Hallo liebe Trojaner,
nachdem ich einen Artikel über die Beseitigung von delta-search durchgearbeitet hatte, wende ich mich nun doch an euch, da ich das Problem leider nicht alleine beseitigen konnte.
Das automatische Laden von Sm.de und delta-Search tritt nur unter Chrome auf.
Ich habe die gewünschten Text-Dateien: OLT.txt, Extra.txt und Gmer.txt beigefügt.

OTL:

OTL logfile created on: 16.06.2013 15:13:00 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Arbeitskonto Bernd\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,86 Gb Available Physical Memory | 42,96% Memory free
4,00 Gb Paging File | 2,35 Gb Available in Paging File | 58,74% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 146,39 Gb Total Space | 97,09 Gb Free Space | 66,32% Space Free | Partition Type: NTFS
Drive F: | 226,12 Gb Total Space | 225,97 Gb Free Space | 99,93% Space Free | Partition Type: NTFS
Drive G: | 465,65 Gb Total Space | 395,94 Gb Free Space | 85,03% Space Free | Partition Type: FAT32
Drive H: | 465,76 Gb Total Space | 254,29 Gb Free Space | 54,60% Space Free | Partition Type: NTFS
 
Computer Name: BERNDS-PC | User Name: Bernd | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.06.16 15:08:43 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Arbeitskonto Bernd\Downloads\OTL.exe
PRC - [2013.06.05 21:31:36 | 012,418,400 | ---- | M] (SugarSync, Inc.) -- C:\Program Files (x86)\SugarSync\SugarSync.exe
PRC - [2013.05.25 02:47:30 | 027,776,968 | ---- | M] (Dropbox, Inc.) -- C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.08.30 22:26:56 | 000,202,328 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\avp.exe
PRC - [2012.08.15 14:50:54 | 006,054,824 | ---- | M] (Kaspersky Lab) -- C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe
PRC - [2012.08.13 11:08:08 | 010,376,704 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2012.08.13 11:08:08 | 010,368,512 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2012.08.03 14:29:10 | 003,400,600 | ---- | M] (ashampoo GmbH & Co. KG) -- C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe
PRC - [2010.10.22 02:00:00 | 002,105,344 | R--- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
PRC - [2010.10.22 02:00:00 | 000,376,832 | R--- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
PRC - [2009.12.21 17:34:38 | 000,743,992 | ---- | M] (Infowatch) -- C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.03.13 22:48:52 | 024,978,944 | ---- | M] () -- C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\libcef.dll
MOD - [2012.11.14 01:32:50 | 003,558,400 | ---- | M] () -- C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll
MOD - [2012.08.30 22:24:20 | 007,422,392 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\QtGui4.dll
MOD - [2012.08.30 22:24:18 | 001,270,200 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\QtScript4.dll
MOD - [2012.08.30 22:24:18 | 000,192,952 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\QtSql4.dll
MOD - [2012.08.30 22:24:16 | 002,453,944 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\QtDeclarative4.dll
MOD - [2012.08.30 22:24:16 | 002,126,264 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\QtCore4.dll
MOD - [2012.08.30 22:24:16 | 000,795,064 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\QtNetwork4.dll
MOD - [2012.08.30 22:23:02 | 000,459,192 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\dblite.dll
MOD - [2012.08.10 16:51:32 | 000,985,088 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2012.08.03 14:29:16 | 000,042,904 | ---- | M] () -- C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\MouseHook.dll
MOD - [2011.09.05 19:36:52 | 000,025,088 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\imageformats\qgif4.dll
MOD - [2011.09.05 19:36:50 | 000,180,224 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\imageformats\qjpeg4.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2011.04.27 17:23:24 | 000,916,992 | ---- | M] () [Disabled | Stopped] -- C:\Windows\SysNative\atwtusb.exe -- (WTService)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2013.06.13 20:42:12 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.05.31 09:58:03 | 000,117,144 | ---- | M] (Mozilla Foundation) [Disabled | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.02.19 22:32:20 | 001,259,296 | ---- | M] (NVIDIA Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2013.02.08 20:30:42 | 000,359,664 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2013.02.07 14:31:22 | 001,223,704 | ---- | M] (Secunia) [Disabled | Stopped] -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent)
SRV - [2013.02.07 14:31:20 | 000,660,504 | ---- | M] (Secunia) [Disabled | Stopped] -- C:\Program Files (x86)\Secunia\PSI\sua.exe -- (Secunia Update Agent)
SRV - [2012.09.26 13:25:07 | 000,068,096 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe -- (Macromedia Licensing Service)
SRV - [2012.08.30 22:26:56 | 000,202,328 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\avp.exe -- (AVP)
SRV - [2010.10.22 02:00:00 | 000,376,832 | R--- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe -- (AVM WLAN Connection Service)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010.01.21 01:53:42 | 000,496,232 | ---- | M] () [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)
SRV - [2010.01.21 01:53:42 | 000,209,000 | ---- | M] () [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp)
SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009.12.21 17:34:38 | 000,743,992 | ---- | M] (Infowatch) [Auto | Running] -- C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe -- (CSObjectsSrv)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007.07.24 12:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Disabled | Stopped] -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013.05.13 12:40:54 | 000,636,760 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\SysNative\drivers\klif.sys -- (KLIF)
DRV:64bit: - [2013.02.07 14:15:22 | 000,018,456 | ---- | M] (Secunia) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\psi_mf_amd64.sys -- (PSI)
DRV:64bit: - [2013.01.30 13:11:50 | 000,347,904 | ---- | M] (EldoS Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sscbfs3.sys -- (SSCBFS3)
DRV:64bit: - [2013.01.03 10:17:38 | 000,079,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb)
DRV:64bit: - [2013.01.03 10:17:38 | 000,077,192 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2013.01.03 10:17:38 | 000,061,832 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2013.01.03 10:17:38 | 000,015,752 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd)
DRV:64bit: - [2012.08.23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012.08.23 16:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012.08.23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.02 12:31:04 | 000,177,152 | ---- | M] ( ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cxbu1x64.sys -- (cxbu1x64)
DRV:64bit: - [2011.11.03 04:01:00 | 000,056,208 | ---- | M] (Rovi Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2011.10.20 11:48:00 | 000,458,032 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\kl1.sys -- (KL1)
DRV:64bit: - [2011.10.20 11:48:00 | 000,013,616 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\kl2.sys -- (kl2)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.03.10 18:36:24 | 000,029,488 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\klim6.sys -- (KLIM6)
DRV:64bit: - [2010.11.21 05:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.10.22 02:00:00 | 000,714,368 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\fwlanusbn.sys -- (fwlanusbn)
DRV:64bit: - [2010.10.22 02:00:00 | 000,014,120 | R--- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avmeject.sys -- (avmeject)
DRV:64bit: - [2010.09.30 21:00:06 | 000,180,736 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010.09.30 21:00:06 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010.03.04 18:26:58 | 000,349,416 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET)
DRV:64bit: - [2009.12.14 12:44:24 | 000,085,048 | ---- | M] (Infowatch) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\CSCrySec.sys -- (CSCrySec)
DRV:64bit: - [2009.12.14 12:44:24 | 000,066,104 | ---- | M] (Infowatch) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\CSVirtualDiskDrv.sys -- (CSVirtualDiskDrv)
DRV:64bit: - [2009.11.24 18:33:50 | 000,028,264 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvamacpi.sys -- (nvamacpi)
DRV:64bit: - [2009.11.02 20:27:10 | 000,022,544 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\klmouflt.sys -- (klmouflt)
DRV:64bit: - [2009.08.26 15:15:10 | 000,007,552 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\walvhid.sys -- (vhidmini)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.03.08 21:16:14 | 000,007,680 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\moufiltr.sys -- (moufiltr)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{54C92EDA-8FEF-42B8-9369-606684135B64}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=23A8E1C8-D151-4C13-918F-1FDFD816A9D8&apn_sauid=B0C19447-0D10-4A4A-B143-39F55CD828F2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledAddons: %7BF003DA68-8256-4b37-A6C4-350FA04494DF%7D:6.5
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeExManDetect: C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll (Adobe Systems)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeExManDetect: C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F003DA68-8256-4b37-A6C4-350FA04494DF}: C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2013.05.09 10:51:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\FFExt\linkfilter@kaspersky.ru [2013.05.13 12:42:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\FFExt\virtualKeyboard@kaspersky.ru [2013.05.13 12:42:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\FFExt\KavAntiBanner@Kaspersky.ru [2013.05.13 12:41:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.05.16 10:14:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.5\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013.04.05 19:15:23 | 000,000,000 | ---D | M]
 
[2012.09.26 13:25:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bernd\AppData\Roaming\mozilla\Extensions
[2013.05.20 12:53:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bernd\AppData\Roaming\mozilla\Firefox\Profiles\wuk9gph8.default\extensions
[2013.05.20 12:53:55 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\Bernd\AppData\Roaming\mozilla\firefox\profiles\wuk9gph8.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.05.31 09:58:04 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2013.05.31 09:58:04 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013.05.09 10:51:13 | 000,000,000 | ---D | M] (Logitech SetPoint) -- C:\PROGRAM FILES\LOGITECH\SETPOINTP\LOGISMOOTHFIREFOXEXT
[2013.02.25 05:55:08 | 000,171,584 | ---- | M] (Tracker Software Products (Canada) Ltd.) -- C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll
[2012.06.28 17:42:00 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: PDF-XChange Viewer (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npPDFXCviewNPPlugin.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\Microsoft Office\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\Microsoft Office\Office14\NPSPWRAP.DLL
CHR - plugin: AdobeExManDetect (Enabled) = C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll
CHR - plugin: AdobeAAMDetect (Enabled) = C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U17 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: CANON iMAGE GATEWAY Album Plugin Utility (Enabled) = C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll
CHR - plugin: Java Deployment Toolkit 7.0.170.2 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: 
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\pdf.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\Arbeitskonto Bernd\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.1.288_0\plugin/npABPlugin.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\Arbeitskonto Bernd\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.1.288_0\plugin/npVKPlugin.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\Arbeitskonto Bernd\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.1.288_0\plugin/npUrlAdvisor.dll
CHR - plugin: PDF-XChange Viewer (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npPDFXCviewNPPlugin.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: AdobeExManDetect (Enabled) = C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U11 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: CANON iMAGE GATEWAY Album Plugin Utility (Enabled) = C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll
CHR - Extension: Google Docs = C:\Users\Bernd\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\Bernd\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\Bernd\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google-Suche = C:\Users\Bernd\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Modul zur Link-Untersuchung = C:\Users\Bernd\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.2.733_0\
CHR - Extension: Logitech SetPoint = C:\Users\Bernd\AppData\Local\Google\Chrome\User Data\Default\Extensions\edaibbiobngpbmeonadpbfafbkimjbdd\6.52.74_0\
CHR - Extension: Virtuelle Tastatur = C:\Users\Bernd\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.2.733_0\
CHR - Extension: Google Mail = C:\Users\Bernd\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Anti-Banner = C:\Users\Bernd\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.2.733_0\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\x64\ievkbd.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Logitech SetPoint) - {AF949550-9094-4807-95EC-D1C317803333} - C:\Programme\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Logitech SetPoint) - {AF949550-9094-4807-95EC-D1C317803333} - C:\Programme\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\klwtbbho.dll (Kaspersky Lab ZAO)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [NVRaidService] C:\Programme\NVIDIA Corporation\Raid\nvraidservice.exe (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin)
O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\RunOnce: [*ForceDelete] C:\Users\Arbeitskonto Bernd\Downloads\adwcleaner.exe ()
O4 - HKLM..\RunOnce: [GrpConv] C:\Windows\SysWow64\grpconv.exe (Microsoft Corporation)
O4 - HKCU..\RunOnce: [Report] \AdwCleaner[S1].txt ()
O4 - HKCU..\RunOnce: [SyncAppRunOnce] C:\Program Files\Adobe\Adobe Creative Cloud Connection (64 Bit)\Creative Cloud Connection.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 60
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\Microsoft Office\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\Microsoft Office\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\Microsoft Office\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\Microsoft Office\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\x64\ievkbd.dll (Kaspersky Lab ZAO)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\ievkbd.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\klwtbbho.dll (Kaspersky Lab ZAO)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000017 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000018 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp64.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0F941680-2485-4E9B-8964-6CE87202091A}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4ED5F535-8115-466B-8126-D6B81EB2C246}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\klogon: DllName - (%SystemRoot%\System32\klogon.dll) - C:\Windows\SysNative\klogon.dll (Kaspersky Lab ZAO)
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O20:64bit: - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) -  File not found
O21:64bit: - SSODL: EldosMountNotificator - {C28617FD-4FE7-4043-AD51-C8132CE90106} - C:\Windows\SysNative\SSCbFsMntNtf3.dll (EldoS Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: EldosMountNotificator - {C28617FD-4FE7-4043-AD51-C8132CE90106} - C:\Windows\SysWOW64\SSCbFsMntNtf3.dll (EldoS Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O22:64bit: - SharedTaskScheduler: {C28617FD-4FE7-4043-AD51-C8132CE90106} - Virtual Storage Mount Notification - C:\Windows\SysNative\SSCbFsMntNtf3.dll (EldoS Corporation)
O22 - SharedTaskScheduler: {C28617FD-4FE7-4043-AD51-C8132CE90106} - Virtual Storage Mount Notification - C:\Windows\SysWOW64\SSCbFsMntNtf3.dll (EldoS Corporation)
O32 - HKLM CDRom: AutoRun - 0
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.06.06 15:59:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Safari
[2013.06.06 15:58:23 | 000,000,000 | ---D | C] -- C:\Users\Bernd\AppData\Local\Apple
[2013.06.06 15:58:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2013.06.06 15:58:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
 
========== Files - Modified Within 30 Days ==========
 
[2013.06.16 15:12:06 | 000,000,000 | ---- | M] () -- C:\Users\Bernd\defogger_reenable
[2013.06.16 15:03:05 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.06.16 15:03:04 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.06.16 15:03:04 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.06.16 14:57:01 | 000,000,960 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3566009820-3197285289-3489268995-1003UA.job
[2013.06.16 14:51:15 | 000,025,680 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.16 14:51:15 | 000,025,680 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.16 14:38:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.14 14:03:20 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3566009820-3197285289-3489268995-1003Core.job
[2013.06.08 09:29:23 | 001,613,340 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.06.08 09:29:23 | 000,696,832 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.06.08 09:29:23 | 000,652,150 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.06.08 09:29:23 | 000,148,128 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.06.08 09:29:23 | 000,121,082 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.06.07 09:11:12 | 000,002,185 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013.06.06 19:02:30 | 000,002,521 | ---- | M] () -- C:\Users\Public\Desktop\Safari.lnk
[2013.05.29 13:44:16 | 000,000,560 | ---- | M] () -- C:\Windows\ulead32.ini
[2013.05.18 12:50:41 | 001,589,618 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
 
========== Files Created - No Company Name ==========
 
[2013.06.16 15:12:06 | 000,000,000 | ---- | C] () -- C:\Users\Bernd\defogger_reenable
[2013.06.06 15:59:58 | 000,002,533 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Safari.lnk
[2013.06.06 15:59:58 | 000,002,521 | ---- | C] () -- C:\Users\Public\Desktop\Safari.lnk
[2013.06.06 15:58:19 | 000,002,563 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2013.05.17 19:17:02 | 001,589,618 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.04.17 22:17:39 | 000,000,188 | ---- | C] () -- C:\ProgramData\.vslscantool_path
[2013.03.04 19:07:52 | 000,001,056 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2013.03.04 18:43:26 | 000,000,105 | R--- | C] () -- C:\ProgramData\Ppster.ini
[2013.03.04 18:35:53 | 000,844,288 | ---- | C] () -- C:\Windows\RmTablet.exe
[2013.02.11 11:28:24 | 000,000,033 | ---- | C] () -- C:\Users\Bernd\.STICK_TYP_VOREINSTELLUNG
[2013.01.27 15:29:23 | 000,003,584 | ---- | C] () -- C:\Users\Bernd\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.01.24 18:54:09 | 000,000,755 | ---- | C] () -- C:\Users\Bernd\AppData\Local\recently-used.xbel
[2012.09.27 13:26:00 | 000,000,034 | ---- | C] () -- C:\Windows\cdplayer.ini
[2012.09.26 10:05:25 | 000,000,560 | ---- | C] () -- C:\Windows\ulead32.ini
[2012.09.25 16:56:04 | 000,017,408 | ---- | C] () -- C:\Users\Bernd\AppData\Local\WebpageIcons.db
[2010.05.05 12:25:54 | 000,089,816 | ---- | C] () -- C:\Users\Bernd\AppData\Roaming\Elster-Bar.bmp
[2009.06.15 15:39:34 | 000,324,137 | ---- | C] () -- C:\Users\Bernd\AppData\Roaming\elster_1001.jpg
[2009.06.15 15:39:34 | 000,275,898 | ---- | C] () -- C:\Users\Bernd\AppData\Roaming\Bitmapwhite.bmp
[2009.06.15 15:39:34 | 000,174,680 | ---- | C] () -- C:\Users\Bernd\AppData\Roaming\ELSTER.bmp
[2009.06.15 15:39:34 | 000,174,678 | ---- | C] () -- C:\Users\Bernd\AppData\Roaming\ELSTER.orig.bmp
[2009.06.15 15:39:34 | 000,127,002 | ---- | C] () -- C:\Users\Bernd\AppData\Roaming\offen0.jpg
[2009.06.15 15:39:34 | 000,109,477 | ---- | C] () -- C:\Users\Bernd\AppData\Roaming\Nutzungsbedingungen GuDMW SW deutsch.rtf
[2009.06.15 15:39:34 | 000,009,352 | ---- | C] () -- C:\Users\Bernd\AppData\Roaming\ST-GuDStarSignUSBTokenfuerELSTER.jpg
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2013.06.05 10:33:28 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\capella-software
[2013.04.30 21:35:20 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\CloudSync
[2012.09.27 20:10:30 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\Dropbox
[2013.01.27 15:06:30 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\DVDVideoSoft
[2013.02.12 16:37:00 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\eBookConverter
[2013.01.24 17:50:52 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\inkscape
[2013.05.09 10:52:26 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\Leadertech
[2013.05.15 17:13:07 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\Notepad++
[2013.01.29 16:55:42 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\Nvu
[2012.10.03 09:02:30 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\OpenOffice.org
[2012.11.06 12:16:07 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\Orbit
[2012.09.26 09:34:37 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\Ordner HP Share-to-Web
[2012.12.31 19:04:46 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\SolidDocuments
[2012.09.25 17:13:36 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\Thunderbird
[2013.04.29 13:52:58 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\TuneUp Software
 
========== Purity Check ==========
 
 

< End of report >
         

Extra:

OTL Extras logfile created on: 16.06.2013 15:13:00 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Arbeitskonto Bernd\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,86 Gb Available Physical Memory | 42,96% Memory free
4,00 Gb Paging File | 2,35 Gb Available in Paging File | 58,74% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 146,39 Gb Total Space | 97,09 Gb Free Space | 66,32% Space Free | Partition Type: NTFS
Drive F: | 226,12 Gb Total Space | 225,97 Gb Free Space | 99,93% Space Free | Partition Type: NTFS
Drive G: | 465,65 Gb Total Space | 395,94 Gb Free Space | 85,03% Space Free | Partition Type: FAT32
Drive H: | 465,76 Gb Total Space | 254,29 Gb Free Space | 54,60% Space Free | Partition Type: NTFS
 
Computer Name: BERNDS-PC | User Name: Bernd | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
.js[@ = JSFile] -- C:\Program Files (x86)\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe (Macromedia, Inc.)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.js [@ = JSFile] -- C:\Program Files (x86)\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe (Macromedia, Inc.)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsfile [open] -- "C:\Program Files (x86)\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe" "%1" (Macromedia, Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [CEWE FOTOSCHAU] -- "C:\Program Files (x86)\CEWE COLOR\Mein CEWE FOTOBUCH\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Mein CEWE FOTOBUCH] -- "C:\Program Files (x86)\CEWE COLOR\Mein CEWE FOTOBUCH\Mein CEWE FOTOBUCH.exe" "%1" ()
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
jsfile [open] -- "C:\Program Files (x86)\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe" "%1" (Macromedia, Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [CEWE FOTOSCHAU] -- "C:\Program Files (x86)\CEWE COLOR\Mein CEWE FOTOBUCH\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Mein CEWE FOTOBUCH] -- "C:\Program Files (x86)\CEWE COLOR\Mein CEWE FOTOBUCH\Mein CEWE FOTOBUCH.exe" "%1" ()
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03B00AA4-634B-486D-99F7-FAC09FD0F5FC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{0D193E47-6CF5-4484-824D-42948EFE9966}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{0D59DA52-D888-4525-8778-C1D481E8C322}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{16DEA1AF-078B-46B7-8C0A-A133D9D72551}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{191C8993-3FA3-4A17-B282-897B631556E9}" = rport=139 | protocol=6 | dir=out | app=system | 
"{24A7148A-C8CF-4121-8298-5AABEFCC2F00}" = rport=445 | protocol=6 | dir=out | app=system | 
"{293491EA-A7F3-48F9-9F55-C901F47C4AB1}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{31C79781-871D-4ACD-A4F2-95A73D532280}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{33567C6E-4768-4A91-B66E-0AD26BC812CE}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{50FA527D-4C17-451C-866B-0B556C62F71B}" = lport=7682 | protocol=6 | dir=in | app=c:\program files (x86)\adobe\adobe edge inspect\edgeinspect.exe | 
"{555A155A-7720-470E-911F-E9C6B977BE45}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{7C9F5DEA-069D-47EF-8DC6-7145C90A3B00}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{8EA618ED-8FFE-4CAC-B035-2E55C9A653D7}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{9A75E881-437E-472E-B739-E8BE161ED086}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{B306A6F4-283B-49D1-ACFB-1202B34DEDC8}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{B674F553-BDFF-434E-9988-9AEC18BF9C7F}" = rport=138 | protocol=17 | dir=out | app=system | 
"{B9017B44-5B50-4507-B474-163C856F0269}" = lport=139 | protocol=6 | dir=in | app=system | 
"{BB5FE97D-3770-44A2-8992-B5232E9D0533}" = rport=137 | protocol=17 | dir=out | app=system | 
"{CACD059D-E3A5-4074-B93D-50CB083E74AE}" = lport=138 | protocol=17 | dir=in | app=system | 
"{DBBC0677-F44D-48B8-965C-ED6817A7157F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{E578A58B-9A66-4343-BEE3-21EF160029F7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{E694BD13-E8D3-442A-879A-5E7CCF7714BF}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{EF9AE0A9-749B-4FE5-8DF8-ED4C2FF2A4FC}" = lport=445 | protocol=6 | dir=in | app=system | 
"{F91D5449-3877-4DDA-87B9-CCDA0C871727}" = lport=137 | protocol=17 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01102596-C954-4E86-8FED-AEA4071C4EB3}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{056ECCB7-F4EA-4307-BCFC-A79E09F7933C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{0BD88ABE-228D-4D20-81E5-1429904D0F17}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{3A5E8DA2-41BB-4320-9E99-EEFDF275C78F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{41457AA9-B8CF-4562-8289-CA1718A35DD0}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{4A546A85-8A74-406F-8A4C-8061B7CD5B4C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{5E97E75C-927F-4509-8CA5-DB307DF074DD}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{60AD63EF-70A0-42D8-A9D4-0F1E40BDCB2D}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 
"{673DC34C-5A1A-43B9-8AAA-6E9636DC5169}" = protocol=17 | dir=in | app=c:\users\arbeitskonto bernd\appdata\roaming\dropbox\bin\dropbox.exe | 
"{7AB12026-FA91-4330-8011-251C7BE30407}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{7D441278-661D-4DCE-876D-1E7CC43FDAC5}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{9321E47E-BDEF-49E5-8933-6CD15CC85DD0}" = protocol=6 | dir=out | app=system | 
"{96FA182E-D3B9-4F63-8C43-912D324A36F9}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{9E1B576E-D1EC-4214-A04E-57913926F3FB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{A070D9E2-7A77-45E9-A227-020FAF053EFB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{A1B8E376-23F2-4C2E-A0E1-E6C6B6531E7E}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{A34C7782-EA47-4263-851D-798ABE5A0223}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{A50269D7-C0A8-418C-93FA-8D25C59EDFF3}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{B52F46BE-8F3E-412A-82A5-6CF2041FE3E1}" = protocol=6 | dir=in | app=c:\users\arbeitskonto bernd\appdata\roaming\dropbox\bin\dropbox.exe | 
"{C1A6C400-3AA3-448E-A376-23479B61D6F1}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{C6DE05A2-329A-4AA9-912C-5177018D2B48}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{F02685BB-0AED-486F-9989-F38D0BF706B5}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 
"{F5405B02-6EE6-4C93-996D-3574B24ADEA7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4800_series" = Canon iP4800 series Printer Driver
"{19DCDC0D-9D87-46DB-A4B0-08B35AA333A3}" = Corel Shell Extension - 64Bit
"{1C6C05E6-FF52-4A03-BCA5-1497579B0B89}" = calibre 64bit
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86417021FF}" = Java 7 Update 21 (64-bit)
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{636BAD38-26BC-4BD8-802B-F18ED2D48D65}" = G&D StarSign USB Token für ELSTER
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{939913F9-F134-4E9E-B879-BE6755B69952}" = USB CCID Smartcard Reader - Version 1.2.1.2
"{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1" = PDF-Viewer
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 307.83
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 307.83
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CutePDF Writer Installation" = CutePDF Writer 2.9
"GPL Ghostscript 9.06" = GPL Ghostscript
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"RmTablet" = Tablet Driver With Macrokey Manager
"sp6" = Logitech SetPoint 6.52
"VLC media player" = VLC media player 2.0.6
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{806422F8-8E0A-494A-A369-0F34F1B89160}" = CorelDRAW Essentials 4 - Extra Content
"_{C0237AA4-1BFB-46EA-860D-7B0EB365CA13}" = CorelDRAW Essentials 4
"_{CF0ADC18-6D8F-4353-8EAA-DF45456B7853}" = CorelDRAW Essentials 4 - Windows Shell Extension
"{05BB2EC5-6BEF-4DDC-9E75-BEE7B161157A}" = Macromedia Dreamweaver MX 2004
"{07B62101-7EBD-434A-94B1-B38063BE5516}" = CorelDRAW Essentials 4 - PHOTO-PAINT
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0ED4216F-3540-4D6B-8199-1C8DDEA3924B}" = CorelDRAW Essentials 4 - Lang DE
"{181241DD-2FC2-4CF9-94CE-97F3E37D6F0B}" = Adobe Edge Animate
"{185F9795-9663-4F13-9EF9-307A282ADB5A}" = ph
"{19AC095C-3520-4999-AA15-93B6D0248A50}" = CorelDRAW Essentials 4 - Content
"{1C3DA126-D523-4089-BCCA-FA46FE34D6F8}" = Google Drive
"{1EC083EE-5B76-4A2A-B95A-CAF460AA29D6}" = Adobe Touch App Plugins
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17
"{2A075BB4-E976-4278-BF3F-E5C6945D84C0}" = bl
"{2D270A67-B7CD-4281-B2FE-60DF18D19B8E}" = Kaspersky PURE 2.0
"{34A9406E-1994-4C20-AC72-04CFA2B24545}" = CorelDRAW Essentials 4 - Lang EN
"{3576C335-958D-4D60-A812-F68F9A2796AF}" = CorelDRAW Essentials 4 - Lang IT
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{41A12FFC-89E9-4743-A51E-00975CA31F40}" = Adobe Exchange Panel
"{4932BCEA-E142-4A41-B3D2-0934EBE24CB4}" = Adobe Edge Reflow Preview
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5500BB35-1C21-4328-9F16-F894B860FADE}" = CorelDRAW Essentials 4 - Lang NL
"{556F2137-B772-43BB-9A45-E0275234DD16}" = Free Notes & Office Ink
"{590D4F8F-98FE-47FA-AC2B-3F22FDCF7C09}" = ShareIns
"{5AF4B3C4-C393-48D7-AC7E-8E7615579548}" = Adobe AIR
"{668B80AF-D98F-42FC-8EE1-36252B03C5C9}_is1" = MIDI4all
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}" = Adobe Photoshop CS6
"{76E852ED-1B06-4BC8-9D6A-625DB95FB7E5}" = CorelDRAW Essentials 4 - IPM - No VBA
"{776B5EBF-72E9-4FBB-9CAB-F029F7500FFF}" = capella-scan 8.0
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"{806422F8-8E0A-494A-A369-0F34F1B89160}" = CorelDRAW Essentials 4 - Extra Content
"{893B3B44-0A1E-404B-8FE8-0A74509102A9}" = Adobe Creative Cloud Connection
"{8A22263A-70C9-48CA-8C78-545ECBA566AE}" = capella-scan 8 Ergänzungswörterbücher
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.SingleImage_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.SingleImage_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.SingleImage_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{9043B9A0-9505-405B-8202-E7167A38A89C}" = CorelDRAW Essentials 4
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A5BA14E0-7384-11D4-BAE7-00409631A2C8}" = Macromedia Extension Manager
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AAF80000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 8.0 Professional Edition
"{ABD8B955-1C69-4AF3-949B-13CD587C175F}" = CorelDRAW Essentials 4 - Lang BR
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.7) - Deutsch
"{AF37176A-78CA-545B-34EF-8B6A21514DD1}" = Adobe Help Manager
"{B9FA9F15-A1F3-4DB1-AD49-0B9351843FAA}" = CorelDRAW Essentials 4 - Draw
"{BA9319FE-BCEF-4C99-8039-F464648D046E}" = CorelDRAW Essentials 4 - Lang FR
"{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}" = PDF Settings CS6
"{C0237AA4-1BFB-46EA-860D-7B0EB365CA13}" = CorelDRAW Essentials 4 - ICA
"{C682F3F0-00A6-4379-B083-4F3273624D7B}" = CorelDRAW Essentials 4 - Lang ES
"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari
"{C8550C86-A712-4219-AD4C-038C9FD1D149}" = Ulead PhotoImpact 11
"{CC452A50-5C87-4A1F-B295-445C3C69BF7D}" = NVIDIA MediaShield
"{CF0ADC18-6D8F-4353-8EAA-DF45456B7853}" = CorelDRAW Essentials 4 - Windows Shell Extension
"{D3873CF8-9608-402B-88AD-D73B5FFAAED8}" = capella 7
"{D4BE5664-4F9A-4655-BCAB-A9E134DB365E}" = capella-scan 7.0
"{D830EE30-BF0C-42B7-A13C-927A379353ED}" = Adobe Edge Inspect
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{EFBE6DD5-B224-96E5-72B9-68D328CB12A6}" = Adobe Widget Browser
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F16841F6-5F0F-4DBE-B318-63CEB916F21D}" = CorelDRAW Essentials 4 - Filters
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Ashampoo Burning Studio 6 FREE_is1" = Ashampoo Burning Studio 6 FREE v.6.81
"Ashampoo Snap 5_is1" = Ashampoo Snap 5 v.5.1.5
"Audacity_is1" = Audacity 2.0.2
"Audiograbber" = Audiograbber 1.83 SE 
"Audiograbber-Lame" = Audiograbber MP3-Plugin (64 bit)
"AVMWLANCLI" = AVM FRITZ!WLAN
"AVS Screen Capture_is1" = AVS Screen Capture version 2.0.1
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS Video Editor_is1" = AVS Video Editor 6
"AVS Video Recorder_is1" = AVS Video Recorder 2.5
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Help Manager
"com.adobe.WidgetBrowser" = Adobe Widget Browser
"Demo-capella-Vienna-orchestra_is1" = Demo-capella-Vienna-orchestra 1.20
"Direct MIDI to MP3 Converter_is1" = Direct MIDI to MP3 Converter Version 7.0.0.0
"Driver Genius_is1" = Driver Genius
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"FileZilla Client" = FileZilla Client 3.7.0.1
"Finale NotePad 2012" = Finale NotePad 2012
"Google Chrome" = Google Chrome
"Hear & Play Song Learner Pro_is1" = Hear & Play Song Learner Pro
"Inkscape" = Inkscape 0.48.4
"InstallShield_{636BAD38-26BC-4BD8-802B-F18ED2D48D65}" = G&D StarSign USB Token für ELSTER
"InstallWIX_{2D270A67-B7CD-4281-B2FE-60DF18D19B8E}" = Kaspersky PURE 2.0
"LAME_is1" = LAME v3.99.3 (for Windows)
"MatheAss_is1" = MatheAss 8.2
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"Mein CEWE FOTOBUCH" = Mein CEWE FOTOBUCH
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"Mozilla Thunderbird 17.0.5 (x86 de)" = Mozilla Thunderbird 17.0.5 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NAVIGON Fresh" = NAVIGON Fresh 3.4.1
"Notepad++" = Notepad++
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"Secunia PSI" = Secunia PSI (3.0.0.6005)
"SugarSync" = SugarSync
"Winamp" = Winamp
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Winamp Detect" = Winamp Erkennungs-Plug-in
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 16.06.2013 06:18:36 | Computer Name = Bernds-PC | Source = MsiInstaller | ID = 11706
Description = 
 
Error - 16.06.2013 06:18:51 | Computer Name = Bernds-PC | Source = MsiInstaller | ID = 11706
Description = 
 
Error - 16.06.2013 06:53:50 | Computer Name = Bernds-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: chrome.exe, Version: 27.0.1453.110,
 Zeitstempel: 0x51a566a7  Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514,
 Zeitstempel: 0x4ce7b96f  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0003bc21  ID des fehlerhaften
 Prozesses: 0x15f8  Startzeit der fehlerhaften Anwendung: 0x01ce6a7720661ef6  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\syswow64\ole32.dll  Berichtskennung: 067f2562-d673-11e2-a6cc-246511c0671c
 
Error - 16.06.2013 07:56:29 | Computer Name = Bernds-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 16.06.2013 08:29:50 | Computer Name = Bernds-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 16.06.2013 08:38:49 | Computer Name = Bernds-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 16.06.2013 08:48:52 | Computer Name = Bernds-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: chrome.exe, Version: 27.0.1453.110,
 Zeitstempel: 0x51a566a7  Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514,
 Zeitstempel: 0x4ce7b96f  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0003bc21  ID des fehlerhaften
 Prozesses: 0x1560  Startzeit der fehlerhaften Anwendung: 0x01ce6a8fa6ce265e  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\syswow64\ole32.dll  Berichtskennung: 18af660c-d683-11e2-8e88-246511c0671c
 
Error - 16.06.2013 09:12:55 | Computer Name = Bernds-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: chrome.exe, Version: 27.0.1453.110,
 Zeitstempel: 0x51a566a7  Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514,
 Zeitstempel: 0x4ce7b96f  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0003bc21  ID des fehlerhaften
 Prozesses: 0x260  Startzeit der fehlerhaften Anwendung: 0x01ce6a90500a61c9  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\syswow64\ole32.dll  Berichtskennung: 7480cb97-d686-11e2-8e88-246511c0671c
 
Error - 16.06.2013 09:15:03 | Computer Name = Bernds-PC | Source = MsiInstaller | ID = 11706
Description = 
 
Error - 16.06.2013 09:15:16 | Computer Name = Bernds-PC | Source = MsiInstaller | ID = 11706
Description = 
 
[ System Events ]
Error - 16.06.2013 08:01:46 | Computer Name = Bernds-PC | Source = WMPNetworkSvc | ID = 866300
Description = 
 
Error - 16.06.2013 08:27:31 | Computer Name = Bernds-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description = Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden 
im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich
 an den Computerhersteller, um aktualisierte Firmware zu erhalten.
 
Error - 16.06.2013 08:27:50 | Computer Name = Bernds-PC | Source = SCardSvr | ID = 602
Description = 
 
Error - 16.06.2013 08:30:36 | Computer Name = Bernds-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst ShellHWDetection erreicht.
 
Error - 16.06.2013 08:31:06 | Computer Name = Bernds-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst ShellHWDetection erreicht.
 
Error - 16.06.2013 08:34:59 | Computer Name = Bernds-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies
 ist bereits 1 Mal passiert.
 
Error - 16.06.2013 08:38:04 | Computer Name = Bernds-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description = Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden 
im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich
 an den Computerhersteller, um aktualisierte Firmware zu erhalten.
 
Error - 16.06.2013 08:38:19 | Computer Name = Bernds-PC | Source = SCardSvr | ID = 602
Description = 
 
Error - 16.06.2013 08:40:52 | Computer Name = Bernds-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst SysMain erreicht.
 
Error - 16.06.2013 08:42:48 | Computer Name = Bernds-PC | Source = DCOM | ID = 10010
Description = 
 
 
< End of report >
         

Gmer:

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-06-16 17:48:59
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000063 SAMSUNG_ rev.CT10 372,61GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Bernd\AppData\Local\Temp\pwdiipog.sys


---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\avp.exe[1624] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                       0000000077a90018 5 bytes JMP 000000016b8c17e3
.text   C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe[2636] C:\Windows\syswow64\PSAPI.dll!GetModuleFileNameExW + 17                                                        0000000076e91401 2 bytes JMP 000000010779a47c
.text   C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe[2636] C:\Windows\syswow64\PSAPI.dll!EnumProcessModules + 17                                                          0000000076e91419 2 bytes JMP 000000010779a494
.text   C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe[2636] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 17                                                        0000000076e91431 2 bytes JMP 000000010779a4ac
.text   C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe[2636] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 42                                                        0000000076e9144a 2 bytes JMP 0000000076f5fcc5
.text   ...                                                                                                                                                                              * 9
.text   C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe[2636] C:\Windows\syswow64\PSAPI.dll!EnumDeviceDrivers + 17                                                           0000000076e914dd 2 bytes JMP 000000010779a558
.text   C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe[2636] C:\Windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameA + 17                                                    0000000076e914f5 2 bytes JMP 000000010779a570
.text   C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe[2636] C:\Windows\syswow64\PSAPI.dll!QueryWorkingSetEx + 17                                                           0000000076e9150d 2 bytes JMP 000000010779a588
.text   C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe[2636] C:\Windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameW + 17                                                    0000000076e91525 2 bytes JMP 000000010779a5a0
.text   C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe[2636] C:\Windows\syswow64\PSAPI.dll!GetModuleBaseNameW + 17                                                          0000000076e9153d 2 bytes JMP 000000010779a5b8
.text   C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe[2636] C:\Windows\syswow64\PSAPI.dll!EnumProcesses + 17                                                               0000000076e91555 2 bytes JMP 000000010779a5d0
.text   C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe[2636] C:\Windows\syswow64\PSAPI.dll!GetProcessMemoryInfo + 17                                                        0000000076e9156d 2 bytes JMP 000000010779a5e8
.text   C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe[2636] C:\Windows\syswow64\PSAPI.dll!GetPerformanceInfo + 17                                                          0000000076e91585 2 bytes JMP 000000010779a600
.text   C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe[2636] C:\Windows\syswow64\PSAPI.dll!QueryWorkingSet + 17                                                             0000000076e9159d 2 bytes JMP 000000010779a618
.text   C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe[2636] C:\Windows\syswow64\PSAPI.dll!GetModuleBaseNameA + 17                                                          0000000076e915b5 2 bytes JMP 000000010779a630
.text   C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe[2636] C:\Windows\syswow64\PSAPI.dll!GetModuleFileNameExA + 17                                                        0000000076e915cd 2 bytes JMP 000000015d37ce48
.text   C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe[2636] C:\Windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 20                                                    0000000076e916b2 2 bytes JMP 000000010779a72d
.text   C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe[2636] C:\Windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 31                                                    0000000076e916bd 2 bytes JMP 000000010779a738
.text   C:\Program Files (x86)\SugarSync\SugarSync.exe[408] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                      0000000076e91401 2 bytes JMP 000000010779a47c
.text   C:\Program Files (x86)\SugarSync\SugarSync.exe[408] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                        0000000076e91419 2 bytes JMP 000000010779a494
.text   C:\Program Files (x86)\SugarSync\SugarSync.exe[408] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                      0000000076e91431 2 bytes JMP 000000010779a4ac
.text   C:\Program Files (x86)\SugarSync\SugarSync.exe[408] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                      0000000076e9144a 2 bytes JMP 0000000076f5fcc5
.text   ...                                                                                                                                                                              * 9
.text   C:\Program Files (x86)\SugarSync\SugarSync.exe[408] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                         0000000076e914dd 2 bytes JMP 000000010779a558
.text   C:\Program Files (x86)\SugarSync\SugarSync.exe[408] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                  0000000076e914f5 2 bytes JMP 000000010779a570
.text   C:\Program Files (x86)\SugarSync\SugarSync.exe[408] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                         0000000076e9150d 2 bytes JMP 000000010779a588
.text   C:\Program Files (x86)\SugarSync\SugarSync.exe[408] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                  0000000076e91525 2 bytes JMP 000000010779a5a0
.text   C:\Program Files (x86)\SugarSync\SugarSync.exe[408] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                        0000000076e9153d 2 bytes JMP 000000010779a5b8
.text   C:\Program Files (x86)\SugarSync\SugarSync.exe[408] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                             0000000076e91555 2 bytes JMP 000000010779a5d0
.text   C:\Program Files (x86)\SugarSync\SugarSync.exe[408] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                      0000000076e9156d 2 bytes JMP 000000010779a5e8
.text   C:\Program Files (x86)\SugarSync\SugarSync.exe[408] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                        0000000076e91585 2 bytes JMP 000000010779a600
.text   C:\Program Files (x86)\SugarSync\SugarSync.exe[408] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                           0000000076e9159d 2 bytes JMP 000000010779a618
.text   C:\Program Files (x86)\SugarSync\SugarSync.exe[408] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                        0000000076e915b5 2 bytes JMP 000000010779a630
.text   C:\Program Files (x86)\SugarSync\SugarSync.exe[408] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                      0000000076e915cd 2 bytes JMP 000000015d37ce48
.text   C:\Program Files (x86)\SugarSync\SugarSync.exe[408] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                  0000000076e916b2 2 bytes JMP 000000010779a72d
.text   C:\Program Files (x86)\SugarSync\SugarSync.exe[408] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                  0000000076e916bd 2 bytes JMP 000000010779a738
.text   C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe[3108] C:\Windows\syswow64\PSAPI.dll!GetModuleFileNameExW + 17                                                0000000076e91401 2 bytes JMP 000000010779a47c
.text   C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe[3108] C:\Windows\syswow64\PSAPI.dll!EnumProcessModules + 17                                                  0000000076e91419 2 bytes JMP 000000010779a494
.text   C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe[3108] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 17                                                0000000076e91431 2 bytes JMP 000000010779a4ac
.text   C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe[3108] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 42                                                0000000076e9144a 2 bytes JMP 0000000076f5fcc5
.text   ...                                                                                                                                                                              * 9
.text   C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe[3108] C:\Windows\syswow64\PSAPI.dll!EnumDeviceDrivers + 17                                                   0000000076e914dd 2 bytes JMP 000000010779a558
.text   C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe[3108] C:\Windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameA + 17                                            0000000076e914f5 2 bytes JMP 000000010779a570
.text   C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe[3108] C:\Windows\syswow64\PSAPI.dll!QueryWorkingSetEx + 17                                                   0000000076e9150d 2 bytes JMP 000000010779a588
.text   C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe[3108] C:\Windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameW + 17                                            0000000076e91525 2 bytes JMP 000000010779a5a0
.text   C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe[3108] C:\Windows\syswow64\PSAPI.dll!GetModuleBaseNameW + 17                                                  0000000076e9153d 2 bytes JMP 000000010779a5b8
.text   C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe[3108] C:\Windows\syswow64\PSAPI.dll!EnumProcesses + 17                                                       0000000076e91555 2 bytes JMP 000000010779a5d0
.text   C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe[3108] C:\Windows\syswow64\PSAPI.dll!GetProcessMemoryInfo + 17                                                0000000076e9156d 2 bytes JMP 000000010779a5e8
.text   C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe[3108] C:\Windows\syswow64\PSAPI.dll!GetPerformanceInfo + 17                                                  0000000076e91585 2 bytes JMP 000000010779a600
.text   C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe[3108] C:\Windows\syswow64\PSAPI.dll!QueryWorkingSet + 17                                                     0000000076e9159d 2 bytes JMP 000000010779a618
.text   C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe[3108] C:\Windows\syswow64\PSAPI.dll!GetModuleBaseNameA + 17                                                  0000000076e915b5 2 bytes JMP 000000010779a630
.text   C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe[3108] C:\Windows\syswow64\PSAPI.dll!GetModuleFileNameExA + 17                                                0000000076e915cd 2 bytes JMP 000000015d37ce48
.text   C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe[3108] C:\Windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 20                                            0000000076e916b2 2 bytes JMP 000000010779a72d
.text   C:\Users\Arbeitskonto Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe[3108] C:\Windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 31                                            0000000076e916bd 2 bytes JMP 000000010779a738
.text   C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3304] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                        0000000076e91401 2 bytes JMP 000000010779a47c
.text   C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3304] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                          0000000076e91419 2 bytes JMP 000000010779a494
.text   C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3304] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                        0000000076e91431 2 bytes JMP 000000010779a4ac
.text   C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3304] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                        0000000076e9144a 2 bytes JMP 0000000076f5fcc5
.text   ...                                                                                                                                                                              * 9
.text   C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3304] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                           0000000076e914dd 2 bytes JMP 000000010779a558
.text   C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3304] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                    0000000076e914f5 2 bytes JMP 000000010779a570
.text   C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3304] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                           0000000076e9150d 2 bytes JMP 000000010779a588
.text   C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3304] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                    0000000076e91525 2 bytes JMP 000000010779a5a0
.text   C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3304] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                          0000000076e9153d 2 bytes JMP 000000010779a5b8
.text   C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3304] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                               0000000076e91555 2 bytes JMP 000000010779a5d0
.text   C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3304] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                        0000000076e9156d 2 bytes JMP 000000010779a5e8
.text   C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3304] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                          0000000076e91585 2 bytes JMP 000000010779a600
.text   C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3304] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                             0000000076e9159d 2 bytes JMP 000000010779a618
.text   C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3304] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                          0000000076e915b5 2 bytes JMP 000000010779a630
.text   C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3304] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                        0000000076e915cd 2 bytes JMP 000000015d37ce48
.text   C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3304] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                    0000000076e916b2 2 bytes JMP 000000010779a72d
.text   C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3304] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                    0000000076e916bd 2 bytes JMP 000000010779a738
.text   C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[3468] C:\Windows\syswow64\PSAPI.dll!GetModuleFileNameExW + 17                                                                    0000000076e91401 2 bytes JMP 000000010779a47c
.text   C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[3468] C:\Windows\syswow64\PSAPI.dll!EnumProcessModules + 17                                                                      0000000076e91419 2 bytes JMP 000000010779a494
.text   C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[3468] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 17                                                                    0000000076e91431 2 bytes JMP 000000010779a4ac
.text   C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[3468] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 42                                                                    0000000076e9144a 2 bytes JMP 0000000076f5fcc5
.text   ...                                                                                                                                                                              * 9
.text   C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[3468] C:\Windows\syswow64\PSAPI.dll!EnumDeviceDrivers + 17                                                                       0000000076e914dd 2 bytes JMP 000000010779a558
.text   C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[3468] C:\Windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameA + 17                                                                0000000076e914f5 2 bytes JMP 000000010779a570
.text   C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[3468] C:\Windows\syswow64\PSAPI.dll!QueryWorkingSetEx + 17                                                                       0000000076e9150d 2 bytes JMP 000000010779a588
.text   C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[3468] C:\Windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameW + 17                                                                0000000076e91525 2 bytes JMP 000000010779a5a0
.text   C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[3468] C:\Windows\syswow64\PSAPI.dll!GetModuleBaseNameW + 17                                                                      0000000076e9153d 2 bytes JMP 000000010779a5b8
.text   C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[3468] C:\Windows\syswow64\PSAPI.dll!EnumProcesses + 17                                                                           0000000076e91555 2 bytes JMP 000000010779a5d0
.text   C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[3468] C:\Windows\syswow64\PSAPI.dll!GetProcessMemoryInfo + 17                                                                    0000000076e9156d 2 bytes JMP 000000010779a5e8
.text   C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[3468] C:\Windows\syswow64\PSAPI.dll!GetPerformanceInfo + 17                                                                      0000000076e91585 2 bytes JMP 000000010779a600
.text   C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[3468] C:\Windows\syswow64\PSAPI.dll!QueryWorkingSet + 17                                                                         0000000076e9159d 2 bytes JMP 000000010779a618
.text   C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[3468] C:\Windows\syswow64\PSAPI.dll!GetModuleBaseNameA + 17                                                                      0000000076e915b5 2 bytes JMP 000000010779a630
.text   C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[3468] C:\Windows\syswow64\PSAPI.dll!GetModuleFileNameExA + 17                                                                    0000000076e915cd 2 bytes JMP 000000015d37ce48
.text   C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[3468] C:\Windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 20                                                                0000000076e916b2 2 bytes JMP 000000010779a72d
.text   C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[3468] C:\Windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 31                                                                0000000076e916bd 2 bytes JMP 000000010779a738
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\kernel32.dll!LoadLibraryExW              0000000075274945 6 bytes JMP 5f070f5a
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\USER32.dll!LoadStringW                   00000000767b8eb9 6 bytes JMP 5f040f5a
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\PSAPI.dll!GetModuleFileNameExW + 17      0000000076e91401 2 bytes JMP 000000010779a47c
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\PSAPI.dll!EnumProcessModules + 17        0000000076e91419 2 bytes JMP 000000010779a494
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 17      0000000076e91431 2 bytes JMP 000000010779a4ac
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 42      0000000076e9144a 2 bytes JMP 0000000076f5fcc5
.text   ...                                                                                                                                                                              * 9
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\PSAPI.dll!EnumDeviceDrivers + 17         0000000076e914dd 2 bytes JMP 000000010779a558
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameA + 17  0000000076e914f5 2 bytes JMP 000000010779a570
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\PSAPI.dll!QueryWorkingSetEx + 17         0000000076e9150d 2 bytes JMP 000000010779a588
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameW + 17  0000000076e91525 2 bytes JMP 000000010779a5a0
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\PSAPI.dll!GetModuleBaseNameW + 17        0000000076e9153d 2 bytes JMP 000000010779a5b8
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\PSAPI.dll!EnumProcesses + 17             0000000076e91555 2 bytes JMP 000000010779a5d0
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\PSAPI.dll!GetProcessMemoryInfo + 17      0000000076e9156d 2 bytes JMP 000000010779a5e8
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\PSAPI.dll!GetPerformanceInfo + 17        0000000076e91585 2 bytes JMP 000000010779a600
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\PSAPI.dll!QueryWorkingSet + 17           0000000076e9159d 2 bytes JMP 000000010779a618
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\PSAPI.dll!GetModuleBaseNameA + 17        0000000076e915b5 2 bytes JMP 000000010779a630
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\PSAPI.dll!GetModuleFileNameExA + 17      0000000076e915cd 2 bytes JMP 000000015d37ce48
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 20  0000000076e916b2 2 bytes JMP 000000010779a72d
.text   C:\PROGRA~2\Kaspersky Lab\Kaspersky PURE 2.0\Kaspersky Password Manager\Module Retargetable Folder\stpass.exe[3728] C:\Windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 31  0000000076e916bd 2 bytes JMP 000000010779a738

---- Threads - GMER 2.1 ----

Thread  C:\Windows\system32\svchost.exe [488:5904]                                                                                                                                       000007fef76e6ed4
Thread  C:\Windows\system32\svchost.exe [488:5908]                                                                                                                                       000007fef76e6b8c
Thread  C:\Windows\System32\svchost.exe [412:4436]                                                                                                                                       000007feea9b9688

---- EOF - GMER 2.1 ----
         

Grüße von Böni.

Hi,
poste das adwcleaner log bitte.
Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop

• Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
• Drücke Start Scan
  
• Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
  TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
  Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Hallo markusg,

hierkommen die logs:
adwcleaner
AdwCleaner Logfile:

# AdwCleaner v2.303 - Datei am 16/06/2013 um 18:55:47 erstellt
# Aktualisiert am 08/06/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : Bernd - BERNDS-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Arbeitskonto Bernd\Downloads\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16490

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v21.0 (de)

Datei : C:\Users\Bernd\AppData\Roaming\Mozilla\Firefox\Profiles\wuk9gph8.default\prefs.js

[OK] Die Datei ist sauber.

Datei : C:\Users\Arbeitskonto Bernd\AppData\Roaming\Mozilla\Firefox\Profiles\9xvjz5ff.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Google Chrome v27.0.1453.110

Datei : C:\Users\Bernd\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

Datei : C:\Users\Arbeitskonto Bernd\AppData\Local\Google\Chrome\User Data\Default\Preferences

Gelöscht [l.3476] : urls_to_restore_on_startup = [ "hxxps://www.google.de/webhp?hl=de&source=hp&btnG=Google-Suche[...]

*************************

AdwCleaner[S1].txt - [15204 octets] - [16/06/2013 14:18:50]
AdwCleaner[S2].txt - [1305 octets] - [16/06/2013 18:55:47]

########## EOF - \AdwCleaner[S2].txt - [1365 octets] ##########
         

--- --- ---


TDSSKiller

19:07:03.0848 1156  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
19:07:10.0351 1156  ============================================================
19:07:10.0351 1156  Current date / time: 2013/06/16 19:07:10.0351
19:07:10.0351 1156  SystemInfo:
19:07:10.0351 1156  
19:07:10.0351 1156  OS Version: 6.1.7601 ServicePack: 1.0
19:07:10.0351 1156  Product type: Workstation
19:07:10.0351 1156  ComputerName: BERNDS-PC
19:07:10.0351 1156  UserName: Bernd
19:07:10.0351 1156  Windows directory: C:\Windows
19:07:10.0351 1156  System windows directory: C:\Windows
19:07:10.0351 1156  Running under WOW64
19:07:10.0351 1156  Processor architecture: Intel x64
19:07:10.0351 1156  Number of processors: 2
19:07:10.0352 1156  Page size: 0x1000
19:07:10.0352 1156  Boot type: Normal boot
19:07:10.0352 1156  ============================================================
19:07:30.0574 1156  Drive \Device\Harddisk0\DR0 - Size: 0x5D27216000 (372.61 Gb), SectorSize: 0x200, Cylinders: 0x2CD34, SectorsPerTrack: 0x13, TracksPerCylinder: 0xE0, Type 'K0', Flags 0x00000040
19:07:30.0579 1156  Drive \Device\Harddisk1\DR1 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
19:07:30.0580 1156  Drive \Device\Harddisk2\DR2 - Size: 0x7470C05A00 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
19:07:34.0256 1156  ============================================================
19:07:34.0256 1156  \Device\Harddisk0\DR0:
19:07:34.0264 1156  MBR partitions:
19:07:34.0264 1156  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
19:07:34.0265 1156  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x124C6000
19:07:34.0265 1156  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x124F8800, BlocksNum 0x1C43F800
19:07:34.0265 1156  \Device\Harddisk1\DR1:
19:07:34.0265 1156  MBR partitions:
19:07:34.0265 1156  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3A384C02
19:07:34.0265 1156  \Device\Harddisk2\DR2:
19:07:34.0277 1156  MBR partitions:
19:07:34.0277 1156  \Device\Harddisk2\DR2\Partition1: MBR, Type 0xC, StartLBA 0x800, BlocksNum 0x3A384800
19:07:34.0277 1156  ============================================================
19:07:34.0314 1156  C: <-> \Device\Harddisk0\DR0\Partition2
19:07:34.0320 1156  G: <-> \Device\Harddisk2\DR2\Partition1
19:07:34.0354 1156  H: <-> \Device\Harddisk1\DR1\Partition1
19:07:34.0390 1156  F: <-> \Device\Harddisk0\DR0\Partition3
19:07:34.0391 1156  ============================================================
19:07:34.0391 1156  Initialize success
19:07:34.0391 1156  ============================================================
19:07:58.0687 4804  ============================================================
19:07:58.0687 4804  Scan started
19:07:58.0687 4804  Mode: Manual; SigCheck; TDLFS; 
19:07:58.0687 4804  ============================================================
19:08:00.0346 4804  ================ Scan system memory ========================
19:08:00.0347 4804  System memory - ok
19:08:00.0347 4804  ================ Scan services =============================
19:08:00.0772 4804  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
19:08:09.0936 4804  1394ohci - ok
19:08:09.0966 4804  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
19:08:09.0988 4804  ACPI - ok
19:08:10.0032 4804  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
19:08:10.0096 4804  AcpiPmi - ok
19:08:10.0225 4804  [ ADDA5E1951B90D3D23C56D3CF0622ADC ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
19:08:10.0242 4804  AdobeARMservice - ok
19:08:10.0367 4804  [ 9915504F602D277EE47FD843A677FD15 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
19:08:10.0383 4804  AdobeFlashPlayerUpdateSvc - ok
19:08:10.0417 4804  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx         C:\Windows\system32\drivers\adp94xx.sys
19:08:10.0443 4804  adp94xx - ok
19:08:10.0482 4804  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci         C:\Windows\system32\drivers\adpahci.sys
19:08:10.0504 4804  adpahci - ok
19:08:10.0525 4804  [ E109549C90F62FB570B9540C4B148E54 ] adpu320         C:\Windows\system32\drivers\adpu320.sys
19:08:10.0544 4804  adpu320 - ok
19:08:10.0574 4804  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
19:08:10.0695 4804  AeLookupSvc - ok
19:08:10.0750 4804  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD             C:\Windows\system32\drivers\afd.sys
19:08:10.0810 4804  AFD - ok
19:08:10.0834 4804  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys
19:08:10.0851 4804  agp440 - ok
19:08:10.0872 4804  [ 3290D6946B5E30E70414990574883DDB ] ALG             C:\Windows\System32\alg.exe
19:08:10.0920 4804  ALG - ok
19:08:10.0949 4804  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys
19:08:10.0964 4804  aliide - ok
19:08:10.0980 4804  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys
19:08:10.0995 4804  amdide - ok
19:08:11.0021 4804  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys
19:08:11.0056 4804  AmdK8 - ok
19:08:11.0077 4804  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys
19:08:11.0113 4804  AmdPPM - ok
19:08:11.0234 4804  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
19:08:11.0283 4804  amdsata - ok
19:08:11.0303 4804  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
19:08:11.0322 4804  amdsbs - ok
19:08:11.0342 4804  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata         C:\Windows\system32\drivers\amdxata.sys
19:08:11.0373 4804  amdxata - ok
19:08:11.0397 4804  [ 89A69C3F2F319B43379399547526D952 ] AppID           C:\Windows\system32\drivers\appid.sys
19:08:11.0540 4804  AppID - ok
19:08:11.0562 4804  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
19:08:11.0624 4804  AppIDSvc - ok
19:08:11.0662 4804  [ 9D2A2369AB4B08A4905FE72DB104498F ] Appinfo         C:\Windows\System32\appinfo.dll
19:08:11.0710 4804  Appinfo - ok
19:08:11.0790 4804  [ 4ABA3E75A76195A3E38ED2766C962899 ] AppMgmt         C:\Windows\System32\appmgmts.dll
19:08:11.0839 4804  AppMgmt - ok
19:08:11.0862 4804  [ C484F8CEB1717C540242531DB7845C4E ] arc             C:\Windows\system32\drivers\arc.sys
19:08:11.0879 4804  arc - ok
19:08:11.0908 4804  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\drivers\arcsas.sys
19:08:11.0924 4804  arcsas - ok
19:08:12.0041 4804  [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
19:08:12.0068 4804  aspnet_state - ok
19:08:12.0096 4804  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
19:08:12.0154 4804  AsyncMac - ok
19:08:12.0180 4804  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi           C:\Windows\system32\drivers\atapi.sys
19:08:12.0196 4804  atapi - ok
19:08:12.0239 4804  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
19:08:12.0318 4804  AudioEndpointBuilder - ok
19:08:12.0331 4804  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
19:08:12.0375 4804  AudioSrv - ok
19:08:12.0452 4804  [ C6F4C466B654C1BE98AF31418BB5AC30 ] AVM WLAN Connection Service C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
19:08:12.0481 4804  AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - warning
19:08:12.0481 4804  AVM WLAN Connection Service - detected UnsignedFile.Multi.Generic (1)
19:08:12.0532 4804  [ 1DC2F715792CF33428AD7993ACBD224D ] avmeject        C:\Windows\system32\drivers\avmeject.sys
19:08:12.0551 4804  avmeject - ok
19:08:12.0620 4804  [ AEFC1353D0FB4E92A23CFB7E3372356D ] AVP             C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\avp.exe
19:08:12.0636 4804  AVP - ok
19:08:12.0670 4804  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll
19:08:12.0752 4804  AxInstSV - ok
19:08:12.0795 4804  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv         C:\Windows\system32\drivers\bxvbda.sys
19:08:12.0856 4804  b06bdrv - ok
19:08:12.0927 4804  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
19:08:12.0965 4804  b57nd60a - ok
19:08:12.0990 4804  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll
19:08:13.0039 4804  BDESVC - ok
19:08:13.0057 4804  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
19:08:13.0117 4804  Beep - ok
19:08:13.0164 4804  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE             C:\Windows\System32\bfe.dll
19:08:13.0226 4804  BFE - ok
19:08:13.0273 4804  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\System32\qmgr.dll
19:08:13.0341 4804  BITS - ok
19:08:13.0373 4804  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
19:08:13.0406 4804  blbdrive - ok
19:08:13.0438 4804  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
19:08:13.0479 4804  bowser - ok
19:08:13.0488 4804  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
19:08:13.0528 4804  BrFiltLo - ok
19:08:13.0545 4804  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
19:08:13.0564 4804  BrFiltUp - ok
19:08:13.0591 4804  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser         C:\Windows\System32\browser.dll
19:08:13.0618 4804  Browser - ok
19:08:13.0633 4804  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
19:08:13.0696 4804  Brserid - ok
19:08:13.0712 4804  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
19:08:13.0747 4804  BrSerWdm - ok
19:08:13.0764 4804  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
19:08:13.0799 4804  BrUsbMdm - ok
19:08:13.0816 4804  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
19:08:13.0833 4804  BrUsbSer - ok
19:08:13.0839 4804  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
19:08:13.0861 4804  BTHMODEM - ok
19:08:13.0900 4804  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv         C:\Windows\system32\bthserv.dll
19:08:13.0943 4804  bthserv - ok
19:08:13.0964 4804  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
19:08:14.0018 4804  cdfs - ok
19:08:14.0056 4804  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
19:08:14.0094 4804  cdrom - ok
19:08:14.0125 4804  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc     C:\Windows\System32\certprop.dll
19:08:14.0180 4804  CertPropSvc - ok
19:08:14.0207 4804  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\drivers\circlass.sys
19:08:14.0227 4804  circlass - ok
19:08:14.0265 4804  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys
19:08:14.0289 4804  CLFS - ok
19:08:14.0342 4804  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
19:08:14.0360 4804  clr_optimization_v2.0.50727_32 - ok
19:08:14.0397 4804  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
19:08:14.0413 4804  clr_optimization_v2.0.50727_64 - ok
19:08:14.0457 4804  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
19:08:14.0484 4804  clr_optimization_v4.0.30319_32 - ok
19:08:14.0501 4804  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
19:08:14.0517 4804  clr_optimization_v4.0.30319_64 - ok
19:08:14.0536 4804  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\drivers\CmBatt.sys
19:08:14.0565 4804  CmBatt - ok
19:08:14.0582 4804  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys
19:08:14.0597 4804  cmdide - ok
19:08:14.0631 4804  [ AAFCB52FE0037207FB6FBEA070D25EFE ] CNG             C:\Windows\system32\Drivers\cng.sys
19:08:14.0685 4804  CNG - ok
19:08:14.0765 4804  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys
19:08:14.0780 4804  Compbatt - ok
19:08:14.0809 4804  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
19:08:14.0845 4804  CompositeBus - ok
19:08:14.0863 4804  COMSysApp - ok
19:08:14.0871 4804  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk         C:\Windows\system32\drivers\crcdisk.sys
19:08:14.0886 4804  crcdisk - ok
19:08:14.0970 4804  [ D8129C49798CBBFB2E4351D4B7B8EF9C ] CryptSvc        C:\Windows\system32\cryptsvc.dll
19:08:15.0016 4804  CryptSvc - ok
19:08:15.0058 4804  [ 54DA3DFD29ED9F1619B6F53F3CE55E49 ] CSC             C:\Windows\system32\drivers\csc.sys
19:08:15.0185 4804  CSC - ok
19:08:15.0235 4804  [ AB1201F8DE199E764DA9A32ABF71049C ] CSCrySec        C:\Windows\system32\DRIVERS\CSCrySec.sys
19:08:15.0250 4804  CSCrySec - ok
19:08:15.0275 4804  [ 3AB183AB4D2C79DCF459CD2C1266B043 ] CscService      C:\Windows\System32\cscsvc.dll
19:08:15.0319 4804  CscService - ok
19:08:15.0381 4804  [ 6E5B42219F1FE4A3D087D9D501E343D5 ] CSObjectsSrv    C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe
19:08:15.0411 4804  CSObjectsSrv - ok
19:08:15.0430 4804  [ A6EED705BB510FA6B0F9F097165A3395 ] CSVirtualDiskDrv C:\Windows\system32\DRIVERS\CSVirtualDiskDrv.sys
19:08:15.0444 4804  CSVirtualDiskDrv - ok
19:08:15.0484 4804  [ 485E158AC6777732F28798A7CCE2EC7E ] cxbu1x64        C:\Windows\system32\DRIVERS\cxbu1x64.sys
19:08:15.0528 4804  cxbu1x64 - ok
19:08:15.0579 4804  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll
19:08:15.0644 4804  DcomLaunch - ok
19:08:15.0678 4804  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc       C:\Windows\System32\defragsvc.dll
19:08:15.0737 4804  defragsvc - ok
19:08:15.0769 4804  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
19:08:15.0827 4804  DfsC - ok
19:08:15.0866 4804  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll
19:08:15.0929 4804  Dhcp - ok
19:08:15.0951 4804  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys
19:08:16.0002 4804  discache - ok
19:08:16.0034 4804  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\drivers\disk.sys
19:08:16.0050 4804  Disk - ok
19:08:16.0086 4804  [ 5DB085A8A6600BE6401F2B24EECB5415 ] dmvsc           C:\Windows\system32\drivers\dmvsc.sys
19:08:16.0129 4804  dmvsc - ok
19:08:16.0154 4804  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
19:08:16.0211 4804  Dnscache - ok
19:08:16.0239 4804  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc         C:\Windows\System32\dot3svc.dll
19:08:16.0284 4804  dot3svc - ok
19:08:16.0432 4804  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS             C:\Windows\system32\dps.dll
19:08:16.0537 4804  DPS - ok
19:08:16.0619 4804  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
19:08:16.0707 4804  drmkaud - ok
19:08:16.0805 4804  [ AF2E16242AA723F68F461B6EAE2EAD3D ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
19:08:16.0844 4804  DXGKrnl - ok
19:08:16.0862 4804  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost         C:\Windows\System32\eapsvc.dll
19:08:16.0915 4804  EapHost - ok
19:08:17.0041 4804  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv           C:\Windows\system32\drivers\evbda.sys
19:08:17.0136 4804  ebdrv - ok
19:08:17.0163 4804  [ C118A82CD78818C29AB228366EBF81C3 ] EFS             C:\Windows\System32\lsass.exe
19:08:17.0213 4804  EFS - ok
19:08:17.0268 4804  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
19:08:17.0330 4804  ehRecvr - ok
19:08:17.0345 4804  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched         C:\Windows\ehome\ehsched.exe
19:08:17.0375 4804  ehSched - ok
19:08:17.0426 4804  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor         C:\Windows\system32\drivers\elxstor.sys
19:08:17.0452 4804  elxstor - ok
19:08:17.0465 4804  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys
19:08:17.0499 4804  ErrDev - ok
19:08:17.0550 4804  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem     C:\Windows\system32\es.dll
19:08:17.0610 4804  EventSystem - ok
19:08:17.0633 4804  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat           C:\Windows\system32\drivers\exfat.sys
19:08:17.0678 4804  exfat - ok
19:08:17.0757 4804  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat         C:\Windows\system32\drivers\fastfat.sys
19:08:17.0813 4804  fastfat - ok
19:08:17.0864 4804  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax             C:\Windows\system32\fxssvc.exe
19:08:17.0921 4804  Fax - ok
19:08:17.0941 4804  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
19:08:17.0968 4804  fdc - ok
19:08:17.0998 4804  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost         C:\Windows\system32\fdPHost.dll
19:08:18.0058 4804  fdPHost - ok
19:08:18.0074 4804  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
19:08:18.0130 4804  FDResPub - ok
19:08:18.0137 4804  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
19:08:18.0155 4804  FileInfo - ok
19:08:18.0177 4804  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
19:08:18.0234 4804  Filetrace - ok
19:08:18.0256 4804  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
19:08:18.0273 4804  flpydisk - ok
19:08:18.0308 4804  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
19:08:18.0329 4804  FltMgr - ok
19:08:18.0382 4804  [ C4C183E6551084039EC862DA1C945E3D ] FontCache       C:\Windows\system32\FntCache.dll
19:08:18.0428 4804  FontCache - ok
19:08:18.0465 4804  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
19:08:18.0480 4804  FontCache3.0.0.0 - ok
19:08:18.0607 4804  [ 76FCBFD0C78DE110468B356F85EC6DB3 ] ForceWare Intelligent Application Manager (IAM) C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
19:08:18.0631 4804  ForceWare Intelligent Application Manager (IAM) - ok
19:08:18.0644 4804  [ D43703496149971890703B4B1B723EAC ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
19:08:18.0660 4804  FsDepends - ok
19:08:18.0685 4804  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
19:08:18.0700 4804  Fs_Rec - ok
19:08:18.0745 4804  [ 8F6322049018354F45F05A2FD2D4E5E0 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
19:08:18.0767 4804  fvevol - ok
19:08:18.0821 4804  [ 15585492E45E2F30768B2D5B57929D99 ] fwlanusbn       C:\Windows\system32\DRIVERS\fwlanusbn.sys
19:08:18.0880 4804  fwlanusbn - ok
19:08:18.0907 4804  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
19:08:18.0923 4804  gagp30kx - ok
19:08:18.0961 4804  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc           C:\Windows\System32\gpsvc.dll
19:08:19.0017 4804  gpsvc - ok
19:08:19.0081 4804  [ 506708142BC63DABA64F2D3AD1DCD5BF ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
19:08:19.0094 4804  gupdate - ok
19:08:19.0110 4804  [ 506708142BC63DABA64F2D3AD1DCD5BF ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
19:08:19.0124 4804  gupdatem - ok
19:08:19.0143 4804  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
19:08:19.0187 4804  hcw85cir - ok
19:08:19.0219 4804  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
19:08:19.0256 4804  HdAudAddService - ok
19:08:19.0282 4804  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
19:08:19.0315 4804  HDAudBus - ok
19:08:19.0333 4804  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt         C:\Windows\system32\drivers\HidBatt.sys
19:08:19.0365 4804  HidBatt - ok
19:08:19.0383 4804  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\drivers\hidbth.sys
19:08:19.0417 4804  HidBth - ok
19:08:19.0438 4804  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr           C:\Windows\system32\drivers\hidir.sys
19:08:19.0458 4804  HidIr - ok
19:08:19.0470 4804  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv         C:\Windows\system32\hidserv.dll
19:08:19.0512 4804  hidserv - ok
19:08:19.0533 4804  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
19:08:19.0550 4804  HidUsb - ok
19:08:19.0583 4804  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll
19:08:19.0650 4804  hkmsvc - ok
19:08:19.0673 4804  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
19:08:19.0715 4804  HomeGroupListener - ok
19:08:19.0771 4804  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
19:08:19.0800 4804  HomeGroupProvider - ok
19:08:19.0823 4804  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
19:08:19.0838 4804  HpSAMD - ok
19:08:19.0878 4804  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
19:08:19.0942 4804  HTTP - ok
19:08:19.0962 4804  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
19:08:19.0985 4804  hwpolicy - ok
19:08:20.0083 4804  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
19:08:20.0116 4804  i8042prt - ok
19:08:20.0192 4804  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
19:08:20.0215 4804  iaStorV - ok
19:08:20.0260 4804  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
19:08:20.0293 4804  idsvc - ok
19:08:20.0313 4804  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp           C:\Windows\system32\drivers\iirsp.sys
19:08:20.0328 4804  iirsp - ok
19:08:20.0366 4804  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll
19:08:20.0438 4804  IKEEXT - ok
19:08:20.0670 4804  [ CCEDD47ABD068C58C8513DEB785093BB ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
19:08:20.0756 4804  IntcAzAudAddService - ok
19:08:20.0786 4804  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys
19:08:20.0800 4804  intelide - ok
19:08:20.0818 4804  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\drivers\intelppm.sys
19:08:20.0845 4804  intelppm - ok
19:08:20.0880 4804  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
19:08:20.0935 4804  IPBusEnum - ok
19:08:20.0943 4804  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
19:08:20.0984 4804  IpFilterDriver - ok
19:08:21.0024 4804  [ 08C2957BB30058E663720C5606885653 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
19:08:21.0080 4804  iphlpsvc - ok
19:08:21.0089 4804  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
19:08:21.0107 4804  IPMIDRV - ok
19:08:21.0115 4804  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
19:08:21.0173 4804  IPNAT - ok
19:08:21.0202 4804  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
19:08:21.0238 4804  IRENUM - ok
19:08:21.0245 4804  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
19:08:21.0260 4804  isapnp - ok
19:08:21.0296 4804  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
19:08:21.0318 4804  iScsiPrt - ok
19:08:21.0344 4804  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
19:08:21.0360 4804  kbdclass - ok
19:08:21.0372 4804  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
19:08:21.0404 4804  kbdhid - ok
19:08:21.0426 4804  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe
19:08:21.0442 4804  KeyIso - ok
19:08:21.0489 4804  [ 73BF91EFBE1F788D0615A396A9211A4B ] KL1             C:\Windows\system32\DRIVERS\kl1.sys
19:08:21.0512 4804  KL1 - ok
19:08:21.0543 4804  [ DC3CF56209C6A19124FEDEF1CBFAF55B ] kl2             C:\Windows\system32\DRIVERS\kl2.sys
19:08:21.0636 4804  kl2 - ok
19:08:21.0702 4804  [ 43D02C0E6BDCD216A01ECAE213A64F67 ] KLIF            C:\Windows\system32\DRIVERS\klif.sys
19:08:21.0729 4804  KLIF - ok
19:08:21.0789 4804  [ 89FB5A33D7171B6D84F5EB721D5055E1 ] KLIM6           C:\Windows\system32\DRIVERS\klim6.sys
19:08:21.0803 4804  KLIM6 - ok
19:08:21.0821 4804  [ 9468D07E91BA136D82415F5DFC1FE168 ] klmouflt        C:\Windows\system32\DRIVERS\klmouflt.sys
19:08:21.0939 4804  klmouflt - ok
19:08:21.0966 4804  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
19:08:21.0985 4804  KSecDD - ok
19:08:22.0016 4804  [ 7EFB9333E4ECCE6AE4AE9D777D9E553E ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
19:08:22.0035 4804  KSecPkg - ok
19:08:22.0064 4804  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
19:08:22.0119 4804  ksthunk - ok
19:08:22.0152 4804  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm           C:\Windows\system32\msdtckrm.dll
19:08:22.0209 4804  KtmRm - ok
19:08:22.0256 4804  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\system32\srvsvc.dll
19:08:22.0313 4804  LanmanServer - ok
19:08:22.0375 4804  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
19:08:22.0434 4804  LanmanWorkstation - ok
19:08:22.0499 4804  [ 70FB6254E29150A7A4A39FDFFD306C33 ] LBTServ         C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
19:08:22.0521 4804  LBTServ - ok
19:08:22.0552 4804  [ A03B765FF67E58BA75333C7C8C0D7706 ] LEqdUsb         C:\Windows\system32\DRIVERS\LEqdUsb.Sys
19:08:22.0671 4804  LEqdUsb - ok
19:08:22.0712 4804  [ 389588725D419476F365370BED4FFE5A ] LHidEqd         C:\Windows\system32\DRIVERS\LHidEqd.Sys
19:08:22.0727 4804  LHidEqd - ok
19:08:22.0743 4804  [ 1470EF17E02E82E4F43346DF9E9F11E1 ] LHidFilt        C:\Windows\system32\DRIVERS\LHidFilt.Sys
19:08:22.0758 4804  LHidFilt - ok
19:08:22.0792 4804  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
19:08:22.0843 4804  lltdio - ok
19:08:22.0881 4804  [ C1185803384AB3FEED115F79F109427F ] lltdsvc         C:\Windows\System32\lltdsvc.dll
19:08:22.0946 4804  lltdsvc - ok
19:08:22.0968 4804  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts         C:\Windows\System32\lmhsvc.dll
19:08:23.0027 4804  lmhosts - ok
19:08:23.0048 4804  [ 12814AE119E959437BEA3110F81BD188 ] LMouFilt        C:\Windows\system32\DRIVERS\LMouFilt.Sys
19:08:23.0065 4804  LMouFilt - ok
19:08:23.0101 4804  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
19:08:23.0119 4804  LSI_FC - ok
19:08:23.0137 4804  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS         C:\Windows\system32\drivers\lsi_sas.sys
19:08:23.0154 4804  LSI_SAS - ok
19:08:23.0183 4804  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
19:08:23.0199 4804  LSI_SAS2 - ok
19:08:23.0220 4804  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
19:08:23.0238 4804  LSI_SCSI - ok
19:08:23.0270 4804  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv           C:\Windows\system32\drivers\luafv.sys
19:08:23.0329 4804  luafv - ok
19:08:23.0377 4804  [ B8EAC4507EB4655377B1E094FCE7F12E ] Macromedia Licensing Service C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
19:08:23.0397 4804  Macromedia Licensing Service ( UnsignedFile.Multi.Generic ) - warning
19:08:23.0397 4804  Macromedia Licensing Service - detected UnsignedFile.Multi.Generic (1)
19:08:23.0425 4804  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
19:08:23.0455 4804  Mcx2Svc - ok
19:08:23.0461 4804  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas         C:\Windows\system32\drivers\megasas.sys
19:08:23.0478 4804  megasas - ok
19:08:23.0502 4804  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
19:08:23.0524 4804  MegaSR - ok
19:08:23.0563 4804  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS           C:\Windows\system32\mmcss.dll
19:08:23.0622 4804  MMCSS - ok
19:08:23.0642 4804  [ 800BA92F7010378B09F9ED9270F07137 ] Modem           C:\Windows\system32\drivers\modem.sys
19:08:23.0693 4804  Modem - ok
19:08:23.0761 4804  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
19:08:23.0791 4804  monitor - ok
19:08:23.0817 4804  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
19:08:23.0833 4804  mouclass - ok
19:08:23.0862 4804  [ 21B7ACEA1BB49C3371DD5427BF309D6A ] moufiltr        C:\Windows\system32\DRIVERS\moufiltr.sys
19:08:23.0905 4804  moufiltr - ok
19:08:23.0923 4804  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
19:08:23.0957 4804  mouhid - ok
19:08:23.0976 4804  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
19:08:23.0994 4804  mountmgr - ok
19:08:24.0046 4804  [ 825BF0E46B4470A463AEB641480C5FCA ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
19:08:24.0064 4804  MozillaMaintenance - ok
19:08:24.0084 4804  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys
19:08:24.0103 4804  mpio - ok
19:08:24.0113 4804  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
19:08:24.0156 4804  mpsdrv - ok
19:08:24.0193 4804  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll
19:08:24.0250 4804  MpsSvc - ok
19:08:24.0265 4804  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
19:08:24.0300 4804  MRxDAV - ok
19:08:24.0323 4804  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
19:08:24.0360 4804  mrxsmb - ok
19:08:24.0378 4804  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
19:08:24.0399 4804  mrxsmb10 - ok
19:08:24.0408 4804  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
19:08:24.0425 4804  mrxsmb20 - ok
19:08:24.0440 4804  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys
19:08:24.0456 4804  msahci - ok
19:08:24.0476 4804  [ DB801A638D011B9633829EB6F663C900 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
19:08:24.0496 4804  msdsm - ok
19:08:24.0509 4804  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC           C:\Windows\System32\msdtc.exe
19:08:24.0544 4804  MSDTC - ok
19:08:24.0559 4804  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
19:08:24.0609 4804  Msfs - ok
19:08:24.0629 4804  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
19:08:24.0671 4804  mshidkmdf - ok
19:08:24.0681 4804  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
19:08:24.0699 4804  msisadrv - ok
19:08:24.0724 4804  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
19:08:24.0786 4804  MSiSCSI - ok
19:08:24.0792 4804  msiserver - ok
19:08:24.0821 4804  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
19:08:24.0874 4804  MSKSSRV - ok
19:08:24.0901 4804  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
19:08:24.0958 4804  MSPCLOCK - ok
19:08:24.0977 4804  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
19:08:25.0030 4804  MSPQM - ok
19:08:25.0066 4804  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
19:08:25.0089 4804  MsRPC - ok
19:08:25.0107 4804  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
19:08:25.0121 4804  mssmbios - ok
19:08:25.0127 4804  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
19:08:25.0179 4804  MSTEE - ok
19:08:25.0186 4804  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
19:08:25.0206 4804  MTConfig - ok
19:08:25.0224 4804  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup             C:\Windows\system32\Drivers\mup.sys
19:08:25.0241 4804  Mup - ok
19:08:25.0282 4804  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll
19:08:25.0352 4804  napagent - ok
19:08:25.0395 4804  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
19:08:25.0446 4804  NativeWifiP - ok
19:08:25.0501 4804  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\Windows\system32\drivers\ndis.sys
19:08:25.0537 4804  NDIS - ok
19:08:25.0544 4804  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
19:08:25.0587 4804  NdisCap - ok
19:08:25.0614 4804  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
19:08:25.0656 4804  NdisTapi - ok
19:08:25.0673 4804  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
19:08:25.0714 4804  Ndisuio - ok
19:08:25.0723 4804  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
19:08:25.0779 4804  NdisWan - ok
19:08:25.0796 4804  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
19:08:25.0850 4804  NDProxy - ok
19:08:25.0875 4804  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
19:08:25.0935 4804  NetBIOS - ok
19:08:25.0957 4804  [ 09594D1089C523423B32A4229263F068 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
19:08:26.0012 4804  NetBT - ok
19:08:26.0029 4804  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe
19:08:26.0048 4804  Netlogon - ok
19:08:26.0099 4804  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll
19:08:26.0168 4804  Netman - ok
19:08:26.0207 4804  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
19:08:26.0234 4804  NetMsmqActivator - ok
19:08:26.0240 4804  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
19:08:26.0255 4804  NetPipeActivator - ok
19:08:26.0285 4804  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll
19:08:26.0351 4804  netprofm - ok
19:08:26.0362 4804  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
19:08:26.0376 4804  NetTcpActivator - ok
19:08:26.0383 4804  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
19:08:26.0411 4804  NetTcpPortSharing - ok
19:08:26.0431 4804  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960         C:\Windows\system32\drivers\nfrd960.sys
19:08:26.0450 4804  nfrd960 - ok
19:08:26.0482 4804  [ 8AD77806D336673F270DB31645267293 ] NlaSvc          C:\Windows\System32\nlasvc.dll
19:08:26.0520 4804  NlaSvc - ok
19:08:26.0539 4804  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
19:08:26.0580 4804  Npfs - ok
19:08:26.0610 4804  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi             C:\Windows\system32\nsisvc.dll
19:08:26.0668 4804  nsi - ok
19:08:26.0691 4804  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
19:08:26.0748 4804  nsiproxy - ok
19:08:26.0787 4804  [ 13C0D9CBA38FFA6D0C9E721B5E7212A0 ] nSvcIp          C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
19:08:26.0803 4804  nSvcIp - ok
19:08:26.0869 4804  [ B98F8C6E31CD07B2E6F71F7F648E38C0 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
19:08:26.0920 4804  Ntfs - ok
19:08:26.0934 4804  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys
19:08:26.0991 4804  Null - ok
19:08:27.0024 4804  [ 786DB821BFD57C0551DBBE4F75384A7D ] nusb3hub        C:\Windows\system32\drivers\nusb3hub.sys
19:08:27.0152 4804  nusb3hub - ok
19:08:27.0179 4804  [ DAA8005CAF745042BB427A1ED7433354 ] nusb3xhc        C:\Windows\system32\drivers\nusb3xhc.sys
19:08:27.0287 4804  nusb3xhc - ok
19:08:27.0340 4804  [ D60EB33D07A8C0D9CCA4265480A6CAB6 ] nvamacpi        C:\Windows\system32\DRIVERS\NVAMACPI.sys
19:08:27.0408 4804  nvamacpi - ok
19:08:27.0451 4804  [ A85B4F2EF3A7304A5399EF0526423040 ] NVENETFD        C:\Windows\system32\DRIVERS\nvm62x64.sys
19:08:27.0485 4804  NVENETFD - ok
19:08:27.0819 4804  [ C47D6B7299BA80A210BCAFA81AC978A1 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
19:08:28.0327 4804  nvlddmkm - ok
19:08:28.0413 4804  [ BD25E03EAD63AC3365F25175B4DBD56A ] NVNET           C:\Windows\system32\DRIVERS\nvmf6264.sys
19:08:28.0434 4804  NVNET - ok
19:08:28.0474 4804  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys
19:08:28.0493 4804  nvraid - ok
19:08:28.0515 4804  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys
19:08:28.0533 4804  nvstor - ok
19:08:28.0569 4804  [ 71B6ECD3C56FBF12FB1968DA3953B703 ] nvstor64        C:\Windows\system32\DRIVERS\nvstor64.sys
19:08:28.0584 4804  nvstor64 - ok
19:08:28.0620 4804  [ 522845124DA947B2372C6F606CD105A8 ] nvsvc           C:\Windows\system32\nvvsvc.exe
19:08:28.0638 4804  nvsvc - ok
19:08:28.0702 4804  [ A3A25E0509F67473B960DAF214828BE3 ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
19:08:28.0752 4804  nvUpdatusService - ok
19:08:28.0775 4804  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
19:08:28.0792 4804  nv_agp - ok
19:08:28.0821 4804  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
19:08:28.0847 4804  ohci1394 - ok
19:08:28.0908 4804  [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
19:08:28.0924 4804  ose - ok
19:08:29.0099 4804  [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc         C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
19:08:29.0215 4804  osppsvc - ok
19:08:29.0279 4804  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
19:08:29.0325 4804  p2pimsvc - ok
19:08:29.0348 4804  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll
19:08:29.0373 4804  p2psvc - ok
19:08:29.0413 4804  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport         C:\Windows\system32\DRIVERS\parport.sys
19:08:29.0446 4804  Parport - ok
19:08:29.0471 4804  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr         C:\Windows\system32\drivers\partmgr.sys
19:08:29.0488 4804  partmgr - ok
19:08:29.0511 4804  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
19:08:29.0553 4804  PcaSvc - ok
19:08:29.0563 4804  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci             C:\Windows\system32\drivers\pci.sys
19:08:29.0583 4804  pci - ok
19:08:29.0599 4804  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys
19:08:29.0614 4804  pciide - ok
19:08:29.0631 4804  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
19:08:29.0652 4804  pcmcia - ok
19:08:29.0659 4804  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw             C:\Windows\system32\drivers\pcw.sys
19:08:29.0676 4804  pcw - ok
19:08:29.0706 4804  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
19:08:29.0771 4804  PEAUTH - ok
19:08:29.0837 4804  [ B9B0A4299DD2D76A4243F75FD54DC680 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll
19:08:29.0892 4804  PeerDistSvc - ok
19:08:29.0966 4804  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe
19:08:30.0172 4804  PerfHost - ok
19:08:30.0241 4804  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla             C:\Windows\system32\pla.dll
19:08:30.0321 4804  pla - ok
19:08:30.0364 4804  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
19:08:30.0399 4804  PlugPlay - ok
19:08:30.0415 4804  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
19:08:30.0445 4804  PNRPAutoReg - ok
19:08:30.0473 4804  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
19:08:30.0493 4804  PNRPsvc - ok
19:08:30.0532 4804  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
19:08:30.0594 4804  PolicyAgent - ok
19:08:30.0627 4804  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power           C:\Windows\system32\umpo.dll
19:08:30.0687 4804  Power - ok
19:08:30.0752 4804  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
19:08:30.0808 4804  PptpMiniport - ok
19:08:30.0826 4804  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor       C:\Windows\system32\drivers\processr.sys
19:08:30.0860 4804  Processor - ok
19:08:30.0903 4804  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc         C:\Windows\system32\profsvc.dll
19:08:30.0946 4804  ProfSvc - ok
19:08:30.0963 4804  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
19:08:30.0981 4804  ProtectedStorage - ok
19:08:31.0008 4804  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
19:08:31.0064 4804  Psched - ok
19:08:31.0117 4804  [ DD3FD48D69F5FBBB21D46D1514C1C2DB ] PSI             C:\Windows\system32\DRIVERS\psi_mf_amd64.sys
19:08:31.0163 4804  PSI - ok
19:08:31.0192 4804  [ A6A7AD767BF5141665F5C675F671B3E1 ] PSI_SVC_2       c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
19:08:31.0210 4804  PSI_SVC_2 - ok
19:08:31.0252 4804  [ BC08F7F3C53CBEE68670ED1314E290FD ] PxHlpa64        C:\Windows\system32\Drivers\PxHlpa64.sys
19:08:31.0267 4804  PxHlpa64 - ok
19:08:31.0587 4804  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
19:08:31.0634 4804  ql2300 - ok
19:08:31.0655 4804  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
19:08:31.0673 4804  ql40xx - ok
19:08:31.0709 4804  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE           C:\Windows\system32\qwave.dll
19:08:31.0737 4804  QWAVE - ok
19:08:31.0751 4804  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
19:08:31.0784 4804  QWAVEdrv - ok
19:08:31.0805 4804  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
19:08:31.0846 4804  RasAcd - ok
19:08:31.0889 4804  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
19:08:31.0930 4804  RasAgileVpn - ok
19:08:31.0948 4804  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto         C:\Windows\System32\rasauto.dll
19:08:32.0002 4804  RasAuto - ok
19:08:32.0020 4804  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
19:08:32.0069 4804  Rasl2tp - ok
19:08:32.0092 4804  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll
19:08:32.0139 4804  RasMan - ok
19:08:32.0147 4804  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
19:08:32.0205 4804  RasPppoe - ok
19:08:32.0221 4804  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
19:08:32.0281 4804  RasSstp - ok
19:08:32.0311 4804  [ 77F665941019A1594D887A74F301FA2F ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
19:08:32.0356 4804  rdbss - ok
19:08:32.0364 4804  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
19:08:32.0397 4804  rdpbus - ok
19:08:32.0414 4804  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
19:08:32.0455 4804  RDPCDD - ok
19:08:32.0490 4804  [ 1B6163C503398B23FF8B939C67747683 ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
19:08:32.0555 4804  RDPDR - ok
19:08:32.0570 4804  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
19:08:32.0620 4804  RDPENCDD - ok
19:08:32.0639 4804  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
19:08:32.0681 4804  RDPREFMP - ok
19:08:32.0770 4804  [ 313F68E1A3E6345A4F47A36B07062F34 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
19:08:32.0818 4804  RdpVideoMiniport - ok
19:08:32.0845 4804  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
19:08:32.0940 4804  RDPWD - ok
19:08:32.0956 4804  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
19:08:32.0976 4804  rdyboost - ok
19:08:33.0000 4804  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
19:08:33.0046 4804  RemoteAccess - ok
19:08:33.0098 4804  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
19:08:33.0211 4804  RemoteRegistry - ok
19:08:33.0263 4804  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
19:08:33.0363 4804  RpcEptMapper - ok
19:08:33.0392 4804  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe
19:08:33.0427 4804  RpcLocator - ok
19:08:33.0459 4804  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs           C:\Windows\system32\rpcss.dll
19:08:33.0505 4804  RpcSs - ok
19:08:33.0538 4804  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
19:08:33.0582 4804  rspndr - ok
19:08:33.0609 4804  [ E60C0A09F997826C7627B244195AB581 ] s3cap           C:\Windows\system32\drivers\vms3cap.sys
19:08:33.0635 4804  s3cap - ok
19:08:33.0651 4804  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs           C:\Windows\system32\lsass.exe
19:08:33.0667 4804  SamSs - ok
19:08:33.0675 4804  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
19:08:33.0693 4804  sbp2port - ok
19:08:33.0709 4804  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
19:08:33.0756 4804  SCardSvr - ok
19:08:33.0770 4804  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
19:08:33.0822 4804  scfilter - ok
19:08:33.0861 4804  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll
19:08:33.0930 4804  Schedule - ok
19:08:33.0962 4804  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc     C:\Windows\System32\certprop.dll
19:08:34.0002 4804  SCPolicySvc - ok
19:08:34.0022 4804  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
19:08:34.0073 4804  SDRSVC - ok
19:08:34.0095 4804  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
19:08:34.0154 4804  secdrv - ok
19:08:34.0174 4804  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll
19:08:34.0215 4804  seclogon - ok
19:08:34.0289 4804  [ E43C0D32FF2D9A72F2D975B83B916964 ] Secunia PSI Agent C:\Program Files (x86)\Secunia\PSI\PSIA.exe
19:08:34.0332 4804  Secunia PSI Agent - ok
19:08:34.0375 4804  [ CB2D183E27D1443F7D4CF10665B2BDED ] Secunia Update Agent C:\Program Files (x86)\Secunia\PSI\sua.exe
19:08:34.0403 4804  Secunia Update Agent - ok
19:08:34.0418 4804  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll
19:08:34.0461 4804  SENS - ok
19:08:34.0483 4804  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
19:08:34.0522 4804  SensrSvc - ok
19:08:34.0550 4804  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
19:08:34.0594 4804  Serenum - ok
19:08:34.0618 4804  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys
19:08:34.0648 4804  Serial - ok
19:08:34.0666 4804  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
19:08:34.0693 4804  sermouse - ok
19:08:34.0738 4804  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll
19:08:34.0794 4804  SessionEnv - ok
19:08:34.0809 4804  [ A554811BCD09279536440C964AE35BBF ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
19:08:34.0829 4804  sffdisk - ok
19:08:34.0847 4804  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
19:08:34.0878 4804  sffp_mmc - ok
19:08:34.0902 4804  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
19:08:34.0932 4804  sffp_sd - ok
19:08:34.0948 4804  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy         C:\Windows\system32\drivers\sfloppy.sys
19:08:34.0973 4804  sfloppy - ok
19:08:35.0006 4804  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll
19:08:35.0068 4804  SharedAccess - ok
19:08:35.0100 4804  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
19:08:35.0148 4804  ShellHWDetection - ok
19:08:35.0172 4804  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
19:08:35.0190 4804  SiSRaid2 - ok
19:08:35.0211 4804  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
19:08:35.0229 4804  SiSRaid4 - ok
19:08:35.0290 4804  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
19:08:35.0353 4804  Smb - ok
19:08:35.0402 4804  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
19:08:35.0437 4804  SNMPTRAP - ok
19:08:35.0459 4804  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr           C:\Windows\system32\drivers\spldr.sys
19:08:35.0475 4804  spldr - ok
19:08:35.0516 4804  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler         C:\Windows\System32\spoolsv.exe
19:08:35.0555 4804  Spooler - ok
19:08:35.0647 4804  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe
19:08:35.0758 4804  sppsvc - ok
19:08:35.0777 4804  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
19:08:35.0820 4804  sppuinotify - ok
19:08:35.0851 4804  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv             C:\Windows\system32\DRIVERS\srv.sys
19:08:35.0904 4804  srv - ok
19:08:35.0916 4804  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
19:08:35.0950 4804  srv2 - ok
19:08:35.0958 4804  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
19:08:35.0977 4804  srvnet - ok
19:08:36.0043 4804  [ 2F4595C0AFA2152D67AAE594DC461509 ] SSCBFS3         C:\Windows\system32\DRIVERS\sscbfs3.sys
19:08:36.0065 4804  SSCBFS3 - ok
19:08:36.0100 4804  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
19:08:36.0145 4804  SSDPSRV - ok
19:08:36.0156 4804  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc         C:\Windows\system32\sstpsvc.dll
19:08:36.0199 4804  SstpSvc - ok
19:08:36.0223 4804  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\drivers\stexstor.sys
19:08:36.0239 4804  stexstor - ok
19:08:36.0290 4804  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll
19:08:36.0324 4804  stisvc - ok
19:08:36.0356 4804  [ 7785DC213270D2FC066538DAF94087E7 ] storflt         C:\Windows\system32\drivers\vmstorfl.sys
19:08:36.0372 4804  storflt - ok
19:08:36.0396 4804  [ C40841817EF57D491F22EB103DA587CC ] StorSvc         C:\Windows\system32\storsvc.dll
19:08:36.0422 4804  StorSvc - ok
19:08:36.0446 4804  [ D34E4943D5AC096C8EDEEBFD80D76E23 ] storvsc         C:\Windows\system32\drivers\storvsc.sys
19:08:36.0461 4804  storvsc - ok
19:08:36.0477 4804  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
19:08:36.0492 4804  swenum - ok
19:08:36.0560 4804  [ F577910A133A592234EBAAD3F3AFA258 ] SwitchBoard     C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
19:08:36.0595 4804  SwitchBoard ( UnsignedFile.Multi.Generic ) - warning
19:08:36.0595 4804  SwitchBoard - detected UnsignedFile.Multi.Generic (1)
19:08:36.0625 4804  [ E08E46FDD841B7184194011CA1955A0B ] swprv           C:\Windows\System32\swprv.dll
19:08:36.0694 4804  swprv - ok
19:08:36.0745 4804  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain         C:\Windows\system32\sysmain.dll
19:08:36.0809 4804  SysMain - ok
19:08:36.0832 4804  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
19:08:36.0868 4804  TabletInputService - ok
19:08:36.0892 4804  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv         C:\Windows\System32\tapisrv.dll
19:08:36.0939 4804  TapiSrv - ok
19:08:36.0955 4804  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS             C:\Windows\System32\tbssvc.dll
19:08:37.0015 4804  TBS - ok
19:08:37.0094 4804  [ 9849EA3843A2ADBDD1497E97A85D8CAE ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
19:08:37.0150 4804  Tcpip - ok
19:08:37.0192 4804  [ 9849EA3843A2ADBDD1497E97A85D8CAE ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
19:08:37.0237 4804  TCPIP6 - ok
19:08:37.0266 4804  [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
19:08:37.0282 4804  tcpipreg - ok
19:08:37.0313 4804  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
19:08:37.0350 4804  TDPIPE - ok
19:08:37.0380 4804  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
19:08:37.0397 4804  TDTCP - ok
19:08:37.0426 4804  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
19:08:37.0481 4804  tdx - ok
19:08:37.0498 4804  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
19:08:37.0513 4804  TermDD - ok
19:08:37.0543 4804  [ 2E648163254233755035B46DD7B89123 ] TermService     C:\Windows\System32\termsrv.dll
19:08:37.0596 4804  TermService - ok
19:08:37.0610 4804  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll
19:08:37.0633 4804  Themes - ok
19:08:37.0663 4804  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER     C:\Windows\system32\mmcss.dll
19:08:37.0705 4804  THREADORDER - ok
19:08:37.0735 4804  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll
19:08:37.0792 4804  TrkWks - ok
19:08:37.0847 4804  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
19:08:37.0889 4804  TrustedInstaller - ok
19:08:37.0911 4804  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
19:08:37.0967 4804  tssecsrv - ok
19:08:38.0006 4804  [ 17C6B51CBCCDED95B3CC14E22791F85E ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
19:08:38.0030 4804  TsUsbFlt - ok
19:08:38.0054 4804  [ AD64450A4ABE076F5CB34CC08EEACB07 ] TsUsbGD         C:\Windows\system32\drivers\TsUsbGD.sys
19:08:38.0127 4804  TsUsbGD - ok
19:08:38.0158 4804  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
19:08:38.0209 4804  tunnel - ok
19:08:38.0225 4804  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
19:08:38.0241 4804  uagp35 - ok
19:08:38.0264 4804  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
19:08:38.0323 4804  udfs - ok
19:08:38.0350 4804  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect       C:\Windows\system32\UI0Detect.exe
19:08:38.0383 4804  UI0Detect - ok
19:08:38.0409 4804  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
19:08:38.0425 4804  uliagpkx - ok
19:08:38.0452 4804  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
19:08:38.0482 4804  umbus - ok
19:08:38.0500 4804  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\drivers\umpass.sys
19:08:38.0528 4804  UmPass - ok
19:08:38.0556 4804  [ A293DCD756D04D8492A750D03B9A297C ] UmRdpService    C:\Windows\System32\umrdp.dll
19:08:38.0592 4804  UmRdpService - ok
19:08:38.0622 4804  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll
19:08:38.0683 4804  upnphost - ok
19:08:38.0753 4804  [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
19:08:38.0790 4804  usbaudio - ok
19:08:38.0879 4804  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
19:08:38.0918 4804  usbccgp - ok
19:08:38.0936 4804  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
19:08:38.0958 4804  usbcir - ok
19:08:38.0969 4804  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys
19:08:38.0999 4804  usbehci - ok
19:08:39.0013 4804  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
19:08:39.0047 4804  usbhub - ok
19:08:39.0063 4804  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci         C:\Windows\system32\DRIVERS\usbohci.sys
19:08:39.0096 4804  usbohci - ok
19:08:39.0129 4804  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
19:08:39.0163 4804  usbprint - ok
19:08:39.0202 4804  [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan         C:\Windows\system32\DRIVERS\usbscan.sys
19:08:39.0221 4804  usbscan - ok
19:08:39.0250 4804  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
19:08:39.0290 4804  USBSTOR - ok
19:08:39.0305 4804  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
19:08:39.0338 4804  usbuhci - ok
19:08:39.0372 4804  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms           C:\Windows\System32\uxsms.dll
19:08:39.0430 4804  UxSms - ok
19:08:39.0449 4804  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe
19:08:39.0464 4804  VaultSvc - ok
19:08:39.0498 4804  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
19:08:39.0513 4804  vdrvroot - ok
19:08:39.0541 4804  [ 8D6B481601D01A456E75C3210F1830BE ] vds             C:\Windows\System32\vds.exe
19:08:39.0599 4804  vds - ok
19:08:39.0622 4804  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
19:08:39.0640 4804  vga - ok
19:08:39.0652 4804  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave         C:\Windows\System32\drivers\vga.sys
19:08:39.0708 4804  VgaSave - ok
19:08:39.0732 4804  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
19:08:39.0753 4804  vhdmp - ok
19:08:39.0798 4804  [ C2C95D62C90CA809240112B41C1765F2 ] vhidmini        C:\Windows\system32\DRIVERS\walvhid.sys
19:08:39.0828 4804  vhidmini - ok
19:08:39.0842 4804  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys
19:08:39.0857 4804  viaide - ok
19:08:39.0879 4804  [ 86EA3E79AE350FEA5331A1303054005F ] vmbus           C:\Windows\system32\drivers\vmbus.sys
19:08:39.0899 4804  vmbus - ok
19:08:39.0917 4804  [ 7DE90B48F210D29649380545DB45A187 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
19:08:39.0958 4804  VMBusHID - ok
19:08:39.0964 4804  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
19:08:39.0981 4804  volmgr - ok
19:08:40.0005 4804  [ A255814907C89BE58B79EF2F189B843B ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
19:08:40.0030 4804  volmgrx - ok
19:08:40.0041 4804  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap         C:\Windows\system32\drivers\volsnap.sys
19:08:40.0061 4804  volsnap - ok
19:08:40.0140 4804  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid         C:\Windows\system32\drivers\vsmraid.sys
19:08:40.0204 4804  vsmraid - ok
19:08:40.0251 4804  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS             C:\Windows\system32\vssvc.exe
19:08:40.0346 4804  VSS - ok
19:08:40.0365 4804  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
19:08:40.0400 4804  vwifibus - ok
19:08:40.0438 4804  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time         C:\Windows\system32\w32time.dll
19:08:40.0486 4804  W32Time - ok
19:08:40.0506 4804  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
19:08:40.0537 4804  WacomPen - ok
19:08:40.0574 4804  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
19:08:40.0624 4804  WANARP - ok
19:08:40.0629 4804  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
19:08:40.0670 4804  Wanarpv6 - ok
19:08:40.0716 4804  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe
19:08:40.0791 4804  wbengine - ok
19:08:40.0814 4804  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
19:08:40.0841 4804  WbioSrvc - ok
19:08:40.0860 4804  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc         C:\Windows\System32\wcncsvc.dll
19:08:40.0907 4804  wcncsvc - ok
19:08:40.0928 4804  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
19:08:40.0978 4804  WcsPlugInService - ok
19:08:40.0991 4804  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\drivers\wd.sys
19:08:41.0006 4804  Wd - ok
19:08:41.0057 4804  [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
19:08:41.0091 4804  Wdf01000 - ok
19:08:41.0109 4804  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
19:08:41.0196 4804  WdiServiceHost - ok
19:08:41.0201 4804  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost   C:\Windows\system32\wdi.dll
19:08:41.0224 4804  WdiSystemHost - ok
19:08:41.0238 4804  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient       C:\Windows\System32\webclnt.dll
19:08:41.0279 4804  WebClient - ok
19:08:41.0308 4804  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
19:08:41.0370 4804  Wecsvc - ok
19:08:41.0387 4804  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
19:08:41.0430 4804  wercplsupport - ok
19:08:41.0458 4804  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
19:08:41.0503 4804  WerSvc - ok
19:08:41.0526 4804  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
19:08:41.0569 4804  WfpLwf - ok
19:08:41.0583 4804  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
19:08:41.0599 4804  WIMMount - ok
19:08:41.0635 4804  WinDefend - ok
19:08:41.0654 4804  WinHttpAutoProxySvc - ok
19:08:41.0704 4804  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
19:08:41.0750 4804  Winmgmt - ok
19:08:41.0824 4804  [ BCB1310604AA415C4508708975B3931E ] WinRM           C:\Windows\system32\WsmSvc.dll
19:08:41.0900 4804  WinRM - ok
19:08:41.0947 4804  [ FE88B288356E7B47B74B13372ADD906D ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
19:08:41.0978 4804  WinUsb - ok
19:08:42.0013 4804  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc         C:\Windows\System32\wlansvc.dll
19:08:42.0064 4804  Wlansvc - ok
19:08:42.0081 4804  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
19:08:42.0098 4804  WmiAcpi - ok
19:08:42.0127 4804  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
19:08:42.0177 4804  wmiApSrv - ok
19:08:42.0197 4804  WMPNetworkSvc - ok
19:08:42.0208 4804  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
19:08:42.0236 4804  WPCSvc - ok
19:08:42.0253 4804  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
19:08:42.0275 4804  WPDBusEnum - ok
19:08:42.0295 4804  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
19:08:42.0336 4804  ws2ifsl - ok
19:08:42.0352 4804  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\System32\wscsvc.dll
19:08:42.0391 4804  wscsvc - ok
19:08:42.0397 4804  WSearch - ok
19:08:42.0439 4804  WTService - ok
19:08:42.0521 4804  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll
19:08:42.0588 4804  wuauserv - ok
19:08:42.0625 4804  [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
19:08:42.0665 4804  WudfPf - ok
19:08:42.0685 4804  [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
19:08:42.0712 4804  WUDFRd - ok
19:08:42.0729 4804  [ B20F051B03A966392364C83F009F7D17 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
19:08:42.0758 4804  wudfsvc - ok
19:08:42.0790 4804  [ FE90B750AB808FB9DD8FBB428B5FF83B ] WwanSvc         C:\Windows\System32\wwansvc.dll
19:08:42.0834 4804  WwanSvc - ok
19:08:42.0865 4804  ================ Scan global ===============================
19:08:42.0898 4804  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
19:08:42.0929 4804  [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
19:08:42.0941 4804  [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
19:08:42.0967 4804  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
19:08:43.0000 4804  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
19:08:43.0005 4804  [Global] - ok
19:08:43.0007 4804  ================ Scan MBR ==================================
19:08:43.0021 4804  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
19:08:43.0296 4804  \Device\Harddisk0\DR0 - ok
19:08:43.0302 4804  [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk1\DR1
19:08:43.0689 4804  \Device\Harddisk1\DR1 - ok
19:08:43.0694 4804  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk2\DR2
19:08:44.0104 4804  \Device\Harddisk2\DR2 - ok
19:08:44.0105 4804  ================ Scan VBR ==================================
19:08:44.0122 4804  [ C2AC99F8C65496AF80A07451230959D7 ] \Device\Harddisk0\DR0\Partition1
19:08:44.0123 4804  \Device\Harddisk0\DR0\Partition1 - ok
19:08:44.0131 4804  [ BA0C10BCDAE9E8200BFC90393F03A9BF ] \Device\Harddisk0\DR0\Partition2
19:08:44.0132 4804  \Device\Harddisk0\DR0\Partition2 - ok
19:08:44.0154 4804  [ E431775C6483B9A027263829686DF97A ] \Device\Harddisk0\DR0\Partition3
19:08:44.0156 4804  \Device\Harddisk0\DR0\Partition3 - ok
19:08:44.0161 4804  [ DA5DEF75BB81028110FDB12E54669DC1 ] \Device\Harddisk1\DR1\Partition1
19:08:44.0165 4804  \Device\Harddisk1\DR1\Partition1 - ok
19:08:44.0169 4804  [ 192A0AEB188AE727484B2C87C1DBEA08 ] \Device\Harddisk2\DR2\Partition1
19:08:44.0170 4804  \Device\Harddisk2\DR2\Partition1 - ok
19:08:44.0172 4804  ============================================================
19:08:44.0173 4804  Scan finished
19:08:44.0173 4804  ============================================================
19:08:44.0192 5068  Detected object count: 3
19:08:44.0192 5068  Actual detected object count: 3
19:11:47.0166 5068  AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - skipped by user
19:11:47.0166 5068  AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 
19:11:47.0168 5068  Macromedia Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user
19:11:47.0169 5068  Macromedia Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 
19:11:47.0171 5068  SwitchBoard ( UnsignedFile.Multi.Generic ) - skipped by user
19:11:47.0171 5068  SwitchBoard ( UnsignedFile.Multi.Generic ) - User select action: Skip 
19:12:12.0921 4504  Deinitialize success
         

Böni

Hi,
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hiere kommt nun die Combofix-Log-Datei:



Combofix Logfile:
Combofix Logfile:

ComboFix 13-06-15.01 - Bernd 16.06.2013  19:27:28.1.2 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.2047.878 [GMT 2:00]
ausgeführt von:: c:\users\Arbeitskonto Bernd\Desktop\ComboFix.exe
AV: Kaspersky PURE 2.0 *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
FW: Kaspersky PURE 2.0 *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
SP: Kaspersky PURE 2.0 *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-05-16 bis 2013-06-16  ))))))))))))))))))))))))))))))
.
.
2013-06-16 17:37 . 2013-06-16 17:37	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2013-06-16 17:37 . 2013-06-16 17:37	--------	d-----w-	c:\users\UpdatusUser.BERNDS-PC\AppData\Local\temp
2013-06-14 06:01 . 2013-05-13 06:37	9460464	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{67DBE121-15AD-447D-8AC8-20BDEB6A7177}\mpengine.dll
2013-06-12 06:18 . 2013-05-08 06:39	1910632	----a-w-	c:\windows\system32\drivers\tcpip.sys
2013-06-12 06:18 . 2013-04-26 05:51	751104	----a-w-	c:\windows\system32\win32spl.dll
2013-06-07 17:57 . 2013-06-07 17:57	--------	d-----w-	c:\users\Arbeitskonto Bernd\AppData\Local\Apple
2013-06-06 14:00 . 2013-06-06 14:00	--------	d-----w-	c:\users\Arbeitskonto Bernd\AppData\Local\Apple Computer
2013-06-06 14:00 . 2013-06-06 14:00	--------	d-----w-	c:\users\Arbeitskonto Bernd\AppData\Roaming\Apple Computer
2013-06-06 13:59 . 2013-06-06 13:59	--------	d-----w-	c:\program files (x86)\Safari
2013-06-06 13:58 . 2013-06-06 13:58	--------	d-----w-	c:\users\Bernd\AppData\Local\Apple
2013-06-06 13:58 . 2013-06-06 13:58	--------	d-----w-	c:\program files (x86)\Apple Software Update
2013-06-06 13:58 . 2013-06-06 13:58	--------	d-----w-	c:\programdata\Apple
2013-05-31 07:58 . 2013-05-31 07:58	262552	----a-w-	c:\program files (x86)\Mozilla Firefox\browser\components\browsercomps.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-13 18:42 . 2012-09-26 04:36	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-13 18:42 . 2012-09-26 04:36	692104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-12 07:55 . 2012-10-05 09:49	75825640	----a-w-	c:\windows\system32\MRT.exe
2013-05-13 10:40 . 2013-05-13 10:40	636760	----a-w-	c:\windows\system32\drivers\klif.sys
2013-05-09 08:52 . 2013-05-09 08:52	53248	----a-r-	c:\users\Bernd\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2013-05-09 08:52 . 2013-05-09 08:52	18960	----a-w-	c:\windows\system32\drivers\LNonPnP.sys
2013-05-02 00:06 . 2010-11-21 03:27	278800	------w-	c:\windows\system32\MpSigStub.exe
2013-04-29 09:20 . 2013-04-29 09:20	108448	----a-w-	c:\windows\system32\WindowsAccessBridge-64.dll
2013-04-29 09:20 . 2013-04-29 09:21	311200	----a-w-	c:\windows\system32\javaws.exe
2013-04-29 09:20 . 2013-04-29 09:20	188832	----a-w-	c:\windows\system32\javaw.exe
2013-04-29 09:20 . 2013-04-29 09:20	188320	----a-w-	c:\windows\system32\java.exe
2013-04-29 09:20 . 2012-10-04 09:25	971680	----a-w-	c:\windows\system32\deployJava1.dll
2013-04-29 09:20 . 2012-10-04 09:25	1092512	----a-w-	c:\windows\system32\npdeployJava1.dll
2013-04-13 05:49 . 2013-05-16 06:43	135168	----a-w-	c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-16 06:43	350208	----a-w-	c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-16 06:43	308736	----a-w-	c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-16 06:43	111104	----a-w-	c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-16 06:43	474624	----a-w-	c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-16 06:43	2176512	----a-w-	c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 06:15	1656680	----a-w-	c:\windows\system32\drivers\ntfs.sys
2013-04-10 06:01 . 2013-05-16 06:43	265064	----a-w-	c:\windows\system32\drivers\dxgmms1.sys
2013-04-10 06:01 . 2013-05-16 06:43	983400	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2013-04-10 03:30 . 2013-05-16 06:42	3153920	----a-w-	c:\windows\system32\win32k.sys
2013-03-29 19:42 . 2013-05-09 08:48	3379272	----a-w-	c:\windows\system32\drivers\RTKVHD64.sys
2013-03-29 17:28 . 2013-03-29 17:28	95648	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-03-29 17:27 . 2012-10-04 09:09	861088	----a-w-	c:\windows\SysWow64\npDeployJava1.dll
2013-03-29 17:27 . 2012-10-04 09:09	782240	----a-w-	c:\windows\SysWow64\deployJava1.dll
2013-03-29 16:04 . 2013-05-09 08:48	21170176	----a-w-	c:\windows\system32\RCoRes64.dat
2013-03-29 15:52 . 2013-05-09 08:48	914992	----a-w-	c:\windows\system32\SFSS_APO.dll
2013-03-27 14:57 . 2013-05-09 08:48	135240	----a-w-	c:\windows\system32\RCoInstII64.dll
2013-03-26 15:06 . 2013-05-09 08:48	2797128	----a-w-	c:\windows\system32\RtPgEx64.dll
2013-03-26 15:04 . 2013-05-09 08:47	2734624	----a-w-	c:\windows\system32\FMAPO64.dll
2013-03-26 13:40 . 2013-05-09 08:48	3693128	----a-w-	c:\windows\system32\RtkAPO64.dll
2013-03-26 12:38 . 2013-05-09 08:48	1659464	----a-w-	c:\windows\system32\RTSnMg64.cpl
2013-03-23 01:43 . 2013-05-09 08:47	208072	----a-w-	c:\windows\system32\AERTAC64.dll
2013-03-20 11:17 . 2013-05-09 08:48	9123608	----a-w-	c:\windows\system32\MaxxAudioVnA64.dll
2013-03-20 11:16 . 2013-05-09 08:47	1900312	----a-w-	c:\windows\system32\MaxxAudioRealtek264.dll
2013-03-20 11:16 . 2013-05-09 08:48	2102040	----a-w-	c:\windows\system32\WavesGUILib64.dll
2013-03-20 11:16 . 2013-05-09 08:47	910104	----a-w-	c:\windows\system32\MaxxAudioAPOShell64.dll
2013-03-19 06:04 . 2013-04-10 07:53	5550424	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-03-19 05:53 . 2013-05-16 06:42	48640	----a-w-	c:\windows\system32\wwanprotdim.dll
2013-03-19 05:53 . 2013-05-16 06:42	230400	----a-w-	c:\windows\system32\wwansvc.dll
2013-03-19 05:46 . 2013-04-10 07:53	43520	----a-w-	c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-10 07:53	3968856	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 07:53	3913560	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-10 07:53	6656	----a-w-	c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-10 07:53	112640	----a-w-	c:\windows\system32\smss.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay]
@="{69925D1B-6A0F-4413-861A-81AB98039DB9}"
[HKEY_CLASSES_ROOT\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}]
2013-01-30 11:12	159488	----a-w-	c:\windows\SysWOW64\SSCbFsMntNtf3.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\KAVOverlayIcon]
@="{dd230880-495a-11d1-b064-008048ec2fc5}"
[HKEY_CLASSES_ROOT\CLSID\{dd230880-495a-11d1-b064-008048ec2fc5}]
2012-08-30 20:24	496056	----a-w-	c:\program files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\shellex.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AVMWlanClient"="c:\program files (x86)\avmwlanstick\wlangui.exe" [2010-10-22 2105344]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2013-04-25 1075296]
"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\avp.exe" [2012-08-30 202328]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
"*ForceDelete"="c:\users\Arbeitskonto Bernd\Downloads\adwcleaner.exe" [2013-06-16 648201]
.
c:\users\Arbeitskonto Bernd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{C28617FD-4FE7-4043-AD51-C8132CE90106}"= "c:\windows\SysWOW64\SSCbFsMntNtf3.dll" [2013-01-30 159488]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"EldosMountNotificator"= {C28617FD-4FE7-4043-AD51-C8132CE90106} - c:\windows\SysWOW64\SSCbFsMntNtf3.dll [2013-01-30 159488]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SwitchBoard"=c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys;c:\windows\SYSNATIVE\drivers\avmeject.sys [x]
R3 cxbu1x64;OEM USB Smart Card Reader;c:\windows\system32\DRIVERS\cxbu1x64.sys;c:\windows\SYSNATIVE\DRIVERS\cxbu1x64.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 fwlanusbn;FRITZ!WLAN N;c:\windows\system32\DRIVERS\fwlanusbn.sys;c:\windows\SYSNATIVE\DRIVERS\fwlanusbn.sys [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf_amd64.sys;c:\windows\SYSNATIVE\DRIVERS\psi_mf_amd64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R4 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe;c:\program files (x86)\Secunia\PSI\PSIA.exe [x]
R4 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe;c:\program files (x86)\Secunia\PSI\sua.exe [x]
R4 WTService;WTService;c:\windows\system32\atwtusb.exe;c:\windows\SYSNATIVE\atwtusb.exe [x]
S0 CSCrySec;InfoWatch Encrypt Sector Library driver;c:\windows\system32\DRIVERS\CSCrySec.sys;c:\windows\SYSNATIVE\DRIVERS\CSCrySec.sys [x]
S0 nvamacpi;NVIDIA Away Mode System;c:\windows\system32\DRIVERS\NVAMACPI.sys;c:\windows\SYSNATIVE\DRIVERS\NVAMACPI.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 CSVirtualDiskDrv;InfoWatch Virtual Disk driver;c:\windows\system32\DRIVERS\CSVirtualDiskDrv.sys;c:\windows\SYSNATIVE\DRIVERS\CSVirtualDiskDrv.sys [x]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys;c:\windows\SYSNATIVE\DRIVERS\kl2.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S2 CSObjectsSrv;Verwaltungsservice vom CryproStorage-System;c:\program files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe;c:\program files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys;c:\windows\SYSNATIVE\DRIVERS\LEqdUsb.Sys [x]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys;c:\windows\SYSNATIVE\DRIVERS\LHidEqd.Sys [x]
S3 SSCBFS3;SugarSync CallBack File System driver v3;c:\windows\system32\DRIVERS\sscbfs3.sys;c:\windows\SYSNATIVE\DRIVERS\sscbfs3.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 14211975
*Deregistered* - 14211975
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-06-07 07:10	1165776	----a-w-	c:\program files (x86)\Google\Chrome\Application\27.0.1453.110\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-06-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-26 18:42]
.
2013-06-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-15 05:50]
.
2013-06-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-15 05:50]
.
2013-06-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3566009820-3197285289-3489268995-1003Core.job
- c:\users\Arbeitskonto Bernd\AppData\Local\Google\Update\GoogleUpdate.exe [2013-05-14 12:58]
.
2013-06-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3566009820-3197285289-3489268995-1003UA.job
- c:\users\Arbeitskonto Bernd\AppData\Local\Google\Update\GoogleUpdate.exe [2013-05-14 12:58]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco1]
@="{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}"
[HKEY_CLASSES_ROOT\CLSID\{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}]
2013-05-02 15:16	3932048	----a-w-	c:\program files\Adobe\Adobe Creative Cloud Connection (64 Bit)\CloudSyncExt_v_1_0_500.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco2]
@="{853B7E05-C47D-4985-909A-D0DC5C6D7303}"
[HKEY_CLASSES_ROOT\CLSID\{853B7E05-C47D-4985-909A-D0DC5C6D7303}]
2013-05-02 15:16	3932048	----a-w-	c:\program files\Adobe\Adobe Creative Cloud Connection (64 Bit)\CloudSyncExt_v_1_0_500.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco3]
@="{42D38F2E-98E9-4382-B546-E24E4D6D04BB}"
[HKEY_CLASSES_ROOT\CLSID\{42D38F2E-98E9-4382-B546-E24E4D6D04BB}]
2013-05-02 15:16	3932048	----a-w-	c:\program files\Adobe\Adobe Creative Cloud Connection (64 Bit)\CloudSyncExt_v_1_0_500.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay]
@="{69925D1B-6A0F-4413-861A-81AB98039DB9}"
[HKEY_CLASSES_ROOT\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}]
2013-01-30 11:12	192256	----a-w-	c:\windows\System32\SSCbFsMntNtf3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-04-16 14:10	776144	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-04-16 14:10	776144	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-04-16 14:10	776144	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-04-16 14:10	776144	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\KAVOverlayIcon]
@="{dd230880-495a-11d1-b064-008048ec2fc5}"
[HKEY_CLASSES_ROOT\CLSID\{dd230880-495a-11d1-b064-008048ec2fc5}]
2012-08-30 20:26	566712	----a-w-	c:\program files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\x64\shellex.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncBackedUp]
@="{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}"
[HKEY_CLASSES_ROOT\CLSID\{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}]
2013-06-05 18:50	2157408	----a-w-	c:\program files (x86)\SugarSync\x64\SugarSyncShellExt_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncPending]
@="{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}"
[HKEY_CLASSES_ROOT\CLSID\{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}]
2013-06-05 18:50	2157408	----a-w-	c:\program files (x86)\SugarSync\x64\SugarSyncShellExt_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncRoot]
@="{39D54CC2-69CF-43b4-B167-577D25E7F496}"
[HKEY_CLASSES_ROOT\CLSID\{39D54CC2-69CF-43b4-B167-577D25E7F496}]
2013-06-05 18:50	2157408	----a-w-	c:\program files (x86)\SugarSync\x64\SugarSyncShellExt_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncShared]
@="{1574C9EF-7D58-488F-B358-8B78C1538F51}"
[HKEY_CLASSES_ROOT\CLSID\{1574C9EF-7D58-488F-B358-8B78C1538F51}]
2013-06-05 18:50	2157408	----a-w-	c:\program files (x86)\SugarSync\x64\SugarSyncShellExt_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncSharedPending]
@="{F7395C2E-A5D8-4a32-9536-5C6A9F1DC450}"
[HKEY_CLASSES_ROOT\CLSID\{F7395C2E-A5D8-4a32-9536-5C6A9F1DC450}]
2013-06-05 18:50	2157408	----a-w-	c:\program files (x86)\SugarSync\x64\SugarSyncShellExt_x64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2013-03-29 13513288]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2013-02-21 2991856]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2013-03-21 472992]
"NVRaidService"="c:\program files\NVIDIA Corporation\Raid\nvraidservice.exe" [2010-04-09 291944]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"*WerKernelReporting"="c:\windows\SYSTEM32\WerFault.exe" [2009-07-14 415232]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{C28617FD-4FE7-4043-AD51-C8132CE90106}"= "c:\windows\system32\SSCbFsMntNtf3.dll" [2013-01-30 192256]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~2\Microsoft Office\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\Microsoft Office\Office14\EXCEL.EXE/3000
LSP: c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Bernd\AppData\Roaming\Mozilla\Firefox\Profiles\wuk9gph8.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - ExtSQL: 2013-04-29 14:22; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Bernd\AppData\Roaming\Mozilla\Firefox\Profiles\wuk9gph8.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF - ExtSQL: 2013-05-09 10:51; {F003DA68-8256-4b37-A6C4-350FA04494DF}; c:\program files\Logitech\SetPointP\LogiSmoothFirefoxExt
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
c:\users\Arbeitskonto Bernd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk - c:\users\Bernd\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
SSODL-EldosMountNotificator    REG_SZ    {C28617FD-4FE7-4043-AD51-C8132CE90106}- - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10zo_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10zo_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10zo.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10zo.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10zo.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10zo.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-06-16  19:41:15
ComboFix-quarantined-files.txt  2013-06-16 17:41
.
Vor Suchlauf: 12 Verzeichnis(se), 103.728.500.736 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 103.326.089.216 Bytes frei
.
- - End Of File - - CDEFF20BA045AF2E0DB6AAC692267DA4
         

--- --- ---
--- --- ---
A36C5E4F47E84449FF07ED3517B43A31
[/CODE]

Gruß
Böni

Hi,
malwarebytes:
Downloade Dir bitte Malwarebytes

• Installiere
  das Programm in den vorgegebenen Pfad.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Starte Malwarebytes, klicke auf Aktualisierung --> Suche
  nach Aktualisierung
• Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
• Wenn der Scan beendet
  ist, klicke auf Ergebnisse anzeigen.
• Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
• Poste
  das Logfile, welches sich in Notepad öffnet, hier in den Thread.
• Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Log des Malwarebyte-Scans

 Malwarebytes Anti-Malware  (PRO) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.06.16.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Bernd :: BERNDS-PC [Administrator]

Schutz: Deaktiviert

16.06.2013 20:08:54
mbam-log-2013-06-16 (20-08-54).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|G:\|H:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 677251
Laufzeit: 2 Stunde(n), 38 Minute(n), 14 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
G:\Downloads\agsetup183se.exe (PUP.Funmoods) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

Hi,

nur zur Info:
Bislang laden sich noch immer beim Öffnen von Chrome beide Programme (Sm.de;Delta-search) fleißig mit auf den Schirm ....

Immer mit der Ruhe, dass kommt jetzt drann.

lade den CCleaner standard:
CCleaner - Download - Filepony
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

7-Zip 9.20 (x64 edition)	Igor Pavlov	27.09.2012	4,53MB	9.20.00.0                              (notwendig)
ABBYY FineReader 8.0 Professional Edition	ABBYY Software House	26.09.2012	250MB	8.00.1095.4743 (notwendig)
Adobe AIR	Adobe Systems Incorporated	05.04.2013		3.6.0.6090                             (notwendig)
Adobe Creative Cloud Connection	Adobe Systems Incorporated	30.04.2013	15,1MB	1.0.223.0              (notwendig)
Adobe Edge Animate	Adobe Systems Incorporated	30.04.2013	217MB	1.5                            (notwendig)
Adobe Edge Inspect	Adobe Systems Incorporated	30.04.2013	65,3MB	1.0.388                        (notwendig)
Adobe Edge Reflow Preview	Adobe Systems Incorporated	30.04.2013	54,1MB	0.12.9232              (notwendig)
Adobe Exchange Panel	Adobe Systems Incorporated	30.04.2013	45,3MB	1                              (unbekannt)
Adobe Flash Player 10 ActiveX	Adobe Systems Incorporated	05.04.2013	6,00MB	10.3.183.68            (unbekannt)
Adobe Flash Player 11 Plugin	Adobe Systems Incorporated	13.06.2013	6,00MB	11.7.700.224           (notwendig)
Adobe Help Manager	Adobe Systems Incorporated	05.04.2013		4.0.244                        (notwendig)
Adobe Photoshop CS6	Adobe Systems Incorporated	30.04.2013	2,92GB	13.0                           (notwendig)
Adobe Reader X (10.1.7) - Deutsch	Adobe Systems Incorporated	16.05.2013	121MB	10.1.7         (notwendig)
Adobe Touch App Plugins	Adobe Systems Incorporated	30.04.2013	3,41MB	1.0                            (unbekannt)
Adobe Widget Browser	Adobe Systems Incorporated.	05.04.2013		2.0 Build 348                  (unbekannt)
Apple Software Update	Apple Inc.	06.06.2013	2,38MB	2.1.3.127                                (nicht notwendig)
Ashampoo Burning Studio 6 FREE v.6.81	Ashampoo GmbH & Co. KG	01.11.2012	34,0MB	6.8.1                  (notwendig)
Ashampoo Snap 5 v.5.1.5	Ashampoo GmbH & Co. KG	27.01.2013	43,4MB	5.1.5                                  (notwendig)
Audacity 2.0.2	Audacity Team	27.09.2012	43,5MB	2.0.2                                                  (notwendig)
Audiograbber 1.83 SE	Audiograbber	27.09.2012		1.83 SE                                  (nicht notwendig) 
Audiograbber MP3-Plugin (64 bit)	AG	27.09.2012		1.0                              (nicht notwendig)
AVM FRITZ!WLAN	AVM Berlin	04.02.2013                                                                     (notwendig)		
AVS Screen Capture version 2.0.1	Online Media Technologies Ltd.	27.09.2012                       (nicht notwendig)		
AVS Update Manager 1.0	Online Media Technologies Ltd.	27.09.2012                                       (nicht notwendig)		
AVS Video Editor 6	Online Media Technologies Ltd.	27.09.2012                                             (notwendig)		
AVS Video Recorder 2.5	Online Media Technologies Ltd.	27.09.2012		                               (notwendig)
AVS4YOU Software Navigator 1.4	Online Media Technologies Ltd.	27.09.2012	                               (notwendig)	
calibre 64bit	Kovid Goyal	12.02.2013	162MB	0.9.18                                           (nicht notwendig)
Canon Easy-PhotoPrint EX		27.09.2012		                                               (notwendig)
Canon iP4800 series Printer Driver		27.09.2012	                                               (notwendig)	
capella 7	capella software AG	15.11.2012	48,5MB	7.1.15                                         (notwendig)
capella-scan 8 Ergänzungswörterbücher	capella-software	17.04.2013	94,7MB	8.1.0                  (notwendig)
capella-scan 8.0	capella-software AG	17.04.2013	106MB	8.0.12                                 (notwendig)
CCleaner	Piriform	24.05.2013		4.02
CD-LabelPrint		27.09.2012		                                                               (notwendig)
CorelDRAW Essentials 4	Corel Corporation	04.03.2013	                                         (nicht notwendig)	
CorelDRAW Essentials 4 - Extra Content	Corel Corporation	04.03.2013		                 (nicht notwendig)
CorelDRAW Essentials 4 - Windows Shell Extension	Corel Corporation	04.03.2013	2,93MB	 (nicht notwendig)
CutePDF Writer 2.9	CutePDF.com	26.09.2012		 2.9                                           (notwendig)
Demo-capella-Vienna-orchestra 1.20		17.04.2013		                                 (nicht notwendig)
Direct MIDI to MP3 Converter Version 7.0.0.0	Piston Software	09.05.2013	14,6MB	7.0.0.0                (notwendig)
Driver Genius	Driver-Soft Inc.	09.05.2013	13,2MB	12.0                                           (notwendig)
FileZilla Client 3.7.0.1	FileZilla Project	14.05.2013	17,6MB	3.7.0.1                        (notwendig)
Finale NotePad 2012	MakeMusic	06.03.2013		2012..r1.1                                     (notwendig)
Free Notes & Office Ink	 	04.03.2013	                                                         (nicht notwendig)	 
G&D StarSign USB Token für ELSTER	Secunet Security Networks AG	11.02.2013	25,9MB	1.2.0          (notwendig)
Google Chrome	Google Inc.	17.06.2013		27.0.1453.110                                    (nicht notwendig)
GPL Ghostscript	Artifex Software Inc.	16.01.2013		9.06                                           (notwendig)
Hear & Play Song Learner Pro	Hear And Play	28.09.2012	2,17MB	                                       (notwendig)
Inkscape 0.48.4		24.01.2013		0.48.4                                                   (nicht notwendig)
Java 7 Update 17	Oracle	29.03.2013	129MB	7.0.170                                          (nicht notwendig)
Java 7 Update 21 (64-bit)	Oracle	29.04.2013	128MB	7.0.210                                  (nicht notwendig)
Kaspersky PURE 2.0	Kaspersky Lab	13.05.2013		12.0.2.733                                     (notwendig)
LAME v3.99.3 (for Windows)		21.10.2012	1,52MB	                                               (notwendig)
Logitech SetPoint 6.52	Logitech	09.05.2013	39,0MB	6.52.74                                  (nicht notwendig)
Macromedia Dreamweaver MX 2004	Macromedia	26.09.2012		7.0                                    (notwendig)
Macromedia Extension Manager	Macromedia	26.09.2012		1.5                              (nicht notwendig)
Malwarebytes Anti-Malware Version 1.75.0.1300	Malwarebytes Corporation	16.06.2013	19,2MB	1.75.0.1300
MatheAss 8.2	MatheAss	27.09.2012	5,91MB	                                                       (notwendig)
Mein CEWE FOTOBUCH	CEWE COLOR AG u Co. OHG	08.12.2012	266MB	5.0.1                                  (notwendig)
Microsoft .NET Framework 4 Client Profile	Microsoft Corporation	27.09.2012	38,8MB	4.0.30319      (unbekannt)
Microsoft .NET Framework 4 Client Profile DEU Language Pack	Microsoft Corporation	27.09.2012	2,93MB	4.0.30319(unbekannt)
Microsoft .NET Framework 4 Extended	Microsoft Corporation	17.05.2013	51,9MB	4.0.30319              (unbekannt)
Microsoft Office Home and Student 2010	Microsoft Corporation	15.04.2013		14.0.6029.1000         (unbekannt)
Microsoft Visual C++ 2005 Redistributable	Microsoft Corporation	27.09.2012	300KB	8.0.61001      (unbekannt)
Microsoft Visual C++ 2005 Redistributable (x64)	Microsoft Corporation	31.01.2013	572KB	8.0.61000      (unbekannt)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148	Microsoft Corporation	31.01.2013	240KB	9.0.30729.4148(unbekannt)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161	Microsoft Corporation	26.09.2012	788KB	9.0.30729.6161(unbekannt)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729	Microsoft Corporation	08.12.2012	234KB	9.0.30729(unbekannt)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17	Microsoft Corporation	28.10.2012	240KB	9.0.30729(unbekannt)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148	Microsoft Corporation	18.01.2013	228KB	9.0.30729.4148(unbekannt)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161	Microsoft Corporation	26.09.2012	600KB	9.0.30729.6161(unbekannt)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219	Microsoft Corporation	01.02.2013	13,8MB	10.0.40219(unbekannt)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219	Microsoft Corporation	19.01.2013	15,0MB	10.0.40219(unbekannt)
MIDI4all	Webdesign-Forum.de	27.09.2012		MIDI4all 1.5                             (nicht notwendig)
Mozilla Firefox 21.0 (x86 de)	Mozilla	31.05.2013	44,9MB	21.0                                           (notwendig)
Mozilla Maintenance Service	Mozilla	31.05.2013	333KB	21.0                                           (unbekannt)
Mozilla Thunderbird 17.0.5 (x86 de)	Mozilla	05.04.2013	41,9MB	17.0.5                                 (notwendig)
NAVIGON Fresh 3.4.1	NAVIGON	28.10.2012		3.4.1                                                  (notwendig)
Notepad++	Notepad++ Team	15.05.2013		6.3.3                                                  (notwendig)
NVIDIA Display Control Panel	NVIDIA Corporation	13.06.2013	135MB	6.14.11.9713                   (notwendig)
NVIDIA Drivers	NVIDIA Corporation	13.06.2013	67,0MB	1.10.62.40                                     (notwendig)
NVIDIA ForceWare Network Access Manager	NVIDIA Corporation	13.06.2013		1.00.7325.0            (unbekannt)
NVIDIA Grafiktreiber 307.83	NVIDIA Corporation	05.04.2013		307.83                         (notwendig)
NVIDIA MediaShield	NVIDIA Corporation	13.06.2013		11.1.0.43                              (unbekannt)
NVIDIA Update 1.10.8	NVIDIA Corporation	05.04.2013		1.10.8                                 (notwendig)
OpenOffice.org 3.4.1	Apache Software Foundation	26.09.2012	331MB	3.41.9593                      (notwendig)
PDF-Viewer	Tracker Software Products Ltd	05.04.2013	54,9MB	2.5.210.0                              (notwendig)
Realtek High Definition Audio Driver	Realtek Semiconductor Corp.	09.05.2013		6.0.1.6873(nicht notwendig)
Safari	Apple Inc.	06.06.2013	104MB	5.34.57.2                                                (nicht notwendig)
Secunia PSI (3.0.0.6005)	Secunia	05.04.2013	5,92MB	3.0.0.6005                               (nicht notwendig)
SugarSync	SugarSync, Inc.	16.06.2013		2.0.24.113934                                    (nicht notwendig)
Tablet Driver With Macrokey Manager		04.03.2013		4.13                                   (notwendig)
Ulead PhotoImpact 11	Ulead System	26.09.2012		11.0                                           (notwendig)
USB CCID Smartcard Reader - Version 1.2.1.2	USB CCID	11.02.2013	128KB	3.0.0.1                (notwendig)
VLC media player 2.0.6	VideoLAN	29.04.2013		2.0.6                                          (notwendig)
Winamp	Nullsoft, Inc	17.01.2013		5.63                                                           (notwendig)
Winamp Erkennungs-Plug-in	Nullsoft, Inc	17.01.2013	75,0KB	1.0.0.1                                (unbekannt)
         

bdeinstaliere:
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden, instalieren.
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen
bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
Sicherheit (erweitert)
Erweiterte Sicherheit anhaken
und alle Dateien auswählen.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
Audiograbber : alle
calibre
Corel: alle
Demo

Free Notes
Google Chrome
Inkscape
Java 7 Update 17
MIDI4all
Safari
SugarSync

Öffne CCleaner, analysieren, starten, PC neustarten
Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

AdwCleaner Logfile:

# AdwCleaner v2.303 - Datei am 18/06/2013 um 17:23:49 erstellt
# Aktualisiert am 08/06/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : Bernd - BERNDS-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Arbeitskonto Bernd\Downloads\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16490

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v21.0 (de)

Datei : C:\Users\Bernd\AppData\Roaming\Mozilla\Firefox\Profiles\wuk9gph8.default\prefs.js

[OK] Die Datei ist sauber.

Datei : C:\Users\Arbeitskonto Bernd\AppData\Roaming\Mozilla\Firefox\Profiles\9xvjz5ff.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [15204 octets] - [16/06/2013 14:18:50]
AdwCleaner[S3].txt - [936 octets] - [18/06/2013 17:23:49]

########## EOF - \AdwCleaner[S3].txt - [995 octets] ##########
         

--- --- ---


Wegen Löschens von Sugar Sync meckert er mich nun beim Neustart an, er könne irgendwas nicht finden und ich solle Quit drücken. Naja wird sich regeln lassen ...

was ist irgendwas genau...?
HitmanPro - Download - Filepony

Lade bitte Hitmanpro, klicke auf Scan, nichts löschen.
Klicke weiter.
Log speichern und posten, bzw als xml exportieren, packen und anhängen.

HitmanPro 3.7.6.201
www.hitmanpro.com

   Computer name . . . . : BERNDS-PC
   Windows . . . . . . . : 6.1.1.7601.X64/2
   User name . . . . . . : BERNDS-PC\Bernd
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2013-06-18 18:59:42
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 8m 38s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 48

   Objects scanned . . . : 1.675.753
   Files scanned . . . . : 33.354
   Remnants scanned  . . : 573.240 files / 1.069.159 keys

Potential Unwanted Programs _________________________________________________

   HKU\S-1-5-21-3566009820-3197285289-3489268995-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{4D2D3B0F-69BE-477A-90F5-FDDB05357975} (Claro)
   HKU\S-1-5-21-3566009820-3197285289-3489268995-1003\Software\Microsoft\Internet Explorer\Approved Extensions\{4D2D3B0F-69BE-477A-90F5-FDDB05357975} (Claro)
   HKU\S-1-5-21-3566009820-3197285289-3489268995-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}\ (AskBar)
   HKU\S-1-5-21-3566009820-3197285289-3489268995-1003\Software\Microsoft\Internet Explorer\SearchScopes\bProtectorDefaultScope (Claro)
   HKU\S-1-5-21-3566009820-3197285289-3489268995-1003\Software\Microsoft\Windows\CurrentVersion\Ext\BPROTECTSETTINGS\ (Claro)
   HKU\S-1-5-21-3566009820-3197285289-3489268995-1003\Software\Wajam\ (Claro)
         

Irgendwas sieht so aus:

als text posten bitte.
hitmanpro funde löschen lassen.
CCleaner öffnen, extras, autostartliste, windows, als txt speichern und posten.

Text der Fehlermeldung: " The application resources could not be reloaded and the application must quit. Please try relaunching the application."

Wie soll ich die Hitmanpro Funde löschen lassen? Da ist kein Befehl nach dem Scan.

CCleaner Txt-Datei wie beschrieben:

Ja	HKCU:Run	AshSnap		C:\Program Files (x86)\Ashampoo\Ashampoo Snap 5\ashsnap.exe
Ja	HKCU:Run	Sidebar	Microsoft Corporation	C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
Nein	HKCU:Run	SolidCapture		C:\Program Files (x86)\SolidDocuments\SolidCapture\solidcapture.exe
Ja	HKCU:Run	SugarSync	SugarSync, Inc.	"C:\Program Files (x86)\SugarSync\SugarSync.exe" -startInTray -usedelay=true
Ja	HKLM:Run	Adobe ARM	Adobe Systems Incorporated	"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
Ja	HKLM:Run	AdobeAAMUpdater-1.0	Adobe Systems Incorporated	"C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
Ja	HKLM:Run	AdobeCS6ServiceManager	Adobe Systems Incorporated	"C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
Ja	HKLM:Run	AVMWlanClient	AVM Berlin	C:\Program Files (x86)\avmwlanstick\wlangui.exe
Ja	HKLM:Run	AVP	Kaspersky Lab ZAO	"C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 2.0\avp.exe"
Ja	HKLM:Run	EvtMgr6	Logitech, Inc.	C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
Nein	HKLM:Run	Logitech Download Assistant	Microsoft Corporation	C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
Nein	HKLM:Run	MacrokeyManager		WTMKM.exe
Ja	HKLM:Run	NVRaidService		C:\Program Files\NVIDIA Corporation\Raid\nvraidservice.exe
Ja	HKLM:Run	RTHDVCPL	Realtek Semiconductor	C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
Nein	HKLM:Run	Ulead AutoDetector v2	Ulead Systems, Inc.	C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\monitor.exe
Nein	HKLM:Run	WinampAgent	Nullsoft, Inc.	"C:\Program Files (x86)\Winamp\winampa.exe"
Ja	HKLM:RunOnce	*ForceDelete		C:\Users\Arbeitskonto Bernd\Downloads\adwcleaner.exe /forcedelete
Ja	HKLM:RunOnce	*WerKernelReporting	Microsoft Corporation	%SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq
Ja	HKLM:RunOnce	GrpConv		grpconv -o
Ja	HKLM:RunOnce	 Malwarebytes Anti-Malware 	Malwarebytes Corporation	C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
Ja	HKLM:RunOnce	 Malwarebytes Anti-Malware  (cleanup)	Microsoft Corporation	rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript
Nein	Startup Common	Secunia PSI Tray.lnk	Secunia	C:\PROGRA~2\Secunia\PSI\psi_tray.exe 
Ja	Startup User	OpenOffice.org 3.4.1.lnk		C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe