Trojaner-Board - AKM 50€ Trojaner - OTL schon ausgeführt, was dann?

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - AKM 50€ Trojaner - OTL schon ausgeführt, was dann? (https://www.trojaner-board.de/111603-akm-50-trojaner-otl-schon-ausgefuehrt-dann.html)

DivX gelöscht, und neues OTL file:

OTL Logfile:

Code:

OTL logfile created on: 25.03.2012 19:44:01 - Run 2

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Josefa\Downloads

 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,18 Gb Total Physical Memory | 1,41 Gb Available Physical Memory | 44,38% Memory free

6,35 Gb Paging File | 4,49 Gb Available in Paging File | 70,66% Paging File free

Paging file location(s): c:\pagefile.sys 3253 5000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 97,56 Gb Total Space | 32,82 Gb Free Space | 33,64% Space Free | Partition Type: NTFS

Drive E: | 498,51 Gb Total Space | 138,50 Gb Free Space | 27,78% Space Free | Partition Type: NTFS

 

Computer Name: JR_NOTEBOOK | User Name: Josefa | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.03.24 20:29:19 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Josefa\Downloads\OTL.exe

PRC - [2012.03.13 06:37:52 | 003,331,872 | ---- | M] (Akamai Technologies, Inc) -- C:\Users\Josefa\AppData\Local\Akamai\netsession_win.exe

PRC - [2012.03.04 23:48:40 | 000,934,752 | ---- | M] (Spigot, Inc.) -- C:\Programme\Common Files\Spigot\Search Settings\SearchSettings.exe

PRC - [2012.03.04 23:40:10 | 000,748,440 | ---- | M] (Spigot, Inc.) -- C:\Programme\Application Updater\ApplicationUpdater.exe

PRC - [2012.02.15 01:03:14 | 024,246,216 | ---- | M] (Dropbox, Inc.) -- C:\Users\Josefa\AppData\Roaming\Dropbox\bin\Dropbox.exe

PRC - [2012.01.13 15:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.01.13 15:53:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.07.07 09:08:30 | 000,216,064 | ---- | M] (Geek Software GmbH) -- E:\Program Files\PDF24\pdf24.exe

PRC - [2011.06.15 15:16:48 | 000,997,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe

PRC - [2011.04.27 15:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\Antimalware\NisSrv.exe

PRC - [2011.04.27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe

PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2010.12.20 16:31:00 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Programme\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

PRC - [2010.12.20 16:30:31 | 001,493,608 | ---- | M] (Realtek Semiconductor) -- C:\Programme\Realtek\Audio\HDA\RtHDVBg.exe

PRC - [2010.12.20 16:30:30 | 002,320,920 | R--- | M] (Intel Corporation) -- C:\Programme\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

PRC - [2010.12.20 16:30:27 | 000,268,824 | R--- | M] (Intel Corporation) -- C:\Programme\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2010.11.20 14:17:41 | 001,174,016 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe

PRC - [2010.10.27 04:59:10 | 000,236,136 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2010.06.21 14:53:44 | 000,436,264 | ---- | M] (Wistron Corp.) -- C:\Programme\Launch Manager\WButton.exe

PRC - [2010.03.03 21:16:06 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

PRC - [2010.03.03 21:16:04 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

PRC - [2009.11.07 04:46:52 | 000,020,480 | ---- | M] (X10) -- C:\Programme\Common Files\X10\Common\X10nets.exe

PRC - [2009.10.22 18:05:40 | 000,118,560 | ---- | M] (Wistron Corp.) -- C:\Programme\Launch Manager\WisLMSvc.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.02.19 00:30:16 | 000,452,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\5be773440afa1e1f565f9021d8fd9730\IAStorUtil.ni.dll

MOD - [2012.02.19 00:24:59 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\42ae8760f0a74ab774e82a64368aa1f6\System.Web.ni.dll

MOD - [2012.02.19 00:24:53 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\a1c4a635721f85bef0ea4194b888b871\System.Runtime.Remoting.ni.dll

MOD - [2012.02.19 00:24:29 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6c51e152e7404188914c9fa4d8503ff9\System.Windows.Forms.ni.dll

MOD - [2012.02.19 00:24:23 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ab87129c2b603f218e4aa5300c9b1bdd\System.Drawing.ni.dll

MOD - [2012.02.19 00:24:11 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\47b9e7f070271ff50f988f75ea68fa3e\WindowsBase.ni.dll

MOD - [2012.02.19 00:24:07 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\9866d1f6178e1cde25642f1ac293ff8d\System.Xml.ni.dll

MOD - [2012.02.19 00:24:02 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e620323cacb5b6bfd93fd28d263440e4\System.Configuration.ni.dll

MOD - [2012.02.19 00:24:01 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\faf4e8730ecbd07570111bb7c3b20565\System.ni.dll

MOD - [2012.01.08 15:41:12 | 000,093,696 | ---- | M] () -- E:\Program Files\FileZilla FTP Client\fzshellext.dll

MOD - [2011.10.15 16:20:32 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll

MOD - [2011.03.17 01:11:16 | 004,297,568 | ---- | M] () -- C:\Programme\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

MOD - [2010.11.13 01:19:04 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll

MOD - [2009.07.14 10:47:11 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2012.03.04 23:40:10 | 000,748,440 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Programme\Application Updater\ApplicationUpdater.exe -- (Application Updater)

SRV - [2012.02.15 14:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.02.10 22:30:45 | 003,340,064 | ---- | M] () [Auto | Running] -- c:\program files\common files\akamai/netsession_win_7de0ed9.dll -- (Akamai)

SRV - [2012.01.13 15:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.06.12 11:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)

SRV - [2011.04.27 15:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)

SRV - [2011.04.27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)

SRV - [2011.02.19 15:08:43 | 001,045,256 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2011.02.19 13:36:06 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)

SRV - [2010.12.20 16:30:30 | 002,320,920 | R--- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)

SRV - [2010.12.20 16:30:27 | 000,268,824 | R--- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)

SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - [2010.10.27 04:59:10 | 000,236,136 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2010.10.27 04:57:22 | 001,620,584 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)

SRV - [2010.03.03 21:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)

SRV - [2010.01.09 22:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)

SRV - [2010.01.09 22:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)

SRV - [2009.11.07 04:46:52 | 000,020,480 | ---- | M] (X10) [Auto | Running] -- C:\Programme\Common Files\X10\Common\X10nets.exe -- (x10nets)

SRV - [2009.10.22 18:05:40 | 000,118,560 | ---- | M] (Wistron Corp.) [On_Demand | Running] -- C:\Programme\Launch Manager\WisLMSvc.exe -- (WisLMSvc)

SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)

SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tsusbhub.sys -- (tsusbhub)

DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\synth3dvsc.sys -- (Synth3dVsc)

DRV - [2011.12.10 16:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2011.08.17 10:56:32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)

DRV - [2011.08.17 10:56:26 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)

DRV - [2011.08.17 10:56:22 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)

DRV - [2011.04.27 15:25:24 | 000,065,024 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)

DRV - [2011.04.18 13:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)

DRV - [2010.12.20 16:31:00 | 000,141,568 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nusb3xhc.sys -- (nusb3xhc)

DRV - [2010.12.20 16:31:00 | 000,061,824 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nusb3hub.sys -- (nusb3hub)

DRV - [2010.12.20 16:30:55 | 000,067,624 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1C62x86.sys -- (L1C)

DRV - [2010.12.20 16:30:54 | 000,193,056 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR)

DRV - [2010.12.20 16:30:53 | 010,367,016 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2010.12.20 16:30:53 | 000,019,656 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvpciflt.sys -- (nvpciflt)

DRV - [2010.12.20 16:30:27 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HECI.sys -- (HECI) Intel(R)

DRV - [2010.11.20 14:30:17 | 000,296,064 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcvmm.sys -- (vpcvmm)

DRV - [2010.11.20 14:30:17 | 000,172,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpchbus.sys -- (vpcbus)

DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)

DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)

DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)

DRV - [2010.11.20 12:50:38 | 000,078,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpcusb.sys -- (vpcusb)

DRV - [2010.11.20 12:50:37 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcnfltr.sys -- (vpcnfltr)

DRV - [2010.11.20 12:50:37 | 000,012,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vpcuxd.sys -- (vpcuxd)

DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV - [2010.11.20 12:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)

DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)

DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)

DRV - [2010.04.01 10:13:38 | 001,009,184 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtl8192se.sys -- (rtl8192se)

DRV - [2010.03.02 14:57:42 | 000,105,856 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)

DRV - [2010.03.02 14:57:42 | 000,105,856 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)

DRV - [2010.03.02 14:57:42 | 000,105,856 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)

DRV - [2010.02.22 10:06:42 | 000,009,216 | ---- | M] (MBB Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\massfilter.sys -- (massfilter)

DRV - [2009.07.14 02:18:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV - [2009.07.14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)

DRV - [2009.05.13 13:26:26 | 000,013,720 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10hid.sys -- (X10Hid)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DD 11 4C 27 20 D0 CB 01  [binary data]

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes\{719AFD7A-89B2-48DB-9C8D-495A78555DB0}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "Search the web"

FF - prefs.js..browser.search.order.1: "Search the web"

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316"

FF - prefs.js..browser.search.selectedEngine: "Search the web"

FF - prefs.js..extensions.enabledItems: {D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}:1.0

FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94

FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94

FF - prefs.js..extensions.enabledItems: ClickPotatoLite@ClickPotatoLite.com:10.0.659.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - prefs.js..extensions.enabledItems: pdfforge@mybrowserbar.com:4.3

FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:4.3

FF - prefs.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="

 

FF - user.js..browser.search.selectedEngine: "Search the web"

FF - user.js..browser.search.order.1: "Search the web"

FF - user.js..browser.search.defaultenginename: "Search the web"

FF - user.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Josefa\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\crossriderapp498@crossrider.com: C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.24 20:46:06 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.03.11 21:17:39 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files\Mozilla Sunbird\components [2011.03.22 13:34:05 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Plugins: C:\Program Files\Mozilla Sunbird\plugins [2012.03.11 21:17:39 | 000,000,000 | ---D | M]

 

[2011.03.11 14:29:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Josefa\AppData\Roaming\mozilla\Extensions

[2011.03.11 14:29:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Josefa\AppData\Roaming\mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}

[2012.03.25 17:35:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions

[2012.01.02 21:12:28 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2012.03.25 17:35:49 | 000,000,000 | ---D | M] (Vuze Remote Community Toolbar) -- C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}

[2012.02.26 17:15:11 | 000,000,000 | ---D | M] (toolplugin) -- C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\welcome@toolmin.com

[2011.03.11 14:29:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Josefa\AppData\Roaming\mozilla\Sunbird\Profiles\ganib2kj.default\extensions

[2012.03.15 21:32:30 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2012.02.28 19:13:13 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

() (No name found) -- C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\EXTENSIONS\YOUTUBE2MP3@MONDAYX.DE.XPI

[2012.03.24 20:46:06 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.05.04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2012.01.06 20:32:22 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.01.06 20:32:22 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012.01.06 20:32:22 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2012.01.06 20:32:22 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.02.26 17:15:11 | 000,000,158 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search the web.src

[2012.01.06 20:32:22 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.01.06 20:32:22 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2012.03.16 03:46:06 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1       localhost

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)

O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)

O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (toolplugin) - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - C:\Users\Josefa\AppData\Roaming\toolplugin\toolbar.dll ()

O3 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)

O4 - HKLM..\Run: [IAStorIcon] C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4 - HKLM..\Run: [Nikon Message Center 2] C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe (Nikon Corporation)

O4 - HKLM..\Run: [NUSB3MON] C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)

O4 - HKLM..\Run: [PDFPrint] E:\Program Files\PDF24\pdf24.exe (Geek Software GmbH)

O4 - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)

O4 - HKLM..\Run: [Wbutton] C:\Program Files\Launch Manager\Wbutton.exe (Wistron Corp.)

O4 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000..\Run: [Akamai NetSession Interface] C:\Users\Josefa\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)

O4 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000..\Run: [Facebook Update] C:\Users\Josefa\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)

O4 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000..\Run: [K3aRyluP6SiCkoR] C:\Users\Josefa\AppData\Roaming\flint4ytw.exe File not found

O4 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000..\Run: [MediaGet2] C:\Users\Josefa\AppData\Local\MediaGet2\mediaget.exe --minimized File not found

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O4 - Startup: C:\Users\Josefa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Josefa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1

O7 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O7 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Josefa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O13 - gopher Prefix: missing

O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab (DLM Control)

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.158.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{077ED5A6-0BB6-4BCC-A1B2-0AE4632AF9B1}: NameServer = 194.48.124.202 194.48.124.200

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6A0BAC69-0D12-4FCE-B866-3F442DFF6449}: DhcpNameServer = 10.158.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{94AC04BF-4F2A-4D16-82A5-DCECFEBA9989}: DhcpNameServer = 193.170.110.64

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (C:\Windows\system32\nvinit.dll) - C:\Windows\System32\nvinit.dll (NVIDIA Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000 Winlogon: Shell - (C:\Users\Josefa\AppData\Roaming\flint4ytw.exe) -  File not found

O20 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000 Winlogon: UserInit - (C:\Users\Josefa\AppData\Roaming\flint4ytw.exe) -  File not found

O20 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000 Winlogon: UserInit - (C:\WINDOWS\System32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2011.02.19 14:55:07 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]

O33 - MountPoints2\{0cceed82-11fc-11e1-b70a-485d604687f4}\Shell - "" = AutoRun

O33 - MountPoints2\{0cceed82-11fc-11e1-b70a-485d604687f4}\Shell\AutoRun\command - "" = IomegaEncryptionSetup v1.3.exe

O33 - MountPoints2\{98cba69b-3c12-11e0-b022-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{98cba69b-3c12-11e0-b022-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Welcome.exe

O33 - MountPoints2\{ce1ff176-f671-11e0-8ea2-00262dc41cd4}\Shell - "" = AutoRun

O33 - MountPoints2\{ce1ff176-f671-11e0-8ea2-00262dc41cd4}\Shell\AutoRun\command - "" = F:\Autorun.exe

O33 - MountPoints2\F\Shell - "" = AutoRun

O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\Autorun.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpReg: HotkeyApp - hkey= - key= - C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron)

MsConfig - StartUpReg: LMgrOSD - hkey= - key= -  File not found

MsConfig - StartUpReg: LMgrVolOSD - hkey= - key= - C:\Program Files\Launch Manager\OSD.exe (Wistron Corp.)

MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)

MsConfig - StartUpReg: SearchSettings - hkey= - key= - C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)

MsConfig - State: "startup" - 2

 

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: MsMpSvc - C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: MsMpSvc - C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {170BC2CF-4B8F-E633-860B-5BC03CE3CEF7} - Microsoft Windows Media Player

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\System32\Microsoft

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45394181-28A0-ADC4-1E17-4CE49025A11C} - Microsoft Windows Media Player 12.0

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {695CE607-29F4-8EA4-8A51-DCF625C4AC57} - .NET Framework

ActiveX: {6BE484BB-1F36-551F-2F1D-C43808D3F1AF} - Internet Explorer

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - C:\Windows\System32\Microsoft

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {FB0EB00B-0E98-DD15-F6D5-7E9BBF41C28E} - Java (Sun)

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.03.23 23:19:22 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.03.23 01:45:34 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Spigot

[2012.03.23 01:45:34 | 000,000,000 | ---D | C] -- C:\Program Files\pdfforge Toolbar

[2012.03.23 01:45:34 | 000,000,000 | ---D | C] -- C:\Program Files\Application Updater

[2012.03.18 09:25:31 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.03.18 09:25:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.03.18 09:25:30 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.03.16 03:46:02 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.03.15 20:05:46 | 000,000,000 | ---D | C] -- C:\Users\Josefa\AppData\Roaming\Malwarebytes

[2012.03.15 20:05:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.03.11 21:17:02 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012.03.11 02:32:25 | 000,000,000 | ---D | C] -- C:\Users\Josefa\Desktop\BSP Buch

[2012.03.09 23:08:27 | 000,000,000 | ---D | C] -- C:\Users\Josefa\Desktop\Panorama

[2012.03.03 18:18:09 | 000,000,000 | ---D | C] -- C:\Users\Josefa\Documents\ZPS14

[2012.03.03 18:18:08 | 000,000,000 | ---D | C] -- C:\Users\Josefa\AppData\Roaming\Zoner

[2012.03.03 18:18:08 | 000,000,000 | ---D | C] -- C:\Users\Josefa\AppData\Local\Zoner

[2012.03.03 18:18:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Zoner

[2012.03.03 18:17:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zoner Photo Studio 14

[2012.03.03 18:17:39 | 000,000,000 | ---D | C] -- C:\Program Files\Zoner

[2012.02.28 19:13:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2012.02.28 19:13:03 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype

[2012.02.26 17:15:07 | 000,000,000 | ---D | C] -- C:\Users\Josefa\AppData\Roaming\toolplugin

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.03.25 19:43:00 | 000,013,760 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.03.25 19:43:00 | 000,013,760 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.03.25 19:32:30 | 000,000,932 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000UA.job

[2012.03.25 19:32:28 | 000,000,910 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000Core.job

[2012.03.25 19:32:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.03.25 17:32:42 | 000,722,736 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.03.25 17:32:42 | 000,661,510 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.03.25 17:32:42 | 000,157,244 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.03.25 17:32:42 | 000,129,150 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.03.24 08:44:23 | 000,000,020 | -H-- | M] () -- C:\ProgramData\PKP_DLet.DAT

[2012.03.23 01:37:28 | 2558,595,072 | -HS- | M] () -- C:\hiberfil.sys

[2012.03.22 20:55:45 | 000,485,016 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.03.21 22:30:39 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.18 07:24:12 | 000,002,243 | ---- | M] () -- C:\Windows\epplauncher.mif

[2012.03.16 03:46:06 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts

[2012.03.15 19:52:12 | 000,000,000 | ---- | M] () -- C:\Windows\ViewNX2.INI

[2012.03.15 19:48:11 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

[2012.03.15 19:48:11 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

[2012.03.13 17:10:56 | 313,256,741 | ---- | M] () -- C:\Windows\MEMORY.DMP

[2012.03.12 13:39:39 | 001,711,984 | ---- | M] () -- C:\Users\Josefa\Desktop\Leno_individuell.pdf

[2012.03.12 13:39:08 | 002,513,666 | ---- | M] () -- C:\Users\Josefa\Desktop\brettstapelbau.pdf

[2012.03.11 03:27:16 | 000,000,600 | ---- | M] () -- C:\Users\Josefa\AppData\Local\PUTTY.RND

[2012.03.11 00:39:27 | 000,000,855 | ---- | M] () -- C:\Users\Public\Desktop\FileZilla Client.lnk

[2012.03.10 19:08:38 | 000,042,733 | ---- | M] () -- C:\Users\Josefa\Desktop\post2.jpg

[2012.03.10 18:34:18 | 001,647,628 | ---- | M] () -- C:\Users\Josefa\Desktop\DSC_0028x.jpg

[2012.03.10 14:26:47 | 000,032,649 | ---- | M] () -- C:\Users\Josefa\Desktop\post.jpg

[2012.03.06 23:08:49 | 026,774,240 | ---- | M] () -- C:\Users\Josefa\Desktop\Technische Mappe_Stand 09.2011_druck.pdf

[2012.03.03 21:03:34 | 000,002,726 | ---- | M] () -- C:\Users\Josefa\Desktop\P1020527.JPG

[2012.03.03 21:03:25 | 000,002,556 | ---- | M] () -- C:\Users\Josefa\Desktop\P1020528.JPG

[2012.03.03 18:17:51 | 000,002,035 | ---- | M] () -- C:\Users\Public\Desktop\Zoner Photo Studio 14 FREE.lnk

[2012.03.02 09:27:55 | 000,001,023 | ---- | M] () -- C:\Users\Josefa\Desktop\Dropbox.lnk

[2012.03.02 09:27:55 | 000,001,003 | ---- | M] () -- C:\Users\Josefa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

[2012.02.28 19:13:03 | 000,002,505 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2012.02.26 17:44:37 | 000,001,593 | ---- | M] () -- C:\Users\Josefa\Desktop\DivX Movies.lnk

 
 ========== Files Created - No Company Name ==========

 

[2012.03.18 09:25:31 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.15 19:52:12 | 000,000,000 | ---- | C] () -- C:\Windows\ViewNX2.INI

[2012.03.15 19:48:11 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS

[2012.03.15 19:48:11 | 000,000,000 | RHS- | C] () -- C:\IO.SYS

[2012.03.12 13:39:39 | 001,711,984 | ---- | C] () -- C:\Users\Josefa\Desktop\Leno_individuell.pdf

[2012.03.12 13:39:08 | 002,513,666 | ---- | C] () -- C:\Users\Josefa\Desktop\brettstapelbau.pdf

[2012.03.11 00:39:27 | 000,000,855 | ---- | C] () -- C:\Users\Public\Desktop\FileZilla Client.lnk

[2012.03.10 19:08:36 | 000,042,733 | ---- | C] () -- C:\Users\Josefa\Desktop\post2.jpg

[2012.03.10 18:33:57 | 001,647,628 | ---- | C] () -- C:\Users\Josefa\Desktop\DSC_0028x.jpg

[2012.03.10 14:26:44 | 000,032,649 | ---- | C] () -- C:\Users\Josefa\Desktop\post.jpg

[2012.03.06 23:08:47 | 026,774,240 | ---- | C] () -- C:\Users\Josefa\Desktop\Technische Mappe_Stand 09.2011_druck.pdf

[2012.03.03 21:03:33 | 000,002,726 | ---- | C] () -- C:\Users\Josefa\Desktop\P1020527.JPG

[2012.03.03 21:03:24 | 000,002,556 | ---- | C] () -- C:\Users\Josefa\Desktop\P1020528.JPG

[2012.03.03 18:17:51 | 000,002,035 | ---- | C] () -- C:\Users\Public\Desktop\Zoner Photo Studio 14 FREE.lnk

[2012.02.26 17:44:37 | 000,001,593 | ---- | C] () -- C:\Users\Josefa\Desktop\DivX Movies.lnk

[2012.02.09 12:54:12 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Rock

[2012.02.09 12:54:12 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Robot

[2012.02.09 12:54:12 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Reverb

[2012.02.09 12:54:12 | 000,000,268 | RH-- | C] () -- C:\Users\Josefa\AppData\Roaming\Repeat Routines

[2012.02.09 12:54:12 | 000,000,268 | RH-- | C] () -- C:\Users\Josefa\AppData\Roaming\Receipts

[2012.02.09 12:54:12 | 000,000,268 | RH-- | C] () -- C:\Users\Josefa\AppData\Roaming\Radio Sounds

[2012.02.09 12:54:12 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLev.DAT

[2012.02.09 12:54:12 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLet.DAT

[2012.02.09 12:54:12 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLes.DAT

[2012.02.09 12:54:12 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Sound Effects

[2012.02.09 12:54:12 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Smooth Strings

[2012.02.09 12:54:12 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Services

[2011.08.13 14:31:15 | 000,065,793 | ---- | C] () -- C:\Windows\System32\esfwad.bin

[2011.05.14 16:25:54 | 000,000,600 | ---- | C] () -- C:\Users\Josefa\AppData\Local\PUTTY.RND

[2011.04.23 20:58:29 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe

[2011.04.23 20:56:52 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

[2011.03.30 19:17:59 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll

[2011.02.21 14:11:34 | 000,000,048 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2011.02.19 12:24:19 | 000,127,184 | ---- | C] () -- C:\Windows\Unwise.exe

[2011.02.19 12:24:18 | 000,149,504 | ---- | C] () -- C:\Windows\unwise32_setup.exe

[2011.02.19 12:20:11 | 000,451,072 | ---- | C] () -- C:\Windows\System32\ISSRemoveSP.exe

[2011.02.19 12:13:16 | 000,002,204 | R--- | C] () -- C:\Windows\System32\drivers\RtPCEE3.DAT

[2011.02.11 19:10:50 | 000,874,048 | ---- | C] () -- C:\Windows\System32\igkrng575.bin

[2011.02.11 18:40:40 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll

[2010.10.27 05:21:58 | 000,416,865 | ---- | C] () -- C:\Windows\System32\nvcoproc.bin

[2010.10.27 05:21:58 | 000,408,168 | ---- | C] () -- C:\Windows\System32\easyUpdatusAPIU.dll

[2010.08.25 20:30:02 | 000,127,868 | ---- | C] () -- C:\Windows\System32\igcompkrng575.bin

[2010.08.25 20:30:00 | 000,104,796 | ---- | C] () -- C:\Windows\System32\igfcg575m.bin

[2010.08.25 19:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config

[2010.06.08 15:19:24 | 000,692,224 | ---- | C] () -- C:\Windows\System32\libeay32.dll

[2010.06.08 15:19:24 | 000,151,552 | ---- | C] () -- C:\Windows\System32\ssleay32.dll

[2010.04.20 16:31:43 | 000,936,832 | ---- | C] () -- C:\Windows\System32\M2ElevatedCalls.dll

 
 ========== LOP Check ==========

 

[2012.03.22 21:05:10 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\cadwork

[2011.09.09 17:40:34 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Abvent

[2011.09.09 17:53:58 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Abvent_Artlantis3

[2011.08.31 11:22:49 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Artisteer

[2011.04.16 17:18:41 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Autodesk

[2011.11.19 16:26:23 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Azureus

[2011.10.15 11:07:22 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\cadwork

[2012.03.23 01:44:33 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Dropbox

[2012.01.02 21:12:39 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\DVDVideoSoft

[2012.01.02 21:12:28 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.08.13 15:35:43 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\EPSON

[2012.03.11 15:24:00 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\FileZilla

[2011.03.15 22:25:10 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Graphisoft

[2011.04.26 20:18:59 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\JSGSoft.com

[2012.02.09 12:56:35 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Nikon

[2012.02.26 17:15:11 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\toolplugin

[2012.03.03 18:18:08 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Zoner

[2012.03.25 19:32:28 | 000,000,910 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000Core.job

[2012.03.25 19:32:30 | 000,000,932 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000UA.job

[2012.03.16 02:08:29 | 000,032,630 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.09.09 17:40:34 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Abvent

[2011.09.09 17:53:58 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Abvent_Artlantis3

[2011.03.04 12:34:53 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Adobe

[2011.08.31 11:22:49 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Apple Computer

[2011.08.31 11:22:49 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Artisteer

[2011.04.16 17:18:41 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Autodesk

[2011.11.19 16:26:23 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Azureus

[2011.10.15 11:07:22 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\cadwork

[2011.09.09 20:55:17 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\DivX

[2011.02.19 15:27:52 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Download Manager

[2012.03.23 01:44:33 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Dropbox

[2012.01.02 21:12:39 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\DVDVideoSoft

[2012.01.02 21:12:28 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.08.13 15:35:43 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\EPSON

[2012.03.11 15:24:00 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\FileZilla

[2011.03.15 22:25:10 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Graphisoft

[2011.02.19 12:09:01 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Identities

[2011.02.19 12:11:49 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\InstallShield

[2011.02.19 12:26:30 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Intel Corporation

[2011.04.26 20:18:59 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\JSGSoft.com

[2011.02.21 12:51:21 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Macromedia

[2012.03.15 20:05:46 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Malwarebytes

[2009.07.14 10:56:41 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Media Center Programs

[2012.02.08 16:18:16 | 000,000,000 | --SD | M] -- C:\Users\Josefa\AppData\Roaming\Microsoft

[2011.03.11 14:29:41 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Mozilla

[2012.02.09 12:56:35 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Nikon

[2012.03.24 20:31:32 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Skype

[2011.07.14 12:20:55 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\skypePM

[2012.02.26 17:15:11 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\toolplugin

[2011.04.17 10:30:16 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\WinRAR

[2012.03.03 18:18:08 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Zoner

 
 < %APPDATA%\*.exe /s >

[2011.11.19 15:00:36 | 000,310,208 | ---- | M] (Georgia Institute of Technology) -- C:\Users\Josefa\AppData\Roaming\Azureus\plugins\mlab\ShaperProbeC.exe

[2012.02.15 01:03:14 | 024,246,216 | ---- | M] (Dropbox, Inc.) -- C:\Users\Josefa\AppData\Roaming\Dropbox\bin\Dropbox.exe

[2012.02.15 01:03:44 | 000,174,752 | ---- | M] (Dropbox, Inc.) -- C:\Users\Josefa\AppData\Roaming\Dropbox\bin\Uninstall.exe

[2011.06.08 23:23:12 | 000,001,078 | R--- | M] () -- C:\Users\Josefa\AppData\Roaming\Microsoft\Installer\{0B15A52D-55B6-457A-8440-F0CE3B2FCDD1}\_2228C2973498FD04F23451.exe

[2011.06.08 23:23:12 | 000,001,078 | R--- | M] () -- C:\Users\Josefa\AppData\Roaming\Microsoft\Installer\{0B15A52D-55B6-457A-8440-F0CE3B2FCDD1}\_6FEFF9B68218417F98F549.exe

[2012.02.09 12:55:09 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Josefa\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe

 
 < %SYSTEMDRIVE%\*.exe >

[2011.07.13 04:55:05 | 002,237,440 | R--- | M] (OldTimer Tools) -- C:\OTLPE.exe

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2010.03.03 20:33:26 | 000,435,736 | ---- | M] (Intel Corporation) MD5=26541A068572F650A2FA490726FE81BE -- C:\Windows\System32\drivers\iaStor.sys

[2010.03.03 20:33:26 | 000,435,736 | ---- | M] (Intel Corporation) MD5=26541A068572F650A2FA490726FE81BE -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_e8a55be84650e755\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys

[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys

[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys

[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys

[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys

[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys

[2011.03.11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys

[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys

[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys

[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys

[2011.03.11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys

[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys

[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll

[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll

[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe

[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe

[2012.01.13 15:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe

[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe

[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

[2011.04.18 13:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\drivers\MpNWMon.sys

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2009.07.14 03:15:19 | 000,016,896 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\eventcls.dll

[2009.07.14 03:15:21 | 000,462,848 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\FirewallAPI.dll

[2009.07.14 03:15:36 | 000,226,816 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\LocationApi.dll

 
 <           >
 

< End of report >

--- --- ---

[/code]

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

PRC - [2012.03.04 23:48:40 | 000,934,752 | ---- | M] (Spigot, Inc.) -- C:\Programme\Common Files\Spigot\Search Settings\SearchSettings.exe

PRC - [2012.03.04 23:40:10 | 000,748,440 | ---- | M] (Spigot, Inc.) -- C:\Programme\Application Updater\ApplicationUpdater.exe

IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DD 11 4C 27 20 D0 CB 01  [binary data]

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes\{719AFD7A-89B2-48DB-9C8D-495A78555DB0}: "URL" = http://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>

FF - prefs.js..browser.search.defaultenginename: "Search the web"

FF - prefs.js..browser.search.order.1: "Search the web"

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316"

FF - prefs.js..browser.search.selectedEngine: "Search the web"

FF - prefs.js..extensions.enabledItems: pdfforge@mybrowserbar.com:4.3

FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:4.3

FF - prefs.js..keyword.URL: "http://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="

FF - user.js..browser.search.selectedEngine: "Search the web"

FF - user.js..browser.search.order.1: "Search the web"

FF - user.js..browser.search.defaultenginename: "Search the web"

FF - user.js..keyword.URL: "http://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="

[2012.03.25 17:35:49 | 000,000,000 | ---D | M] (Vuze Remote Community Toolbar) -- C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}

[2012.02.26 17:15:11 | 000,000,000 | ---D | M] (toolplugin) -- C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\welcome@toolmin.com

O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)

O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)

O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (toolplugin) - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - C:\Users\Josefa\AppData\Roaming\toolplugin\toolbar.dll ()

O3 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

O4 - HKLM..\Run: []  File not found

O4 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000..\Run: [K3aRyluP6SiCkoR] C:\Users\Josefa\AppData\Roaming\flint4ytw.exe File not found

O4 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000..\Run: [MediaGet2] C:\Users\Josefa\AppData\Local\MediaGet2\mediaget.exe --minimized File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1

O7 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O7 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O20 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000 Winlogon: Shell - (C:\Users\Josefa\AppData\Roaming\flint4ytw.exe) -  File not found

O20 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000 Winlogon: UserInit - (C:\Users\Josefa\AppData\Roaming\flint4ytw.exe) -  File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2011.02.19 14:55:07 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]

O33 - MountPoints2\{0cceed82-11fc-11e1-b70a-485d604687f4}\Shell - "" = AutoRun

:Files

C:\Program Files\Common Files\Spigot

C:\Program Files\pdfforge Toolbar

C:\Program Files\Application Updater

:Commands

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

ergebnis:

Code:



All processes killed

========== OTL ==========

No active process named SearchSettings.exe was found!

Process ApplicationUpdater.exe killed successfully!

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ba14329e-9550-4989-b3f2-9732e92d17cc}\ deleted successfully.

C:\Programme\Vuze_Remote\prxtbVuze.dll moved successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.

HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!

HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!

HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{B922D405-6D13-4A2B-AE89-08A030DA4402} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ deleted successfully.

C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll moved successfully.

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ba14329e-9550-4989-b3f2-9732e92d17cc}\ not found.

File C:\Programme\Vuze_Remote\prxtbVuze.dll not found.

HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Internet Explorer\SearchScopes\{719AFD7A-89B2-48DB-9C8D-495A78555DB0}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{719AFD7A-89B2-48DB-9C8D-495A78555DB0}\ not found.

Registry key HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.

HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!

Prefs.js: "Search the web" removed from browser.search.defaultenginename

Prefs.js: "Search the web" removed from browser.search.order.1

Prefs.js: "chr-greentree_ff&type=827316" removed from browser.search.param.yahoo-fr

Prefs.js: "Search the web" removed from browser.search.selectedEngine

Prefs.js: pdfforge@mybrowserbar.com:4.3 removed from extensions.enabledItems

Prefs.js: wtxpcom@mybrowserbar.com:4.3 removed from extensions.enabledItems

Prefs.js: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q=" removed from keyword.URL

C:\Users\Josefa\AppData\Roaming\Mozilla\FireFox\Profiles\2t5b1ba2.default\user.js moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\searchplugin folder moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\modules folder moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\META-INF folder moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\defaults folder moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\components folder moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\chrome folder moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc} folder moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\welcome@toolmin.com\chrome\content folder moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\welcome@toolmin.com\chrome folder moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\welcome@toolmin.com folder moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ not found.

File C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll not found.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ba14329e-9550-4989-b3f2-9732e92d17cc}\ not found.

File C:\Programme\Vuze_Remote\prxtbVuze.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{B922D405-6D13-4A2B-AE89-08A030DA4402} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ not found.

File C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ba14329e-9550-4989-b3f2-9732e92d17cc}\ not found.

File C:\Programme\Vuze_Remote\prxtbVuze.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{DFEFCDEE-CF1A-4FC8-89AF-189327213627} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFEFCDEE-CF1A-4FC8-89AF-189327213627}\ deleted successfully.

C:\Users\Josefa\AppData\Roaming\toolplugin\toolbar.dll moved successfully.

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BA14329E-9550-4989-B3F2-9732E92D17CC} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BA14329E-9550-4989-B3F2-9732E92D17CC}\ not found.

File C:\Programme\Vuze_Remote\prxtbVuze.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Windows\CurrentVersion\Run\\K3aRyluP6SiCkoR deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Windows\CurrentVersion\Run\\MediaGet2 deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDesktop deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\Josefa\AppData\Roaming\flint4ytw.exe deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:\Users\Josefa\AppData\Roaming\flint4ytw.exe deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

File  not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0cceed82-11fc-11e1-b70a-485d604687f4}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0cceed82-11fc-11e1-b70a-485d604687f4}\ not found.

========== FILES ==========

C:\Program Files\Common Files\Spigot\wtxpcom\components folder moved successfully.

C:\Program Files\Common Files\Spigot\wtxpcom folder moved successfully.

C:\Program Files\Common Files\Spigot\Search Settings\Res folder moved successfully.

C:\Program Files\Common Files\Spigot\Search Settings\Lang folder moved successfully.

C:\Program Files\Common Files\Spigot\Search Settings folder moved successfully.

C:\Program Files\Common Files\Spigot folder moved successfully.

C:\Program Files\pdfforge Toolbar\Res\Lang folder moved successfully.

C:\Program Files\pdfforge Toolbar\Res folder moved successfully.

C:\Program Files\pdfforge Toolbar\IE\5.1 folder moved successfully.

C:\Program Files\pdfforge Toolbar\IE folder moved successfully.

C:\Program Files\pdfforge Toolbar\FF\chrome folder moved successfully.

C:\Program Files\pdfforge Toolbar\FF folder moved successfully.

C:\Program Files\pdfforge Toolbar folder moved successfully.

C:\Program Files\Application Updater folder moved successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: Administrator

->Temp folder emptied: 448569 bytes

->Temporary Internet Files folder emptied: 19801009 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 50164846 bytes

->Flash cache emptied: 954 bytes

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Josefa

->Temp folder emptied: 1385229 bytes

->Temporary Internet Files folder emptied: 1198898 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 76203586 bytes

->Flash cache emptied: 689 bytes

 

User: Public

 

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 291572 bytes

RecycleBin emptied: 3478164856 bytes

 

Total Files Cleaned = 3.460,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.39.2 log created on 03262012_174223
 

Files\Folders moved on Reboot...
 

Registry entries deleted on Reboot...

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

wiedermal brav alles befolgt, oh großer meister^^ :heilig:

Code:



20:00:37.0161 2892        TDSS rootkit removing tool 2.7.23.0 Mar 26 2012 13:40:18

20:00:37.0405 2892        ============================================================

20:00:37.0406 2892        Current date / time: 2012/03/26 20:00:37.0405

20:00:37.0406 2892        SystemInfo:

20:00:37.0406 2892        

20:00:37.0406 2892        OS Version: 6.1.7601 ServicePack: 1.0

20:00:37.0406 2892        Product type: Workstation

20:00:37.0406 2892        ComputerName: JR_NOTEBOOK

20:00:37.0407 2892        UserName: Josefa

20:00:37.0407 2892        Windows directory: C:\Windows

20:00:37.0407 2892        System windows directory: C:\Windows

20:00:37.0407 2892        Processor architecture: Intel x86

20:00:37.0407 2892        Number of processors: 4

20:00:37.0407 2892        Page size: 0x1000

20:00:37.0407 2892        Boot type: Normal boot

20:00:37.0407 2892        ============================================================

20:00:38.0066 2892        Drive \Device\Harddisk0\DR0 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050

20:00:38.0067 2892        \Device\Harddisk0\DR0:

20:00:38.0068 2892        MBR used

20:00:38.0068 2892        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000

20:00:38.0068 2892        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0xC31E000

20:00:38.0068 2892        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0xC350800, BlocksNum 0x3E506800

20:00:38.0174 2892        Initialize success

20:00:38.0174 2892        ============================================================

20:04:20.0251 4268        ============================================================

20:04:20.0251 4268        Scan started

20:04:20.0251 4268        Mode: Manual; SigCheck; TDLFS; 

20:04:20.0251 4268        ============================================================

20:04:20.0704 4268        1394ohci        (1b133875b8aa8ac48969bd3458afe9f5) C:\Windows\system32\drivers\1394ohci.sys

20:04:20.0844 4268        1394ohci - ok

20:04:20.0860 4268        ACPI            (cea80c80bed809aa0da6febc04733349) C:\Windows\system32\drivers\ACPI.sys

20:04:20.0906 4268        ACPI - ok

20:04:20.0938 4268        AcpiPmi         (1efbc664abff416d1d07db115dcb264f) C:\Windows\system32\drivers\acpipmi.sys

20:04:21.0016 4268        AcpiPmi - ok

20:04:21.0140 4268        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

20:04:21.0187 4268        AdobeARMservice - ok

20:04:21.0343 4268        adp94xx         (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys

20:04:21.0390 4268        adp94xx - ok

20:04:21.0406 4268        adpahci         (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys

20:04:21.0437 4268        adpahci - ok

20:04:21.0452 4268        adpu320         (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys

20:04:21.0484 4268        adpu320 - ok

20:04:21.0530 4268        AeLookupSvc     (8b5eefeec1e6d1a72a06c526628ad161) C:\Windows\System32\aelupsvc.dll

20:04:21.0640 4268        AeLookupSvc - ok

20:04:21.0671 4268        AFD             (9ebbba55060f786f0fcaa3893bfa2806) C:\Windows\system32\drivers\afd.sys

20:04:21.0796 4268        AFD - ok

20:04:21.0858 4268        agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\drivers\agp440.sys

20:04:21.0905 4268        agp440 - ok

20:04:21.0952 4268        aic78xx         (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys

20:04:21.0998 4268        aic78xx - ok

20:04:22.0201 4268        Akamai          (31bd294dc6ddbc0f16356d958d0743a4) c:\program files\common files\akamai/netsession_win_7de0ed9.dll

20:04:22.0201 4268        Suspicious file (Hidden): c:\program files\common files\akamai/netsession_win_7de0ed9.dll. md5: 31bd294dc6ddbc0f16356d958d0743a4

20:04:22.0201 4268        Akamai ( HiddenFile.Multi.Generic ) - warning

20:04:22.0201 4268        Akamai - detected HiddenFile.Multi.Generic (1)

20:04:22.0326 4268        ALG             (18a54e132947cd98fea9accc57f98f13) C:\Windows\System32\alg.exe

20:04:22.0420 4268        ALG - ok

20:04:22.0482 4268        aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\drivers\aliide.sys

20:04:22.0498 4268        aliide - ok

20:04:22.0544 4268        amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\drivers\amdagp.sys

20:04:22.0576 4268        amdagp - ok

20:04:22.0591 4268        amdide          (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\drivers\amdide.sys

20:04:22.0607 4268        amdide - ok

20:04:22.0638 4268        AmdK8           (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys

20:04:22.0716 4268        AmdK8 - ok

20:04:22.0747 4268        AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys

20:04:22.0810 4268        AmdPPM - ok

20:04:22.0841 4268        amdsata         (d320bf87125326f996d4904fe24300fc) C:\Windows\system32\drivers\amdsata.sys

20:04:22.0903 4268        amdsata - ok

20:04:22.0934 4268        amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys

20:04:22.0997 4268        amdsbs - ok

20:04:23.0028 4268        amdxata         (46387fb17b086d16dea267d5be23a2f2) C:\Windows\system32\drivers\amdxata.sys

20:04:23.0044 4268        amdxata - ok

20:04:23.0075 4268        AppID           (aea177f783e20150ace5383ee368da19) C:\Windows\system32\drivers\appid.sys

20:04:23.0215 4268        AppID - ok

20:04:23.0324 4268        AppIDSvc        (62a9c86cb6085e20db4823e4e97826f5) C:\Windows\System32\appidsvc.dll

20:04:23.0387 4268        AppIDSvc - ok

20:04:23.0434 4268        Appinfo         (fb1959012294d6ad43e5304df65e3c26) C:\Windows\System32\appinfo.dll

20:04:23.0512 4268        Appinfo - ok

20:04:23.0558 4268        Application Updater - ok

20:04:23.0621 4268        AppMgmt         (a45d184df6a8803da13a0b329517a64a) C:\Windows\System32\appmgmts.dll

20:04:23.0699 4268        AppMgmt - ok

20:04:23.0777 4268        arc             (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys

20:04:23.0808 4268        arc - ok

20:04:23.0824 4268        arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys

20:04:23.0855 4268        arcsas - ok

20:04:23.0980 4268        aspnet_state    (776acefa0ca9df0faa51a5fb2f435705) C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe

20:04:24.0011 4268        aspnet_state - ok

20:04:24.0058 4268        AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys

20:04:24.0182 4268        AsyncMac - ok

20:04:24.0292 4268        atapi           (338c86357871c167a96ab976519bf59e) C:\Windows\system32\drivers\atapi.sys

20:04:24.0323 4268        atapi - ok

20:04:24.0416 4268        AudioEndpointBuilder (ce3b4e731638d2ef62fcb419be0d39f0) C:\Windows\System32\Audiosrv.dll

20:04:24.0526 4268        AudioEndpointBuilder - ok

20:04:24.0526 4268        Audiosrv        (ce3b4e731638d2ef62fcb419be0d39f0) C:\Windows\System32\Audiosrv.dll

20:04:24.0572 4268        Audiosrv - ok

20:04:24.0635 4268        AxInstSV        (6e30d02aac9cac84f421622e3a2f6178) C:\Windows\System32\AxInstSV.dll

20:04:24.0728 4268        AxInstSV - ok

20:04:24.0822 4268        b06bdrv         (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys

20:04:24.0900 4268        b06bdrv - ok

20:04:24.0931 4268        b57nd60x        (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys

20:04:25.0025 4268        b57nd60x - ok

20:04:25.0072 4268        BDESVC          (ee1e9c3bb8228ae423dd38db69128e71) C:\Windows\System32\bdesvc.dll

20:04:25.0134 4268        BDESVC - ok

20:04:25.0150 4268        Beep            (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys

20:04:25.0196 4268        Beep - ok

20:04:25.0290 4268        BFE             (1e2bac209d184bb851e1a187d8a29136) C:\Windows\System32\bfe.dll

20:04:25.0384 4268        BFE - ok

20:04:25.0446 4268        BITS            (e585445d5021971fae10393f0f1c3961) C:\Windows\System32\qmgr.dll

20:04:25.0508 4268        BITS - ok

20:04:25.0555 4268        blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys

20:04:25.0602 4268        blbdrive - ok

20:04:25.0649 4268        bowser          (8f2da3028d5fcbd1a060a3de64cd6506) C:\Windows\system32\DRIVERS\bowser.sys

20:04:25.0727 4268        bowser - ok

20:04:25.0742 4268        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys

20:04:25.0836 4268        BrFiltLo - ok

20:04:25.0852 4268        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys

20:04:25.0914 4268        BrFiltUp - ok

20:04:25.0976 4268        Browser         (6e11f33d14d020f58d5e02e4d67dfa19) C:\Windows\System32\browser.dll

20:04:26.0054 4268        Browser - ok

20:04:26.0086 4268        Brserid         (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys

20:04:26.0179 4268        Brserid - ok

20:04:26.0195 4268        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys

20:04:26.0242 4268        BrSerWdm - ok

20:04:26.0288 4268        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys

20:04:26.0304 4268        BrUsbMdm - ok

20:04:26.0320 4268        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys

20:04:26.0366 4268        BrUsbSer - ok

20:04:26.0398 4268        BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys

20:04:26.0429 4268        BTHMODEM - ok

20:04:26.0476 4268        bthserv         (1df19c96eef6c29d1c3e1a8678e07190) C:\Windows\system32\bthserv.dll

20:04:26.0554 4268        bthserv - ok

20:04:26.0600 4268        cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys

20:04:26.0694 4268        cdfs - ok

20:04:26.0756 4268        cdrom           (be167ed0fdb9c1fa1133953c18d5a6c9) C:\Windows\system32\DRIVERS\cdrom.sys

20:04:26.0819 4268        cdrom - ok

20:04:26.0881 4268        CertPropSvc     (319c6b309773d063541d01df8ac6f55f) C:\Windows\System32\certprop.dll

20:04:26.0959 4268        CertPropSvc - ok

20:04:26.0990 4268        circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys

20:04:27.0037 4268        circlass - ok

20:04:27.0068 4268        CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys

20:04:27.0131 4268        CLFS - ok

20:04:27.0193 4268        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

20:04:27.0240 4268        clr_optimization_v2.0.50727_32 - ok

20:04:27.0302 4268        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

20:04:27.0334 4268        clr_optimization_v4.0.30319_32 - ok

20:04:27.0412 4268        CmBatt          (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys

20:04:27.0490 4268        CmBatt - ok

20:04:27.0521 4268        cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\drivers\cmdide.sys

20:04:27.0568 4268        cmdide - ok

20:04:27.0614 4268        CNG             (6427525d76f61d0c519b008d3680e8e7) C:\Windows\system32\Drivers\cng.sys

20:04:27.0661 4268        CNG - ok

20:04:27.0708 4268        Compbatt        (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys

20:04:27.0724 4268        Compbatt - ok

20:04:27.0802 4268        CompositeBus    (cbe8c58a8579cfe5fccf809e6f114e89) C:\Windows\system32\drivers\CompositeBus.sys

20:04:27.0880 4268        CompositeBus - ok

20:04:27.0895 4268        COMSysApp - ok

20:04:27.0911 4268        crcdisk         (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys

20:04:27.0942 4268        crcdisk - ok

20:04:27.0989 4268        CryptSvc        (a585bebf7d054bd9618eda0922d5484a) C:\Windows\system32\cryptsvc.dll

20:04:28.0098 4268        CryptSvc - ok

20:04:28.0145 4268        CSC             (3c2177a897b4ca2788c6fb0c3fd81d4b) C:\Windows\system32\drivers\csc.sys

20:04:28.0238 4268        CSC - ok

20:04:28.0254 4268        CscService      (15f93b37f6801943360d9eb42485d5d3) C:\Windows\System32\cscsvc.dll

20:04:28.0301 4268        CscService - ok

20:04:28.0332 4268        DcomLaunch      (7660f01d3b38aca1747e397d21d790af) C:\Windows\system32\rpcss.dll

20:04:28.0410 4268        DcomLaunch - ok

20:04:28.0441 4268        defragsvc       (8d6e10a2d9a5eed59562d9b82cf804e1) C:\Windows\System32\defragsvc.dll

20:04:28.0504 4268        defragsvc - ok

20:04:28.0566 4268        DfsC            (f024449c97ec1e464aaffda18593db88) C:\Windows\system32\Drivers\dfsc.sys

20:04:28.0660 4268        DfsC - ok

20:04:28.0738 4268        Dhcp            (e9e01eb683c132f7fa27cd607b8a2b63) C:\Windows\system32\dhcpcore.dll

20:04:28.0831 4268        Dhcp - ok

20:04:28.0862 4268        discache        (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys

20:04:28.0925 4268        discache - ok

20:04:28.0972 4268        Disk            (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys

20:04:29.0018 4268        Disk - ok

20:04:29.0128 4268        Dnscache        (33ef4861f19a0736b11314aad9ae28d0) C:\Windows\System32\dnsrslvr.dll

20:04:29.0206 4268        Dnscache - ok

20:04:29.0252 4268        dot3svc         (366ba8fb4b7bb7435e3b9eacb3843f67) C:\Windows\System32\dot3svc.dll

20:04:29.0315 4268        dot3svc - ok

20:04:29.0346 4268        DPS             (8ec04ca86f1d68da9e11952eb85973d6) C:\Windows\system32\dps.dll

20:04:29.0424 4268        DPS - ok

20:04:29.0486 4268        drmkaud         (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys

20:04:29.0533 4268        drmkaud - ok

20:04:29.0564 4268        DXGKrnl         (23f5d28378a160352ba8f817bd8c71cb) C:\Windows\System32\drivers\dxgkrnl.sys

20:04:29.0611 4268        DXGKrnl - ok

20:04:29.0642 4268        EapHost         (8600142fa91c1b96367d3300ad0f3f3a) C:\Windows\System32\eapsvc.dll

20:04:29.0705 4268        EapHost - ok

20:04:29.0814 4268        ebdrv           (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys

20:04:29.0939 4268        ebdrv - ok

20:04:30.0001 4268        EFS             (81951f51e318aecc2d68559e47485cc4) C:\Windows\System32\lsass.exe

20:04:30.0079 4268        EFS - ok

20:04:30.0142 4268        ehRecvr         (a8c362018efc87beb013ee28f29c0863) C:\Windows\ehome\ehRecvr.exe

20:04:30.0235 4268        ehRecvr - ok

20:04:30.0266 4268        ehSched         (d389bff34f80caede417bf9d1507996a) C:\Windows\ehome\ehsched.exe

20:04:30.0360 4268        ehSched - ok

20:04:30.0454 4268        elxstor         (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys

20:04:30.0500 4268        elxstor - ok

20:04:30.0532 4268        ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\drivers\errdev.sys

20:04:30.0563 4268        ErrDev - ok

20:04:30.0610 4268        EventSystem     (f6916efc29d9953d5d0df06882ae8e16) C:\Windows\system32\es.dll

20:04:30.0672 4268        EventSystem - ok

20:04:30.0719 4268        exfat           (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys

20:04:30.0781 4268        exfat - ok

20:04:30.0812 4268        fastfat         (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys

20:04:30.0859 4268        fastfat - ok

20:04:30.0906 4268        Fax             (967ea5b213e9984cbe270205df37755b) C:\Windows\system32\fxssvc.exe

20:04:31.0000 4268        Fax - ok

20:04:31.0046 4268        fdc             (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys

20:04:31.0093 4268        fdc - ok

20:04:31.0124 4268        fdPHost         (f3222c893bd2f5821a0179e5c71e88fb) C:\Windows\system32\fdPHost.dll

20:04:31.0202 4268        fdPHost - ok

20:04:31.0218 4268        FDResPub        (7dbe8cbfe79efbdeb98c9fb08d3a9a5b) C:\Windows\system32\fdrespub.dll

20:04:31.0265 4268        FDResPub - ok

20:04:31.0280 4268        FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys

20:04:31.0312 4268        FileInfo - ok

20:04:31.0327 4268        Filetrace       (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys

20:04:31.0390 4268        Filetrace - ok

20:04:31.0483 4268        FLEXnet Licensing Service (d60ef46dc0e757fe5eb579db95b88954) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

20:04:31.0608 4268        FLEXnet Licensing Service - ok

20:04:31.0733 4268        flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys

20:04:31.0780 4268        flpydisk - ok

20:04:31.0811 4268        FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys

20:04:31.0842 4268        FltMgr - ok

20:04:31.0904 4268        FontCache       (b3a5ec6b6b6673db7e87c2bcdbddc074) C:\Windows\system32\FntCache.dll

20:04:31.0982 4268        FontCache - ok

20:04:32.0076 4268        FontCache3.0.0.0 (e56f39f6b7fda0ac77a79b0fd3de1a2f) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

20:04:32.0123 4268        FontCache3.0.0.0 - ok

20:04:32.0170 4268        FsDepends       (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys

20:04:32.0201 4268        FsDepends - ok

20:04:32.0232 4268        Fs_Rec          (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys

20:04:32.0248 4268        Fs_Rec - ok

20:04:32.0279 4268        fvevol          (8a73e79089b282100b9393b644cb853b) C:\Windows\system32\DRIVERS\fvevol.sys

20:04:32.0326 4268        fvevol - ok

20:04:32.0357 4268        gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys

20:04:32.0419 4268        gagp30kx - ok

20:04:32.0466 4268        gpsvc           (e897eaf5ed6ba41e081060c9b447a673) C:\Windows\System32\gpsvc.dll

20:04:32.0544 4268        gpsvc - ok

20:04:32.0560 4268        hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys

20:04:32.0731 4268        hcw85cir - ok

20:04:32.0794 4268        HdAudAddService (a5ef29d5315111c80a5c1abad14c8972) C:\Windows\system32\drivers\HdAudio.sys

20:04:32.0840 4268        HdAudAddService - ok

20:04:32.0872 4268        HDAudBus        (9036377b8a6c15dc2eec53e489d159b5) C:\Windows\system32\drivers\HDAudBus.sys

20:04:32.0934 4268        HDAudBus - ok

20:04:32.0981 4268        HECI            (a88485dc6a7136c10d9a6c7e38fdfe3c) C:\Windows\system32\DRIVERS\HECI.sys

20:04:33.0043 4268        HECI - ok

20:04:33.0059 4268        HidBatt         (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys

20:04:33.0106 4268        HidBatt - ok

20:04:33.0137 4268        HidBth          (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys

20:04:33.0168 4268        HidBth - ok

20:04:33.0184 4268        HidIr           (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys

20:04:33.0230 4268        HidIr - ok

20:04:33.0246 4268        hidserv         (2bc6f6a1992b3a77f5f41432ca6b3b6b) C:\Windows\system32\hidserv.dll

20:04:33.0308 4268        hidserv - ok

20:04:33.0371 4268        HidUsb          (10c19f8290891af023eaec0832e1eb4d) C:\Windows\system32\DRIVERS\hidusb.sys

20:04:33.0418 4268        HidUsb - ok

20:04:33.0449 4268        hkmsvc          (196b4e3f4cccc24af836ce58facbb699) C:\Windows\system32\kmsvc.dll

20:04:33.0496 4268        hkmsvc - ok

20:04:33.0527 4268        HomeGroupListener (6658f4404de03d75fe3ba09f7aba6a30) C:\Windows\system32\ListSvc.dll

20:04:33.0589 4268        HomeGroupListener - ok

20:04:33.0636 4268        HomeGroupProvider (dbc02d918fff1cad628acbe0c0eaa8e8) C:\Windows\system32\provsvc.dll

20:04:33.0698 4268        HomeGroupProvider - ok

20:04:33.0761 4268        HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\drivers\HpSAMD.sys

20:04:33.0792 4268        HpSAMD - ok

20:04:33.0854 4268        HTTP            (871917b07a141bff43d76d8844d48106) C:\Windows\system32\drivers\HTTP.sys

20:04:33.0948 4268        HTTP - ok

20:04:34.0010 4268        hwpolicy        (0c4e035c7f105f1299258c90886c64c5) C:\Windows\system32\drivers\hwpolicy.sys

20:04:34.0042 4268        hwpolicy - ok

20:04:34.0120 4268        i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\drivers\i8042prt.sys

20:04:34.0182 4268        i8042prt - ok

20:04:34.0213 4268        iaStor          (26541a068572f650a2fa490726fe81be) C:\Windows\system32\DRIVERS\iaStor.sys

20:04:34.0276 4268        iaStor - ok

20:04:34.0354 4268        IAStorDataMgrSvc (31a0e93cdf29007d6c6fffb632f375ed) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

20:04:34.0369 4268        IAStorDataMgrSvc - ok

20:04:34.0400 4268        iaStorV         (5cd5f9a5444e6cdcb0ac89bd62d8b76e) C:\Windows\system32\drivers\iaStorV.sys

20:04:34.0463 4268        iaStorV - ok

20:04:34.0541 4268        IDriverT        (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

20:04:34.0588 4268        IDriverT ( UnsignedFile.Multi.Generic ) - warning

20:04:34.0588 4268        IDriverT - detected UnsignedFile.Multi.Generic (1)

20:04:34.0697 4268        idsvc           (c521d7eb6497bb1af6afa89e322fb43c) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

20:04:34.0790 4268        idsvc - ok

20:04:35.0056 4268        igfx            (dce0b53570703cce580d066f89ef58cd) C:\Windows\system32\DRIVERS\igdkmd32.sys

20:04:35.0336 4268        igfx - ok

20:04:35.0446 4268        iirsp           (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys

20:04:35.0477 4268        iirsp - ok

20:04:35.0524 4268        IKEEXT          (f95622f161474511b8d80d6b093aa610) C:\Windows\System32\ikeext.dll

20:04:35.0617 4268        IKEEXT - ok

20:04:35.0726 4268        IntcAzAudAddService (eef55e4de66fd16f636c26a8883c27f7) C:\Windows\system32\drivers\RTKVHDA.sys

20:04:35.0820 4268        IntcAzAudAddService - ok

20:04:35.0914 4268        intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\drivers\intelide.sys

20:04:35.0945 4268        intelide - ok

20:04:35.0992 4268        intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys

20:04:36.0054 4268        intelppm - ok

20:04:36.0085 4268        IPBusEnum       (acb364b9075a45c0736e5c47be5cae19) C:\Windows\system32\ipbusenum.dll

20:04:36.0148 4268        IPBusEnum - ok

20:04:36.0179 4268        IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys

20:04:36.0241 4268        IpFilterDriver - ok

20:04:36.0288 4268        iphlpsvc        (4d65a07b795d6674312f879d09aa7663) C:\Windows\System32\iphlpsvc.dll

20:04:36.0366 4268        iphlpsvc - ok

20:04:36.0397 4268        IPMIDRV         (4bd7134618c1d2a27466a099062547bf) C:\Windows\system32\drivers\IPMIDrv.sys

20:04:36.0460 4268        IPMIDRV - ok

20:04:36.0491 4268        IPNAT           (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys

20:04:36.0522 4268        IPNAT - ok

20:04:36.0569 4268        IRENUM          (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys

20:04:36.0616 4268        IRENUM - ok

20:04:36.0647 4268        isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\drivers\isapnp.sys

20:04:36.0694 4268        isapnp - ok

20:04:36.0725 4268        iScsiPrt        (cb7a9abb12b8415bce5d74994c7ba3ae) C:\Windows\system32\drivers\msiscsi.sys

20:04:36.0787 4268        iScsiPrt - ok

20:04:36.0803 4268        kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\drivers\kbdclass.sys

20:04:36.0834 4268        kbdclass - ok

20:04:36.0881 4268        kbdhid          (9e3ced91863e6ee98c24794d05e27a71) C:\Windows\system32\drivers\kbdhid.sys

20:04:36.0912 4268        kbdhid - ok

20:04:36.0959 4268        KeyIso          (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe

20:04:37.0006 4268        KeyIso - ok

20:04:37.0021 4268        KSecDD          (f4647bb23db9038a7536cf6b68f4207f) C:\Windows\system32\Drivers\ksecdd.sys

20:04:37.0052 4268        KSecDD - ok

20:04:37.0068 4268        KSecPkg         (e73cae53bbb72ba26918492c6b4c229d) C:\Windows\system32\Drivers\ksecpkg.sys

20:04:37.0115 4268        KSecPkg - ok

20:04:37.0146 4268        KtmRm           (89a7b9cc98d0d80c6f31b91c0a310fcd) C:\Windows\system32\msdtckrm.dll

20:04:37.0208 4268        KtmRm - ok

20:04:37.0271 4268        L1C             (4566fd5f4416e7fef3600e4b30d086c3) C:\Windows\system32\DRIVERS\L1C62x86.sys

20:04:37.0318 4268        L1C - ok

20:04:37.0364 4268        LanmanServer    (d64af876d53eca3668bb97b51b4e70ab) C:\Windows\system32\srvsvc.dll

20:04:37.0427 4268        LanmanServer - ok

20:04:37.0474 4268        LanmanWorkstation (58405e4f68ba8e4057c6e914f326aba2) C:\Windows\System32\wkssvc.dll

20:04:37.0552 4268        LanmanWorkstation - ok

20:04:37.0614 4268        lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys

20:04:37.0692 4268        lltdio - ok

20:04:37.0723 4268        lltdsvc         (5700673e13a2117fa3b9020c852c01e2) C:\Windows\System32\lltdsvc.dll

20:04:37.0801 4268        lltdsvc - ok

20:04:37.0817 4268        lmhosts         (55ca01ba19d0006c8f2639b6c045e08b) C:\Windows\System32\lmhsvc.dll

20:04:37.0864 4268        lmhosts - ok

20:04:37.0942 4268        LMS             (1e2f802846eb944e0333efee7c9532a8) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

20:04:38.0051 4268        LMS - ok

20:04:38.0113 4268        LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys

20:04:38.0176 4268        LSI_FC - ok

20:04:38.0191 4268        LSI_SAS         (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys

20:04:38.0222 4268        LSI_SAS - ok

20:04:38.0254 4268        LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys

20:04:38.0269 4268        LSI_SAS2 - ok

20:04:38.0300 4268        LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys

20:04:38.0332 4268        LSI_SCSI - ok

20:04:38.0363 4268        luafv           (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys

20:04:38.0441 4268        luafv - ok

20:04:38.0488 4268        massfilter      (0b058116d3d4ecca7ded38f16e0581b2) C:\Windows\system32\drivers\massfilter.sys

20:04:38.0550 4268        massfilter - ok

20:04:38.0581 4268        MBAMProtector   (b7ca8cc3f978201856b6ab82f40953c3) C:\Windows\system32\drivers\mbam.sys

20:04:38.0612 4268        MBAMProtector - ok

20:04:38.0675 4268        MBAMService     (056b19651bd7b7ce5f89a3ac46dbdc08) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

20:04:38.0768 4268        MBAMService - ok

20:04:38.0800 4268        Mcx2Svc         (bfb9ee8ee977efe85d1a3105abef6dd1) C:\Windows\system32\Mcx2Svc.dll

20:04:38.0831 4268        Mcx2Svc - ok

20:04:38.0893 4268        megasas         (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys

20:04:38.0909 4268        megasas - ok

20:04:38.0956 4268        MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys

20:04:38.0987 4268        MegaSR - ok

20:04:39.0065 4268        Microsoft SharePoint Workspace Audit Service - ok

20:04:39.0096 4268        MMCSS           (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll

20:04:39.0158 4268        MMCSS - ok

20:04:39.0174 4268        Modem           (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys

20:04:39.0221 4268        Modem - ok

20:04:39.0252 4268        monitor         (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys

20:04:39.0299 4268        monitor - ok

20:04:39.0346 4268        mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys

20:04:39.0377 4268        mouclass - ok

20:04:39.0408 4268        mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys

20:04:39.0455 4268        mouhid - ok

20:04:39.0486 4268        mountmgr        (fc8771f45ecccfd89684e38842539b9b) C:\Windows\system32\drivers\mountmgr.sys

20:04:39.0548 4268        mountmgr - ok

20:04:39.0611 4268        MpFilter        (fee0baded54222e9f1dae9541212aab1) C:\Windows\system32\DRIVERS\MpFilter.sys

20:04:39.0689 4268        MpFilter - ok

20:04:39.0720 4268        mpio            (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\Windows\system32\drivers\mpio.sys

20:04:39.0767 4268        mpio - ok

20:04:39.0892 4268        MpKslc3445e54   (a69630d039c38018689190234f866d77) C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B3E55C7C-D4D4-4414-98FB-B246A0AF9BAC}\MpKslc3445e54.sys

20:04:39.0923 4268        MpKslc3445e54 - ok

20:04:39.0938 4268        MpNWMon         (2c3489660d4a8d514c123c3f0d67df46) C:\Windows\system32\DRIVERS\MpNWMon.sys

20:04:39.0970 4268        MpNWMon - ok

20:04:40.0001 4268        mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys

20:04:40.0048 4268        mpsdrv - ok

20:04:40.0110 4268        MpsSvc          (9835584e999d25004e1ee8e5f3e3b881) C:\Windows\system32\mpssvc.dll

20:04:40.0204 4268        MpsSvc - ok

20:04:40.0235 4268        MRxDAV          (ceb46ab7c01c9f825f8cc6babc18166a) C:\Windows\system32\drivers\mrxdav.sys

20:04:40.0282 4268        MRxDAV - ok

20:04:40.0328 4268        mrxsmb          (5d16c921e3671636c0eba3bbaac5fd25) C:\Windows\system32\DRIVERS\mrxsmb.sys

20:04:40.0375 4268        mrxsmb - ok

20:04:40.0422 4268        mrxsmb10        (6d17a4791aca19328c685d256349fefc) C:\Windows\system32\DRIVERS\mrxsmb10.sys

20:04:40.0500 4268        mrxsmb10 - ok

20:04:40.0531 4268        mrxsmb20        (b81f204d146000be76651a50670a5e9e) C:\Windows\system32\DRIVERS\mrxsmb20.sys

20:04:40.0594 4268        mrxsmb20 - ok

20:04:40.0625 4268        msahci          (012c5f4e9349e711e11e0f19a8589f0a) C:\Windows\system32\drivers\msahci.sys

20:04:40.0640 4268        msahci - ok

20:04:40.0687 4268        msdsm           (55055f8ad8be27a64c831322a780a228) C:\Windows\system32\drivers\msdsm.sys

20:04:40.0703 4268        msdsm - ok

20:04:40.0734 4268        MSDTC           (e1bce74a3bd9902b72599c0192a07e27) C:\Windows\System32\msdtc.exe

20:04:40.0781 4268        MSDTC - ok

20:04:40.0828 4268        Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys

20:04:40.0859 4268        Msfs - ok

20:04:40.0874 4268        mshidkmdf       (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys

20:04:40.0921 4268        mshidkmdf - ok

20:04:40.0952 4268        msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\drivers\msisadrv.sys

20:04:40.0968 4268        msisadrv - ok

20:04:41.0015 4268        MSiSCSI         (90f7d9e6b6f27e1a707d4a297f077828) C:\Windows\system32\iscsiexe.dll

20:04:41.0062 4268        MSiSCSI - ok

20:04:41.0077 4268        msiserver - ok

20:04:41.0124 4268        MSKSSRV         (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys

20:04:41.0186 4268        MSKSSRV - ok

20:04:41.0296 4268        MsMpSvc         (cfce43b70ca0cc4dcc8adb62b792b173) C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

20:04:41.0327 4268        MsMpSvc - ok

20:04:41.0342 4268        MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys

20:04:41.0405 4268        MSPCLOCK - ok

20:04:41.0420 4268        MSPQM           (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys

20:04:41.0452 4268        MSPQM - ok

20:04:41.0483 4268        MsRPC           (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys

20:04:41.0530 4268        MsRPC - ok

20:04:41.0561 4268        mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\drivers\mssmbios.sys

20:04:41.0608 4268        mssmbios - ok

20:04:41.0623 4268        MSTEE           (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys

20:04:41.0654 4268        MSTEE - ok

20:04:41.0670 4268        MTConfig        (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys

20:04:41.0732 4268        MTConfig - ok

20:04:41.0764 4268        Mup             (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys

20:04:41.0795 4268        Mup - ok

20:04:41.0826 4268        napagent        (61d57a5d7c6d9afe10e77dae6e1b445e) C:\Windows\system32\qagentRT.dll

20:04:41.0873 4268        napagent - ok

20:04:41.0920 4268        NativeWifiP     (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys

20:04:41.0951 4268        NativeWifiP - ok

20:04:42.0013 4268        NDIS            (e7c54812a2aaf43316eb6930c1ffa108) C:\Windows\system32\drivers\ndis.sys

20:04:42.0060 4268        NDIS - ok

20:04:42.0091 4268        NdisCap         (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys

20:04:42.0154 4268        NdisCap - ok

20:04:42.0185 4268        NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys

20:04:42.0232 4268        NdisTapi - ok

20:04:42.0278 4268        Ndisuio         (d8a65dafb3eb41cbb622745676fcd072) C:\Windows\system32\DRIVERS\ndisuio.sys

20:04:42.0341 4268        Ndisuio - ok

20:04:42.0372 4268        NdisWan         (38fbe267e7e6983311179230facb1017) C:\Windows\system32\DRIVERS\ndiswan.sys

20:04:42.0434 4268        NdisWan - ok

20:04:42.0481 4268        NDProxy         (a4bdc541e69674fbff1a8ff00be913f2) C:\Windows\system32\drivers\NDProxy.sys

20:04:42.0544 4268        NDProxy - ok

20:04:42.0575 4268        NetBIOS         (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys

20:04:42.0622 4268        NetBIOS - ok

20:04:42.0653 4268        NetBT           (280122ddcf04b378edd1ad54d71c1e54) C:\Windows\system32\DRIVERS\netbt.sys

20:04:42.0731 4268        NetBT - ok

20:04:42.0778 4268        Netlogon        (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe

20:04:42.0824 4268        Netlogon - ok

20:04:42.0871 4268        Netman          (7cccfca7510684768da22092d1fa4db2) C:\Windows\System32\netman.dll

20:04:42.0949 4268        Netman - ok

20:04:43.0043 4268        NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

20:04:43.0074 4268        NetMsmqActivator - ok

20:04:43.0074 4268        NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

20:04:43.0090 4268        NetPipeActivator - ok

20:04:43.0105 4268        netprofm        (8c338238c16777a802d6a9211eb2ba50) C:\Windows\System32\netprofm.dll

20:04:43.0168 4268        netprofm - ok

20:04:43.0183 4268        NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

20:04:43.0214 4268        NetTcpActivator - ok

20:04:43.0214 4268        NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

20:04:43.0230 4268        NetTcpPortSharing - ok

20:04:43.0308 4268        nfrd960         (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys

20:04:43.0355 4268        nfrd960 - ok

20:04:43.0386 4268        NisDrv          (7b01c6172cfd0b10116175e09200d4b4) C:\Windows\system32\DRIVERS\NisDrvWFP.sys

20:04:43.0402 4268        NisDrv - ok

20:04:43.0511 4268        NisSrv          (a5cb074f34bbd89948e34a630d459c0c) C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

20:04:43.0573 4268        NisSrv - ok

20:04:43.0604 4268        NlaSvc          (912084381d30d8b89ec4e293053f4710) C:\Windows\System32\nlasvc.dll

20:04:43.0667 4268        NlaSvc - ok

20:04:43.0745 4268        nmwcd           (b0a67de1a128389aea4d42c5a56215fd) C:\Windows\system32\drivers\ccdcmb.sys

20:04:43.0823 4268        nmwcd - ok

20:04:43.0948 4268        nmwcdc          (025c54f9f8c8bc1894ea38529c742c54) C:\Windows\system32\drivers\ccdcmbo.sys

20:04:44.0010 4268        nmwcdc - ok

20:04:44.0041 4268        Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys

20:04:44.0104 4268        Npfs - ok

20:04:44.0135 4268        nsi             (ba387e955e890c8a88306d9b8d06bf17) C:\Windows\system32\nsisvc.dll

20:04:44.0213 4268        nsi - ok

20:04:44.0228 4268        nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys

20:04:44.0291 4268        nsiproxy - ok

20:04:44.0384 4268        Ntfs            (81189c3d7763838e55c397759d49007a) C:\Windows\system32\drivers\Ntfs.sys

20:04:44.0540 4268        Ntfs - ok

20:04:44.0634 4268        Null            (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys

20:04:44.0696 4268        Null - ok

20:04:44.0743 4268        nusb3hub        (ff6d3248e791e7a897bd8ea2fbacbcff) C:\Windows\system32\DRIVERS\nusb3hub.sys

20:04:44.0806 4268        nusb3hub - ok

20:04:44.0837 4268        nusb3xhc        (b5eb7e275f2967026c6031897624bc51) C:\Windows\system32\DRIVERS\nusb3xhc.sys

20:04:44.0868 4268        nusb3xhc - ok

20:04:45.0071 4268        nvlddmkm        (ac8c39fe0f9551087ed0d40239a9db52) C:\Windows\system32\DRIVERS\nvlddmkm.sys

20:04:45.0398 4268        nvlddmkm - ok

20:04:45.0492 4268        nvpciflt        (6b050791d479c338ec464213cdffaf4a) C:\Windows\system32\DRIVERS\nvpciflt.sys

20:04:45.0539 4268        nvpciflt - ok

20:04:45.0586 4268        nvraid          (b3e25ee28883877076e0e1ff877d02e0) C:\Windows\system32\drivers\nvraid.sys

20:04:45.0632 4268        nvraid - ok

20:04:45.0648 4268        nvstor          (4380e59a170d88c4f1022eff6719a8a4) C:\Windows\system32\drivers\nvstor.sys

20:04:45.0695 4268        nvstor - ok

20:04:45.0742 4268        nvsvc           (cb45c7ed5220546107f154572db6202d) C:\Windows\system32\nvvsvc.exe

20:04:45.0804 4268        nvsvc - ok

20:04:45.0898 4268        nvUpdatusService (c9f1aa3cea686f8f966c0b4dadf67994) C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

20:04:46.0022 4268        nvUpdatusService - ok

20:04:46.0147 4268        nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\drivers\nv_agp.sys

20:04:46.0178 4268        nv_agp - ok

20:04:46.0225 4268        ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\drivers\ohci1394.sys

20:04:46.0288 4268        ohci1394 - ok

20:04:46.0366 4268        ose             (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

20:04:46.0428 4268        ose - ok

20:04:46.0553 4268        osppsvc         (358a9cca612c68eb2f07ddad4ce1d8d7) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

20:04:46.0834 4268        osppsvc - ok

20:04:46.0927 4268        p2pimsvc        (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll

20:04:47.0005 4268        p2pimsvc - ok

20:04:47.0052 4268        p2psvc          (59c3ddd501e39e006dac31bf55150d91) C:\Windows\system32\p2psvc.dll

20:04:47.0083 4268        p2psvc - ok

20:04:47.0146 4268        Parport         (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys

20:04:47.0177 4268        Parport - ok

20:04:47.0224 4268        partmgr         (bf8f6af06da75b336f07e23aef97d93b) C:\Windows\system32\drivers\partmgr.sys

20:04:47.0255 4268        partmgr - ok

20:04:47.0286 4268        Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys

20:04:47.0302 4268        Parvdm - ok

20:04:47.0333 4268        PcaSvc          (358ab7956d3160000726574083dfc8a6) C:\Windows\System32\pcasvc.dll

20:04:47.0395 4268        PcaSvc - ok

20:04:47.0442 4268        pci             (673e55c3498eb970088e812ea820aa8f) C:\Windows\system32\drivers\pci.sys

20:04:47.0473 4268        pci - ok

20:04:47.0504 4268        pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\drivers\pciide.sys

20:04:47.0551 4268        pciide - ok

20:04:47.0582 4268        pcmcia          (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys

20:04:47.0614 4268        pcmcia - ok

20:04:47.0629 4268        pcw             (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys

20:04:47.0645 4268        pcw - ok

20:04:47.0676 4268        PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys

20:04:47.0738 4268        PEAUTH - ok

20:04:47.0801 4268        PeerDistSvc     (af4d64d2a57b9772cf3801950b8058a6) C:\Windows\system32\peerdistsvc.dll

20:04:47.0910 4268        PeerDistSvc - ok

20:04:48.0019 4268        pla             (414bba67a3ded1d28437eb66aeb8a720) C:\Windows\system32\pla.dll

20:04:48.0128 4268        pla - ok

20:04:48.0222 4268        PlugPlay        (ec7bc28d207da09e79b3e9faf8b232ca) C:\Windows\system32\umpnpmgr.dll

20:04:48.0316 4268        PlugPlay - ok

20:04:48.0347 4268        PNRPAutoReg     (63ff8572611249931eb16bb8eed6afc8) C:\Windows\system32\pnrpauto.dll

20:04:48.0394 4268        PNRPAutoReg - ok

20:04:48.0425 4268        PNRPsvc         (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll

20:04:48.0456 4268        PNRPsvc - ok

20:04:48.0534 4268        PolicyAgent     (53946b69ba0836bd95b03759530c81ec) C:\Windows\System32\ipsecsvc.dll

20:04:48.0628 4268        PolicyAgent - ok

20:04:48.0659 4268        Power           (f87d30e72e03d579a5199ccb3831d6ea) C:\Windows\system32\umpo.dll

20:04:48.0752 4268        Power - ok

20:04:48.0815 4268        PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys

20:04:48.0893 4268        PptpMiniport - ok

20:04:48.0924 4268        Processor       (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys

20:04:48.0955 4268        Processor - ok

20:04:48.0986 4268        ProfSvc         (43ca4ccc22d52fb58e8988f0198851d0) C:\Windows\system32\profsvc.dll

20:04:49.0049 4268        ProfSvc - ok

20:04:49.0064 4268        ProtectedStorage (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe

20:04:49.0096 4268        ProtectedStorage - ok

20:04:49.0127 4268        Psched          (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys

20:04:49.0174 4268        Psched - ok

20:04:49.0236 4268        ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys

20:04:49.0298 4268        ql2300 - ok

20:04:49.0314 4268        ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys

20:04:49.0361 4268        ql40xx - ok

20:04:49.0376 4268        QWAVE           (31ac809e7707eb580b2bdb760390765a) C:\Windows\system32\qwave.dll

20:04:49.0439 4268        QWAVE - ok

20:04:49.0454 4268        QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys

20:04:49.0501 4268        QWAVEdrv - ok

20:04:49.0517 4268        RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys

20:04:49.0564 4268        RasAcd - ok

20:04:49.0610 4268        RasAgileVpn     (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys

20:04:49.0688 4268        RasAgileVpn - ok

20:04:49.0720 4268        RasAuto         (a60f1839849c0c00739787fd5ec03f13) C:\Windows\System32\rasauto.dll

20:04:49.0798 4268        RasAuto - ok

20:04:49.0829 4268        Rasl2tp         (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys

20:04:49.0922 4268        Rasl2tp - ok

20:04:49.0954 4268        RasMan          (cb9e04dc05eacf5b9a36ca276d475006) C:\Windows\System32\rasmans.dll

20:04:50.0016 4268        RasMan - ok

20:04:50.0032 4268        RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys

20:04:50.0078 4268        RasPppoe - ok

20:04:50.0125 4268        RasSstp         (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys

20:04:50.0188 4268        RasSstp - ok

20:04:50.0234 4268        rdbss           (d528bc58a489409ba40334ebf96a311b) C:\Windows\system32\DRIVERS\rdbss.sys

20:04:50.0297 4268        rdbss - ok

20:04:50.0312 4268        rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys

20:04:50.0344 4268        rdpbus - ok

20:04:50.0375 4268        RDPCDD          (23dae03f29d253ae74c44f99e515f9a1) C:\Windows\system32\DRIVERS\RDPCDD.sys

20:04:50.0453 4268        RDPCDD - ok

20:04:50.0484 4268        RDPDR           (b973fcfc50dc1434e1970a146f7e3885) C:\Windows\system32\drivers\rdpdr.sys

20:04:50.0531 4268        RDPDR - ok

20:04:50.0562 4268        RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys

20:04:50.0593 4268        RDPENCDD - ok

20:04:50.0624 4268        RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys

20:04:50.0656 4268        RDPREFMP - ok

20:04:50.0702 4268        RdpVideoMiniport (68a0387f58e226deee23d9715955572a) C:\Windows\system32\drivers\rdpvideominiport.sys

20:04:50.0765 4268        RdpVideoMiniport - ok

20:04:50.0796 4268        RDPWD           (244c83332f44589ae98fc347f11b2693) C:\Windows\system32\drivers\RDPWD.sys

20:04:50.0936 4268        RDPWD - ok

20:04:50.0983 4268        rdyboost        (518395321dc96fe2c9f0e96ac743b656) C:\Windows\system32\drivers\rdyboost.sys

20:04:51.0046 4268        rdyboost - ok

20:04:51.0092 4268        RemoteAccess    (7b5e1419717fac363a31cc302895217a) C:\Windows\System32\mprdim.dll

20:04:51.0155 4268        RemoteAccess - ok

20:04:51.0186 4268        RemoteRegistry  (cb9a8683f4ef2bf99e123d79950d7935) C:\Windows\system32\regsvc.dll

20:04:51.0248 4268        RemoteRegistry - ok

20:04:51.0248 4268        RpcEptMapper    (78d072f35bc45d9e4e1b61895c152234) C:\Windows\System32\RpcEpMap.dll

20:04:51.0295 4268        RpcEptMapper - ok

20:04:51.0311 4268        RpcLocator      (94d36c0e44677dd26981d2bfeef2a29d) C:\Windows\system32\locator.exe

20:04:51.0358 4268        RpcLocator - ok

20:04:51.0389 4268        RpcSs           (7660f01d3b38aca1747e397d21d790af) C:\Windows\system32\rpcss.dll

20:04:51.0451 4268        RpcSs - ok

20:04:51.0514 4268        rspndr          (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys

20:04:51.0607 4268        rspndr - ok

20:04:51.0654 4268        RSUSBSTOR       (0340a381b920a6e68178b832889f33f8) C:\Windows\system32\Drivers\RtsUStor.sys

20:04:51.0701 4268        RSUSBSTOR - ok

20:04:51.0748 4268        rtl8192se       (b5e9979fbb26fc059bd87a81f763d5da) C:\Windows\system32\DRIVERS\rtl8192se.sys

20:04:51.0810 4268        rtl8192se - ok

20:04:51.0826 4268        s3cap           (7fa7f2e249a5dcbb7970630e15e1f482) C:\Windows\system32\drivers\vms3cap.sys

20:04:51.0872 4268        s3cap - ok

20:04:51.0904 4268        SamSs           (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe

20:04:51.0919 4268        SamSs - ok

20:04:51.0966 4268        sbp2port        (05d860da1040f111503ac416ccef2bca) C:\Windows\system32\drivers\sbp2port.sys

20:04:51.0997 4268        sbp2port - ok

20:04:52.0028 4268        SCardSvr        (8fc518ffe9519c2631d37515a68009c4) C:\Windows\System32\SCardSvr.dll

20:04:52.0091 4268        SCardSvr - ok

20:04:52.0122 4268        scfilter        (0693b5ec673e34dc147e195779a4dcf6) C:\Windows\system32\DRIVERS\scfilter.sys

20:04:52.0200 4268        scfilter - ok

20:04:52.0231 4268        Schedule        (a04bb13f8a72f8b6e8b4071723e4e336) C:\Windows\system32\schedsvc.dll

20:04:52.0340 4268        Schedule - ok

20:04:52.0372 4268        SCPolicySvc     (319c6b309773d063541d01df8ac6f55f) C:\Windows\System32\certprop.dll

20:04:52.0418 4268        SCPolicySvc - ok

20:04:52.0434 4268        SDRSVC          (08236c4bce5edd0a0318a438af28e0f7) C:\Windows\System32\SDRSVC.dll

20:04:52.0496 4268        SDRSVC - ok

20:04:52.0559 4268        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

20:04:52.0621 4268        secdrv - ok

20:04:52.0652 4268        seclogon        (a59b3a4442c52060cc7a85293aa3546f) C:\Windows\system32\seclogon.dll

20:04:52.0715 4268        seclogon - ok

20:04:52.0730 4268        SENS            (dcb7fcdcc97f87360f75d77425b81737) C:\Windows\System32\sens.dll

20:04:52.0793 4268        SENS - ok

20:04:52.0824 4268        SensrSvc        (50087fe1ee447009c9cc2997b90de53f) C:\Windows\system32\sensrsvc.dll

20:04:52.0886 4268        SensrSvc - ok

20:04:52.0949 4268        Serenum         (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys

20:04:52.0996 4268        Serenum - ok

20:04:53.0011 4268        Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys

20:04:53.0074 4268        Serial - ok

20:04:53.0105 4268        sermouse        (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys

20:04:53.0152 4268        sermouse - ok

20:04:53.0198 4268        SessionEnv      (4ae380f39a0032eab7dd953030b26d28) C:\Windows\system32\sessenv.dll

20:04:53.0261 4268        SessionEnv - ok

20:04:53.0292 4268        sffdisk         (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\drivers\sffdisk.sys

20:04:53.0308 4268        sffdisk - ok

20:04:53.0339 4268        sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\drivers\sffp_mmc.sys

20:04:53.0401 4268        sffp_mmc - ok

20:04:53.0417 4268        sffp_sd         (6d4ccaedc018f1cf52866bbbaa235982) C:\Windows\system32\drivers\sffp_sd.sys

20:04:53.0448 4268        sffp_sd - ok

20:04:53.0479 4268        sfloppy         (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys

20:04:53.0510 4268        sfloppy - ok

20:04:53.0557 4268        SharedAccess    (d1a079a0de2ea524513b6930c24527a2) C:\Windows\System32\ipnathlp.dll

20:04:53.0698 4268        SharedAccess - ok

20:04:53.0744 4268        ShellHWDetection (414da952a35bf5d50192e28263b40577) C:\Windows\System32\shsvcs.dll

20:04:53.0791 4268        ShellHWDetection - ok

20:04:53.0869 4268        sisagp          (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\drivers\sisagp.sys

20:04:53.0900 4268        sisagp - ok

20:04:53.0947 4268        SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys

20:04:53.0963 4268        SiSRaid2 - ok

20:04:53.0994 4268        SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys

20:04:54.0025 4268        SiSRaid4 - ok

20:04:54.0072 4268        SkypeUpdate     (db0405d9aad62f0762e0876ac142b7e1) C:\Program Files\Skype\Updater\Updater.exe

20:04:54.0197 4268        SkypeUpdate - ok

20:04:54.0244 4268        Smb             (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys

20:04:54.0322 4268        Smb - ok

20:04:54.0368 4268        SNMPTRAP        (6a984831644eca1a33ffeae4126f4f37) C:\Windows\System32\snmptrap.exe

20:04:54.0431 4268        SNMPTRAP - ok

20:04:54.0462 4268        spldr           (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys

20:04:54.0478 4268        spldr - ok

20:04:54.0524 4268        Spooler         (866a43013535dc8587c258e43579c764) C:\Windows\System32\spoolsv.exe

20:04:54.0602 4268        Spooler - ok

20:04:54.0712 4268        sppsvc          (cf87a1de791347e75b98885214ced2b8) C:\Windows\system32\sppsvc.exe

20:04:54.0868 4268        sppsvc - ok

20:04:54.0946 4268        sppuinotify     (b0180b20b065d89232a78a40fe56eaa6) C:\Windows\system32\sppuinotify.dll

20:04:55.0024 4268        sppuinotify - ok

20:04:55.0086 4268        srv             (e4c2764065d66ea1d2d3ebc28fe99c46) C:\Windows\system32\DRIVERS\srv.sys

20:04:55.0133 4268        srv - ok

20:04:55.0164 4268        srv2            (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\Windows\system32\DRIVERS\srv2.sys

20:04:55.0211 4268        srv2 - ok

20:04:55.0226 4268        srvnet          (be6bd660caa6f291ae06a718a4fa8abc) C:\Windows\system32\DRIVERS\srvnet.sys

20:04:55.0258 4268        srvnet - ok

20:04:55.0289 4268        SSDPSRV         (d887c9fd02ac9fa880f6e5027a43e118) C:\Windows\System32\ssdpsrv.dll

20:04:55.0336 4268        SSDPSRV - ok

20:04:55.0351 4268        SstpSvc         (d318f23be45d5e3a107469eb64815b50) C:\Windows\system32\sstpsvc.dll

20:04:55.0429 4268        SstpSvc - ok

20:04:55.0507 4268        Stereo Service  (47a0a473ad1822e9e6c76e519bd0a023) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

20:04:55.0616 4268        Stereo Service - ok

20:04:55.0663 4268        stexstor        (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys

20:04:55.0710 4268        stexstor - ok

20:04:55.0757 4268        StiSvc          (e1fb3706030fb4578a0d72c2fc3689e4) C:\Windows\System32\wiaservc.dll

20:04:55.0788 4268        StiSvc - ok

20:04:55.0835 4268        storflt         (472af0311073dceceaa8fa18ba2bdf89) C:\Windows\system32\drivers\vmstorfl.sys

20:04:55.0850 4268        storflt - ok

20:04:55.0882 4268        storvsc         (dcaffd62259e0bdb433dd67b5bb37619) C:\Windows\system32\drivers\storvsc.sys

20:04:55.0897 4268        storvsc - ok

20:04:55.0928 4268        swenum          (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\drivers\swenum.sys

20:04:55.0944 4268        swenum - ok

20:04:55.0975 4268        swprv           (a28bd92df340e57b024ba433165d34d7) C:\Windows\System32\swprv.dll

20:04:56.0038 4268        swprv - ok

20:04:56.0069 4268        Synth3dVsc - ok

20:04:56.0116 4268        SynTP           (d776eb85a20696d9d43129ccf6e703e2) C:\Windows\system32\DRIVERS\SynTP.sys

20:04:56.0147 4268        SynTP - ok

20:04:56.0194 4268        SysMain         (36650d618ca34c9d357dfd3d89b2c56f) C:\Windows\system32\sysmain.dll

20:04:56.0272 4268        SysMain - ok

20:04:56.0303 4268        TabletInputService (763fecdc3d30c815fe72dd57936c6cd1) C:\Windows\System32\TabSvc.dll

20:04:56.0365 4268        TabletInputService - ok

20:04:56.0412 4268        TapiSrv         (613bf4820361543956909043a265c6ac) C:\Windows\System32\tapisrv.dll

20:04:56.0474 4268        TapiSrv - ok

20:04:56.0506 4268        TBS             (b799d9fdb26111737f58288d8dc172d9) C:\Windows\System32\tbssvc.dll

20:04:56.0584 4268        TBS - ok

20:04:56.0677 4268        Tcpip           (65d10b191c59c5501a1263fc33f6894b) C:\Windows\system32\drivers\tcpip.sys

20:04:56.0740 4268        Tcpip - ok

20:04:56.0864 4268        TCPIP6          (65d10b191c59c5501a1263fc33f6894b) C:\Windows\system32\DRIVERS\tcpip.sys

20:04:56.0927 4268        TCPIP6 - ok

20:04:56.0974 4268        tcpipreg        (cca24162e055c3714ce5a88b100c64ed) C:\Windows\system32\drivers\tcpipreg.sys

20:04:57.0036 4268        tcpipreg - ok

20:04:57.0067 4268        TDPIPE          (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\Windows\system32\drivers\tdpipe.sys

20:04:57.0145 4268        TDPIPE - ok

20:04:57.0192 4268        TDTCP           (2c2c5afe7ee4f620d69c23c0617651a8) C:\Windows\system32\drivers\tdtcp.sys

20:04:57.0223 4268        TDTCP - ok

20:04:57.0270 4268        tdx             (b459575348c20e8121d6039da063c704) C:\Windows\system32\DRIVERS\tdx.sys

20:04:57.0317 4268        tdx - ok

20:04:57.0348 4268        TermDD          (04dbf4b01ea4bf25a9a3e84affac9b20) C:\Windows\system32\drivers\termdd.sys

20:04:57.0379 4268        TermDD - ok

20:04:57.0426 4268        TermService     (382c804c92811be57829d8e550a900e2) C:\Windows\System32\termsrv.dll

20:04:57.0488 4268        TermService - ok

20:04:57.0504 4268        Themes          (42fb6afd6b79d9fe07381609172e7ca4) C:\Windows\system32\themeservice.dll

20:04:57.0551 4268        Themes - ok

20:04:57.0582 4268        THREADORDER     (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll

20:04:57.0629 4268        THREADORDER - ok

20:04:57.0644 4268        TrkWks          (4792c0378db99a9bc2ae2de6cfff0c3a) C:\Windows\System32\trkwks.dll

20:04:57.0691 4268        TrkWks - ok

20:04:57.0738 4268        TrustedInstaller (2c49b175aee1d4364b91b531417fe583) C:\Windows\servicing\TrustedInstaller.exe

20:04:57.0816 4268        TrustedInstaller - ok

20:04:57.0878 4268        tssecsrv        (254bb140eee3c59d6114c1a86b636877) C:\Windows\system32\DRIVERS\tssecsrv.sys

20:04:57.0925 4268        tssecsrv - ok

20:04:57.0972 4268        TsUsbFlt        (fd1d6c73e6333be727cbcc6054247654) C:\Windows\system32\drivers\tsusbflt.sys

20:04:58.0050 4268        TsUsbFlt - ok

20:04:58.0050 4268        tsusbhub - ok

20:04:58.0097 4268        tunnel          (b2fa25d9b17a68bb93d58b0556e8c90d) C:\Windows\system32\DRIVERS\tunnel.sys

20:04:58.0144 4268        tunnel - ok

20:04:58.0190 4268        uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys

20:04:58.0237 4268        uagp35 - ok

20:04:58.0284 4268        udfs            (ee43346c7e4b5e63e54f927babbb32ff) C:\Windows\system32\DRIVERS\udfs.sys

20:04:58.0331 4268        udfs - ok

20:04:58.0378 4268        UI0Detect       (8344fd4fce927880aa1aa7681d4927e5) C:\Windows\system32\UI0Detect.exe

20:04:58.0424 4268        UI0Detect - ok

20:04:58.0471 4268        uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\drivers\uliagpkx.sys

20:04:58.0502 4268        uliagpkx - ok

20:04:58.0534 4268        umbus           (d295bed4b898f0fd999fcfa9b32b071b) C:\Windows\system32\drivers\umbus.sys

20:04:58.0580 4268        umbus - ok

20:04:58.0612 4268        UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys

20:04:58.0643 4268        UmPass - ok

20:04:58.0674 4268        UmRdpService    (409994a8eaceee4e328749c0353527a0) C:\Windows\System32\umrdp.dll

20:04:58.0736 4268        UmRdpService - ok

20:04:58.0877 4268        UNS             (af905f4966cfc8b973623ab150cd4b2b) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

20:04:59.0064 4268        UNS - ok

20:04:59.0142 4268        upnphost        (833fbb672460efce8011d262175fad33) C:\Windows\System32\upnphost.dll

20:04:59.0220 4268        upnphost - ok

20:04:59.0267 4268        usbccgp         (bd9c55d7023c5de374507acc7a14e2ac) C:\Windows\system32\DRIVERS\usbccgp.sys

20:04:59.0329 4268        usbccgp - ok

20:04:59.0360 4268        usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\drivers\usbcir.sys

20:04:59.0407 4268        usbcir - ok

20:04:59.0438 4268        usbehci         (f92de757e4b7ce9c07c5e65423f3ae3b) C:\Windows\system32\drivers\usbehci.sys

20:04:59.0516 4268        usbehci - ok

20:04:59.0532 4268        usbhub          (8dc94aec6a7e644a06135ae7506dc2e9) C:\Windows\system32\DRIVERS\usbhub.sys

20:04:59.0579 4268        usbhub - ok

20:04:59.0610 4268        usbohci         (e185d44fac515a18d9deddc23c2cdf44) C:\Windows\system32\drivers\usbohci.sys

20:04:59.0672 4268        usbohci - ok

20:04:59.0704 4268        usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys

20:04:59.0750 4268        usbprint - ok

20:04:59.0797 4268        usbscan         (576096ccbc07e7c4ea4f5e6686d6888f) C:\Windows\system32\DRIVERS\usbscan.sys

20:04:59.0844 4268        usbscan - ok

20:04:59.0906 4268        usbser          (31181de6190b39fc8007dffd1a48ffd6) C:\Windows\system32\drivers\usbser.sys

20:04:59.0969 4268        usbser - ok

20:04:59.0984 4268        UsbserFilt      (4f8fbc51a1c0a17310846b417a447f91) C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys

20:05:00.0016 4268        UsbserFilt - ok

20:05:00.0047 4268        USBSTOR         (f991ab9cc6b908db552166768176896a) C:\Windows\system32\DRIVERS\USBSTOR.SYS

20:05:00.0109 4268        USBSTOR - ok

20:05:00.0140 4268        usbuhci         (68df884cf41cdada664beb01daf67e3d) C:\Windows\system32\drivers\usbuhci.sys

20:05:00.0172 4268        usbuhci - ok

20:05:00.0234 4268        usbvideo        (45f4e7bf43db40a6c6b4d92c76cbc3f2) C:\Windows\System32\Drivers\usbvideo.sys

20:05:00.0281 4268        usbvideo - ok

20:05:00.0312 4268        UxSms           (081e6e1c91aec36758902a9f727cd23c) C:\Windows\System32\uxsms.dll

20:05:00.0374 4268        UxSms - ok

20:05:00.0390 4268        VaultSvc        (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe

20:05:00.0421 4268        VaultSvc - ok

20:05:00.0452 4268        vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\drivers\vdrvroot.sys

20:05:00.0468 4268        vdrvroot - ok

20:05:00.0515 4268        vds             (c3cd30495687c2a2f66a65ca6fd89be9) C:\Windows\System32\vds.exe

20:05:00.0577 4268        vds - ok

20:05:00.0593 4268        vga             (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys

20:05:00.0624 4268        vga - ok

20:05:00.0655 4268        VgaSave         (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys

20:05:00.0718 4268        VgaSave - ok

20:05:00.0718 4268        VGPU - ok

20:05:00.0749 4268        vhdmp           (5461686cca2fda57b024547733ab42e3) C:\Windows\system32\drivers\vhdmp.sys

20:05:00.0780 4268        vhdmp - ok

20:05:00.0811 4268        viaagp          (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\drivers\viaagp.sys

20:05:00.0842 4268        viaagp - ok

20:05:00.0858 4268        ViaC7           (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys

20:05:00.0889 4268        ViaC7 - ok

20:05:00.0936 4268        viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\drivers\viaide.sys

20:05:00.0967 4268        viaide - ok

20:05:00.0998 4268        vmbus           (c2f2911156fdc7817c52829c86da494e) C:\Windows\system32\drivers\vmbus.sys

20:05:01.0030 4268        vmbus - ok

20:05:01.0045 4268        VMBusHID        (d4d77455211e204f370d08f4963063ce) C:\Windows\system32\drivers\VMBusHID.sys

20:05:01.0076 4268        VMBusHID - ok

20:05:01.0108 4268        volmgr          (4c63e00f2f4b5f86ab48a58cd990f212) C:\Windows\system32\drivers\volmgr.sys

20:05:01.0139 4268        volmgr - ok

20:05:01.0186 4268        volmgrx         (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys

20:05:01.0217 4268        volmgrx - ok

20:05:01.0232 4268        volsnap         (f497f67932c6fa693d7de2780631cfe7) C:\Windows\system32\drivers\volsnap.sys

20:05:01.0264 4268        volsnap - ok

20:05:01.0310 4268        vpcbus          (b26536add1d748cda104d856c979ae79) C:\Windows\system32\DRIVERS\vpchbus.sys

20:05:01.0342 4268        vpcbus - ok

20:05:01.0388 4268        vpcnfltr        (a0f7e923a6261760130f22b85df9040e) C:\Windows\system32\DRIVERS\vpcnfltr.sys

20:05:01.0466 4268        vpcnfltr - ok

20:05:01.0498 4268        vpcusb          (5f4b55e91ce7e2523c9e1e0ece858869) C:\Windows\system32\DRIVERS\vpcusb.sys

20:05:01.0560 4268        vpcusb - ok

20:05:01.0607 4268        vpcuxd          (c35c2c888aff276e95ad3db3b7a8d003) C:\Windows\system32\DRIVERS\vpcuxd.sys

20:05:01.0638 4268        vpcuxd - ok

20:05:01.0716 4268        vpcvmm          (b487191fe18d6863381a1ac55482469a) C:\Windows\system32\drivers\vpcvmm.sys

20:05:01.0778 4268        vpcvmm - ok

20:05:01.0810 4268        vsmraid         (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys

20:05:01.0856 4268        vsmraid - ok

20:05:01.0903 4268        VSS             (209a3b1901b83aeb8527ed211cce9e4c) C:\Windows\system32\vssvc.exe

20:05:01.0997 4268        VSS - ok

20:05:02.0090 4268        vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\system32\DRIVERS\vwifibus.sys

20:05:02.0137 4268        vwifibus - ok

20:05:02.0153 4268        vwififlt        (7090d3436eeb4e7da3373090a23448f7) C:\Windows\system32\DRIVERS\vwififlt.sys

20:05:02.0200 4268        vwififlt - ok

20:05:02.0231 4268        vwifimp         (a3f04cbea6c2a10e6cb01f8b47611882) C:\Windows\system32\DRIVERS\vwifimp.sys

20:05:02.0262 4268        vwifimp - ok

20:05:02.0309 4268        W32Time         (55187fd710e27d5095d10a472c8baf1c) C:\Windows\system32\w32time.dll

20:05:02.0387 4268        W32Time - ok

20:05:02.0402 4268        WacomPen        (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys

20:05:02.0434 4268        WacomPen - ok

20:05:02.0496 4268        WANARP          (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys

20:05:02.0558 4268        WANARP - ok

20:05:02.0574 4268        Wanarpv6        (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys

20:05:02.0621 4268        Wanarpv6 - ok

20:05:02.0699 4268        WatAdminSvc     (353a04c273ec58475d8633e75ccd5604) C:\Windows\system32\Wat\WatAdminSvc.exe

20:05:03.0011 4268        WatAdminSvc - ok

20:05:03.0104 4268        wbengine        (691e3285e53dca558e1a84667f13e15a) C:\Windows\system32\wbengine.exe

20:05:03.0214 4268        wbengine - ok

20:05:03.0292 4268        WbioSrvc        (9614b5d29dc76ac3c29f6d2d3aa70e67) C:\Windows\System32\wbiosrvc.dll

20:05:03.0338 4268        WbioSrvc - ok

20:05:03.0385 4268        wcncsvc         (34eee0dfaadb4f691d6d5308a51315dc) C:\Windows\System32\wcncsvc.dll

20:05:03.0463 4268        wcncsvc - ok

20:05:03.0494 4268        WcsPlugInService (5d930b6357a6d2af4d7653bdabbf352f) C:\Windows\System32\WcsPlugInService.dll

20:05:03.0541 4268        WcsPlugInService - ok

20:05:03.0604 4268        Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys

20:05:03.0635 4268        Wd - ok

20:05:03.0650 4268        Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys

20:05:03.0682 4268        Wdf01000 - ok

20:05:03.0697 4268        WdiServiceHost  (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll

20:05:03.0806 4268        WdiServiceHost - ok

20:05:03.0806 4268        WdiSystemHost   (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll

20:05:03.0838 4268        WdiSystemHost - ok

20:05:03.0884 4268        WebClient       (a9d880f97530d5b8fee278923349929d) C:\Windows\System32\webclnt.dll

20:05:03.0931 4268        WebClient - ok

20:05:03.0978 4268        Wecsvc          (760f0afe937a77cff27153206534f275) C:\Windows\system32\wecsvc.dll

20:05:04.0025 4268        Wecsvc - ok

20:05:04.0040 4268        wercplsupport   (ac804569bb2364fb6017370258a4091b) C:\Windows\System32\wercplsupport.dll

20:05:04.0103 4268        wercplsupport - ok

20:05:04.0118 4268        WerSvc          (08e420d873e4fd85241ee2421b02c4a4) C:\Windows\System32\WerSvc.dll

20:05:04.0181 4268        WerSvc - ok

20:05:04.0243 4268        WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys

20:05:04.0321 4268        WfpLwf - ok

20:05:04.0337 4268        WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys

20:05:04.0368 4268        WIMMount - ok

20:05:04.0446 4268        WinDefend       (3fae8f94296001c32eab62cd7d82e0fd) C:\Program Files\Windows Defender\mpsvc.dll

20:05:04.0508 4268        WinDefend - ok

20:05:04.0508 4268        WinHttpAutoProxySvc - ok

20:05:04.0555 4268        Winmgmt         (f62e510b6ad4c21eb9fe8668ed251826) C:\Windows\system32\wbem\WMIsvc.dll

20:05:04.0618 4268        Winmgmt - ok

20:05:04.0696 4268        WinRM           (1b91cd34ea3a90ab6a4ef0550174f4cc) C:\Windows\system32\WsmSvc.dll

20:05:04.0789 4268        WinRM - ok

20:05:04.0914 4268        WinUsb          (a67e5f9a400f3bd1be3d80613b45f708) C:\Windows\system32\DRIVERS\WinUsb.sys

20:05:04.0961 4268        WinUsb - ok

20:05:05.0039 4268        WisLMSvc        (4c69a8e2e159c1c59bc4b688e9dd7f8c) C:\Program Files\Launch Manager\WisLMSvc.exe

20:05:05.0086 4268        WisLMSvc - ok

20:05:05.0148 4268        Wlansvc         (16935c98ff639d185086a3529b1f2067) C:\Windows\System32\wlansvc.dll

20:05:05.0210 4268        Wlansvc - ok

20:05:05.0288 4268        WmiAcpi         (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\drivers\wmiacpi.sys

20:05:05.0335 4268        WmiAcpi - ok

20:05:05.0382 4268        wmiApSrv        (6eb6b66517b048d87dc1856ddf1f4c3f) C:\Windows\system32\wbem\WmiApSrv.exe

20:05:05.0444 4268        wmiApSrv - ok

20:05:05.0538 4268        WMPNetworkSvc   (3b40d3a61aa8c21b88ae57c58ab3122e) C:\Program Files\Windows Media Player\wmpnetwk.exe

20:05:05.0632 4268        WMPNetworkSvc - ok

20:05:05.0710 4268        WPCSvc          (a2f0ec770a92f2b3f9de6d518e11409c) C:\Windows\System32\wpcsvc.dll

20:05:05.0772 4268        WPCSvc - ok

20:05:05.0803 4268        WPDBusEnum      (aa53356d60af47eacc85bc617a4f3f66) C:\Windows\system32\wpdbusenum.dll

20:05:05.0866 4268        WPDBusEnum - ok

20:05:05.0928 4268        ws2ifsl         (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys

20:05:05.0990 4268        ws2ifsl - ok

20:05:06.0022 4268        wscsvc          (6f5d49efe0e7164e03ae773a3fe25340) C:\Windows\System32\wscsvc.dll

20:05:06.0084 4268        wscsvc - ok

20:05:06.0131 4268        WSDPrintDevice  (553f6ccd7c58eb98d4a8fbdaf283d7a9) C:\Windows\system32\DRIVERS\WSDPrint.sys

20:05:06.0193 4268        WSDPrintDevice - ok

20:05:06.0193 4268        WSearch - ok

20:05:06.0271 4268        wuauserv        (3026418a50c5b4761befa632cedb7406) C:\Windows\system32\wuaueng.dll

20:05:06.0365 4268        wuauserv - ok

20:05:06.0458 4268        WudfPf          (e714a1c0354636837e20ccbf00888ee7) C:\Windows\system32\drivers\WudfPf.sys

20:05:06.0521 4268        WudfPf - ok

20:05:06.0568 4268        WUDFRd          (1023ee888c9b47178c5293ed5336ab69) C:\Windows\system32\DRIVERS\WUDFRd.sys

20:05:06.0630 4268        WUDFRd - ok

20:05:06.0661 4268        wudfsvc         (8d1e1e529a2c9e9b6a85b55a345f7629) C:\Windows\System32\WUDFSvc.dll

20:05:06.0708 4268        wudfsvc - ok

20:05:06.0739 4268        WwanSvc         (ff2d745b560f7c71b31f30f4d49f73d2) C:\Windows\System32\wwansvc.dll

20:05:06.0786 4268        WwanSvc - ok

20:05:06.0817 4268        X10Hid          (1f93fcb5bab3a921ecba522f63586f4a) C:\Windows\system32\Drivers\x10hid.sys

20:05:06.0833 4268        X10Hid - ok

20:05:06.0880 4268        x10nets         (5a0c788c5bc5f2c993cb60940adcf95e) C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

20:05:06.0911 4268        x10nets ( UnsignedFile.Multi.Generic ) - warning

20:05:06.0911 4268        x10nets - detected UnsignedFile.Multi.Generic (1)

20:05:06.0958 4268        ZTEusbmdm6k     (46686fe8915bd8b2feb3a876e367010c) C:\Windows\system32\DRIVERS\ZTEusbmdm6k.sys

20:05:07.0020 4268        ZTEusbmdm6k - ok

20:05:07.0036 4268        ZTEusbnmea      (46686fe8915bd8b2feb3a876e367010c) C:\Windows\system32\DRIVERS\ZTEusbnmea.sys

20:05:07.0067 4268        ZTEusbnmea - ok

20:05:07.0082 4268        ZTEusbser6k     (46686fe8915bd8b2feb3a876e367010c) C:\Windows\system32\DRIVERS\ZTEusbser6k.sys

20:05:07.0114 4268        ZTEusbser6k - ok

20:05:07.0145 4268        MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0

20:05:07.0270 4268        \Device\Harddisk0\DR0 - ok

20:05:07.0270 4268        Boot (0x1200)   (e3cf23f62799f2f5b996aaa22ced8712) \Device\Harddisk0\DR0\Partition0

20:05:07.0270 4268        \Device\Harddisk0\DR0\Partition0 - ok

20:05:07.0301 4268        Boot (0x1200)   (2ac1f28c6cb498c26c1932a76dde7db9) \Device\Harddisk0\DR0\Partition1

20:05:07.0301 4268        \Device\Harddisk0\DR0\Partition1 - ok

20:05:07.0316 4268        Boot (0x1200)   (86878ed15004ac11e4c21bde858abba2) \Device\Harddisk0\DR0\Partition2

20:05:07.0316 4268        \Device\Harddisk0\DR0\Partition2 - ok

20:05:07.0316 4268        ============================================================

20:05:07.0316 4268        Scan finished

20:05:07.0316 4268        ============================================================

20:05:07.0332 4336        Detected object count: 3

20:05:07.0332 4336        Actual detected object count: 3

20:05:57.0408 4336        Akamai ( HiddenFile.Multi.Generic ) - skipped by user

20:05:57.0408 4336        Akamai ( HiddenFile.Multi.Generic ) - User select action: Skip 

20:05:57.0408 4336        IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

20:05:57.0408 4336        IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 

20:05:57.0408 4336        x10nets ( UnsignedFile.Multi.Generic ) - skipped by user

20:05:57.0408 4336        x10nets ( UnsignedFile.Multi.Generic ) - User select action: Skip

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Code:



Combofix Logfile:
 

        Code:


        
ComboFix 12-03-29.02 - Josefa 29.03.2012  20:49:08.1.4 - x86

Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.3253.2018 [GMT 2:00]

ausgeführt von:: c:\users\Josefa\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\Services

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-02-28 bis 2012-03-29  ))))))))))))))))))))))))))))))

.

.

2012-03-29 18:53 . 2012-03-29 18:53        --------        d-----w-        c:\users\Josefa\AppData\Local\temp

2012-03-29 18:45 . 2012-03-29 18:45        29904        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{54F4A8B5-DA87-4CCC-B6BA-474F3E57D07F}\MpKsl57b03096.sys

2012-03-29 17:39 . 2012-03-13 18:15        6582328        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{54F4A8B5-DA87-4CCC-B6BA-474F3E57D07F}\mpengine.dll

2012-03-24 18:46 . 2012-03-24 18:46        592824        ----a-w-        c:\program files\Mozilla Firefox\gkmedias.dll

2012-03-24 18:46 . 2012-03-24 18:46        44472        ----a-w-        c:\program files\Mozilla Firefox\mozglue.dll

2012-03-23 21:19 . 2012-03-23 21:19        --------        d-----w-        c:\program files\ESET

2012-03-22 18:49 . 2011-11-19 14:50        3968368        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2012-03-22 18:49 . 2011-11-19 14:50        3913584        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-03-21 18:58 . 2012-02-03 03:54        2343424        ----a-w-        c:\windows\system32\win32k.sys

2012-03-21 18:58 . 2012-02-10 05:38        1077248        ----a-w-        c:\windows\system32\DWrite.dll

2012-03-21 18:30 . 2012-02-17 05:34        919040        ----a-w-        c:\windows\system32\rdpcorets.dll

2012-03-21 18:30 . 2012-02-17 05:34        826880        ----a-w-        c:\windows\system32\rdpcore.dll

2012-03-21 18:30 . 2012-02-17 04:13        24576        ----a-w-        c:\windows\system32\drivers\tdtcp.sys

2012-03-21 18:29 . 2012-02-17 04:14        183808        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-03-21 18:29 . 2012-01-25 05:32        58880        ----a-w-        c:\windows\system32\rdpwsx.dll

2012-03-21 18:29 . 2012-01-25 05:32        129536        ----a-w-        c:\windows\system32\rdpcorekmts.dll

2012-03-21 18:29 . 2012-01-25 05:27        8192        ----a-w-        c:\windows\system32\rdrmemptylst.exe

2012-03-18 07:25 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-03-18 07:25 . 2012-03-21 20:31        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2012-03-18 07:12 . 2012-03-22 04:24        --------        d-----w-        c:\users\Administrator

2012-03-16 01:46 . 2012-03-16 01:46        --------        d-----w-        C:\_OTL

2012-03-15 18:05 . 2012-03-15 18:05        --------        d-----w-        c:\users\Josefa\AppData\Roaming\Malwarebytes

2012-03-15 18:05 . 2012-03-15 18:05        --------        d-----w-        c:\programdata\Malwarebytes

2012-03-03 16:18 . 2012-03-03 16:18        --------        d-----w-        c:\users\Josefa\AppData\Roaming\Zoner

2012-03-03 16:18 . 2012-03-03 16:18        --------        d-----w-        c:\users\Josefa\AppData\Local\Zoner

2012-03-03 16:18 . 2012-03-03 16:18        --------        d-----w-        c:\programdata\Zoner

2012-03-03 16:17 . 2012-03-03 16:17        --------        d-----w-        c:\program files\Zoner

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-03-13 18:15 . 2011-02-19 11:02        6582328        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-02-28 20:39 . 2012-01-14 00:52        2300696        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll

2012-02-28 20:39 . 2012-01-14 00:52        42776        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll

2012-02-28 20:39 . 2012-01-04 21:55        1236816        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2012-02-11 14:07 . 2012-02-11 14:07        713784        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C29FAD29-96F0-4CDF-B4F7-026F8E62CBAB}\gapaengine.dll

2012-02-09 10:55 . 2012-02-09 10:55        57344        ----a-r-        c:\users\Josefa\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe

2012-02-09 10:54 . 2012-02-09 10:54        106496        ----a-w-        c:\windows\system32\ATL71.DLL

2012-01-31 12:44 . 2011-02-19 10:35        237072        ------w-        c:\windows\system32\MpSigStub.exe

2012-01-25 10:28 . 2012-01-04 21:55        2300696        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll

2012-01-25 10:28 . 2012-01-04 21:55        42776        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll

2012-01-25 10:27 . 2012-01-14 00:52        1236816        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll

2012-01-04 19:51 . 2011-08-12 09:46        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-01-04 08:58 . 2012-02-15 15:10        442880        ----a-w-        c:\windows\system32\ntshrui.dll

2012-03-24 18:46 . 2011-05-05 16:13        97208        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12        94208        ----a-w-        c:\users\Josefa\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12        94208        ----a-w-        c:\users\Josefa\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12        94208        ----a-w-        c:\users\Josefa\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]

"Facebook Update"="c:\users\Josefa\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2011-09-29 137536]

"Akamai NetSession Interface"="c:\users\Josefa\AppData\Local\Akamai\netsession_win.exe" [2012-03-13 3331872]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-03 284696]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-12-20 9726568]

"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RtHDVBg.exe" [2010-12-20 1493608]

"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2010-06-21 436264]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-12-20 1594664]

"NUSB3MON"="c:\program files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-12-20 113288]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]

"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 137752]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 171032]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 172568]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"PDFPrint"="e:\program files\PDF24\pdf24.exe" [2011-07-07 216064]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

"Nikon Message Center 2"="c:\program files\Nikon\Nikon Message Center 2\NkMC2.exe" [2010-05-25 619008]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]

.

c:\users\Josefa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Josefa\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-2-15 24246216]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\System32\nvinit.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotkeyApp]

2009-12-14 10:25        200704        ----a-w-        c:\program files\Launch Manager\HotkeyApp.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LMgrVolOSD]

2009-12-11 14:18        348960        ----a-w-        c:\program files\Launch Manager\OSD.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-11-29 16:38        421888        ----a-w-        c:\program files\QuickTime\QTTask.exe

.

R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2010-10-27 1620584]

R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2012-02-15 158856]

R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2010-02-22 9216]

R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]

R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-12-20 193056]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]

R3 vpcuxd;USB-Virtualisierungsstubdienst;c:\windows\system32\DRIVERS\vpcuxd.sys [2010-11-20 12800]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2011-02-19 1343400]

R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 17920]

S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2010-12-20 19656]

S1 MpKsl57b03096;MpKsl57b03096;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{54F4A8B5-DA87-4CCC-B6BA-474F3E57D07F}\MpKsl57b03096.sys [2012-03-29 29904]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-03 13336]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-27 236136]

S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-20 2320920]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2010-12-20 67624]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-10 20464]

S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-12-20 61824]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-12-20 141568]

S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2010-04-01 1009184]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]

S3 WisLMSvc;WisLMSvc;c:\program files\Launch Manager\WisLMSvc.exe [2009-10-22 118560]

S3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2009-05-13 13720]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - MPKSL57B03096

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Akamai        REG_MULTI_SZ           Akamai

.

Inhalt des "geplante Tasks" Ordners

.

2012-03-29 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000Core.job

- c:\users\Josefa\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-29 16:03]

.

2012-03-29 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000UA.job

- c:\users\Josefa\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-29 16:03]

.

.

------- Zusätzlicher Suchlauf -------

.

uInternet Settings,ProxyOverride = <local>

IE: An OneNote s&enden - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105

IE: Free YouTube to MP3 Converter - c:\users\Josefa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000

TCP: DhcpNameServer = 10.158.0.1

TCP: Interfaces\{077ED5A6-0BB6-4BCC-A1B2-0AE4632AF9B1}: NameServer = 194.48.124.202 194.48.124.200

TCP: Interfaces\{94AC04BF-4F2A-4D16-82A5-DCECFEBA9989}: DhcpNameServer = 193.170.110.64

TCP: Interfaces\{94AC04BF-4F2A-4D16-82A5-DCECFEBA9989}\4656661657C647: DhcpNameServer = 192.168.1.2

TCP: Interfaces\{94AC04BF-4F2A-4D16-82A5-DCECFEBA9989}\A4F637566616: DhcpNameServer = 213.153.32.129 213.153.32.1

FF - ProfilePath - c:\users\Josefa\AppData\Roaming\Mozilla\Firefox\Profiles\2t5b1ba2.default\

FF - prefs.js: browser.search.selectedEngine - Google

.

.

------- Dateityp-Verknüpfung -------

.

.scr=AutoCADScriptFile

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM-Run-SearchSettings - c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe

MSConfigStartUp-LMgrOSD - c:\program files\Launch Manager\OSDCtrl.exe

MSConfigStartUp-SearchSettings - c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe

AddRemove-toolplugin - c:\users\Josefa\AppData\Local\Temp\WZSE0.TMP\setup.exe

.

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]

"ServiceDll"="c:\program files\common files\akamai/netsession_win_6c825ce.dll"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DbgagD\1*]

"value"="?\0b\06\13\0d\00\02g"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2012-03-29  20:54:47

ComboFix-quarantined-files.txt  2012-03-29 18:54

.

Vor Suchlauf: 11 Verzeichnis(se), 40.429.539.328 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 40.361.558.016 Bytes frei

.

- - End Of File - - D16775A9B0A9C2EAD400ED58FC9C976E

 
--- --- ---

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

gmer:

Code:



GMER Logfile:
 

        Code:


        
GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2012-03-30 00:43:12

Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AJ1

Running: 1g1ktdkg.exe; Driver: C:\Users\Josefa\AppData\Local\Temp\ugdiipog.sys
 
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!ZwSaveKey + 13C1            82E883D9 1 Byte  [06]

.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2   82EC1D52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0  Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
 

Device          \Driver\ACPI_HAL \Device\00000050        halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
 

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1   fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2   fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3   fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
 

---- EOF - GMER 1.0.15 ----

 
--- --- ---

Osam:

Code:



OSAM Logfile:
 

        Code:


        
Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 00:55:19 on 30.03.2012
 

OS: Windows 7 Ultimate Edition Service Pack 1 (Build 7601), 32-bit

Default Browser: Mozilla Corporation Firefox 11.0
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000Core.job" - "Facebook Inc." - C:\Users\Josefa\AppData\Local\Facebook\Update\FacebookUpdate.exe

"FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000UA.job" - "Facebook Inc." - C:\Users\Josefa\AppData\Local\Facebook\Update\FacebookUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl

"odbccp32.cpl" - "Microsoft Corporation" - C:\Windows\system32\odbccp32.cpl

"plotman.cpl" - "Autodesk, Inc." - C:\Windows\system32\plotman.cpl

"styleman.cpl" - "Autodesk, Inc." - C:\Windows\system32\styleman.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\MLCFG32.CPL

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@%SystemRoot%\system32\drivers\tsusbhub.sys,-1" (tsusbhub) - ? - C:\Windows\System32\drivers\tsusbhub.sys  (File not found)

"catchme" (catchme) - ? - C:\Users\Josefa\AppData\Local\Temp\catchme.sys  (File not found)

"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys

"Synth3dVsc" (Synth3dVsc) - ? - C:\Windows\System32\drivers\synth3dvsc.sys  (File not found)

"VGPU" (VGPU) - ? - C:\Windows\System32\drivers\rdvgkmd.sys  (File not found)
 

[Explorer]

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{8A0BC933-7552-42E2-A228-3BE055777227} "AcColumnHandler" - "Autodesk" - C:\Program Files\Common Files\Autodesk Shared\AcShellEx\AcShellExtension.dll

{FC66F851-FFAB-11D1-B226-0000C01A73E9} "Graphisoft Shell Extension 3.0" - "Graphisoft R&D" - C:\Program Files\Graphisoft\ArchiCAD 14\GSShellX32.dll

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{8A0BC933-7552-42E2-A228-3BE055777227} "AcColumnHandler" - "Autodesk" - C:\Program Files\Common Files\Autodesk Shared\AcShellEx\AcShellExtension.dll

{4B392032-A759-43ED-9469-377C80A4472D} "AcDgnImageExtractor" - "Autodesk" - C:\Program Files\Common Files\Autodesk Shared\AcDgnCOM18.dll

{5800AD5B-72C1-477B-9A08-CA112DF06D97} "AcInfoTipHandler" - "Autodesk" - C:\Program Files\Common Files\Autodesk Shared\AcShellEx\AcShellExtension.dll

{36A21736-36C2-4C11-8ACB-D4136F2B57BD} "AcSignIcon" - "Autodesk, Inc." - C:\Windows\system32\AcSignIcon.dll

{AC1DB655-4F9A-4c39-8AD2-A65324A4C446} "ACTHUMBNAIL" - "Autodesk, Inc." - C:\Program Files\Common Files\Autodesk Shared\Thumbnail\AcThumbnail16.dll

{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D} "Arbeitsbereiche" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\VISSHE.DLL

{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll

{27887764-0D0A-4C3C-B0C6-91A332FFF6A7} "DWFVShellExt Class" - "Autodesk, Inc." - C:\Program Files\Common Files\Autodesk Shared\DWF Common\DWF_VShell.dll

{7CCA70DB-DE7A-4FB7-9B2B-52E2335A3B5A} "Enterprise-Projekte" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL

{09A47860-11B0-4DA5-AFA5-26D86198A780} "EPP" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\shellext.dll

{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\VISSHE.DLL

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll

{0875DCB6-C686-4243-9432-ADCCF0B9F2D7} "Microsoft OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL

{00020D75-0000-0000-C000-000000000046} "Microsoft Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\MLSHEXT.DLL

{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C} "NvAppShExt Class" - "NVIDIA Corporation" - C:\Windows\system32\nv3dappshext.dll

{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll

{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll

{E97DEC16-A50D-49bb-AE24-CF682282E08D} "OpenGLShExt Class" - "NVIDIA Corporation" - C:\Windows\system32\nv3dappshext.dll

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll

{E0D79304-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll

{E0D79305-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll

{E0D79306-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll

{E0D79307-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{4871A87A-BFDD-4106-8153-FFDE2BAC2967} "DLM Control" - "Akamai Technologies, Inc." - C:\Windows\DOWNLO~1\DOWNLO~1.OCX / hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash10m.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

{67DABFBF-D0AB-41FA-9C46-CC0F21721616} "{67DABFBF-D0AB-41FA-9C46-CC0F21721616}" - ? -   (File not found | COM-object registry key not found) / hxxp://download.divx.com/player/DivXBrowserPlugin.cab

{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -   (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

{FFFDC614-B694-4AE6-AB38-5D6374584B52} "Verknüpfte &OneNote-Notizen" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL

{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Browser Helper" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Josefa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"Dropbox.lnk" - "Dropbox, Inc." - C:\Users\Josefa\AppData\Roaming\Dropbox\bin\Dropbox.exe  (Shortcut exists | File exists)

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"Akamai NetSession Interface" - "Akamai Technologies, Inc" - "C:\Users\Josefa\AppData\Local\Akamai\netsession_win.exe"

"Facebook Update" - "Facebook Inc." - "C:\Users\Josefa\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"BCSSync" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices

"IAStorIcon" - "Intel Corporation" - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

"MSC" - "Microsoft Corporation" - "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

"Nikon Message Center 2" - "Nikon Corporation" - C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe -s

"NUSB3MON" - "Renesas Electronics Corporation" - "C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"

"PDFPrint" - "Geek Software GmbH" - E:\Program Files\PDF24\pdf24.exe

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

"Wbutton" - "Wistron Corp." - "C:\Program Files\Launch Manager\Wbutton.exe"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"PDF-XChange4" - "Tracker Software Products Ltd." - C:\Windows\system32\pxc40pm.dll

"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)

"PrintingScout Language Monitor for Xerox Phaser 6140 XPS" - "Xerox Co., Ltd." - C:\Windows\system32\XRMSNL00.DLL
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@C:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243" (NisSrv) - "Microsoft Corporation" - C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

"Akamai NetSession Interface" (Akamai) - ? - c:\program files\common files\akamai\netsession_win_6c825ce.dll  (File found, but it contains no detailed information)

"Application Updater" (Application Updater) - ? - "C:\Program Files\Application Updater\ApplicationUpdater.exe"  (File not found)

"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe

"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Acresso Software Inc." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

"Intel(R) Management & Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

"Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

"Intel(R) Rapid Storage Technology" (IAStorDataMgrSvc) - "Intel Corporation" - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Antimalware Service" (MsMpSvc) - "Microsoft Corporation" - C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

"Microsoft SharePoint Workspace Audit Service" (Microsoft SharePoint Workspace Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\GROOVE.EXE

"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe

"NVIDIA Stereoscopic 3D Driver Service" (Stereo Service) - "NVIDIA Corporation" - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

"NVIDIA Update Service Daemon" (nvUpdatusService) - "NVIDIA Corporation" - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files\Skype\Updater\Updater.exe

"WisLMSvc" (WisLMSvc) - "Wistron Corp." - C:\Program Files\Launch Manager\WisLMSvc.exe

"X10 Device Network Service" (x10nets) - "X10" - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
 

===[ Logfile end ]=========================================[ Logfile end ]===

 
--- --- ---
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Wo ist das Log von aswMBR?

habs 2 mal probiert und is immer wieder abgestürzt... werde es heute naqchmittag nochmal versuchen...

Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

habe das jetzt über den administatoraccount gemacht

Code:



aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-03-30 20:12:41

-----------------------------

20:12:41.766    OS Version: Windows 6.1.7601 Service Pack 1

20:12:41.766    Number of processors: 4 586 0x2505

20:12:41.766    ComputerName: JR_NOTEBOOK  UserName: 

20:12:42.296    Initialize success

20:26:36.831    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

20:26:36.847    Disk 0 Vendor: SAMSUNG_ 2AJ1 Size: 610480MB BusType: 3

20:26:37.221    Disk 0 MBR read successfully

20:26:37.221    Disk 0 MBR scan

20:26:37.221    Disk 0 Windows 7 default MBR code

20:26:37.237    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048

20:26:37.253    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS        99900 MB offset 206848

20:26:37.268    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       510477 MB offset 204802048

20:26:37.299    Disk 0 scanning sectors +1250258944

20:26:37.377    Disk 0 scanning C:\Windows\system32\drivers

20:26:45.957    Service scanning

20:26:52.104    Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32

20:27:00.653    Modules scanning

20:27:09.155    Disk 0 trace - called modules:

20:27:09.669    ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys halmacpi.dll 

20:27:09.685    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87fa4030]

20:27:09.685    3 CLASSPNP.SYS[8c19359e] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x863fc028]

20:27:09.701    Scan finished successfully

20:27:53.084    Disk 0 MBR has been saved successfully to "C:\MBR.dat"

20:27:53.147    The log file has been saved successfully to "C:\aswMBR.txt"

nach deiner anweisung auf (none) umgeshclaten... dnan gings... :)

Code:



aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-03-30 20:39:23

-----------------------------

20:39:23.468    OS Version: Windows 6.1.7601 Service Pack 1

20:39:23.468    Number of processors: 4 586 0x2505

20:39:23.468    ComputerName: JR_NOTEBOOK  UserName: Josefa

20:39:23.873    Initialize success

20:39:27.336    AVAST engine defs: 12032901

20:39:32.048    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

20:39:32.048    Disk 0 Vendor: SAMSUNG_ 2AJ1 Size: 610480MB BusType: 3

20:39:32.110    Disk 0 MBR read successfully

20:39:32.110    Disk 0 MBR scan

20:39:32.110    Disk 0 Windows 7 default MBR code

20:39:32.141    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048

20:39:32.157    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS        99900 MB offset 206848

20:39:32.172    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       510477 MB offset 204802048

20:39:32.204    Disk 0 scanning sectors +1250258944

20:39:32.344    Disk 0 scanning C:\Windows\system32\drivers

20:39:56.805    Service scanning

20:40:07.460    Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32

20:40:20.907    Modules scanning

20:40:36.148    Disk 0 trace - called modules:

20:40:36.179    ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys halmacpi.dll 

20:40:36.179    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87fa4030]

20:40:36.195    3 CLASSPNP.SYS[8c19359e] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x863fc028]

20:40:36.195    Scan finished successfully

20:40:47.177    Disk 0 MBR has been saved successfully to "C:\Users\Josefa\Desktop\MBR.dat"

20:40:47.177    The log file has been saved successfully to "C:\Users\Josefa\Desktop\aswMBR.txt"

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

teil 1: scan mit malwarebytes... teil 2 folgt noch...

Code:



Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.03.31.03
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 8.0.7601.17514

Josefa :: JR_NOTEBOOK [Administrator]
 

Schutz: Aktiviert
 

31.03.2012 08:21:01

mbam-log-2012-03-31 (08-21-01).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 423170

Laufzeit: 1 Stunde(n), 5 Minute(n), 41 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)