zum 1.Mal ratlos, persönliche Informationen werden unbemerkt verschickt

u578188 · 11.05.2013, 11:45

Hallo zusammen,

zum ersten Mal in der Geschichte meiner PC-Kenntnisse bin ich ratlos....

hier mein Problem/Probleme:

ich bekomme seit 4 Monaten Benachrichtigungen von meinen Banken, dass sich in mein PC wahrscheinlich ein Trojaner eingewurmt hat. Mein T-online email-account wurde mir gesperrt, da ich angeblich maßenhaft emails versendet haben soll, was ich jedoch nicht getätigt habe und auch kein Programm etc. dafür besitze.

Ich habe Windows Vista, habe von Anfang an Avira AntiVir installiert und regelmäßig die vorgeschlagenen Updates ausgeführt.
Avira hat jedoch nie angeschlagen, noch findet es momentan irgendwelchne Würmer. ich bekomme jedoch des weiteren im 3Wochen Takt ein neues Online-Banking-Kennwort von meiner Bank zugesendet, da jemand versucht hat auf mein Konto zuzugreifen und zwar auf verschiedenen Konten von verschiedenen Banken.

Normalerweise kenne ich mich mit der PC-Handhabung ganz gut aus, hier bin ich jedoch vor einer geschlossenen Schranke, vielleicht habe ich mich in letzter Zeit zu schlecht informiert.

Im Netz habe ich dazu außer Fach-chinesisch auch nichts gefunden......

Falls sich meine Infos etwas wirr anhören, gerne Fragen äußern
und ich bitte um Hilfe!!!

u578188

markusg · 11.05.2013, 11:55

Hi,

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die
Textbox.

Code:

ATTFilter

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
C:\Windows\system32\*.tsp
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

u578188 · 13.05.2013, 15:01

EXTRAS.txt:OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 13.05.2013 14:23:20 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Ulf Rawas\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,17 Gb Available Physical Memory | 58,57% Memory free
4,24 Gb Paging File | 3,17 Gb Available in Paging File | 74,86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 141,51 Gb Total Space | 30,01 Gb Free Space | 21,21% Space Free | Partition Type: NTFS
Drive D: | 149,05 Gb Total Space | 0,13 Gb Free Space | 0,09% Space Free | Partition Type: NTFS
Drive E: | 7,54 Gb Total Space | 2,28 Gb Free Space | 30,24% Space Free | Partition Type: NTFS
Drive F: | 654,81 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: U-RAWAS | User Name: Ulf Rawas | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.pif [@ = piffile] -- "%1" %*"
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*"
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 1
"InternetSettingsDisableNotify" = 1
"AutoUpdateDisableNotify" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3651596773-1541584794-529895780-1000]
"EnableNotifications" = 1
"EnableNotificationsRef" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0146ABC6-6F2A-4A1B-9346-70A0312AD71B}" = rport=139 | protocol=6 | dir=out | app=system | 
"{0A005758-79D9-4236-9744-941524BBBD3D}" = lport=138 | protocol=17 | dir=in | app=system | 
"{16563D3A-2AA7-4722-B9E8-86C4F9376227}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{230B4FC0-7960-4281-83C3-CEE7D4207D15}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{263BA729-6611-4596-A6A8-5695F5107342}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{2BA8692D-FCB0-4DD3-A2E0-19E231DC7732}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{2F3A1D06-DFB7-418B-BE14-349E7DC2B27C}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{38C150FC-458F-4EB4-95ED-79D83E4CE4BA}" = lport=445 | protocol=6 | dir=in | app=system | 
"{454EF46B-118A-43FF-BFEB-C1B34519BE46}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{50D21BFB-F2F5-4CCD-9B43-46C2FC3CA344}" = rport=137 | protocol=17 | dir=out | app=system | 
"{58761419-50AF-4D04-B860-3A481C27E477}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{5D6E2DBB-6831-4A90-AFEA-8C19BF2529FC}" = lport=139 | protocol=6 | dir=in | app=system | 
"{647BEC02-ED7C-4CA4-9CF0-DC8FAABCEC36}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{64A0DCE3-E428-474C-9179-A546EC77A209}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{78C6C2A0-1D01-44F3-AB7D-56B790E9523C}" = rport=138 | protocol=17 | dir=out | app=system | 
"{7D5D4B46-716C-4A31-9156-D830EE19A40D}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{7DB44F4E-39C9-4925-8AB5-3AC57C303637}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{8547FB9E-1799-4D0D-9241-073579234428}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{8AE7B85F-DC8D-4D89-B0E8-D620103EDC53}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{8F5239DD-FFBB-4390-AA2E-25D1F35DB34C}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{904F3434-365E-47D8-862D-5DA3C84E003A}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{958A526E-8606-4A11-A711-2CC4B3684266}" = lport=137 | protocol=17 | dir=in | app=system | 
"{A6AD4E4C-BEDB-4BF3-A1B4-4ADFA6C27DFE}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{A7548842-8D2F-4EAF-8CDD-B46221B6C501}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{AC671DDE-9D56-47BB-9E7A-0982C80BEA6C}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{AD790048-D93C-4DA5-998F-3F332F53728B}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{B2A763F6-9AA8-47E2-B5B1-64D4D07A959D}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{BAE87FDE-72CA-4639-8BAF-CD60C9C4C09E}" = rport=445 | protocol=6 | dir=out | app=system | 
"{CADF1663-F2AA-474E-94D7-CD80778DDEF9}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{CBDA3527-21BC-453C-90B9-29D3E12D7530}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{E0607319-9180-43E9-9488-F3E059459E4E}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{E728556C-1C5A-4D26-8B01-F2BBEEDDB9E9}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{E7293DBF-648F-4AE2-B51B-9842EA208AEF}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{EB6EB3E0-DF7A-452B-965A-548971C6A386}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{F1A02D1B-BDE6-4537-837E-1A0143ACEC94}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{FE365204-A45D-4A50-B6B8-D3AE274BB903}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{39F9CCF3-DEF7-4D6E-BDE3-9561A411FC18}" = dir=in | app=c:\program files\rosettastoneltdservices\rosettastonedaemon.exe | 
"{485D1974-D4DA-48B0-8918-2DFA6CF67816}" = protocol=6 | dir=out | app=c:\program files\rosettastoneltdservices\rosettastoneltdservices.exe | 
"{499B1A02-2F24-49C2-8481-43A70E2DA72F}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{4C7B6053-CC83-4D58-AC33-0A8FAB1F3FF3}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{74673C8A-6D35-446D-8DD6-BC3A8B1D97B9}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{7C7CC2CE-AB8F-4764-A604-3FA214E8763A}" = dir=in | app=c:\program files\rosettastoneltdservices\rosettastoneltdservices.exe | 
"{7EBDCEDB-3F52-4967-B9F1-635E2B4F366B}" = dir=in | app=c:\program files\hp\quickplay\qp.exe | 
"{974D7E05-92FE-453A-80E2-D123CB0A5615}" = protocol=6 | dir=out | app=c:\program files\rosettastoneltdservices\rosettastonedaemon.exe | 
"{D243203B-5D8C-4C0D-B3EA-33E9AD6724DC}" = dir=in | app=c:\program files\hp\quickplay\qpservice.exe | 
"{E8F2B234-9EB7-4107-978E-6994D3DDD06A}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{FDB45454-4E1D-449C-B2D9-0793AD0C44E1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"TCP Query User{1B16F3D9-2B16-4EFA-93D2-C63C20FED80F}C:\users\ulf rawas\appdata\local\virtualstore\program files\ea games\need for speed hot pursuit 2\nfshp2.ori" = protocol=6 | dir=in | app=c:\users\ulf rawas\appdata\local\virtualstore\program files\ea games\need for speed hot pursuit 2\nfshp2.ori | 
"TCP Query User{B18128A0-0CC1-44F8-BD74-AFBED8B59A76}C:\program files\sierra\half-life\hl.exe" = protocol=6 | dir=in | app=c:\program files\sierra\half-life\hl.exe | 
"TCP Query User{B75CB4E1-3947-4A49-AB1E-0BA996717C75}C:\program files\ea games\command & conquer generäle stunde null\game.dat" = protocol=6 | dir=in | app=c:\program files\ea games\command & conquer generäle stunde null\game.dat | 
"TCP Query User{C68026CC-195B-44E0-89FC-3C46AA54745B}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"TCP Query User{FDE6B738-F09D-4C3E-B186-56D577D13FF4}C:\program files\sierra\half-life\hl.exe" = protocol=6 | dir=in | app=c:\program files\sierra\half-life\hl.exe | 
"UDP Query User{071B6A8F-3F1F-466B-94E8-7999175762F4}C:\program files\sierra\half-life\hl.exe" = protocol=17 | dir=in | app=c:\program files\sierra\half-life\hl.exe | 
"UDP Query User{0B5A78CF-EDA6-49D5-B4DD-560FBE4769B0}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{26F0D80E-0F14-4E8F-A423-35B148398D83}C:\program files\sierra\half-life\hl.exe" = protocol=17 | dir=in | app=c:\program files\sierra\half-life\hl.exe | 
"UDP Query User{550644DC-E1CC-4494-8805-179A8544DAF2}C:\users\ulf rawas\appdata\local\virtualstore\program files\ea games\need for speed hot pursuit 2\nfshp2.ori" = protocol=17 | dir=in | app=c:\users\ulf rawas\appdata\local\virtualstore\program files\ea games\need for speed hot pursuit 2\nfshp2.ori | 
"UDP Query User{C438B02F-668D-4478-813B-7F33E726FA25}C:\program files\ea games\command & conquer generäle stunde null\game.dat" = protocol=17 | dir=in | app=c:\program files\ea games\command & conquer generäle stunde null\game.dat | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
"{0CFD3BAF-9F4D-4D70-BD0B-638EA2504C25}" = PSSWCORE
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}" = Roxio Creator EasyArchive
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 29
"{290B83AA-093A-45BF-A917-D1C4A1E8D917}" = HP Active Support Library
"{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}" = Logitech SetPoint
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
"{33C65B6A-5D73-4E3E-A1F9-127C27BD3F72}" = Roxio MyDVD Basic v9
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.20 B1
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Roxio Activation Module
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{40F7AED3-0C7D-4582-99F6-484A515C73F2}" = HP Easy Setup - Frontend
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 3.2
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5AB56552-6938-4686-9F87-DB0ED8D1E06B}" = HP User Guides 0056
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{76F4DD9B-C246-4BE0-00B6-3DE9ABF72299}" = Need For Speed Hot Pursuit 2
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{8CC5F040-44F2-4FB7-9720-47F53F96D180}" = MSCU for Microsoft Vista
"{8CEA85DE-955B-4BF4-87F2-0BAA62821633}" = HP Photosmart Essential2.5
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9061CEF2-51F5-42C9-8A70-9ED351C6597A}" = HP Help and Support
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9EDBB857-8028-49CD-B9C9-0B4D10CD1031}" = Nero 8 Demo
"{AB5E289E-76BF-4251-9F3F-9B763F681AE0}" = HP Customer Experience Enhancements
"{AC76BA86-7AD7-1031-7B44-A83000000003}" = Adobe Reader 8.3.1 - Deutsch
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B76A76EB-BCCA-4625-9C4C-1FFAE19E4772}" = ESU for Microsoft Vista
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{CE10CFE5-FA4B-4D01-B587-7EBB77505C7E}" = 3M Littmann Introduction to Heart Sounds
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D32067CD-7409-4792-BFA0-1469BCD8F0C8}" = HP Wireless Assistant
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{D9B4D7EE-481C-4C36-86AB-A8F7417725FF}" = LightScribe  1.6.43.1
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and Conquer(TM) Generäle Die Stunde Null 
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FAB0C302-CB18-4A7A-BA03-C3DC23101A68}" = HP Active Support Library 32 bit components
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{FFF186B6-4D02-4D8D-A776-C43E062E01A9}" = Rosetta Stone Ltd Services
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Avira AntiVir Desktop" = Avira Free Antivirus
"CNXT_AUDIO_HDA" = Conexant HD Audio
"CNXT_MODEM_HDA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"DVD Shrink DE_is1" = DVD Shrink 3.2 deutsch
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"EPSON Scanner" = EPSON Scan
"ESDX6000_CX5900 Benutzerhandb." = ESDX6000_CX5900 Benutzerhandb.
"Free FLV Converter_is1" = Free FLV Converter V 6.97.0
"Half-Life" = Half-Life
"HP Photosmart Essential" = HP Photosmart Essential 2.0
"InstallShield_{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"InstallShield_{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and Conquer(TM) Generäle Die Stunde Null 
"MAGIX mp3 maker 2004 diamond" = MAGIX mp3 maker 2004 diamond
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Drivers" = NVIDIA Drivers
"POD-Bot 2.5" = POD-Bot 2.5
"QuickTime" = QuickTime
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"Sierra Utilities" = Sierra Utilities
"SmartAudio" = SmartAudio
"SX Virtual Link" = SX Virtual Link
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR Archivierer
"Wise Registry Cleaner_is1" = Wise Registry Cleaner 7.12
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 30.03.2013 11:52:08 | Computer Name = U-Rawas | Source = VSS | ID = 12289
Description = 
 
Error - 30.03.2013 11:55:09 | Computer Name = U-Rawas | Source = ESENT | ID = 490
Description = Windows (2616) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 30.03.2013 11:55:09 | Computer Name = U-Rawas | Source = ESENT | ID = 439
Description = Windows (2616) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 05.04.2013 08:42:20 | Computer Name = U-Rawas | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 9.0.8112.16470 arbeitet nicht mehr 
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen 
über das Problem zu suchen.  Prozess-ID: 167c  Anfangszeit: 01ce31faf18cdcb1  Zeitpunkt
 der Beendigung: 125
 
Error - 05.04.2013 08:42:40 | Computer Name = U-Rawas | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 9.0.8112.16470 arbeitet nicht mehr 
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen 
über das Problem zu suchen.  Prozess-ID: 13f0  Anfangszeit: 01ce31fb03887ff1  Zeitpunkt
 der Beendigung: 109
 
Error - 12.04.2013 10:35:36 | Computer Name = U-Rawas | Source = VSS | ID = 12289
Description = 
 
Error - 12.04.2013 10:37:48 | Computer Name = U-Rawas | Source = VSS | ID = 12289
Description = 
 
Error - 12.04.2013 11:21:49 | Computer Name = U-Rawas | Source = VSS | ID = 12289
Description = 
 
Error - 12.04.2013 11:22:31 | Computer Name = U-Rawas | Source = VSS | ID = 12289
Description = 
 
Error - 09.05.2013 19:11:13 | Computer Name = U-Rawas | Source = VSS | ID = 12289
Description = 
 
[ System Events ]
Error - 02.05.2013 04:36:22 | Computer Name = U-Rawas | Source = Service Control Manager | ID = 7034
Description = 
 
Error - 02.05.2013 04:54:51 | Computer Name = U-Rawas | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 04.05.2013 18:42:38 | Computer Name = U-Rawas | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 09.05.2013 19:03:51 | Computer Name = U-Rawas | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 09.05.2013 19:51:34 | Computer Name = U-Rawas | Source = DCOM | ID = 10016
Description = 
 
Error - 09.05.2013 19:51:57 | Computer Name = U-Rawas | Source = DCOM | ID = 10016
Description = 
 
Error - 09.05.2013 19:55:05 | Computer Name = U-Rawas | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 09.05.2013 19:56:37 | Computer Name = U-Rawas | Source = Service Control Manager | ID = 7022
Description = 
 
Error - 13.05.2013 07:10:46 | Computer Name = U-Rawas | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 13.05.2013 07:12:10 | Computer Name = U-Rawas | Source = Service Control Manager | ID = 7022
Description = 
 
 
< End of report >

--- --- ---

OTL.txt:
OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 13.05.2013 14:23:20 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Ulf Rawas\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,17 Gb Available Physical Memory | 58,57% Memory free
4,24 Gb Paging File | 3,17 Gb Available in Paging File | 74,86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 141,51 Gb Total Space | 30,01 Gb Free Space | 21,21% Space Free | Partition Type: NTFS
Drive D: | 149,05 Gb Total Space | 0,13 Gb Free Space | 0,09% Space Free | Partition Type: NTFS
Drive E: | 7,54 Gb Total Space | 2,28 Gb Free Space | 30,24% Space Free | Partition Type: NTFS
Drive F: | 654,81 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: U-RAWAS | User Name: Ulf Rawas | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.05.13 14:21:14 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Ulf Rawas\Desktop\OTL.exe
PRC - [2013.05.10 01:09:41 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.05.02 10:05:29 | 000,812,424 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\Macromed\Flash\FlashUtil32_11_7_700_169_ActiveX.exe
PRC - [2013.03.30 01:15:16 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2013.03.30 01:15:01 | 000,079,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2013.03.30 01:14:59 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.01.19 09:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2007.09.15 03:29:10 | 000,102,400 | ---- | M] (Synaptics, Inc.) -- C:\Programme\Synaptics\SynTP\SynTPStart.exe
PRC - [2007.04.24 03:11:42 | 000,262,243 | ---- | M] () -- C:\Programme\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
PRC - [2006.11.02 11:45:59 | 000,215,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\WindowsMobile\wmdSync.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2007.04.24 03:10:44 | 000,061,440 | ---- | M] () -- C:\Programme\HP\QuickPlay\Kernel\common\MCEMediaStatus.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2013.05.02 10:05:32 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.03.30 01:15:16 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.03.30 01:14:59 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.04.15 13:18:06 | 001,646,056 | ---- | M] (Rosetta Stone Ltd.) [Disabled | Stopped] -- C:\Programme\RosettaStoneLtdServices\RosettaStoneDaemon.exe -- (RosettaStoneDaemon)
SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.19 09:36:49 | 000,365,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2008.01.19 09:36:15 | 000,167,936 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2008.01.19 09:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2007.04.24 03:11:44 | 000,106,593 | ---- | M] () [Disabled | Stopped] -- C:\Programme\HP\QuickPlay\Kernel\TV\CLSched.exe -- (CLSched)
SRV - [2007.04.24 03:11:42 | 000,262,243 | ---- | M] () [Auto | Running] -- C:\Programme\HP\QuickPlay\Kernel\TV\CLCapSvc.exe -- (CLCapSvc)
SRV - [2007.01.09 23:55:34 | 000,110,592 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Disabled | Stopped] -- C:\Programme\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe -- (Com4Qlb)
SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2013.03.30 01:15:20 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2013.03.30 01:15:20 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2013.03.30 01:15:20 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2012.08.27 15:50:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2011.07.26 19:38:28 | 000,015,544 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CPQBttn.sys -- (HBtnKey)
DRV - [2009.10.03 07:02:06 | 009,905,096 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008.03.03 12:32:00 | 000,188,416 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)
DRV - [2007.07.10 07:27:56 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007.06.26 09:38:14 | 000,163,328 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CHDART.sys -- (HdAudAddService)
DRV - [2007.03.07 06:15:58 | 001,059,112 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2007.02.24 16:42:22 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2007.02.17 01:50:32 | 000,012,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2007.01.23 19:03:28 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007.01.23 18:40:20 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006.11.30 19:24:58 | 000,008,192 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | System | Running] -- C:\Windows\System32\drivers\eabfiltr.sys -- (eabfiltr)
DRV - [2006.11.02 09:30:57 | 000,064,000 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avmcowan.sys -- (AVMCOWAN)
DRV - [2004.11.26 03:00:00 | 000,798,656 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\bfhubase.sys -- (bfhubase)
DRV - [2004.11.26 03:00:00 | 000,374,144 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\capi_cip.sys -- (CAPI_CIP)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=73&bd=Pavilion&pf=laptop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=73&bd=Pavilion&pf=laptop
IE - HKLM\..\SearchScopes,DefaultScope = {DB975F34-1B06-408E-9B92-3182C4F5D764}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{DB975F34-1B06-408E-9B92-3182C4F5D764}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\Ulf Rawas\Desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=73&bd=Pavilion&pf=laptop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {DB975F34-1B06-408E-9B92-3182C4F5D764}
IE - HKCU\..\SearchScopes\{DB975F34-1B06-408E-9B92-3182C4F5D764}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =  localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
 
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (XTTBPos00 Class) - {7914D9F0-DD27-4260-9BC1-AE01834B77CA} - C:\Program Files\T-Online\T-Online_Toolbar_2\T-Online_Toolbar_2.0.dll File not found
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (T-Online Toolbar 2.0) - {25F97EB4-1C02-45BA-BA0C-E67AACE64D4A} - C:\Program Files\T-Online\T-Online_Toolbar_2\T-Online_Toolbar_2.0.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (T-Online Toolbar 2.0) - {25F97EB4-1C02-45BA-BA0C-E67AACE64D4A} - C:\Program Files\T-Online\T-Online_Toolbar_2\T-Online_Toolbar_2.0.dll File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [HP Health Check Scheduler] C:\Programme\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [MSConfig] C:\Windows\System32\msconfig.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SynTPStart] C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7CF141E4-0D24-464B-A005-573590131AFB}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8754FBF2-C2E0-4B2B-94B1-4ADA146FFA8F}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D99E2A88-3C48-4B72-87D3-AF8119B2F058}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Ulf Rawas\Pictures\Wallpapers\Windows Vista 7.jpg
O24 - Desktop BackupWallPaper: C:\Users\Ulf Rawas\Pictures\Wallpapers\Windows Vista 7.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2005.09.11 17:18:54 | 000,000,340 | -HS- | M] () - E:\AUTOMODE -- [ NTFS ]
O32 - AutoRun File - [2005.07.05 12:12:14 | 000,000,000 | ---D | M] - F:\AutoRun -- [ CDFS ]
O32 - AutoRun File - [2003.08.31 05:36:09 | 000,002,046 | R--- | M] () - F:\Autorun.csf -- [ CDFS ]
O32 - AutoRun File - [2003.09.01 23:50:21 | 001,101,824 | R--- | M] () - F:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2003.08.31 05:15:46 | 000,000,027 | R--- | M] () - F:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{2abb1717-dbc0-11dc-8d93-404e57434402}\Shell\AutoRun\command - "" = G:\fooool.exe
O33 - MountPoints2\{2abb1717-dbc0-11dc-8d93-404e57434402}\Shell\explore\Command - "" = G:\fooool.exe
O33 - MountPoints2\{2abb1717-dbc0-11dc-8d93-404e57434402}\Shell\open\Command - "" = G:\fooool.exe
O33 - MountPoints2\{45c65050-6a29-11e2-8aa6-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{45c65050-6a29-11e2-8aa6-806e6f6e6963}\Shell\AutoRun\command - "" = G:\setup_vmb_lite.exe /checkApplicationPresence
O33 - MountPoints2\{59c94591-9b3e-11dc-8384-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{59c94591-9b3e-11dc-8384-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Autorun.exe -- [2003.09.01 23:50:21 | 001,101,824 | R--- | M] ()
O33 - MountPoints2\{877b8b8c-0e54-11de-8076-806e6f6e6963}\Shell\AutoRun\command - "" = G:\fooool.exe
O33 - MountPoints2\{877b8b8c-0e54-11de-8076-806e6f6e6963}\Shell\explore\Command - "" = G:\fooool.exe
O33 - MountPoints2\{877b8b8c-0e54-11de-8076-806e6f6e6963}\Shell\open\Command - "" = G:\fooool.exe
O33 - MountPoints2\{9d889073-41aa-11de-ac12-806e6f6e6963}\Shell\AutoRun\command - "" = G:\fooool.exe
O33 - MountPoints2\{9d889073-41aa-11de-ac12-806e6f6e6963}\Shell\explore\Command - "" = G:\fooool.exe
O33 - MountPoints2\{9d889073-41aa-11de-ac12-806e6f6e6963}\Shell\open\Command - "" = G:\fooool.exe
O33 - MountPoints2\{eac12b98-cddf-11dd-951a-404e57434402}\Shell\AutoRun\command - "" = H:\fooool.exe
O33 - MountPoints2\{eac12b98-cddf-11dd-951a-404e57434402}\Shell\explore\Command - "" = H:\fooool.exe
O33 - MountPoints2\{eac12b98-cddf-11dd-951a-404e57434402}\Shell\open\Command - "" = H:\fooool.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Windows Media Player 5.2
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech SetPoint.lnk - C:\Programme\Logitech\SetPoint\SetPoint.exe - (Logitech Inc.)
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: AdobeUpdater - hkey= - key= - C:\Programme\Common Files\Adobe\Updater5\AdobeUpdater.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - hkey= - key= - C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe (Nero AG)
MsConfig - StartUpReg: ccApp - hkey= - key= -  File not found
MsConfig - StartUpReg: HP Software Update - hkey= - key= - C:\Programme\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)
MsConfig - StartUpReg: LightScribe Control Panel - hkey= - key= - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
MsConfig - StartUpReg: NapsterShell - hkey= - key= -  File not found
MsConfig - StartUpReg: NBKeyScan - hkey= - key= - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
MsConfig - StartUpReg: NeroCheck - hkey= - key= -  File not found
MsConfig - StartUpReg: NeroFilterCheck - hkey= - key= - C:\Programme\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
MsConfig - StartUpReg: NvCplDaemon - hkey= - key= -  File not found
MsConfig - StartUpReg: QPService - hkey= - key= - C:\Program Files\HP\QuickPlay\QPService.exe (CyberLink Corp.)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: SynTPEnh - hkey= - key= - C:\Programme\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated)
MsConfig - StartUpReg: WAWifiMessage - hkey= - key= -  File not found
MsConfig - State: "startup" - 2
MsConfig - State: "services" - 2
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.05.13 14:21:13 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Ulf Rawas\Desktop\OTL.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.05.13 14:21:14 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Ulf Rawas\Desktop\OTL.exe
[2013.05.13 13:44:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.05.13 13:17:06 | 000,628,992 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.05.13 13:17:06 | 000,596,246 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.05.13 13:17:06 | 000,126,510 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.05.13 13:17:06 | 000,104,320 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.05.13 13:10:27 | 000,234,122 | ---- | M] () -- C:\ProgramData\nvModes.001
[2013.05.13 13:10:26 | 000,005,136 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.13 13:10:26 | 000,005,136 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.13 13:10:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.04.15 15:12:41 | 000,138,752 | ---- | M] () -- C:\Users\Ulf Rawas\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.02.09 19:22:11 | 000,000,680 | ---- | C] () -- C:\Users\Ulf Rawas\AppData\Local\d3d9caps.dat
[2011.12.25 16:19:23 | 000,000,444 | ---- | C] () -- C:\Users\Ulf Rawas\AppData\Roaming\wklnhst.dat
[2011.09.18 19:06:55 | 000,554,496 | ---- | C] () -- C:\Windows\System32\dvmsg.dll
[2011.09.15 02:11:16 | 001,048,576 | ---- | C] () -- C:\Windows\System32\syndata.bin
[2011.02.27 18:09:05 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.05.07 21:34:26 | 000,234,122 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009.05.07 21:34:26 | 000,234,122 | ---- | C] () -- C:\ProgramData\nvModes.001
[2008.02.09 17:03:58 | 000,000,116 | -HS- | C] () -- C:\ProgramData\.zreglib
[2007.11.25 03:57:43 | 000,202,621 | ---- | C] () -- C:\Users\Ulf Rawas\AppData\Roaming\nvModes.dat
[2007.11.25 03:57:43 | 000,202,621 | ---- | C] () -- C:\Users\Ulf Rawas\AppData\Roaming\nvModes.001
[2007.11.25 00:32:34 | 000,138,752 | ---- | C] () -- C:\Users\Ulf Rawas\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2008.02.06 23:08:07 | 000,000,000 | ---D | M] -- C:\Users\Ulf Rawas\AppData\Roaming\EPSON
[2011.05.19 15:09:13 | 000,000,000 | ---D | M] -- C:\Users\Ulf Rawas\AppData\Roaming\FreeFLVConverter
[2010.08.22 17:36:14 | 000,000,000 | ---D | M] -- C:\Users\Ulf Rawas\AppData\Roaming\ProtectDisc
[2011.12.25 16:19:26 | 000,000,000 | ---D | M] -- C:\Users\Ulf Rawas\AppData\Roaming\Template
[2011.09.18 19:20:48 | 000,000,000 | ---D | M] -- C:\Users\Ulf Rawas\AppData\Roaming\Tobit
[2011.12.04 16:25:22 | 000,000,000 | ---D | M] -- C:\Users\Ulf Rawas\AppData\Roaming\Wise Registry Cleaner
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2011.06.20 15:22:44 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2012.04.05 13:50:27 | 000,000,000 | -HSD | M] -- C:\boot
[2007.11.24 21:13:58 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2007.08.20 11:30:34 | 000,000,000 | -H-D | M] -- C:\HP
[2009.03.11 22:25:49 | 000,000,000 | ---D | M] -- C:\Infinity
[2011.10.26 22:56:48 | 000,000,000 | ---D | M] -- C:\Log
[2012.05.12 12:39:26 | 000,000,000 | ---D | M] -- C:\MappedFiles
[2007.03.30 12:42:54 | 000,000,000 | ---D | M] -- C:\MCPP
[2008.09.16 02:47:26 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2013.05.02 10:36:33 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.11.15 18:02:25 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2007.11.24 21:13:58 | 000,000,000 | -HSD | M] -- C:\Programme
[2007.11.24 21:27:14 | 000,000,000 | ---D | M] -- C:\SwSetup
[2013.05.13 14:25:55 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2007.11.24 21:27:14 | 000,000,000 | -H-D | M] -- C:\System.sav
[2005.03.01 22:38:50 | 000,000,000 | ---D | M] -- C:\Temp
[2009.03.11 23:13:46 | 000,000,000 | ---D | M] -- C:\tocame
[2009.03.11 23:08:05 | 000,000,000 | ---D | M] -- C:\tocame_
[2011.06.20 15:22:15 | 000,000,000 | R--D | M] -- C:\Users
[2013.04.23 16:38:47 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< C:\Windows\system32\*.tsp >
[2006.11.02 11:44:49 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp
[2006.11.02 11:44:49 | 000,038,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp
[2006.11.02 11:44:49 | 000,049,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp
[2006.11.02 11:44:49 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp
[2009.04.11 08:27:17 | 000,280,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp
[2006.11.02 15:01:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2006.11.02 15:01:49 | 000,032,628 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.06.15 13:36:11 | 000,000,884 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job
 
< MD5 for: AGP440.SYS  >
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2007.08.20 11:13:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=313FF294978EA6AF715722D708FB249F -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20494_none_b858f78adaed51b3\AGP440.sys
[2007.08.20 11:13:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=CE71AFD6738AA025D742CDBCFBDC8B9C -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f2490cb0\AGP440.sys
[2007.08.20 11:13:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=CE71AFD6738AA025D742CDBCFBDC8B9C -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.16399_none_b7d45c31c1cb309c\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 05:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2007.11.29 18:50:36 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2007.11.29 18:50:36 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 04:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006.11.02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008.01.19 09:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.08.20 10:07:10 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2007.08.20 10:07:11 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2008.01.19 09:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\system32\*.dll /lockedfiles >
[2011.04.23 14:14:19 | 000,353,792 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtmsft.dll
[2011.04.23 14:14:19 | 000,223,232 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtrans.dll
 
< %USERPROFILE%\*.* >
[2013.05.13 14:30:02 | 003,145,728 | -HS- | M] () -- C:\Users\Ulf Rawas\ntuser.dat
[2013.05.13 14:30:02 | 000,262,144 | -H-- | M] () -- C:\Users\Ulf Rawas\ntuser.dat.LOG1
[2007.11.24 21:17:20 | 000,000,000 | -H-- | M] () -- C:\Users\Ulf Rawas\ntuser.dat.LOG2
[2013.05.10 02:12:23 | 000,065,536 | -HS- | M] () -- C:\Users\Ulf Rawas\ntuser.dat{0fe67825-ae23-11e1-b781-404e57434402}.TM.blf
[2013.05.10 02:12:23 | 000,524,288 | -HS- | M] () -- C:\Users\Ulf Rawas\ntuser.dat{0fe67825-ae23-11e1-b781-404e57434402}.TMContainer00000000000000000001.regtrans-ms
[2012.06.04 17:30:48 | 000,524,288 | -HS- | M] () -- C:\Users\Ulf Rawas\ntuser.dat{0fe67825-ae23-11e1-b781-404e57434402}.TMContainer00000000000000000002.regtrans-ms
[2009.01.22 12:59:22 | 000,065,536 | -HS- | M] () -- C:\Users\Ulf Rawas\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2009.01.22 12:59:22 | 000,524,288 | -HS- | M] () -- C:\Users\Ulf Rawas\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2007.11.24 23:21:10 | 000,524,288 | -HS- | M] () -- C:\Users\Ulf Rawas\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2012.06.04 07:03:06 | 000,065,536 | -HS- | M] () -- C:\Users\Ulf Rawas\ntuser.dat{5aa5f1e1-e871-11dd-86c6-404e57434402}.TM.blf
[2011.01.24 01:03:22 | 000,524,288 | -HS- | M] () -- C:\Users\Ulf Rawas\ntuser.dat{5aa5f1e1-e871-11dd-86c6-404e57434402}.TMContainer00000000000000000001.regtrans-ms
[2012.06.04 07:03:06 | 000,524,288 | -HS- | M] () -- C:\Users\Ulf Rawas\ntuser.dat{5aa5f1e1-e871-11dd-86c6-404e57434402}.TMContainer00000000000000000002.regtrans-ms
[2007.11.24 21:17:20 | 000,000,020 | -HS- | M] () -- C:\Users\Ulf Rawas\ntuser.ini
[2012.12.06 16:23:32 | 000,000,093 | ---- | M] () -- C:\Users\Ulf Rawas\Speedport key.txt
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
 
<           >

< End of report >

--- --- ---

kurze Zwischenfrage:

auf dem OTL-Programm steht "die letzten 30Tage" als Dateialter.

Wenn die kreiierten Dateien älter sind, werden diese auch berücksichtigt?

Danke

markusg · 13.05.2013, 17:08

Frage:
gibts noch andere Geräte mit denen du Banking betreibst?
Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

u578188 · 15.05.2013, 11:03

Es wurden viele Gefunden !!

.txt-Datei:

11:57:29.0212 11716 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
11:57:29.0390 11716 ============================================================
11:57:29.0390 11716 Current date / time: 2013/05/15 11:57:29.0390
11:57:29.0390 11716 SystemInfo:
11:57:29.0390 11716
11:57:29.0390 11716 OS Version: 6.0.6002 ServicePack: 2.0
11:57:29.0390 11716 Product type: Workstation
11:57:29.0390 11716 ComputerName: U-RAWAS
11:57:29.0391 11716 UserName: Ulf Rawas
11:57:29.0391 11716 Windows directory: C:\Windows
11:57:29.0391 11716 System windows directory: C:\Windows
11:57:29.0391 11716 Processor architecture: Intel x86
11:57:29.0391 11716 Number of processors: 2
11:57:29.0391 11716 Page size: 0x1000
11:57:29.0391 11716 Boot type: Normal boot
11:57:29.0391 11716 ============================================================
11:57:33.0238 11716 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
11:57:33.0255 11716 Drive \Device\Harddisk1\DR1 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
11:57:33.0258 11716 ============================================================
11:57:33.0258 11716 \Device\Harddisk0\DR0:
11:57:33.0263 11716 MBR partitions:
11:57:33.0263 11716 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x11B054AA
11:57:33.0263 11716 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x11B054E9, BlocksNum 0xF135D8
11:57:33.0263 11716 \Device\Harddisk1\DR1:
11:57:33.0263 11716 MBR partitions:
11:57:33.0263 11716 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x12A18A82
11:57:33.0263 11716 ============================================================
11:57:33.0320 11716 C: <-> \Device\Harddisk0\DR0\Partition1
11:57:33.0321 11716 D: <-> \Device\Harddisk1\DR1\Partition1
11:57:33.0470 11716 E: <-> \Device\Harddisk0\DR0\Partition2
11:57:33.0470 11716 ============================================================
11:57:33.0470 11716 Initialize success
11:57:33.0470 11716 ============================================================
11:57:46.0139 11664 ============================================================
11:57:46.0139 11664 Scan started
11:57:46.0139 11664 Mode: Manual;
11:57:46.0139 11664 ============================================================
11:57:47.0719 11664 ================ Scan system memory ========================
11:57:47.0719 11664 Scan interrupted by user!
11:57:47.0719 11664 ================ Scan services =============================
11:57:47.0746 11664 Scan interrupted by user!
11:57:47.0746 11664 ================ Scan global ===============================
11:57:47.0746 11664 Scan interrupted by user!
11:57:47.0746 11664 ================ Scan MBR ==================================
11:57:47.0746 11664 Scan interrupted by user!
11:57:47.0746 11664 ================ Scan VBR ==================================
11:57:47.0746 11664 Scan interrupted by user!
11:57:47.0746 11664 ============================================================
11:57:47.0746 11664 Scan finished
11:57:47.0746 11664 ============================================================
11:57:47.0759 11040 Detected object count: 0
11:57:47.0759 11040 Actual detected object count: 0
11:58:11.0723 11816 ============================================================
11:58:11.0723 11816 Scan started
11:58:11.0723 11816 Mode: Manual; SigCheck; TDLFS;
11:58:11.0723 11816 ============================================================
11:58:20.0932 11816 ================ Scan system memory ========================
11:58:20.0932 11816 System memory - ok
11:58:20.0933 11816 ================ Scan services =============================
11:58:21.0914 11816 [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI C:\Windows\system32\drivers\acpi.sys
11:58:22.0147 11816 ACPI - ok
11:58:22.0298 11816 [ 479901C99FA62D1C3261B7ACB1228DAD ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
11:58:22.0449 11816 AdobeFlashPlayerUpdateSvc - ok
11:58:22.0570 11816 [ 2EDC5BBAC6C651ECE337BDE8ED97C9FB ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
11:58:22.0638 11816 adp94xx - ok
11:58:22.0666 11816 [ B84088CA3CDCA97DA44A984C6CE1CCAD ] adpahci C:\Windows\system32\drivers\adpahci.sys
11:58:22.0697 11816 adpahci - ok
11:58:22.0723 11816 [ 7880C67BCCC27C86FD05AA2AFB5EA469 ] adpu160m C:\Windows\system32\drivers\adpu160m.sys
11:58:22.0793 11816 adpu160m - ok
11:58:22.0874 11816 [ 9AE713F8E30EFC2ABCCD84904333DF4D ] adpu320 C:\Windows\system32\drivers\adpu320.sys
11:58:22.0942 11816 adpu320 - ok
11:58:22.0967 11816 [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
11:58:23.0620 11816 AeLookupSvc - ok
11:58:23.0716 11816 [ 3911B972B55FEA0478476B2E777B29FA ] AFD C:\Windows\system32\drivers\afd.sys
11:58:23.0908 11816 AFD - ok
11:58:24.0253 11816 [ EF23439CDD587F64C2C1B8825CEAD7D8 ] agp440 C:\Windows\system32\drivers\agp440.sys
11:58:24.0413 11816 agp440 - ok
11:58:24.0469 11816 [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx C:\Windows\system32\drivers\djsvs.sys
11:58:24.0511 11816 aic78xx - ok
11:58:24.0555 11816 [ A1545B731579895D8CC44FC0481C1192 ] ALG C:\Windows\System32\alg.exe
11:58:25.0206 11816 ALG - ok
11:58:25.0277 11816 [ 90395B64600EBB4552E26E178C94B2E4 ] aliide C:\Windows\system32\drivers\aliide.sys
11:58:25.0318 11816 aliide - ok
11:58:25.0357 11816 [ 2B13E304C9DFDFA5EB582F6A149FA2C7 ] amdagp C:\Windows\system32\drivers\amdagp.sys
11:58:25.0470 11816 amdagp - ok
11:58:25.0500 11816 [ 0577DF1D323FE75A739C787893D300EA ] amdide C:\Windows\system32\drivers\amdide.sys
11:58:25.0567 11816 amdide - ok
11:58:25.0587 11816 [ DC487885BCEF9F28EECE6FAC0E5DDFC5 ] AmdK7 C:\Windows\system32\drivers\amdk7.sys
11:58:25.0920 11816 AmdK7 - ok
11:58:25.0985 11816 [ 93AE7F7DD54AB986A6F1A1B37BE7442D ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
11:58:26.0031 11816 AmdK8 - ok
11:58:26.0676 11816 [ D9A92E6DD41C5ADC045AE485026AA40C ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe
11:58:26.0689 11816 AntiVirSchedulerService - ok
11:58:26.0735 11816 [ 66A7A38F7C439153B758548375EB9E5E ] AntiVirService C:\Program Files\Avira\AntiVir Desktop\avguard.exe
11:58:26.0779 11816 AntiVirService - ok
11:58:26.0817 11816 [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo C:\Windows\System32\appinfo.dll
11:58:26.0921 11816 Appinfo - ok
11:58:26.0944 11816 [ 5F673180268BB1FDB69C99B6619FE379 ] arc C:\Windows\system32\drivers\arc.sys
11:58:27.0037 11816 arc - ok
11:58:27.0060 11816 [ 957F7540B5E7F602E44648C7DE5A1C05 ] arcsas C:\Windows\system32\drivers\arcsas.sys
11:58:27.0160 11816 arcsas - ok
11:58:27.0241 11816 [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
11:58:27.0362 11816 AsyncMac - ok
11:58:27.0420 11816 [ 1F05B78AB91C9075565A9D8A4B880BC4 ] atapi C:\Windows\system32\drivers\atapi.sys
11:58:27.0434 11816 atapi - ok
11:58:27.0522 11816 [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
11:58:27.0595 11816 AudioEndpointBuilder - ok
11:58:27.0608 11816 [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv C:\Windows\System32\Audiosrv.dll
11:58:27.0632 11816 Audiosrv - ok
11:58:27.0698 11816 [ 87425709A251386064C99B684BF96F72 ] avgntflt C:\Windows\system32\DRIVERS\avgntflt.sys
11:58:27.0726 11816 avgntflt - ok
11:58:27.0825 11816 [ D50FBA68163BC498F2C136E0E5BA8E2F ] avipbb C:\Windows\system32\DRIVERS\avipbb.sys
11:58:27.0857 11816 avipbb - ok
11:58:27.0878 11816 [ CB8741CD7B126499FED40C9B197F6AC5 ] avkmgr C:\Windows\system32\DRIVERS\avkmgr.sys
11:58:27.0899 11816 avkmgr - ok
11:58:27.0980 11816 [ D730AA8494EC4C8C6C976F5EB04D3AC2 ] AVMCOWAN C:\Windows\system32\DRIVERS\AVMCOWAN.sys
11:58:28.0093 11816 AVMCOWAN - ok
11:58:28.0151 11816 [ 746F59822A5187510471FC46889B8CC9 ] BCM43XV C:\Windows\system32\DRIVERS\bcmwl6.sys
11:58:28.0266 11816 BCM43XV - ok
11:58:28.0283 11816 [ 746F59822A5187510471FC46889B8CC9 ] BCM43XX C:\Windows\system32\DRIVERS\bcmwl6.sys
11:58:28.0304 11816 BCM43XX - ok
11:58:28.0352 11816 [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep C:\Windows\system32\drivers\Beep.sys
11:58:28.0400 11816 Beep - ok
11:58:28.0462 11816 [ C789AF0F724FDA5852FB9A7D3A432381 ] BFE C:\Windows\System32\bfe.dll
11:58:28.0557 11816 BFE - ok
11:58:28.0651 11816 [ 4531143E6CD9AC8D49B92255D2CC4B41 ] bfhubase C:\Windows\system32\DRIVERS\bfhubase.sys
11:58:28.0713 11816 bfhubase ( UnsignedFile.Multi.Generic ) - warning
11:58:28.0713 11816 bfhubase - detected UnsignedFile.Multi.Generic (1)
11:58:28.0785 11816 [ 93952506C6D67330367F7E7934B6A02F ] BITS C:\Windows\System32\qmgr.dll
11:58:28.0847 11816 BITS - ok
11:58:28.0858 11816 blbdrive - ok
11:58:28.0911 11816 [ 35F376253F687BDE63976CCB3F2108CA ] bowser C:\Windows\system32\DRIVERS\bowser.sys
11:58:29.0007 11816 bowser - ok
11:58:29.0057 11816 [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo C:\Windows\system32\drivers\brfiltlo.sys
11:58:29.0114 11816 BrFiltLo - ok
11:58:29.0158 11816 [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp C:\Windows\system32\drivers\brfiltup.sys
11:58:29.0201 11816 BrFiltUp - ok
11:58:29.0259 11816 [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser C:\Windows\System32\browser.dll
11:58:29.0313 11816 Browser - ok
11:58:29.0353 11816 [ B304E75CFF293029EDDF094246747113 ] Brserid C:\Windows\system32\drivers\brserid.sys
11:58:29.0460 11816 Brserid - ok
11:58:29.0496 11816 [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm C:\Windows\system32\drivers\brserwdm.sys
11:58:29.0551 11816 BrSerWdm - ok
11:58:29.0584 11816 [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm C:\Windows\system32\drivers\brusbmdm.sys
11:58:29.0678 11816 BrUsbMdm - ok
11:58:29.0704 11816 [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer C:\Windows\system32\drivers\brusbser.sys
11:58:29.0780 11816 BrUsbSer - ok
11:58:29.0839 11816 [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
11:58:29.0902 11816 BTHMODEM - ok
11:58:29.0958 11816 [ 600FE1FC7F063398E56FBCE22488B108 ] CAPI_CIP C:\Windows\system32\DRIVERS\capi_cip.sys
11:58:29.0993 11816 CAPI_CIP ( UnsignedFile.Multi.Generic ) - warning
11:58:29.0993 11816 CAPI_CIP - detected UnsignedFile.Multi.Generic (1)
11:58:30.0038 11816 [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
11:58:30.0079 11816 cdfs - ok
11:58:30.0116 11816 [ 6B4BFFB9BECD728097024276430DB314 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
11:58:30.0197 11816 cdrom - ok
11:58:30.0289 11816 [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc C:\Windows\System32\certprop.dll
11:58:30.0328 11816 CertPropSvc - ok
11:58:30.0369 11816 [ DA8E0AFC7BAA226C538EF53AC2F90897 ] circlass C:\Windows\system32\drivers\circlass.sys
11:58:30.0455 11816 circlass - ok
11:58:30.0567 11816 [ DBAFC6734C054FEEF9087754BD80F847 ] CLCapSvc C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
11:58:30.0597 11816 CLCapSvc ( UnsignedFile.Multi.Generic ) - warning
11:58:30.0597 11816 CLCapSvc - detected UnsignedFile.Multi.Generic (1)
11:58:30.0656 11816 [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS C:\Windows\system32\CLFS.sys
11:58:30.0691 11816 CLFS - ok
11:58:30.0767 11816 [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
11:58:30.0790 11816 clr_optimization_v2.0.50727_32 - ok
11:58:30.0844 11816 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
11:58:30.0893 11816 clr_optimization_v4.0.30319_32 - ok
11:58:30.0925 11816 [ E67F8F036FD882E4AB62501C0D45B536 ] CLSched C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
11:58:30.0961 11816 CLSched ( UnsignedFile.Multi.Generic ) - warning
11:58:30.0962 11816 CLSched - detected UnsignedFile.Multi.Generic (1)
11:58:31.0006 11816 [ 99AFC3795B58CC478FBBBCDC658FCB56 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
11:58:31.0060 11816 CmBatt - ok
11:58:31.0119 11816 [ 45201046C776FFDAF3FC8A0029C581C8 ] cmdide C:\Windows\system32\drivers\cmdide.sys
11:58:31.0138 11816 cmdide - ok
11:58:31.0191 11816 [ B6E7991E3D6146C04C85CD31AF22A381 ] CnxtHdAudService C:\Windows\system32\drivers\CHDRT32.sys
11:58:31.0268 11816 CnxtHdAudService - ok
11:58:31.0360 11816 [ A5AAA656403E5E7AFA9647CE73DBF944 ] Com4Qlb C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
11:58:31.0399 11816 Com4Qlb ( UnsignedFile.Multi.Generic ) - warning
11:58:31.0399 11816 Com4Qlb - detected UnsignedFile.Multi.Generic (1)
11:58:31.0445 11816 [ 6AFEF0B60FA25DE07C0968983EE4F60A ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
11:58:31.0467 11816 Compbatt - ok
11:58:31.0476 11816 COMSysApp - ok
11:58:31.0492 11816 [ 2A213AE086BBEC5E937553C7D9A2B22C ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
11:58:31.0512 11816 crcdisk - ok
11:58:31.0538 11816 [ 22A7F883508176489F559EE745B5BF5D ] Crusoe C:\Windows\system32\drivers\crusoe.sys
11:58:31.0608 11816 Crusoe - ok
11:58:31.0685 11816 [ F1E8C34892336D33EDDCDFE44E474F64 ] CryptSvc C:\Windows\system32\cryptsvc.dll
11:58:31.0832 11816 CryptSvc - ok
11:58:32.0102 11816 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch C:\Windows\system32\rpcss.dll
11:58:32.0183 11816 DcomLaunch - ok
11:58:32.0235 11816 [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC C:\Windows\system32\Drivers\dfsc.sys
11:58:32.0334 11816 DfsC - ok
11:58:32.0436 11816 [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR C:\Windows\system32\DFSR.exe
11:58:32.0615 11816 DFSR - ok
11:58:32.0668 11816 [ 9028559C132146FB75EB7ACF384B086A ] Dhcp C:\Windows\System32\dhcpcsvc.dll
11:58:32.0725 11816 Dhcp - ok
11:58:32.0771 11816 [ 5D4AEFC3386920236A548271F8F1AF6A ] disk C:\Windows\system32\drivers\disk.sys
11:58:32.0797 11816 disk - ok
11:58:32.0846 11816 [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache C:\Windows\System32\dnsrslvr.dll
11:58:32.0879 11816 Dnscache - ok
11:58:32.0933 11816 [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc C:\Windows\System32\dot3svc.dll
11:58:32.0975 11816 dot3svc - ok
11:58:33.0030 11816 [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS C:\Windows\system32\dps.dll
11:58:33.0086 11816 DPS - ok
11:58:33.0131 11816 [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
11:58:33.0171 11816 drmkaud - ok
11:58:33.0229 11816 [ C68AC676B0EF30CFBB1080ADCE49EB1F ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
11:58:33.0265 11816 DXGKrnl - ok
11:58:33.0297 11816 [ C0B00E55CF82D122D25983C7A6A53DEA ] E100B C:\Windows\system32\DRIVERS\e100b325.sys
11:58:33.0402 11816 E100B - ok
11:58:33.0436 11816 [ F88FB26547FD2CE6D0A5AF2985892C48 ] E1G60 C:\Windows\system32\DRIVERS\E1G60I32.sys
11:58:33.0517 11816 E1G60 - ok
11:58:33.0567 11816 [ E88B0CFCECF745211BBA87F44F85D0DD ] eabfiltr C:\Windows\system32\DRIVERS\eabfiltr.sys
11:58:33.0621 11816 eabfiltr - ok
11:58:33.0681 11816 [ C0B95E40D85CD807D614E264248A45B9 ] EapHost C:\Windows\System32\eapsvc.dll
11:58:33.0726 11816 EapHost - ok
11:58:33.0770 11816 [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache C:\Windows\system32\drivers\ecache.sys
11:58:33.0801 11816 Ecache - ok
11:58:33.0879 11816 [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
11:58:33.0957 11816 ehRecvr - ok
11:58:33.0999 11816 [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched C:\Windows\ehome\ehsched.exe
11:58:34.0120 11816 ehSched - ok
11:58:34.0144 11816 [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart C:\Windows\ehome\ehstart.dll
11:58:34.0181 11816 ehstart - ok
11:58:34.0237 11816 [ E8F3F21A71720C84BCF423B80028359F ] elxstor C:\Windows\system32\drivers\elxstor.sys
11:58:34.0270 11816 elxstor - ok
11:58:34.0352 11816 [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt C:\Windows\system32\emdmgmt.dll
11:58:34.0569 11816 EMDMgmt - ok
11:58:34.0693 11816 [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem C:\Windows\system32\es.dll
11:58:34.0747 11816 EventSystem - ok
11:58:34.0809 11816 [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat C:\Windows\system32\drivers\exfat.sys
11:58:34.0903 11816 exfat - ok
11:58:34.0967 11816 [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat C:\Windows\system32\drivers\fastfat.sys
11:58:35.0149 11816 fastfat - ok
11:58:35.0185 11816 [ 63BDADA84951B9C03E641800E176898A ] fdc C:\Windows\system32\DRIVERS\fdc.sys
11:58:35.0294 11816 fdc - ok
11:58:35.0345 11816 [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost C:\Windows\system32\fdPHost.dll
11:58:35.0429 11816 fdPHost - ok
11:58:35.0469 11816 [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub C:\Windows\system32\fdrespub.dll
11:58:35.0558 11816 FDResPub - ok
11:58:35.0632 11816 [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
11:58:35.0655 11816 FileInfo - ok
11:58:35.0767 11816 [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace C:\Windows\system32\drivers\filetrace.sys
11:58:35.0841 11816 Filetrace - ok
11:58:35.0914 11816 [ 6603957EFF5EC62D25075EA8AC27DE68 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
11:58:36.0065 11816 flpydisk - ok
11:58:36.0206 11816 [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
11:58:36.0322 11816 FltMgr - ok
11:58:36.0606 11816 [ 8CE364388C8ECA59B14B539179276D44 ] FontCache C:\Windows\system32\FntCache.dll
11:58:37.0097 11816 FontCache - ok
11:58:37.0585 11816 [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
11:58:37.0939 11816 FontCache3.0.0.0 - ok
11:58:38.0137 11816 [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
11:58:38.0388 11816 Fs_Rec - ok
11:58:38.0466 11816 [ 4E1CD0A45C50A8882616CAE5BF82F3C5 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
11:58:38.0519 11816 gagp30kx - ok
11:58:38.0692 11816 [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc C:\Windows\System32\gpsvc.dll
11:58:38.0811 11816 gpsvc - ok
11:58:38.0868 11816 [ E19BC597A0B13BBE6A7E3612F6F8D8A6 ] HBtnKey C:\Windows\system32\DRIVERS\cpqbttn.sys
11:58:38.0907 11816 HBtnKey - ok
11:58:39.0050 11816 [ 5AB09C8B9DA9E5DAE0090EB62A9D035A ] HdAudAddService C:\Windows\system32\drivers\CHDART.sys
11:58:40.0873 11816 HdAudAddService - ok
11:58:41.0121 11816 [ 062452B7FFD68C8C042A6261FE8DFF4A ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
11:58:41.0666 11816 HDAudBus - ok
11:58:41.0825 11816 [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth C:\Windows\system32\drivers\hidbth.sys
11:58:42.0173 11816 HidBth - ok
11:58:42.0223 11816 [ FF3160C3A2445128C5A6D9B076DA519E ] HidIr C:\Windows\system32\drivers\hidir.sys
11:58:42.0438 11816 HidIr - ok
11:58:42.0628 11816 [ 84067081F3318162797385E11A8F0582 ] hidserv C:\Windows\system32\hidserv.dll
11:58:42.0890 11816 hidserv - ok
11:58:43.0044 11816 [ CCA4B519B17E23A00B826C55716809CC ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
11:58:43.0099 11816 HidUsb - ok
11:58:43.0258 11816 [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc C:\Windows\system32\kmsvc.dll
11:58:43.0352 11816 hkmsvc - ok
11:58:43.0439 11816 [ 2CEEB349216FEBD91A907013D4ABCFF7 ] HP Health Check Service C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
11:58:43.0486 11816 HP Health Check Service - ok
11:58:43.0545 11816 [ DF353B401001246853763C4B7AAA6F50 ] HpCISSs C:\Windows\system32\drivers\hpcisss.sys
11:58:43.0573 11816 HpCISSs - ok
11:58:43.0837 11816 [ 04C1DCBB226C6AE647B794833CE3CEB6 ] hpqwmiex C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
11:58:43.0916 11816 hpqwmiex ( UnsignedFile.Multi.Generic ) - warning
11:58:43.0916 11816 hpqwmiex - detected UnsignedFile.Multi.Generic (1)
11:58:43.0981 11816 [ 46D67209550973257601A533E2AC5785 ] HSFHWAZL C:\Windows\system32\DRIVERS\VSTAZL3.SYS
11:58:44.0043 11816 HSFHWAZL - ok
11:58:44.0152 11816 [ 1882827F41DEE51C70E24C567C35BFB5 ] HSF_DPV C:\Windows\system32\DRIVERS\HSX_DPV.sys
11:58:44.0346 11816 HSF_DPV - ok
11:58:44.0504 11816 [ A44DDF3BA83E4664BF4DE9220097578C ] HSXHWAZL C:\Windows\system32\DRIVERS\HSXHWAZL.sys
11:58:44.0567 11816 HSXHWAZL - ok
11:58:44.0681 11816 [ F870AA3E254628EBEAFE754108D664DE ] HTTP C:\Windows\system32\drivers\HTTP.sys
11:58:44.0904 11816 HTTP - ok
11:58:44.0949 11816 [ 324C2152FF2C61ABAE92D09F3CCA4D63 ] i2omp C:\Windows\system32\drivers\i2omp.sys
11:58:44.0969 11816 i2omp - ok
11:58:44.0994 11816 [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
11:58:45.0286 11816 i8042prt - ok
11:58:45.0649 11816 [ 496DB78E6A0C4C44023D9A92B4A7AC31 ] ialm C:\Windows\system32\DRIVERS\igdkmd32.sys
11:58:45.0843 11816 ialm - ok
11:58:45.0899 11816 [ C957BF4B5D80B46C5017BF0101E6C906 ] iaStorV C:\Windows\system32\drivers\iastorv.sys
11:58:46.0138 11816 iaStorV - ok
11:58:46.0398 11816 [ 6F95324909B502E2651442C1548AB12F ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
11:58:46.0604 11816 IDriverT ( UnsignedFile.Multi.Generic ) - warning
11:58:46.0605 11816 IDriverT - detected UnsignedFile.Multi.Generic (1)
11:58:46.0724 11816 [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
11:58:46.0794 11816 idsvc - ok
11:58:46.0868 11816 [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp C:\Windows\system32\drivers\iirsp.sys
11:58:46.0890 11816 iirsp - ok
11:58:46.0937 11816 [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT C:\Windows\System32\ikeext.dll
11:58:46.0992 11816 IKEEXT - ok
11:58:47.0023 11816 [ 97469037714070E45194ED318D636401 ] intelide C:\Windows\system32\drivers\intelide.sys
11:58:47.0052 11816 intelide - ok
11:58:47.0078 11816 [ CE44CC04262F28216DD4341E9E36A16F ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
11:58:47.0137 11816 intelppm - ok
11:58:47.0184 11816 [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum C:\Windows\system32\ipbusenum.dll
11:58:47.0222 11816 IPBusEnum - ok
11:58:47.0270 11816 [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
11:58:47.0437 11816 IpFilterDriver - ok
11:58:47.0567 11816 [ 1998BD97F950680BB55F55A7244679C2 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
11:58:47.0811 11816 iphlpsvc - ok
11:58:47.0820 11816 IpInIp - ok
11:58:47.0904 11816 [ 40F34F8ABA2A015D780E4B09138B6C17 ] IPMIDRV C:\Windows\system32\drivers\ipmidrv.sys
11:58:48.0037 11816 IPMIDRV - ok
11:58:48.0108 11816 [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT C:\Windows\system32\DRIVERS\ipnat.sys
11:58:48.0186 11816 IPNAT - ok
11:58:48.0251 11816 [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
11:58:48.0307 11816 IRENUM - ok
11:58:48.0408 11816 [ 350FCA7E73CF65BCEF43FAE1E4E91293 ] isapnp C:\Windows\system32\drivers\isapnp.sys
11:58:48.0435 11816 isapnp - ok
11:58:48.0662 11816 [ 232FA340531D940AAC623B121A595034 ] iScsiPrt C:\Windows\system32\DRIVERS\msiscsi.sys
11:58:48.0728 11816 iScsiPrt - ok
11:58:48.0787 11816 [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi C:\Windows\system32\drivers\iteatapi.sys
11:58:48.0856 11816 iteatapi - ok
11:58:48.0908 11816 [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid C:\Windows\system32\drivers\iteraid.sys
11:58:48.0961 11816 iteraid - ok
11:58:49.0005 11816 [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
11:58:49.0057 11816 kbdclass - ok
11:58:49.0098 11816 [ EDE59EC70E25C24581ADD1FBEC7325F7 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
11:58:49.0399 11816 kbdhid - ok
11:58:49.0502 11816 [ A3E186B4B935905B829219502557314E ] KeyIso C:\Windows\system32\lsass.exe
11:58:49.0591 11816 KeyIso - ok
11:58:49.0680 11816 [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
11:58:50.0076 11816 KSecDD - ok
11:58:50.0132 11816 [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm C:\Windows\system32\msdtckrm.dll
11:58:50.0443 11816 KtmRm - ok
11:58:50.0821 11816 [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer C:\Windows\system32\srvsvc.dll
11:58:51.0000 11816 LanmanServer - ok
11:58:51.0157 11816 [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
11:58:51.0368 11816 LanmanWorkstation - ok
11:58:51.0670 11816 [ 31D8B705DCD5F2366186E731F87C7A71 ] LightScribeService C:\Program Files\Common Files\LightScribe\LSSrvc.exe
11:58:51.0718 11816 LightScribeService - ok
11:58:51.0923 11816 [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
11:58:52.0068 11816 lltdio - ok
11:58:52.0165 11816 [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc C:\Windows\System32\lltdsvc.dll
11:58:52.0337 11816 lltdsvc - ok
11:58:52.0398 11816 [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts C:\Windows\System32\lmhsvc.dll
11:58:52.0557 11816 lmhosts - ok
11:58:52.0648 11816 [ A2262FB9F28935E862B4DB46438C80D2 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
11:58:52.0746 11816 LSI_FC - ok
11:58:52.0793 11816 [ 30D73327D390F72A62F32C103DAF1D6D ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
11:58:52.0848 11816 LSI_SAS - ok
11:58:52.0883 11816 [ E1E36FEFD45849A95F1AB81DE0159FE3 ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
11:58:52.0957 11816 LSI_SCSI - ok
11:58:53.0072 11816 [ 8F5C7426567798E62A3B3614965D62CC ] luafv C:\Windows\system32\drivers\luafv.sys
11:58:53.0462 11816 luafv - ok
11:58:53.0509 11816 [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
11:58:53.0570 11816 Mcx2Svc - ok
11:58:53.0610 11816 [ 0CEA2D0D3FA284B85ED5B68365114F76 ] mdmxsdk C:\Windows\system32\DRIVERS\mdmxsdk.sys
11:58:53.0875 11816 mdmxsdk - ok
11:58:53.0923 11816 [ D153B14FC6598EAE8422A2037553ADCE ] megasas C:\Windows\system32\drivers\megasas.sys
11:58:53.0974 11816 megasas - ok
11:58:54.0031 11816 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS C:\Windows\system32\mmcss.dll
11:58:54.0157 11816 MMCSS - ok
11:58:54.0312 11816 [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem C:\Windows\system32\drivers\modem.sys
11:58:54.0450 11816 Modem - ok
11:58:54.0617 11816 [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
11:58:54.0710 11816 monitor - ok
11:58:54.0747 11816 [ 5BF6A1326A335C5298477754A506D263 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
11:58:54.0775 11816 mouclass - ok
11:58:54.0829 11816 [ 93B8D4869E12CFBE663915502900876F ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
11:58:54.0888 11816 mouhid - ok
11:58:54.0949 11816 [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr C:\Windows\system32\drivers\mountmgr.sys
11:58:54.0975 11816 MountMgr - ok
11:58:55.0037 11816 [ 583A41F26278D9E0EA548163D6139397 ] mpio C:\Windows\system32\drivers\mpio.sys
11:58:55.0061 11816 mpio - ok
11:58:55.0120 11816 [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
11:58:55.0153 11816 mpsdrv - ok
11:58:55.0220 11816 [ 5DE62C6E9108F14F6794060A9BDECAEC ] MpsSvc C:\Windows\system32\mpssvc.dll
11:58:55.0284 11816 MpsSvc - ok
11:58:55.0317 11816 [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x C:\Windows\system32\drivers\mraid35x.sys
11:58:55.0340 11816 Mraid35x - ok
11:58:55.0400 11816 [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
11:58:55.0490 11816 MRxDAV - ok
11:58:55.0537 11816 [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
11:58:55.0642 11816 mrxsmb - ok
11:58:55.0693 11816 [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
11:58:55.0800 11816 mrxsmb10 - ok
11:58:55.0856 11816 [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
11:58:55.0928 11816 mrxsmb20 - ok
11:58:56.0026 11816 [ 742AED7939E734C36B7E8D6228CE26B7 ] msahci C:\Windows\system32\drivers\msahci.sys
11:58:56.0104 11816 msahci - ok
11:58:56.0139 11816 [ 3FC82A2AE4CC149165A94699183D3028 ] msdsm C:\Windows\system32\drivers\msdsm.sys
11:58:56.0185 11816 msdsm - ok
11:58:56.0226 11816 [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC C:\Windows\System32\msdtc.exe
11:58:56.0290 11816 MSDTC - ok
11:58:56.0365 11816 [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs C:\Windows\system32\drivers\Msfs.sys
11:58:56.0457 11816 Msfs - ok
11:58:56.0527 11816 [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
11:58:56.0561 11816 msisadrv - ok
11:58:56.0589 11816 [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
11:58:56.0681 11816 MSiSCSI - ok
11:58:56.0690 11816 msiserver - ok
11:58:56.0746 11816 [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
11:58:56.0797 11816 MSKSSRV - ok
11:58:56.0872 11816 [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
11:58:56.0922 11816 MSPCLOCK - ok
11:58:57.0234 11816 [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
11:58:57.0341 11816 MSPQM - ok
11:58:57.0450 11816 [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
11:58:57.0793 11816 MsRPC - ok
11:58:57.0850 11816 [ E384487CB84BE41D09711C30CA79646C ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
11:58:57.0864 11816 mssmbios - ok
11:58:57.0910 11816 [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
11:58:57.0940 11816 MSTEE - ok
11:58:57.0984 11816 [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup C:\Windows\system32\Drivers\mup.sys
11:58:58.0008 11816 Mup - ok
11:58:58.0061 11816 [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent C:\Windows\system32\qagentRT.dll
11:58:58.0116 11816 napagent - ok
11:58:58.0173 11816 [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
11:58:58.0224 11816 NativeWifiP - ok
11:58:58.0295 11816 [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS C:\Windows\system32\drivers\ndis.sys
11:58:58.0326 11816 NDIS - ok
11:58:58.0366 11816 [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
11:58:58.0421 11816 NdisTapi - ok
11:58:58.0478 11816 [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
11:58:58.0530 11816 Ndisuio - ok
11:58:58.0595 11816 [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
11:58:58.0656 11816 NdisWan - ok
11:58:58.0715 11816 [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
11:58:58.0764 11816 NDProxy - ok
11:58:58.0912 11816 [ 6D4028D458EAAA1782099750790DC8C9 ] Nero BackItUp Scheduler 3 C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
11:58:58.0970 11816 Nero BackItUp Scheduler 3 - ok
11:58:59.0046 11816 [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
11:58:59.0099 11816 NetBIOS - ok
11:58:59.0151 11816 [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt C:\Windows\system32\DRIVERS\netbt.sys
11:58:59.0186 11816 netbt - ok
11:58:59.0203 11816 [ A3E186B4B935905B829219502557314E ] Netlogon C:\Windows\system32\lsass.exe
11:58:59.0219 11816 Netlogon - ok
11:58:59.0264 11816 [ C8052711DAECC48B982434C5116CA401 ] Netman C:\Windows\System32\netman.dll
11:58:59.0318 11816 Netman - ok
11:58:59.0363 11816 [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm C:\Windows\System32\netprofm.dll
11:58:59.0418 11816 netprofm - ok
11:58:59.0470 11816 [ D6C4E4A39A36029AC0813D476FBD0248 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
11:58:59.0500 11816 NetTcpPortSharing - ok
11:58:59.0538 11816 [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
11:58:59.0558 11816 nfrd960 - ok
11:58:59.0601 11816 [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc C:\Windows\System32\nlasvc.dll
11:58:59.0657 11816 NlaSvc - ok
11:58:59.0788 11816 [ FF4D73B16EA3A32D34CEB3A7BC3C3773 ] NMIndexingService C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
11:58:59.0855 11816 NMIndexingService - ok
11:58:59.0904 11816 [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs C:\Windows\system32\drivers\Npfs.sys
11:58:59.0955 11816 Npfs - ok
11:59:00.0001 11816 [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi C:\Windows\system32\nsisvc.dll
11:59:00.0046 11816 nsi - ok
11:59:00.0083 11816 [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
11:59:00.0115 11816 nsiproxy - ok
11:59:00.0192 11816 [ 2C1121F2B87E9A6B12485DF53CD848C7 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
11:59:00.0264 11816 Ntfs - ok
11:59:00.0319 11816 [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi C:\Windows\system32\drivers\ntrigdigi.sys
11:59:00.0397 11816 ntrigdigi - ok
11:59:00.0445 11816 [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null C:\Windows\system32\drivers\Null.sys
11:59:01.0873 11816 Null - ok
11:59:01.0952 11816 [ A1108084B0D2FC43DCC401735770E2A3 ] NVENETFD C:\Windows\system32\DRIVERS\nvmfdx32.sys
11:59:02.0057 11816 NVENETFD - ok
11:59:02.0404 11816 [ 24000B817CC84AC1555F41929879AF5A ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
11:59:09.0790 11816 nvlddmkm - ok
11:59:09.0867 11816 [ E69E946F80C1C31C53003BFBF50CBB7C ] nvraid C:\Windows\system32\drivers\nvraid.sys
11:59:09.0934 11816 nvraid - ok
11:59:10.0014 11816 [ 9AEBC32F9D6E02EBEE0369AB296FE7C8 ] nvsmu C:\Windows\system32\DRIVERS\nvsmu.sys
11:59:10.0074 11816 nvsmu - ok
11:59:10.0102 11816 [ 9E0BA19A28C498A6D323D065DB76DFFC ] nvstor C:\Windows\system32\drivers\nvstor.sys
11:59:10.0127 11816 nvstor - ok
11:59:10.0182 11816 [ C4D17F11526F87BC762F31DA5BD2580B ] nvsvc C:\Windows\system32\nvvsvc.exe
11:59:10.0202 11816 nvsvc - ok
11:59:10.0238 11816 [ 07C186427EB8FCC3D8D7927187F260F7 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
11:59:10.0280 11816 nv_agp - ok
11:59:10.0292 11816 NwlnkFlt - ok
11:59:10.0304 11816 NwlnkFwd - ok
11:59:10.0353 11816 [ 6F310E890D46E246E0E261A63D9B36B4 ] ohci1394 C:\Windows\system32\DRIVERS\ohci1394.sys
11:59:10.0377 11816 ohci1394 - ok
11:59:10.0558 11816 [ 7A56CF3E3F12E8AF599963B16F50FB6A ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
11:59:10.0585 11816 ose - ok
11:59:10.0734 11816 [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc C:\Windows\system32\p2psvc.dll
11:59:11.0233 11816 p2pimsvc - ok
11:59:11.0255 11816 [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc C:\Windows\system32\p2psvc.dll
11:59:11.0344 11816 p2psvc - ok
11:59:11.0396 11816 [ 0FA9B5055484649D63C303FE404E5F4D ] Parport C:\Windows\system32\drivers\parport.sys
11:59:11.0523 11816 Parport - ok
11:59:11.0594 11816 [ B9C2B89F08670E159F7181891E449CD9 ] partmgr C:\Windows\system32\drivers\partmgr.sys
11:59:11.0657 11816 partmgr - ok
11:59:11.0727 11816 [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm C:\Windows\system32\drivers\parvdm.sys
11:59:12.0337 11816 Parvdm - ok
11:59:12.0380 11816 [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc C:\Windows\System32\pcasvc.dll
11:59:12.0767 11816 PcaSvc - ok
11:59:12.0836 11816 [ 941DC1D19E7E8620F40BBC206981EFDB ] pci C:\Windows\system32\drivers\pci.sys
11:59:12.0907 11816 pci - ok
11:59:12.0958 11816 [ 1636D43F10416AEB483BC6001097B26C ] pciide C:\Windows\system32\drivers\pciide.sys
11:59:12.0987 11816 pciide - ok
11:59:13.0076 11816 [ E6F3FB1B86AA519E7698AD05E58B04E5 ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
11:59:13.0114 11816 pcmcia - ok
11:59:13.0171 11816 [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH C:\Windows\system32\drivers\peauth.sys
11:59:13.0431 11816 PEAUTH - ok
11:59:13.0579 11816 [ B1689DF169143F57053F795390C99DB3 ] pla C:\Windows\system32\pla.dll
11:59:13.0757 11816 pla - ok
11:59:13.0819 11816 [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay C:\Windows\system32\umpnpmgr.dll
11:59:13.0900 11816 PlugPlay - ok
11:59:13.0946 11816 [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg C:\Windows\system32\p2psvc.dll
11:59:13.0982 11816 PNRPAutoReg - ok
11:59:14.0048 11816 [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc C:\Windows\system32\p2psvc.dll
11:59:14.0088 11816 PNRPsvc - ok
11:59:14.0173 11816 [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
11:59:14.0215 11816 PolicyAgent - ok
11:59:14.0255 11816 [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
11:59:14.0302 11816 PptpMiniport - ok
11:59:14.0338 11816 [ 0E3CEF5D28B40CF273281D620C50700A ] Processor C:\Windows\system32\drivers\processr.sys
11:59:14.0451 11816 Processor - ok
11:59:14.0548 11816 [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc C:\Windows\system32\profsvc.dll
11:59:14.0609 11816 ProfSvc - ok
11:59:14.0817 11816 [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\Windows\system32\lsass.exe
11:59:14.0848 11816 ProtectedStorage - ok
11:59:15.0193 11816 [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched C:\Windows\system32\DRIVERS\pacer.sys
11:59:15.0218 11816 PSched - ok
11:59:15.0440 11816 [ D86B4A68565E444D76457F14172C875A ] PxHelp20 C:\Windows\system32\Drivers\PxHelp20.sys
11:59:15.0643 11816 PxHelp20 - ok
11:59:15.0808 11816 [ CCDAC889326317792480C0A67156A1EC ] ql2300 C:\Windows\system32\drivers\ql2300.sys
11:59:16.0932 11816 ql2300 - ok
11:59:16.0991 11816 [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
11:59:17.0046 11816 ql40xx - ok
11:59:17.0146 11816 [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE C:\Windows\system32\qwave.dll
11:59:17.0227 11816 QWAVE - ok
11:59:17.0288 11816 [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
11:59:17.0365 11816 QWAVEdrv - ok
11:59:17.0471 11816 [ 70DBDAB246C18B78E2200D6401D038BE ] RapiMgr C:\Windows\WindowsMobile\rapimgr.dll
11:59:17.0597 11816 RapiMgr - ok
11:59:17.0657 11816 [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
11:59:17.0706 11816 RasAcd - ok
11:59:17.0751 11816 [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto C:\Windows\System32\rasauto.dll
11:59:17.0850 11816 RasAuto - ok
11:59:18.0092 11816 [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
11:59:18.0225 11816 Rasl2tp - ok
11:59:18.0337 11816 [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan C:\Windows\System32\rasmans.dll
11:59:18.0447 11816 RasMan - ok
11:59:18.0533 11816 [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
11:59:18.0934 11816 RasPppoe - ok
11:59:18.0978 11816 [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
11:59:19.0449 11816 RasSstp - ok
11:59:19.0502 11816 [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
11:59:19.0795 11816 rdbss - ok
11:59:19.0860 11816 [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
11:59:20.0014 11816 RDPCDD - ok
11:59:20.0166 11816 [ E8BD98D46F2ED77132BA927FCCB47D8B ] rdpdr C:\Windows\system32\drivers\rdpdr.sys
11:59:20.0372 11816 rdpdr - ok
11:59:20.0428 11816 [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
11:59:20.0682 11816 RDPENCDD - ok
11:59:20.0753 11816 [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
11:59:21.0345 11816 RDPWD - ok
11:59:21.0673 11816 [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess C:\Windows\System32\mprdim.dll
11:59:21.0837 11816 RemoteAccess - ok
11:59:21.0889 11816 [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry C:\Windows\system32\regsvc.dll
11:59:21.0968 11816 RemoteRegistry - ok
11:59:22.0040 11816 [ 355AAC141B214BEF1DBC1483AFD9BD50 ] rimmptsk C:\Windows\system32\DRIVERS\rimmptsk.sys
11:59:22.0127 11816 rimmptsk - ok
11:59:22.0151 11816 [ A4216C71DD4F60B26418CCFD99CD0815 ] rimsptsk C:\Windows\system32\DRIVERS\rimsptsk.sys
11:59:22.0269 11816 rimsptsk - ok
11:59:22.0297 11816 [ C663AF77E2F4EABF8EB08B388D2F1F36 ] rismxdp C:\Windows\system32\DRIVERS\rixdptsk.sys
11:59:22.0366 11816 rismxdp - ok
11:59:22.0663 11816 [ E7062DBD907E0C5CEEB5ABDAF07E6B32 ] RosettaStoneDaemon C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe
11:59:23.0808 11816 RosettaStoneDaemon - ok
11:59:23.0959 11816 [ 08FB7D968805001C7ADCBB14B0651FA2 ] RoxMediaDB9 C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
11:59:24.0085 11816 RoxMediaDB9 ( UnsignedFile.Multi.Generic ) - warning
11:59:24.0086 11816 RoxMediaDB9 - detected UnsignedFile.Multi.Generic (1)
11:59:24.0124 11816 [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator C:\Windows\system32\locator.exe
11:59:24.0259 11816 RpcLocator - ok
11:59:24.0376 11816 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs C:\Windows\system32\rpcss.dll
11:59:24.0415 11816 RpcSs - ok
11:59:24.0463 11816 [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
11:59:24.0553 11816 rspndr - ok
11:59:24.0585 11816 [ A3E186B4B935905B829219502557314E ] SamSs C:\Windows\system32\lsass.exe
11:59:24.0602 11816 SamSs - ok
11:59:24.0658 11816 [ 3CE8F073A557E172B330109436984E30 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
11:59:24.0696 11816 sbp2port - ok
11:59:24.0758 11816 [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr C:\Windows\System32\SCardSvr.dll
11:59:24.0827 11816 SCardSvr - ok
11:59:24.0881 11816 [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule C:\Windows\system32\schedsvc.dll
11:59:24.0937 11816 Schedule - ok
11:59:24.0997 11816 [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc C:\Windows\System32\certprop.dll
11:59:25.0046 11816 SCPolicySvc - ok
11:59:25.0132 11816 [ 8F36B54688C31EED4580129040C6A3D3 ] sdbus C:\Windows\system32\DRIVERS\sdbus.sys
11:59:25.0184 11816 sdbus - ok
11:59:25.0244 11816 [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC C:\Windows\System32\SDRSVC.dll
11:59:25.0460 11816 SDRSVC - ok
11:59:25.0530 11816 [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv C:\Windows\system32\drivers\secdrv.sys
11:59:25.0851 11816 secdrv - ok
11:59:25.0927 11816 [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon C:\Windows\system32\seclogon.dll
11:59:26.0014 11816 seclogon - ok
11:59:26.0105 11816 [ A9BBAB5759771E523F55563D6CBE140F ] SENS C:\Windows\System32\sens.dll
11:59:26.0172 11816 SENS - ok
11:59:26.0201 11816 [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum C:\Windows\system32\drivers\serenum.sys
11:59:26.0295 11816 Serenum - ok
11:59:26.0400 11816 [ C70D69A918B178D3C3B06339B40C2E1B ] Serial C:\Windows\system32\drivers\serial.sys
11:59:26.0643 11816 Serial - ok
11:59:26.0742 11816 [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse C:\Windows\system32\drivers\sermouse.sys
11:59:27.0238 11816 sermouse - ok
11:59:27.0439 11816 [ D2193326F729B163125610DBF3E17D57 ] SessionEnv C:\Windows\system32\sessenv.dll
11:59:27.0701 11816 SessionEnv - ok
11:59:27.0880 11816 [ 3EFA810BDCA87F6ECC24F9832243FE86 ] sffdisk C:\Windows\system32\DRIVERS\sffdisk.sys
11:59:28.0168 11816 sffdisk - ok
11:59:28.0222 11816 [ 8FD08A310645FE872EEEC6E08C6BF3EE ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
11:59:28.0354 11816 sffp_mmc - ok
11:59:28.0394 11816 [ 9F66A46C55D6F1CCABC79BB7AFCCC545 ] sffp_sd C:\Windows\system32\DRIVERS\sffp_sd.sys
11:59:28.0482 11816 sffp_sd - ok
11:59:28.0566 11816 [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
11:59:28.0750 11816 sfloppy - ok
11:59:28.0871 11816 [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess C:\Windows\System32\ipnathlp.dll
11:59:29.0050 11816 SharedAccess - ok
11:59:29.0166 11816 [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
11:59:29.0332 11816 ShellHWDetection - ok
11:59:29.0383 11816 [ D2A595D6EEBEEAF4334F8E50EFBC9931 ] sisagp C:\Windows\system32\drivers\sisagp.sys
11:59:29.0481 11816 sisagp - ok
11:59:29.0547 11816 [ CEDD6F4E7D84E9F98B34B3FE988373AA ] SiSRaid2 C:\Windows\system32\drivers\sisraid2.sys
11:59:29.0678 11816 SiSRaid2 - ok
11:59:29.0722 11816 [ DF843C528C4F69D12CE41CE462E973A7 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
11:59:29.0794 11816 SiSRaid4 - ok
11:59:29.0984 11816 [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe
11:59:30.0385 11816 SkypeUpdate - ok
11:59:31.0409 11816 [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc C:\Windows\system32\SLsvc.exe
11:59:33.0875 11816 slsvc - ok
11:59:34.0091 11816 [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify C:\Windows\system32\SLUINotify.dll
11:59:34.0222 11816 SLUINotify - ok
11:59:34.0503 11816 [ 7B75299A4D201D6A6533603D6914AB04 ] Smb C:\Windows\system32\DRIVERS\smb.sys
11:59:34.0789 11816 Smb - ok
11:59:34.0867 11816 [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
11:59:34.0986 11816 SNMPTRAP - ok
11:59:35.0064 11816 [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr C:\Windows\system32\drivers\spldr.sys
11:59:35.0124 11816 spldr - ok
11:59:35.0184 11816 [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler C:\Windows\System32\spoolsv.exe
11:59:35.0281 11816 Spooler - ok
11:59:35.0377 11816 [ 41987F9FC0E61ADF54F581E15029AD91 ] srv C:\Windows\system32\DRIVERS\srv.sys
11:59:35.0623 11816 srv - ok
11:59:35.0727 11816 [ FF33AFF99564B1AA534F58868CBE41EF ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
11:59:35.0848 11816 srv2 - ok
11:59:35.0916 11816 [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
11:59:36.0059 11816 srvnet - ok
11:59:36.0204 11816 [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
11:59:36.0267 11816 SSDPSRV - ok
11:59:36.0359 11816 [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv C:\Windows\system32\DRIVERS\ssmdrv.sys
11:59:36.0394 11816 ssmdrv - ok
11:59:36.0452 11816 [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc C:\Windows\system32\sstpsvc.dll
11:59:36.0563 11816 SstpSvc - ok
11:59:36.0783 11816 [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc C:\Windows\System32\wiaservc.dll
11:59:36.0979 11816 stisvc - ok
11:59:37.0108 11816 [ A9A23C8AF361F7A93FD632E91A8C346F ] stllssvr C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
11:59:37.0324 11816 stllssvr - ok
11:59:37.0351 11816 [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
11:59:37.0387 11816 swenum - ok
11:59:37.0587 11816 [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv C:\Windows\System32\swprv.dll
11:59:37.0741 11816 swprv - ok
11:59:37.0808 11816 [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx C:\Windows\system32\drivers\symc8xx.sys
11:59:37.0961 11816 Symc8xx - ok
11:59:38.0061 11816 [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi C:\Windows\system32\drivers\sym_hi.sys
11:59:38.0152 11816 Sym_hi - ok
11:59:38.0239 11816 [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3 C:\Windows\system32\drivers\sym_u3.sys
11:59:38.0346 11816 Sym_u3 - ok
11:59:38.0552 11816 [ 6DD49E1A5FA0F01824652F1A0A8866FB ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys
11:59:38.0852 11816 SynTP - ok
11:59:39.0087 11816 [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain C:\Windows\system32\sysmain.dll
11:59:39.0498 11816 SysMain - ok
11:59:39.0589 11816 [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll
11:59:39.0737 11816 TabletInputService - ok
11:59:40.0054 11816 [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv C:\Windows\System32\tapisrv.dll
11:59:40.0131 11816 TapiSrv - ok
11:59:40.0293 11816 [ CB05822CD9CC6C688168E113C603DBE7 ] TBS C:\Windows\System32\tbssvc.dll
11:59:40.0475 11816 TBS - ok
11:59:40.0965 11816 [ 74E2D020C47BB2B2FCCBA29A518A7EB4 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
11:59:41.0609 11816 Tcpip - ok
11:59:41.0841 11816 [ 74E2D020C47BB2B2FCCBA29A518A7EB4 ] Tcpip6 C:\Windows\system32\DRIVERS\tcpip.sys
11:59:41.0963 11816 Tcpip6 - ok
11:59:42.0032 11816 [ 608C345A255D82A6289C2D468EB41FD7 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
11:59:42.0598 11816 tcpipreg - ok
11:59:42.0725 11816 [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
11:59:42.0836 11816 TDPIPE - ok
11:59:42.0914 11816 [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
11:59:43.0085 11816 TDTCP - ok
11:59:43.0187 11816 [ 76B06EB8A01FC8624D699E7045303E54 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
11:59:43.0286 11816 tdx - ok
11:59:43.0376 11816 [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
11:59:43.0443 11816 TermDD - ok
11:59:43.0568 11816 [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService C:\Windows\System32\termsrv.dll
11:59:43.0774 11816 TermService - ok
11:59:43.0857 11816 [ C7230FBEE14437716701C15BE02C27B8 ] Themes C:\Windows\system32\shsvcs.dll
11:59:43.0883 11816 Themes - ok
11:59:43.0916 11816 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER C:\Windows\system32\mmcss.dll
11:59:43.0979 11816 THREADORDER - ok
11:59:44.0070 11816 [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks C:\Windows\System32\trkwks.dll
11:59:44.0134 11816 TrkWks - ok
11:59:44.0287 11816 [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
11:59:44.0355 11816 TrustedInstaller - ok
11:59:44.0452 11816 [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
11:59:44.0629 11816 tssecsrv - ok
11:59:44.0743 11816 [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp C:\Windows\system32\DRIVERS\tunmp.sys
11:59:44.0942 11816 tunmp - ok
11:59:45.0066 11816 [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
11:59:45.0251 11816 tunnel - ok
11:59:45.0365 11816 [ C3ADE15414120033A36C0F293D4A4121 ] uagp35 C:\Windows\system32\drivers\uagp35.sys
11:59:45.0467 11816 uagp35 - ok
11:59:45.0590 11816 [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
11:59:45.0752 11816 udfs - ok
11:59:45.0842 11816 [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect C:\Windows\system32\UI0Detect.exe
11:59:45.0925 11816 UI0Detect - ok
11:59:46.0023 11816 [ 75E6890EBFCE0841D3291B02E7A8BDB0 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
11:59:46.0164 11816 uliagpkx - ok
11:59:46.0396 11816 [ 3CD4EA35A6221B85DCC25DAA46313F8D ] uliahci C:\Windows\system32\drivers\uliahci.sys
11:59:46.0525 11816 uliahci - ok
11:59:46.0607 11816 [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata C:\Windows\system32\drivers\ulsata.sys
11:59:46.0714 11816 UlSata - ok
11:59:46.0737 11816 [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2 C:\Windows\system32\drivers\ulsata2.sys
11:59:46.0868 11816 ulsata2 - ok
11:59:46.0941 11816 [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
11:59:47.0046 11816 umbus - ok
11:59:47.0131 11816 [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost C:\Windows\System32\upnphost.dll
11:59:47.0305 11816 upnphost - ok
11:59:47.0415 11816 [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
11:59:47.0530 11816 usbccgp - ok
11:59:47.0595 11816 [ E9476E6C486E76BC4898074768FB7131 ] usbcir C:\Windows\system32\drivers\usbcir.sys
11:59:47.0775 11816 usbcir - ok
11:59:47.0844 11816 [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
11:59:48.0029 11816 usbehci - ok
11:59:48.0169 11816 [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
11:59:48.0383 11816 usbhub - ok
11:59:48.0514 11816 [ CE697FEE0D479290D89BEC80DFE793B7 ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys
11:59:48.0670 11816 usbohci - ok
11:59:48.0722 11816 [ E75C4B5269091D15A2E7DC0B6D35F2F5 ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
11:59:48.0807 11816 usbprint - ok
11:59:48.0894 11816 [ A508C9BD8724980512136B039BBA65E9 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
11:59:49.0057 11816 usbscan - ok
11:59:49.0139 11816 [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
11:59:49.0242 11816 USBSTOR - ok
11:59:49.0298 11816 [ 325DBBACB8A36AF9988CCF40EAC228CC ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
11:59:49.0409 11816 usbuhci - ok
11:59:49.0530 11816 [ E67998E8F14CB0627A769F6530BCB352 ] usbvideo C:\Windows\system32\Drivers\usbvideo.sys
11:59:49.0755 11816 usbvideo - ok
11:59:49.0819 11816 [ 228F444F9AF0D3B9ECA9FC3F4FEB12F2 ] usb_rndisx C:\Windows\system32\DRIVERS\usb8023x.sys
11:59:49.0929 11816 usb_rndisx - ok
11:59:49.0985 11816 [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms C:\Windows\System32\uxsms.dll
11:59:50.0048 11816 UxSms - ok
11:59:50.0222 11816 [ CD88D1B7776DC17A119049742EC07EB4 ] vds C:\Windows\System32\vds.exe
11:59:50.0494 11816 vds - ok
11:59:50.0552 11816 [ 7D92BE0028ECDEDEC74617009084B5EF ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
11:59:50.0712 11816 vga - ok
11:59:50.0782 11816 [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave C:\Windows\System32\drivers\vga.sys
11:59:50.0924 11816 VgaSave - ok
11:59:50.0967 11816 [ 045D9961E591CF0674A920B6BA3BA5CB ] viaagp C:\Windows\system32\drivers\viaagp.sys
11:59:51.0036 11816 viaagp - ok
11:59:51.0071 11816 [ 56A4DE5F02F2E88182B0981119B4DD98 ] ViaC7 C:\Windows\system32\drivers\viac7.sys
11:59:51.0212 11816 ViaC7 - ok
11:59:51.0256 11816 [ FD2E3175FCADA350C7AB4521DCA187EC ] viaide C:\Windows\system32\drivers\viaide.sys
11:59:51.0312 11816 viaide - ok
11:59:51.0427 11816 [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr C:\Windows\system32\drivers\volmgr.sys
11:59:51.0835 11816 volmgr - ok
11:59:52.0080 11816 [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
11:59:52.0344 11816 volmgrx - ok
11:59:52.0487 11816 [ 786DB5771F05EF300390399F626BF30A ] volsnap C:\Windows\system32\drivers\volsnap.sys
11:59:52.0676 11816 volsnap - ok
11:59:52.0737 11816 [ D984439746D42B30FC65A4C3546C6829 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
11:59:52.0832 11816 vsmraid - ok
11:59:53.0132 11816 [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS C:\Windows\system32\vssvc.exe
11:59:53.0257 11816 VSS - ok
11:59:53.0328 11816 [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time C:\Windows\system32\w32time.dll
11:59:53.0438 11816 W32Time - ok
11:59:53.0502 11816 [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen C:\Windows\system32\drivers\wacompen.sys
11:59:53.0702 11816 WacomPen - ok
11:59:53.0761 11816 [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp C:\Windows\system32\DRIVERS\wanarp.sys
11:59:53.0823 11816 Wanarp - ok
11:59:53.0833 11816 [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
11:59:53.0855 11816 Wanarpv6 - ok
11:59:53.0938 11816 [ 779F9C90D3FE9C70B6FFD8EF035F3E83 ] WcesComm C:\Windows\WindowsMobile\wcescomm.dll
11:59:54.0028 11816 WcesComm - ok
11:59:54.0098 11816 [ A3CD60FD826381B49F03832590E069AF ] wcncsvc C:\Windows\System32\wcncsvc.dll
11:59:54.0256 11816 wcncsvc - ok
11:59:54.0320 11816 [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
11:59:54.0399 11816 WcsPlugInService - ok
11:59:54.0446 11816 [ 78FE9542363F297B18C027B2D7E7C07F ] Wd C:\Windows\system32\drivers\wd.sys
11:59:54.0498 11816 Wd - ok
11:59:54.0552 11816 [ A840213F1ACDCC175B4D1D5AAEAC0D7A ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
11:59:54.0818 11816 Wdf01000 - ok
11:59:54.0867 11816 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost C:\Windows\system32\wdi.dll
11:59:54.0901 11816 WdiServiceHost - ok
11:59:54.0909 11816 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost C:\Windows\system32\wdi.dll
11:59:54.0954 11816 WdiSystemHost - ok
11:59:55.0005 11816 [ 04C37D8107320312FBAE09926103D5E2 ] WebClient C:\Windows\System32\webclnt.dll
11:59:55.0030 11816 WebClient - ok
11:59:55.0088 11816 [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc C:\Windows\system32\wecsvc.dll
11:59:55.0328 11816 Wecsvc - ok
11:59:55.0369 11816 [ 670FF720071ED741206D69BD995EA453 ] wercplsupport C:\Windows\System32\wercplsupport.dll
11:59:55.0499 11816 wercplsupport - ok
11:59:55.0538 11816 [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc C:\Windows\System32\WerSvc.dll
11:59:55.0573 11816 WerSvc - ok
11:59:55.0739 11816 [ E096FFB754F1E45AE1BDDAC1275AE2C5 ] winachsf C:\Windows\system32\DRIVERS\HSX_CNXT.sys
11:59:55.0910 11816 winachsf - ok
11:59:56.0006 11816 [ 4575AA12561C5648483403541D0D7F2B ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll
11:59:56.0034 11816 WinDefend - ok
11:59:56.0060 11816 WinHttpAutoProxySvc - ok
11:59:56.0181 11816 [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
11:59:56.0317 11816 Winmgmt - ok
11:59:56.0530 11816 [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM C:\Windows\system32\WsmSvc.dll
11:59:56.0725 11816 WinRM - ok
11:59:56.0868 11816 [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc C:\Windows\System32\wlansvc.dll
11:59:56.0978 11816 Wlansvc - ok
11:59:57.0052 11816 [ 2E7255D172DF0B8283CDFB7B433B864E ] WmiAcpi C:\Windows\system32\DRIVERS\wmiacpi.sys
11:59:57.0105 11816 WmiAcpi - ok
11:59:57.0172 11816 [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
11:59:57.0201 11816 wmiApSrv - ok
11:59:57.0284 11816 [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
11:59:57.0504 11816 WMPNetworkSvc - ok
11:59:57.0568 11816 [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc C:\Windows\System32\wpcsvc.dll
11:59:57.0756 11816 WPCSvc - ok
11:59:57.0817 11816 [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
11:59:57.0965 11816 WPDBusEnum - ok
11:59:58.0034 11816 [ DE9D36F91A4DF3D911626643DEBF11EA ] WpdUsb C:\Windows\system32\DRIVERS\wpdusb.sys
11:59:58.0138 11816 WpdUsb - ok
11:59:58.0403 11816 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
11:59:58.0536 11816 WPFFontCache_v0400 - ok
11:59:58.0565 11816 [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
11:59:58.0642 11816 ws2ifsl - ok
11:59:58.0688 11816 [ 1CA6C40261DDC0425987980D0CD2AAAB ] wscsvc C:\Windows\System32\wscsvc.dll
11:59:58.0735 11816 wscsvc - ok
11:59:58.0742 11816 WSearch - ok
11:59:59.0057 11816 [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv C:\Windows\system32\wuaueng.dll
11:59:59.0684 11816 wuauserv - ok
11:59:59.0775 11816 [ 06E6F32C8D0A3F66D956F57B43A2E070 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
11:59:59.0873 11816 WudfPf - ok
11:59:59.0906 11816 [ 867C301E8B790040AE9CF6486E8041DF ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
11:59:59.0976 11816 WUDFRd - ok
12:00:00.0033 11816 [ FE47B7BC8EA320C2D9B5E5BF6E303765 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
12:00:00.0069 11816 wudfsvc - ok
12:00:00.0104 11816 [ 19E7C173B6242AD7521E537AE54768BF ] XAudio C:\Windows\system32\DRIVERS\xaudio.sys
12:00:00.0160 11816 XAudio - ok
12:00:00.0245 11816 [ CDA0BC78672B50C43649FF34E1FD0FF8 ] XAudioService C:\Windows\system32\DRIVERS\xaudio.exe
12:00:00.0378 11816 XAudioService - ok
12:00:00.0438 11816 ================ Scan global ===============================
12:00:00.0556 11816 [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll
12:00:00.0698 11816 [ A508314231C49AEE86987CEA3EAECAD1 ] C:\Windows\system32\winsrv.dll
12:00:00.0805 11816 [ A508314231C49AEE86987CEA3EAECAD1 ] C:\Windows\system32\winsrv.dll
12:00:00.0895 11816 [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\system32\services.exe
12:00:00.0925 11816 [Global] - ok
12:00:00.0927 11816 ================ Scan MBR ==================================
12:00:00.0959 11816 [ 1A1A06F62E891045814007163C1C76C3 ] \Device\Harddisk0\DR0
12:00:01.0242 11816 \Device\Harddisk0\DR0 - ok
12:00:01.0248 11816 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk1\DR1
12:00:01.0711 11816 \Device\Harddisk1\DR1 - ok
12:00:01.0715 11816 ================ Scan VBR ==================================
12:00:01.0721 11816 [ 539B4038E8145CFEEC388EE760D56F34 ] \Device\Harddisk0\DR0\Partition1
12:00:01.0723 11816 \Device\Harddisk0\DR0\Partition1 - ok
12:00:01.0727 11816 [ 64A8D5ABF224C8D74BF6FFC0AB46F117 ] \Device\Harddisk0\DR0\Partition2
12:00:01.0729 11816 \Device\Harddisk0\DR0\Partition2 - ok
12:00:01.0739 11816 [ 6DC0F665BBF0E694A7EEA429B134952D ] \Device\Harddisk1\DR1\Partition1
12:00:01.0740 11816 \Device\Harddisk1\DR1\Partition1 - ok
12:00:01.0743 11816 ============================================================
12:00:01.0743 11816 Scan finished
12:00:01.0743 11816 ============================================================
12:00:01.0761 11824 Detected object count: 8
12:00:01.0761 11824 Actual detected object count: 8
12:00:10.0113 11824 bfhubase ( UnsignedFile.Multi.Generic ) - skipped by user
12:00:10.0113 11824 bfhubase ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:00:10.0113 11824 CAPI_CIP ( UnsignedFile.Multi.Generic ) - skipped by user
12:00:10.0114 11824 CAPI_CIP ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:00:10.0114 11824 CLCapSvc ( UnsignedFile.Multi.Generic ) - skipped by user
12:00:10.0114 11824 CLCapSvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:00:10.0114 11824 CLSched ( UnsignedFile.Multi.Generic ) - skipped by user
12:00:10.0114 11824 CLSched ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:00:10.0115 11824 Com4Qlb ( UnsignedFile.Multi.Generic ) - skipped by user
12:00:10.0115 11824 Com4Qlb ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:00:10.0115 11824 hpqwmiex ( UnsignedFile.Multi.Generic ) - skipped by user
12:00:10.0115 11824 hpqwmiex ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:00:10.0118 11824 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
12:00:10.0118 11824 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:00:10.0119 11824 RoxMediaDB9 ( UnsignedFile.Multi.Generic ) - skipped by user
12:00:10.0119 11824 RoxMediaDB9 ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:00:31.0645 6080 Deinitialize success

PS: Ich habe irgendwo gelesen, dass man euer Forum finanzielle unterstützen kann, ich finde es nämlich großartig, dass ihr euch so viel Mühe gebt, Vielen Dank Dank dafür!!

Auf deine Frage:

Ich betreibe Online-Banking nur mit meinem Laptop, selten meinem Handy (seit langem nicht mehr), und mit dem PC in meiner Arbeit, der jedoch unter dem Schutz der EDV steht.

Gruß

markusg · 15.05.2013, 13:42

Hi,
spenden kannst du, aber erst, wenn das Problem gelöst ist.
Ne EDV muss nicht unbedingt fähig sein bzw kann auch schadsoftware übersehen, ich persönlich würde nur Banking von Geräten machen, die ich unter Kontrolle hab
Das soll keine Beleidigung deiner Arbeitsstelle sein :-)
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

u578188 · 15.05.2013, 23:51

.txt-Datei

Combofix Logfile:

Code:

ATTFilter

ComboFix 13-05-15.01 - Ulf Rawas 16.05.2013   0:35.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2046.920 [GMT 2:00]
ausgeführt von:: c:\users\Ulf Rawas\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\users\Ulf Rawas\Favorites\groupon.url
c:\windows\IsUn0407.exe
c:\windows\security\Database\tmp.edb
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\unin0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-04-15 bis 2013-05-15  ))))))))))))))))))))))))))))))
.
.
2013-05-15 22:44 . 2013-05-15 22:44	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-05-15 22:44 . 2013-05-15 22:44	--------	d-----w-	c:\users\Gast\AppData\Local\temp
2013-05-15 10:14 . 2013-05-13 06:19	7016152	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{2E26DEF1-8BDD-45C2-9D24-B72D1B58B659}\mpengine.dll
2013-05-15 10:11 . 2013-05-05 19:12	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2013-05-15 09:59 . 2013-04-15 14:20	638328	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2013-05-15 09:59 . 2013-04-13 10:56	37376	----a-w-	c:\windows\system32\cdd.dll
2013-05-15 09:58 . 2013-04-09 01:36	2049024	----a-w-	c:\windows\system32\win32k.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-02 08:05 . 2012-03-31 03:18	691592	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-05-02 08:05 . 2011-06-05 18:21	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-02 00:06 . 2009-10-03 09:40	238872	------w-	c:\windows\system32\MpSigStub.exe
2013-03-29 23:15 . 2012-11-15 16:02	84744	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2013-03-29 23:15 . 2012-11-15 16:02	37352	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2013-03-29 23:15 . 2012-11-15 16:02	135136	----a-w-	c:\windows\system32\drivers\avipbb.sys
2013-03-11 13:25 . 2013-04-09 21:17	3603816	----a-w-	c:\windows\system32\ntkrnlpa.exe
2013-03-11 13:25 . 2013-04-09 21:17	3551080	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-03-09 03:45 . 2013-04-09 21:17	49152	----a-w-	c:\windows\system32\csrsrv.dll
2013-03-09 01:28 . 2013-04-09 21:17	64000	----a-w-	c:\windows\system32\smss.exe
2013-03-08 03:53 . 2013-04-09 21:17	376320	----a-w-	c:\windows\system32\winsrv.dll
2013-03-08 03:52 . 2013-04-09 21:17	2067968	----a-w-	c:\windows\system32\mstscax.dll
2013-03-03 19:07 . 2013-04-09 21:17	1082232	----a-w-	c:\windows\system32\drivers\ntfs.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2011-10-14 2299176]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-05-09 345312]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=c:\windows\pss\Logitech SetPoint.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-29 19:59	937920	----a-r-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-08-31 01:57	40368	----a-w-	c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
2008-09-26 10:02	2356088	----a-r-	c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-10-23 13:18	202024	----a-w-	c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-02-17 06:11	49152	----a-w-	c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2007-04-19 20:26	484904	----a-w-	c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
2007-09-20 07:51	1836328	----a-w-	c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 10:50	155648	----a-w-	c:\windows\System32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 13:57	153136	----a-w-	c:\program files\Common Files\Nero\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2009-10-03 10:40	13826664	----a-w-	c:\windows\System32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
2007-04-24 01:11	176128	----a-w-	c:\program files\HP\QuickPlay\QPService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-01-23 23:41	413696	----a-w-	c:\program files\QuickTime\qttask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-06-09 12:06	254696	----a-w-	c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2011-10-14 03:36	2299176	----a-w-	c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WAWifiMessage]
2007-01-10 23:12	317128	----a-w-	c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3651596773-1541584794-529895780-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-04-19 20:23	452136	----a-w-	c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-05-15 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 08:05]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=73&bd=Pavilion&pf=laptop
uInternet Settings,ProxyOverride =  localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost
TCP: DhcpNameServer = 192.168.178.1
.
.
------- Dateityp-Verknüpfung -------
.
inifile=%SystemRoot%\System32\NOTEPAD.EXE %1"
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe
MSConfigStartUp-NapsterShell - c:\program files\Napster\napster.exe
AddRemove-Half-Life - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-05-16 00:45
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2013-05-16  00:48:29
ComboFix-quarantined-files.txt  2013-05-15 22:48
.
Vor Suchlauf: 13 Verzeichnis(se), 37.511.462.912 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 37.335.617.536 Bytes frei
.
- - End Of File - - 9DC63765CBEF3A30719D78AC1B1FD2C2

--- --- ---

Eine kurze Zwischenfrage:

ich habe eine 2TB externe FAT und diverse USB-Sticks, die ich in letzter Zeit an meinem Laptop angeschlossen hatte. Soll ich diese bei der Überprüfung oder Durchführung der Programme ebenfalls anschließen? Weil ich denke mir da müssten sich eigentlich auch ein paar "schlechte" Dateien finden.

PS: entweder ist es Einbildung oder mein Sytem läuft auf einmal merklich schneller (?)

Gruß
u578188

markusg · 16.05.2013, 16:56

Hi,
malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

u578188 · 17.05.2013, 15:42

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.05.17.03

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Ulf Rawas :: U-RAWAS [Administrator]

17.05.2013 13:01:36
mbam-log-2013-05-17 (13-01-36).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|I:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 418757
Laufzeit: 2 Stunde(n), 18 Minute(n), 32 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 8
HKCR\CLSID\{25F97EB4-1C02-45BA-BA0C-E67AACE64D4A} (Adware.ToolBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{DFB4667B-5304-4CD5-B494-2742ACD99212} (Adware.ToolBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{25F97EB4-1C02-45BA-BA0C-E67AACE64D4A} (Adware.ToolBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25F97EB4-1C02-45BA-BA0C-E67AACE64D4A} (Adware.ToolBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7914D9F0-DD27-4260-9BC1-AE01834B77CA} (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{7914D9F0-DD27-4260-9BC1-AE01834B77CA} (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{7914D9F0-DD27-4260-9BC1-AE01834B77CA} (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7914D9F0-DD27-4260-9BC1-AE01834B77CA} (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 4
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser|{25F97EB4-1C02-45BA-BA0C-E67AACE64D4A} (Adware.ToolBar) -> Daten: ´~ù%ºEºæz¬æMJ{13977806-98C2-4c11-B07C-8C08743E2210} -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{25F97EB4-1C02-45BA-BA0C-E67AACE64D4A} (Adware.ToolBar) -> Daten: -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{25F97EB4-1C02-45BA-BA0C-E67AACE64D4A} (Adware.ToolBar) -> Daten: -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{25F97EB4-1C02-45BA-BA0C-E67AACE64D4A} (Adware.ToolBar) -> Daten: -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

PS: hatte meine externe festplatte angeschlossen,

markusg · 17.05.2013, 16:03

hi, die Frage ist jetzt,
könnte der arbeits pc sauber sein oder nicht.
es ist möglich, dass sich die Malware tief ins system verankert hatt, und wir sie trotz scans nicht finden, bisher sehe ich nichts weiter. aber es würde natürlich ne unsicherheit bleiben.
wir haben daher mehrere Möglichkeiten:
1. wir untersuchen weiter, mit dem Unsicherheitsfaktor.
2. wir setzen dea gerät neu auf, sichern es ab, und du machst nur noch von dem pc aus onlinebanking, von keinem anderen, somit währe gewerleistet, dass du das immer von nem sauberen PC aus tust, bzw wenn es Probleme gibt, du die Problemquelle kennst

u578188 · 17.05.2013, 16:16

was würde neu aufsetzen bedeuten?

Der Grund meiner Frage ist folgender, seit längerem spiele ich mit dem Gedanken mein komplettes System zu löschen und alles neu aufzufahren, da ich dies seit utopischen 6Jahren nicht mehr gemacht hab und sich sicherlich viel "Müll" in allen Speichern befindet.

Nun besteht diese Frage:
Ich habe ein "E: Recovery" Laufwerk (von HP - Hewlett Packard zusammengestellt) , das ich dann zum Wiederherstellen verwenden würde, da allein schon mein Betriebssystem sich darauf befindet. Auf der externen Festplatte befinden sich alle Eigene Dateien. Nun will ich natürlich sicher sein, dass wenn ich alles lösche und neu aufzieh, die infiltrativen Dateien (Trojaner, Malware etc.) nicht erneut mit aufgezogen werden.

Was wäre denn deine Idee dazu?
Gruß, u578188

markusg · 17.05.2013, 16:18

kann man so machen wie von dir geplant, dann würde ich dir ne anleitung zum pc absichern geben, und bevor die nich durch ist, wird die Datensicherung nicht angeschlossen, wenn sie durch is, können wir die dann ganz normal scannen.

u578188 · 17.05.2013, 16:24

Gerne. Gut, dann machen wir es so!

markusg · 17.05.2013, 16:36

ok, dann sichere deine Daten.
dann recovery starten.
geht meist über:
f4
f9
f10
bzw:
alt+f9 oder alt+f10
dort auf werks bzw Auslieferungszustand wiederherstellen.
Wenn das geklappt hatt, auf der HP-Page neueste Treiber laden, und Gerät absichern:
als antimalware programm würde ich emsisoft empfehlen.
diese haben für mich den besten schutz kostet aber etwas.
Computeractive Software Store - Emsisoft Anti-Malware 7 [1-PC] - 63% off RRP
testversion:
Meine Antivirus-Empfehlung: Emsisoft Anti-Malware
insbesondere wenn du onlinebanking, einkäufe, sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches machst, also sensible daten zu schützen sind, solltest du in sicherheitssoftware investieren.
vor dem aktivieren der lizenz die 30 tage testzeitraum ausnutzen.

kostenlos, aber eben nicht ganz so gut währe avast zu empfehlen.
http://www.trojaner-board.de/110895-...antivirus.html

sag mir welches du nutzt, dann gebe ich konfigurationshinweise.
bitte dein bisheriges av deinstalieren
die folgende anleitung ist umfangreich, dass ist mir klar, sie sollte aber umgesetzt werden, da nur dann dein pc sicher ist. stelle so viele fragen wie nötig, ich arbeite gern alles mit dir durch!

http://www.trojaner-board.de/96344-a...-rechners.html
Starte bitte mit der Passage, Windows Vista und Windows 7
Bitte beginne damit, Windows Updates zu instalieren.
Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst.
Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist:
- Updates automatisch Instalieren,
- Täglich
- Uhrzeit wählen
- Bitte den gesammten rest anhaken, außer:
- detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist.
Klicke jetzt die Schaltfläche "OK"
Klicke jetzt "nach Updates suchen".
Bitte instaliere zunächst wichtige Updates.
Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren.
Mache das selbe bitte mit den optionalen Updates.
Bitte übernimm den rest so, wie es im Abschnitt windows 7 / Vista zu lesen ist.
aus dem Abschnitt xp, bitte den punkt "datenausführungsverhinderung, dep" übernehmen.
als browser rate ich dir zu chrome:
http://support.google.com/chrome/bin...&answer=118663
anleitung lesen bitte
falls du nen andern nutzen willst, sags mir dann muss ich teile der nun folgenden anleitung anpassen.

Sandboxie
Die devinition einer Sandbox ist hier nachzulesen:
Sandbox
Kurz gesagt, man kann Programme fast 100 %ig isuliert vom System ausführen.

Der Vorteil liegt klar auf der Hand, wenn über den Browser Schadcode eingeschläust wird, kann dieser nicht nach außen dringen.
Download Link:
Sandboxie - Download - Filepony

anleitung:
http://www.trojaner-board.de/71542-a...sandboxie.html
ausführliche anleitung als pdf, auch abarbeiten:
Sandbox Einstellungen |

bitte folgende zusatz konfiguration machen:
sandboxie control öffnen, menü sandbox anklicken, defauldbox wählen.
dort klicke auf sandbox einstellungen.
beschrenkungen, bei programm start und internet zugriff schreibe:
chrome.exe
dann gehe auf anwendungen, webbrowser, chrome.
dort aktiviere alles außer gesammten profil ordner freigeben.
Wie du evtl. schon gesehen hast, kannst du einige Funktionen nicht nutzen.
Dies ist nur in der Vollversion nötig, zu deren Kauf ich dir rate.
Du kannst zb unter "Erzwungene Programmstarts" festlegen, dass alle Browser in der Sandbox starten.
Ansonsten musst du immer auf "Sandboxed webbrowser" klicken bzw Rechtsklick, in Sandboxie starten.
Eine lebenslange Lizenz kostet 30 €, und ist auf allen deinen PC's nutzbar.

Weiter mit:
Maßnahmen für ALLE Windows-Versionen
alles komplett durcharbeiten
anmerkung zu file hippo.
in den settings zusätzlich auswählen:
hide beta updates.
Run updateChecker when Windows starts

Backup Programm:
in meiner Anleitung ist bereits ein Backup Programm verlinkt, als Alternative bietet sich auch das Windows eigene Backup Programm an:
http://www.trojaner-board.de/82962-w...en-backup.html
Dies ist aber leider nur für Windows 7 Nutzer vernünftig nutzbar.
Alle Anderen sollten sich aber auf jeden fall auch ein Backup Programm instalieren, denn dies kann unter Umständen sehr wichtig sein, zum Beispiel, wenn die Festplatte einmal kaputt ist.

Zum Schluss, die allgemeinen sicherheitstipps beachten, wenn es dich betrifft, den Tipp zum Onlinebanking beachten und alle Passwörter ändern
bitte auch lesen, wie mache ich programme für alle sichtbar:
Programme für alle Konten nutzbar machen - PCtipp.ch - Praxis & Hilfe
surfe jetzt also nur noch im standard nutzer konto und dort in der sandbox.
wenn du die kostenlose version nutzt, dann mit klick auf sandboxed web browser, wenn du die bezahlversion hast, kannst du erzwungene programm starts festlegen, dann wird Sandboxie immer gestartet wenn du nen browser aufrufst.
wenn du mit der maus über den browser fährst sollte der eingerahmt sein, dann bist du im sandboxed web browser

passwort sicherheit:
jeder dienst benötigt ein eigenes, mindestens 12-stelliges passwort
bei der passwort verwaltung und erstellung hilft roboform
Passwort Manager, Formular Ausfueller, Passwort Management | RoboForm Passwort Manager
anleitung:
RoboForm-Bedienungsanleitung: Passwort-Manager, Verwalten von Passwörtern und persönlichen Daten