Trojaner-Board - Phorpiex.B.56 dank Facebook Link

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Phorpiex.B.56 dank Facebook Link (https://www.trojaner-board.de/104658-phorpiex-b-56-dank-facebook-link.html)

Phorpiex.B.56 dank Facebook Link

Hi,

heute Abend war es nun soweit ich hab ohne genau hinzuschauen einen Link bei Facebook angeklickt.Das hinterhältige dran mein Freund ist Hobbyfotograf und ich dachte natürlich es sei eines seiner neuen Bilder.

Ich habe bereits in anderen Threads nach Lösungswegen gesucht da die aber wohl individuel ausfallen können, bin ich mir nicht sicher ob ich ihn schon ganz entfernt habe. Um dem Problem Herr zu werden hab ich Malwarebytes und Eset laufen gelassen. Malwarebytes hat auch einen Fund und diesen entfernt. Seit dem tauchen im Taskmanager auch keine unbekannten Prozesse mehr auf.

So und hier noch OTL Log

OTL logfile created on: 31.10.2011 19:57:25 - Run 5
OTL by OldTimer - Version 3.2.31.0 Folder = H:\
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

4,00 Gb Total Physical Memory | 2,34 Gb Available Physical Memory | 58,46% Memory free
8,00 Gb Paging File | 6,11 Gb Available in Paging File | 76,40% Paging File free
Paging file location(s): h:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 59,53 Gb Total Space | 34,44 Gb Free Space | 57,86% Space Free | Partition Type: NTFS
Drive D: | 405,70 Gb Total Space | 198,06 Gb Free Space | 48,82% Space Free | Partition Type: NTFS
Drive H: | 60,06 Gb Total Space | 54,86 Gb Free Space | 91,35% Space Free | Partition Type: NTFS

Computer Name: MARC-PC | User Name: Marc | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - H:\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe (Sony Ericsson)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanionInfo.exe ()
PRC - C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\RocketDock\RocketDock.exe ()

========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\MExplorer.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PhoneUpdate.dll ()
MOD - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanionInfo.exe ()
MOD - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\TMonitorAPI.dll ()
MOD - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\Report.dll ()
MOD - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\VObject.dll ()
MOD - C:\Windows\SysWOW64\APOMngr.DLL ()
MOD - C:\Windows\SysWOW64\CmdRtr.DLL ()
MOD - C:\Windows\SysWOW64\OemSpiE.dll ()
MOD - C:\Program Files (x86)\RocketDock\RocketDock.exe ()
MOD - C:\Program Files (x86)\RocketDock\RocketDock.dll ()

========== Win32 Services (SafeList) ==========

SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (NisSrv) -- C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (Creative ALchemy AL6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (Futuremark SystemInfo Service) -- C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe (Futuremark Corporation)
SRV - (OpenVPNService) -- C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe ()
SRV - (Sony Ericsson PCCompanion) -- C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe (Avanquest Software)
SRV - (LBTServ) -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (ggsemc) -- C:\Windows\SysNative\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)
DRV:64bit: - (ggflt) -- C:\Windows\SysNative\drivers\ggflt.sys (Sony Ericsson Mobile Communications)
DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (LGBusEnum) -- C:\Windows\SysNative\drivers\LGBusEnum.sys (Logitech Inc.)
DRV:64bit: - (LGVirHid) -- C:\Windows\SysNative\drivers\LGVirHid.sys (Logitech Inc.)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (tapoas) -- C:\Windows\SysNative\drivers\tapoas.sys (The OpenVPN Project)
DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (LHidFilt) -- C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LMouFilt) -- C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (NisDrv) -- C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (P17) -- C:\Windows\SysNative\drivers\P17.sys (Creative Technology Ltd.)
DRV:64bit: - (AtcL001) -- C:\Windows\SysNative\drivers\l160x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 07 1D 90 4E BE 73 CC 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.google.de"

FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.09.17 22:46:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.09.30 16:52:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.10.26 16:02:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.09.15 19:52:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins

[2011.09.15 19:07:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Marc\AppData\Roaming\mozilla\Extensions
[2011.10.25 16:00:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Marc\AppData\Roaming\mozilla\Firefox\Profiles\kmpcm7l3.default\extensions
[2011.10.26 16:02:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.09.15 22:19:10 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}
[2011.10.26 16:02:53 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
() (No name found) -- C:\USERS\MARC\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\KMPCM7L3.DEFAULT\EXTENSIONS\{097D3191-E6FA-4728-9826-B533D755359D}.XPI
() (No name found) -- C:\USERS\MARC\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\KMPCM7L3.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
() (No name found) -- C:\USERS\MARC\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\KMPCM7L3.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.09.30 16:52:09 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.10.03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.09.30 16:52:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.09.30 16:52:08 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.09.30 16:52:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.09.30 16:52:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.09.30 16:52:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.09.30 16:52:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2011.10.07 17:24:37 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [P17RunE] C:\Windows\SysWow64\P17RunE.dll (Creative Technology Ltd.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [RocketDock] C:\Program Files (x86)\RocketDock\RocketDock.exe ()
O4 - HKCU..\Run: [Sony Ericsson PC Companion] C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe (Sony Ericsson)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 10.2.0)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{19597666-D70E-4F7B-A1FA-00C4AE18A231}: DhcpNameServer = 95.141.192.4
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{94E48E46-75F2-46F8-B123-15B80B84EC43}: DhcpNameServer = 192.168.178.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.10.31 19:07:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2011.10.31 19:01:45 | 000,000,000 | ---D | C] -- C:\Users\Marc\AppData\Roaming\Malwarebytes
[2011.10.31 19:01:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.10.31 19:01:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.10.31 19:01:17 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.10.31 19:01:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.10.31 18:37:39 | 000,055,384 | ---- | C] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
[2011.10.31 18:34:56 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE
[2011.10.31 18:34:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
[2011.10.31 18:34:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lavasoft
[2011.10.31 18:01:33 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011.10.31 17:48:41 | 000,000,000 | RHSD | C] -- C:\Users\Marc\M-1-52-5782-8752-5245
[2011.10.28 16:09:02 | 001,490,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WdfCoInstaller01007.dll
[2011.10.28 16:09:02 | 000,027,176 | ---- | C] (Sony Ericsson Mobile Communications) -- C:\Windows\SysNative\drivers\ggsemc.sys
[2011.10.28 16:09:02 | 000,013,352 | ---- | C] (Sony Ericsson Mobile Communications) -- C:\Windows\SysNative\drivers\ggflt.sys
[2011.10.20 21:07:20 | 000,000,000 | ---D | C] -- C:\Users\Marc\Documents\Might & Magic Heroes VI
[2011.10.20 21:07:20 | 000,000,000 | ---D | C] -- C:\Users\Marc\AppData\Roaming\Might & Magic Heroes VI
[2011.10.20 20:58:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft
[2011.10.20 20:42:29 | 000,270,912 | ---- | C] (DT Soft Ltd) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys
[2011.10.20 20:42:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DAEMON Tools Lite
[2011.10.20 20:41:23 | 000,000,000 | ---D | C] -- C:\Users\Marc\AppData\Roaming\DAEMON Tools Lite
[2011.10.20 20:41:20 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite
[2011.10.16 21:35:51 | 000,000,000 | ---D | C] -- C:\Users\Marc\AppData\Local\TQVault
[2011.10.16 21:35:12 | 000,000,000 | ---D | C] -- C:\Users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TQVault
[2011.10.16 21:00:16 | 000,000,000 | ---D | C] -- C:\Users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Soul's Software
[2011.10.15 14:41:08 | 000,000,000 | ---D | C] -- C:\Users\Marc\Documents\4A Games
[2011.10.15 14:40:25 | 000,000,000 | ---D | C] -- C:\Users\Marc\AppData\Local\4A Games
[2011.10.15 14:36:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation
[2011.10.15 14:36:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2011.10.14 02:00:36 | 000,096,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2011.10.14 02:00:36 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2011.10.14 02:00:35 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2011.10.14 02:00:35 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2011.10.14 02:00:34 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2011.10.14 02:00:33 | 002,309,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2011.10.14 02:00:33 | 000,818,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2011.10.14 02:00:33 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2011.10.14 02:00:33 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2011.10.13 12:08:47 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisdecd.dll
[2011.10.13 12:08:47 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisdecd.dll
[2011.10.13 12:08:47 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisrndr.ax
[2011.10.13 12:08:46 | 000,108,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisrndr.ax
[2011.10.13 12:08:35 | 000,861,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll
[2011.10.13 12:08:35 | 000,331,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleacc.dll
[2011.10.11 20:05:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony Ericsson
[2011.10.11 20:05:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony Ericsson
[2011.10.11 20:05:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony Ericsson
[2011.10.10 20:53:18 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2011.10.10 20:52:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2011.10.10 20:51:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies
[2011.10.10 20:51:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2011.10.10 20:51:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies
[2011.10.10 20:50:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2011.10.10 20:50:00 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2011.10.10 20:49:57 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2011.10.10 20:45:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Phyxion.net
[2011.10.10 20:45:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Phyxion.net
[2011.10.09 17:32:23 | 000,000,000 | ---D | C] -- C:\Users\Marc\AppData\Local\ID Software
[2011.10.09 17:27:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Futuremark
[2011.10.07 17:25:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN
[2011.10.07 17:20:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenVPN Technologies
[2011.10.07 06:21:40 | 010,207,232 | ---- | C] (ATI Technologies Inc.) -- C:\Windows\SysNative\drivers\atikmdag.sys
[2011.10.07 04:47:08 | 024,996,864 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atio6axx.dll
[2011.10.07 04:33:56 | 000,159,744 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atiapfxx.exe
[2011.10.07 04:33:44 | 000,736,768 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\aticfx32.dll
[2011.10.07 04:32:12 | 000,867,328 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\aticfx64.dll
[2011.10.07 04:29:24 | 000,466,944 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\ATIDEMGX.dll
[2011.10.07 04:29:10 | 000,487,936 | ---- | C] (AMD) -- C:\Windows\SysNative\atieclxx.exe
[2011.10.07 04:28:34 | 000,204,288 | ---- | C] (AMD) -- C:\Windows\SysNative\atiesrxx.exe
[2011.10.07 04:27:18 | 000,120,320 | ---- | C] (AMD) -- C:\Windows\SysNative\atitmm64.dll
[2011.10.07 04:27:00 | 000,423,424 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysNative\atipdl64.dll
[2011.10.07 04:26:54 | 000,356,352 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysWow64\atipdlxx.dll
[2011.10.07 04:26:42 | 000,278,528 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysWow64\Oemdspif.dll
[2011.10.07 04:26:36 | 000,021,504 | ---- | C] (AMD) -- C:\Windows\SysNative\atimuixx.dll
[2011.10.07 04:26:32 | 000,059,392 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysNative\atiedu64.dll
[2011.10.07 04:26:26 | 000,043,520 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysWow64\ati2edxx.dll
[2011.10.07 04:25:04 | 018,836,992 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysWow64\atioglxx.dll
[2011.10.07 04:23:22 | 004,231,680 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atidxx32.dll
[2011.10.07 04:12:56 | 004,960,768 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atidxx64.dll
[2011.10.07 04:01:18 | 004,289,024 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiumdag.dll
[2011.10.07 03:54:32 | 005,431,808 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiumd64.dll
[2011.10.07 03:53:10 | 000,051,200 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticalrt64.dll
[2011.10.07 03:53:08 | 000,046,080 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticalrt.dll
[2011.10.07 03:52:58 | 000,044,544 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticalcl64.dll
[2011.10.07 03:52:56 | 000,044,032 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticalcl.dll
[2011.10.07 03:52:46 | 009,809,920 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticaldd64.dll
[2011.10.07 03:49:02 | 008,390,656 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticaldd.dll
[2011.10.07 03:46:48 | 000,479,744 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atiadlxx.dll
[2011.10.07 03:46:40 | 000,335,872 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysWow64\atiadlxy.dll
[2011.10.07 03:46:26 | 000,017,408 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atig6pxx.dll
[2011.10.07 03:46:22 | 000,014,336 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiglpxx.dll
[2011.10.07 03:46:22 | 000,014,336 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiglpxx.dll
[2011.10.07 03:46:18 | 000,039,936 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atig6txx.dll
[2011.10.07 03:46:10 | 000,032,768 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atigktxx.dll
[2011.10.07 03:46:02 | 000,317,952 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\drivers\atikmpag.sys
[2011.10.07 03:45:12 | 000,040,960 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiuxp64.dll
[2011.10.07 03:45:06 | 000,031,744 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiuxpag.dll
[2011.10.07 03:45:00 | 000,038,912 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiu9p64.dll
[2011.10.07 03:44:52 | 000,029,184 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiu9pag.dll
[2011.10.07 03:44:18 | 000,053,248 | ---- | C] (ATI Technologies Inc.) -- C:\Windows\SysNative\drivers\ati2erec.dll
[2011.10.07 03:43:32 | 001,113,088 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiumd6v.dll
[2011.10.07 03:42:56 | 001,828,864 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiumdmv.dll
[2011.10.07 03:42:44 | 004,023,296 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiumd6a.dll
[2011.10.07 03:31:52 | 004,174,848 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiumdva.dll
[2011.10.07 03:14:06 | 000,054,784 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atimpc64.dll
[2011.10.07 03:14:06 | 000,054,784 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\amdpcom64.dll
[2011.10.07 03:14:00 | 000,053,760 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atimpc32.dll
[2011.10.07 03:14:00 | 000,053,760 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\amdpcom32.dll
[2011.10.06 21:30:36 | 016,787,456 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\amdocl64.dll
[2011.10.06 21:29:54 | 013,753,856 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\amdocl.dll
[2011.10.06 21:29:04 | 000,051,200 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2011.10.06 21:29:00 | 000,043,520 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2011.10.02 21:49:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Firefly Studios
[2011.10.02 21:49:42 | 000,178,800 | ---- | C] (Sony DADC Austria AG.) -- C:\Windows\SysWow64\CmdLineExt_x64.dll
[2011.10.02 21:36:24 | 000,000,000 | ---D | C] -- C:\Users\Marc\Documents\Stronghold 2
[2011.10.02 21:24:01 | 000,000,000 | ---D | C] -- C:\Users\Marc\AppData\Local\dxhr
[2011.10.02 21:23:34 | 000,000,000 | ---D | C] -- C:\Users\Marc\AppData\Local\28050
[2011.10.02 13:41:30 | 000,000,000 | ---D | C] -- C:\Users\Marc\Documents\The Lord of the Rings Online
[2011.10.02 13:41:30 | 000,000,000 | ---D | C] -- C:\Users\Marc\AppData\Local\The Lord of the Rings Online
[2011.10.02 11:35:04 | 000,000,000 | ---D | C] -- C:\Users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Serious Sam HD - The Second Encounter
[2011.10.01 22:57:41 | 000,000,000 | ---D | C] -- C:\Windows\pss

========== Files - Modified Within 30 Days ==========

[2011.10.31 19:46:17 | 000,014,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.10.31 19:46:17 | 000,014,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.10.31 19:42:09 | 000,000,168 | ---- | M] () -- C:\Users\Marc\defogger_reenable
[2011.10.31 19:10:15 | 001,648,476 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.10.31 19:10:15 | 000,709,334 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.10.31 19:10:15 | 000,662,952 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.10.31 19:10:15 | 000,153,826 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.10.31 19:10:15 | 000,126,042 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.10.31 19:05:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.10.31 19:01:21 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.10.31 18:42:01 | 000,000,408 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2011.10.31 18:37:39 | 000,055,384 | ---- | M] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
[2011.10.31 18:01:34 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.10.28 16:54:58 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_ggsemc_01007.Wdf
[2011.10.28 16:54:58 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_ggflt_01007.Wdf
[2011.10.28 16:09:02 | 001,490,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WdfCoInstaller01007.dll
[2011.10.28 16:09:02 | 000,027,176 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\Windows\SysNative\drivers\ggsemc.sys
[2011.10.28 16:09:02 | 000,013,352 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\Windows\SysNative\drivers\ggflt.sys
[2011.10.28 16:05:30 | 000,002,268 | ---- | M] () -- C:\Users\Public\Desktop\Sony Ericsson PC Companion 2.0.lnk
[2011.10.20 20:58:47 | 000,001,019 | ---- | M] () -- C:\Users\Public\Desktop\Might & Magic Heroes VI.lnk
[2011.10.20 20:42:30 | 000,270,912 | ---- | M] (DT Soft Ltd) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys
[2011.10.18 22:11:15 | 000,013,352 | ---- | M] () -- C:\Users\Marc\Desktop\Lebenskraftentzug.vault
[2011.10.18 22:08:53 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011.10.17 16:04:28 | 000,275,952 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.10.16 21:35:13 | 000,003,035 | ---- | M] () -- C:\Users\Marc\Desktop\TQVault.lnk
[2011.10.16 21:00:16 | 000,003,065 | ---- | M] () -- C:\Users\Marc\Desktop\TQ Defiler.NET.lnk
[2011.10.14 09:08:08 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011.10.12 17:06:27 | 000,010,443 | ---- | M] () -- C:\Users\Marc\Desktop\sILeNt heLLsCrEAm.nfo
[2011.10.10 20:53:10 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2011.10.07 17:25:23 | 000,001,129 | ---- | M] () -- C:\Users\Public\Desktop\OpenVPN GUI.lnk
[2011.10.07 06:21:40 | 010,207,232 | ---- | M] (ATI Technologies Inc.) -- C:\Windows\SysNative\drivers\atikmdag.sys
[2011.10.07 04:47:08 | 024,996,864 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atio6axx.dll
[2011.10.07 04:34:32 | 000,198,616 | ---- | M] () -- C:\Windows\SysNative\atiapfxx.blb
[2011.10.07 04:33:56 | 000,159,744 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atiapfxx.exe
[2011.10.07 04:33:44 | 000,736,768 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\aticfx32.dll
[2011.10.07 04:32:12 | 000,867,328 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\aticfx64.dll
[2011.10.07 04:29:24 | 000,466,944 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\ATIDEMGX.dll
[2011.10.07 04:29:10 | 000,487,936 | ---- | M] (AMD) -- C:\Windows\SysNative\atieclxx.exe
[2011.10.07 04:28:34 | 000,204,288 | ---- | M] (AMD) -- C:\Windows\SysNative\atiesrxx.exe
[2011.10.07 04:27:18 | 000,120,320 | ---- | M] (AMD) -- C:\Windows\SysNative\atitmm64.dll
[2011.10.07 04:27:00 | 000,423,424 | ---- | M] (ATI Technologies, Inc.) -- C:\Windows\SysNative\atipdl64.dll
[2011.10.07 04:26:54 | 000,356,352 | ---- | M] (ATI Technologies, Inc.) -- C:\Windows\SysWow64\atipdlxx.dll
[2011.10.07 04:26:42 | 000,278,528 | ---- | M] (ATI Technologies, Inc.) -- C:\Windows\SysWow64\Oemdspif.dll
[2011.10.07 04:26:36 | 000,021,504 | ---- | M] (AMD) -- C:\Windows\SysNative\atimuixx.dll
[2011.10.07 04:26:32 | 000,059,392 | ---- | M] (ATI Technologies, Inc.) -- C:\Windows\SysNative\atiedu64.dll
[2011.10.07 04:26:26 | 000,043,520 | ---- | M] (ATI Technologies, Inc.) -- C:\Windows\SysWow64\ati2edxx.dll
[2011.10.07 04:25:04 | 018,836,992 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Windows\SysWow64\atioglxx.dll
[2011.10.07 04:23:22 | 004,231,680 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atidxx32.dll
[2011.10.07 04:12:56 | 004,960,768 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atidxx64.dll
[2011.10.07 04:01:18 | 004,289,024 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiumdag.dll
[2011.10.07 03:54:32 | 005,431,808 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiumd64.dll
[2011.10.07 03:53:10 | 000,051,200 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticalrt64.dll
[2011.10.07 03:53:08 | 000,046,080 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticalrt.dll
[2011.10.07 03:52:58 | 000,044,544 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticalcl64.dll
[2011.10.07 03:52:56 | 000,044,032 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticalcl.dll
[2011.10.07 03:52:46 | 009,809,920 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticaldd64.dll
[2011.10.07 03:49:02 | 008,390,656 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticaldd.dll
[2011.10.07 03:46:48 | 000,479,744 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atiadlxx.dll
[2011.10.07 03:46:40 | 000,335,872 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Windows\SysWow64\atiadlxy.dll
[2011.10.07 03:46:26 | 000,017,408 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atig6pxx.dll
[2011.10.07 03:46:22 | 000,014,336 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiglpxx.dll
[2011.10.07 03:46:22 | 000,014,336 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiglpxx.dll
[2011.10.07 03:46:18 | 000,039,936 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atig6txx.dll
[2011.10.07 03:46:10 | 000,032,768 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atigktxx.dll
[2011.10.07 03:46:02 | 000,317,952 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\drivers\atikmpag.sys
[2011.10.07 03:45:12 | 000,040,960 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiuxp64.dll
[2011.10.07 03:45:06 | 000,031,744 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiuxpag.dll
[2011.10.07 03:45:00 | 000,038,912 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiu9p64.dll
[2011.10.07 03:44:52 | 000,029,184 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiu9pag.dll
[2011.10.07 03:44:18 | 000,053,248 | ---- | M] (ATI Technologies Inc.) -- C:\Windows\SysNative\drivers\ati2erec.dll
[2011.10.07 03:43:32 | 001,113,088 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiumd6v.dll
[2011.10.07 03:42:56 | 001,828,864 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiumdmv.dll
[2011.10.07 03:42:44 | 004,023,296 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiumd6a.dll
[2011.10.07 03:38:42 | 001,847,904 | ---- | M] () -- C:\Windows\SysNative\atiumd6a.cap
[2011.10.07 03:31:52 | 004,174,848 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiumdva.dll
[2011.10.07 03:30:34 | 001,849,344 | ---- | M] () -- C:\Windows\SysWow64\atiumdva.cap
[2011.10.07 03:22:22 | 000,058,880 | ---- | M] (AMD) -- C:\Windows\SysNative\coinst.dll
[2011.10.07 03:14:06 | 000,054,784 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atimpc64.dll
[2011.10.07 03:14:06 | 000,054,784 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\amdpcom64.dll
[2011.10.07 03:14:00 | 000,053,760 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atimpc32.dll
[2011.10.07 03:14:00 | 000,053,760 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\amdpcom32.dll
[2011.10.06 21:30:54 | 000,066,048 | ---- | M] () -- C:\Windows\SysNative\OpenVideo64.dll
[2011.10.06 21:30:48 | 000,056,832 | ---- | M] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011.10.06 21:30:36 | 016,787,456 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\amdocl64.dll
[2011.10.06 21:29:54 | 013,753,856 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\amdocl.dll
[2011.10.06 21:29:04 | 000,051,200 | ---- | M] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2011.10.06 21:29:00 | 000,043,520 | ---- | M] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2011.10.03 04:06:16 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2011.10.03 04:06:15 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2011.10.03 04:06:14 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2011.10.03 04:06:03 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll
[2011.10.02 21:49:42 | 000,178,800 | ---- | M] (Sony DADC Austria AG.) -- C:\Windows\SysWow64\CmdLineExt_x64.dll
[2011.10.02 11:35:04 | 000,000,868 | ---- | M] () -- C:\Users\Marc\Desktop\Serious Sam HD - The Second Encounter.lnk

========== Files Created - No Company Name ==========

[2011.10.31 19:42:09 | 000,000,168 | ---- | C] () -- C:\Users\Marc\defogger_reenable
[2011.10.31 19:01:21 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.10.31 18:41:31 | 000,000,408 | ---- | C] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2011.10.31 18:01:34 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.10.28 16:54:58 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_ggsemc_01007.Wdf
[2011.10.28 16:54:58 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_ggflt_01007.Wdf
[2011.10.20 20:58:47 | 000,001,019 | ---- | C] () -- C:\Users\Public\Desktop\Might & Magic Heroes VI.lnk
[2011.10.18 22:11:15 | 000,013,352 | ---- | C] () -- C:\Users\Marc\Desktop\Lebenskraftentzug.vault
[2011.10.18 22:08:53 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011.10.16 21:35:13 | 000,003,035 | ---- | C] () -- C:\Users\Marc\Desktop\TQVault.lnk
[2011.10.16 21:00:16 | 000,003,065 | ---- | C] () -- C:\Users\Marc\Desktop\TQ Defiler.NET.lnk
[2011.10.13 09:31:37 | 000,010,443 | ---- | C] () -- C:\Users\Marc\Desktop\sILeNt heLLsCrEAm.nfo
[2011.10.13 09:31:36 | 000,036,548 | ---- | C] () -- C:\Users\Marc\Desktop\Play.dll
[2011.10.11 20:05:48 | 000,002,268 | ---- | C] () -- C:\Users\Public\Desktop\Sony Ericsson PC Companion 2.0.lnk
[2011.10.10 20:53:10 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.10.07 17:25:23 | 000,001,129 | ---- | C] () -- C:\Users\Public\Desktop\OpenVPN GUI.lnk
[2011.10.07 04:34:32 | 000,198,616 | ---- | C] () -- C:\Windows\SysNative\atiapfxx.blb
[2011.10.07 03:38:42 | 001,847,904 | ---- | C] () -- C:\Windows\SysNative\atiumd6a.cap
[2011.10.07 03:30:34 | 001,849,344 | ---- | C] () -- C:\Windows\SysWow64\atiumdva.cap
[2011.10.06 21:30:54 | 000,066,048 | ---- | C] () -- C:\Windows\SysNative\OpenVideo64.dll
[2011.10.06 21:30:48 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011.10.02 11:35:04 | 000,000,868 | ---- | C] () -- C:\Users\Marc\Desktop\Serious Sam HD - The Second Encounter.lnk
[2011.10.01 18:10:05 | 000,000,092 | ---- | C] () -- C:\Users\Marc\AppData\Local\fusioncache.dat
[2011.09.17 22:51:57 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2011.09.17 22:51:56 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2011.09.17 22:51:53 | 000,650,752 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2011.09.17 22:51:53 | 000,243,200 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2011.09.17 22:51:53 | 000,074,752 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2011.09.15 19:14:12 | 001,674,774 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.09.15 16:59:39 | 000,177,664 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2011.09.15 16:59:39 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2011.09.15 16:47:57 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2011.09.14 17:23:55 | 000,150,016 | ---- | C] () -- C:\Windows\SysWow64\OemSpiE.dll
[2011.09.14 17:23:53 | 000,002,177 | ---- | C] () -- C:\Windows\P17EP.ini
[2011.09.14 17:23:53 | 000,001,578 | ---- | C] () -- C:\Windows\P17EPLS.ini
[2011.09.14 17:23:53 | 000,001,489 | ---- | C] () -- C:\Windows\P17EP51.ini
[2011.09.14 10:47:40 | 000,053,760 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011.03.17 18:51:44 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

========== LOP Check ==========

[2011.10.29 22:30:26 | 000,000,000 | ---D | M] -- C:\Users\Marc\AppData\Roaming\.minecraft
[2011.10.31 18:02:57 | 000,000,000 | ---D | M] -- C:\Users\Marc\AppData\Roaming\DAEMON Tools Lite
[2011.09.15 19:11:36 | 000,000,000 | ---D | M] -- C:\Users\Marc\AppData\Roaming\Leadertech
[2011.09.15 21:22:11 | 000,000,000 | ---D | M] -- C:\Users\Marc\AppData\Roaming\LolClient
[2011.10.20 21:23:25 | 000,000,000 | ---D | M] -- C:\Users\Marc\AppData\Roaming\Might & Magic Heroes VI
[2011.09.15 19:52:45 | 000,000,000 | ---D | M] -- C:\Users\Marc\AppData\Roaming\Thunderbird
[2011.10.02 15:18:08 | 000,000,000 | ---D | M] -- C:\Users\Marc\AppData\Roaming\TS3Client
[2011.10.31 18:02:57 | 000,000,000 | ---D | M] -- C:\Users\Marc\AppData\Roaming\uTorrent
[2011.10.31 18:42:01 | 000,000,408 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Weekly).job
[2009.07.14 06:08:49 | 000,020,538 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*. >
[2011.09.15 16:43:22 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.09.15 16:43:08 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2011.09.17 17:42:25 | 000,000,000 | ---D | M] -- C:\Guild Wars
[2011.09.15 16:46:54 | 000,000,000 | ---D | M] -- C:\Intel
[2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.10.31 18:01:33 | 000,000,000 | R--D | M] -- C:\Program Files
[2011.10.31 19:07:26 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2011.10.31 19:01:20 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2011.09.15 16:43:08 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.09.15 16:43:08 | 000,000,000 | -HSD | M] -- C:\Recovery
[2011.10.31 19:50:17 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.09.15 16:43:15 | 000,000,000 | R--D | M] -- C:\Users
[2011.10.31 18:03:59 | 000,000,000 | ---D | M] -- C:\Windows

< %PROGRAMFILES%\*.exe >

< %LOCALAPPDATA%\*.exe >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.manifest /3 >

< MD5 for: EXPLORER.EXE >
[2011.02.26 07:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011.02.26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009.08.03 07:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010.11.20 14:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011.02.26 07:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009.08.03 07:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe

< MD5 for: REGEDIT.EXE >
[2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe
[2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe
[2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe
[2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe

< MD5 for: USERINIT.EXE >
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WININIT.EXE >
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

< MD5 for: WINLOGON.EXE >
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< >

< End of report >

Gruss,
Marc

Zitat:

Malwarebytes hat auch einen Fund und diesen entfernt.

Bitte alle Logs davon posten

So hier nochmal fix Logs einmal mit Befund und kurz darauf noch einmal dazwischen war ein Neustart

Zitat:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8052

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

31.10.2011 19:04:03
mbam-log-2011-10-31 (19-04-03).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 168321
Laufzeit: 47 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\Marc\m-1-52-5782-8752-5245\winsvc.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Zitat:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8052

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

31.10.2011 19:06:49
mbam-log-2011-10-31 (19-06-49).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 168102
Laufzeit: 56 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Wünchse noch eine gute Nacht

Bitte nun routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Hier die Logs

Zitat:

Malwarebytes' Anti-Malware 1.51.2.1300
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 8061

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

01.11.2011 18:01:20
mbam-log-2011-11-01 (18-01-20).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|H:\|)
Durchsuchte Objekte: 309791
Laufzeit: 20 Minute(n), 59 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

und hier ESET

Zitat:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=92a3118b0a64414c93dc9858a0bd1702
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-11-01 07:31:08
# local_time=2011-11-01 08:31:08 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 3289168 71802696 0 0
# compatibility_mode=8192 67108863 100 0 9458 9458 0 0
# scanned=153436
# found=0
# cleaned=0
# scan_time=3022

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

MOD - C:\Windows\SysWOW64\APOMngr.DLL ()

MOD - C:\Windows\SysWOW64\CmdRtr.DLL ()

MOD - C:\Windows\SysWOW64\OemSpiE.dll ()

O32 - HKLM CDRom: AutoRun - 1

[2011.10.31 17:48:41 | 000,000,000 | RHSD | C] -- C:\Users\Marc\M-1-52-5782-8752-5245

[2011.10.02 21:24:01 | 000,000,000 | ---D | C] -- C:\Users\Marc\AppData\Local\dxhr

[2011.10.02 21:23:34 | 000,000,000 | ---D | C] -- C:\Users\Marc\AppData\Local\28050

:Commands

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Hat alles soweit geklappt denk ich mal hier der Log

Zitat:

All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\Users\Marc\M-1-52-5782-8752-5245 folder moved successfully.
C:\Users\Marc\AppData\Local\dxhr\cache\data\players folder moved successfully.
C:\Users\Marc\AppData\Local\dxhr\cache\data folder moved successfully.
C:\Users\Marc\AppData\Local\dxhr\cache folder moved successfully.
C:\Users\Marc\AppData\Local\dxhr folder moved successfully.
C:\Users\Marc\AppData\Local\28050\eidos\fc61684c\cache\temp folder moved successfully.
C:\Users\Marc\AppData\Local\28050\eidos\fc61684c\cache\persistent folder moved successfully.
C:\Users\Marc\AppData\Local\28050\eidos\fc61684c\cache folder moved successfully.
C:\Users\Marc\AppData\Local\28050\eidos\fc61684c folder moved successfully.
C:\Users\Marc\AppData\Local\28050\eidos folder moved successfully.
C:\Users\Marc\AppData\Local\28050 folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Marc
->Temp folder emptied: 17195695 bytes
->Temporary Internet Files folder emptied: 1311380 bytes
->Java cache emptied: 10063248 bytes
->FireFox cache emptied: 227019956 bytes
->Flash cache emptied: 1667 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 27702 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 244,00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.31.0 log created on 11012011_213643

Files\Folders moved on Reboot...
C:\Users\Marc\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

So und weiter gehts im Programm hier die nächste Log

Code:

22:07:38.0528 3080        TDSS rootkit removing tool 2.6.14.0 Oct 28 2011 11:11:01

22:07:38.0793 3080        ============================================================

22:07:38.0793 3080        Current date / time: 2011/11/01 22:07:38.0793

22:07:38.0793 3080        SystemInfo:

22:07:38.0793 3080        

22:07:38.0793 3080        OS Version: 6.1.7601 ServicePack: 1.0

22:07:38.0793 3080        Product type: Workstation

22:07:38.0793 3080        ComputerName: MARC-PC

22:07:38.0793 3080        UserName: Marc

22:07:38.0793 3080        Windows directory: C:\Windows

22:07:38.0793 3080        System windows directory: C:\Windows

22:07:38.0793 3080        Running under WOW64

22:07:38.0793 3080        Processor architecture: Intel x64

22:07:38.0793 3080        Number of processors: 2

22:07:38.0793 3080        Page size: 0x1000

22:07:38.0793 3080        Boot type: Normal boot

22:07:38.0793 3080        ============================================================

22:07:38.0934 3080        Initialize success

22:07:42.0958 1816        ============================================================

22:07:42.0958 1816        Scan started

22:07:42.0958 1816        Mode: Manual; SigCheck; TDLFS; 

22:07:42.0958 1816        ============================================================

22:07:43.0161 1816        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys

22:07:43.0192 1816        1394ohci - ok

22:07:43.0208 1816        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys

22:07:43.0208 1816        ACPI - ok

22:07:43.0224 1816        AcpiPmi         (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys

22:07:43.0239 1816        AcpiPmi - ok

22:07:43.0255 1816        adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys

22:07:43.0270 1816        adp94xx - ok

22:07:43.0286 1816        adpahci         (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys

22:07:43.0286 1816        adpahci - ok

22:07:43.0302 1816        adpu320         (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys

22:07:43.0317 1816        adpu320 - ok

22:07:43.0333 1816        AFD             (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys

22:07:43.0348 1816        AFD - ok

22:07:43.0348 1816        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys

22:07:43.0364 1816        agp440 - ok

22:07:43.0380 1816        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys

22:07:43.0380 1816        aliide - ok

22:07:43.0395 1816        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys

22:07:43.0395 1816        amdide - ok

22:07:43.0411 1816        AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys

22:07:43.0426 1816        AmdK8 - ok

22:07:43.0520 1816        amdkmdag        (43bd304bb9f43973a75b37c6d7c88a83) C:\Windows\system32\DRIVERS\atikmdag.sys

22:07:43.0629 1816        amdkmdag - ok

22:07:43.0645 1816        amdkmdap        (783f10e1cb8503b556e5a9df0a264031) C:\Windows\system32\DRIVERS\atikmpag.sys

22:07:43.0645 1816        amdkmdap - ok

22:07:43.0660 1816        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys

22:07:43.0660 1816        AmdPPM - ok

22:07:43.0676 1816        amdsata         (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys

22:07:43.0692 1816        amdsata - ok

22:07:43.0692 1816        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys

22:07:43.0707 1816        amdsbs - ok

22:07:43.0723 1816        amdxata         (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys

22:07:43.0723 1816        amdxata - ok

22:07:43.0738 1816        AppID           (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys

22:07:43.0754 1816        AppID - ok

22:07:43.0770 1816        arc             (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys

22:07:43.0785 1816        arc - ok

22:07:43.0801 1816        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys

22:07:43.0801 1816        arcsas - ok

22:07:43.0816 1816        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

22:07:43.0848 1816        AsyncMac - ok

22:07:43.0848 1816        atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys

22:07:43.0863 1816        atapi - ok

22:07:43.0879 1816        AtcL001         (940e5b876251e04fffe058ad71fe0f1c) C:\Windows\system32\DRIVERS\l160x64.sys

22:07:43.0879 1816        AtcL001 - ok

22:07:43.0894 1816        AtiHDAudioService (dbb487d09f56c674430ac454fd8bcab9) C:\Windows\system32\drivers\AtihdW76.sys

22:07:43.0910 1816        AtiHDAudioService - ok

22:07:43.0926 1816        b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys

22:07:43.0941 1816        b06bdrv - ok

22:07:43.0941 1816        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

22:07:43.0957 1816        b57nd60a - ok

22:07:43.0972 1816        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

22:07:44.0004 1816        Beep - ok

22:07:44.0019 1816        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys

22:07:44.0019 1816        blbdrive - ok

22:07:44.0035 1816        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys

22:07:44.0035 1816        bowser - ok

22:07:44.0050 1816        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys

22:07:44.0066 1816        BrFiltLo - ok

22:07:44.0066 1816        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys

22:07:44.0082 1816        BrFiltUp - ok

22:07:44.0097 1816        Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

22:07:44.0113 1816        Brserid - ok

22:07:44.0113 1816        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

22:07:44.0128 1816        BrSerWdm - ok

22:07:44.0144 1816        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

22:07:44.0144 1816        BrUsbMdm - ok

22:07:44.0160 1816        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

22:07:44.0175 1816        BrUsbSer - ok

22:07:44.0175 1816        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys

22:07:44.0191 1816        BTHMODEM - ok

22:07:44.0206 1816        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

22:07:44.0238 1816        cdfs - ok

22:07:44.0238 1816        cdrom           (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys

22:07:44.0253 1816        cdrom - ok

22:07:44.0269 1816        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys

22:07:44.0284 1816        circlass - ok

22:07:44.0284 1816        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

22:07:44.0300 1816        CLFS - ok

22:07:44.0316 1816        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys

22:07:44.0331 1816        CmBatt - ok

22:07:44.0331 1816        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys

22:07:44.0347 1816        cmdide - ok

22:07:44.0362 1816        CNG             (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys

22:07:44.0378 1816        CNG - ok

22:07:44.0378 1816        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys

22:07:44.0394 1816        Compbatt - ok

22:07:44.0409 1816        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys

22:07:44.0425 1816        CompositeBus - ok

22:07:44.0425 1816        cpuz135 - ok

22:07:44.0440 1816        crcdisk         (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys

22:07:44.0440 1816        crcdisk - ok

22:07:44.0456 1816        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys

22:07:44.0487 1816        DfsC - ok

22:07:44.0503 1816        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

22:07:44.0534 1816        discache - ok

22:07:44.0534 1816        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys

22:07:44.0550 1816        Disk - ok

22:07:44.0565 1816        drmkaud         (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

22:07:44.0565 1816        drmkaud - ok

22:07:44.0581 1816        dtsoftbus01     (d3d64cf7b2bceaa34a270f45a3fffb36) C:\Windows\system32\DRIVERS\dtsoftbus01.sys

22:07:44.0596 1816        dtsoftbus01 - ok

22:07:44.0612 1816        DXGKrnl         (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys

22:07:44.0628 1816        DXGKrnl - ok

22:07:44.0674 1816        ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys

22:07:44.0706 1816        ebdrv - ok

22:07:44.0721 1816        elxstor         (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys

22:07:44.0737 1816        elxstor - ok

22:07:44.0752 1816        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys

22:07:44.0768 1816        ErrDev - ok

22:07:44.0784 1816        exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

22:07:44.0799 1816        exfat - ok

22:07:44.0815 1816        fastfat         (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

22:07:44.0846 1816        fastfat - ok

22:07:44.0862 1816        fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys

22:07:44.0862 1816        fdc - ok

22:07:44.0877 1816        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

22:07:44.0893 1816        FileInfo - ok

22:07:44.0893 1816        Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

22:07:44.0924 1816        Filetrace - ok

22:07:44.0940 1816        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys

22:07:44.0940 1816        flpydisk - ok

22:07:44.0955 1816        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys

22:07:44.0971 1816        FltMgr - ok

22:07:44.0986 1816        FsDepends       (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

22:07:44.0986 1816        FsDepends - ok

22:07:45.0002 1816        Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys

22:07:45.0002 1816        Fs_Rec - ok

22:07:45.0018 1816        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys

22:07:45.0033 1816        fvevol - ok

22:07:45.0049 1816        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys

22:07:45.0049 1816        gagp30kx - ok

22:07:45.0064 1816        ggflt           (a4198f2bd8aa592cb90476277a81b5e1) C:\Windows\system32\DRIVERS\ggflt.sys

22:07:45.0064 1816        ggflt - ok

22:07:45.0080 1816        ggsemc          (d266350bdaab9eb6c1aec370eeaaff3a) C:\Windows\system32\DRIVERS\ggsemc.sys

22:07:45.0080 1816        ggsemc - ok

22:07:45.0096 1816        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

22:07:45.0096 1816        hcw85cir - ok

22:07:45.0111 1816        HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys

22:07:45.0127 1816        HdAudAddService - ok

22:07:45.0142 1816        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys

22:07:45.0158 1816        HDAudBus - ok

22:07:45.0158 1816        HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys

22:07:45.0174 1816        HidBatt - ok

22:07:45.0174 1816        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys

22:07:45.0189 1816        HidBth - ok

22:07:45.0205 1816        HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys

22:07:45.0220 1816        HidIr - ok

22:07:45.0220 1816        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys

22:07:45.0236 1816        HidUsb - ok

22:07:45.0252 1816        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys

22:07:45.0267 1816        HpSAMD - ok

22:07:45.0283 1816        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys

22:07:45.0314 1816        HTTP - ok

22:07:45.0314 1816        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys

22:07:45.0330 1816        hwpolicy - ok

22:07:45.0330 1816        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys

22:07:45.0345 1816        i8042prt - ok

22:07:45.0361 1816        iaStorV         (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys

22:07:45.0376 1816        iaStorV - ok

22:07:45.0392 1816        iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys

22:07:45.0392 1816        iirsp - ok

22:07:45.0408 1816        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys

22:07:45.0408 1816        intelide - ok

22:07:45.0439 1816        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys

22:07:45.0454 1816        intelppm - ok

22:07:45.0454 1816        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys

22:07:45.0486 1816        IpFilterDriver - ok

22:07:45.0501 1816        IPMIDRV         (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys

22:07:45.0501 1816        IPMIDRV - ok

22:07:45.0517 1816        IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

22:07:45.0548 1816        IPNAT - ok

22:07:45.0564 1816        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

22:07:45.0564 1816        IRENUM - ok

22:07:45.0579 1816        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys

22:07:45.0579 1816        isapnp - ok

22:07:45.0595 1816        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys

22:07:45.0610 1816        iScsiPrt - ok

22:07:45.0626 1816        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys

22:07:45.0626 1816        kbdclass - ok

22:07:45.0642 1816        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys

22:07:45.0642 1816        kbdhid - ok

22:07:45.0657 1816        KSecDD          (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys

22:07:45.0673 1816        KSecDD - ok

22:07:45.0673 1816        KSecPkg         (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys

22:07:45.0688 1816        KSecPkg - ok

22:07:45.0704 1816        ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

22:07:45.0720 1816        ksthunk - ok

22:07:45.0735 1816        LGBusEnum       (fa529fb35694c24bf98a9ef67c1cd9d0) C:\Windows\system32\drivers\LGBusEnum.sys

22:07:45.0751 1816        LGBusEnum - ok

22:07:45.0751 1816        LGVirHid        (94b29ce153765e768f004fb3440be2b0) C:\Windows\system32\drivers\LGVirHid.sys

22:07:45.0766 1816        LGVirHid - ok

22:07:45.0766 1816        LHidFilt        (1074c77a47835e03c15bf92452f9a750) C:\Windows\system32\DRIVERS\LHidFilt.Sys

22:07:45.0782 1816        LHidFilt - ok

22:07:45.0798 1816        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

22:07:45.0813 1816        lltdio - ok

22:07:45.0829 1816        LMouFilt        (96999c364c649e2866a268f7420a304a) C:\Windows\system32\DRIVERS\LMouFilt.Sys

22:07:45.0844 1816        LMouFilt - ok

22:07:45.0844 1816        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys

22:07:45.0860 1816        LSI_FC - ok

22:07:45.0876 1816        LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys

22:07:45.0876 1816        LSI_SAS - ok

22:07:45.0891 1816        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys

22:07:45.0891 1816        LSI_SAS2 - ok

22:07:45.0907 1816        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys

22:07:45.0922 1816        LSI_SCSI - ok

22:07:45.0922 1816        luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

22:07:45.0954 1816        luafv - ok

22:07:45.0969 1816        MBAMProtector   (23a854450dab5c9b7a42ab9be6f2e4bd) C:\Windows\system32\drivers\mbam.sys

22:07:45.0969 1816        MBAMProtector - ok

22:07:45.0985 1816        megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys

22:07:46.0000 1816        megasas - ok

22:07:46.0016 1816        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys

22:07:46.0016 1816        MegaSR - ok

22:07:46.0032 1816        Modem           (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

22:07:46.0063 1816        Modem - ok

22:07:46.0063 1816        monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

22:07:46.0078 1816        monitor - ok

22:07:46.0094 1816        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys

22:07:46.0094 1816        mouclass - ok

22:07:46.0110 1816        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys

22:07:46.0125 1816        mouhid - ok

22:07:46.0125 1816        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys

22:07:46.0141 1816        mountmgr - ok

22:07:46.0156 1816        MpFilter        (c177a7ebf5e8a0b596f618870516cab8) C:\Windows\system32\DRIVERS\MpFilter.sys

22:07:46.0156 1816        MpFilter - ok

22:07:46.0172 1816        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys

22:07:46.0188 1816        mpio - ok

22:07:46.0188 1816        MpNWMon         (8fbf6b31fe8af1833d93c5913d5b4d55) C:\Windows\system32\DRIVERS\MpNWMon.sys

22:07:46.0203 1816        MpNWMon - ok

22:07:46.0203 1816        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

22:07:46.0234 1816        mpsdrv - ok

22:07:46.0250 1816        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys

22:07:46.0266 1816        MRxDAV - ok

22:07:46.0266 1816        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys

22:07:46.0281 1816        mrxsmb - ok

22:07:46.0297 1816        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys

22:07:46.0312 1816        mrxsmb10 - ok

22:07:46.0312 1816        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

22:07:46.0328 1816        mrxsmb20 - ok

22:07:46.0328 1816        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys

22:07:46.0344 1816        msahci - ok

22:07:46.0359 1816        msdsm           (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys

22:07:46.0359 1816        msdsm - ok

22:07:46.0375 1816        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

22:07:46.0406 1816        Msfs - ok

22:07:46.0422 1816        mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

22:07:46.0453 1816        mshidkmdf - ok

22:07:46.0453 1816        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys

22:07:46.0468 1816        msisadrv - ok

22:07:46.0484 1816        MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

22:07:46.0500 1816        MSKSSRV - ok

22:07:46.0515 1816        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

22:07:46.0546 1816        MSPCLOCK - ok

22:07:46.0562 1816        MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

22:07:46.0578 1816        MSPQM - ok

22:07:46.0593 1816        MsRPC           (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys

22:07:46.0609 1816        MsRPC - ok

22:07:46.0624 1816        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys

22:07:46.0624 1816        mssmbios - ok

22:07:46.0640 1816        MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

22:07:46.0671 1816        MSTEE - ok

22:07:46.0671 1816        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys

22:07:46.0687 1816        MTConfig - ok

22:07:46.0687 1816        MTsensor        (03b7145c889603537e9ffeabb1ad1089) C:\Windows\system32\DRIVERS\ASACPI.sys

22:07:46.0702 1816        MTsensor - ok

22:07:46.0718 1816        Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

22:07:46.0718 1816        Mup - ok

22:07:46.0734 1816        NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

22:07:46.0749 1816        NativeWifiP - ok

22:07:46.0765 1816        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys

22:07:46.0780 1816        NDIS - ok

22:07:46.0796 1816        NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

22:07:46.0827 1816        NdisCap - ok

22:07:46.0843 1816        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

22:07:46.0858 1816        NdisTapi - ok

22:07:46.0874 1816        Ndisuio         (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys

22:07:46.0905 1816        Ndisuio - ok

22:07:46.0905 1816        NdisWan         (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys

22:07:46.0936 1816        NdisWan - ok

22:07:46.0952 1816        NDProxy         (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys

22:07:46.0983 1816        NDProxy - ok

22:07:46.0999 1816        NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

22:07:47.0014 1816        NetBIOS - ok

22:07:47.0030 1816        NetBT           (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys

22:07:47.0061 1816        NetBT - ok

22:07:47.0077 1816        nfrd960         (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys

22:07:47.0092 1816        nfrd960 - ok

22:07:47.0108 1816        NisDrv          (5f7d72cbcdd025af1f38fdeee5646968) C:\Windows\system32\DRIVERS\NisDrvWFP.sys

22:07:47.0108 1816        NisDrv - ok

22:07:47.0124 1816        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

22:07:47.0155 1816        Npfs - ok

22:07:47.0155 1816        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

22:07:47.0186 1816        nsiproxy - ok

22:07:47.0217 1816        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys

22:07:47.0248 1816        Ntfs - ok

22:07:47.0248 1816        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

22:07:47.0280 1816        Null - ok

22:07:47.0295 1816        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys

22:07:47.0295 1816        nvraid - ok

22:07:47.0311 1816        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys

22:07:47.0326 1816        nvstor - ok

22:07:47.0326 1816        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys

22:07:47.0342 1816        nv_agp - ok

22:07:47.0342 1816        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys

22:07:47.0358 1816        ohci1394 - ok

22:07:47.0389 1816        P17             (edd1dcd36f6115acc6935c3f88ff54d7) C:\Windows\system32\drivers\P17.sys

22:07:47.0404 1816        P17 - ok

22:07:47.0420 1816        Parport         (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys

22:07:47.0420 1816        Parport - ok

22:07:47.0436 1816        partmgr         (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys

22:07:47.0451 1816        partmgr - ok

22:07:47.0467 1816        pci             (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys

22:07:47.0467 1816        pci - ok

22:07:47.0482 1816        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys

22:07:47.0482 1816        pciide - ok

22:07:47.0498 1816        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys

22:07:47.0514 1816        pcmcia - ok

22:07:47.0514 1816        pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

22:07:47.0529 1816        pcw - ok

22:07:47.0545 1816        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

22:07:47.0576 1816        PEAUTH - ok

22:07:47.0607 1816        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys

22:07:47.0638 1816        PptpMiniport - ok

22:07:47.0638 1816        Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys

22:07:47.0654 1816        Processor - ok

22:07:47.0670 1816        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys

22:07:47.0685 1816        Psched - ok

22:07:47.0716 1816        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys

22:07:47.0748 1816        ql2300 - ok

22:07:47.0748 1816        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys

22:07:47.0763 1816        ql40xx - ok

22:07:47.0779 1816        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

22:07:47.0794 1816        QWAVEdrv - ok

22:07:47.0794 1816        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

22:07:47.0826 1816        RasAcd - ok

22:07:47.0841 1816        RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

22:07:47.0857 1816        RasAgileVpn - ok

22:07:47.0872 1816        Rasl2tp         (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys

22:07:47.0904 1816        Rasl2tp - ok

22:07:47.0919 1816        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

22:07:47.0950 1816        RasPppoe - ok

22:07:47.0950 1816        RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

22:07:47.0982 1816        RasSstp - ok

22:07:47.0997 1816        rdbss           (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys

22:07:48.0028 1816        rdbss - ok

22:07:48.0028 1816        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys

22:07:48.0044 1816        rdpbus - ok

22:07:48.0060 1816        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

22:07:48.0075 1816        RDPCDD - ok

22:07:48.0091 1816        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

22:07:48.0122 1816        RDPENCDD - ok

22:07:48.0138 1816        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

22:07:48.0169 1816        RDPREFMP - ok

22:07:48.0169 1816        RDPWD           (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys

22:07:48.0200 1816        RDPWD - ok

22:07:48.0216 1816        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys

22:07:48.0231 1816        rdyboost - ok

22:07:48.0247 1816        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

22:07:48.0278 1816        rspndr - ok

22:07:48.0278 1816        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys

22:07:48.0294 1816        sbp2port - ok

22:07:48.0309 1816        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys

22:07:48.0325 1816        scfilter - ok

22:07:48.0340 1816        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

22:07:48.0372 1816        secdrv - ok

22:07:48.0387 1816        Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys

22:07:48.0403 1816        Serenum - ok

22:07:48.0403 1816        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys

22:07:48.0418 1816        Serial - ok

22:07:48.0434 1816        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys

22:07:48.0434 1816        sermouse - ok

22:07:48.0450 1816        sffdisk         (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys

22:07:48.0465 1816        sffdisk - ok

22:07:48.0481 1816        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys

22:07:48.0481 1816        sffp_mmc - ok

22:07:48.0496 1816        sffp_sd         (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys

22:07:48.0512 1816        sffp_sd - ok

22:07:48.0512 1816        sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys

22:07:48.0528 1816        sfloppy - ok

22:07:48.0543 1816        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys

22:07:48.0543 1816        SiSRaid2 - ok

22:07:48.0559 1816        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys

22:07:48.0559 1816        SiSRaid4 - ok

22:07:48.0574 1816        Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

22:07:48.0606 1816        Smb - ok

22:07:48.0621 1816        spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

22:07:48.0621 1816        spldr - ok

22:07:48.0652 1816        srv             (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys

22:07:48.0652 1816        srv - ok

22:07:48.0668 1816        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys

22:07:48.0684 1816        srv2 - ok

22:07:48.0699 1816        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys

22:07:48.0715 1816        srvnet - ok

22:07:48.0715 1816        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys

22:07:48.0730 1816        stexstor - ok

22:07:48.0746 1816        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys

22:07:48.0746 1816        swenum - ok

22:07:48.0762 1816        tap0901         (f0b9d3ed88e56d3cd713dff21e42aaf0) C:\Windows\system32\DRIVERS\tap0901.sys

22:07:48.0762 1816        tap0901 - ok

22:07:48.0777 1816        tapoas          (927d0cdb3f96efc1e98fb1a2c9fb67ad) C:\Windows\system32\DRIVERS\tapoas.sys

22:07:48.0793 1816        tapoas - ok

22:07:48.0824 1816        Tcpip           (f0e98c00a09fdf791525829a1d14240f) C:\Windows\system32\drivers\tcpip.sys

22:07:48.0840 1816        Tcpip - ok

22:07:48.0871 1816        TCPIP6          (f0e98c00a09fdf791525829a1d14240f) C:\Windows\system32\DRIVERS\tcpip.sys

22:07:48.0902 1816        TCPIP6 - ok

22:07:48.0918 1816        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys

22:07:48.0949 1816        tcpipreg - ok

22:07:48.0949 1816        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

22:07:48.0980 1816        TDPIPE - ok

22:07:48.0996 1816        TDTCP           (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys

22:07:49.0027 1816        TDTCP - ok

22:07:49.0027 1816        tdx             (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys

22:07:49.0058 1816        tdx - ok

22:07:49.0074 1816        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys

22:07:49.0074 1816        TermDD - ok

22:07:49.0089 1816        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys

22:07:49.0120 1816        tssecsrv - ok

22:07:49.0136 1816        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys

22:07:49.0136 1816        TsUsbFlt - ok

22:07:49.0152 1816        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys

22:07:49.0183 1816        tunnel - ok

22:07:49.0198 1816        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys

22:07:49.0198 1816        uagp35 - ok

22:07:49.0214 1816        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys

22:07:49.0245 1816        udfs - ok

22:07:49.0261 1816        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys

22:07:49.0261 1816        uliagpkx - ok

22:07:49.0276 1816        umbus           (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys

22:07:49.0292 1816        umbus - ok

22:07:49.0292 1816        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys

22:07:49.0308 1816        UmPass - ok

22:07:49.0323 1816        usbccgp         (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys

22:07:49.0323 1816        usbccgp - ok

22:07:49.0339 1816        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys

22:07:49.0354 1816        usbcir - ok

22:07:49.0354 1816        usbehci         (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys

22:07:49.0370 1816        usbehci - ok

22:07:49.0386 1816        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys

22:07:49.0401 1816        usbhub - ok

22:07:49.0401 1816        usbohci         (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys

22:07:49.0417 1816        usbohci - ok

22:07:49.0417 1816        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys

22:07:49.0432 1816        usbprint - ok

22:07:49.0448 1816        USBSTOR         (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS

22:07:49.0464 1816        USBSTOR - ok

22:07:49.0464 1816        usbuhci         (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys

22:07:49.0479 1816        usbuhci - ok

22:07:49.0495 1816        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys

22:07:49.0495 1816        vdrvroot - ok

22:07:49.0510 1816        vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

22:07:49.0526 1816        vga - ok

22:07:49.0526 1816        VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

22:07:49.0557 1816        VgaSave - ok

22:07:49.0573 1816        vhdmp           (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys

22:07:49.0588 1816        vhdmp - ok

22:07:49.0588 1816        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys

22:07:49.0604 1816        viaide - ok

22:07:49.0604 1816        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys

22:07:49.0620 1816        volmgr - ok

22:07:49.0635 1816        volmgrx         (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys

22:07:49.0651 1816        volmgrx - ok

22:07:49.0651 1816        volsnap         (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys

22:07:49.0666 1816        volsnap - ok

22:07:49.0682 1816        vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys

22:07:49.0682 1816        vsmraid - ok

22:07:49.0698 1816        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys

22:07:49.0713 1816        vwifibus - ok

22:07:49.0729 1816        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys

22:07:49.0729 1816        WacomPen - ok

22:07:49.0744 1816        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

22:07:49.0776 1816        WANARP - ok

22:07:49.0776 1816        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

22:07:49.0807 1816        Wanarpv6 - ok

22:07:49.0822 1816        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys

22:07:49.0822 1816        Wd - ok

22:07:49.0838 1816        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

22:07:49.0854 1816        Wdf01000 - ok

22:07:49.0885 1816        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

22:07:49.0900 1816        WfpLwf - ok

22:07:49.0916 1816        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

22:07:49.0932 1816        WIMMount - ok

22:07:49.0947 1816        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys

22:07:49.0963 1816        WinUsb - ok

22:07:49.0978 1816        WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys

22:07:49.0978 1816        WmiAcpi - ok

22:07:49.0994 1816        ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

22:07:50.0025 1816        ws2ifsl - ok

22:07:50.0041 1816        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys

22:07:50.0072 1816        WudfPf - ok

22:07:50.0088 1816        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys

22:07:50.0119 1816        WUDFRd - ok

22:07:50.0119 1816        MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0

22:07:50.0134 1816        \Device\Harddisk0\DR0 - ok

22:07:50.0134 1816        MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk1\DR1

22:07:50.0166 1816        \Device\Harddisk1\DR1 - ok

22:07:50.0166 1816        Boot (0x1200)   (90ba7ed2569fc5e7b205a26c4eff7b64) \Device\Harddisk0\DR0\Partition0

22:07:50.0166 1816        \Device\Harddisk0\DR0\Partition0 - ok

22:07:50.0166 1816        Boot (0x1200)   (2002494668ec5c702f63a30738745001) \Device\Harddisk0\DR0\Partition1

22:07:50.0166 1816        \Device\Harddisk0\DR0\Partition1 - ok

22:07:50.0166 1816        Boot (0x1200)   (e449672f0f492ce34563898948d7b8df) \Device\Harddisk1\DR1\Partition0

22:07:50.0166 1816        \Device\Harddisk1\DR1\Partition0 - ok

22:07:50.0166 1816        Boot (0x1200)   (c133725402b3f799c4e48c69563905cd) \Device\Harddisk1\DR1\Partition1

22:07:50.0166 1816        \Device\Harddisk1\DR1\Partition1 - ok

22:07:50.0181 1816        ============================================================

22:07:50.0181 1816        Scan finished

22:07:50.0181 1816        ============================================================

22:07:50.0181 3188        Detected object count: 0

22:07:50.0181 3188        Actual detected object count: 0

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

So hier das nächste

Code:

ComboFix 11-11-02.01 - Marc 02.11.2011  16:56:35.1.2 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4095.2720 [GMT 1:00]

ausgeführt von:: c:\users\Marc\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-10-02 bis 2011-11-02  ))))))))))))))))))))))))))))))

.

.

2011-11-01 19:34 . 2011-10-07 04:16        8570192        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{33906462-9DFA-4688-AAC6-66E5E4170A68}\mpengine.dll

2011-11-01 17:03 . 2011-11-01 17:03        --------        d-----w-        c:\program files (x86)\ESET

2011-10-31 18:01 . 2011-10-31 18:01        --------        d-----w-        c:\users\Marc\AppData\Roaming\Malwarebytes

2011-10-31 18:01 . 2011-10-31 18:01        --------        d-----w-        c:\programdata\Malwarebytes

2011-10-31 18:01 . 2011-10-31 18:01        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2011-10-31 18:01 . 2011-08-31 16:00        25416        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-10-31 17:37 . 2011-10-31 17:37        55384        ----a-w-        c:\windows\system32\drivers\SBREDrv.sys

2011-10-31 17:34 . 2011-10-31 17:58        --------        dc----w-        c:\windows\system32\DRVSTORE

2011-10-31 17:34 . 2011-10-31 17:34        --------        d-----w-        c:\programdata\Lavasoft

2011-10-31 17:34 . 2011-10-31 17:34        --------        d-----w-        c:\program files (x86)\Lavasoft

2011-10-31 17:01 . 2011-10-31 17:01        --------        d-----w-        c:\program files\CCleaner

2011-10-28 15:09 . 2011-10-28 15:09        27176        ----a-w-        c:\windows\system32\drivers\ggsemc.sys

2011-10-28 15:09 . 2011-10-28 15:09        1490656        ----a-w-        c:\windows\system32\WdfCoInstaller01007.dll

2011-10-28 15:09 . 2011-10-28 15:09        13352        ----a-w-        c:\windows\system32\drivers\ggflt.sys

2011-10-26 15:02 . 2011-10-03 03:06        476904        ----a-w-        c:\program files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll

2011-10-20 20:07 . 2011-10-20 20:23        --------        d-----w-        c:\users\Marc\AppData\Roaming\Might & Magic Heroes VI

2011-10-20 19:42 . 2011-10-20 19:42        270912        ----a-w-        c:\windows\system32\drivers\dtsoftbus01.sys

2011-10-20 19:42 . 2011-10-20 19:42        --------        d-----w-        c:\program files (x86)\DAEMON Tools Lite

2011-10-20 19:41 . 2011-10-31 17:02        --------        d-----w-        c:\users\Marc\AppData\Roaming\DAEMON Tools Lite

2011-10-20 19:41 . 2011-10-20 19:41        --------        d-----w-        c:\programdata\DAEMON Tools Lite

2011-10-16 20:35 . 2011-10-16 20:35        --------        d-----w-        c:\users\Marc\AppData\Local\TQVault

2011-10-15 13:40 . 2011-10-15 13:40        --------        d-----w-        c:\users\Marc\AppData\Local\4A Games

2011-10-15 13:36 . 2011-10-15 13:36        --------        d-----w-        c:\program files (x86)\NVIDIA Corporation

2011-10-15 13:36 . 2011-10-15 13:36        --------        d-----w-        c:\program files (x86)\Common Files\Wise Installation Wizard

2011-10-13 11:08 . 2011-09-06 03:03        3138048        ----a-w-        c:\windows\system32\win32k.sys

2011-10-13 11:08 . 2011-08-17 05:26        613888        ----a-w-        c:\windows\system32\psisdecd.dll

2011-10-13 11:08 . 2011-08-17 04:24        465408        ----a-w-        c:\windows\SysWow64\psisdecd.dll

2011-10-13 11:08 . 2011-08-17 04:19        75776        ----a-w-        c:\windows\SysWow64\psisrndr.ax

2011-10-13 11:08 . 2011-08-17 05:25        108032        ----a-w-        c:\windows\system32\psisrndr.ax

2011-10-13 11:08 . 2011-08-27 05:37        861696        ----a-w-        c:\windows\system32\oleaut32.dll

2011-10-13 11:08 . 2011-08-27 05:37        331776        ----a-w-        c:\windows\system32\oleacc.dll

2011-10-13 11:08 . 2011-08-27 04:26        571904        ----a-w-        c:\windows\SysWow64\oleaut32.dll

2011-10-13 11:08 . 2011-08-27 04:26        233472        ----a-w-        c:\windows\SysWow64\oleacc.dll

2011-10-12 15:17 . 2011-09-15 18:18        601424        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

2011-10-12 15:17 . 2011-10-12 15:16        917840        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2DE82CE9-B121-4C5F-8AFD-A3DE73DE7AE9}\gapaengine.dll

2011-10-11 19:05 . 2011-10-28 15:08        --------        d-----w-        c:\programdata\Sony Ericsson

2011-10-11 19:05 . 2011-10-28 15:08        --------        d-----w-        c:\program files (x86)\Sony Ericsson

2011-10-10 19:53 . 2011-10-10 19:53        --------        d-----w-        c:\programdata\ATI

2011-10-10 19:53 . 2011-10-10 19:53        0        ----a-w-        c:\windows\ativpsrm.bin

2011-10-10 19:52 . 2011-10-10 19:52        --------        d-----w-        c:\program files (x86)\AMD APP

2011-10-10 19:51 . 2011-10-10 19:51        --------        d-----w-        c:\program files (x86)\Common Files\ATI Technologies

2011-10-10 19:51 . 2011-10-10 19:51        --------        d-----w-        c:\program files\Common Files\ATI Technologies

2011-10-10 19:50 . 2011-10-10 19:51        --------        d-----w-        c:\program files (x86)\ATI Technologies

2011-10-10 19:50 . 2011-10-10 19:51        --------        d-----w-        c:\program files\ATI Technologies

2011-10-10 19:49 . 2011-10-10 19:49        --------        d-----w-        c:\program files\ATI

2011-10-10 19:45 . 2011-10-10 19:45        --------        d-----w-        c:\program files (x86)\Phyxion.net

2011-10-09 16:32 . 2011-10-09 16:32        --------        d-----w-        c:\users\Marc\AppData\Local\ID Software

2011-10-09 16:27 . 2011-10-09 16:27        --------        d-----w-        c:\program files (x86)\Futuremark

2011-10-07 16:20 . 2011-10-07 16:20        --------        d-----w-        c:\program files (x86)\OpenVPN Technologies

2011-10-07 05:21 . 2011-10-07 05:21        10207232        ----a-w-        c:\windows\system32\drivers\atikmdag.sys

2011-10-07 03:47 . 2011-10-07 03:47        24996864        ----a-w-        c:\windows\system32\atio6axx.dll

2011-10-07 03:33 . 2011-10-07 03:33        159744        ----a-w-        c:\windows\system32\atiapfxx.exe

2011-10-07 03:33 . 2011-10-07 03:33        736768        ----a-w-        c:\windows\SysWow64\aticfx32.dll

2011-10-07 03:32 . 2011-10-07 03:32        867328        ----a-w-        c:\windows\system32\aticfx64.dll

2011-10-07 03:29 . 2011-10-07 03:29        466944        ----a-w-        c:\windows\system32\ATIDEMGX.dll

2011-10-07 03:29 . 2011-10-07 03:29        487936        ----a-w-        c:\windows\system32\atieclxx.exe

2011-10-07 03:28 . 2011-10-07 03:28        204288        ----a-w-        c:\windows\system32\atiesrxx.exe

2011-10-07 03:27 . 2011-10-07 03:27        120320        ----a-w-        c:\windows\system32\atitmm64.dll

2011-10-07 03:27 . 2011-10-07 03:27        423424        ----a-w-        c:\windows\system32\atipdl64.dll

2011-10-07 03:26 . 2011-10-07 03:26        356352        ----a-w-        c:\windows\SysWow64\atipdlxx.dll

2011-10-07 03:26 . 2011-10-07 03:26        278528        ----a-w-        c:\windows\SysWow64\Oemdspif.dll

2011-10-07 03:26 . 2011-10-07 03:26        21504        ----a-w-        c:\windows\system32\atimuixx.dll

2011-10-07 03:26 . 2011-10-07 03:26        59392        ----a-w-        c:\windows\system32\atiedu64.dll

2011-10-07 03:26 . 2011-10-07 03:26        43520        ----a-w-        c:\windows\SysWow64\ati2edxx.dll

2011-10-07 03:25 . 2011-10-07 03:25        18836992        ----a-w-        c:\windows\SysWow64\atioglxx.dll

2011-10-07 03:23 . 2011-10-07 03:23        4231680        ----a-w-        c:\windows\SysWow64\atidxx32.dll

2011-10-07 03:12 . 2011-10-07 03:12        4960768        ----a-w-        c:\windows\system32\atidxx64.dll

2011-10-07 03:01 . 2011-10-07 03:01        4289024        ----a-w-        c:\windows\SysWow64\atiumdag.dll

2011-10-07 02:54 . 2011-10-07 02:54        5431808        ----a-w-        c:\windows\system32\atiumd64.dll

2011-10-07 02:53 . 2011-10-07 02:53        51200        ----a-w-        c:\windows\system32\aticalrt64.dll

2011-10-07 02:53 . 2011-10-07 02:53        46080        ----a-w-        c:\windows\SysWow64\aticalrt.dll

2011-10-07 02:52 . 2011-10-07 02:52        44544        ----a-w-        c:\windows\system32\aticalcl64.dll

2011-10-07 02:52 . 2011-10-07 02:52        44032        ----a-w-        c:\windows\SysWow64\aticalcl.dll

2011-10-07 02:52 . 2011-10-07 02:52        9809920        ----a-w-        c:\windows\system32\aticaldd64.dll

2011-10-07 02:49 . 2011-10-07 02:49        8390656        ----a-w-        c:\windows\SysWow64\aticaldd.dll

2011-10-07 02:46 . 2011-10-07 02:46        479744        ----a-w-        c:\windows\system32\atiadlxx.dll

2011-10-07 02:46 . 2011-10-07 02:46        335872        ----a-w-        c:\windows\SysWow64\atiadlxy.dll

2011-10-07 02:46 . 2011-10-07 02:46        17408        ----a-w-        c:\windows\system32\atig6pxx.dll

2011-10-07 02:46 . 2011-10-07 02:46        14336        ----a-w-        c:\windows\SysWow64\atiglpxx.dll

2011-10-07 02:46 . 2011-10-07 02:46        14336        ----a-w-        c:\windows\system32\atiglpxx.dll

2011-10-07 02:46 . 2011-10-07 02:46        39936        ----a-w-        c:\windows\system32\atig6txx.dll

2011-10-07 02:46 . 2011-10-07 02:46        32768        ----a-w-        c:\windows\SysWow64\atigktxx.dll

2011-10-07 02:46 . 2011-10-07 02:46        317952        ----a-w-        c:\windows\system32\drivers\atikmpag.sys

2011-10-07 02:45 . 2011-10-07 02:45        40960        ----a-w-        c:\windows\system32\atiuxp64.dll

2011-10-07 02:45 . 2011-10-07 02:45        31744        ----a-w-        c:\windows\SysWow64\atiuxpag.dll

2011-10-07 02:45 . 2011-10-07 02:45        38912        ----a-w-        c:\windows\system32\atiu9p64.dll

2011-10-07 02:44 . 2011-10-07 02:44        29184        ----a-w-        c:\windows\SysWow64\atiu9pag.dll

2011-10-07 02:44 . 2011-10-07 02:44        53248        ----a-w-        c:\windows\system32\drivers\ati2erec.dll

2011-10-07 02:43 . 2011-10-07 02:43        1113088        ----a-w-        c:\windows\system32\atiumd6v.dll

2011-10-07 02:42 . 2011-10-07 02:42        1828864        ----a-w-        c:\windows\SysWow64\atiumdmv.dll

2011-10-07 02:42 . 2011-10-07 02:42        4023296        ----a-w-        c:\windows\system32\atiumd6a.dll

2011-10-07 02:31 . 2011-10-07 02:31        4174848        ----a-w-        c:\windows\SysWow64\atiumdva.dll

2011-10-07 02:14 . 2011-10-07 02:14        54784        ----a-w-        c:\windows\system32\atimpc64.dll

2011-10-07 02:14 . 2011-10-07 02:14        54784        ----a-w-        c:\windows\system32\amdpcom64.dll

2011-10-07 02:14 . 2011-10-07 02:14        53760        ----a-w-        c:\windows\SysWow64\atimpc32.dll

2011-10-07 02:14 . 2011-10-07 02:14        53760        ----a-w-        c:\windows\SysWow64\amdpcom32.dll

2011-10-06 20:30 . 2011-10-06 20:30        66048        ----a-w-        c:\windows\system32\OpenVideo64.dll

2011-10-06 20:30 . 2011-10-06 20:30        56832        ----a-w-        c:\windows\SysWow64\OpenVideo.dll

2011-10-06 20:30 . 2011-10-06 20:30        16787456        ----a-w-        c:\windows\system32\amdocl64.dll

2011-10-06 20:29 . 2011-10-06 20:29        13753856        ----a-w-        c:\windows\SysWow64\amdocl.dll

2011-10-06 20:29 . 2011-10-06 20:29        51200        ----a-w-        c:\windows\system32\OpenCL.dll

2011-10-06 20:29 . 2011-10-06 20:29        43520        ----a-w-        c:\windows\SysWow64\OpenCL.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-10-14 08:08 . 2011-09-15 18:22        414368        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2011-10-07 04:16 . 2011-09-15 21:34        8570192        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-10-07 02:22 . 2011-07-28 21:01        58880        ----a-w-        c:\windows\system32\coinst.dll

2011-10-03 03:06 . 2011-09-15 21:19        472808        ----a-w-        c:\windows\SysWow64\deployJava1.dll

2011-10-02 20:49 . 2011-10-02 20:49        178800        ----a-w-        c:\windows\SysWow64\CmdLineExt_x64.dll

2011-09-17 14:38 . 2011-09-17 14:38        660368        ----a-w-        c:\windows\system32\deployJava1.dll

2011-09-15 22:07 . 2009-07-14 02:36        152576        ----a-w-        c:\windows\SysWow64\msclmd.dll

2011-09-15 22:07 . 2009-07-14 02:36        175616        ----a-w-        c:\windows\system32\msclmd.dll

2011-09-15 21:40 . 2011-09-15 21:40        74752        ----a-w-        c:\windows\SysWow64\RegisterIEPKEYs.exe

2011-09-15 21:40 . 2011-09-15 21:40        161792        ----a-w-        c:\windows\SysWow64\msls31.dll

2011-09-15 21:40 . 2011-09-15 21:40        86528        ----a-w-        c:\windows\SysWow64\iesysprep.dll

2011-09-15 21:40 . 2011-09-15 21:40        76800        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe

2011-09-15 21:40 . 2011-09-15 21:40        74752        ----a-w-        c:\windows\SysWow64\iesetup.dll

2011-09-15 21:40 . 2011-09-15 21:40        63488        ----a-w-        c:\windows\SysWow64\tdc.ocx

2011-09-15 21:40 . 2011-09-15 21:40        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll

2011-09-15 21:40 . 2011-09-15 21:40        367104        ----a-w-        c:\windows\SysWow64\html.iec

2011-09-15 21:40 . 2011-09-15 21:40        23552        ----a-w-        c:\windows\SysWow64\licmgr10.dll

2011-09-15 21:40 . 2011-09-15 21:40        152064        ----a-w-        c:\windows\SysWow64\wextract.exe

2011-09-15 21:40 . 2011-09-15 21:40        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe

2011-09-15 21:40 . 2011-09-15 21:40        1427456        ----a-w-        c:\windows\SysWow64\inetcpl.cpl

2011-09-15 21:40 . 2011-09-15 21:40        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll

2011-09-15 21:40 . 2011-09-15 21:40        89088        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe

2011-09-15 21:40 . 2011-09-15 21:40        420864        ----a-w-        c:\windows\SysWow64\vbscript.dll

2011-09-15 21:40 . 2011-09-15 21:40        35840        ----a-w-        c:\windows\SysWow64\imgutil.dll

2011-09-15 21:40 . 2011-09-15 21:40        222208        ----a-w-        c:\windows\system32\msls31.dll

2011-09-15 21:40 . 2011-09-15 21:40        142848        ----a-w-        c:\windows\SysWow64\ieUnatt.exe

2011-09-15 21:40 . 2011-09-15 21:40        11776        ----a-w-        c:\windows\SysWow64\mshta.exe

2011-09-15 21:40 . 2011-09-15 21:40        101888        ----a-w-        c:\windows\SysWow64\admparse.dll

2011-09-15 21:40 . 2011-09-15 21:40        91648        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2011-09-15 21:40 . 2011-09-15 21:40        76800        ----a-w-        c:\windows\system32\tdc.ocx

2011-09-15 21:40 . 2011-09-15 21:40        49664        ----a-w-        c:\windows\system32\imgutil.dll

2011-09-15 21:40 . 2011-09-15 21:40        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2011-09-15 21:40 . 2011-09-15 21:40        448512        ----a-w-        c:\windows\system32\html.iec

2011-09-15 21:40 . 2011-09-15 21:40        173056        ----a-w-        c:\windows\system32\ieUnatt.exe

2011-09-15 21:40 . 2011-09-15 21:40        135168        ----a-w-        c:\windows\system32\IEAdvpack.dll

2011-09-15 21:40 . 2011-09-15 21:40        12288        ----a-w-        c:\windows\system32\mshta.exe

2011-09-15 21:40 . 2011-09-15 21:40        114176        ----a-w-        c:\windows\system32\admparse.dll

2011-09-15 21:40 . 2011-09-15 21:40        111616        ----a-w-        c:\windows\system32\iesysprep.dll

2011-09-15 21:40 . 2011-09-15 21:40        85504        ----a-w-        c:\windows\system32\iesetup.dll

2011-09-15 21:40 . 2011-09-15 21:40        603648        ----a-w-        c:\windows\system32\vbscript.dll

2011-09-15 21:40 . 2011-09-15 21:40        30720        ----a-w-        c:\windows\system32\licmgr10.dll

2011-09-15 21:40 . 2011-09-15 21:40        165888        ----a-w-        c:\windows\system32\iexpress.exe

2011-09-15 21:40 . 2011-09-15 21:40        160256        ----a-w-        c:\windows\system32\wextract.exe

2011-09-15 21:40 . 2011-09-15 21:40        1492992        ----a-w-        c:\windows\system32\inetcpl.cpl

2011-09-15 18:11 . 2011-09-15 18:11        53248        ----a-r-        c:\users\Marc\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe

2011-09-15 18:11 . 2011-09-15 18:11        18960        ----a-w-        c:\windows\system32\drivers\LNonPnP.sys

2011-09-15 16:03 . 2011-09-15 16:03        374792        ----a-w-        c:\windows\system32\drivers\UMDF\lgSSQVGA.dll

2011-09-15 16:03 . 2011-09-15 16:03        22408        ----a-w-        c:\windows\system32\drivers\LGBusEnum.sys

2011-09-15 16:03 . 2011-09-15 16:03        16008        ----a-w-        c:\windows\system32\drivers\LGVirHid.sys

2011-09-15 16:03 . 2011-09-15 16:03        157704        ----a-w-        c:\windows\system32\drivers\UMDF\lgSSBW.dll

2011-09-15 16:00 . 2011-09-15 16:00        466520        ----a-w-        c:\windows\system32\wrap_oal.dll

2011-09-15 16:00 . 2011-09-15 16:00        445016        ----a-w-        c:\windows\SysWow64\wrap_oal.dll

2011-09-15 16:00 . 2011-09-15 16:00        123480        ----a-w-        c:\windows\system32\OpenAL32.dll

2011-09-15 16:00 . 2011-09-15 16:00        109144        ----a-w-        c:\windows\SysWow64\OpenAL32.dll

2011-09-14 09:47 . 2011-09-14 09:47        60416        ----a-w-        c:\windows\system32\OVDecode64.dll

2011-09-14 09:47 . 2011-09-14 09:47        53760        ----a-w-        c:\windows\SysWow64\OVDecode.dll

2011-09-14 09:38 . 2011-09-14 09:38        44032        ----a-w-        c:\windows\system32\amdoclcl64.dll

2011-09-14 09:38 . 2011-09-14 09:38        37376        ----a-w-        c:\windows\SysWow64\amdoclcl.dll

2011-08-29 08:00 . 2011-09-17 21:51        74752        ----a-w-        c:\windows\SysWow64\ff_vfw.dll

2011-08-18 23:46 . 2011-08-18 23:46        30720        ----a-w-        c:\windows\system32\drivers\tapoas.sys

2011-08-16 06:48 . 2011-09-15 16:20        8862544        ------w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{3CA64B41-85AA-4B12-9CAA-C251CE8BAAEA}\mpengine.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RocketDock"="c:\program files (x86)\RocketDock\RocketDock.exe" [2007-09-02 495616]

"Sony Ericsson PC Companion"="c:\program files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" [2011-07-25 433360]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"P17RunE"="P17RunE.dll" [2007-05-09 18432]

"VolPanel"="c:\program files (x86)\Creative\Volume Panel\VolPanlu.exe" [2009-07-07 241789]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-06 343168]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]

R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]

R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2011-09-15 79360]

R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [2011-08-15 130976]

R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [x]

R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [x]

R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [x]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]

R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-06-29 155344]

R3 tapoas;TAP-Win32 Adapter OAS;c:\windows\system32\DRIVERS\tapoas.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\l160x64.sys [x]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]

S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]

.

.

Inhalt des "geplante Tasks" Ordners

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-06-23 1744152]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

TCP: DhcpNameServer = 192.168.178.1

FF - ProfilePath - c:\users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\kmpcm7l3.default\

FF - prefs.js: browser.startup.homepage - www.google.de

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\SysWOW64\rundll32.exe

c:\program files (x86)\Mozilla Firefox\firefox.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-11-02  17:02:18 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-11-02 16:02

.

Vor Suchlauf: 8 Verzeichnis(se), 38.014.406.656 Bytes frei

Nach Suchlauf: 11 Verzeichnis(se), 37.743.337.472 Bytes frei

.

- - End Of File - - 00DE9AE2AA92CF056BDD1D7F04C6A984

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

So das wäre dan der nächste Log

Code:

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software

Run date: 2011-11-02 20:59:53

-----------------------------

20:59:53.437    OS Version: Windows x64 6.1.7601 Service Pack 1

20:59:53.437    Number of processors: 2 586 0xF0B

20:59:53.437    ComputerName: MARC-PC  UserName: Marc

20:59:53.640    Initialize success

21:01:30.989    AVAST engine defs: 11110201

21:01:48.758    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

21:01:48.758    Disk 0 Vendor: M4-CT064M4SSD2 0002 Size: 61057MB BusType: 3

21:01:48.758    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T0L0-4

21:01:48.758    Disk 1 Vendor: SAMSUNG_HD501LJ CR100-12 Size: 476940MB BusType: 3

21:01:50.770    Disk 0 MBR read successfully

21:01:50.770    Disk 0 MBR scan

21:01:50.770    Disk 0 Windows 7 default MBR code

21:01:50.770    Service scanning

21:01:51.067    Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32

21:01:51.706    Modules scanning

21:01:51.706    Disk 0 trace - called modules:

21:01:51.706    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys 

21:01:51.706    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80048a0060]

21:01:52.221    3 CLASSPNP.SYS[fffff880019d043f] -> nt!IofCallDriver -> [0xfffffa80047c2520]

21:01:52.221    5 ACPI.sys[fffff88000fac7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8004441060]

21:01:52.315    AVAST engine scan C:\Windows

21:01:54.187    AVAST engine scan C:\Windows\system32

21:03:08.256    AVAST engine scan C:\Windows\system32\drivers

21:03:12.936    AVAST engine scan C:\Users\Marc

21:03:40.392    AVAST engine scan C:\ProgramData

21:04:10.406    Scan finished successfully

21:07:36.919    Disk 0 MBR has been saved successfully to "C:\Users\Marc\Desktop\MBR.dat"

21:07:36.919    The log file has been saved successfully to "C:\Users\Marc\Desktop\aswMBR.txt"

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

So hier erst mal von Malwarebytes der Rest kommt dann morgen, das Bett ruft.

Code:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org
 

Datenbank Version: 8071
 

Windows 6.1.7601 Service Pack 1

Internet Explorer 9.0.8112.16421
 

02.11.2011 21:57:08

mbam-log-2011-11-02 (21-57-08).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|H:\|)

Durchsuchte Objekte: 311665

Laufzeit: 19 Minute(n), 39 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)