Trojaner-Board - 3 Logs (mbam,otl,hijackthis)

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - 3 Logs (mbam,otl,hijackthis) (https://www.trojaner-board.de/107822-3-logs-mbam-otl-hijackthis.html)

3 Logs (mbam,otl,hijackthis)

Sehr geehrte Damen und Herren,

vielen Dank für die Aufnahme im Forum!

Mein System (Win 7, X64) reagiert verlangsamt und läuft heiß.

Ich führte Komplettscans mit mbam, otl und hijackthis durch. Ich habe die Logs angehängt und bitte einen der Experten in diesem Forum, einmal draufzuschauen, ob das System infiziert ist oder ob daraus hervorgeht, was mit dem System nicht in Ordnung sein könnte.

Ganz herzlichen Dank im voraus!

Mit freundlichen Grüßen

Christoph

Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

Und bitte lass die Finger von Hijackthis. Siehe Signatur.

Hallo Arne,

habe die Logs als Zip-Datei angehängt.

Gruß

Christoph

Führ bitte auch ESET aus, danach sehen wir weiter:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

So, das ESET-Log ist angehängt.

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

ESET-Log:

Code:

 ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=55360b104d6f974f83b75ec539a086c8

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-12-19 05:21:45

# local_time=2011-12-19 06:21:45 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1792 16777215 100 0 2105661 2105661 0 0

# compatibility_mode=5893 16776573 100 94 14848 75861872 0 0

# compatibility_mode=8192 67108863 100 0 4503 4503 0 0

# scanned=313207

# found=0

# cleaned=0

# scan_time=83282

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=55360b104d6f974f83b75ec539a086c8

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-01-10 02:42:29

# local_time=2012-01-10 03:42:29 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=1792 16777215 100 0 4071356 4071356 0 0

# compatibility_mode=5893 16776573 100 94 7139 77827567 0 0

# compatibility_mode=8192 67108863 100 0 1970198 1970198 0 0

# scanned=319820

# found=1

# cleaned=0

# scan_time=8853

C:\Program Files (x86)\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe        Win32/Adware.Toolbar.Dealio application (unable to clean)        00000000000000000000000000000000        I

Das ist kein OTL-Log

Ah, ich dachte, du wolltest das ESET-Log auch als Code-Tag haben. Hier kommt jetzt das OTL-Log:

Code:

OTL logfile created on: 10.01.2012 19:05:34 - Run 3

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Christoph\Desktop

64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,80 Gb Total Physical Memory | 2,53 Gb Available Physical Memory | 66,59% Memory free

7,60 Gb Paging File | 5,83 Gb Available in Paging File | 76,73% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 296,08 Gb Total Space | 182,95 Gb Free Space | 61,79% Space Free | Partition Type: NTFS

Drive E: | 1,87 Gb Total Space | 1,83 Gb Free Space | 97,82% Space Free | Partition Type: FAT

Drive F: | 2,95 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

 

Computer Name: CHRISTOPH-PC | User Name: Christoph | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Christoph\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

PRC - C:\Program Files (x86)\Fujitsu\DeskUpdate\DeskUpdateNotifier.exe (Fujitsu Technology Solutions)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

PRC - C:\Windows.old\Program Files (x86)\OneClickInternet\WTGService.exe ()

PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (FUJITSU LIMITED)

PRC - C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kSierra.exe (QUALCOMM, Inc.)

PRC - C:\Windows\vsnp2uvc.exe (Sonix)

PRC - C:\Windows\SysWOW64\o2flash.exe (O2Micro International)

PRC - C:\Program Files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe (FUJITSU LIMITED)

PRC - C:\Windows\snuvcdsm.exe ()

PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)

PRC - C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ()

PRC - C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\apdproxy.exe (Adobe Systems Incorporated)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\log4net\cfc3613d82bf82155b21cb0559b93a36\log4net.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\DeskUpdateNotifier\a0c738ce4b924eb58073d2b2c46c789d\DeskUpdateNotifier.ni.exe ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\130ad4d9719e566ca933ac7158a04203\System.Xml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\2d5bcbeb9475ef62189f605bcca1cec6\System.Configuration.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll ()

MOD - C:\Windows\snuvcdsm.exe ()

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - (PowerSavingUtilityService) -- C:\Program Files\Fujitsu\PSUtility\PSUService.exe (FUJITSU LIMITED)

SRV:64bit: - (VFPRadioSupportService) -- C:\Program Files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe (CSR, plc)

SRV:64bit: - (TabletServicePen) -- C:\Windows\SysNative\Pen_Tablet.exe (Wacom Technology, Corp.)

SRV:64bit: - (WirelessSelectorService) -- C:\Program Files\Fujitsu\WirelessSelector\WSUService.exe ()

SRV:64bit: - (ATService) -- C:\Program Files\Fingerprint Sensor\ATService.exe (AuthenTec, Inc.)

SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)

SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

SRV - (SearchAnonymizer) -- C:\Users\Christoph\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe ()

SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (WTGService) -- C:\Windows.old\Program Files (x86)\OneClickInternet\WTGService.exe ()

SRV - (UNS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)

SRV - (LMS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)

SRV - (QDLService2kSierra) Qualcomm Gobi 2000 Download Service (Sierra) -- C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kSierra.exe (QUALCOMM, Inc.)

SRV - (O2Flash) -- C:\Windows\SysWOW64\o2flash.exe (O2Micro International)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (SBSDWSCService) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)

SRV - (AdobeActiveFileMonitor6.0) -- C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ()

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)

DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)

DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)

DRV:64bit: - (FJGSDisk) -- C:\Windows\SysNative\drivers\FJGSDisk.sys (FUJITSU LIMITED)

DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)

DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)

DRV:64bit: - (FscGabi) -- C:\Windows\SysNative\drivers\FscGabi.sys (Fujitsu Technology Solutions)

DRV:64bit: - (FscEfDmi) -- C:\Windows\SysNative\drivers\FscEfDmi.sys (Fujitsu Technology Solutions)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)

DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)

DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)

DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)

DRV:64bit: - (IntcDAud) Intel(R) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)

DRV:64bit: - (NETw5s64) Intel(R) -- C:\Windows\SysNative\drivers\NETw5s64.sys (Intel Corporation)

DRV:64bit: - (e1kexpress) Intel(R) -- C:\Windows\SysNative\drivers\e1k62x64.sys (Intel Corporation)

DRV:64bit: - (HECIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)

DRV:64bit: - (O2SCBUS) -- C:\Windows\SysNative\drivers\ozscrx64.sys (O2Micro)

DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)

DRV:64bit: - (WISDPen) -- C:\Windows\SysNative\drivers\wisdpen.sys (Wacom Technology)

DRV:64bit: - (wacomvhid) -- C:\Windows\SysNative\drivers\wacomvhid.sys (Wacom Technology)

DRV:64bit: - (wacommousefilter) -- C:\Windows\SysNative\drivers\wacommousefilter.sys (Wacom Technology)

DRV:64bit: - (qcusbnetsra2k) Gobi 2000 USB-NDIS miniport(1199-9001) -- C:\Windows\SysNative\drivers\qcusbnetsra2k.sys (QUALCOMM Incorporated)

DRV:64bit: - (qcusbsersra2k) Gobi 2000 USB Device for Legacy Serial Communication(1199-9001) -- C:\Windows\SysNative\drivers\qcusbsersra2k.sys (QUALCOMM Incorporated)

DRV:64bit: - (qcfiltersra2k) Gobi 2000 USB Composite Device Filter Driver(1199-9001) -- C:\Windows\SysNative\drivers\qcfiltersra2k.sys (QUALCOMM Incorporated)

DRV:64bit: - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\Windows\SysNative\drivers\snp2uvc.sys ()

DRV:64bit: - (FjBtnDrv) -- C:\Windows\SysNative\drivers\FjBtnDrv.sys (Fujitsu America, Inc.)

DRV:64bit: - (ATSwpWDF) -- C:\Windows\SysNative\drivers\ATSwpWDF.sys (AuthenTec, Inc.)

DRV:64bit: - (O2MDRDR) -- C:\Windows\SysNative\drivers\o2mdx64.sys (O2Micro )

DRV:64bit: - (O2SDRDR) -- C:\Windows\SysNative\drivers\o2sdx64.sys (O2Micro)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (acpials) -- C:\Windows\SysNative\drivers\acpials.sys (Microsoft Corporation)

DRV:64bit: - (TPM) -- C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (FUJ02E3) -- C:\Windows\SysNative\drivers\fuj02e3.sys (FUJITSU LIMITED)

DRV:64bit: - (FUJ02B1) -- C:\Windows\SysNative\drivers\fuj02b1.sys (FUJITSU LIMITED)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.01.08 15:18:08 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.01.08 11:25:49 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.11.24 18:19:00 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins

 

[2011.11.24 17:39:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christoph\AppData\Roaming\mozilla\Extensions

[2012.01.06 16:18:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\f1zh9ium.default\extensions

[2011.12.25 01:52:11 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\f1zh9ium.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2011.12.20 02:23:45 | 000,001,870 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\f1zh9ium.default\searchplugins\{4F958E15-27E4-42CA-8F43-85725705C872}.xml

[2011.12.20 02:23:45 | 000,002,188 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\f1zh9ium.default\searchplugins\{7D91D577-9054-464B-96A4-DB484B8ACA86}.xml

[2011.12.20 02:23:45 | 000,002,077 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\f1zh9ium.default\searchplugins\{D3A76844-A97B-473E-B80F-3F60E725FE09}.xml

[2012.01.08 15:18:08 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

() (No name found) -- C:\USERS\CHRISTOPH\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1ZH9IUM.DEFAULT\EXTENSIONS\{3D7EB24F-2740-49DF-8937-200B1CC08F8A}.XPI

() (No name found) -- C:\USERS\CHRISTOPH\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1ZH9IUM.DEFAULT\EXTENSIONS\{B1DF372D-8B32-4C7D-B6B4-9C5B78CF6FB1}.XPI

() (No name found) -- C:\USERS\CHRISTOPH\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1ZH9IUM.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\USERS\CHRISTOPH\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1ZH9IUM.DEFAULT\EXTENSIONS\ADBLOCKPOPUPS@JESSEHAKANEN.NET.XPI

() (No name found) -- C:\USERS\CHRISTOPH\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1ZH9IUM.DEFAULT\EXTENSIONS\ELEMHIDEHELPER@ADBLOCKPLUS.ORG.XPI

() (No name found) -- C:\USERS\CHRISTOPH\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1ZH9IUM.DEFAULT\EXTENSIONS\SKIPSCREEN@SKIPSCREEN.XPI

[2011.12.21 08:42:29 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2011.12.21 06:08:50 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.12.21 06:02:40 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2011.12.21 06:08:50 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2011.12.21 06:08:50 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.12.21 06:08:50 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.12.21 06:08:50 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O4:64bit: - HKLM..\Run: []  File not found

O4:64bit: - HKLM..\Run: [ATSwpNav] C:\Program Files\Fingerprint Sensor\ATSwpNav.exe (AuthenTec, Inc.)

O4:64bit: - HKLM..\Run: [BbInstallUser] C:\Program Files\Bluebeam Software\Pushbutton PDF\Bluebeam Admin User.exe (Bluebeam Software, Inc.)

O4:64bit: - HKLM..\Run: [BbPrintMonitor] C:\Program Files\Common Files\Bluebeam Software\Brewery\V45\Printer Support\BBPrint.exe (Bluebeam Software, Inc.)

O4:64bit: - HKLM..\Run: [BthSyncServ] "C:\Program Files\CSR\Bluetooth Feature Pack 5.0\bthsyncserv.exe" File not found

O4:64bit: - HKLM..\Run: [ConMgr] C:\Program Files\CSR\Bluetooth Feature Pack 5.0\ConMgr.exe (CSR, plc)

O4:64bit: - HKLM..\Run: [CSRSkype] C:\Program Files\CSR\Bluetooth Feature Pack 5.0\CSRSkype.exe (CSR, plc)

O4:64bit: - HKLM..\Run: [FDM7] C:\Program Files\Fujitsu\FDM7\FdmDaemon.exe (FUJITSU LIMITED)

O4:64bit: - HKLM..\Run: [FjStrtAp] C:\Program Files\Fujitsu\Utils\FjStrtAp.exe (Fujitsu Computer Systems Corp.)

O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [Ocs_SM] C:\Users\Christoph\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS)

O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [PSUTility] C:\Program Files\Fujitsu\PSUtility\TrayManager.exe (FUJITSU LIMITED)

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [snp2uvc] C:\Windows\vsnp2uvc.exe (Sonix)

O4:64bit: - HKLM..\Run: [SNUVCDSM] C:\Windows\snuvcdsm.exe ()

O4:64bit: - HKLM..\Run: [SSUtility] C:\Program Files\Fujitsu\SSUtility\FJSSDMN.exe (FUJITSU LIMITED)

O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\apdproxy.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [DeskUpdateNotifier] C:\Program Files (x86)\Fujitsu\DeskUpdate\DeskUpdateNotifier.exe (Fujitsu Technology Solutions)

O4 - HKLM..\Run: [IMSS] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe ()

O4 - HKLM..\Run: [IndicatorUtility] C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (FUJITSU LIMITED)

O4 - HKLM..\Run: [LoadFUJ02E3] C:\Program Files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe (FUJITSU LIMITED)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [snp2uvc] C:\Windows\vsnp2uvc.exe (Sonix)

O4 - HKCU..\Run: [LtMoh] C:\Program Files\ltmoh\ltmoh.exe (LSI Corp.)

O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\FRONTP~1\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 10.1.0)

O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7766B3EF-851B-4C45-A157-8DFD0A1F03C4}: NameServer = 193.189.244.225 193.189.244.206

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D9EAB02C-B7D5-4BDC-B519-57E1195E5060}: DhcpNameServer = 192.168.1.1

O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found

O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)

O18:64bit: - Protocol\Filter\text/xml - No CLSID value found

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2007.07.16 21:47:26 | 000,000,073 | R--- | M] () - F:\AUTORUN.INF -- [ CDFS ]

O32 - AutoRun File - [2007.05.14 18:30:39 | 000,186,552 | R--- | M] (Adobe Systems Incorporated) - F:\Autoplay.exe -- [ CDFS ]

O32 - AutoRun File - [2008.01.28 18:21:00 | 000,000,000 | ---D | M] - F:\Autoplay -- [ CDFS ]

O33 - MountPoints2\{b50617a9-1611-11e1-807f-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{b50617a9-1611-11e1-807f-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Autoplay.exe -- [2007.05.14 18:30:39 | 000,186,552 | R--- | M] (Adobe Systems Incorporated)

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

 

 

SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

Drivers32: vidc.tscc - C:\Windows\SysWow64\tsccvid.dll (TechSmith Corporation)

 

CREATERESTOREPOINT

Error creating restore point.

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.01.10 19:03:44 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Christoph\Desktop\OTL.exe

[2012.01.10 13:10:48 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Christoph\Desktop\esetsmartinstaller_enu.exe

[2012.01.10 12:22:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip

[2012.01.10 12:17:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client

[2012.01.10 12:17:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FileZilla FTP Client

[2012.01.10 11:27:12 | 000,000,000 | ---D | C] -- C:\ProgramData\WinZip

[2012.01.10 11:27:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinZip

[2012.01.09 17:34:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Macrovision Shared

[2012.01.08 20:06:04 | 000,000,000 | ---D | C] -- C:\Users\Christoph\Desktop\cdex_151

[2012.01.08 15:20:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\eRightSoft

[2012.01.08 12:55:06 | 000,000,000 | --SD | C] -- C:\Users\Christoph\Documents\Meine Websites

[2012.01.08 12:48:35 | 000,000,000 | ---D | C] -- C:\Users\Christoph\Desktop\IFAS-Web

[2012.01.08 11:25:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office

[2012.01.08 11:25:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER

[2012.01.08 11:24:28 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH

[2012.01.08 11:24:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Frontpage

[2012.01.08 11:23:07 | 000,000,000 | RH-D | C] -- C:\MSOCache

[2012.01.08 10:17:22 | 040,497,982 | ---- | C] (eRightSoft                                                  ) -- C:\Users\Christoph\Desktop\SUPERsetup201149.exe

[2011.12.28 19:35:04 | 000,000,000 | R--D | C] -- C:\Users\Christoph\Contacts

[2011.12.27 22:28:27 | 000,022,016 | ---- | C] (Fujitsu Technology Solutions) -- C:\Windows\SysNative\drivers\FscGabi.sys

[2011.12.27 22:28:27 | 000,017,920 | ---- | C] (Fujitsu Technology Solutions) -- C:\Windows\SysNative\drivers\FscEfDmi.sys

[2011.12.27 22:28:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Fujitsu

[2011.12.26 15:41:09 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Wat

[2011.12.26 15:41:09 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Wat

[2011.12.23 10:08:12 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Roaming\Skype

[2011.12.23 10:08:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2011.12.23 10:08:06 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype

[2011.12.23 10:08:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype

[2011.12.20 12:16:44 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Roaming\Malwarebytes

[2011.12.20 12:16:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.12.20 12:16:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.12.20 12:16:37 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2011.12.20 12:16:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2011.12.20 02:28:28 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lugert Verlag

[2011.12.20 02:28:24 | 000,856,064 | ---- | C] (Essien Research & Development) -- C:\Windows\SysWow64\mpgfiltr.ax

[2011.12.20 02:28:24 | 000,155,648 | ---- | C] (Viscom Software www.viscomsoft.com) -- C:\Windows\SysWow64\viscomwaveform.dll

[2011.12.20 02:28:24 | 000,155,648 | ---- | C] (Viscom Software www.viscomsoft.com) -- C:\Windows\SysWow64\AudioCapture.ocx

[2011.12.20 02:28:24 | 000,081,920 | ---- | C] (Viscom Software) -- C:\Windows\SysWow64\viscomwave.dll

[2011.12.20 02:28:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lugert Verlag

[2011.12.20 02:23:45 | 000,493,056 | ---- | C] ( datenhaus GmbH) -- C:\Windows\SysWow64\dhRichClient3.dll

[2011.12.20 02:23:42 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Roaming\OCS

[2011.12.19 23:43:15 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Roaming\Softland

[2011.12.19 23:43:12 | 000,029,008 | ---- | C] (Softland) -- C:\Windows\SysNative\novamnv7.dll

[2011.12.19 23:43:12 | 000,021,328 | ---- | C] (Softland) -- C:\Windows\SysNative\novamiv7.dll

[2011.12.19 23:43:08 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Local\PDF Annotator

[2011.12.19 23:43:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Annotator

[2011.12.19 23:43:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDF Annotator

[2011.12.19 18:44:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy

[2011.12.19 18:44:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy

[2011.12.19 18:44:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy

[2011.12.18 18:58:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET

[2011.12.16 13:02:47 | 000,000,000 | ---D | C] -- C:\Users\Christoph\Desktop\KV Hanse Merkur

[2011.12.16 10:43:14 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Roaming\pdfforge

[2011.12.16 10:43:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator

[2011.12.16 10:43:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDFCreator

[2011.12.15 02:37:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneClick Internet

[2011.12.15 02:36:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OneClickInternet

[2011.12.13 08:10:28 | 000,000,000 | ---D | C] -- C:\Program Files\Musaios 2010

[2011.11.24 10:21:28 | 000,245,760 | ---- | C] ( ) -- C:\Windows\SysWow64\rsnp2uvc.dll

[1 C:\*.tmp files -> C:\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.01.10 19:03:48 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Christoph\Desktop\OTL.exe

[2012.01.10 19:00:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.01.10 18:50:37 | 000,039,730 | ---- | M] () -- C:\Users\Christoph\Desktop\Römische Geschichte.odt

[2012.01.10 15:42:31 | 000,011,026 | ---- | M] () -- C:\Users\Christoph\Desktop\Embedcodes und Sonderzeichen.odt

[2012.01.10 13:10:51 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Christoph\Desktop\esetsmartinstaller_enu.exe

[2012.01.10 12:35:12 | 001,429,878 | ---- | M] () -- C:\Users\Christoph\Desktop\DEURAG_Kundeninformationen 2011 mit Antrag.pdf

[2012.01.10 12:28:57 | 000,024,043 | ---- | M] () -- C:\Users\Christoph\Desktop\Logs.zip

[2012.01.10 12:21:18 | 000,014,256 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.01.10 12:21:18 | 000,014,256 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.01.10 12:13:22 | 3060,338,688 | -HS- | M] () -- C:\hiberfil.sys

[2012.01.09 21:11:00 | 000,000,000 | ---- | M] () -- C:\Users\Christoph\defogger_reenable

[2012.01.09 17:38:00 | 000,306,632 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.01.09 17:32:15 | 000,000,209 | ---- | M] () -- C:\Windows\ODBCINST.INI

[2012.01.09 10:37:54 | 000,056,900 | ---- | M] () -- C:\Users\Christoph\Desktop\Kursplan WF 2012.pdf

[2012.01.09 10:36:32 | 000,021,606 | ---- | M] () -- C:\Users\Christoph\Desktop\Kalenderdemo für Chris(1).ods

[2012.01.08 11:26:12 | 000,000,400 | ---- | M] () -- C:\Windows\ODBC.INI

[2012.01.08 10:18:15 | 040,497,982 | ---- | M] (eRightSoft                                                  ) -- C:\Users\Christoph\Desktop\SUPERsetup201149.exe

[2012.01.03 12:07:29 | 000,047,684 | ---- | M] () -- C:\Users\Christoph\Desktop\Finanzreport_Nr.12_vom_31.12.2011899141.pdf

[2012.01.03 10:47:43 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.01.03 10:47:43 | 000,654,166 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.01.03 10:47:43 | 000,616,008 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.01.03 10:47:43 | 000,130,006 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.01.03 10:47:43 | 000,106,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2011.12.27 08:27:03 | 000,849,070 | ---- | M] () -- C:\Users\Christoph\Desktop\Rechnung.pdf

[2011.12.20 12:30:12 | 000,039,796 | ---- | M] () -- C:\Users\Christoph\Desktop\Kündigung DNS.pdf

[2011.12.20 12:30:07 | 000,012,341 | ---- | M] () -- C:\Users\Christoph\Kündigung DNS.odt

[2011.12.20 02:38:19 | 000,019,456 | ---- | M] () -- C:\Users\Christoph\Desktop\Odyssee-Teil.fnf

[2011.12.19 19:05:38 | 013,366,873 | ---- | M] () -- C:\Users\Christoph\AppData\Local\census.cache

[2011.12.19 18:40:17 | 000,103,913 | ---- | M] () -- C:\Users\Christoph\AppData\Local\ars.cache

[2011.12.18 18:56:37 | 000,000,036 | ---- | M] () -- C:\Users\Christoph\AppData\Local\housecall.guid.cache

[1 C:\*.tmp files -> C:\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.01.10 12:35:11 | 001,429,878 | ---- | C] () -- C:\Users\Christoph\Desktop\DEURAG_Kundeninformationen 2011 mit Antrag.pdf

[2012.01.10 12:23:44 | 000,024,043 | ---- | C] () -- C:\Users\Christoph\Desktop\Logs.zip

[2012.01.09 21:11:00 | 000,000,000 | ---- | C] () -- C:\Users\Christoph\defogger_reenable

[2012.01.09 17:34:17 | 000,001,125 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Elements 6.0.lnk

[2012.01.09 17:32:15 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI

[2012.01.09 10:04:37 | 000,056,900 | ---- | C] () -- C:\Users\Christoph\Desktop\Kursplan WF 2012.pdf

[2012.01.08 20:36:15 | 000,021,606 | ---- | C] () -- C:\Users\Christoph\Desktop\Kalenderdemo für Chris(1).ods

[2012.01.08 11:26:12 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI

[2012.01.07 09:20:49 | 000,306,632 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.01.03 12:07:28 | 000,047,684 | ---- | C] () -- C:\Users\Christoph\Desktop\Finanzreport_Nr.12_vom_31.12.2011899141.pdf

[2011.12.27 08:27:03 | 000,849,070 | ---- | C] () -- C:\Users\Christoph\Desktop\Rechnung.pdf

[2011.12.20 12:30:10 | 000,039,796 | ---- | C] () -- C:\Users\Christoph\Desktop\Kündigung DNS.pdf

[2011.12.20 12:30:05 | 000,012,341 | ---- | C] () -- C:\Users\Christoph\Kündigung DNS.odt

[2011.12.20 02:38:19 | 000,019,456 | ---- | C] () -- C:\Users\Christoph\Desktop\Odyssee-Teil.fnf

[2011.12.20 02:23:45 | 000,338,432 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll

[2011.12.19 23:43:12 | 000,007,549 | ---- | C] () -- C:\Windows\SysNative\novav7.ctm

[2011.12.19 19:05:38 | 013,366,873 | ---- | C] () -- C:\Users\Christoph\AppData\Local\census.cache

[2011.12.19 18:40:17 | 000,103,913 | ---- | C] () -- C:\Users\Christoph\AppData\Local\ars.cache

[2011.12.18 18:56:37 | 000,000,036 | ---- | C] () -- C:\Users\Christoph\AppData\Local\housecall.guid.cache

[2011.12.16 10:43:11 | 000,087,040 | ---- | C] () -- C:\Windows\SysNative\pdfcmnnt.dll

[2011.12.06 19:39:02 | 000,003,963 | ---- | C] () -- C:\ProgramData\wp-config.php

[2011.11.29 12:28:20 | 000,004,474 | ---- | C] () -- C:\Users\Christoph\AppData\Roaming\FjMenu1.XML

[2011.11.29 09:26:17 | 000,005,120 | ---- | C] () -- C:\Users\Christoph\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.11.24 18:48:11 | 000,000,105 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc

[2011.11.24 10:21:27 | 000,024,576 | ---- | C] () -- C:\Windows\snuvcdsm.exe

[2011.11.24 10:21:27 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini

[2011.11.24 10:11:36 | 000,000,208 | ---- | C] () -- C:\Windows\hbcikrnl.ini

[2011.07.28 16:55:44 | 015,079,936 | R--- | C] () -- C:\Windows\SysWow64\BGP901.dll

[2010.09.24 09:15:46 | 000,678,912 | R--- | C] () -- C:\Windows\SysWow64\Bluebeam Javascript Library.dll

[2010.09.24 09:15:42 | 000,246,272 | R--- | C] () -- C:\Windows\SysWow64\Bluebeam JPX Library.dll

[2010.06.02 18:41:30 | 000,127,868 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng575.bin

[2010.06.02 18:41:28 | 000,870,560 | ---- | C] () -- C:\Windows\SysWow64\igkrng575.bin

[2010.06.02 18:41:28 | 000,104,636 | ---- | C] () -- C:\Windows\SysWow64\igfcg575m.bin

[2010.06.02 17:45:28 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\iglhsip32.dll

[2010.06.02 17:45:28 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\iglhcp32.dll

[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT

[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat

[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll

[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll

[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

 
 ========== LOP Check ==========

 

[2012.01.10 12:17:29 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\FileZilla

[2011.12.20 02:23:42 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\OCS

[2011.12.15 04:04:37 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\OneClickInternet

[2011.11.26 11:06:13 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\OpenOffice.org

[2011.12.20 02:23:45 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Opera

[2011.12.16 10:43:14 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\pdfforge

[2011.12.19 23:43:15 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Softland

[2011.11.24 18:19:04 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Thunderbird

[2009.07.14 06:08:49 | 000,016,002 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2012.01.09 17:34:45 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Adobe

[2011.11.24 11:24:44 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Avira

[2012.01.10 12:17:29 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\FileZilla

[2011.11.23 21:48:47 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Identities

[2011.11.24 10:21:11 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\InstallShield

[2011.11.25 21:43:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Macromedia

[2011.12.20 12:16:44 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Malwarebytes

[2009.07.14 08:45:37 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Media Center Programs

[2012.01.08 13:26:15 | 000,000,000 | --SD | M] -- C:\Users\Christoph\AppData\Roaming\Microsoft

[2011.11.24 17:39:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Mozilla

[2011.12.04 16:46:27 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Nero

[2011.12.20 02:23:42 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\OCS

[2011.12.15 04:04:37 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\OneClickInternet

[2011.11.26 11:06:13 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\OpenOffice.org

[2011.12.20 02:23:45 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Opera

[2011.12.16 10:43:14 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\pdfforge

[2012.01.09 14:35:46 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Skype

[2011.12.19 23:43:15 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Softland

[2011.11.24 18:19:04 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Thunderbird

[2011.12.18 16:14:19 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\vlc

[2011.11.25 01:23:38 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\WinRAR

[2012.01.10 12:14:04 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\WTablet

 
 < %APPDATA%\*.exe /s >

[2011.12.20 02:23:42 | 000,106,496 | ---- | M] (OCS) -- C:\Users\Christoph\AppData\Roaming\OCS\SM\SearchAnonymizer.exe

[2011.12.20 02:23:42 | 000,040,960 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows.old\Windows\System32\drivers\AGP440.sys

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows.old\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows.old\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows.old\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows.old\Windows\ERDNT\cache64\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows.old\Windows\System32\drivers\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows.old\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows.old\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows.old\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows.old\Windows\ERDNT\cache86\cngaudit.dll

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows.old\Windows\SysWOW64\cngaudit.dll

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows.old\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows.old\Windows\ERDNT\cache64\cngaudit.dll

[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows.old\Windows\System32\cngaudit.dll

[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2009.11.20 15:09:48 | 000,537,112 | ---- | M] (Intel Corporation) MD5=073A606333B6F7BBF20AA856DF7F0997 -- C:\Fujitsu\Driver Pool\5\iaStor.sys

[2009.11.20 15:09:48 | 000,537,112 | ---- | M] (Intel Corporation) MD5=073A606333B6F7BBF20AA856DF7F0997 -- C:\Users\Christoph\Tools und Utilities\SATA\1044479_intel_9_5_4_1001\iaStor.sys

[2009.11.20 15:09:48 | 000,537,112 | ---- | M] (Intel Corporation) MD5=073A606333B6F7BBF20AA856DF7F0997 -- C:\Windows.old\Windows\System32\drivers\iaStor.sys

[2009.11.20 15:09:48 | 000,537,112 | ---- | M] (Intel Corporation) MD5=073A606333B6F7BBF20AA856DF7F0997 -- C:\Windows.old\Windows\System32\DriverStore\FileRepository\iaahci.inf_amd64_neutral_53f33454d751d4bd\iaStor.sys

[2009.11.20 15:09:48 | 000,537,112 | ---- | M] (Intel Corporation) MD5=073A606333B6F7BBF20AA856DF7F0997 -- C:\Windows.old\Windows\System32\DriverStore\FileRepository\iastor.inf_amd64_neutral_59158fde2592da5a\iaStor.sys

[2010.06.08 09:33:14 | 000,540,696 | ---- | M] (Intel Corporation) MD5=2064090C9FAAD92C090D77E50E735B2E -- C:\Windows\SysNative\drivers\iaStor.sys

[2010.06.08 09:33:14 | 000,540,696 | ---- | M] (Intel Corporation) MD5=2064090C9FAAD92C090D77E50E735B2E -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_b2da0d5f1235b4d6\iaStor.sys

[2010.06.08 09:33:14 | 000,540,696 | ---- | M] (Intel Corporation) MD5=2064090C9FAAD92C090D77E50E735B2E -- C:\Windows\SysNative\DriverStore\FileRepository\iastor.inf_amd64_neutral_1170b46175ba2765\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows.old\Windows\System32\drivers\iaStorV.sys

[2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows.old\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows.old\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2010.11.20 05:33:40 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 05:33:40 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2010.11.26 15:33:30 | 000,410,504 | ---- | M] (Intel Corporation) MD5=513DC087CFED7D2BB82F005385D3531F -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16592_none_0af87721a183cb70\iaStorV.sys

[2011.03.11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011.03.11 07:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011.03.11 07:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows.old\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

[2010.11.26 15:33:30 | 000,410,496 | ---- | M] (Intel Corporation) MD5=E353CF970C5D4D6A092911E15FB78C07 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20712_none_0bd89532ba6088d9\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows.old\Windows\ERDNT\cache64\netlogon.dll

[2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows.old\Windows\System32\netlogon.dll

[2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.20 05:27:24 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.20 05:27:24 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows.old\Windows\ERDNT\cache86\netlogon.dll

[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows.old\Windows\SysWOW64\netlogon.dll

[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows.old\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

[2010.11.20 04:20:30 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.20 04:20:30 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows.old\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2010.11.26 15:33:30 | 000,166,280 | ---- | M] (NVIDIA Corporation) MD5=0AF7B8136794E23E87BE138992880E64 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16592_none_95c1e7d0d8ba7548\nvstor.sys

[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows.old\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011.03.11 07:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011.03.11 07:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2010.11.26 15:33:30 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=CE76755AF933E728CEBA6C7A970838A4 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20712_none_96a205e1f19732b1\nvstor.sys

[2011.03.11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows.old\Windows\System32\drivers\nvstor.sys

[2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows.old\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows.old\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

[2010.11.20 05:33:50 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 05:33:50 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows.old\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows.old\Windows\ERDNT\cache86\scecli.dll

[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows.old\Windows\SysWOW64\scecli.dll

[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows.old\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.20 04:21:06 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.20 04:21:06 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows.old\Windows\ERDNT\cache64\scecli.dll

[2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows.old\Windows\System32\scecli.dll

[2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

[2010.11.20 05:27:26 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.20 05:27:26 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows.old\Windows\ERDNT\cache86\user32.dll

[2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows.old\Windows\SysWOW64\user32.dll

[2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows.old\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2010.11.20 04:08:58 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll

[2010.11.20 04:08:58 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows.old\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

[2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows.old\Windows\ERDNT\cache64\user32.dll

[2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows.old\Windows\System32\user32.dll

[2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

[2010.11.20 05:27:28 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll

[2010.11.20 05:27:28 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows.old\Windows\ERDNT\cache86\userinit.exe

[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows.old\Windows\SysWOW64\userinit.exe

[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows.old\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2010.11.20 04:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.20 04:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows.old\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows.old\Windows\ERDNT\cache64\userinit.exe

[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows.old\Windows\System32\userinit.exe

[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

[2010.11.20 05:25:26 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.20 05:25:26 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows.old\Windows\ERDNT\cache64\wininit.exe

[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows.old\Windows\System32\wininit.exe

[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe

[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows.old\Windows\ERDNT\cache86\wininit.exe

[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows.old\Windows\SysWOW64\wininit.exe

[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows.old\Windows\ERDNT\cache64\winlogon.exe

[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows.old\Windows\System32\winlogon.exe

[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2010.11.20 05:25:32 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.20 05:25:32 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2010.06.03 08:25:55 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2010.06.03 08:25:55 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows.old\Windows\System32\drivers\ws2ifsl.sys

[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >
 

< End of report >

Das ESET-Log hast du aber schon um 15:45 gepostet :confused:

Ich glaube, wir haben uns da gerade überschnitten. Das OTL-Log ist jetzt in meinem letzten Beitrag gepostet.

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

O4:64bit: - HKLM..\Run: []  File not found

O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2007.07.16 21:47:26 | 000,000,073 | R--- | M] () - F:\AUTORUN.INF -- [ CDFS ]

O32 - AutoRun File - [2007.05.14 18:30:39 | 000,186,552 | R--- | M] (Adobe Systems Incorporated) - F:\Autoplay.exe -- [ CDFS ]

O32 - AutoRun File - [2008.01.28 18:21:00 | 000,000,000 | ---D | M] - F:\Autoplay -- [ CDFS ]

O33 - MountPoints2\{b50617a9-1611-11e1-807f-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{b50617a9-1611-11e1-807f-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Autoplay.exe -- [2007.05.14 18:30:39 | 000,186,552 | R--- | M] (Adobe Systems Incorporated)

:Files

C:\Program Files (x86)\PDFCreator\Toolbar

:Commands

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Okay, hier kommt das OTL-Fix-Log:

Code:

All processes killed

========== OTL ==========

64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer deleted successfully.

C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe moved successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

File F:\AUTORUN.INF not found.

File F:\Autoplay.exe not found.

File  not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b50617a9-1611-11e1-807f-806e6f6e6963}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b50617a9-1611-11e1-807f-806e6f6e6963}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b50617a9-1611-11e1-807f-806e6f6e6963}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b50617a9-1611-11e1-807f-806e6f6e6963}\ not found.

File F:\Autoplay.exe not found.

========== FILES ==========

C:\Program Files (x86)\PDFCreator\Toolbar folder moved successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: Administrator

->Temp folder emptied: 5831463 bytes

->Temporary Internet Files folder emptied: 36013 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 34663888 bytes

->Flash cache emptied: 759 bytes

 

User: All Users

 

User: Christoph

->Temp folder emptied: 24406870 bytes

->Temporary Internet Files folder emptied: 1562122 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 44228596 bytes

->Flash cache emptied: 479 bytes

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 6006356 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 29426 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes

RecycleBin emptied: 150944012 bytes

 

Total Files Cleaned = 255,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully
 

OTL by OldTimer - Version 3.2.31.0 log created on 01112012_120649
 

Files\Folders moved on Reboot...

C:\Users\Christoph\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
 

Registry entries deleted on Reboot...

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Das ist der Report des TDSS-Killer:

Code:

16:36:54.0845 1700        TDSS rootkit removing tool 2.7.0.0 Jan 10 2012 09:14:26

16:36:55.0110 1700        ============================================================

16:36:55.0110 1700        Current date / time: 2012/01/11 16:36:55.0110

16:36:55.0110 1700        SystemInfo:

16:36:55.0110 1700        

16:36:55.0110 1700        OS Version: 6.1.7601 ServicePack: 1.0

16:36:55.0110 1700        Product type: Workstation

16:36:55.0110 1700        ComputerName: CHRISTOPH-PC

16:36:55.0110 1700        UserName: Christoph

16:36:55.0110 1700        Windows directory: C:\Windows

16:36:55.0110 1700        System windows directory: C:\Windows

16:36:55.0110 1700        Running under WOW64

16:36:55.0110 1700        Processor architecture: Intel x64

16:36:55.0110 1700        Number of processors: 4

16:36:55.0110 1700        Page size: 0x1000

16:36:55.0110 1700        Boot type: Normal boot

16:36:55.0110 1700        ============================================================

16:36:56.0000 1700        Drive \Device\Harddisk1\DR1 - Size: 0x77700000, SectorSize: 0x200, Cylinders: 0xF3, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K', Flags 0x00000048

16:36:56.0000 1700        Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000, SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K', Flags 0x00000040

16:36:56.0124 1700        Drive \Device\Harddisk1\DR1 - Size: 0x77700000, SectorSize: 0x200, Cylinders: 0xF3, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

16:36:56.0140 1700        Initialize success

16:37:04.0096 5052        ============================================================

16:37:04.0096 5052        Scan started

16:37:04.0096 5052        Mode: Manual; SigCheck; TDLFS; 

16:37:04.0096 5052        ============================================================

16:37:04.0860 5052        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys

16:37:04.0954 5052        1394ohci - ok

16:37:05.0079 5052        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys

16:37:05.0110 5052        ACPI - ok

16:37:05.0328 5052        acpials         (12c5274cd87449a2a37a607cdb321922) C:\Windows\system32\DRIVERS\acpials.sys

16:37:05.0422 5052        acpials - ok

16:37:05.0516 5052        AcpiPmi         (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys

16:37:05.0609 5052        AcpiPmi - ok

16:37:05.0765 5052        adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys

16:37:05.0796 5052        adp94xx - ok

16:37:05.0921 5052        adpahci         (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys

16:37:05.0968 5052        adpahci - ok

16:37:05.0984 5052        adpu320         (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys

16:37:06.0015 5052        adpu320 - ok

16:37:06.0140 5052        AFD             (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys

16:37:06.0218 5052        AFD - ok

16:37:06.0311 5052        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys

16:37:06.0327 5052        agp440 - ok

16:37:06.0436 5052        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys

16:37:06.0467 5052        aliide - ok

16:37:06.0483 5052        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys

16:37:06.0514 5052        amdide - ok

16:37:06.0623 5052        AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys

16:37:06.0701 5052        AmdK8 - ok

16:37:06.0795 5052        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys

16:37:06.0857 5052        AmdPPM - ok

16:37:06.0920 5052        amdsata         (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys

16:37:06.0951 5052        amdsata - ok

16:37:07.0029 5052        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys

16:37:07.0044 5052        amdsbs - ok

16:37:07.0091 5052        amdxata         (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys

16:37:07.0122 5052        amdxata - ok

16:37:07.0247 5052        AppID           (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys

16:37:07.0388 5052        AppID - ok

16:37:07.0512 5052        arc             (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys

16:37:07.0544 5052        arc - ok

16:37:07.0559 5052        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys

16:37:07.0575 5052        arcsas - ok

16:37:07.0606 5052        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

16:37:07.0778 5052        AsyncMac - ok

16:37:07.0871 5052        atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys

16:37:07.0887 5052        atapi - ok

16:37:08.0027 5052        ATSwpWDF        (f97f384b0361c0df4266f59f456d2d3e) C:\Windows\system32\Drivers\ATSwpWDF.sys

16:37:08.0105 5052        ATSwpWDF - ok

16:37:08.0261 5052        avgntflt        (aa8f79a1bdfc03b3bc70c44ab00589b4) C:\Windows\system32\DRIVERS\avgntflt.sys

16:37:08.0292 5052        avgntflt - ok

16:37:08.0308 5052        avipbb          (f1c9db5f7b2a56a0b29667d22ba540fc) C:\Windows\system32\DRIVERS\avipbb.sys

16:37:08.0324 5052        avipbb - ok

16:37:08.0417 5052        avkmgr          (248db59fc86de44d2779f4c7fb1a567d) C:\Windows\system32\DRIVERS\avkmgr.sys

16:37:08.0448 5052        avkmgr - ok

16:37:08.0573 5052        b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys

16:37:08.0667 5052        b06bdrv - ok

16:37:08.0776 5052        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

16:37:08.0838 5052        b57nd60a - ok

16:37:08.0963 5052        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

16:37:09.0041 5052        Beep - ok

16:37:09.0182 5052        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys

16:37:09.0213 5052        blbdrive - ok

16:37:09.0260 5052        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys

16:37:09.0291 5052        bowser - ok

16:37:09.0400 5052        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys

16:37:09.0494 5052        BrFiltLo - ok

16:37:09.0587 5052        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys

16:37:09.0618 5052        BrFiltUp - ok

16:37:09.0634 5052        Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

16:37:09.0712 5052        Brserid - ok

16:37:09.0806 5052        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

16:37:09.0837 5052        BrSerWdm - ok

16:37:09.0852 5052        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

16:37:09.0899 5052        BrUsbMdm - ok

16:37:10.0008 5052        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

16:37:10.0040 5052        BrUsbSer - ok

16:37:10.0149 5052        BthEnum         (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\drivers\BthEnum.sys

16:37:10.0227 5052        BthEnum - ok

16:37:10.0336 5052        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys

16:37:10.0383 5052        BTHMODEM - ok

16:37:10.0508 5052        BthPan          (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys

16:37:10.0539 5052        BthPan - ok

16:37:10.0648 5052        BTHPORT         (64c198198501f7560ee41d8d1efa7952) C:\Windows\System32\Drivers\BTHport.sys

16:37:10.0726 5052        BTHPORT - ok

16:37:10.0820 5052        BTHUSB          (f188b7394d81010767b6df3178519a37) C:\Windows\System32\Drivers\BTHUSB.sys

16:37:10.0866 5052        BTHUSB - ok

16:37:10.0898 5052        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

16:37:10.0976 5052        cdfs - ok

16:37:11.0069 5052        cdrom           (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys

16:37:11.0132 5052        cdrom - ok

16:37:11.0256 5052        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys

16:37:11.0303 5052        circlass - ok

16:37:11.0350 5052        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

16:37:11.0397 5052        CLFS - ok

16:37:11.0537 5052        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys

16:37:11.0584 5052        CmBatt - ok

16:37:11.0615 5052        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys

16:37:11.0646 5052        cmdide - ok

16:37:11.0756 5052        CNG             (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys

16:37:11.0802 5052        CNG - ok

16:37:11.0912 5052        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys

16:37:11.0943 5052        Compbatt - ok

16:37:11.0974 5052        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys

16:37:12.0021 5052        CompositeBus - ok

16:37:12.0146 5052        crcdisk         (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys

16:37:12.0161 5052        crcdisk - ok

16:37:12.0224 5052        CSC             (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys

16:37:12.0302 5052        CSC - ok

16:37:12.0458 5052        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys

16:37:12.0520 5052        DfsC - ok

16:37:12.0551 5052        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

16:37:12.0614 5052        discache - ok

16:37:12.0723 5052        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys

16:37:12.0738 5052        Disk - ok

16:37:12.0801 5052        drmkaud         (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

16:37:12.0832 5052        drmkaud - ok

16:37:12.0941 5052        DXGKrnl         (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys

16:37:12.0988 5052        DXGKrnl - ok

16:37:13.0113 5052        e1kexpress      (52a482dc61f24b498c8268866b90bb44) C:\Windows\system32\DRIVERS\e1k62x64.sys

16:37:13.0144 5052        e1kexpress - ok

16:37:13.0238 5052        ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys

16:37:13.0394 5052        ebdrv - ok

16:37:13.0534 5052        elxstor         (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys

16:37:13.0565 5052        elxstor - ok

16:37:13.0674 5052        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys

16:37:13.0768 5052        ErrDev - ok

16:37:13.0893 5052        exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

16:37:13.0971 5052        exfat - ok

16:37:13.0986 5052        fastfat         (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

16:37:14.0049 5052        fastfat - ok

16:37:14.0174 5052        fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys

16:37:14.0236 5052        fdc - ok

16:37:14.0361 5052        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

16:37:14.0376 5052        FileInfo - ok

16:37:14.0392 5052        Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

16:37:14.0454 5052        Filetrace - ok

16:37:14.0548 5052        FjBtnDrv        (5e5203a036f5477b302ef15494d8a9d4) C:\Windows\system32\DRIVERS\FjBtnDrv.sys

16:37:14.0626 5052        FjBtnDrv - ok

16:37:14.0751 5052        FJGSDisk        (d5a72cca060bef75075877c0ad504df0) C:\Windows\system32\DRIVERS\FJGSDisk.sys

16:37:14.0766 5052        FJGSDisk - ok

16:37:14.0891 5052        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys

16:37:14.0938 5052        flpydisk - ok

16:37:14.0985 5052        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys

16:37:15.0016 5052        FltMgr - ok

16:37:15.0110 5052        FscEfDmi        (db75b9978e83c8d1e2a2aece3fece608) C:\Windows\system32\DRIVERS\FscEfDmi.sys

16:37:15.0156 5052        FscEfDmi - ok

16:37:15.0188 5052        FscGabi         (4d1f8b1844f3317b4ca2fa7db1af2c98) C:\Windows\system32\DRIVERS\FscGabi.sys

16:37:15.0234 5052        FscGabi - ok

16:37:15.0344 5052        FsDepends       (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

16:37:15.0359 5052        FsDepends - ok

16:37:15.0390 5052        Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys

16:37:15.0406 5052        Fs_Rec - ok

16:37:15.0453 5052        FUJ02B1         (ba0c1ffda496d8bcbcac63f8d98d20e3) C:\Windows\system32\DRIVERS\FUJ02B1.sys

16:37:15.0515 5052        FUJ02B1 - ok

16:37:15.0640 5052        FUJ02E3         (7135030cbf87d724b6037bb023923730) C:\Windows\system32\DRIVERS\FUJ02E3.sys

16:37:15.0687 5052        FUJ02E3 - ok

16:37:15.0812 5052        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys

16:37:15.0843 5052        fvevol - ok

16:37:15.0890 5052        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys

16:37:15.0905 5052        gagp30kx - ok

16:37:15.0936 5052        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

16:37:16.0014 5052        hcw85cir - ok

16:37:16.0108 5052        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys

16:37:16.0186 5052        HdAudAddService - ok

16:37:16.0358 5052        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys

16:37:16.0404 5052        HDAudBus - ok

16:37:16.0498 5052        HECIx64         (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\DRIVERS\HECIx64.sys

16:37:16.0514 5052        HECIx64 - ok

16:37:16.0560 5052        HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys

16:37:16.0592 5052        HidBatt - ok

16:37:16.0716 5052        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys

16:37:16.0779 5052        HidBth - ok

16:37:16.0872 5052        HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys

16:37:16.0904 5052        HidIr - ok

16:37:17.0044 5052        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys

16:37:17.0075 5052        HidUsb - ok

16:37:17.0122 5052        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys

16:37:17.0138 5052        HpSAMD - ok

16:37:17.0262 5052        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys

16:37:17.0340 5052        HTTP - ok

16:37:17.0465 5052        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys

16:37:17.0481 5052        hwpolicy - ok

16:37:17.0512 5052        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys

16:37:17.0528 5052        i8042prt - ok

16:37:17.0652 5052        iaStor          (2064090c9faad92c090d77e50e735b2e) C:\Windows\system32\DRIVERS\iaStor.sys

16:37:17.0668 5052        iaStor - ok

16:37:17.0777 5052        iaStorV         (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys

16:37:17.0824 5052        iaStorV - ok

16:37:18.0058 5052        igfx            (fbacbed7a37b3223822470ff1d8ea00f) C:\Windows\system32\DRIVERS\igdkmd64.sys

16:37:18.0432 5052        igfx - ok

16:37:18.0542 5052        iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys

16:37:18.0573 5052        iirsp - ok

16:37:18.0620 5052        Impcd           (dd587a55390ed2295bce6d36ad567da9) C:\Windows\system32\DRIVERS\Impcd.sys

16:37:18.0666 5052        Impcd - ok

16:37:18.0822 5052        IntcAzAudAddService (9aa6a93852e36fe76c3f7fc2904f3b01) C:\Windows\system32\drivers\RTKVHD64.sys

16:37:18.0869 5052        IntcAzAudAddService - ok

16:37:18.0978 5052        IntcDAud        (58cf58dee26c909bd6f977b61d246295) C:\Windows\system32\DRIVERS\IntcDAud.sys

16:37:19.0041 5052        IntcDAud - ok

16:37:19.0150 5052        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys

16:37:19.0166 5052        intelide - ok

16:37:19.0228 5052        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys

16:37:19.0259 5052        intelppm - ok

16:37:19.0368 5052        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys

16:37:19.0446 5052        IpFilterDriver - ok

16:37:19.0493 5052        IPMIDRV         (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys

16:37:19.0509 5052        IPMIDRV - ok

16:37:19.0618 5052        IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

16:37:19.0680 5052        IPNAT - ok

16:37:19.0727 5052        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

16:37:19.0805 5052        IRENUM - ok

16:37:19.0899 5052        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys

16:37:19.0914 5052        isapnp - ok

16:37:19.0946 5052        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys

16:37:19.0977 5052        iScsiPrt - ok

16:37:20.0070 5052        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys

16:37:20.0086 5052        kbdclass - ok

16:37:20.0148 5052        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys

16:37:20.0195 5052        kbdhid - ok

16:37:20.0289 5052        KSecDD          (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys

16:37:20.0304 5052        KSecDD - ok

16:37:20.0351 5052        KSecPkg         (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys

16:37:20.0382 5052        KSecPkg - ok

16:37:20.0460 5052        ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

16:37:20.0554 5052        ksthunk - ok

16:37:20.0679 5052        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

16:37:20.0757 5052        lltdio - ok

16:37:20.0897 5052        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys

16:37:20.0928 5052        LSI_FC - ok

16:37:20.0944 5052        LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys

16:37:20.0960 5052        LSI_SAS - ok

16:37:20.0975 5052        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys

16:37:20.0991 5052        LSI_SAS2 - ok

16:37:21.0116 5052        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys

16:37:21.0162 5052        LSI_SCSI - ok

16:37:21.0225 5052        luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

16:37:21.0303 5052        luafv - ok

16:37:21.0412 5052        MBAMProtector   (79da94b35371b9e7104460c7693dcb2c) C:\Windows\system32\drivers\mbam.sys

16:37:21.0428 5052        MBAMProtector - ok

16:37:21.0490 5052        megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys

16:37:21.0506 5052        megasas - ok

16:37:21.0537 5052        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys

16:37:21.0568 5052        MegaSR - ok

16:37:21.0646 5052        Modem           (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

16:37:21.0724 5052        Modem - ok

16:37:21.0849 5052        monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

16:37:21.0880 5052        monitor - ok

16:37:21.0942 5052        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys

16:37:21.0974 5052        mouclass - ok

16:37:22.0052 5052        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys

16:37:22.0098 5052        mouhid - ok

16:37:22.0161 5052        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys

16:37:22.0176 5052        mountmgr - ok

16:37:22.0254 5052        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys

16:37:22.0286 5052        mpio - ok

16:37:22.0332 5052        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

16:37:22.0410 5052        mpsdrv - ok

16:37:22.0504 5052        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys

16:37:22.0598 5052        MRxDAV - ok

16:37:22.0707 5052        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys

16:37:22.0769 5052        mrxsmb - ok

16:37:22.0878 5052        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys

16:37:22.0925 5052        mrxsmb10 - ok

16:37:22.0941 5052        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

16:37:22.0972 5052        mrxsmb20 - ok

16:37:23.0066 5052        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys

16:37:23.0081 5052        msahci - ok

16:37:23.0097 5052        msdsm           (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys

16:37:23.0128 5052        msdsm - ok

16:37:23.0222 5052        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

16:37:23.0268 5052        Msfs - ok

16:37:23.0284 5052        mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

16:37:23.0362 5052        mshidkmdf - ok

16:37:23.0456 5052        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys

16:37:23.0471 5052        msisadrv - ok

16:37:23.0565 5052        MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

16:37:23.0643 5052        MSKSSRV - ok

16:37:23.0705 5052        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

16:37:23.0752 5052        MSPCLOCK - ok

16:37:23.0799 5052        MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

16:37:23.0892 5052        MSPQM - ok

16:37:23.0986 5052        MsRPC           (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys

16:37:24.0017 5052        MsRPC - ok

16:37:24.0064 5052        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys

16:37:24.0080 5052        mssmbios - ok

16:37:24.0173 5052        MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

16:37:24.0267 5052        MSTEE - ok

16:37:24.0314 5052        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys

16:37:24.0407 5052        MTConfig - ok

16:37:24.0485 5052        Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

16:37:24.0516 5052        Mup - ok

16:37:24.0563 5052        NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

16:37:24.0610 5052        NativeWifiP - ok

16:37:24.0719 5052        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys

16:37:24.0750 5052        NDIS - ok

16:37:24.0875 5052        NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

16:37:24.0938 5052        NdisCap - ok

16:37:25.0062 5052        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

16:37:25.0109 5052        NdisTapi - ok

16:37:25.0172 5052        Ndisuio         (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys

16:37:25.0250 5052        Ndisuio - ok

16:37:25.0359 5052        NdisWan         (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys

16:37:25.0437 5052        NdisWan - ok

16:37:25.0484 5052        NDProxy         (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys

16:37:25.0546 5052        NDProxy - ok

16:37:25.0671 5052        NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

16:37:25.0749 5052        NetBIOS - ok

16:37:25.0796 5052        NetBT           (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys

16:37:25.0858 5052        NetBT - ok

16:37:26.0108 5052        NETw5s64        (4d85a450edef10c38882182753a49aae) C:\Windows\system32\DRIVERS\NETw5s64.sys

16:37:26.0342 5052        NETw5s64 - ok

16:37:26.0466 5052        nfrd960         (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys

16:37:26.0482 5052        nfrd960 - ok

16:37:26.0513 5052        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

16:37:26.0576 5052        Npfs - ok

16:37:26.0700 5052        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

16:37:26.0763 5052        nsiproxy - ok

16:37:26.0919 5052        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys

16:37:26.0966 5052        Ntfs - ok

16:37:27.0075 5052        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

16:37:27.0153 5052        Null - ok

16:37:27.0200 5052        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys

16:37:27.0231 5052        nvraid - ok

16:37:27.0293 5052        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys

16:37:27.0324 5052        nvstor - ok

16:37:27.0387 5052        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys

16:37:27.0402 5052        nv_agp - ok

16:37:27.0512 5052        O2MDRDR         (aecff27d5c70f295b09b85efe3292ed1) C:\Windows\system32\DRIVERS\o2mdx64.sys

16:37:27.0527 5052        O2MDRDR - ok

16:37:27.0574 5052        O2SCBUS         (3b179a7eff9edcc045f5570510c812f6) C:\Windows\system32\DRIVERS\ozscrx64.sys

16:37:27.0590 5052        O2SCBUS - ok

16:37:27.0652 5052        O2SDRDR         (df014c48015b637790be3eddd1384728) C:\Windows\system32\DRIVERS\o2sdx64.sys

16:37:27.0668 5052        O2SDRDR - ok

16:37:27.0714 5052        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys

16:37:27.0761 5052        ohci1394 - ok

16:37:27.0886 5052        Parport         (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys

16:37:27.0917 5052        Parport - ok

16:37:27.0980 5052        partmgr         (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys

16:37:27.0995 5052        partmgr - ok

16:37:28.0073 5052        pci             (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys

16:37:28.0104 5052        pci - ok

16:37:28.0136 5052        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys

16:37:28.0151 5052        pciide - ok

16:37:28.0214 5052        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys

16:37:28.0229 5052        pcmcia - ok

16:37:28.0292 5052        pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

16:37:28.0307 5052        pcw - ok

16:37:28.0370 5052        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

16:37:28.0448 5052        PEAUTH - ok

16:37:28.0604 5052        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys

16:37:28.0682 5052        PptpMiniport - ok

16:37:28.0713 5052        Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys

16:37:28.0744 5052        Processor - ok

16:37:28.0884 5052        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys

16:37:28.0947 5052        Psched - ok

16:37:29.0087 5052        PxHlpa64        (a6bf0a9b5a30d743623ca0d3be35df05) C:\Windows\system32\Drivers\PxHlpa64.sys

16:37:29.0103 5052        PxHlpa64 - ok

16:37:29.0150 5052        qcfiltersra2k   (418914bbaf7b2961f712e8059b6a1044) C:\Windows\system32\DRIVERS\qcfiltersra2k.sys

16:37:29.0181 5052        qcfiltersra2k - ok

16:37:29.0306 5052        qcusbnetsra2k   (feb9abd8e036cbb2ae520e3bd9d78e2b) C:\Windows\system32\DRIVERS\qcusbnetsra2k.sys

16:37:29.0337 5052        qcusbnetsra2k - ok

16:37:29.0462 5052        qcusbsersra2k   (9b682f4bdde7453ecdc70572c52dd97b) C:\Windows\system32\DRIVERS\qcusbsersra2k.sys

16:37:29.0508 5052        qcusbsersra2k - ok

16:37:29.0664 5052        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys

16:37:29.0711 5052        ql2300 - ok

16:37:29.0836 5052        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys

16:37:29.0852 5052        ql40xx - ok

16:37:29.0883 5052        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

16:37:29.0914 5052        QWAVEdrv - ok

16:37:30.0023 5052        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

16:37:30.0086 5052        RasAcd - ok

16:37:30.0210 5052        RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

16:37:30.0273 5052        RasAgileVpn - ok

16:37:30.0320 5052        Rasl2tp         (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys

16:37:30.0398 5052        Rasl2tp - ok

16:37:30.0522 5052        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

16:37:30.0600 5052        RasPppoe - ok

16:37:30.0725 5052        RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

16:37:30.0803 5052        RasSstp - ok

16:37:30.0834 5052        rdbss           (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys

16:37:30.0897 5052        rdbss - ok

16:37:31.0006 5052        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys

16:37:31.0053 5052        rdpbus - ok

16:37:31.0084 5052        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

16:37:31.0178 5052        RDPCDD - ok

16:37:31.0271 5052        RDPDR           (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys

16:37:31.0334 5052        RDPDR - ok

16:37:31.0443 5052        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

16:37:31.0505 5052        RDPENCDD - ok

16:37:31.0536 5052        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

16:37:31.0568 5052        RDPREFMP - ok

16:37:31.0677 5052        RDPWD           (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys

16:37:31.0739 5052        RDPWD - ok

16:37:31.0817 5052        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys

16:37:31.0833 5052        rdyboost - ok

16:37:31.0926 5052        RFCOMM          (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys

16:37:31.0989 5052        RFCOMM - ok

16:37:32.0114 5052        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

16:37:32.0192 5052        rspndr - ok

16:37:32.0238 5052        s3cap           (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys

16:37:32.0301 5052        s3cap - ok

16:37:32.0379 5052        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys

16:37:32.0410 5052        sbp2port - ok

16:37:32.0613 5052        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys

16:37:32.0660 5052        scfilter - ok

16:37:32.0722 5052        sdbus           (111e0ebc0ad79cb0fa014b907b231cf0) C:\Windows\system32\drivers\sdbus.sys

16:37:32.0784 5052        sdbus - ok

16:37:32.0925 5052        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

16:37:33.0003 5052        secdrv - ok

16:37:33.0128 5052        Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys

16:37:33.0159 5052        Serenum - ok

16:37:33.0299 5052        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys

16:37:33.0330 5052        Serial - ok

16:37:33.0362 5052        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys

16:37:33.0393 5052        sermouse - ok

16:37:33.0502 5052        sffdisk         (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys

16:37:33.0549 5052        sffdisk - ok

16:37:33.0642 5052        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys

16:37:33.0705 5052        sffp_mmc - ok

16:37:33.0736 5052        sffp_sd         (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys

16:37:33.0798 5052        sffp_sd - ok

16:37:33.0908 5052        sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys

16:37:33.0970 5052        sfloppy - ok

16:37:34.0017 5052        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys

16:37:34.0032 5052        SiSRaid2 - ok

16:37:34.0157 5052        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys

16:37:34.0173 5052        SiSRaid4 - ok

16:37:34.0251 5052        Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

16:37:34.0313 5052        Smb - ok

16:37:34.0500 5052        SNP2UVC         (ed116ef32d0c80596b5cc9b16799b29a) C:\Windows\system32\DRIVERS\snp2uvc.sys

16:37:34.0656 5052        SNP2UVC - ok

16:37:34.0766 5052        spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

16:37:34.0781 5052        spldr - ok

16:37:34.0828 5052        srv             (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys

16:37:34.0875 5052        srv - ok

16:37:34.0984 5052        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys

16:37:35.0015 5052        srv2 - ok

16:37:35.0062 5052        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys

16:37:35.0109 5052        srvnet - ok

16:37:35.0202 5052        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys

16:37:35.0234 5052        stexstor - ok

16:37:35.0343 5052        storflt         (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys

16:37:35.0358 5052        storflt - ok

16:37:35.0374 5052        storvsc         (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys

16:37:35.0390 5052        storvsc - ok

16:37:35.0468 5052        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys

16:37:35.0499 5052        swenum - ok

16:37:35.0546 5052        SynTP           (2f827bb08cc7f1a17df2ead7b424d731) C:\Windows\system32\DRIVERS\SynTP.sys

16:37:35.0577 5052        SynTP - ok

16:37:35.0748 5052        Tcpip           (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys

16:37:35.0811 5052        Tcpip - ok

16:37:35.0967 5052        TCPIP6          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys

16:37:36.0014 5052        TCPIP6 - ok

16:37:36.0107 5052        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys

16:37:36.0185 5052        tcpipreg - ok

16:37:36.0232 5052        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

16:37:36.0263 5052        TDPIPE - ok

16:37:36.0372 5052        TDTCP           (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys

16:37:36.0466 5052        TDTCP - ok

16:37:36.0544 5052        tdx             (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys

16:37:36.0591 5052        tdx - ok

16:37:36.0669 5052        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys

16:37:36.0684 5052        TermDD - ok

16:37:36.0809 5052        TPM             (dbcc20c02e8a3e43b03c304a4e40a84f) C:\Windows\system32\drivers\tpm.sys

16:37:36.0856 5052        TPM - ok

16:37:36.0996 5052        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys

16:37:37.0043 5052        tssecsrv - ok

16:37:37.0090 5052        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys

16:37:37.0168 5052        TsUsbFlt - ok

16:37:37.0277 5052        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys

16:37:37.0355 5052        tunnel - ok

16:37:37.0386 5052        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys

16:37:37.0402 5052        uagp35 - ok

16:37:37.0527 5052        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys

16:37:37.0589 5052        udfs - ok

16:37:37.0714 5052        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys

16:37:37.0730 5052        uliagpkx - ok

16:37:37.0776 5052        umbus           (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys

16:37:37.0823 5052        umbus - ok

16:37:37.0917 5052        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys

16:37:37.0964 5052        UmPass - ok

16:37:38.0010 5052        usbaudio        (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys

16:37:38.0073 5052        usbaudio - ok

16:37:38.0182 5052        usbccgp         (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys

16:37:38.0213 5052        usbccgp - ok

16:37:38.0322 5052        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys

16:37:38.0369 5052        usbcir - ok

16:37:38.0447 5052        usbehci         (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys

16:37:38.0494 5052        usbehci - ok

16:37:38.0525 5052        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys

16:37:38.0572 5052        usbhub - ok

16:37:38.0681 5052        usbohci         (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys

16:37:38.0712 5052        usbohci - ok

16:37:38.0837 5052        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys

16:37:38.0884 5052        usbprint - ok

16:37:38.0946 5052        usbscan         (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys

16:37:38.0993 5052        usbscan - ok

16:37:39.0056 5052        USBSTOR         (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS

16:37:39.0134 5052        USBSTOR - ok

16:37:39.0227 5052        usbuhci         (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys

16:37:39.0258 5052        usbuhci - ok

16:37:39.0336 5052        usbvideo        (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys

16:37:39.0368 5052        usbvideo - ok

16:37:39.0461 5052        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys

16:37:39.0477 5052        vdrvroot - ok

16:37:39.0555 5052        vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

16:37:39.0586 5052        vga - ok

16:37:39.0648 5052        VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

16:37:39.0726 5052        VgaSave - ok

16:37:39.0789 5052        vhdmp           (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys

16:37:39.0820 5052        vhdmp - ok

16:37:39.0898 5052        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys

16:37:39.0929 5052        viaide - ok

16:37:39.0960 5052        vmbus           (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys

16:37:39.0992 5052        vmbus - ok

16:37:40.0038 5052        VMBusHID        (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys

16:37:40.0085 5052        VMBusHID - ok

16:37:40.0148 5052        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys

16:37:40.0163 5052        volmgr - ok

16:37:40.0257 5052        volmgrx         (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys

16:37:40.0288 5052        volmgrx - ok

16:37:40.0319 5052        volsnap         (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys

16:37:40.0335 5052        volsnap - ok

16:37:40.0413 5052        vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys

16:37:40.0444 5052        vsmraid - ok

16:37:40.0475 5052        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys

16:37:40.0538 5052        vwifibus - ok

16:37:40.0662 5052        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys

16:37:40.0694 5052        vwififlt - ok

16:37:40.0756 5052        wacommousefilter (e04d43c7d1641e95d35cae6086c7e350) C:\Windows\system32\DRIVERS\wacommousefilter.sys

16:37:40.0772 5052        wacommousefilter - ok

16:37:40.0850 5052        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys

16:37:40.0881 5052        WacomPen - ok

16:37:40.0943 5052        wacomvhid       (ec1ceb237e365330c1fcfc4876aa0ac0) C:\Windows\system32\DRIVERS\wacomvhid.sys

16:37:40.0959 5052        wacomvhid - ok

16:37:41.0052 5052        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

16:37:41.0130 5052        WANARP - ok

16:37:41.0130 5052        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

16:37:41.0162 5052        Wanarpv6 - ok

16:37:41.0302 5052        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys

16:37:41.0318 5052        Wd - ok

16:37:41.0349 5052        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

16:37:41.0364 5052        Wdf01000 - ok

16:37:41.0505 5052        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

16:37:41.0552 5052        WfpLwf - ok

16:37:41.0598 5052        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

16:37:41.0598 5052        WIMMount - ok

16:37:41.0708 5052        WISDPen         (de5f22e0904e5ac80226db7fb4068ba6) C:\Windows\system32\DRIVERS\wisdpen.sys

16:37:41.0723 5052        WISDPen - ok

16:37:41.0770 5052        WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys

16:37:41.0801 5052        WmiAcpi - ok

16:37:41.0926 5052        ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

16:37:42.0004 5052        ws2ifsl - ok

16:37:42.0144 5052        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys

16:37:42.0207 5052        WudfPf - ok

16:37:42.0332 5052        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys

16:37:42.0425 5052        WUDFRd - ok

16:37:42.0456 5052        MBR (0x1B8)     (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR1

16:37:42.0581 5052        \Device\Harddisk1\DR1 - ok

16:37:42.0597 5052        MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0

16:37:42.0722 5052        \Device\Harddisk0\DR0 - ok

16:37:42.0737 5052        MBR (0x1B8)     (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR1

16:37:42.0862 5052        \Device\Harddisk1\DR1 - ok

16:37:42.0862 5052        Boot (0x1200)   (8c6dc00650eb2ede3222d4f5343c4ba9) \Device\Harddisk1\DR1\Partition0

16:37:42.0862 5052        \Device\Harddisk1\DR1\Partition0 - ok

16:37:42.0893 5052        Boot (0x1200)   (6b70ce4e67b9adf38c418a2b41f67bb1) \Device\Harddisk0\DR0\Partition0

16:37:42.0893 5052        \Device\Harddisk0\DR0\Partition0 - ok

16:37:42.0893 5052        Boot (0x1200)   (8c6dc00650eb2ede3222d4f5343c4ba9) \Device\Harddisk1\DR1\Partition0

16:37:42.0893 5052        \Device\Harddisk1\DR1\Partition0 - ok

16:37:42.0893 5052        ============================================================

16:37:42.0893 5052        Scan finished

16:37:42.0893 5052        ============================================================

16:37:42.0893 4976        Detected object count: 0

16:37:42.0893 4976        Actual detected object count: 0

Eine Frage noch: Was genau meinst du hier mit "im normalen Windows-Modus"?

Ich habe TDSS-Killer jetzt nach dem normalen Hochfahren, NICHT als Admin und bei eingeschalteten Virenscannern laufen lassen. Hoffe, das war so richtig... :dummguck:

Normaler Modus bedeutet NICHT der abgesicherte Modus
Und die Bereinigungstools ohne Adminrechte sind sinnfrei...

Sorry, hatte mir sowas schon gedacht. Also hier nochmal mit Admin-Rechten:

Code:

19:06:02.0225 2912        TDSS rootkit removing tool 2.7.0.0 Jan 10 2012 09:14:26

19:06:02.0428 2912        ============================================================

19:06:02.0428 2912        Current date / time: 2012/01/11 19:06:02.0428

19:06:02.0428 2912        SystemInfo:

19:06:02.0428 2912        

19:06:02.0428 2912        OS Version: 6.1.7601 ServicePack: 1.0

19:06:02.0428 2912        Product type: Workstation

19:06:02.0428 2912        ComputerName: CHRISTOPH-PC

19:06:02.0428 2912        UserName: Christoph

19:06:02.0428 2912        Windows directory: C:\Windows

19:06:02.0428 2912        System windows directory: C:\Windows

19:06:02.0428 2912        Running under WOW64

19:06:02.0428 2912        Processor architecture: Intel x64

19:06:02.0428 2912        Number of processors: 4

19:06:02.0428 2912        Page size: 0x1000

19:06:02.0428 2912        Boot type: Normal boot

19:06:02.0428 2912        ============================================================

19:06:03.0177 2912        Drive \Device\Harddisk1\DR1 - Size: 0x77700000, SectorSize: 0x200, Cylinders: 0xF3, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K', Flags 0x00000048

19:06:03.0177 2912        Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000, SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K', Flags 0x00000040

19:06:03.0301 2912        Drive \Device\Harddisk1\DR1 - Size: 0x77700000, SectorSize: 0x200, Cylinders: 0xF3, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

19:06:03.0333 2912        Initialize success

19:06:09.0713 1748        ============================================================

19:06:09.0713 1748        Scan started

19:06:09.0713 1748        Mode: Manual; SigCheck; TDLFS; 

19:06:09.0713 1748        ============================================================

19:06:10.0212 1748        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys

19:06:10.0275 1748        1394ohci - ok

19:06:10.0321 1748        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys

19:06:10.0353 1748        ACPI - ok

19:06:10.0462 1748        acpials         (12c5274cd87449a2a37a607cdb321922) C:\Windows\system32\DRIVERS\acpials.sys

19:06:10.0477 1748        acpials - ok

19:06:10.0571 1748        AcpiPmi         (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys

19:06:10.0602 1748        AcpiPmi - ok

19:06:10.0743 1748        adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys

19:06:10.0774 1748        adp94xx - ok

19:06:10.0883 1748        adpahci         (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys

19:06:10.0914 1748        adpahci - ok

19:06:10.0930 1748        adpu320         (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys

19:06:10.0945 1748        adpu320 - ok

19:06:11.0086 1748        AFD             (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys

19:06:11.0117 1748        AFD - ok

19:06:11.0242 1748        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys

19:06:11.0257 1748        agp440 - ok

19:06:11.0320 1748        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys

19:06:11.0335 1748        aliide - ok

19:06:11.0398 1748        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys

19:06:11.0413 1748        amdide - ok

19:06:11.0491 1748        AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys

19:06:11.0507 1748        AmdK8 - ok

19:06:11.0601 1748        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys

19:06:11.0616 1748        AmdPPM - ok

19:06:11.0694 1748        amdsata         (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys

19:06:11.0710 1748        amdsata - ok

19:06:11.0819 1748        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys

19:06:11.0835 1748        amdsbs - ok

19:06:11.0913 1748        amdxata         (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys

19:06:11.0928 1748        amdxata - ok

19:06:12.0115 1748        AppID           (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys

19:06:12.0162 1748        AppID - ok

19:06:12.0256 1748        arc             (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys

19:06:12.0271 1748        arc - ok

19:06:12.0318 1748        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys

19:06:12.0334 1748        arcsas - ok

19:06:12.0412 1748        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

19:06:12.0459 1748        AsyncMac - ok

19:06:12.0537 1748        atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys

19:06:12.0552 1748        atapi - ok

19:06:12.0708 1748        ATSwpWDF        (f97f384b0361c0df4266f59f456d2d3e) C:\Windows\system32\Drivers\ATSwpWDF.sys

19:06:12.0771 1748        ATSwpWDF - ok

19:06:12.0911 1748        avgntflt        (aa8f79a1bdfc03b3bc70c44ab00589b4) C:\Windows\system32\DRIVERS\avgntflt.sys

19:06:12.0927 1748        avgntflt - ok

19:06:12.0942 1748        avipbb          (f1c9db5f7b2a56a0b29667d22ba540fc) C:\Windows\system32\DRIVERS\avipbb.sys

19:06:12.0942 1748        avipbb - ok

19:06:13.0051 1748        avkmgr          (248db59fc86de44d2779f4c7fb1a567d) C:\Windows\system32\DRIVERS\avkmgr.sys

19:06:13.0051 1748        avkmgr - ok

19:06:13.0192 1748        b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys

19:06:13.0223 1748        b06bdrv - ok

19:06:13.0332 1748        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

19:06:13.0348 1748        b57nd60a - ok

19:06:13.0379 1748        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

19:06:13.0426 1748        Beep - ok

19:06:13.0566 1748        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys

19:06:13.0597 1748        blbdrive - ok

19:06:13.0816 1748        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys

19:06:13.0831 1748        bowser - ok

19:06:14.0065 1748        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys

19:06:14.0081 1748        BrFiltLo - ok

19:06:14.0081 1748        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys

19:06:14.0097 1748        BrFiltUp - ok

19:06:14.0112 1748        Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

19:06:14.0128 1748        Brserid - ok

19:06:14.0221 1748        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

19:06:14.0253 1748        BrSerWdm - ok

19:06:14.0268 1748        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

19:06:14.0284 1748        BrUsbMdm - ok

19:06:14.0284 1748        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

19:06:14.0299 1748        BrUsbSer - ok

19:06:14.0346 1748        BthEnum         (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\drivers\BthEnum.sys

19:06:14.0362 1748        BthEnum - ok

19:06:14.0440 1748        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys

19:06:14.0471 1748        BTHMODEM - ok

19:06:14.0549 1748        BthPan          (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys

19:06:14.0580 1748        BthPan - ok

19:06:14.0705 1748        BTHPORT         (64c198198501f7560ee41d8d1efa7952) C:\Windows\System32\Drivers\BTHport.sys

19:06:14.0736 1748        BTHPORT - ok

19:06:14.0830 1748        BTHUSB          (f188b7394d81010767b6df3178519a37) C:\Windows\System32\Drivers\BTHUSB.sys

19:06:14.0845 1748        BTHUSB - ok

19:06:14.0908 1748        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

19:06:14.0955 1748        cdfs - ok

19:06:15.0048 1748        cdrom           (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys

19:06:15.0064 1748        cdrom - ok

19:06:15.0126 1748        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys

19:06:15.0142 1748        circlass - ok

19:06:15.0251 1748        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

19:06:15.0282 1748        CLFS - ok

19:06:15.0407 1748        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys

19:06:15.0438 1748        CmBatt - ok

19:06:15.0469 1748        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys

19:06:15.0485 1748        cmdide - ok

19:06:15.0516 1748        CNG             (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys

19:06:15.0563 1748        CNG - ok

19:06:15.0688 1748        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys

19:06:15.0703 1748        Compbatt - ok

19:06:15.0766 1748        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys

19:06:15.0797 1748        CompositeBus - ok

19:06:15.0891 1748        crcdisk         (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys

19:06:15.0906 1748        crcdisk - ok

19:06:15.0984 1748        CSC             (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys

19:06:16.0015 1748        CSC - ok

19:06:16.0156 1748        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys

19:06:16.0234 1748        DfsC - ok

19:06:16.0265 1748        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

19:06:16.0296 1748        discache - ok

19:06:16.0405 1748        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys

19:06:16.0421 1748        Disk - ok

19:06:16.0515 1748        drmkaud         (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

19:06:16.0530 1748        drmkaud - ok

19:06:16.0655 1748        DXGKrnl         (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys

19:06:16.0686 1748        DXGKrnl - ok

19:06:16.0827 1748        e1kexpress      (52a482dc61f24b498c8268866b90bb44) C:\Windows\system32\DRIVERS\e1k62x64.sys

19:06:16.0858 1748        e1kexpress - ok

19:06:16.0967 1748        ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys

19:06:17.0014 1748        ebdrv - ok

19:06:17.0154 1748        elxstor         (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys

19:06:17.0185 1748        elxstor - ok

19:06:17.0263 1748        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys

19:06:17.0295 1748        ErrDev - ok

19:06:17.0357 1748        exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

19:06:17.0419 1748        exfat - ok

19:06:17.0529 1748        fastfat         (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

19:06:17.0575 1748        fastfat - ok

19:06:17.0669 1748        fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys

19:06:17.0685 1748        fdc - ok

19:06:17.0778 1748        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

19:06:17.0794 1748        FileInfo - ok

19:06:17.0809 1748        Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

19:06:17.0856 1748        Filetrace - ok

19:06:17.0919 1748        FjBtnDrv        (5e5203a036f5477b302ef15494d8a9d4) C:\Windows\system32\DRIVERS\FjBtnDrv.sys

19:06:17.0934 1748        FjBtnDrv - ok

19:06:18.0012 1748        FJGSDisk        (d5a72cca060bef75075877c0ad504df0) C:\Windows\system32\DRIVERS\FJGSDisk.sys

19:06:18.0012 1748        FJGSDisk - ok

19:06:18.0153 1748        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys

19:06:18.0184 1748        flpydisk - ok

19:06:18.0231 1748        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys

19:06:18.0262 1748        FltMgr - ok

19:06:18.0355 1748        FscEfDmi        (db75b9978e83c8d1e2a2aece3fece608) C:\Windows\system32\DRIVERS\FscEfDmi.sys

19:06:18.0371 1748        FscEfDmi - ok

19:06:18.0402 1748        FscGabi         (4d1f8b1844f3317b4ca2fa7db1af2c98) C:\Windows\system32\DRIVERS\FscGabi.sys

19:06:18.0418 1748        FscGabi - ok

19:06:18.0511 1748        FsDepends       (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

19:06:18.0527 1748        FsDepends - ok

19:06:18.0543 1748        Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys

19:06:18.0558 1748        Fs_Rec - ok

19:06:18.0636 1748        FUJ02B1         (ba0c1ffda496d8bcbcac63f8d98d20e3) C:\Windows\system32\DRIVERS\FUJ02B1.sys

19:06:18.0652 1748        FUJ02B1 - ok

19:06:18.0777 1748        FUJ02E3         (7135030cbf87d724b6037bb023923730) C:\Windows\system32\DRIVERS\FUJ02E3.sys

19:06:18.0777 1748        FUJ02E3 - ok

19:06:18.0855 1748        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys

19:06:18.0870 1748        fvevol - ok

19:06:18.0979 1748        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys

19:06:18.0995 1748        gagp30kx - ok

19:06:19.0026 1748        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

19:06:19.0042 1748        hcw85cir - ok

19:06:19.0135 1748        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys

19:06:19.0167 1748        HdAudAddService - ok

19:06:19.0198 1748        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys

19:06:19.0213 1748        HDAudBus - ok

19:06:19.0291 1748        HECIx64         (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\DRIVERS\HECIx64.sys

19:06:19.0307 1748        HECIx64 - ok

19:06:19.0354 1748        HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys

19:06:19.0369 1748        HidBatt - ok

19:06:19.0385 1748        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys

19:06:19.0401 1748        HidBth - ok

19:06:19.0510 1748        HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys

19:06:19.0525 1748        HidIr - ok

19:06:19.0588 1748        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys

19:06:19.0603 1748        HidUsb - ok

19:06:19.0728 1748        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys

19:06:19.0744 1748        HpSAMD - ok

19:06:19.0822 1748        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys

19:06:19.0884 1748        HTTP - ok

19:06:19.0993 1748        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys

19:06:20.0009 1748        hwpolicy - ok

19:06:20.0040 1748        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys

19:06:20.0056 1748        i8042prt - ok

19:06:20.0181 1748        iaStor          (2064090c9faad92c090d77e50e735b2e) C:\Windows\system32\DRIVERS\iaStor.sys

19:06:20.0196 1748        iaStor - ok

19:06:20.0305 1748        iaStorV         (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys

19:06:20.0337 1748        iaStorV - ok

19:06:20.0586 1748        igfx            (fbacbed7a37b3223822470ff1d8ea00f) C:\Windows\system32\DRIVERS\igdkmd64.sys

19:06:20.0695 1748        igfx - ok

19:06:20.0805 1748        iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys

19:06:20.0836 1748        iirsp - ok

19:06:20.0883 1748        Impcd           (dd587a55390ed2295bce6d36ad567da9) C:\Windows\system32\DRIVERS\Impcd.sys

19:06:20.0898 1748        Impcd - ok

19:06:21.0039 1748        IntcAzAudAddService (9aa6a93852e36fe76c3f7fc2904f3b01) C:\Windows\system32\drivers\RTKVHD64.sys

19:06:21.0070 1748        IntcAzAudAddService - ok

19:06:21.0179 1748        IntcDAud        (58cf58dee26c909bd6f977b61d246295) C:\Windows\system32\DRIVERS\IntcDAud.sys

19:06:21.0195 1748        IntcDAud - ok

19:06:21.0226 1748        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys

19:06:21.0241 1748        intelide - ok

19:06:21.0351 1748        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys

19:06:21.0366 1748        intelppm - ok

19:06:21.0413 1748        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys

19:06:21.0460 1748        IpFilterDriver - ok

19:06:21.0553 1748        IPMIDRV         (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys

19:06:21.0569 1748        IPMIDRV - ok

19:06:21.0631 1748        IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

19:06:21.0678 1748        IPNAT - ok

19:06:21.0787 1748        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

19:06:21.0819 1748        IRENUM - ok

19:06:21.0850 1748        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys

19:06:21.0865 1748        isapnp - ok

19:06:21.0897 1748        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys

19:06:21.0928 1748        iScsiPrt - ok

19:06:22.0021 1748        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys

19:06:22.0037 1748        kbdclass - ok

19:06:22.0084 1748        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys

19:06:22.0099 1748        kbdhid - ok

19:06:22.0209 1748        KSecDD          (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys

19:06:22.0224 1748        KSecDD - ok

19:06:22.0240 1748        KSecPkg         (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys

19:06:22.0240 1748        KSecPkg - ok

19:06:22.0349 1748        ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

19:06:22.0411 1748        ksthunk - ok

19:06:22.0552 1748        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

19:06:22.0599 1748        lltdio - ok

19:06:22.0661 1748        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys

19:06:22.0677 1748        LSI_FC - ok

19:06:22.0755 1748        LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys

19:06:22.0770 1748        LSI_SAS - ok

19:06:22.0786 1748        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys

19:06:22.0786 1748        LSI_SAS2 - ok

19:06:22.0911 1748        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys

19:06:22.0926 1748        LSI_SCSI - ok

19:06:22.0957 1748        luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

19:06:23.0004 1748        luafv - ok

19:06:23.0129 1748        MBAMProtector   (79da94b35371b9e7104460c7693dcb2c) C:\Windows\system32\drivers\mbam.sys

19:06:23.0145 1748        MBAMProtector - ok

19:06:23.0191 1748        megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys

19:06:23.0207 1748        megasas - ok

19:06:23.0285 1748        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys

19:06:23.0316 1748        MegaSR - ok

19:06:23.0363 1748        Modem           (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

19:06:23.0394 1748        Modem - ok

19:06:23.0519 1748        monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

19:06:23.0550 1748        monitor - ok

19:06:23.0628 1748        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys

19:06:23.0644 1748        mouclass - ok

19:06:23.0753 1748        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys

19:06:23.0784 1748        mouhid - ok

19:06:23.0815 1748        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys

19:06:23.0831 1748        mountmgr - ok

19:06:23.0878 1748        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys

19:06:23.0909 1748        mpio - ok

19:06:23.0971 1748        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

19:06:24.0034 1748        mpsdrv - ok

19:06:24.0096 1748        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys

19:06:24.0127 1748        MRxDAV - ok

19:06:24.0159 1748        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys

19:06:24.0174 1748        mrxsmb - ok

19:06:24.0237 1748        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys

19:06:24.0252 1748        mrxsmb10 - ok

19:06:24.0299 1748        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

19:06:24.0315 1748        mrxsmb20 - ok

19:06:24.0377 1748        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys

19:06:24.0408 1748        msahci - ok

19:06:24.0455 1748        msdsm           (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys

19:06:24.0471 1748        msdsm - ok

19:06:24.0549 1748        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

19:06:24.0611 1748        Msfs - ok

19:06:24.0658 1748        mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

19:06:24.0689 1748        mshidkmdf - ok

19:06:24.0705 1748        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys

19:06:24.0705 1748        msisadrv - ok

19:06:24.0814 1748        MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

19:06:24.0876 1748        MSKSSRV - ok

19:06:24.0907 1748        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

19:06:24.0939 1748        MSPCLOCK - ok

19:06:24.0954 1748        MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

19:06:24.0985 1748        MSPQM - ok

19:06:25.0032 1748        MsRPC           (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys

19:06:25.0048 1748        MsRPC - ok

19:06:25.0110 1748        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys

19:06:25.0126 1748        mssmbios - ok

19:06:25.0204 1748        MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

19:06:25.0251 1748        MSTEE - ok

19:06:25.0329 1748        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys

19:06:25.0344 1748        MTConfig - ok

19:06:25.0422 1748        Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

19:06:25.0438 1748        Mup - ok

19:06:25.0500 1748        NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

19:06:25.0531 1748        NativeWifiP - ok

19:06:25.0641 1748        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys

19:06:25.0672 1748        NDIS - ok

19:06:25.0797 1748        NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

19:06:25.0859 1748        NdisCap - ok

19:06:25.0890 1748        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

19:06:25.0937 1748        NdisTapi - ok

19:06:26.0046 1748        Ndisuio         (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys

19:06:26.0093 1748        Ndisuio - ok

19:06:26.0109 1748        NdisWan         (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys

19:06:26.0140 1748        NdisWan - ok

19:06:26.0233 1748        NDProxy         (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys

19:06:26.0280 1748        NDProxy - ok

19:06:26.0343 1748        NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

19:06:26.0389 1748        NetBIOS - ok

19:06:26.0436 1748        NetBT           (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys

19:06:26.0483 1748        NetBT - ok

19:06:26.0748 1748        NETw5s64        (4d85a450edef10c38882182753a49aae) C:\Windows\system32\DRIVERS\NETw5s64.sys

19:06:26.0826 1748        NETw5s64 - ok

19:06:26.0935 1748        nfrd960         (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys

19:06:26.0951 1748        nfrd960 - ok

19:06:26.0982 1748        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

19:06:27.0013 1748        Npfs - ok

19:06:27.0123 1748        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

19:06:27.0169 1748        nsiproxy - ok

19:06:27.0247 1748        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys

19:06:27.0294 1748        Ntfs - ok

19:06:27.0403 1748        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

19:06:27.0450 1748        Null - ok

19:06:27.0481 1748        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys

19:06:27.0481 1748        nvraid - ok

19:06:27.0559 1748        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys

19:06:27.0591 1748        nvstor - ok

19:06:27.0684 1748        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys

19:06:27.0700 1748        nv_agp - ok

19:06:27.0809 1748        O2MDRDR         (aecff27d5c70f295b09b85efe3292ed1) C:\Windows\system32\DRIVERS\o2mdx64.sys

19:06:27.0809 1748        O2MDRDR - ok

19:06:27.0871 1748        O2SCBUS         (3b179a7eff9edcc045f5570510c812f6) C:\Windows\system32\DRIVERS\ozscrx64.sys

19:06:27.0871 1748        O2SCBUS - ok

19:06:27.0949 1748        O2SDRDR         (df014c48015b637790be3eddd1384728) C:\Windows\system32\DRIVERS\o2sdx64.sys

19:06:27.0965 1748        O2SDRDR - ok

19:06:28.0012 1748        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys

19:06:28.0027 1748        ohci1394 - ok

19:06:28.0137 1748        Parport         (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys

19:06:28.0152 1748        Parport - ok

19:06:28.0215 1748        partmgr         (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys

19:06:28.0230 1748        partmgr - ok

19:06:28.0277 1748        pci             (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys

19:06:28.0293 1748        pci - ok

19:06:28.0339 1748        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys

19:06:28.0355 1748        pciide - ok

19:06:28.0402 1748        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys

19:06:28.0433 1748        pcmcia - ok

19:06:28.0449 1748        pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

19:06:28.0464 1748        pcw - ok

19:06:28.0527 1748        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

19:06:28.0589 1748        PEAUTH - ok

19:06:28.0729 1748        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys

19:06:28.0807 1748        PptpMiniport - ok

19:06:28.0854 1748        Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys

19:06:28.0870 1748        Processor - ok

19:06:29.0010 1748        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys

19:06:29.0057 1748        Psched - ok

19:06:29.0182 1748        PxHlpa64        (a6bf0a9b5a30d743623ca0d3be35df05) C:\Windows\system32\Drivers\PxHlpa64.sys

19:06:29.0197 1748        PxHlpa64 - ok

19:06:29.0244 1748        qcfiltersra2k   (418914bbaf7b2961f712e8059b6a1044) C:\Windows\system32\DRIVERS\qcfiltersra2k.sys

19:06:29.0244 1748        qcfiltersra2k - ok

19:06:29.0369 1748        qcusbnetsra2k   (feb9abd8e036cbb2ae520e3bd9d78e2b) C:\Windows\system32\DRIVERS\qcusbnetsra2k.sys

19:06:29.0385 1748        qcusbnetsra2k - ok

19:06:29.0494 1748        qcusbsersra2k   (9b682f4bdde7453ecdc70572c52dd97b) C:\Windows\system32\DRIVERS\qcusbsersra2k.sys

19:06:29.0509 1748        qcusbsersra2k - ok

19:06:29.0603 1748        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys

19:06:29.0634 1748        ql2300 - ok

19:06:29.0759 1748        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys

19:06:29.0790 1748        ql40xx - ok

19:06:29.0806 1748        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

19:06:29.0821 1748        QWAVEdrv - ok

19:06:29.0931 1748        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

19:06:29.0977 1748        RasAcd - ok

19:06:30.0055 1748        RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

19:06:30.0102 1748        RasAgileVpn - ok

19:06:30.0211 1748        Rasl2tp         (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys

19:06:30.0258 1748        Rasl2tp - ok

19:06:30.0305 1748        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

19:06:30.0367 1748        RasPppoe - ok

19:06:30.0477 1748        RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

19:06:30.0539 1748        RasSstp - ok

19:06:30.0586 1748        rdbss           (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys

19:06:30.0617 1748        rdbss - ok

19:06:30.0726 1748        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys

19:06:30.0757 1748        rdpbus - ok

19:06:30.0773 1748        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

19:06:30.0820 1748        RDPCDD - ok

19:06:30.0851 1748        RDPDR           (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys

19:06:30.0882 1748        RDPDR - ok

19:06:30.0991 1748        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

19:06:31.0054 1748        RDPENCDD - ok

19:06:31.0069 1748        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

19:06:31.0101 1748        RDPREFMP - ok

19:06:31.0147 1748        RDPWD           (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys

19:06:31.0194 1748        RDPWD - ok

19:06:31.0303 1748        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys

19:06:31.0319 1748        rdyboost - ok

19:06:31.0381 1748        RFCOMM          (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys

19:06:31.0397 1748        RFCOMM - ok

19:06:31.0522 1748        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

19:06:31.0569 1748        rspndr - ok

19:06:31.0615 1748        s3cap           (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys

19:06:31.0631 1748        s3cap - ok

19:06:31.0725 1748        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys

19:06:31.0740 1748        sbp2port - ok

19:06:31.0881 1748        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys

19:06:31.0943 1748        scfilter - ok

19:06:32.0005 1748        sdbus           (111e0ebc0ad79cb0fa014b907b231cf0) C:\Windows\system32\drivers\sdbus.sys

19:06:32.0037 1748        sdbus - ok

19:06:32.0177 1748        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

19:06:32.0224 1748        secdrv - ok

19:06:32.0255 1748        Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys

19:06:32.0271 1748        Serenum - ok

19:06:32.0380 1748        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys

19:06:32.0395 1748        Serial - ok

19:06:32.0442 1748        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys

19:06:32.0458 1748        sermouse - ok

19:06:32.0567 1748        sffdisk         (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys

19:06:32.0583 1748        sffdisk - ok

19:06:32.0645 1748        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys

19:06:32.0661 1748        sffp_mmc - ok

19:06:32.0754 1748        sffp_sd         (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys

19:06:32.0785 1748        sffp_sd - ok

19:06:32.0832 1748        sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys

19:06:32.0848 1748        sfloppy - ok

19:06:32.0926 1748        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys

19:06:32.0941 1748        SiSRaid2 - ok

19:06:32.0973 1748        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys

19:06:32.0988 1748        SiSRaid4 - ok

19:06:33.0097 1748        Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

19:06:33.0144 1748        Smb - ok

19:06:33.0347 1748        SNP2UVC         (ed116ef32d0c80596b5cc9b16799b29a) C:\Windows\system32\DRIVERS\snp2uvc.sys

19:06:33.0394 1748        SNP2UVC - ok

19:06:33.0503 1748        spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

19:06:33.0519 1748        spldr - ok

19:06:33.0565 1748        srv             (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys

19:06:33.0581 1748        srv - ok

19:06:33.0675 1748        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys

19:06:33.0690 1748        srv2 - ok

19:06:33.0737 1748        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys

19:06:33.0737 1748        srvnet - ok

19:06:33.0862 1748        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys

19:06:33.0877 1748        stexstor - ok

19:06:33.0987 1748        storflt         (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys

19:06:34.0018 1748        storflt - ok

19:06:34.0018 1748        storvsc         (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys

19:06:34.0033 1748        storvsc - ok

19:06:34.0049 1748        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys

19:06:34.0065 1748        swenum - ok

19:06:34.0158 1748        SynTP           (2f827bb08cc7f1a17df2ead7b424d731) C:\Windows\system32\DRIVERS\SynTP.sys

19:06:34.0174 1748        SynTP - ok

19:06:34.0345 1748        Tcpip           (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys

19:06:34.0392 1748        Tcpip - ok

19:06:34.0548 1748        TCPIP6          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys

19:06:34.0595 1748        TCPIP6 - ok

19:06:34.0704 1748        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys

19:06:34.0751 1748        tcpipreg - ok

19:06:34.0782 1748        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

19:06:34.0813 1748        TDPIPE - ok

19:06:34.0923 1748        TDTCP           (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys

19:06:34.0985 1748        TDTCP - ok

19:06:35.0047 1748        tdx             (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys

19:06:35.0094 1748        tdx - ok

19:06:35.0203 1748        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys

19:06:35.0219 1748        TermDD - ok

19:06:35.0328 1748        TPM             (dbcc20c02e8a3e43b03c304a4e40a84f) C:\Windows\system32\drivers\tpm.sys

19:06:35.0359 1748        TPM - ok

19:06:35.0406 1748        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys

19:06:35.0453 1748        tssecsrv - ok

19:06:35.0562 1748        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys

19:06:35.0578 1748        TsUsbFlt - ok

19:06:35.0656 1748        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys

19:06:35.0718 1748        tunnel - ok

19:06:35.0827 1748        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys

19:06:35.0843 1748        uagp35 - ok

19:06:35.0905 1748        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys

19:06:35.0952 1748        udfs - ok

19:06:36.0077 1748        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys

19:06:36.0093 1748        uliagpkx - ok

19:06:36.0295 1748        umbus           (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys

19:06:36.0327 1748        umbus - ok

19:06:36.0498 1748        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys

19:06:36.0529 1748        UmPass - ok

19:06:36.0732 1748        usbaudio        (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys

19:06:36.0763 1748        usbaudio - ok

19:06:37.0075 1748        usbccgp         (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys

19:06:37.0091 1748        usbccgp - ok

19:06:37.0231 1748        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys

19:06:37.0247 1748        usbcir - ok

19:06:37.0341 1748        usbehci         (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys

19:06:37.0372 1748        usbehci - ok

19:06:37.0387 1748        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys

19:06:37.0403 1748        usbhub - ok

19:06:37.0450 1748        usbohci         (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys

19:06:37.0465 1748        usbohci - ok

19:06:37.0575 1748        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys

19:06:37.0590 1748        usbprint - ok

19:06:37.0653 1748        usbscan         (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys

19:06:37.0684 1748        usbscan - ok

19:06:37.0715 1748        USBSTOR         (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS

19:06:37.0731 1748        USBSTOR - ok

19:06:37.0793 1748        usbuhci         (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys

19:06:37.0809 1748        usbuhci - ok

19:06:37.0887 1748        usbvideo        (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys

19:06:37.0902 1748        usbvideo - ok

19:06:38.0011 1748        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys

19:06:38.0027 1748        vdrvroot - ok

19:06:38.0261 1748        vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

19:06:38.0292 1748        vga - ok

19:06:38.0433 1748        VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

19:06:38.0495 1748        VgaSave - ok

19:06:38.0667 1748        vhdmp           (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys

19:06:38.0698 1748        vhdmp - ok

19:06:38.0791 1748        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys

19:06:38.0807 1748        viaide - ok

19:06:38.0838 1748        vmbus           (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys

19:06:38.0854 1748        vmbus - ok

19:06:38.0963 1748        VMBusHID        (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys

19:06:38.0994 1748        VMBusHID - ok

19:06:38.0994 1748        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys

19:06:39.0010 1748        volmgr - ok

19:06:39.0057 1748        volmgrx         (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys

19:06:39.0088 1748        volmgrx - ok

19:06:39.0166 1748        volsnap         (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys

19:06:39.0197 1748        volsnap - ok

19:06:39.0259 1748        vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys

19:06:39.0275 1748        vsmraid - ok

19:06:39.0369 1748        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys

19:06:39.0400 1748        vwifibus - ok

19:06:39.0665 1748        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys

19:06:39.0696 1748        vwififlt - ok

19:06:39.0883 1748        wacommousefilter (e04d43c7d1641e95d35cae6086c7e350) C:\Windows\system32\DRIVERS\wacommousefilter.sys

19:06:39.0899 1748        wacommousefilter - ok

19:06:39.0930 1748        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys

19:06:39.0946 1748        WacomPen - ok

19:06:40.0008 1748        wacomvhid       (ec1ceb237e365330c1fcfc4876aa0ac0) C:\Windows\system32\DRIVERS\wacomvhid.sys

19:06:40.0008 1748        wacomvhid - ok

19:06:40.0102 1748        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

19:06:40.0164 1748        WANARP - ok

19:06:40.0164 1748        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

19:06:40.0195 1748        Wanarpv6 - ok

19:06:40.0305 1748        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys

19:06:40.0320 1748        Wd - ok

19:06:40.0351 1748        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

19:06:40.0383 1748        Wdf01000 - ok

19:06:40.0523 1748        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

19:06:40.0570 1748        WfpLwf - ok

19:06:40.0648 1748        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

19:06:40.0663 1748        WIMMount - ok

19:06:40.0897 1748        WISDPen         (de5f22e0904e5ac80226db7fb4068ba6) C:\Windows\system32\DRIVERS\wisdpen.sys

19:06:40.0897 1748        WISDPen - ok

19:06:41.0038 1748        WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys

19:06:41.0053 1748        WmiAcpi - ok

19:06:41.0100 1748        ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

19:06:41.0131 1748        ws2ifsl - ok

19:06:41.0256 1748        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys

19:06:41.0319 1748        WudfPf - ok

19:06:41.0334 1748        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys

19:06:41.0381 1748        WUDFRd - ok

19:06:41.0412 1748        MBR (0x1B8)     (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR1

19:06:41.0537 1748        \Device\Harddisk1\DR1 - ok

19:06:41.0553 1748        MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0

19:06:41.0662 1748        \Device\Harddisk0\DR0 - ok

19:06:41.0677 1748        MBR (0x1B8)     (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR1

19:06:41.0802 1748        \Device\Harddisk1\DR1 - ok

19:06:41.0802 1748        Boot (0x1200)   (8c6dc00650eb2ede3222d4f5343c4ba9) \Device\Harddisk1\DR1\Partition0

19:06:41.0802 1748        \Device\Harddisk1\DR1\Partition0 - ok

19:06:41.0880 1748        Boot (0x1200)   (6b70ce4e67b9adf38c418a2b41f67bb1) \Device\Harddisk0\DR0\Partition0

19:06:41.0880 1748        \Device\Harddisk0\DR0\Partition0 - ok

19:06:41.0896 1748        Boot (0x1200)   (8c6dc00650eb2ede3222d4f5343c4ba9) \Device\Harddisk1\DR1\Partition0

19:06:41.0896 1748        \Device\Harddisk1\DR1\Partition0 - ok

19:06:41.0896 1748        ============================================================

19:06:41.0896 1748        Scan finished

19:06:41.0896 1748        ============================================================

19:06:41.0911 4168        Detected object count: 0

19:06:41.0911 4168        Actual detected object count: 0

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Hier das CF-Log:

[code]
Combofix Logfile:

Code:

ComboFix 12-01-12.02 - Christoph 12.01.2012   8:56.1.4 - x64

Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3891.2263 [GMT 1:00]

ausgeführt von:: c:\users\Christoph\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\system32\java.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-12-12 bis 2012-01-12  ))))))))))))))))))))))))))))))

.

.

2012-01-12 08:01 . 2012-01-12 08:01        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-01-12 08:01 . 2012-01-12 08:01        --------        d-----w-        c:\users\Administrator\AppData\Local\temp

2012-01-12 07:52 . 2012-01-12 07:52        69000        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{99416305-9833-4356-B980-E61027FCBAB9}\offreg.dll

2012-01-11 11:06 . 2012-01-11 11:06        --------        d-----w-        C:\_OTL

2012-01-11 07:45 . 2011-10-26 05:25        1572864        ----a-w-        c:\windows\system32\quartz.dll

2012-01-11 07:45 . 2011-10-26 05:25        366592        ----a-w-        c:\windows\system32\qdvd.dll

2012-01-11 07:45 . 2011-10-26 04:32        514560        ----a-w-        c:\windows\SysWow64\qdvd.dll

2012-01-11 07:45 . 2011-10-26 04:32        1328128        ----a-w-        c:\windows\SysWow64\quartz.dll

2012-01-11 07:45 . 2011-11-17 06:41        1731920        ----a-w-        c:\windows\system32\ntdll.dll

2012-01-11 07:45 . 2011-11-17 05:38        1292080        ----a-w-        c:\windows\SysWow64\ntdll.dll

2012-01-11 07:45 . 2011-11-19 14:58        77312        ----a-w-        c:\windows\system32\packager.dll

2012-01-11 07:45 . 2011-11-19 14:01        67072        ----a-w-        c:\windows\SysWow64\packager.dll

2012-01-10 11:17 . 2012-01-10 11:17        --------        d-----w-        c:\program files (x86)\FileZilla FTP Client

2012-01-10 10:27 . 2012-01-10 10:27        --------        d-----w-        c:\programdata\WinZip

2012-01-10 09:43 . 2011-11-21 11:40        8822856        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{99416305-9833-4356-B980-E61027FCBAB9}\mpengine.dll

2012-01-09 16:34 . 2012-01-09 16:34        --------        d-----w-        c:\program files (x86)\Common Files\Macrovision Shared

2012-01-08 14:20 . 2012-01-08 14:20        --------        d-----w-        c:\program files (x86)\eRightSoft

2012-01-08 14:18 . 2011-12-21 07:42        121816        ----a-w-        c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll

2012-01-08 14:18 . 2011-12-21 07:42        43992        ----a-w-        c:\program files (x86)\Mozilla Firefox\mozutils.dll

2012-01-08 14:18 . 2011-12-21 04:29        626688        ----a-w-        c:\program files (x86)\Mozilla Firefox\msvcr80.dll

2012-01-08 14:18 . 2011-12-21 04:29        548864        ----a-w-        c:\program files (x86)\Mozilla Firefox\msvcp80.dll

2012-01-08 14:18 . 2011-12-21 04:29        479232        ----a-w-        c:\program files (x86)\Mozilla Firefox\msvcm80.dll

2012-01-08 12:25 . 2003-07-14 22:30        21941        ----a-w-        c:\users\Christoph\AppData\Roaming\Microsoft\FrontPage\Behaviors\Actions\STRINGS.JS

2012-01-08 12:25 . 2003-07-14 22:30        18690        ----a-w-        c:\users\Christoph\AppData\Roaming\Microsoft\FrontPage\Behaviors\Actions\PRELOAD.JS

2012-01-08 12:25 . 2003-07-14 22:30        14396        ----a-w-        c:\users\Christoph\AppData\Roaming\Microsoft\FrontPage\Behaviors\Actions\FPLIB.JS

2012-01-08 12:25 . 2003-07-14 22:30        11729        ----a-w-        c:\users\Christoph\AppData\Roaming\Microsoft\FrontPage\Behaviors\Actions\_JMPMENU.JS

2012-01-08 12:25 . 2003-07-14 22:30        18219        ----a-w-        c:\users\Christoph\AppData\Roaming\Microsoft\FrontPage\Behaviors\Actions\SETTEXT.JS

2012-01-08 12:25 . 2003-07-14 22:30        15020        ----a-w-        c:\users\Christoph\AppData\Roaming\Microsoft\FrontPage\Behaviors\Actions\_PRELOAD.JS

2012-01-08 12:25 . 2003-07-14 22:30        13773        ----a-w-        c:\users\Christoph\AppData\Roaming\Microsoft\FrontPage\Behaviors\Actions\DOM.JS

2012-01-08 12:25 . 2003-07-14 22:30        11988        ----a-w-        c:\users\Christoph\AppData\Roaming\Microsoft\FrontPage\Behaviors\Actions\GETOBJ.JS

2012-01-08 10:24 . 2012-01-08 10:25        --------        d-----w-        c:\program files (x86)\Frontpage

2012-01-08 10:24 . 2012-01-08 10:24        --------        d-----w-        c:\windows\PCHEALTH

2012-01-08 10:23 . 2012-01-08 10:23        --------        d-----r-        C:\MSOCache

2011-12-27 21:28 . 2011-09-21 09:41        22016        ----a-w-        c:\windows\system32\drivers\FscGabi.sys

2011-12-27 21:28 . 2011-09-21 09:41        17920        ----a-w-        c:\windows\system32\drivers\FscEfDmi.sys

2011-12-27 21:28 . 2011-12-27 21:28        --------        d-----w-        c:\program files (x86)\Common Files\Fujitsu

2011-12-26 14:41 . 2011-12-26 14:41        --------        d-----w-        c:\windows\SysWow64\Wat

2011-12-26 14:41 . 2011-12-26 14:41        --------        d-----w-        c:\windows\system32\Wat

2011-12-23 09:08 . 2012-01-09 13:35        --------        d-----w-        c:\users\Christoph\AppData\Roaming\Skype

2011-12-23 09:08 . 2011-12-23 09:08        --------        d-----r-        c:\program files (x86)\Skype

2011-12-23 09:08 . 2011-12-23 09:08        --------        d-----w-        c:\programdata\Skype

2011-12-20 11:16 . 2011-12-20 11:16        --------        d-----w-        c:\users\Christoph\AppData\Roaming\Malwarebytes

2011-12-20 11:16 . 2011-12-20 11:16        --------        d-----w-        c:\programdata\Malwarebytes

2011-12-20 11:16 . 2011-12-31 21:24        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2011-12-20 11:16 . 2011-12-10 14:24        23152        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-12-20 01:23 . 2011-05-13 12:16        493056        ----a-w-        c:\windows\SysWow64\dhRichClient3.dll

2011-12-20 01:23 . 2011-03-25 20:42        338432        ----a-w-        c:\windows\SysWow64\sqlite36_engine.dll

2011-12-20 01:23 . 2011-12-20 01:23        --------        d-----w-        c:\users\Christoph\AppData\Roaming\OCS

2011-12-19 22:43 . 2011-12-19 22:43        --------        d-----w-        c:\users\Christoph\AppData\Roaming\Softland

2011-12-19 22:43 . 2011-03-31 10:14        29008        ----a-w-        c:\windows\system32\novamnv7.dll

2011-12-19 22:43 . 2011-03-31 10:14        21328        ----a-w-        c:\windows\system32\novamiv7.dll

2011-12-19 22:43 . 2010-02-05 14:00        1700352        ----a-w-        c:\windows\system32\GdiPlus.dll

2011-12-19 22:43 . 2011-12-28 17:54        --------        d-----w-        c:\users\Christoph\AppData\Local\PDF Annotator

2011-12-19 22:43 . 2011-12-19 22:43        --------        d-----w-        c:\program files (x86)\PDF Annotator

2011-12-19 17:44 . 2012-01-11 11:06        --------        d-----w-        c:\program files (x86)\Spybot - Search & Destroy

2011-12-19 17:44 . 2012-01-03 10:08        --------        d-----w-        c:\programdata\Spybot - Search & Destroy

2011-12-18 17:58 . 2011-12-18 17:58        --------        d-----w-        c:\program files (x86)\ESET

2011-12-16 09:43 . 2011-12-16 09:43        --------        d-----w-        c:\users\Christoph\AppData\Roaming\pdfforge

2011-12-16 09:43 . 2005-04-15 19:58        1071088        ----a-w-        c:\windows\SysWow64\MSCOMCTL.OCX

2011-12-16 09:43 . 2005-03-12 00:07        87040        ----a-w-        c:\windows\system32\pdfcmnnt.dll

2011-12-16 09:43 . 2004-03-09 00:00        662288        ----a-w-        c:\windows\SysWow64\MSCOMCT2.OCX

2011-12-16 09:43 . 1998-06-24 00:00        137000        ----a-w-        c:\windows\SysWow64\MSMAPI32.OCX

2011-12-16 09:43 . 2012-01-11 11:06        --------        d-----w-        c:\program files (x86)\PDFCreator

2011-12-16 09:43 . 1998-07-06 17:56        125712        ----a-w-        c:\windows\SysWow64\VB6DE.DLL

2011-12-16 09:43 . 1998-07-06 17:55        158208        ----a-w-        c:\windows\SysWow64\MSCMCDE.DLL

2011-12-16 09:43 . 1998-07-06 17:55        64512        ----a-w-        c:\windows\SysWow64\MSCC2DE.DLL

2011-12-16 09:43 . 1998-07-06 00:00        23552        ----a-w-        c:\windows\SysWow64\MSMPIDE.DLL

2011-12-15 10:51 . 2011-11-24 04:52        3145216        ----a-w-        c:\windows\system32\win32k.sys

2011-12-15 10:51 . 2011-10-15 06:31        723456        ----a-w-        c:\windows\system32\EncDec.dll

2011-12-15 10:51 . 2011-10-15 05:38        534528        ----a-w-        c:\windows\SysWow64\EncDec.dll

2011-12-15 10:51 . 2011-11-05 05:32        2048        ----a-w-        c:\windows\system32\tzres.dll

2011-12-15 10:51 . 2011-11-05 04:26        2048        ----a-w-        c:\windows\SysWow64\tzres.dll

2011-12-15 01:36 . 2011-12-15 01:37        --------        d-----w-        c:\program files (x86)\OneClickInternet

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-08 16:34 . 2011-11-24 10:19        130760        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2011-11-28 10:15 . 2011-11-26 10:02        544656        ----a-w-        c:\windows\SysWow64\deployJava1.dll

2011-11-28 10:05 . 2011-11-28 10:06        525544        ----a-w-        c:\windows\system32\deployJava1.dll

2011-11-25 20:43 . 2011-11-25 20:43        414368        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2011-11-24 22:24 . 2009-07-14 02:36        152576        ----a-w-        c:\windows\SysWow64\msclmd.dll

2011-11-24 22:24 . 2009-07-14 02:36        175616        ----a-w-        c:\windows\system32\msclmd.dll

2011-11-24 09:39 . 2011-11-24 09:39        14696        ----a-w-        c:\windows\system32\drivers\FJGSDisk.sys

2011-10-19 15:56 . 2011-11-24 10:19        97312        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2011-10-19 15:56 . 2011-11-24 10:19        27760        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2009-12-04 195080]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IMSS"="c:\program files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2009-11-01 104960]

"IndicatorUtility"="c:\program files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2009-10-09 47976]

"snp2uvc"="c:\windows\vsnp2uvc.exe" [2009-08-12 662016]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-10-19 258512]

"DeskUpdateNotifier"="c:\program files (x86)\Fujitsu\DeskUpdate\DeskUpdateNotifier.exe" [2011-11-10 100120]

"LoadFUJ02E3"="c:\program files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe" [2009-06-16 36712]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-05-04 252136]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]

"Adobe Photo Downloader"="c:\program files (x86)\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-10 67488]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 FscEfDmi;FscEfDmi;c:\windows\system32\DRIVERS\FscEfDmi.sys [x]

R3 FscGabi;FscGabi;c:\windows\system32\DRIVERS\FscGabi.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]

S0 FJGSDisk;G-Sensor Application Filter Driver;c:\windows\system32\DRIVERS\FJGSDisk.sys [x]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-10-19 86224]

S2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\ATService.exe [2009-07-31 2688248]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872]

S2 PowerSavingUtilityService;PowerSavingUtilityService;c:\program files\Fujitsu\PSUtility\PSUService.exe [2009-10-29 63336]

S2 QDLService2kSierra;Qualcomm Gobi 2000 Download Service (Sierra);c:\program files (x86)\QUALCOMM\QDLService2k\QDLService2kSierra.exe [2009-10-01 329976]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

S2 SearchAnonymizer;SearchAnonymizer;c:\users\Christoph\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [2011-12-20 40960]

S2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [x]

S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-01 2314240]

S2 VFPRadioSupportService;Unterstützung für Bluetooth-Funktionen;c:\program files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe [2009-10-12 145792]

S2 WirelessSelectorService;WirelessSelectorService;c:\program files\Fujitsu\WirelessSelector\WSUService.exe [2009-09-30 62312]

S2 WTGService;WTGService;c:\windows.old\Program Files (x86)\OneClickInternet\WTGService.exe [2009-11-27 312784]

S3 acpials;ALS-Sensorfilter;c:\windows\system32\DRIVERS\acpials.sys [x]

S3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\Drivers\ATSwpWDF.sys [x]

S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys [x]

S3 FjBtnDrv;Fujitsu Button Driver;c:\windows\system32\DRIVERS\FjBtnDrv.sys [x]

S3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\DRIVERS\FUJ02E3.sys [x]

S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]

S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]

S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]

S3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2mdx64.sys [x]

S3 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sdx64.sys [x]

S3 qcfiltersra2k;Gobi 2000 USB Composite Device Filter Driver(1199-9001);c:\windows\system32\DRIVERS\qcfiltersra2k.sys [x]

S3 qcusbnetsra2k;Gobi 2000 USB-NDIS miniport(1199-9001);c:\windows\system32\DRIVERS\qcusbnetsra2k.sys [x]

S3 qcusbsersra2k;Gobi 2000 USB Device for Legacy Serial Communication(1199-9001);c:\windows\system32\DRIVERS\qcusbsersra2k.sys [x]

S3 WISDPen;Wacom Penabled MiniDriver;c:\windows\system32\DRIVERS\wisdpen.sys [x]

.

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ATSwpNav"="c:\program files\Fingerprint Sensor\ATSwpNav -run" [X]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-05 8060960]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-06-24 161304]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-06-24 386584]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-06-24 414744]

"ConMgr"="c:\program files\CSR\Bluetooth Feature Pack 5.0\ConMgr.exe" [2009-10-12 535392]

"CSRSkype"="c:\program files\CSR\Bluetooth Feature Pack 5.0\CSRSkype.exe" [2009-10-12 431456]

"snp2uvc"="c:\windows\vsnp2uvc.exe" [2009-08-12 662016]

"SNUVCDSM"="c:\windows\snuvcdsm.exe" [2009-05-22 24576]

"SSUtility"="c:\program files\Fujitsu\SSUtility\FJSSDMN.exe" [2009-08-10 282984]

"PSUTility"="c:\program files\Fujitsu\PSUtility\TrayManager.exe" [2009-10-29 188264]

"FDM7"="c:\program files\Fujitsu\FDM7\FdmDaemon.exe" [2009-10-19 164200]

"BbPrintMonitor"="c:\program files\Common Files\Bluebeam Software\Brewery\V45\Printer Support\BBPrint.exe" [2010-11-30 201376]

"BbInstallUser"="c:\program files\Bluebeam Software\Pushbutton PDF\Bluebeam Admin User.exe" [2011-10-07 38560]

"FjStrtAp"="c:\program files\Fujitsu\Utils\FjStrtAp.exe" [2009-05-21 13824]

"Ocs_SM"="c:\users\Christoph\AppData\Roaming\OCS\SM\SearchAnonymizer.exe" [2011-12-20 106496]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{7766B3EF-851B-4C45-A157-8DFD0A1F03C4}: NameServer = 193.189.244.225 193.189.244.206

FF - ProfilePath - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\f1zh9ium.default\

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM-Run-BthSyncServ - c:\program files\CSR\Bluetooth Feature Pack 5.0\bthsyncserv.exe

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Flash\\Flash9f.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.9"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Flash\\Flash9f.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Flash\\Flash9f.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Flash\\Flash9f.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Flash\\FlashUtil9f.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Flash\\FlashUtil9f.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]

@Denied: (A 2) (Everyone)

@="IFlashBroker"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2012-01-12  09:03:39

ComboFix-quarantined-files.txt  2012-01-12 08:03

.

Vor Suchlauf: 22 Verzeichnis(se), 196.197.404.672 Bytes frei

Nach Suchlauf: 25 Verzeichnis(se), 196.073.844.736 Bytes frei

.

- - End Of File - - 002777D5436579F371FC4505AD87742D

--- --- ---

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Offenbar gibt's ein Problem mit AVAST. Zuerst führte ich alles so durch, wie du beschrieben hast. Als der Scan fertig war, stand da allerdings NICHT "Scan finished successfully", aber es tat sich auch nichts mehr. Es war folgendes Log abgespeichert:

Code:

aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software

Run date: 2012-01-13 10:14:28

-----------------------------

10:14:28.560    OS Version: Windows x64 6.1.7601 Service Pack 1

10:14:28.560    Number of processors: 4 586 0x2505

10:14:28.560    ComputerName: CHRISTOPH-PC  UserName: Christoph

10:14:30.775    Initialize success

10:15:41.788    AVAST engine defs: 12011201

10:26:47.301    The log file has been saved successfully to "C:\Users\Christoph\Desktop\aswMBR.txt"

Das sah für mich etwas wenig aus. Also führte ich den AVAST-Scan nochmals wie beschrieben aus und Windows stürzte ab. Nach dem Neustart ließ ich's nochmal durchlaufen und diesmal stürzte AVAST ab.

Was soll ich tun?

=> Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"

???

Nach wiederholten Abstürzen installierte Windows gestern ein Update. Anschließend ließ ich AVAST erneut laufen. Diesmal funktionierte es. Hier ist das Log:

Code:

aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software

Run date: 2012-01-13 23:09:46

-----------------------------

23:09:46.277    OS Version: Windows x64 6.1.7601 Service Pack 1

23:09:46.277    Number of processors: 4 586 0x2505

23:09:46.277    ComputerName: CHRISTOPH-PC  UserName: Christoph

23:09:47.369    Initialize success

23:09:52.298    AVAST engine defs: 12011201

23:09:56.760    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

23:09:56.760    Disk 0 Vendor: Hitachi_ PB3O Size: 305245MB BusType: 3

23:09:56.869    Disk 1  \Device\Harddisk1\DR1 -> \Device\Scsi\O2SDRDR1Port1Path0Target0Lun0

23:09:56.869    Disk 1 Vendor: O2Micro_ 0001 Size: 1911MB BusType: 16

23:09:56.900    Disk 0 MBR read successfully

23:09:56.916    Disk 0 MBR scan

23:09:56.931    Disk 0 Windows 7 default MBR code

23:09:56.947    Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS         2049 MB offset 12678

23:09:56.963    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS       303187 MB offset 4212332

23:09:56.963    Service scanning

23:10:03.374    Modules scanning

23:10:03.374    Disk 0 trace - called modules:

23:10:03.405    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll 

23:10:03.421    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8006965060]

23:10:03.437    3 CLASSPNP.SYS[fffff88001b7843f] -> nt!IofCallDriver -> [0xfffffa800491c4c0]

23:10:03.437    5 ACPI.sys[fffff88000ec97a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004921050]

23:10:04.560    AVAST engine scan C:\Windows

23:10:07.259    File: C:\Windows\PEV.exe  **INFECTED** Win32:Rootkit-gen [Rtk]

23:10:09.068    AVAST engine scan C:\Windows\system32

23:13:46.268    AVAST engine scan C:\Windows\system32\drivers

23:14:00.776    AVAST engine scan C:\Users\Christoph

23:29:03.066    Disk 0 MBR has been saved successfully to "C:\Users\Christoph\Desktop\MBR.dat"

23:29:03.066    The log file has been saved successfully to "C:\Users\Christoph\Desktop\aswMBR.txt"
 
 

aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software

Run date: 2012-01-13 23:09:46

-----------------------------

23:09:46.277    OS Version: Windows x64 6.1.7601 Service Pack 1

23:09:46.277    Number of processors: 4 586 0x2505

23:09:46.277    ComputerName: CHRISTOPH-PC  UserName: Christoph

23:09:47.369    Initialize success

23:09:52.298    AVAST engine defs: 12011201

23:09:56.760    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

23:09:56.760    Disk 0 Vendor: Hitachi_ PB3O Size: 305245MB BusType: 3

23:09:56.869    Disk 1  \Device\Harddisk1\DR1 -> \Device\Scsi\O2SDRDR1Port1Path0Target0Lun0

23:09:56.869    Disk 1 Vendor: O2Micro_ 0001 Size: 1911MB BusType: 16

23:09:56.900    Disk 0 MBR read successfully

23:09:56.916    Disk 0 MBR scan

23:09:56.931    Disk 0 Windows 7 default MBR code

23:09:56.947    Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS         2049 MB offset 12678

23:09:56.963    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS       303187 MB offset 4212332

23:09:56.963    Service scanning

23:10:03.374    Modules scanning

23:10:03.374    Disk 0 trace - called modules:

23:10:03.405    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll 

23:10:03.421    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8006965060]

23:10:03.437    3 CLASSPNP.SYS[fffff88001b7843f] -> nt!IofCallDriver -> [0xfffffa800491c4c0]

23:10:03.437    5 ACPI.sys[fffff88000ec97a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004921050]

23:10:04.560    AVAST engine scan C:\Windows

23:10:07.259    File: C:\Windows\PEV.exe  **INFECTED** Win32:Rootkit-gen [Rtk]

23:10:09.068    AVAST engine scan C:\Windows\system32

23:13:46.268    AVAST engine scan C:\Windows\system32\drivers

23:14:00.776    AVAST engine scan C:\Users\Christoph

23:29:03.066    Disk 0 MBR has been saved successfully to "C:\Users\Christoph\Desktop\MBR.dat"

23:29:03.066    The log file has been saved successfully to "C:\Users\Christoph\Desktop\aswMBR.txt"

23:30:10.236    AVAST engine scan C:\ProgramData

23:32:38.047    Scan finished successfully

23:39:53.623    Disk 0 MBR has been saved successfully to "C:\Users\Christoph\Desktop\MBR.dat"

23:39:53.623    The log file has been saved successfully to "C:\Users\Christoph\Desktop\aswMBR.txt"

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Malwarebytes: KEIN FUND!
Log:

Code:

Malwarebytes Anti-Malware (Test) 1.60.0.1800

www.malwarebytes.org
 

Datenbank Version: v2012.01.15.01
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 8.0.7601.17514

Christoph :: CHRISTOPH-PC [Administrator]
 

Schutz: Deaktiviert
 

15.01.2012 12:21:43

mbam-log-2012-01-15 (12-21-43).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 474610

Laufzeit: 1 Stunde(n), 26 Minute(n), 25 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

SAS: Trojan.Dropper/Win-NV

SAS fordert mich auf, den Dropper sofort zu löschen. Habe ich bisher noch nicht gemacht und SAS jetzt noch offengelassen. ESET läuft gerade noch. Kann ich schon irgendwas machen?

Hier noch das SAS-Log:

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 01/16/2012 at 02:01 AM
 

Application Version : 5.0.1142
 

Core Rules Database Version : 8134

Trace Rules Database Version: 5946
 

Scan type       : Complete Scan

Total Scan Time : 03:34:28
 

Operating System Information

Windows 7 Professional 64-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Administrator
 

Memory items scanned      : 687

Memory threats detected   : 0

Registry items scanned    : 72085

Registry threats detected : 0

File items scanned        : 397735

File threats detected     : 1
 

Trojan.Dropper/Win-NV

        C:\WINDOWS.OLD\PROGRAM FILES (X86)\LUGERT VERLAG\FORTE FREE\UPDATE.EXE

und das ESET-Log:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=55360b104d6f974f83b75ec539a086c8

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-12-19 05:21:45

# local_time=2011-12-19 06:21:45 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1792 16777215 100 0 2105661 2105661 0 0

# compatibility_mode=5893 16776573 100 94 14848 75861872 0 0

# compatibility_mode=8192 67108863 100 0 4503 4503 0 0

# scanned=313207

# found=0

# cleaned=0

# scan_time=83282

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=55360b104d6f974f83b75ec539a086c8

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-01-10 02:42:29

# local_time=2012-01-10 03:42:29 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=1792 16777215 100 0 4071356 4071356 0 0

# compatibility_mode=5893 16776573 100 94 7139 77827567 0 0

# compatibility_mode=8192 67108863 100 0 1970198 1970198 0 0

# scanned=319820

# found=1

# cleaned=0

# scan_time=8853

C:\Program Files (x86)\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe        Win32/Adware.Toolbar.Dealio application (unable to clean)        00000000000000000000000000000000        I

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=55360b104d6f974f83b75ec539a086c8

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-01-16 12:36:05

# local_time=2012-01-16 01:36:05 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=1792 16777215 100 0 4535016 4535016 0 0

# compatibility_mode=5893 16776573 100 94 3865 78291227 0 0

# compatibility_mode=8192 67108863 100 0 2433858 2433858 0 0

# scanned=320365

# found=1

# cleaned=0

# scan_time=12809

C:\_OTL\MovedFiles\01112012_120649\C_Program Files (x86)\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe        Win32/Adware.Toolbar.Dealio application (unable to clean)        00000000000000000000000000000000        I

Das ist ok. In C:\Qoobox bzw. C:\_OTL (Q-Ordner von CF und OTL) sind die Schädlinge isoliert und gut aufgehoben.
Ansonsten nur ein Fehlalarm bei SASW

Rechner soweit wieder im Lot?

Ja, so merkt man nichts mehr! Ihr seid legendär hier und ich spreche nur gut von euch! Tausendfachen Dank und beste Grüße!

Christoph

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.