Themen zu www.searchnu.com/406 wird bei jedem neuen Tab geöffnet
32 bit, bandoo, bho, browser, entfernen, error, excel, firefox, flash player, google, helper, home, hängt, install.exe, libusb0.sys, logfile, ntdll.dll, problem, programm, remote control, rootkit, scan, search results toolbar, searchnu.com/406, security, software, spyware, starten, suchmaschine, super, svchost.exe, system, vista



Ähnliche Themen: www.searchnu.com/406 wird bei jedem neuen Tab geöffnet


  1. Windows 7: Trojaner artemis!E* wird bei fast jedem Scan auf meinem PC gefunden
    Log-Analyse und Auswertung - 20.04.2015 (20)
  2. Win 7: Avast wird von Gruppenrichtlinie Blockiert; Ominöse Fehlermeldung nach jedem Reboot.
    Log-Analyse und Auswertung - 08.11.2014 (15)
  3. nach firefox update / portaldosites in jedem neuen tap
    Plagegeister aller Art und deren Bekämpfung - 30.05.2014 (9)
  4. Windows XP Werbung wird ungefragt geöffnet
    Log-Analyse und Auswertung - 12.01.2014 (3)
  5. Firefox: ezpowerads wird geöffnet
    Log-Analyse und Auswertung - 09.10.2013 (12)
  6. nach Installation von llivid wird Startseite immer mit http://www.searchnu.com gestartet
    Log-Analyse und Auswertung - 07.06.2013 (16)
  7. deltasearch automatisch bei jedem neuen leeren Tab
    Plagegeister aller Art und deren Bekämpfung - 12.05.2013 (3)
  8. MyStart Trojaner in jedem neuen Tab (Mozilla)
    Plagegeister aller Art und deren Bekämpfung - 02.10.2012 (49)
  9. Mystart incredibar in jedem neuen Tab
    Plagegeister aller Art und deren Bekämpfung - 22.09.2012 (3)
  10. Trojaner Searchnu - http://www.searchnu.com/413?tag=newtab
    Log-Analyse und Auswertung - 30.08.2012 (29)
  11. Searchnu Problem im Browser, im neuen Tab (Firefox)
    Plagegeister aller Art und deren Bekämpfung - 12.07.2012 (1)
  12. Bei jedem Systemstart wird nach eine in Quarantäne geschickte DLL-Datei gefragt
    Plagegeister aller Art und deren Bekämpfung - 25.05.2011 (68)
  13. tdsskiller.exe wird nicht geöffnet
    Plagegeister aller Art und deren Bekämpfung - 23.04.2011 (23)
  14. Internet Explorer wird permanent geöffnet!
    Plagegeister aller Art und deren Bekämpfung - 09.04.2011 (5)
  15. Hostsdatei wird bei jedem Neustart des Rechners wieder überschrieben
    Mülltonne - 27.12.2010 (1)
  16. Jede .exe wird nur noch mit Editor geöffnet
    Plagegeister aller Art und deren Bekämpfung - 11.02.2010 (4)
  17. Grafikkarte wird nach Treiber nicht erkannt und kann auch keinen neuen installieren!
    Mülltonne - 24.10.2008 (0)

Zum Thema www.searchnu.com/406 wird bei jedem neuen Tab geöffnet - Hallo liebes Forum, seit dem Wochenende schlage ich mich mit dem Search rum und werde ihn nicht los. Alle neuen Tabs starten auf dieser Seite, egal welchen Browser ich verwende. - www.searchnu.com/406 wird bei jedem neuen Tab geöffnet...
Archiv
Du betrachtest: www.searchnu.com/406 wird bei jedem neuen Tab geöffnet auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.