Trojaner-Board - Computer mit TR/Ransom.EJ.3 infiziert

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Computer mit TR/Ransom.EJ.3 infiziert (https://www.trojaner-board.de/112935-computer-tr-ransom-ej-3-infiziert.html)

Computer mit TR/Ransom.EJ.3 infiziert

Hallo,

der Computer meines Vaters wurde von TR/Ransom.EJ.3 befallen. Er zeigte die dafür üblichen Symptome: Der Bildschirminhalt wird abgedunkelt und ein Fenster öffnet sich, dass zu einer Zahlung von 50 Euro aufruft.

Ich habe mit defogger Emulator-Treiber deaktiviert und den Computer neugestartet.

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 11:05 on 02/04/2012 (***)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...

Unable to read sptd.sys

SPTD -> Disabled (Service running -> reboot required)
 
 

-=E.O.F=-

Hier die Logdateien von DDS:

DDS.txt
[CODE].DDS Logfile:

Code:

DDS (Ver_2011-08-26.01) - NTFSx86 

Internet Explorer: 9.0.8112.16421  BrowserJavaVersion: 10.3.1

Run by *** at 11:12:15 on 2012-04-02

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2046.991 [GMT 2:00]

.

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Program Files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe

C:\Windows\system32\svchost.exe -k HsfXAudioService

c:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Windows\system32\lxbscoms.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

C:\Windows\system32\IoctlSvc.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\CyberLink\Shared Files\RichVideo.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\DRIVERS\xaudio.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\iashost.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Power Manager\PM.exe

C:\Program Files\HomeCinema\Power2Go\CLMLSvc.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\DSL-Manager\DslMgr.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\DSL-Manager\DslMgrSvc.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\Explorer.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\Macromed\Flash\FlashUtil32_11_2_202_228_ActiveX.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\conime.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

mURLSearchHooks: SearchElf 1.2 Toolbar: {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - c:\program files\searchelf_1.2\prxtbSea0.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll

BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\oracle\javafx 2.0 runtime\bin\jp2ssv.dll

BHO: SearchElf 1.2 Toolbar: {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - c:\program files\searchelf_1.2\prxtbSea0.dll

TB: SearchElf 1.2 Toolbar: {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - c:\program files\searchelf_1.2\prxtbSea0.dll

TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll

TB: {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - No File

uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe

uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"

mRun: [RtHDVCpl] RtHDVCpl.exe

mRun: [PowerManager] c:\program files\power manager\PM.exe

mRun: [CLMLServer] "c:\program files\homecinema\power2go\CLMLSvc.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

StartupFolder: c:\users\***\appdata\roaming\micros~1\windows\startm~1\programs\startup\dsl-ma~1.lnk - c:\program files\dsl-manager\DslMgr.exe

mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab

DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 192.168.0.1

TCP: Interfaces\{8660B1CA-198A-4D32-A3BD-4630E08FAD64} : DhcpNameServer = 192.168.0.1

TCP: Interfaces\{AD197E5A-BCDB-411A-84B2-A2144B7340F9} : DhcpNameServer = 192.168.0.1

.

============= SERVICES / DRIVERS ===============

.

R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2012-4-2 36000]

R1 DslMNLwf;DSL-Manager NDIS LightWeight Filter;c:\windows\system32\drivers\dslmnlwf.sys [2009-7-17 16448]

R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-1-3 63928]

R2 AntiVirSchedulerService;Avira Planer;c:\program files\avira\antivir desktop\sched.exe [2012-4-2 86224]

R2 AntiVirService;Avira Echtzeit Scanner;c:\program files\avira\antivir desktop\avguard.exe [2012-4-2 110032]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-4-2 74640]

R2 FontCache;Windows-Dienst für Schriftartencache;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-5-17 21504]

R2 FSCLBaseUpdaterService;FSCLBaseUpdaterService;c:\program files\fujitsu siemens computers\fsclounge\fscwbaseupdaterservice\2\FSCWBaseUpdaterService.exe [2007-6-4 65536]

R2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe -k HsfXAudioService [2008-5-17 21504]

R3 smscirrx;SMSC CIR Receive;c:\windows\system32\drivers\smscirrx.sys [2008-1-17 40448]

R3 TDslMgrService;DSL-Manager;c:\program files\dsl-manager\DslMgrSvc.exe [2009-7-17 307200]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-2 253600]

S3 dsltestSp5;dsltestSp5 NDIS Protocol Driver;c:\windows\system32\drivers\DslTestSp5.sys [2009-7-17 26816]

S3 TridVid;Video Grabber;c:\windows\system32\drivers\tridvid.sys [2008-12-23 168704]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

S3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\drivers\WSDPrint.sys [2008-5-17 16896]

S3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\drivers\WSDScan.sys [2009-10-18 19968]

.

=============== Created Last 30 ================

.

2012-04-02 09:09:44        418464        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2012-04-02 08:23:09        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-04-02 07:23:45        --------        d-----w-        c:\program files\Microsoft WSE

2012-04-02 07:22:34        --------        d-----w-        c:\program files\Netzmanager

2012-04-02 07:21:46        --------        d-----w-        c:\users\***\appdata\local\PackageAware

2012-04-02 06:53:14        --------        d-----w-        c:\users\***\appdata\roaming\Avira

2012-04-02 06:50:57        36000        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2012-04-02 06:50:56        74640        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2012-04-02 06:50:55        --------        d-----w-        c:\programdata\Avira

2012-04-02 06:50:55        --------        d-----w-        c:\program files\Avira

2012-04-01 19:21:42        --------        d-----w-        c:\program files\iPod

2012-04-01 19:21:39        --------        d-----w-        c:\program files\iTunes

2012-04-01 18:10:56        2044416        ----a-w-        c:\windows\system32\win32k.sys

2012-04-01 18:10:47        613376        ----a-w-        c:\windows\system32\rdpencom.dll

2012-04-01 18:10:47        180736        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-04-01 18:10:45        2409784        ----a-w-        c:\program files\windows mail\OESpamFilter.dat

2012-04-01 18:10:43        683008        ----a-w-        c:\windows\system32\d2d1.dll

2012-04-01 18:10:43        219648        ----a-w-        c:\windows\system32\d3d10_1core.dll

2012-04-01 18:10:43        160768        ----a-w-        c:\windows\system32\d3d10_1.dll

2012-04-01 18:10:43        1172480        ----a-w-        c:\windows\system32\d3d10warp.dll

2012-04-01 18:10:43        1068544        ----a-w-        c:\windows\system32\DWrite.dll

2012-04-01 14:44:09        --------        d-----w-        c:\users\***\appdata\roaming\Malwarebytes

2012-04-01 14:43:59        --------        d-----w-        c:\programdata\Malwarebytes

2012-04-01 14:43:57        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2012-03-31 19:53:02        --------        d-----w-        c:\program files\common files\Java(1)

2012-03-25 16:34:01        --------        d-----w-        c:\programdata\Avira(91)

.

==================== Find3M  ====================

.

2012-04-02 09:09:44        70304        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-01-10 11:57:14        637848        ----a-w-        c:\windows\system32\npdeployJava1.dll

2012-01-10 11:57:10        567696        ----a-w-        c:\windows\system32\deployJava1.dll

.

============= FINISH: 11:14:35,54 ===============

--- --- ---

Attach.txt

Code:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft® Windows Vista™ Home Premium 

Boot Device: \Device\HarddiskVolume2

Install Date: 09.02.2008 12:27:00

System Uptime: 02.04.2012 11:06:53 (0 hours ago)

.

Motherboard: FUJITSU SIEMENS |  | XTB71___

Processor: AMD Turion(tm) 64 X2 Mobile Technology TL-56 | Socket A | 1800/133mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 148 GiB total, 82,608 GiB free.

D: is FIXED (NTFS) - 73 GiB total, 33,266 GiB free.

E: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

.

==== Installed Programs ======================

.

Adobe Flash Player 11 ActiveX

Adobe Reader X (10.1.2) - Deutsch

Adobe Shockwave Player 11.5

AeroFly Professional Deluxe (inkl. Add-On 1)

ALPS Touch Pad Driver

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ArcSoft PhotoBase 3

ArcSoft PhotoStudio 5

Audacity 1.3.12 (Unicode)

Avira Free Antivirus

Bison WebCam

Bonjour

CanoScan Toolbox Ver4.1

ChargerMonitor V1.0

Compatibility Pack für 2007 Office System

COMPUTER BILD Windows Wiki 2010

Conduit Engine 

Corel Graphics Suite 11

CorelDRAW Graphics Suite 11

CP2101 USB to UART Bridge Controller Driver Installation

CyberLink PhotoNow!

CyberLink Power2Go

CyberLink PowerDirector

CyberLink PowerProducer

DHTML Editing Component

DivX-Setup

dm-Fotowelt

DruckShop Weihnachten

DSL-Manager

EPSON SX430 Series Printer Uninstall

EZ Vinyl/Tape Converter 4.1 by MixMeister

FFmpeg for Audacity on Windows

FirstSteps Diagnostics

FSCLounge

Future Pinball

Game Booster

glasklar Komplettpaket DVD1

Hardcopy (C:\Program Files\Hardcopy)

HDAUDIO Soft Data Fax Modem with SmartCP

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

InterVideo WinDVD 8

iTunes

Java Auto Updater

Java(TM) 7 Update 3

JavaFX 2.0.3

klickTel OEM 2007

LAME v3.98.3 for Audacity

Lexmark 810 Series

LibreOffice 3.4

MA-VIN

Malwarebytes Anti-Malware Version 1.60.1.1000

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 German Language Pack

Microsoft .NET Framework 1.1 Security Update (KB2656353)

Microsoft .NET Framework 1.1 Security Update (KB979906)

Microsoft .NET Framework 3.5 Language Pack SP1 - deu

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Client Profile DEU Language Pack

Microsoft Application Error Reporting

Microsoft Office PowerPoint Viewer 2007 (German)

Microsoft Silverlight

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

Microsoft Visual J# .NET Redistributable Package 1.1

Microsoft Word 2002

Microsoft Works

Microsoft WSE 3.0 Runtime

MSXML 4.0 SP2 (KB941833)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

neox Sudoku Trainer 1.0

Nero 7 Essentials

neroxml

NVIDIA Display Control Panel

NVIDIA Drivers

NVIDIA ForceWare Network Access Manager

NVIDIA PhysX

Paint.NET v3.20

PhotoScape

Power Manager 2.1.7

PowerDV

QuickTime

Realtek High Definition Audio Driver

SearchElf 1.2 Toolbar

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)

Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)

Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista

System Requirements Lab

T-Online 6.0

T-Online WLAN-Access Finder

Ulead COOL 360 1.0

Ulead Photo Explorer 8.0 SE Basic

Ulead Photo Express 5 SE

Universallexikon 2008

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

VC80CRTRedist - 8.0.50727.4053

vispa

VLC media player 1.0.5

WinSysClean 2008

XMedia Recode 2.2.1.6

XnView 1.74

.

==== End Of File ===========================

Dann noch ein Scan mit Gmer (Tut mir leid, dass der Internet Explorer geöffnet war!):

Code:

GMER 1.0.15.14966 - hxxp://www.gmer.net

Rootkit scan 2012-04-02 11:54:00

Windows 6.0.6002 Service Pack 2
 
 

---- System - GMER 1.0.15 ----
 

SSDT            8A1EE7D6                                                                                             ZwCreateSection

SSDT            8A1EE7E0                                                                                             ZwRequestWaitReplyPort

SSDT            8A1EE7DB                                                                                             ZwSetContextThread

SSDT            8A1EE7E5                                                                                             ZwSetSecurityObject

SSDT            8A1EE7EA                                                                                             ZwSystemDebugControl

SSDT            8A1EE777                                                                                             ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!KeSetEvent + 215                                                                        820AC998 4 Bytes  [D6, E7, 1E, 8A]

.text           ntkrnlpa.exe!KeSetEvent + 539                                                                        820ACCBC 4 Bytes  [E0, E7, 1E, 8A]

.text           ntkrnlpa.exe!KeSetEvent + 56D                                                                        820ACCF0 4 Bytes  [DB, E7, 1E, 8A]

.text           ntkrnlpa.exe!KeSetEvent + 5D1                                                                        820ACD54 4 Bytes  [E5, E7, 1E, 8A]

.text           ntkrnlpa.exe!KeSetEvent + 619                                                                        820ACD9C 4 Bytes  JMP 628A1EE7 

.text           ...                                                                                                  

?               C:\Users\***\AppData\Local\Temp\mbr.sys                                                         Das System kann die angegebene Datei nicht finden. !
 

---- User code sections - GMER 1.0.15 ----
 

.text           C:\Program Files\Internet Explorer\iexplore.exe[832] USER32.dll!EnableWindow                         75E0CD8B 5 Bytes  JMP 68B19A14 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[832] USER32.dll!DialogBoxParamW                      75E310B0 5 Bytes  JMP 68A7170B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[832] USER32.dll!DialogBoxIndirectParamW              75E32EF5 5 Bytes  JMP 68C66336 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[832] USER32.dll!DialogBoxParamA                      75E48152 5 Bytes  JMP 68C662D1 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[832] USER32.dll!DialogBoxIndirectParamA              75E4847D 5 Bytes  JMP 68C6639B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[832] USER32.dll!MessageBoxIndirectA                  75E5D4D9 5 Bytes  JMP 68C66258 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[832] USER32.dll!MessageBoxIndirectW                  75E5D5D3 5 Bytes  JMP 68C661DF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[832] USER32.dll!MessageBoxExA                        75E5D639 5 Bytes  JMP 68C6617B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[832] USER32.dll!MessageBoxExW                        75E5D65D 5 Bytes  JMP 68C66117 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] kernel32.dll!CreateThread                      75B6CB2E 5 Bytes  JMP 68AD7303 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!CreateDialogParamW                  75E072A2 5 Bytes  JMP 68C666A0 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!GetAsyncKeyState                    75E0863C 5 Bytes  JMP 68ABDD8D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!SetWindowsHookExW                   75E087AD 5 Bytes  JMP 68B12194 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!CallNextHookEx                      75E08E3B 5 Bytes  JMP 68B37BAF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!UnhookWindowsHookEx                 75E098DB 5 Bytes  JMP 68B5EB00 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!EnableWindow                        75E0CD8B 5 Bytes  JMP 68B19A14 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!DefWindowProcA                      75E0DB88 7 Bytes  JMP 68AD952D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!CreateWindowExA                     75E0DC2A 5 Bytes  JMP 68AE3363 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!CreateWindowExW                     75E11305 5 Bytes  JMP 68B3FF87 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!GetKeyState                         75E18CB1 5 Bytes  JMP 68ABDC67 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!DefWindowProcW                      75E203B4 7 Bytes  JMP 68B37C12 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!IsDialogMessageW                    75E20745 5 Bytes  JMP 68C66E05 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!CreateDialogParamA                  75E217AA 5 Bytes  JMP 68C66668 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!IsDialogMessage                     75E21847 2 Bytes  JMP 68C66DDD C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!IsDialogMessage + 3                 75E2184A 2 Bytes  [E4, F2] {IN AL, 0xf2}

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!CreateDialogIndirectParamA          75E226F1 5 Bytes  JMP 68C666D8 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!CreateDialogIndirectParamW          75E29A62 5 Bytes  JMP 68C66710 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!SetKeyboardState                    75E30987 5 Bytes  JMP 68C676D1 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!DialogBoxParamW                     75E310B0 5 Bytes  JMP 68A7170B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!DialogBoxIndirectParamW             75E32EF5 5 Bytes  JMP 68C66336 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!SendInput                           75E32F75 5 Bytes  JMP 68C67679 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!EndDialog                           75E3326E 5 Bytes  JMP 68C670B4 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!SetCursorPos                        75E46FB2 5 Bytes  JMP 68C67752 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!DialogBoxParamA                     75E48152 5 Bytes  JMP 68C662D1 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!DialogBoxIndirectParamA             75E4847D 5 Bytes  JMP 68C6639B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!MessageBoxIndirectA                 75E5D4D9 5 Bytes  JMP 68C66258 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!MessageBoxIndirectW                 75E5D5D3 5 Bytes  JMP 68C661DF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!MessageBoxExA                       75E5D639 5 Bytes  JMP 68C6617B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!MessageBoxExW                       75E5D65D 5 Bytes  JMP 68C66117 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!keybd_event                         75E5D972 5 Bytes  JMP 68C67636 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] SHELL32.dll!SHRestricted + D95                 761A89A8 4 Bytes  [CF, 01, C2, 66]

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] SHELL32.dll!SHRestricted + D9D                 761A89B0 8 Bytes  [E0, 61, C1, 66, 79, F7, C1, ...]

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] ole32.dll!OleLoadFromStream                    76F51E80 5 Bytes  JMP 68C66B0F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] kernel32.dll!CreateThread                      75B6CB2E 5 Bytes  JMP 68AD7303 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!CreateDialogParamW                  75E072A2 5 Bytes  JMP 68C666A0 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!GetAsyncKeyState                    75E0863C 5 Bytes  JMP 68ABDD8D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!SetWindowsHookExW                   75E087AD 5 Bytes  JMP 68B12194 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!CallNextHookEx                      75E08E3B 5 Bytes  JMP 68B37BAF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!UnhookWindowsHookEx                 75E098DB 5 Bytes  JMP 68B5EB00 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!EnableWindow                        75E0CD8B 5 Bytes  JMP 68B19A14 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!DefWindowProcA                      75E0DB88 7 Bytes  JMP 68AD952D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!CreateWindowExA                     75E0DC2A 5 Bytes  JMP 68AE3363 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!CreateWindowExW                     75E11305 5 Bytes  JMP 68B3FF87 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!GetKeyState                         75E18CB1 5 Bytes  JMP 68ABDC67 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!DefWindowProcW                      75E203B4 7 Bytes  JMP 68B37C12 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!IsDialogMessageW                    75E20745 5 Bytes  JMP 68C66E05 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!CreateDialogParamA                  75E217AA 5 Bytes  JMP 68C66668 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!IsDialogMessage                     75E21847 2 Bytes  JMP 68C66DDD C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!IsDialogMessage + 3                 75E2184A 2 Bytes  [E4, F2] {IN AL, 0xf2}

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!CreateDialogIndirectParamA          75E226F1 5 Bytes  JMP 68C666D8 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!CreateDialogIndirectParamW          75E29A62 5 Bytes  JMP 68C66710 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!SetKeyboardState                    75E30987 5 Bytes  JMP 68C676D1 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!DialogBoxParamW                     75E310B0 5 Bytes  JMP 68A7170B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!DialogBoxIndirectParamW             75E32EF5 5 Bytes  JMP 68C66336 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!SendInput                           75E32F75 5 Bytes  JMP 68C67679 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!EndDialog                           75E3326E 5 Bytes  JMP 68C670B4 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!SetCursorPos                        75E46FB2 5 Bytes  JMP 68C67752 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!DialogBoxParamA                     75E48152 5 Bytes  JMP 68C662D1 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!DialogBoxIndirectParamA             75E4847D 5 Bytes  JMP 68C6639B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!MessageBoxIndirectA                 75E5D4D9 5 Bytes  JMP 68C66258 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!MessageBoxIndirectW                 75E5D5D3 5 Bytes  JMP 68C661DF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!MessageBoxExA                       75E5D639 5 Bytes  JMP 68C6617B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!MessageBoxExW                       75E5D65D 5 Bytes  JMP 68C66117 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!keybd_event                         75E5D972 5 Bytes  JMP 68C67636 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] SHELL32.dll!SHRestricted + D95                 761A89A8 4 Bytes  [CF, 01, C2, 66]

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] SHELL32.dll!SHRestricted + D9D                 761A89B0 8 Bytes  [E0, 61, C1, 66, 79, F7, C1, ...]

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] ole32.dll!OleLoadFromStream                    76F51E80 5 Bytes  JMP 68C66B0F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
 

---- Devices - GMER 1.0.15 ----
 

Device          \Driver\BTHUSB \Device\00000074                                                                      bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)

Device          \Driver\BTHUSB \Device\00000076                                                                      bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)
 

AttachedDevice  \FileSystem\fastfat \Fat                                                                             fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001060d01269                          

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001060d0161a                          

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                     

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                  0

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew               0x4B 0x7A 0xA4 0xC6 ...

Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001060d01269                              

Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001060d0161a                              

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                         

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                      0

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                   0x4B 0x7A 0xA4 0xC6 ...
 

---- Files - GMER 1.0.15 ----
 

File            C:\Windows\System32\config\systemprofile\AppData\Roaming\Apple Computer\Logs\asl.084709_02Apr12.log  (size mismatch) 5154/0 bytes

File            C:\Windows\System32\config\systemprofile\AppData\Roaming\Apple Computer\Logs\asl.110817_02Apr12.log  (size mismatch) 4720/0 bytes

File            C:\Windows\System32\config\systemprofile\AppData\Roaming\Apple Computer\Logs\asl.211932_01Apr12.log  (size mismatch) 5154/0 bytes

File            C:\Windows\System32\LogFiles\IN1204.log                                                              (size mismatch) 1280/1148 bytes

File            C:\Windows\System32\LogFiles\Scm\SCM.EVM                                                             (size mismatch) 360448/0 bytes

File            C:\Windows\System32\LogFiles\WUDF\WUDFTrace.etl                                                      (size mismatch) 16384/0 bytes

File            C:\Windows\System32\spool\SpoolerETW.etl                                                             (size mismatch) 4096/0 bytes

File            C:\Windows\System32\wfp\wfpdiag.etl                                                                  (size mismatch) 65536/0 bytes

File            C:\Windows\System32\WDI\LogFiles\WdiContextLog.etl.002                                               (size mismatch) 344064/311296 bytes
 

---- EOF - GMER 1.0.15 ----

Beschreibung zu TR/Ransom.EJ.3: hxxp://www.avira.com/de/support-threats-summary/tid/7288/threat/TR.Ransom.EJ.3

Vielen Dank im Vorraus!

Funktioniert noch der abgesicherte Modus mit Netzwerktreibern? Mit Internetverbindung?

Abgesicherter Modus zur Bereinigung

Windows mit F8-Taste beim Start in den abgesicherten Modus bringen.
Starte den Rechner in den abgesicherten Modus mit Netzwerktreibern:

Ja, der abgesicherte Modus mit Netzwerktreibern funktioniert.

na wenn der Modus geht wirst du erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Noch kurz eine Ergänzung: Zuvor wurde eine Systemwiederherstellung ausgeführt, weshalb ich mir nicht sicher bin, ob der Computer noch infiziert ist.

Vor den Prüfungen im abgesicherten Modus wurde bereits mit Avira und MBAM gescannt.

Avira:

Code:



Avira Free Antivirus

Erstellungsdatum der Reportdatei: Montag, 2. April 2012  13:00
 

Es wird nach 3574017 Virenstämmen gesucht.
 

Das Programm läuft als uneingeschränkte Vollversion.

Online-Dienste stehen zur Verfügung.
 

Lizenznehmer   : Avira AntiVir Personal - Free Antivirus

Seriennummer   : 0000149996-ADJIE-0000001

Plattform      : Windows Vista

Windowsversion : (Service Pack 2)  [6.0.6002]

Boot Modus     : Normal gebootet

Benutzername   : ***

Computername   : ALLE-PC
 

Versionsinformationen:

BUILD.DAT      : 12.0.0.898     41963 Bytes  31.01.2012 13:51:00

AVSCAN.EXE     : 12.1.0.20     492496 Bytes  31.01.2012 06:55:52

AVSCAN.DLL     : 12.1.0.18      65744 Bytes  31.01.2012 06:56:29

LUKE.DLL       : 12.1.0.19      68304 Bytes  31.01.2012 06:56:01

AVSCPLR.DLL    : 12.1.0.22     100048 Bytes  31.01.2012 06:55:52

AVREG.DLL      : 12.1.0.31     228104 Bytes  02.04.2012 10:50:16

VBASE000.VDF   : 7.10.0.0    19875328 Bytes  06.11.2009 09:49:21

VBASE001.VDF   : 7.11.0.0    13342208 Bytes  14.12.2010 06:56:15

VBASE002.VDF   : 7.11.19.170 14374912 Bytes  20.12.2011 06:56:21

VBASE003.VDF   : 7.11.21.238  4472832 Bytes  01.02.2012 06:53:24

VBASE004.VDF   : 7.11.26.44   4329472 Bytes  28.03.2012 06:53:50

VBASE005.VDF   : 7.11.26.45      2048 Bytes  28.03.2012 06:53:50

VBASE006.VDF   : 7.11.26.46      2048 Bytes  28.03.2012 06:53:50

VBASE007.VDF   : 7.11.26.47      2048 Bytes  28.03.2012 06:53:50

VBASE008.VDF   : 7.11.26.48      2048 Bytes  28.03.2012 06:53:50

VBASE009.VDF   : 7.11.26.49      2048 Bytes  28.03.2012 06:53:51

VBASE010.VDF   : 7.11.26.50      2048 Bytes  28.03.2012 06:53:51

VBASE011.VDF   : 7.11.26.51      2048 Bytes  28.03.2012 06:53:51

VBASE012.VDF   : 7.11.26.52      2048 Bytes  28.03.2012 06:53:51

VBASE013.VDF   : 7.11.26.53      2048 Bytes  28.03.2012 06:53:51

VBASE014.VDF   : 7.11.26.107   221696 Bytes  30.03.2012 06:53:53

VBASE015.VDF   : 7.11.26.108     2048 Bytes  30.03.2012 06:53:53

VBASE016.VDF   : 7.11.26.109     2048 Bytes  30.03.2012 06:53:53

VBASE017.VDF   : 7.11.26.110     2048 Bytes  30.03.2012 06:53:53

VBASE018.VDF   : 7.11.26.111     2048 Bytes  30.03.2012 06:53:53

VBASE019.VDF   : 7.11.26.112     2048 Bytes  30.03.2012 06:53:53

VBASE020.VDF   : 7.11.26.113     2048 Bytes  30.03.2012 06:53:53

VBASE021.VDF   : 7.11.26.114     2048 Bytes  30.03.2012 06:53:53

VBASE022.VDF   : 7.11.26.115     2048 Bytes  30.03.2012 06:53:53

VBASE023.VDF   : 7.11.26.116     2048 Bytes  30.03.2012 06:53:53

VBASE024.VDF   : 7.11.26.117     2048 Bytes  30.03.2012 06:53:54

VBASE025.VDF   : 7.11.26.118     2048 Bytes  30.03.2012 06:53:54

VBASE026.VDF   : 7.11.26.119     2048 Bytes  30.03.2012 06:53:54

VBASE027.VDF   : 7.11.26.120     2048 Bytes  30.03.2012 06:53:54

VBASE028.VDF   : 7.11.26.121     2048 Bytes  30.03.2012 06:53:54

VBASE029.VDF   : 7.11.26.122     2048 Bytes  30.03.2012 06:53:54

VBASE030.VDF   : 7.11.26.123     2048 Bytes  30.03.2012 06:53:54

VBASE031.VDF   : 7.11.26.152   218624 Bytes  02.04.2012 10:50:16

Engineversion  : 8.2.10.34 

AEVDF.DLL      : 8.1.2.2       106868 Bytes  31.01.2012 06:55:38

AESCRIPT.DLL   : 8.1.4.15      442747 Bytes  02.04.2012 06:54:15

AESCN.DLL      : 8.1.8.2       131444 Bytes  02.04.2012 06:54:14

AESBX.DLL      : 8.2.5.5       606579 Bytes  02.04.2012 06:54:16

AERDL.DLL      : 8.1.9.15      639348 Bytes  31.01.2012 06:55:37

AEPACK.DLL     : 8.2.16.9      807287 Bytes  02.04.2012 06:54:14

AEOFFICE.DLL   : 8.1.2.25      201084 Bytes  31.01.2012 06:55:36

AEHEUR.DLL     : 8.1.4.10     4551031 Bytes  02.04.2012 06:54:11

AEHELP.DLL     : 8.1.19.0      254327 Bytes  02.04.2012 06:53:59

AEGEN.DLL      : 8.1.5.23      409973 Bytes  02.04.2012 06:53:59

AEEXP.DLL      : 8.1.0.27       82293 Bytes  02.04.2012 06:54:16

AEEMU.DLL      : 8.1.3.0       393589 Bytes  31.01.2012 06:55:34

AECORE.DLL     : 8.1.25.6      201078 Bytes  02.04.2012 06:53:58

AEBB.DLL       : 8.1.1.0        53618 Bytes  31.01.2012 06:55:33

AVWINLL.DLL    : 12.1.0.17      27344 Bytes  31.01.2012 06:55:54

AVPREF.DLL     : 12.1.0.17      51920 Bytes  31.01.2012 06:55:51

AVREP.DLL      : 12.1.0.17     179408 Bytes  31.01.2012 06:55:51

AVARKT.DLL     : 12.1.0.23     209360 Bytes  31.01.2012 06:55:46

AVEVTLOG.DLL   : 12.1.0.17     169168 Bytes  31.01.2012 06:55:47

SQLITE3.DLL    : 3.7.0.0       398288 Bytes  31.01.2012 06:56:07

AVSMTP.DLL     : 12.1.0.17      62928 Bytes  31.01.2012 06:55:52

NETNT.DLL      : 12.1.0.17      17104 Bytes  31.01.2012 06:56:02

RCIMAGE.DLL    : 12.1.0.17    4447952 Bytes  31.01.2012 06:56:32

RCTEXT.DLL     : 12.1.0.16      98512 Bytes  31.01.2012 06:56:32
 

Konfiguration für den aktuellen Suchlauf:

Job Name..............................: Lokale Laufwerke

Konfigurationsdatei...................: C:\Program Files\Avira\AntiVir Desktop\alldrives.avp

Protokollierung.......................: standard

Primäre Aktion........................: reparieren

Sekundäre Aktion......................: löschen

Durchsuche Masterbootsektoren.........: ein

Durchsuche Bootsektoren...............: ein

Bootsektoren..........................: C:, D:, E:, 

Durchsuche aktive Programme...........: ein

Durchsuche Registrierung..............: ein

Suche nach Rootkits...................: ein

Integritätsprüfung von Systemdateien..: ein

Optimierter Suchlauf..................: ein

Datei Suchmodus.......................: Alle Dateien

Durchsuche Archive....................: ein

Rekursionstiefe einschränken..........: aus

Archiv Smart Extensions...............: ein

Abweichende Archivtypen...............: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox, +ISO 9660, +Windows Imaging File (WIM), 

Makrovirenheuristik...................: ein

Dateiheuristik........................: vollständig

Abweichende Gefahrenkategorien........: +JOKE,+PFS,+SPR,
 

Beginn des Suchlaufs: Montag, 2. April 2012  13:00
 

Der Suchlauf über die Masterbootsektoren wird begonnen:

Masterbootsektor HD0

    [INFO]      Es wurde kein Virus gefunden!
 

Der Suchlauf über die Bootsektoren wird begonnen:

Bootsektor 'C:\'

    [INFO]      Es wurde kein Virus gefunden!

Bootsektor 'D:\'

    [INFO]      Es wurde kein Virus gefunden!
 

Der Suchlauf nach versteckten Objekten wird begonnen.
 

Der Suchlauf über gestartete Prozesse wird begonnen:

Durchsuche Prozess 'TrustedInstaller.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'vssvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'iPodService.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'NMIndexingService.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wmpnetwk.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wmpnscfg.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'DslMgrSvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ehmsas.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wmiprvse.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'unsecapp.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'DslMgr.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ehtray.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'iTunesHelper.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'CLMLSvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'PM.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'RtHDVCpl.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'Explorer.EXE' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'Dwm.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'iashost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'xaudio.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'TestHandler.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'RichVideo.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'IoctlSvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SMSvcHost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'mdm.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'lxbscoms.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'iviRegMgr.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'FSCWBaseUpdaterService.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'mDNSResponder.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'AppleMobileDeviceService.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'armsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'spoolsv.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'nvvsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SLsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'nvvsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avshadow.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'winlogon.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'lsm.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'lsass.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'services.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wininit.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'smss.exe' - '1' Modul(e) wurden durchsucht
 

Untersuchung der Systemdateien wird begonnen:

Signiert -> 'C:\Windows\system32\svchost.exe'

Signiert -> 'C:\Windows\system32\winlogon.exe'

Signiert -> 'C:\Windows\explorer.exe'

Signiert -> 'C:\Windows\system32\smss.exe'

Signiert -> 'C:\Windows\system32\wininet.DLL'

Signiert -> 'C:\Windows\system32\wsock32.DLL'

Signiert -> 'C:\Windows\system32\ws2_32.DLL'

Signiert -> 'C:\Windows\system32\services.exe'

Signiert -> 'C:\Windows\system32\lsass.exe'

Signiert -> 'C:\Windows\system32\csrss.exe'

Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'

Signiert -> 'C:\Windows\system32\spoolsv.exe'

Signiert -> 'C:\Windows\system32\alg.exe'

Signiert -> 'C:\Windows\system32\wuauclt.exe'

Signiert -> 'C:\Windows\system32\advapi32.DLL'

Signiert -> 'C:\Windows\system32\user32.DLL'

Signiert -> 'C:\Windows\system32\gdi32.DLL'

Signiert -> 'C:\Windows\system32\kernel32.DLL'

Signiert -> 'C:\Windows\system32\ntdll.DLL'

Signiert -> 'C:\Windows\system32\ntoskrnl.exe'

Signiert -> 'C:\Windows\system32\ctfmon.exe'

Die Systemdateien wurden durchsucht ('21' Dateien)
 

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:

Die Registry wurde durchsucht ( '1391' Dateien ).
 
 

Der Suchlauf über die ausgewählten Dateien wird begonnen:
 

Beginne mit der Suche in 'C:\' <SYSTEM>

Beginne mit der Suche in 'D:\' <DATA>

Beginne mit der Suche in 'E:\'

Der zu durchsuchende Pfad E:\ konnte nicht geöffnet werden!

Systemfehler [21]: Das Gerät ist nicht bereit.
 
 

Ende des Suchlaufs: Montag, 2. April 2012  14:48

Benötigte Zeit:  1:47:22 Stunde(n)
 

Der Suchlauf wurde vollständig durchgeführt.
 

  31136 Verzeichnisse wurden überprüft

 710028 Dateien wurden geprüft

      0 Viren bzw. unerwünschte Programme wurden gefunden

      0 Dateien wurden als verdächtig eingestuft

      0 Dateien wurden gelöscht

      0 Viren bzw. unerwünschte Programme wurden repariert

      0 Dateien wurden in die Quarantäne verschoben

      0 Dateien wurden umbenannt

      0 Dateien konnten nicht durchsucht werden

 710028 Dateien ohne Befall

  24763 Archive wurden durchsucht

      0 Warnungen

      0 Hinweise

 114892 Objekte wurden beim Rootkitscan durchsucht

      0 Versteckte Objekte wurden gefunden

MBAM:

Code:

Malwarebytes Anti-Malware 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.04.02.03
 

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

*** :: ALLE-PC [Administrator]
 

02.04.2012 14:55:17

mbam-log-2012-04-02 (14-55-17).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 424431

Laufzeit: 3 Stunde(n), 1 Minute(n), 47 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Dann wurde im abgesicherten Modus gescannt:

MBAM:

Code:

Malwarebytes Anti-Malware 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.04.03.05
 

Windows Vista Service Pack 2 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)

Internet Explorer 9.0.8112.16421

*** :: ALLE-PC [Administrator]
 

03.04.2012 11:06:06

mbam-log-2012-04-03 (11-06-06).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 436211

Laufzeit: 1 Stunde(n), 31 Minute(n), 12 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

ESET:

Code:

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=008ae93639df714692026094f4b4ebb2

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-04-03 02:28:01

# local_time=2012-04-03 04:28:01 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=1792 16777215 100 0 100600 100600 0 0

# compatibility_mode=5892 16776574 100 100 6559636 170982783 0 0

# compatibility_mode=8192 67108863 100 0 214 214 0 0

# scanned=216311

# found=1

# cleaned=0

# scan_time=12123

C:\Program Files\vispa\vispa.exe        probably a variant of Win32/Agent.BGLQJOV trojan (unable to clean)        00000000000000000000000000000000        I

Zitat:

C:\Program Files\vispa\vispa.exe

Kennst du das, was soll das sein?

Ja, ist zwar nicht mein Computer, aber mein Vater hat es installiert.

Zitat:

Zitat von COMPUTER BILD

Mit dem kostenlosen Systemtool „Vispa“ verwalten Sie eine Vielzahl verborgener Einstellungen von Windows Vista. Eine Baumansicht listet verschiedene Registry-Einträge auf, mit denen Sie überflüssige Verknüpfungen löschen, unnötige Dienste deaktivieren oder das Übermitteln persönlicher Daten abschalten können.

Dann ist das ein Fehlalarm.

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus wieder uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Ja, der normale Modus funktioniert und ich vermisse nichts im Startmenü. Es ist alles vorhanden.

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Code:

OTL logfile created on: 04.04.2012 17:13:20 - Run 1

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\***\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,31 Gb Available Physical Memory | 65,56% Memory free

4,23 Gb Paging File | 3,40 Gb Available in Paging File | 80,52% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 148,10 Gb Total Space | 81,61 Gb Free Space | 55,11% Space Free | Partition Type: NTFS

Drive D: | 73,07 Gb Total Space | 33,24 Gb Free Space | 45,49% Space Free | Partition Type: NTFS

 

Computer Name: ALLE-PC | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.04.04 17:10:11 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

PRC - [2012.04.02 11:09:44 | 000,353,440 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\Macromed\Flash\FlashUtil32_11_2_202_228_ActiveX.exe

PRC - [2012.01.31 08:56:34 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2012.01.31 08:56:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2012.01.31 08:55:48 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012.01.31 08:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2008.10.23 17:45:14 | 000,307,200 | ---- | M] (T-Systems Enterprise Services GmbH) -- C:\Program Files\DSL-Manager\DslMgrSvc.exe

PRC - [2008.07.18 20:52:16 | 000,104,936 | ---- | M] (CyberLink) -- C:\Program Files\HomeCinema\Power2Go\CLMLSvc.exe

PRC - [2008.01.18 23:33:12 | 000,017,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iashost.exe

PRC - [2007.11.26 14:51:00 | 001,085,440 | ---- | M] (T-Systems Enterprise Services GmbH) -- C:\Program Files\DSL-Manager\DslMgr.exe

PRC - [2007.06.04 16:20:38 | 000,065,536 | ---- | M] () -- C:\Program Files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe

PRC - [2007.03.16 00:49:34 | 000,537,520 | ---- | M] ( ) -- C:\Windows\System32\lxbscoms.exe

PRC - [2007.03.13 16:01:40 | 000,029,696 | ---- | M] () -- C:\Program Files\Power Manager\PM.exe

PRC - [2007.01.18 14:46:56 | 004,349,952 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2007.01.04 20:48:52 | 000,112,152 | R--- | M] (InterVideo) -- c:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

PRC - [2006.12.08 11:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011.11.02 00:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2011.11.02 00:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

MOD - [2008.07.18 20:52:08 | 000,649,704 | ---- | M] () -- C:\Program Files\HomeCinema\Power2Go\CLMediaLibrary.dll

MOD - [2008.06.09 10:55:08 | 000,013,096 | ---- | M] () -- C:\Program Files\HomeCinema\Power2Go\CLMLSvcPS.dll

MOD - [2007.03.13 16:01:40 | 000,029,696 | ---- | M] () -- C:\Program Files\Power Manager\PM.exe

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Auto | Stopped] -- c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon -- (CLTNetCnService)

SRV - [2012.04.02 11:09:45 | 000,253,600 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.01.31 08:56:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012.01.31 08:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2008.11.04 03:37:58 | 000,410,624 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\System32\XAudio32.dll -- (HsfXAudioService)

SRV - [2008.10.23 17:45:14 | 000,307,200 | ---- | M] (T-Systems Enterprise Services GmbH) [On_Demand | Running] -- C:\Program Files\DSL-Manager\DslMgrSvc.exe -- (TDslMgrService)

SRV - [2008.01.18 23:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007.06.04 16:20:38 | 000,065,536 | ---- | M] () [Auto | Running] -- C:\Program Files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe -- (FSCLBaseUpdaterService)

SRV - [2007.03.16 00:49:34 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\System32\lxbscoms.exe -- (lxbs_device)

SRV - [2007.01.04 20:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto | Running] -- c:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)

SRV - [2006.12.08 11:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) [Auto | Running] -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe -- (TestHandler)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\12C5.tmp -- (MEMSWEEP2)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\STK02HW2.sys -- (DCamUSBSTK02H)

DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)

DRV - [2012.01.31 08:56:33 | 000,137,416 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2012.01.31 08:56:33 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.09.16 16:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2010.06.02 18:54:46 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)

DRV - [2009.12.11 08:17:14 | 011,515,848 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2009.10.08 16:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.09.05 14:25:36 | 001,183,744 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)

DRV - [2009.04.10 22:06:28 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDScan.sys -- (WSDScan)

DRV - [2009.04.03 10:18:44 | 000,049,904 | R--- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BVRPMPR5.SYS -- (BVRPMPR5)

DRV - [2008.11.04 03:32:20 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio32.sys -- (XAudio)

DRV - [2008.10.09 15:42:42 | 000,017,408 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\KMWDFILTER.sys -- (KMWDFILTER)

DRV - [2008.09.02 16:03:54 | 000,168,704 | ---- | M] (10moons Technologies Co.,Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tridvid.sys -- (TridVid)

DRV - [2008.01.29 12:55:00 | 001,042,464 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)

DRV - [2008.01.18 22:15:00 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV - [2007.09.12 17:24:00 | 000,026,816 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\DslTestSp5.sys -- (dsltestSp5)

DRV - [2007.09.07 01:00:00 | 000,783,272 | ---- | M] (Bison Electronics. Inc. ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BisonCam.sys -- (Cam5603D)

DRV - [2007.08.09 19:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)

DRV - [2007.08.01 14:49:00 | 000,016,448 | ---- | M] (T-Systems Enterprise Services GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\dslmnlwf.sys -- (DslMNLwf)

DRV - [2007.07.02 17:37:10 | 000,131,616 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nvrd32.sys -- (nvrd32)

DRV - [2007.06.13 23:47:12 | 000,048,256 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)

DRV - [2007.02.02 09:51:14 | 000,040,448 | ---- | M] (SMSC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smscirrx.sys -- (smscirrx)

DRV - [2007.01.04 12:15:08 | 000,009,336 | ---- | M] (hxxp://www.internals.com) [Kernel | System | Running] -- C:\Windows\System32\WinIo.sys -- (WINIO)

DRV - [2006.11.06 15:27:36 | 000,100,400 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\slabser.sys -- (slabser)

DRV - [2006.11.06 15:27:36 | 000,066,672 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\slabbus.sys -- (slabbus) CP210x USB Composite Device driver (WDM)

DRV - [2006.10.30 15:35:20 | 000,140,800 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)

DRV - [2006.09.15 08:44:18 | 000,011,520 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\URLSearchHook: {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2769726

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E0 5C D0 C2 74 D3 CC 01  [binary data]

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 
 ========== FireFox ==========

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  File not found

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.3.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.3.1: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

 

 

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (SearchElf 1.2 Toolbar) - {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (SearchElf 1.2 Toolbar) - {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

O3 - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\..\Toolbar\WebBrowser: (no name) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - No CLSID value found.

O3 - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\..\Toolbar\WebBrowser: (SearchElf 1.2 Toolbar) - {F4E6547E-325B-403C-A3BB-AD29ED37A92F} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [CLMLServer] C:\Program Files\HomeCinema\Power2Go\CLMLSvc.exe (CyberLink)

O4 - HKLM..\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe ()

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)

O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.1)

O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8660B1CA-198A-4D32-A3BD-4630E08FAD64}: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AD197E5A-BCDB-411A-84B2-A2144B7340F9}: DhcpNameServer = 192.168.0.1

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img29.jpg

O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img29.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{7c2dfa00-fb52-11dc-9606-00140b4345ce}\Shell - "" = AutoRun

O33 - MountPoints2\{7c2dfa00-fb52-11dc-9606-00140b4345ce}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpReg: Windows Defender - hkey= - key= -  File not found

MsConfig - State: "bootini" - 2

MsConfig - State: "startup" - 2

 

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfPf - Driver

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org)

Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.04.04 17:10:10 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

[2012.04.03 12:44:01 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.04.02 11:02:24 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\scan

[2012.04.02 10:23:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.04.02 10:23:09 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.04.02 09:27:44 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012.04.02 09:23:45 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft WSE

[2012.04.02 09:21:46 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\PackageAware

[2012.04.02 08:53:14 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Avira

[2012.04.02 08:51:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2012.04.02 08:50:58 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys

[2012.04.02 08:50:57 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys

[2012.04.02 08:50:56 | 000,137,416 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2012.04.02 08:50:56 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2012.04.02 08:50:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2012.04.02 08:50:55 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2012.04.01 21:22:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

[2012.04.01 21:21:42 | 000,000,000 | ---D | C] -- C:\Program Files\iPod

[2012.04.01 21:21:39 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes

[2012.04.01 20:34:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2012.04.01 16:44:09 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2012.04.01 16:43:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.04.01 16:43:57 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.03.31 21:53:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java(1)

[2012.03.31 16:59:46 | 000,000,000 | ---D | C] -- C:\Windows\Temp

[2012.03.25 18:34:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira(91)

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.04.04 17:10:11 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

[2012.04.04 17:08:09 | 000,139,818 | ---- | M] () -- C:\ProgramData\nvModes.dat

[2012.04.04 17:08:08 | 000,139,818 | ---- | M] () -- C:\ProgramData\nvModes.001

[2012.04.04 17:02:54 | 000,638,748 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.04.04 17:02:54 | 000,604,324 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.04.04 17:02:54 | 000,130,668 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.04.04 17:02:54 | 000,107,760 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.04.04 16:58:43 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.04.04 16:58:43 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.04.04 16:58:31 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.04.04 16:57:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.04.04 16:57:53 | 2144,370,688 | -HS- | M] () -- C:\hiberfil.sys

[2012.04.04 15:48:09 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2012.04.04 15:48:05 | 000,000,757 | ---- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk

[2012.04.03 18:01:04 | 000,001,356 | ---- | M] () -- C:\Users\***\AppData\Local\d3d9caps.dat

[2012.04.02 11:05:32 | 000,000,020 | ---- | M] () -- C:\Users\***\defogger_reenable

[2012.04.02 08:51:13 | 000,001,813 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2012.04.01 21:22:25 | 000,001,630 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk

[2012.04.01 20:20:11 | 000,434,368 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

 
 ========== Files Created - No Company Name ==========

 

[2012.04.04 15:34:40 | 2144,370,688 | -HS- | C] () -- C:\hiberfil.sys

[2012.04.02 11:09:45 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.04.02 11:05:09 | 000,000,020 | ---- | C] () -- C:\Users\***\defogger_reenable

[2012.04.02 08:51:13 | 000,001,813 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2012.04.01 21:22:25 | 000,001,630 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk

[2010.12.30 12:39:49 | 000,000,215 | ---- | C] () -- C:\Windows\gkv501me.INI

[2010.12.30 12:39:49 | 000,000,202 | ---- | C] () -- C:\Windows\gkv501di.INI

[2010.12.30 12:39:49 | 000,000,200 | ---- | C] () -- C:\Windows\gkv501ti.INI

[2010.12.30 12:39:49 | 000,000,131 | ---- | C] () -- C:\Windows\gkstart1.INI

[2010.12.30 12:39:30 | 000,375,296 | ---- | C] () -- C:\Windows\System32\tx32.dll

[2010.12.30 12:39:26 | 000,000,202 | ---- | C] () -- C:\Windows\System32\IC32.INI

 
 ========== LOP Check ==========

 

[2011.02.27 15:58:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\T-Online

[2011.04.27 11:05:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Audacity

[2008.02.24 19:13:23 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canon

[2008.02.14 18:31:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\InterVideo

[2008.03.01 18:45:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\klickTel

[2011.10.09 15:42:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org

[2011.04.25 19:45:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PhotoScape

[2008.02.28 17:14:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\T-Online

[2008.02.14 20:00:56 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Template

[2009.12.26 23:59:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software

[2008.05.18 21:29:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\XnView

[2008.05.01 11:35:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\InterVideo

[2012.01.18 16:51:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LibreOffice

[2012.01.18 15:34:55 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org

[2008.02.10 13:39:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PeerNetworking

[2008.03.21 18:47:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\T-Online

[2009.12.25 19:32:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software

[2012.04.04 15:48:10 | 000,032,514 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2012.01.15 15:09:21 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Adobe

[2009.10.19 13:52:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ahead

[2012.01.15 22:26:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Apple Computer

[2012.04.02 08:53:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Avira

[2009.10.19 14:12:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Help

[2008.02.10 11:32:39 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Identities

[2008.05.01 11:35:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\InterVideo

[2012.01.18 16:51:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LibreOffice

[2008.03.21 19:27:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Macromedia

[2012.04.01 16:44:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Media Center Programs

[2012.04.02 09:23:47 | 000,000,000 | --SD | M] -- C:\Users\***\AppData\Roaming\Microsoft

[2012.01.18 15:34:55 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org

[2011.02.08 23:25:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org2

[2008.02.10 13:39:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PeerNetworking

[2008.03.21 18:47:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\T-Online

[2009.12.25 19:32:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software

 
 < %APPDATA%\*.exe /s >

[2012.04.02 09:23:47 | 000,010,134 | R--- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2007.11.03 01:26:51 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\System32\drivers\AGP440.sys

[2007.11.03 01:26:51 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_cb7c81c7\AGP440.sys

[2007.11.03 01:26:51 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20598_none_b85cfa98dae9b436\AGP440.sys

[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2007.11.03 01:53:24 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=0B77F93AB73798F97E8E0A0AA4CCBEEF -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_44b6b0d0\atapi.sys

[2007.11.03 01:53:24 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=0B77F93AB73798F97E8E0A0AA4CCBEEF -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20694_none_db7e36353dc64123\atapi.sys

[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys

[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.17 18:54:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=224505155EC3E36D7A1F36E446F04C2A -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_ecc53ff9\atapi.sys

[2008.01.17 18:54:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=224505155EC3E36D7A1F36E446F04C2A -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16584_none_daff695624a08568\atapi.sys

[2008.01.18 23:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.18 23:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

[2008.01.17 18:54:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=BFD3DF48C9ED81934FE21E8E3CFC2496 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_27cad3e5\atapi.sys

[2008.01.17 18:54:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=BFD3DF48C9ED81934FE21E8E3CFC2496 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20707_none_dbe288453d7a8ed6\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: EVENTLOG.DLL  >

[2007.01.12 23:30:08 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files\HomeCinema\PowerDirector\EventLog.dll

 
 < MD5 for: IASTOR.SYS  >

[2007.07.12 16:35:02 | 000,305,176 | ---- | M] (Intel Corporation) MD5=2358C53F30CB9DCD1D3843C4E2F299B2 -- C:\Windows\System32\drivers\iaStor.sys

[2007.07.12 16:35:02 | 000,305,176 | ---- | M] (Intel Corporation) MD5=2358C53F30CB9DCD1D3843C4E2F299B2 -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_ec8a8d1b\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2008.01.18 23:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.18 23:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll

[2009.04.10 23:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll

[2009.04.10 23:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.18 23:35:38 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys

[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.18 23:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.18 23:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: NVSTOR32.SYS  >

[2007.01.27 17:21:04 | 000,101,160 | ---- | M] (NVIDIA Corporation) MD5=4A9A6368BEF61C9608FE7CC21B1F8886 -- C:\DRIVER\SATA\NFORCE\nvstor32.sys

[2007.01.27 17:21:04 | 000,101,160 | ---- | M] (NVIDIA Corporation) MD5=4A9A6368BEF61C9608FE7CC21B1F8886 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_54ba863a\nvstor32.sys

[2007.07.02 17:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=703E3A7093B0FAC0EEBADBB8E931ECAF -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_bbf77119\nvstor32.sys

[2007.08.09 19:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) MD5=DC5F166422BEEBF195E3E4BB8AB4EE22 -- C:\Windows\System32\drivers\nvstor32.sys

[2007.08.09 19:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) MD5=DC5F166422BEEBF195E3E4BB8AB4EE22 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_99d8b088\nvstor32.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.18 23:36:20 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

[2009.04.10 23:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll

[2009.04.10 23:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2007.11.03 01:17:10 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=3322B167C8F76319C991B851514DFAC9 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20587_none_cb8c4940898e24a6\user32.dll

[2008.01.18 23:36:48 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll

[2009.04.10 23:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2009.04.10 23:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.18 23:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.18 23:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

 
 < MD5 for: VIAMRAID.SYS  >

[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\Windows\System32\drivers\viamraid.sys

[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\Windows\System32\DriverStore\FileRepository\viamraid.inf_74a36694\viamraid.sys

 
 < MD5 for: WININIT.EXE  >

[2008.01.18 23:33:38 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.18 23:33:38 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

[2007.11.03 01:17:50 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=39D959CD9F3BC44F78DB3C6588AAC3FE -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.20593_none_2f37c4ba208e02ab\wininit.exe

[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe

[2007.11.03 01:17:50 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=A3FEA6ED9FD3CF07219A632E4A716226 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.20593_none_6e080d01f12ed7fe\winlogon.exe

[2008.01.18 23:33:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys

[2008.01.18 21:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.18 21:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2008.01.18 03:38:11 | 008,011,776 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2008.01.18 03:38:07 | 000,102,400 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2008.01.18 03:38:12 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2008.01.18 03:38:27 | 016,478,208 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2008.01.18 03:38:29 | 006,029,312 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 <           >
 

< End of report >

Zitat:

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

Sagmal gehörst du auch zur der Fraktion, die sich Serien und Kinofilme über dubiose Portale anschaut?
Wenn ja: in Zukunft Finger weg, diese illegalen Portale verbreiten Malware und wenn du in Zukunft malwarefrei sein wilst, musst du auf legale Alternativen ausweichen und auf solche riskanten Streamingseiten verzichten!
Gerade solche Streamingseiten sind für die aktuelle Welle der Erpresserschädlinge verantwortlich, die Windows blockieren und 50 oder 100 EUR erpressen wollen!!

Hab keine Ahnung, woher das kommt. Aber ich bin auf jeden Fall nicht auf solchen Seiten unterwegs. Filme und Serien sollte man im Kino, Fernsehen oder auf DVD/BluRay sehen und legal kaufen.

Na, dann deinstallier DivX wenn es sonst nicht mehr gebraucht wird. Mach dann wie o.g. ein neues OTL-Log.

So, DivX wurde deinstalliert. Btw: Firefox ist hier gar nicht installiert.
Hier das neue Log:

Code:

OTL logfile created on: 05.04.2012 08:54:13 - Run 2

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\***\Desktop\scan

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,19 Gb Available Physical Memory | 59,46% Memory free

4,23 Gb Paging File | 3,23 Gb Available in Paging File | 76,40% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 148,10 Gb Total Space | 86,01 Gb Free Space | 58,08% Space Free | Partition Type: NTFS

Drive D: | 73,07 Gb Total Space | 33,25 Gb Free Space | 45,50% Space Free | Partition Type: NTFS

 

Computer Name: ALLE-PC | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.04.04 17:10:11 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\scan\OTL.exe

PRC - [2012.01.31 08:56:34 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2012.01.31 08:56:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2012.01.31 08:55:48 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012.01.31 08:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2009.04.10 23:28:16 | 000,117,248 | ---- | M] () -- \\?\C:\Windows\System32\wbem\WMIADAP.EXE

PRC - [2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2008.10.23 17:45:14 | 000,307,200 | ---- | M] (T-Systems Enterprise Services GmbH) -- C:\Program Files\DSL-Manager\DslMgrSvc.exe

PRC - [2008.07.18 20:52:16 | 000,104,936 | ---- | M] (CyberLink) -- C:\Program Files\HomeCinema\Power2Go\CLMLSvc.exe

PRC - [2008.01.18 23:33:12 | 000,017,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iashost.exe

PRC - [2007.11.26 14:51:00 | 001,085,440 | ---- | M] (T-Systems Enterprise Services GmbH) -- C:\Program Files\DSL-Manager\DslMgr.exe

PRC - [2007.06.04 16:20:38 | 000,065,536 | ---- | M] () -- C:\Program Files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe

PRC - [2007.03.16 00:49:34 | 000,537,520 | ---- | M] ( ) -- C:\Windows\System32\lxbscoms.exe

PRC - [2007.03.13 16:01:40 | 000,029,696 | ---- | M] () -- C:\Program Files\Power Manager\PM.exe

PRC - [2007.01.18 14:46:56 | 004,349,952 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2007.01.04 20:48:52 | 000,112,152 | R--- | M] (InterVideo) -- c:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

PRC - [2006.12.08 11:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011.11.02 00:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2011.11.02 00:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

MOD - [2008.07.18 20:52:08 | 000,649,704 | ---- | M] () -- C:\Program Files\HomeCinema\Power2Go\CLMediaLibrary.dll

MOD - [2008.06.09 10:55:08 | 000,013,096 | ---- | M] () -- C:\Program Files\HomeCinema\Power2Go\CLMLSvcPS.dll

MOD - [2007.03.13 16:01:40 | 000,029,696 | ---- | M] () -- C:\Program Files\Power Manager\PM.exe

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Auto | Stopped] -- c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon -- (CLTNetCnService)

SRV - [2012.04.02 11:09:45 | 000,253,600 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.01.31 08:56:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012.01.31 08:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2008.11.04 03:37:58 | 000,410,624 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\System32\XAudio32.dll -- (HsfXAudioService)

SRV - [2008.10.23 17:45:14 | 000,307,200 | ---- | M] (T-Systems Enterprise Services GmbH) [On_Demand | Running] -- C:\Program Files\DSL-Manager\DslMgrSvc.exe -- (TDslMgrService)

SRV - [2008.01.18 23:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007.06.04 16:20:38 | 000,065,536 | ---- | M] () [Auto | Running] -- C:\Program Files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe -- (FSCLBaseUpdaterService)

SRV - [2007.03.16 00:49:34 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\System32\lxbscoms.exe -- (lxbs_device)

SRV - [2007.01.04 20:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto | Running] -- c:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)

SRV - [2006.12.08 11:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) [Auto | Running] -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe -- (TestHandler)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\12C5.tmp -- (MEMSWEEP2)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\STK02HW2.sys -- (DCamUSBSTK02H)

DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)

DRV - [2012.01.31 08:56:33 | 000,137,416 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2012.01.31 08:56:33 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.09.16 16:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2010.06.02 18:54:46 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)

DRV - [2009.12.11 08:17:14 | 011,515,848 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2009.10.08 16:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.09.05 14:25:36 | 001,183,744 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)

DRV - [2009.04.10 22:06:28 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDScan.sys -- (WSDScan)

DRV - [2009.04.03 10:18:44 | 000,049,904 | R--- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BVRPMPR5.SYS -- (BVRPMPR5)

DRV - [2008.11.04 03:32:20 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio32.sys -- (XAudio)

DRV - [2008.10.09 15:42:42 | 000,017,408 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\KMWDFILTER.sys -- (KMWDFILTER)

DRV - [2008.09.02 16:03:54 | 000,168,704 | ---- | M] (10moons Technologies Co.,Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tridvid.sys -- (TridVid)

DRV - [2008.01.29 12:55:00 | 001,042,464 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)

DRV - [2008.01.18 22:15:00 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV - [2007.09.12 17:24:00 | 000,026,816 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\DslTestSp5.sys -- (dsltestSp5)

DRV - [2007.09.07 01:00:00 | 000,783,272 | ---- | M] (Bison Electronics. Inc. ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BisonCam.sys -- (Cam5603D)

DRV - [2007.08.09 19:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)

DRV - [2007.08.01 14:49:00 | 000,016,448 | ---- | M] (T-Systems Enterprise Services GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\dslmnlwf.sys -- (DslMNLwf)

DRV - [2007.07.02 17:37:10 | 000,131,616 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nvrd32.sys -- (nvrd32)

DRV - [2007.06.13 23:47:12 | 000,048,256 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)

DRV - [2007.02.02 09:51:14 | 000,040,448 | ---- | M] (SMSC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smscirrx.sys -- (smscirrx)

DRV - [2007.01.04 12:15:08 | 000,009,336 | ---- | M] (hxxp://www.internals.com) [Kernel | System | Running] -- C:\Windows\System32\WinIo.sys -- (WINIO)

DRV - [2006.11.06 15:27:36 | 000,100,400 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\slabser.sys -- (slabser)

DRV - [2006.11.06 15:27:36 | 000,066,672 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\slabbus.sys -- (slabbus) CP210x USB Composite Device driver (WDM)

DRV - [2006.10.30 15:35:20 | 000,140,800 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)

DRV - [2006.09.15 08:44:18 | 000,011,520 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\URLSearchHook: {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2769726

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E0 5C D0 C2 74 D3 CC 01  [binary data]

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 
 ========== FireFox ==========

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  File not found

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.3.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.3.1: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

 

 

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (SearchElf 1.2 Toolbar) - {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (SearchElf 1.2 Toolbar) - {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

O3 - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\..\Toolbar\WebBrowser: (no name) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - No CLSID value found.

O3 - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\..\Toolbar\WebBrowser: (SearchElf 1.2 Toolbar) - {F4E6547E-325B-403C-A3BB-AD29ED37A92F} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [CLMLServer] C:\Program Files\HomeCinema\Power2Go\CLMLSvc.exe (CyberLink)

O4 - HKLM..\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe ()

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)

O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.1)

O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8660B1CA-198A-4D32-A3BD-4630E08FAD64}: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AD197E5A-BCDB-411A-84B2-A2144B7340F9}: DhcpNameServer = 192.168.0.1

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img29.jpg

O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img29.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{7c2dfa00-fb52-11dc-9606-00140b4345ce}\Shell - "" = AutoRun

O33 - MountPoints2\{7c2dfa00-fb52-11dc-9606-00140b4345ce}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpReg: Windows Defender - hkey= - key= -  File not found

MsConfig - State: "bootini" - 2

MsConfig - State: "startup" - 2

 

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfPf - Driver

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org)

Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.04.05 08:45:55 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\DivX

[2012.04.03 12:44:01 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.04.02 11:02:24 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\scan

[2012.04.02 10:23:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.04.02 10:23:09 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.04.02 09:27:44 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012.04.02 09:23:45 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft WSE

[2012.04.02 09:21:46 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\PackageAware

[2012.04.02 08:53:14 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Avira

[2012.04.02 08:51:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2012.04.02 08:50:58 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys

[2012.04.02 08:50:57 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys

[2012.04.02 08:50:56 | 000,137,416 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2012.04.02 08:50:56 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2012.04.02 08:50:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2012.04.02 08:50:55 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2012.04.01 21:22:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

[2012.04.01 21:21:42 | 000,000,000 | ---D | C] -- C:\Program Files\iPod

[2012.04.01 21:21:39 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes

[2012.04.01 20:34:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2012.04.01 16:44:09 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2012.04.01 16:43:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.04.01 16:43:57 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.03.31 21:53:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java(1)

[2012.03.31 16:59:46 | 000,000,000 | ---D | C] -- C:\Windows\Temp

[2012.03.25 18:34:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira(91)

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.04.05 08:55:54 | 000,638,748 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.04.05 08:55:54 | 000,604,324 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.04.05 08:55:54 | 000,130,668 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.04.05 08:55:54 | 000,107,760 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.04.05 08:49:51 | 000,139,818 | ---- | M] () -- C:\ProgramData\nvModes.dat

[2012.04.05 08:49:50 | 000,139,818 | ---- | M] () -- C:\ProgramData\nvModes.001

[2012.04.05 08:49:24 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.04.05 08:49:24 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.04.05 08:49:02 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.04.05 08:48:57 | 2146,418,688 | -HS- | M] () -- C:\hiberfil.sys

[2012.04.05 08:47:40 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2012.04.05 08:47:38 | 000,000,757 | ---- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk

[2012.04.05 08:42:09 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.04.03 18:01:04 | 000,001,356 | ---- | M] () -- C:\Users\***\AppData\Local\d3d9caps.dat

[2012.04.02 11:05:32 | 000,000,020 | ---- | M] () -- C:\Users\***\defogger_reenable

[2012.04.02 08:51:13 | 000,001,813 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2012.04.01 21:22:25 | 000,001,630 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk

[2012.04.01 20:20:11 | 000,434,368 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

 
 ========== Files Created - No Company Name ==========

 

[2012.04.04 15:34:40 | 2146,418,688 | -HS- | C] () -- C:\hiberfil.sys

[2012.04.02 11:09:45 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.04.02 11:05:09 | 000,000,020 | ---- | C] () -- C:\Users\***\defogger_reenable

[2012.04.02 08:51:13 | 000,001,813 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2012.04.01 21:22:25 | 000,001,630 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk

[2010.12.30 12:39:49 | 000,000,215 | ---- | C] () -- C:\Windows\gkv501me.INI

[2010.12.30 12:39:49 | 000,000,202 | ---- | C] () -- C:\Windows\gkv501di.INI

[2010.12.30 12:39:49 | 000,000,200 | ---- | C] () -- C:\Windows\gkv501ti.INI

[2010.12.30 12:39:49 | 000,000,131 | ---- | C] () -- C:\Windows\gkstart1.INI

[2010.12.30 12:39:30 | 000,375,296 | ---- | C] () -- C:\Windows\System32\tx32.dll

[2010.12.30 12:39:26 | 000,000,202 | ---- | C] () -- C:\Windows\System32\IC32.INI

 
 ========== LOP Check ==========

 

[2011.02.27 15:58:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\T-Online

[2011.04.27 11:05:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Audacity

[2008.02.24 19:13:23 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canon

[2008.02.14 18:31:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\InterVideo

[2008.03.01 18:45:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\klickTel

[2011.10.09 15:42:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org

[2011.04.25 19:45:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PhotoScape

[2008.02.28 17:14:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\T-Online

[2008.02.14 20:00:56 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Template

[2009.12.26 23:59:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software

[2008.05.18 21:29:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\XnView

[2008.05.01 11:35:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\InterVideo

[2012.01.18 16:51:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LibreOffice

[2012.01.18 15:34:55 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org

[2008.02.10 13:39:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PeerNetworking

[2008.03.21 18:47:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\T-Online

[2009.12.25 19:32:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software

[2012.04.05 08:47:41 | 000,032,514 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2012.01.15 15:09:21 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Adobe

[2009.10.19 13:52:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ahead

[2012.01.15 22:26:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Apple Computer

[2012.04.02 08:53:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Avira

[2012.04.05 08:45:55 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DivX

[2009.10.19 14:12:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Help

[2008.02.10 11:32:39 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Identities

[2008.05.01 11:35:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\InterVideo

[2012.01.18 16:51:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LibreOffice

[2008.03.21 19:27:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Macromedia

[2012.04.01 16:44:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Media Center Programs

[2012.04.02 09:23:47 | 000,000,000 | --SD | M] -- C:\Users\***\AppData\Roaming\Microsoft

[2012.01.18 15:34:55 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org

[2011.02.08 23:25:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org2

[2008.02.10 13:39:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PeerNetworking

[2008.03.21 18:47:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\T-Online

[2009.12.25 19:32:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software

 
 < %APPDATA%\*.exe /s >

[2012.04.02 09:23:47 | 000,010,134 | R--- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2007.11.03 01:26:51 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\System32\drivers\AGP440.sys

[2007.11.03 01:26:51 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_cb7c81c7\AGP440.sys

[2007.11.03 01:26:51 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20598_none_b85cfa98dae9b436\AGP440.sys

[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2007.11.03 01:53:24 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=0B77F93AB73798F97E8E0A0AA4CCBEEF -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_44b6b0d0\atapi.sys

[2007.11.03 01:53:24 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=0B77F93AB73798F97E8E0A0AA4CCBEEF -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20694_none_db7e36353dc64123\atapi.sys

[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys

[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.17 18:54:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=224505155EC3E36D7A1F36E446F04C2A -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_ecc53ff9\atapi.sys

[2008.01.17 18:54:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=224505155EC3E36D7A1F36E446F04C2A -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16584_none_daff695624a08568\atapi.sys

[2008.01.18 23:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.18 23:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

[2008.01.17 18:54:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=BFD3DF48C9ED81934FE21E8E3CFC2496 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_27cad3e5\atapi.sys

[2008.01.17 18:54:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=BFD3DF48C9ED81934FE21E8E3CFC2496 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20707_none_dbe288453d7a8ed6\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: EVENTLOG.DLL  >

[2007.01.12 23:30:08 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files\HomeCinema\PowerDirector\EventLog.dll

 
 < MD5 for: IASTOR.SYS  >

[2007.07.12 16:35:02 | 000,305,176 | ---- | M] (Intel Corporation) MD5=2358C53F30CB9DCD1D3843C4E2F299B2 -- C:\Windows\System32\drivers\iaStor.sys

[2007.07.12 16:35:02 | 000,305,176 | ---- | M] (Intel Corporation) MD5=2358C53F30CB9DCD1D3843C4E2F299B2 -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_ec8a8d1b\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2008.01.18 23:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.18 23:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll

[2009.04.10 23:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll

[2009.04.10 23:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.18 23:35:38 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys

[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.18 23:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.18 23:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: NVSTOR32.SYS  >

[2007.01.27 17:21:04 | 000,101,160 | ---- | M] (NVIDIA Corporation) MD5=4A9A6368BEF61C9608FE7CC21B1F8886 -- C:\DRIVER\SATA\NFORCE\nvstor32.sys

[2007.01.27 17:21:04 | 000,101,160 | ---- | M] (NVIDIA Corporation) MD5=4A9A6368BEF61C9608FE7CC21B1F8886 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_54ba863a\nvstor32.sys

[2007.07.02 17:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=703E3A7093B0FAC0EEBADBB8E931ECAF -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_bbf77119\nvstor32.sys

[2007.08.09 19:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) MD5=DC5F166422BEEBF195E3E4BB8AB4EE22 -- C:\Windows\System32\drivers\nvstor32.sys

[2007.08.09 19:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) MD5=DC5F166422BEEBF195E3E4BB8AB4EE22 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_99d8b088\nvstor32.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.18 23:36:20 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

[2009.04.10 23:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll

[2009.04.10 23:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2007.11.03 01:17:10 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=3322B167C8F76319C991B851514DFAC9 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20587_none_cb8c4940898e24a6\user32.dll

[2008.01.18 23:36:48 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll

[2009.04.10 23:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2009.04.10 23:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.18 23:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.18 23:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

 
 < MD5 for: VIAMRAID.SYS  >

[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\Windows\System32\drivers\viamraid.sys

[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\Windows\System32\DriverStore\FileRepository\viamraid.inf_74a36694\viamraid.sys

 
 < MD5 for: WININIT.EXE  >

[2008.01.18 23:33:38 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.18 23:33:38 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

[2007.11.03 01:17:50 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=39D959CD9F3BC44F78DB3C6588AAC3FE -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.20593_none_2f37c4ba208e02ab\wininit.exe

[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe

[2007.11.03 01:17:50 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=A3FEA6ED9FD3CF07219A632E4A716226 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.20593_none_6e080d01f12ed7fe\winlogon.exe

[2008.01.18 23:33:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys

[2008.01.18 21:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.18 21:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2008.01.18 03:38:11 | 008,011,776 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2008.01.18 03:38:07 | 000,102,400 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2008.01.18 03:38:12 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2008.01.18 03:38:27 | 016,478,208 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2008.01.18 03:38:29 | 006,029,312 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 <           >
 

< End of report >

Zitat:

So, DivX wurde deinstalliert. Btw: Firefox ist hier gar nicht installiert.

Na ich weiß nicht, zumindest wurde der WebPlayer für DivX installiert.

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2769726

O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)

O2 - BHO: (SearchElf 1.2 Toolbar) - {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (SearchElf 1.2 Toolbar) - {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

O3 - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\..\Toolbar\WebBrowser: (no name) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - No CLSID value found.

O3 - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\..\Toolbar\WebBrowser: (SearchElf 1.2 Toolbar) - {F4E6547E-325B-403C-A3BB-AD29ED37A92F} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{7c2dfa00-fb52-11dc-9606-00140b4345ce}\Shell - "" = AutoRun

O33 - MountPoints2\{7c2dfa00-fb52-11dc-9606-00140b4345ce}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a

:Commands

[purity]

[emptytemp]

[emptyflash]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Code:

All processes killed

========== OTL ==========

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.

C:\Program Files\ConduitEngine\prxConduitEngine.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f4e6547e-325b-403c-a3bb-ad29ed37a92f}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f4e6547e-325b-403c-a3bb-ad29ed37a92f}\ deleted successfully.

C:\Program Files\SearchElf_1.2\prxtbSea0.dll moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.

File C:\Program Files\ConduitEngine\prxConduitEngine.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{f4e6547e-325b-403c-a3bb-ad29ed37a92f} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f4e6547e-325b-403c-a3bb-ad29ed37a92f}\ not found.

File C:\Program Files\SearchElf_1.2\prxtbSea0.dll not found.

Registry value HKEY_USERS\S-1-5-21-2954311596-1565164629-2574654167-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}\ not found.

Registry value HKEY_USERS\S-1-5-21-2954311596-1565164629-2574654167-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{F4E6547E-325B-403C-A3BB-AD29ED37A92F} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4E6547E-325B-403C-A3BB-AD29ED37A92F}\ not found.

File C:\Program Files\SearchElf_1.2\prxtbSea0.dll not found.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\autoexec.bat moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7c2dfa00-fb52-11dc-9606-00140b4345ce}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7c2dfa00-fb52-11dc-9606-00140b4345ce}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7c2dfa00-fb52-11dc-9606-00140b4345ce}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7c2dfa00-fb52-11dc-9606-00140b4345ce}\ not found.

File H:\LaunchU3.exe -a not found.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: ***

->Temp folder emptied: 2793470 bytes

->Temporary Internet Files folder emptied: 133223120 bytes

->Java cache emptied: 0 bytes

->Flash cache emptied: 759 bytes

 

User: ***

->Temp folder emptied: 8496530 bytes

->Temporary Internet Files folder emptied: 2482603 bytes

->Java cache emptied: 709206 bytes

->Flash cache emptied: 487 bytes

 

User: Future Pinball

 

User: ***

->Temp folder emptied: 864208545 bytes

->Temporary Internet Files folder emptied: 1671168 bytes

->Java cache emptied: 0 bytes

->Flash cache emptied: 470 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 1242976 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 968,00 mb

 

 

[EMPTYFLASH]

 

User: All Users

 

User: Default

 

User: Default User

 

User: ***

->Flash cache emptied: 0 bytes

 

User: ***

->Flash cache emptied: 0 bytes

 

User: Future Pinball

 

User: ***

->Flash cache emptied: 0 bytes

 

User: Public

 

Total Flash Files Cleaned = 0,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.39.2 log created on 04052012_174642
 

Files\Folders moved on Reboot...
 

Registry entries deleted on Reboot...

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Code:

12:30:22.0845 4808        TDSS rootkit removing tool 2.7.26.0 Apr  4 2012 19:52:02

12:30:23.0562 4808        ============================================================

12:30:23.0562 4808        Current date / time: 2012/04/06 12:30:23.0562

12:30:23.0562 4808        SystemInfo:

12:30:23.0562 4808        

12:30:23.0562 4808        OS Version: 6.0.6002 ServicePack: 2.0

12:30:23.0562 4808        Product type: Workstation

12:30:23.0562 4808        ComputerName: ALLE-PC

12:30:23.0562 4808        UserName: ***

12:30:23.0562 4808        Windows directory: C:\Windows

12:30:23.0562 4808        System windows directory: C:\Windows

12:30:23.0562 4808        Processor architecture: Intel x86

12:30:23.0562 4808        Number of processors: 2

12:30:23.0562 4808        Page size: 0x1000

12:30:23.0562 4808        Boot type: Normal boot

12:30:23.0562 4808        ============================================================

12:30:24.0514 4808        Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050

12:30:24.0514 4808        \Device\Harddisk0\DR0:

12:30:24.0514 4808        MBR used

12:30:24.0514 4808        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1770800, BlocksNum 0x12831000

12:30:24.0514 4808        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x13FA1800, BlocksNum 0x9223800

12:30:24.0685 4808        Initialize success

12:30:24.0685 4808        ============================================================

12:30:54.0856 5064        ============================================================

12:30:54.0856 5064        Scan started

12:30:54.0856 5064        Mode: Manual; SigCheck; TDLFS; 

12:30:54.0856 5064        ============================================================

12:30:55.0417 5064        ACPI            (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys

12:30:55.0620 5064        ACPI - ok

12:30:55.0776 5064        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

12:30:55.0823 5064        AdobeARMservice - ok

12:30:55.0995 5064        AdobeFlashPlayerUpdateSvc (0d4c486a24a711a45fd83acdf4d18506) C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

12:30:56.0026 5064        AdobeFlashPlayerUpdateSvc - ok

12:30:56.0416 5064        adp94xx         (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys

12:30:56.0494 5064        adp94xx - ok

12:30:56.0665 5064        adpahci         (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys

12:30:56.0743 5064        adpahci - ok

12:30:56.0899 5064        adpu160m        (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys

12:30:56.0931 5064        adpu160m - ok

12:30:57.0133 5064        adpu320         (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys

12:30:57.0165 5064        adpu320 - ok

12:30:57.0289 5064        AeLookupSvc     (9d1fda9e086ba64e3c93c9de32461bcf) C:\Windows\System32\aelupsvc.dll

12:30:57.0492 5064        AeLookupSvc - ok

12:30:57.0648 5064        AFD             (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys

12:30:57.0789 5064        AFD - ok

12:30:57.0945 5064        agp440          (198636e76971ebc96404547ec0fd5e75) C:\Windows\system32\drivers\agp440.sys

12:30:58.0007 5064        agp440 - ok

12:30:58.0163 5064        aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

12:30:58.0210 5064        aic78xx - ok

12:30:58.0335 5064        ALG             (a1545b731579895d8cc44fc0481c1192) C:\Windows\System32\alg.exe

12:30:58.0444 5064        ALG - ok

12:30:58.0584 5064        aliide          (0b3b337a68d9a75cc8d787dc98b53d79) C:\Windows\system32\drivers\aliide.sys

12:30:58.0600 5064        aliide - ok

12:30:58.0647 5064        amdagp          (2363abc8989a14fd7247ca6f4e89d397) C:\Windows\system32\drivers\amdagp.sys

12:30:58.0693 5064        amdagp - ok

12:30:58.0803 5064        amdide          (468a204966d09f327a662c35f4b15dd3) C:\Windows\system32\drivers\amdide.sys

12:30:58.0834 5064        amdide - ok

12:30:58.0881 5064        AmdK7           (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys

12:30:58.0974 5064        AmdK7 - ok

12:30:59.0068 5064        AmdK8           (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\DRIVERS\amdk8.sys

12:30:59.0208 5064        AmdK8 - ok

12:30:59.0317 5064        AntiVirSchedulerService (a122d68ea2541453f787f341877cb40b) C:\Program Files\Avira\AntiVir Desktop\sched.exe

12:30:59.0364 5064        AntiVirSchedulerService - ok

12:30:59.0395 5064        AntiVirService  (2fe359edeb34efcf42574752f8aebd3f) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

12:30:59.0427 5064        AntiVirService - ok

12:30:59.0614 5064        ApfiltrService  (703ef49130f2466887a911be2bb87998) C:\Windows\system32\DRIVERS\Apfiltr.sys

12:30:59.0692 5064        ApfiltrService - ok

12:30:59.0848 5064        Appinfo         (c6d704c7f0434dc791aac37cac4b6e14) C:\Windows\System32\appinfo.dll

12:30:59.0926 5064        Appinfo - ok

12:31:00.0051 5064        Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

12:31:00.0066 5064        Apple Mobile Device - ok

12:31:00.0378 5064        arc             (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys

12:31:00.0425 5064        arc - ok

12:31:00.0519 5064        arcsas          (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys

12:31:00.0550 5064        arcsas - ok

12:31:00.0612 5064        AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys

12:31:00.0690 5064        AsyncMac - ok

12:31:00.0737 5064        atapi           (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys

12:31:00.0768 5064        atapi - ok

12:31:00.0877 5064        athr            (2846f5ee802889d500fcf5cc48b28381) C:\Windows\system32\DRIVERS\athr.sys

12:31:01.0049 5064        athr - ok

12:31:01.0111 5064        AudioEndpointBuilder (68e2a1a0407a66cf50da0300852424ab) C:\Windows\System32\Audiosrv.dll

12:31:01.0205 5064        AudioEndpointBuilder - ok

12:31:01.0221 5064        Audiosrv        (68e2a1a0407a66cf50da0300852424ab) C:\Windows\System32\Audiosrv.dll

12:31:01.0252 5064        Audiosrv - ok

12:31:01.0299 5064        avgntflt        (7713e4eb0276702faa08e52a6e23f2a6) C:\Windows\system32\DRIVERS\avgntflt.sys

12:31:01.0377 5064        avgntflt - ok

12:31:01.0439 5064        avipbb          (13b02b9b969dde270cd7c351203dad3c) C:\Windows\system32\DRIVERS\avipbb.sys

12:31:01.0470 5064        avipbb - ok

12:31:01.0501 5064        avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\Windows\system32\DRIVERS\avkmgr.sys

12:31:01.0517 5064        avkmgr - ok

12:31:01.0564 5064        Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys

12:31:01.0626 5064        Beep - ok

12:31:01.0720 5064        BFE             (c789af0f724fda5852fb9a7d3a432381) C:\Windows\System32\bfe.dll

12:31:01.0813 5064        BFE - ok

12:31:01.0907 5064        BITS            (93952506c6d67330367f7e7934b6a02f) C:\Windows\System32\qmgr.dll

12:31:02.0016 5064        BITS - ok

12:31:02.0047 5064        blbdrive - ok

12:31:02.0219 5064        Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe

12:31:02.0297 5064        Bonjour Service - ok

12:31:02.0375 5064        bowser          (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys

12:31:02.0500 5064        bowser - ok

12:31:02.0531 5064        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

12:31:02.0578 5064        BrFiltLo - ok

12:31:02.0609 5064        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

12:31:02.0687 5064        BrFiltUp - ok

12:31:02.0734 5064        Browser         (a3629a0c4226f9e9c72faaeebc3ad33c) C:\Windows\System32\browser.dll

12:31:02.0843 5064        Browser - ok

12:31:02.0905 5064        Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

12:31:03.0015 5064        Brserid - ok

12:31:03.0061 5064        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

12:31:03.0155 5064        BrSerWdm - ok

12:31:03.0202 5064        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

12:31:03.0280 5064        BrUsbMdm - ok

12:31:03.0358 5064        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys

12:31:03.0451 5064        BrUsbSer - ok

12:31:03.0561 5064        BthEnum         (6d39c954799b63ba866910234cf7d726) C:\Windows\system32\DRIVERS\BthEnum.sys

12:31:03.0623 5064        BthEnum - ok

12:31:03.0670 5064        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

12:31:03.0779 5064        BTHMODEM - ok

12:31:03.0841 5064        BthPan          (5904efa25f829bf84ea6fb045134a1d8) C:\Windows\system32\DRIVERS\bthpan.sys

12:31:03.0919 5064        BthPan - ok

12:31:04.0044 5064        BTHPORT         (611ff3f2f095c8d4a6d4cfd9dcc09793) C:\Windows\system32\Drivers\BTHport.sys

12:31:04.0091 5064        BTHPORT - ok

12:31:04.0153 5064        BthServ         (a4c8377fa4a994e07075107dbe2e3dce) C:\Windows\System32\bthserv.dll

12:31:04.0341 5064        BthServ - ok

12:31:04.0465 5064        BTHUSB          (d330803eab2a15caec7f011f1d4cb30e) C:\Windows\system32\Drivers\BTHUSB.sys

12:31:04.0543 5064        BTHUSB - ok

12:31:04.0668 5064        BVRPMPR5        (248dfa5762dde38dfddbbd44149e9d7a) C:\Windows\system32\drivers\BVRPMPR5.SYS

12:31:04.0715 5064        BVRPMPR5 ( UnsignedFile.Multi.Generic ) - warning

12:31:04.0715 5064        BVRPMPR5 - detected UnsignedFile.Multi.Generic (1)

12:31:04.0809 5064        Cam5603D        (eb5121a90c1e6859ed0ba2f60b8993bb) C:\Windows\system32\Drivers\BisonCam.sys

12:31:04.0871 5064        Cam5603D - ok

12:31:04.0918 5064        cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys

12:31:04.0980 5064        cdfs - ok

12:31:05.0027 5064        cdrom           (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys

12:31:05.0105 5064        cdrom - ok

12:31:05.0152 5064        CertPropSvc     (312ec3e37a0a1f2006534913e37b4423) C:\Windows\System32\certprop.dll

12:31:05.0245 5064        CertPropSvc - ok

12:31:05.0308 5064        circlass        (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys

12:31:05.0370 5064        circlass - ok

12:31:05.0433 5064        CLFS            (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys

12:31:05.0448 5064        CLFS - ok

12:31:05.0511 5064        clr_optimization_v2.0.50727_32 (8ee772032e2fe80a924f3b8dd5082194) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

12:31:05.0557 5064        clr_optimization_v2.0.50727_32 - ok

12:31:05.0667 5064        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

12:31:05.0682 5064        clr_optimization_v4.0.30319_32 - ok

12:31:05.0745 5064        CLTNetCnService - ok

12:31:06.0088 5064        CmBatt          (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys

12:31:06.0150 5064        CmBatt - ok

12:31:06.0213 5064        cmdide          (2ac0c92b29ec21838f4cb46adb26bcc0) C:\Windows\system32\drivers\cmdide.sys

12:31:06.0244 5064        cmdide - ok

12:31:06.0322 5064        Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys

12:31:06.0337 5064        Compbatt - ok

12:31:06.0337 5064        COMSysApp - ok

12:31:06.0400 5064        crcdisk         (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys

12:31:06.0431 5064        crcdisk - ok

12:31:06.0493 5064        Crusoe          (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys

12:31:06.0603 5064        Crusoe - ok

12:31:06.0774 5064        CryptSvc        (fb27772beaf8e1d28ccd825c09da939b) C:\Windows\system32\cryptsvc.dll

12:31:06.0821 5064        CryptSvc - ok

12:31:06.0852 5064        DCamUSBSTK02H - ok

12:31:06.0930 5064        DcomLaunch      (3b5b4d53fec14f7476ca29a20cc31ac9) C:\Windows\system32\rpcss.dll

12:31:07.0008 5064        DcomLaunch - ok

12:31:07.0039 5064        DfsC            (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys

12:31:07.0102 5064        DfsC - ok

12:31:07.0336 5064        DFSR            (2cc3dcfb533a1035b13dcab6160ab38b) C:\Windows\system32\DFSR.exe

12:31:07.0570 5064        DFSR - ok

12:31:07.0788 5064        Dhcp            (9028559c132146fb75eb7acf384b086a) C:\Windows\System32\dhcpcsvc.dll

12:31:07.0897 5064        Dhcp - ok

12:31:07.0944 5064        disk            (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys

12:31:07.0960 5064        disk - ok

12:31:07.0991 5064        Dnscache        (57d762f6f5974af0da2be88a3349baaa) C:\Windows\System32\dnsrslvr.dll

12:31:08.0053 5064        Dnscache - ok

12:31:08.0116 5064        dot3svc         (324fd74686b1ef5e7c19a8af49e748f6) C:\Windows\System32\dot3svc.dll

12:31:08.0178 5064        dot3svc - ok

12:31:08.0225 5064        DPS             (a622e888f8aa2f6b49e9bc466f0e5def) C:\Windows\system32\dps.dll

12:31:08.0287 5064        DPS - ok

12:31:08.0365 5064        drmkaud         (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys

12:31:08.0490 5064        drmkaud - ok

12:31:08.0568 5064        DslMNLwf        (e577b5c4a6be078e5445cdcfb65be7ab) C:\Windows\system32\DRIVERS\dslmnlwf.sys

12:31:08.0584 5064        DslMNLwf - ok

12:31:08.0615 5064        dsltestSp5      (c6b2e10cfe79169c72f0269087b9a603) C:\Windows\system32\Drivers\dsltestSp5.sys

12:31:08.0646 5064        dsltestSp5 - ok

12:31:08.0693 5064        DXGKrnl         (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys

12:31:08.0787 5064        DXGKrnl - ok

12:31:08.0833 5064        E1G60           (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys

12:31:08.0927 5064        E1G60 - ok

12:31:09.0021 5064        EapHost         (c0b95e40d85cd807d614e264248a45b9) C:\Windows\System32\eapsvc.dll

12:31:09.0099 5064        EapHost - ok

12:31:09.0161 5064        Ecache          (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys

12:31:09.0192 5064        Ecache - ok

12:31:09.0270 5064        ehRecvr         (9be3744d295a7701eb425332014f0797) C:\Windows\ehome\ehRecvr.exe

12:31:09.0317 5064        ehRecvr - ok

12:31:09.0348 5064        ehSched         (ad1870c8e5d6dd340c829e6074bf3c3f) C:\Windows\ehome\ehsched.exe

12:31:09.0457 5064        ehSched - ok

12:31:09.0489 5064        ehstart         (c27c4ee8926e74aa72efcab24c5242c3) C:\Windows\ehome\ehstart.dll

12:31:09.0520 5064        ehstart - ok

12:31:09.0629 5064        elxstor         (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys

12:31:09.0723 5064        elxstor - ok

12:31:09.0785 5064        EMDMgmt         (4e6b23dfc917ea39306b529b773950f4) C:\Windows\system32\emdmgmt.dll

12:31:09.0910 5064        EMDMgmt - ok

12:31:09.0988 5064        EventSystem     (67058c46504bc12d821f38cf99b7b28f) C:\Windows\system32\es.dll

12:31:10.0035 5064        EventSystem - ok

12:31:10.0066 5064        exfat           (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys

12:31:10.0159 5064        exfat - ok

12:31:10.0191 5064        fastfat         (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys

12:31:10.0237 5064        fastfat - ok

12:31:10.0315 5064        fdc             (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys

12:31:10.0409 5064        fdc - ok

12:31:10.0456 5064        fdPHost         (6629b5f0e98151f4afdd87567ea32ba3) C:\Windows\system32\fdPHost.dll

12:31:10.0487 5064        fdPHost - ok

12:31:10.0518 5064        FDResPub        (89ed56dce8e47af40892778a5bd31fd2) C:\Windows\system32\fdrespub.dll

12:31:10.0627 5064        FDResPub - ok

12:31:10.0877 5064        FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys

12:31:10.0924 5064        FileInfo - ok

12:31:11.0345 5064        Filetrace       (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys

12:31:11.0407 5064        Filetrace - ok

12:31:11.0501 5064        flpydisk        (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys

12:31:11.0595 5064        flpydisk - ok

12:31:11.0641 5064        FltMgr          (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys

12:31:11.0673 5064        FltMgr - ok

12:31:11.0735 5064        FontCache       (8ce364388c8eca59b14b539179276d44) C:\Windows\system32\FntCache.dll

12:31:11.0860 5064        FontCache - ok

12:31:12.0031 5064        FontCache3.0.0.0 (c7fbdd1ed42f82bfa35167a5c9803ea3) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

12:31:12.0094 5064        FontCache3.0.0.0 - ok

12:31:12.0187 5064        FSCLBaseUpdaterService (6a4125edbe6d5907d4b1e4514f1f5675) C:\Program Files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe

12:31:12.0234 5064        FSCLBaseUpdaterService ( UnsignedFile.Multi.Generic ) - warning

12:31:12.0234 5064        FSCLBaseUpdaterService - detected UnsignedFile.Multi.Generic (1)

12:31:12.0453 5064        Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys

12:31:12.0499 5064        Fs_Rec - ok

12:31:12.0546 5064        gagp30kx        (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys

12:31:12.0562 5064        gagp30kx - ok

12:31:12.0687 5064        GEARAspiWDM     (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

12:31:12.0765 5064        GEARAspiWDM - ok

12:31:12.0827 5064        gpsvc           (cd5d0aeee35dfd4e986a5aa1500a6e66) C:\Windows\System32\gpsvc.dll

12:31:12.0921 5064        gpsvc - ok

12:31:12.0999 5064        HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys

12:31:13.0123 5064        HdAudAddService - ok

12:31:13.0295 5064        HDAudBus        (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys

12:31:13.0451 5064        HDAudBus - ok

12:31:13.0513 5064        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

12:31:13.0669 5064        HidBth - ok

12:31:13.0732 5064        HidIr           (d8df3722d5e961baa1292aa2f12827e2) C:\Windows\system32\DRIVERS\hidir.sys

12:31:13.0794 5064        HidIr - ok

12:31:13.0841 5064        hidserv         (84067081f3318162797385e11a8f0582) C:\Windows\system32\hidserv.dll

12:31:13.0872 5064        hidserv - ok

12:31:13.0935 5064        HidUsb          (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys

12:31:13.0981 5064        HidUsb - ok

12:31:14.0059 5064        hkmsvc          (d8ad255b37da92434c26e4876db7d418) C:\Windows\system32\kmsvc.dll

12:31:14.0137 5064        hkmsvc - ok

12:31:14.0200 5064        HpCISSs         (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys

12:31:14.0215 5064        HpCISSs - ok

12:31:14.0309 5064        HSFHWAZL        (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS

12:31:14.0356 5064        HSFHWAZL - ok

12:31:14.0434 5064        HsfXAudioService (1e7c79cbaf71aa92e0eee924907dcb55) C:\Windows\system32\XAudio32.dll

12:31:14.0496 5064        HsfXAudioService - ok

12:31:14.0590 5064        HSF_DPV         (efed6bd9b9d5f407adca918bbe2d410d) C:\Windows\system32\DRIVERS\HSX_DPV.sys

12:31:14.0683 5064        HSF_DPV - ok

12:31:14.0699 5064        HSXHWAZL        (c2eb8396c46e13f76037d70eae8820a9) C:\Windows\system32\DRIVERS\HSXHWAZL.sys

12:31:14.0746 5064        HSXHWAZL - ok

12:31:14.0793 5064        HTTP            (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys

12:31:14.0902 5064        HTTP - ok

12:31:14.0980 5064        i2omp           (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys

12:31:15.0011 5064        i2omp - ok

12:31:15.0073 5064        i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys

12:31:15.0136 5064        i8042prt - ok

12:31:15.0183 5064        iaStor          (2358c53f30cb9dcd1d3843c4e2f299b2) C:\Windows\system32\drivers\iastor.sys

12:31:15.0229 5064        iaStor - ok

12:31:15.0276 5064        iaStorV         (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys

12:31:15.0307 5064        iaStorV - ok

12:31:15.0495 5064        IDriverT        (daf66902f08796f9c694901660e5a64a) C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

12:31:15.0557 5064        IDriverT ( UnsignedFile.Multi.Generic ) - warning

12:31:15.0557 5064        IDriverT - detected UnsignedFile.Multi.Generic (1)

12:31:15.0635 5064        idsvc           (98477b08e61945f974ed9fdc4cb6bdab) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

12:31:15.0760 5064        idsvc - ok

12:31:15.0885 5064        iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

12:31:15.0900 5064        iirsp - ok

12:31:15.0963 5064        IKEEXT          (9908d8a397b76cd8d31d0d383c5773c9) C:\Windows\System32\ikeext.dll

12:31:16.0025 5064        IKEEXT - ok

12:31:16.0197 5064        IntcAzAudAddService (721b1a0434647418f98d034bebd4b4db) C:\Windows\system32\drivers\RTKVHDA.sys

12:31:16.0337 5064        IntcAzAudAddService - ok

12:31:16.0399 5064        intelide        (4a6b4c4fab7716c869fa9d19ac8ca5a5) C:\Windows\system32\drivers\intelide.sys

12:31:16.0415 5064        intelide - ok

12:31:16.0462 5064        intelppm        (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys

12:31:16.0540 5064        intelppm - ok

12:31:16.0602 5064        IPBusEnum       (9ac218c6e6105477484c6fdbe7d409a4) C:\Windows\system32\ipbusenum.dll

12:31:16.0649 5064        IPBusEnum - ok

12:31:16.0680 5064        IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys

12:31:16.0743 5064        IpFilterDriver - ok

12:31:16.0836 5064        iphlpsvc        (1998bd97f950680bb55f55a7244679c2) C:\Windows\System32\iphlpsvc.dll

12:31:16.0899 5064        iphlpsvc - ok

12:31:16.0914 5064        IpInIp - ok

12:31:16.0961 5064        IPMIDRV         (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys

12:31:17.0039 5064        IPMIDRV - ok

12:31:17.0086 5064        IPNAT           (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys

12:31:17.0164 5064        IPNAT - ok

12:31:17.0242 5064        iPod Service    (57edb35ea2feca88f8b17c0c095c9a56) C:\Program Files\iPod\bin\iPodService.exe

12:31:17.0335 5064        iPod Service - ok

12:31:17.0585 5064        IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys

12:31:17.0710 5064        IRENUM - ok

12:31:17.0788 5064        isapnp          (ce2997a0c3b0049a3188c4f0c7a04bc9) C:\Windows\system32\drivers\isapnp.sys

12:31:17.0850 5064        isapnp - ok

12:31:17.0928 5064        iScsiPrt        (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys

12:31:17.0991 5064        iScsiPrt - ok

12:31:18.0069 5064        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

12:31:18.0100 5064        iteatapi - ok

12:31:18.0131 5064        iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

12:31:18.0147 5064        iteraid - ok

12:31:18.0271 5064        IviRegMgr       (213822072085b5bbad9af30ab577d817) c:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

12:31:18.0303 5064        IviRegMgr - ok

12:31:18.0334 5064        JRAID           (c1632fe31d1824a43dea29725312e3fa) C:\Windows\system32\drivers\jraid.sys

12:31:18.0396 5064        JRAID - ok

12:31:18.0443 5064        kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys

12:31:18.0459 5064        kbdclass - ok

12:31:18.0505 5064        kbdhid          (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys

12:31:18.0568 5064        kbdhid - ok

12:31:18.0615 5064        KeyIso          (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe

12:31:18.0677 5064        KeyIso - ok

12:31:18.0755 5064        KMWDFILTER      (566c5fd480fdbce3ba5cf9fbcffaea9a) C:\Windows\system32\DRIVERS\KMWDFILTER.sys

12:31:18.0786 5064        KMWDFILTER ( UnsignedFile.Multi.Generic ) - warning

12:31:18.0786 5064        KMWDFILTER - detected UnsignedFile.Multi.Generic (1)

12:31:18.0849 5064        KSecDD          (2b2f1638466e8cb091400c9019cc730e) C:\Windows\system32\Drivers\ksecdd.sys

12:31:18.0973 5064        KSecDD - ok

12:31:19.0036 5064        KtmRm           (8078f8f8f7a79e2e6b494523a828c585) C:\Windows\system32\msdtckrm.dll

12:31:19.0114 5064        KtmRm - ok

12:31:19.0161 5064        LanmanServer    (1bf5eebfd518dd7298434d8c862f825d) C:\Windows\system32\srvsvc.dll

12:31:19.0192 5064        LanmanServer - ok

12:31:19.0239 5064        LanmanWorkstation (1db69705b695b987082c8baec0c6b34f) C:\Windows\System32\wkssvc.dll

12:31:19.0301 5064        LanmanWorkstation - ok

12:31:19.0379 5064        lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys

12:31:19.0441 5064        lltdio - ok

12:31:19.0488 5064        lltdsvc         (2d5a428872f1442631d0959a34abff63) C:\Windows\System32\lltdsvc.dll

12:31:19.0551 5064        lltdsvc - ok

12:31:19.0582 5064        lmhosts         (35d40113e4a5b961b6ce5c5857702518) C:\Windows\System32\lmhsvc.dll

12:31:19.0675 5064        lmhosts - ok

12:31:19.0738 5064        LSI_FC          (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys

12:31:19.0753 5064        LSI_FC - ok

12:31:19.0785 5064        LSI_SAS         (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys

12:31:19.0800 5064        LSI_SAS - ok

12:31:19.0831 5064        LSI_SCSI        (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys

12:31:19.0863 5064        LSI_SCSI - ok

12:31:19.0894 5064        luafv           (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys

12:31:19.0987 5064        luafv - ok

12:31:19.0987 5064        lxbs_device - ok

12:31:20.0034 5064        Mcx2Svc         (aef9babb8a506bc4ce0451a64aaded46) C:\Windows\system32\Mcx2Svc.dll

12:31:20.0097 5064        Mcx2Svc - ok

12:31:20.0268 5064        MDM             (11f714f85530a2bd134074dc30e99fca) C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

12:31:20.0331 5064        MDM - ok

12:31:20.0377 5064        mdmxsdk         (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys

12:31:20.0424 5064        mdmxsdk - ok

12:31:20.0487 5064        megasas         (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys

12:31:20.0502 5064        megasas - ok

12:31:20.0549 5064        MEMSWEEP2 - ok

12:31:20.0580 5064        MMCSS           (1076ffcffaae8385fd62dfcb25ac4708) C:\Windows\system32\mmcss.dll

12:31:20.0627 5064        MMCSS - ok

12:31:20.0658 5064        Modem           (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys

12:31:20.0721 5064        Modem - ok

12:31:20.0767 5064        monitor         (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys

12:31:20.0799 5064        monitor - ok

12:31:20.0845 5064        mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys

12:31:20.0861 5064        mouclass - ok

12:31:20.0908 5064        mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys

12:31:20.0939 5064        mouhid - ok

12:31:20.0986 5064        MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys

12:31:21.0001 5064        MountMgr - ok

12:31:21.0048 5064        mpio            (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys

12:31:21.0079 5064        mpio - ok

12:31:21.0126 5064        mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys

12:31:21.0157 5064        mpsdrv - ok

12:31:21.0251 5064        MpsSvc          (5de62c6e9108f14f6794060a9bdecaec) C:\Windows\system32\mpssvc.dll

12:31:21.0329 5064        MpsSvc - ok

12:31:21.0391 5064        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

12:31:21.0407 5064        Mraid35x - ok

12:31:21.0454 5064        MRxDAV          (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys

12:31:21.0516 5064        MRxDAV - ok

12:31:21.0547 5064        mrxsmb          (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys

12:31:21.0563 5064        mrxsmb - ok

12:31:21.0625 5064        mrxsmb10        (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys

12:31:21.0672 5064        mrxsmb10 - ok

12:31:21.0719 5064        mrxsmb20        (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

12:31:21.0781 5064        mrxsmb20 - ok

12:31:21.0859 5064        msahci          (13fa01d10c95762e3e191bb023dfa8cc) C:\Windows\system32\drivers\msahci.sys

12:31:21.0922 5064        msahci - ok

12:31:22.0000 5064        msdsm           (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys

12:31:22.0015 5064        msdsm - ok

12:31:22.0109 5064        MSDTC           (fd7520cc3a80c5fc8c48852bb24c6ded) C:\Windows\System32\msdtc.exe

12:31:22.0171 5064        MSDTC - ok

12:31:22.0218 5064        Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys

12:31:22.0281 5064        Msfs - ok

12:31:22.0343 5064        msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys

12:31:22.0359 5064        msisadrv - ok

12:31:22.0390 5064        MSiSCSI         (85466c0757a23d9a9aecdc0755203cb2) C:\Windows\system32\iscsiexe.dll

12:31:22.0468 5064        MSiSCSI - ok

12:31:22.0468 5064        msiserver - ok

12:31:22.0515 5064        MSKSSRV         (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys

12:31:22.0561 5064        MSKSSRV - ok

12:31:22.0608 5064        MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys

12:31:22.0655 5064        MSPCLOCK - ok

12:31:22.0702 5064        MSPQM           (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys

12:31:22.0733 5064        MSPQM - ok

12:31:22.0780 5064        MsRPC           (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys

12:31:22.0795 5064        MsRPC - ok

12:31:22.0858 5064        mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys

12:31:22.0873 5064        mssmbios - ok

12:31:22.0936 5064        MSTEE           (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys

12:31:22.0967 5064        MSTEE - ok

12:31:23.0014 5064        Mup             (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys

12:31:23.0029 5064        Mup - ok

12:31:23.0092 5064        napagent        (e4eaf0c5c1b41b5c83386cf212ca9584) C:\Windows\system32\qagentRT.dll

12:31:23.0139 5064        napagent - ok

12:31:23.0185 5064        NativeWifiP     (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys

12:31:23.0217 5064        NativeWifiP - ok

12:31:23.0326 5064        NBService       (3bae2bfcb6d69e19c8373f635dd544dc) C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

12:31:23.0404 5064        NBService - ok

12:31:23.0513 5064        NDIS            (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys

12:31:23.0653 5064        NDIS - ok

12:31:23.0747 5064        NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys

12:31:23.0809 5064        NdisTapi - ok

12:31:23.0841 5064        Ndisuio         (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys

12:31:23.0887 5064        Ndisuio - ok

12:31:23.0934 5064        NdisWan         (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys

12:31:23.0997 5064        NdisWan - ok

12:31:24.0028 5064        NDProxy         (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys

12:31:24.0090 5064        NDProxy - ok

12:31:24.0137 5064        NetBIOS         (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys

12:31:24.0184 5064        NetBIOS - ok

12:31:24.0246 5064        netbt           (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys

12:31:24.0309 5064        netbt - ok

12:31:24.0355 5064        Netlogon        (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe

12:31:24.0371 5064        Netlogon - ok

12:31:24.0433 5064        Netman          (c8052711daecc48b982434c5116ca401) C:\Windows\System32\netman.dll

12:31:24.0558 5064        Netman - ok

12:31:24.0605 5064        netprofm        (2ef3bbe22e5a5acd1428ee387a0d0172) C:\Windows\System32\netprofm.dll

12:31:24.0667 5064        netprofm - ok

12:31:24.0714 5064        NetTcpPortSharing (d6c4e4a39a36029ac0813d476fbd0248) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

12:31:24.0745 5064        NetTcpPortSharing - ok

12:31:24.0792 5064        nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

12:31:24.0808 5064        nfrd960 - ok

12:31:24.0870 5064        NlaSvc          (2997b15415f9bbe05b5a4c1c85e0c6a2) C:\Windows\System32\nlasvc.dll

12:31:24.0917 5064        NlaSvc - ok

12:31:25.0042 5064        NMIndexingService (193fa51dddd0bffded1c340f0434999a) C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

12:31:25.0073 5064        NMIndexingService - ok

12:31:25.0167 5064        Npfs            (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys

12:31:25.0213 5064        Npfs - ok

12:31:25.0276 5064        nsi             (8bb86f0c7eea2bded6fe095d0b4ca9bd) C:\Windows\system32\nsisvc.dll

12:31:25.0338 5064        nsi - ok

12:31:25.0385 5064        nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys

12:31:25.0416 5064        nsiproxy - ok

12:31:25.0479 5064        Ntfs            (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys

12:31:25.0619 5064        Ntfs - ok

12:31:25.0697 5064        ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

12:31:25.0759 5064        ntrigdigi - ok

12:31:25.0806 5064        Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys

12:31:25.0869 5064        Null - ok

12:31:25.0947 5064        NVENETFD        (ae78a7285df03a277415fc62f8ce8f24) C:\Windows\system32\DRIVERS\nvmfdx32.sys

12:31:26.0071 5064        NVENETFD - ok

12:31:26.0493 5064        nvlddmkm        (118a7a2231c33a2c92758ba324a711cd) C:\Windows\system32\DRIVERS\nvlddmkm.sys

12:31:27.0288 5064        nvlddmkm - ok

12:31:27.0398 5064        nvraid          (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys

12:31:27.0430 5064        nvraid - ok

12:31:27.0523 5064        nvrd32          (ed399014a8029de02ba5ae01da8cc9ee) C:\Windows\system32\drivers\nvrd32.sys

12:31:27.0539 5064        nvrd32 - ok

12:31:27.0586 5064        nvsmu           (adfdd343b1d3a9e061f17c730f1e83dc) C:\Windows\system32\DRIVERS\nvsmu.sys

12:31:27.0632 5064        nvsmu - ok

12:31:27.0679 5064        nvstor          (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys

12:31:27.0695 5064        nvstor - ok

12:31:27.0742 5064        nvstor32        (dc5f166422beebf195e3e4bb8ab4ee22) C:\Windows\system32\DRIVERS\nvstor32.sys

12:31:27.0757 5064        nvstor32 - ok

12:31:27.0882 5064        nvsvc           (33526b0de74fa58621d4dfefb63b50b6) C:\Windows\system32\nvvsvc.exe

12:31:27.0898 5064        nvsvc - ok

12:31:27.0976 5064        nv_agp          (925eb9e53eca4473a2d156a02b7418e3) C:\Windows\system32\drivers\nv_agp.sys

12:31:28.0007 5064        nv_agp - ok

12:31:28.0022 5064        NwlnkFlt - ok

12:31:28.0038 5064        NwlnkFwd - ok

12:31:28.0100 5064        ohci1394        (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys

12:31:28.0163 5064        ohci1394 - ok

12:31:28.0225 5064        p2pimsvc        (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll

12:31:28.0319 5064        p2pimsvc - ok

12:31:28.0350 5064        p2psvc          (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll

12:31:28.0412 5064        p2psvc - ok

12:31:28.0476 5064        Parport         (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys

12:31:28.0569 5064        Parport - ok

12:31:28.0616 5064        partmgr         (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys

12:31:28.0632 5064        partmgr - ok

12:31:28.0663 5064        Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys

12:31:28.0741 5064        Parvdm - ok

12:31:28.0788 5064        PcaSvc          (c6276ad11f4bb49b58aa1ed88537f14a) C:\Windows\System32\pcasvc.dll

12:31:28.0835 5064        PcaSvc - ok

12:31:28.0897 5064        pci             (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys

12:31:28.0913 5064        pci - ok

12:31:28.0975 5064        pciide          (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys

12:31:28.0991 5064        pciide - ok

12:31:29.0037 5064        pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys

12:31:29.0069 5064        pcmcia - ok

12:31:29.0115 5064        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

12:31:29.0303 5064        PEAUTH - ok

12:31:29.0412 5064        pla             (b1689df169143f57053f795390c99db3) C:\Windows\system32\pla.dll

12:31:29.0600 5064        pla - ok

12:31:29.0647 5064        PLFlash DeviceIoControl Service (875e4e0661f3a5994df9e5e3a0a4f96b) C:\Windows\system32\IoctlSvc.exe

12:31:29.0662 5064        PLFlash DeviceIoControl Service ( UnsignedFile.Multi.Generic ) - warning

12:31:29.0662 5064        PLFlash DeviceIoControl Service - detected UnsignedFile.Multi.Generic (1)

12:31:29.0725 5064        PlugPlay        (c5e7f8a996ec0a82d508fd9064a5569e) C:\Windows\system32\umpnpmgr.dll

12:31:29.0803 5064        PlugPlay - ok

12:31:29.0865 5064        PNRPAutoReg     (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll

12:31:29.0912 5064        PNRPAutoReg - ok

12:31:29.0959 5064        PNRPsvc         (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll

12:31:30.0037 5064        PNRPsvc - ok

12:31:30.0084 5064        PolicyAgent     (d0494460421a03cd5225cca0059aa146) C:\Windows\System32\ipsecsvc.dll

12:31:30.0177 5064        PolicyAgent - ok

12:31:30.0208 5064        PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys

12:31:30.0271 5064        PptpMiniport - ok

12:31:30.0318 5064        Processor       (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys

12:31:30.0380 5064        Processor - ok

12:31:30.0474 5064        ProfSvc         (0508faa222d28835310b7bfca7a77346) C:\Windows\system32\profsvc.dll

12:31:30.0520 5064        ProfSvc - ok

12:31:30.0567 5064        ProtectedStorage (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe

12:31:30.0598 5064        ProtectedStorage - ok

12:31:30.0661 5064        PSched          (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys

12:31:30.0754 5064        PSched - ok

12:31:30.0848 5064        ql2300          (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys

12:31:30.0957 5064        ql2300 - ok

12:31:30.0988 5064        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

12:31:31.0020 5064        ql40xx - ok

12:31:31.0082 5064        QWAVE           (e9ecae663f47e6cb43962d18ab18890f) C:\Windows\system32\qwave.dll

12:31:31.0129 5064        QWAVE - ok

12:31:31.0160 5064        QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys

12:31:31.0191 5064        QWAVEdrv - ok

12:31:31.0238 5064        RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys

12:31:31.0300 5064        RasAcd - ok

12:31:31.0332 5064        RasAuto         (f6a452eb4ceadbb51c9e0ee6b3ecef0f) C:\Windows\System32\rasauto.dll

12:31:31.0410 5064        RasAuto - ok

12:31:31.0472 5064        Rasl2tp         (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys

12:31:31.0519 5064        Rasl2tp - ok

12:31:31.0566 5064        RasMan          (75d47445d70ca6f9f894b032fbc64fcf) C:\Windows\System32\rasmans.dll

12:31:31.0612 5064        RasMan - ok

12:31:31.0644 5064        RasPppoe        (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys

12:31:31.0675 5064        RasPppoe - ok

12:31:31.0706 5064        RasSstp         (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys

12:31:31.0737 5064        RasSstp - ok

12:31:31.0784 5064        rdbss           (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys

12:31:31.0831 5064        rdbss - ok

12:31:31.0878 5064        RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys

12:31:31.0924 5064        RDPCDD - ok

12:31:31.0987 5064        rdpdr           (87ee019fe9fbff071d76ccf9ec794646) C:\Windows\system32\drivers\rdpdr.sys

12:31:32.0018 5064        rdpdr - ok

12:31:32.0034 5064        RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys

12:31:32.0080 5064        RDPENCDD - ok

12:31:32.0127 5064        RDPWD           (79c6df8477250f5c54f7c5ae1d6b814e) C:\Windows\system32\drivers\RDPWD.sys

12:31:32.0190 5064        RDPWD - ok

12:31:32.0236 5064        RemoteAccess    (bcdd6b4804d06b1f7ebf29e53a57ece9) C:\Windows\System32\mprdim.dll

12:31:32.0268 5064        RemoteAccess - ok

12:31:32.0330 5064        RemoteRegistry  (9e6894ea18daff37b63e1005f83ae4ab) C:\Windows\system32\regsvc.dll

12:31:32.0361 5064        RemoteRegistry - ok

12:31:32.0424 5064        RFCOMM          (6482707f9f4da0ecbab43b2e0398a101) C:\Windows\system32\DRIVERS\rfcomm.sys

12:31:32.0502 5064        RFCOMM - ok

12:31:32.0595 5064        RichVideo       (17e0bef5ca5c9ce52cc8082ac6ebc449) C:\Program Files\CyberLink\Shared Files\RichVideo.exe

12:31:32.0673 5064        RichVideo - ok

12:31:32.0751 5064        RpcLocator      (5123f83cbc4349d065534eeb6bbdc42b) C:\Windows\system32\locator.exe

12:31:32.0782 5064        RpcLocator - ok

12:31:32.0892 5064        RpcSs           (3b5b4d53fec14f7476ca29a20cc31ac9) C:\Windows\system32\rpcss.dll

12:31:32.0954 5064        RpcSs - ok

12:31:33.0001 5064        rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys

12:31:33.0063 5064        rspndr - ok

12:31:33.0094 5064        SamSs           (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe

12:31:33.0110 5064        SamSs - ok

12:31:33.0188 5064        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

12:31:33.0219 5064        sbp2port - ok

12:31:33.0266 5064        SCardSvr        (77b7a11a0c3d78d3386398fbbea1b632) C:\Windows\System32\SCardSvr.dll

12:31:33.0297 5064        SCardSvr - ok

12:31:33.0360 5064        Schedule        (1a58069db21d05eb2ab58ee5753ebe8d) C:\Windows\system32\schedsvc.dll

12:31:33.0531 5064        Schedule - ok

12:31:33.0562 5064        SCPolicySvc     (312ec3e37a0a1f2006534913e37b4423) C:\Windows\System32\certprop.dll

12:31:33.0578 5064        SCPolicySvc - ok

12:31:33.0625 5064        SDRSVC          (716313d9f6b0529d03f726d5aaf6f191) C:\Windows\System32\SDRSVC.dll

12:31:33.0703 5064        SDRSVC - ok

12:31:33.0750 5064        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

12:31:33.0843 5064        secdrv - ok

12:31:33.0874 5064        seclogon        (fd5199d4d8a521005e4b5ee7fe00fa9b) C:\Windows\system32\seclogon.dll

12:31:33.0952 5064        seclogon - ok

12:31:33.0999 5064        SENS            (a9bbab5759771e523f55563d6cbe140f) C:\Windows\System32\sens.dll

12:31:34.0077 5064        SENS - ok

12:31:34.0140 5064        Serenum         (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys

12:31:34.0218 5064        Serenum - ok

12:31:34.0249 5064        Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys

12:31:34.0358 5064        Serial - ok

12:31:34.0389 5064        sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys

12:31:34.0420 5064        sermouse - ok

12:31:34.0483 5064        SessionEnv      (d2193326f729b163125610dbf3e17d57) C:\Windows\system32\sessenv.dll

12:31:34.0530 5064        SessionEnv - ok

12:31:34.0576 5064        sffdisk         (55b145d4248012d306da8e92fa9fdc20) C:\Windows\system32\drivers\sffdisk.sys

12:31:34.0639 5064        sffdisk - ok

12:31:34.0686 5064        sffp_mmc        (b86dfcd55294a0495571a27b861e6ef3) C:\Windows\system32\drivers\sffp_mmc.sys

12:31:34.0717 5064        sffp_mmc - ok

12:31:34.0764 5064        sffp_sd         (5b327b59fae2b01c34690d91ed03786e) C:\Windows\system32\drivers\sffp_sd.sys

12:31:34.0826 5064        sffp_sd - ok

12:31:34.0904 5064        sfloppy         (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys

12:31:34.0998 5064        sfloppy - ok

12:31:36.0121 5064        SharedAccess    (e1499bd0ff76b1b2fbbf1af339d91165) C:\Windows\System32\ipnathlp.dll

12:31:36.0214 5064        SharedAccess - ok

12:31:36.0292 5064        ShellHWDetection (c7230fbee14437716701c15be02c27b8) C:\Windows\System32\shsvcs.dll

12:31:36.0370 5064        ShellHWDetection - ok

12:31:36.0402 5064        sisagp          (e5773c4cff310d00a59db01ef4074135) C:\Windows\system32\drivers\sisagp.sys

12:31:36.0433 5064        sisagp - ok

12:31:36.0495 5064        SiSRaid2        (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys

12:31:36.0511 5064        SiSRaid2 - ok

12:31:36.0558 5064        SiSRaid4        (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys

12:31:36.0573 5064        SiSRaid4 - ok

12:31:36.0620 5064        slabbus         (00746035c28e913fb14bc0c94205c863) C:\Windows\system32\DRIVERS\slabbus.sys

12:31:36.0682 5064        slabbus - ok

12:31:36.0729 5064        slabser         (c471a21df9a26deb2ff5e8eccb4db622) C:\Windows\system32\DRIVERS\slabser.sys

12:31:36.0807 5064        slabser - ok

12:31:36.0963 5064        slsvc           (862bb4cbc05d80c5b45be430e5ef872f) C:\Windows\system32\SLsvc.exe

12:31:37.0228 5064        slsvc - ok

12:31:37.0260 5064        SLUINotify      (6edc422215cd78aa8a9cde6b30abbd35) C:\Windows\system32\SLUINotify.dll

12:31:37.0322 5064        SLUINotify - ok

12:31:37.0369 5064        Smb             (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys

12:31:37.0400 5064        Smb - ok

12:31:37.0462 5064        smscirrx        (ebff8386c79c33c64cc560c8c03fb707) C:\Windows\system32\DRIVERS\smscirrx.sys

12:31:37.0509 5064        smscirrx - ok

12:31:37.0572 5064        SNMPTRAP        (2a146a055b4401c16ee62d18b8e2a032) C:\Windows\System32\snmptrap.exe

12:31:37.0618 5064        SNMPTRAP - ok

12:31:37.0665 5064        spldr           (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys

12:31:37.0681 5064        spldr - ok

12:31:37.0743 5064        Spooler         (8554097e5136c3bf9f69fe578a1b35f4) C:\Windows\System32\spoolsv.exe

12:31:37.0821 5064        Spooler - ok

12:31:37.0915 5064        sptd            (71e276f6d189413266ea22171806597b) C:\Windows\System32\Drivers\sptd.sys

12:31:38.0118 5064        sptd - ok

12:31:38.0289 5064        srv             (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys

12:31:38.0383 5064        srv - ok

12:31:38.0445 5064        srv2            (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys

12:31:38.0554 5064        srv2 - ok

12:31:38.0757 5064        srvnet          (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys

12:31:38.0820 5064        srvnet - ok

12:31:39.0100 5064        SSDPSRV         (03d50b37234967433a5ea5ba72bc0b62) C:\Windows\System32\ssdpsrv.dll

12:31:39.0210 5064        SSDPSRV - ok

12:31:39.0303 5064        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys

12:31:39.0319 5064        ssmdrv - ok

12:31:39.0366 5064        SstpSvc         (6f1a32e7b7b30f004d9a20afadb14944) C:\Windows\system32\sstpsvc.dll

12:31:39.0397 5064        SstpSvc - ok

12:31:39.0568 5064        stisvc          (5de7d67e49b88f5f07f3e53c4b92a352) C:\Windows\System32\wiaservc.dll

12:31:39.0646 5064        stisvc - ok

12:31:39.0787 5064        swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys

12:31:39.0834 5064        swenum - ok

12:31:40.0005 5064        swprv           (f21fd248040681cca1fb6c9a03aaa93d) C:\Windows\System32\swprv.dll

12:31:40.0114 5064        swprv - ok

12:31:40.0161 5064        Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

12:31:40.0177 5064        Symc8xx - ok

12:31:40.0224 5064        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

12:31:40.0239 5064        Sym_hi - ok

12:31:40.0364 5064        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

12:31:40.0380 5064        Sym_u3 - ok

12:31:40.0582 5064        SysMain         (9a51b04e9886aa4ee90093586b0ba88d) C:\Windows\system32\sysmain.dll

12:31:40.0707 5064        SysMain - ok

12:31:40.0770 5064        TabletInputService (2dca225eae15f42c0933e998ee0231c3) C:\Windows\System32\TabSvc.dll

12:31:40.0801 5064        TabletInputService - ok

12:31:40.0926 5064        TapiSrv         (d7673e4b38ce21ee54c59eeeb65e2483) C:\Windows\System32\tapisrv.dll

12:31:40.0972 5064        TapiSrv - ok

12:31:41.0019 5064        TBS             (cb05822cd9cc6c688168e113c603dbe7) C:\Windows\System32\tbssvc.dll

12:31:41.0082 5064        TBS - ok

12:31:41.0160 5064        Tcpip           (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys

12:31:41.0316 5064        Tcpip - ok

12:31:41.0425 5064        Tcpip6          (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys

12:31:41.0487 5064        Tcpip6 - ok

12:31:41.0565 5064        tcpipreg        (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys

12:31:41.0612 5064        tcpipreg - ok

12:31:41.0659 5064        TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys

12:31:41.0721 5064        TDPIPE - ok

12:31:41.0799 5064        TDslMgrService  (1226a953d4fdbdfd570da5cee66eaa55) C:\Program Files\DSL-Manager\DslMgrSvc.exe

12:31:41.0862 5064        TDslMgrService ( UnsignedFile.Multi.Generic ) - warning

12:31:41.0862 5064        TDslMgrService - detected UnsignedFile.Multi.Generic (1)

12:31:41.0940 5064        TDTCP           (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys

12:31:41.0986 5064        TDTCP - ok

12:31:42.0174 5064        tdx             (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys

12:31:42.0267 5064        tdx - ok

12:31:42.0314 5064        TermDD          (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys

12:31:42.0345 5064        TermDD - ok

12:31:42.0486 5064        TermService     (bb95da09bef6e7a131bff3ba5032090d) C:\Windows\System32\termsrv.dll

12:31:42.0564 5064        TermService - ok

12:31:42.0798 5064        TestHandler     (8c80a73a5d77b2208ca91e4fa269981d) C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe

12:31:42.0860 5064        TestHandler ( UnsignedFile.Multi.Generic ) - warning

12:31:42.0860 5064        TestHandler - detected UnsignedFile.Multi.Generic (1)

12:31:43.0359 5064        Themes          (c7230fbee14437716701c15be02c27b8) C:\Windows\system32\shsvcs.dll

12:31:43.0406 5064        Themes - ok

12:31:43.0562 5064        THREADORDER     (1076ffcffaae8385fd62dfcb25ac4708) C:\Windows\system32\mmcss.dll

12:31:43.0640 5064        THREADORDER - ok

12:31:43.0718 5064        TridVid         (171f41174a88f71e7234d7a48303c6a0) C:\Windows\system32\DRIVERS\TridVid.sys

12:31:43.0765 5064        TridVid ( UnsignedFile.Multi.Generic ) - warning

12:31:43.0765 5064        TridVid - detected UnsignedFile.Multi.Generic (1)

12:31:43.0812 5064        TrkWks          (ec74e77d0eb004bd3a809b5f8fb8c2ce) C:\Windows\System32\trkwks.dll

12:31:43.0905 5064        TrkWks - ok

12:31:43.0968 5064        TrustedInstaller (97d9d6a04e3ad9b6c626b9931db78dba) C:\Windows\servicing\TrustedInstaller.exe

12:31:44.0030 5064        TrustedInstaller - ok

12:31:44.0420 5064        tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys

12:31:44.0514 5064        tssecsrv - ok

12:31:44.0732 5064        tunmp           (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys

12:31:44.0779 5064        tunmp - ok

12:31:44.0857 5064        tunnel          (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys

12:31:44.0904 5064        tunnel - ok

12:31:44.0950 5064        uagp35          (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys

12:31:44.0982 5064        uagp35 - ok

12:31:45.0044 5064        udfs            (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys

12:31:45.0106 5064        udfs - ok

12:31:45.0169 5064        UI0Detect       (ecef404f62863755951e09c802c94ad5) C:\Windows\system32\UI0Detect.exe

12:31:45.0216 5064        UI0Detect - ok

12:31:45.0262 5064        uliagpkx        (5895ef4d0f1424392ee6439250e25677) C:\Windows\system32\drivers\uliagpkx.sys

12:31:45.0278 5064        uliagpkx - ok

12:31:45.0340 5064        uliahci         (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys

12:31:45.0372 5064        uliahci - ok

12:31:45.0403 5064        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

12:31:45.0434 5064        UlSata - ok

12:31:45.0465 5064        ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

12:31:45.0512 5064        ulsata2 - ok

12:31:45.0559 5064        umbus           (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys

12:31:45.0590 5064        umbus - ok

12:31:45.0715 5064        upnphost        (68308183f4ae0be7bf8ecd07cb297999) C:\Windows\System32\upnphost.dll

12:31:45.0762 5064        upnphost - ok

12:31:45.0855 5064        usbaudio        (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys

12:31:45.0933 5064        usbaudio - ok

12:31:45.0996 5064        usbccgp         (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys

12:31:46.0042 5064        usbccgp - ok

12:31:46.0105 5064        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

12:31:46.0183 5064        usbcir - ok

12:31:46.0276 5064        usbehci         (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys

12:31:46.0308 5064        usbehci - ok

12:31:46.0370 5064        usbhub          (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys

12:31:46.0401 5064        usbhub - ok

12:31:46.0479 5064        usbohci         (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys

12:31:46.0542 5064        usbohci - ok

12:31:46.0588 5064        usbprint        (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys

12:31:46.0682 5064        usbprint - ok

12:31:46.0744 5064        usbscan         (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys

12:31:46.0822 5064        usbscan - ok

12:31:46.0854 5064        USBSTOR         (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS

12:31:46.0885 5064        USBSTOR - ok

12:31:46.0932 5064        usbuhci         (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys

12:31:47.0010 5064        usbuhci - ok

12:31:47.0056 5064        UxSms           (1509e705f3ac1d474c92454a5c2dd81f) C:\Windows\System32\uxsms.dll

12:31:47.0088 5064        UxSms - ok

12:31:47.0134 5064        vds             (cd88d1b7776dc17a119049742ec07eb4) C:\Windows\System32\vds.exe

12:31:47.0212 5064        vds - ok

12:31:47.0275 5064        vga             (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys

12:31:47.0353 5064        vga - ok

12:31:47.0431 5064        VgaSave         (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys

12:31:47.0478 5064        VgaSave - ok

12:31:47.0540 5064        viaagp          (66e64d5cbeb047c90e65f0962483a5b2) C:\Windows\system32\drivers\viaagp.sys

12:31:47.0571 5064        viaagp - ok

12:31:47.0634 5064        ViaC7           (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys

12:31:47.0727 5064        ViaC7 - ok

12:31:47.0790 5064        viaide          (7100b56688c5d6d7695d18fd001f0cd6) C:\Windows\system32\drivers\viaide.sys

12:31:47.0805 5064        viaide - ok

12:31:47.0883 5064        viamraid        (7dc3e1dc6e4f8be381c31bfea578412a) C:\Windows\system32\drivers\viamraid.sys

12:31:47.0930 5064        viamraid - ok

12:31:47.0977 5064        volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys

12:31:48.0008 5064        volmgr - ok

12:31:48.0055 5064        volmgrx         (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys

12:31:48.0086 5064        volmgrx - ok

12:31:48.0133 5064        volsnap         (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys

12:31:48.0180 5064        volsnap - ok

12:31:48.0226 5064        vsmraid         (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys

12:31:48.0242 5064        vsmraid - ok

12:31:48.0414 5064        VSS             (db3d19f850c6eb32bdcb9bc0836acddb) C:\Windows\system32\vssvc.exe

12:31:48.0601 5064        VSS - ok

12:31:48.0757 5064        W32Time         (96ea68b9eb310a69c25ebb0282b2b9de) C:\Windows\system32\w32time.dll

12:31:48.0819 5064        W32Time - ok

12:31:48.0866 5064        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

12:31:48.0944 5064        WacomPen - ok

12:31:48.0991 5064        Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

12:31:49.0053 5064        Wanarp - ok

12:31:49.0069 5064        Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

12:31:49.0084 5064        Wanarpv6 - ok

12:31:49.0178 5064        wcncsvc         (a3cd60fd826381b49f03832590e069af) C:\Windows\System32\wcncsvc.dll

12:31:49.0225 5064        wcncsvc - ok

12:31:49.0287 5064        WcsPlugInService (11bcb7afcdd7aadacb5746f544d3a9c7) C:\Windows\System32\WcsPlugInService.dll

12:31:49.0334 5064        WcsPlugInService - ok

12:31:49.0396 5064        Wd              (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys

12:31:49.0428 5064        Wd - ok

12:31:49.0568 5064        Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys

12:31:49.0630 5064        Wdf01000 - ok

12:31:49.0662 5064        WdiServiceHost  (abfc76b48bb6c96e3338d8943c5d93b5) C:\Windows\system32\wdi.dll

12:31:49.0708 5064        WdiServiceHost - ok

12:31:49.0708 5064        WdiSystemHost   (abfc76b48bb6c96e3338d8943c5d93b5) C:\Windows\system32\wdi.dll

12:31:49.0755 5064        WdiSystemHost - ok

12:31:49.0833 5064        WebClient       (04c37d8107320312fbae09926103d5e2) C:\Windows\System32\webclnt.dll

12:31:49.0880 5064        WebClient - ok

12:31:49.0942 5064        Wecsvc          (ae3736e7e8892241c23e4ebbb7453b60) C:\Windows\system32\wecsvc.dll

12:31:50.0036 5064        Wecsvc - ok

12:31:50.0067 5064        wercplsupport   (670ff720071ed741206d69bd995ea453) C:\Windows\System32\wercplsupport.dll

12:31:50.0114 5064        wercplsupport - ok

12:31:50.0176 5064        WerSvc          (32b88481d3b326da6deb07b1d03481e7) C:\Windows\System32\WerSvc.dll

12:31:50.0239 5064        WerSvc - ok

12:31:50.0332 5064        winachsf        (d0116c473ef3c381a42bb55036a1adb1) C:\Windows\system32\DRIVERS\HSX_CNXT.sys

12:31:50.0410 5064        winachsf - ok

12:31:50.0566 5064        WinDefend       (4575aa12561c5648483403541d0d7f2b) C:\Program Files\Windows Defender\mpsvc.dll

12:31:50.0644 5064        WinDefend - ok

12:31:50.0676 5064        WinHttpAutoProxySvc - ok

12:31:51.0190 5064        WINIO           (819c68ff6c4c63886d636ffb2dabf5ef) C:\Windows\system32\WinIo.sys

12:31:51.0253 5064        WINIO ( UnsignedFile.Multi.Generic ) - warning

12:31:51.0253 5064        WINIO - detected UnsignedFile.Multi.Generic (1)

12:31:51.0346 5064        Winmgmt         (6b2a1d0e80110e3d04e6863c6e62fd8a) C:\Windows\system32\wbem\WMIsvc.dll

12:31:51.0424 5064        Winmgmt - ok

12:31:51.0518 5064        WinRM           (7cfe68bdc065e55aa5e8421607037511) C:\Windows\system32\WsmSvc.dll

12:31:51.0705 5064        WinRM - ok

12:31:51.0814 5064        Wlansvc         (c008405e4feeb069e30da1d823910234) C:\Windows\System32\wlansvc.dll

12:31:51.0924 5064        Wlansvc - ok

12:31:52.0017 5064        WmiAcpi         (17eac0d023a65fa9b02114cc2baacad5) C:\Windows\system32\drivers\wmiacpi.sys

12:31:52.0048 5064        WmiAcpi - ok

12:31:52.0173 5064        wmiApSrv        (43be3875207dcb62a85c8c49970b66cc) C:\Windows\system32\wbem\WmiApSrv.exe

12:31:52.0220 5064        wmiApSrv - ok

12:31:52.0407 5064        WMPNetworkSvc   (3978704576a121a9204f8cc49a301a9b) C:\Program Files\Windows Media Player\wmpnetwk.exe

12:31:52.0579 5064        WMPNetworkSvc - ok

12:31:52.0828 5064        WPCSvc          (cfc5a04558f5070cee3e3a7809f3ff52) C:\Windows\System32\wpcsvc.dll

12:31:52.0938 5064        WPCSvc - ok

12:31:53.0016 5064        WPDBusEnum      (801fbdb89d472b3c467eb112a0fc9246) C:\Windows\system32\wpdbusenum.dll

12:31:53.0078 5064        WPDBusEnum - ok

12:31:53.0203 5064        WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

12:31:53.0265 5064        WPFFontCache_v0400 - ok

12:31:53.0343 5064        ws2ifsl         (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys

12:31:53.0406 5064        ws2ifsl - ok

12:31:53.0499 5064        wscsvc          (1ca6c40261ddc0425987980d0cd2aaab) C:\Windows\System32\wscsvc.dll

12:31:53.0546 5064        wscsvc - ok

12:31:53.0640 5064        WSDPrintDevice  (4422ac5ed8d4c2f0db63e71d4c069dd7) C:\Windows\system32\DRIVERS\WSDPrint.sys

12:31:53.0702 5064        WSDPrintDevice - ok

12:31:53.0764 5064        WSDScan         (65d1ff8aaff4a7d8f787a290e5087816) C:\Windows\system32\DRIVERS\WSDScan.sys

12:31:53.0796 5064        WSDScan - ok

12:31:53.0811 5064        WSearch - ok

12:31:53.0936 5064        wuauserv        (6298277b73c77fa99106b271a7525163) C:\Windows\system32\wuaueng.dll

12:31:54.0154 5064        wuauserv - ok

12:31:54.0217 5064        WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

12:31:54.0279 5064        WUDFRd - ok

12:31:54.0373 5064        wudfsvc         (575a4190d989f64732119e4114045a4f) C:\Windows\System32\WUDFSvc.dll

12:31:54.0466 5064        wudfsvc - ok

12:31:54.0513 5064        XAudio          (22a08b9faecd6a306868f59b7f03f188) C:\Windows\system32\DRIVERS\XAudio32.sys

12:31:54.0529 5064        XAudio - ok

12:31:54.0576 5064        XAudioService   (ab0f15e3fb2b5920963789d77397776b) C:\Windows\system32\DRIVERS\xaudio.exe

12:31:54.0654 5064        XAudioService - ok

12:31:54.0685 5064        MBR (0x1B8)     (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0

12:31:54.0903 5064        \Device\Harddisk0\DR0 - ok

12:31:54.0919 5064        Boot (0x1200)   (ccc8f5dd6cdf0097e7612a8d142b1c38) \Device\Harddisk0\DR0\Partition0

12:31:54.0919 5064        \Device\Harddisk0\DR0\Partition0 - ok

12:31:54.0966 5064        Boot (0x1200)   (f91ed479a06f947b5edee61ca6ed8286) \Device\Harddisk0\DR0\Partition1

12:31:54.0966 5064        \Device\Harddisk0\DR0\Partition1 - ok

12:31:54.0966 5064        ============================================================

12:31:54.0966 5064        Scan finished

12:31:54.0966 5064        ============================================================

12:31:55.0012 5056        Detected object count: 9

12:31:55.0012 5056        Actual detected object count: 9

12:34:17.0222 5056        BVRPMPR5 ( UnsignedFile.Multi.Generic ) - skipped by user

12:34:17.0222 5056        BVRPMPR5 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

12:34:17.0222 5056        FSCLBaseUpdaterService ( UnsignedFile.Multi.Generic ) - skipped by user

12:34:17.0222 5056        FSCLBaseUpdaterService ( UnsignedFile.Multi.Generic ) - User select action: Skip 

12:34:17.0222 5056        IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

12:34:17.0222 5056        IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 

12:34:17.0222 5056        KMWDFILTER ( UnsignedFile.Multi.Generic ) - skipped by user

12:34:17.0222 5056        KMWDFILTER ( UnsignedFile.Multi.Generic ) - User select action: Skip 

12:34:17.0238 5056        PLFlash DeviceIoControl Service ( UnsignedFile.Multi.Generic ) - skipped by user

12:34:17.0238 5056        PLFlash DeviceIoControl Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 

12:34:17.0238 5056        TDslMgrService ( UnsignedFile.Multi.Generic ) - skipped by user

12:34:17.0238 5056        TDslMgrService ( UnsignedFile.Multi.Generic ) - User select action: Skip 

12:34:17.0238 5056        TestHandler ( UnsignedFile.Multi.Generic ) - skipped by user

12:34:17.0238 5056        TestHandler ( UnsignedFile.Multi.Generic ) - User select action: Skip 

12:34:17.0238 5056        TridVid ( UnsignedFile.Multi.Generic ) - skipped by user

12:34:17.0238 5056        TridVid ( UnsignedFile.Multi.Generic ) - User select action: Skip 

12:34:17.0238 5056        WINIO ( UnsignedFile.Multi.Generic ) - skipped by user

12:34:17.0238 5056        WINIO ( UnsignedFile.Multi.Generic ) - User select action: Skip

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Code:

ComboFix 12-04-06.02 - *** 06.04.2012  16:14:43.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2046.1302 [GMT 2:00]

ausgeführt von:: c:\users\***\Desktop\scan\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\driver\TOUCHPAD\ALPS\_desktop.ini

c:\driver\TOUCHPAD\ALPS\Eula\_desktop.ini

c:\users\Future Pinball\Newton.dll

c:\windows\IsUn0407.exe

c:\windows\system\BisonCam.dll

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-03-06 bis 2012-04-06  ))))))))))))))))))))))))))))))

.

.

2012-04-06 14:43 . 2012-04-06 14:43        --------        d-----w-        c:\users\***\AppData\Local\temp

2012-04-05 15:46 . 2012-04-05 15:46        --------        d-----w-        C:\_OTL

2012-04-05 06:45 . 2012-04-05 06:45        --------        d-----w-        c:\users\***\AppData\Roaming\DivX

2012-04-03 10:44 . 2012-04-03 10:44        --------        d-----w-        c:\program files\ESET

2012-04-02 16:18 . 2012-04-02 16:18        --------        d-----w-        c:\users\***\AppData\Roaming\Avira

2012-04-02 09:09 . 2012-04-02 09:09        418464        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2012-04-02 08:23 . 2011-12-10 13:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-04-02 07:23 . 2012-04-02 07:23        --------        d-----w-        c:\program files\Microsoft WSE

2012-04-02 07:21 . 2012-04-02 07:21        --------        d-----w-        c:\users\***\AppData\Local\PackageAware

2012-04-02 06:53 . 2012-04-02 06:53        --------        d-----w-        c:\users\***\AppData\Roaming\Avira

2012-04-02 06:50 . 2011-09-16 14:08        36000        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2012-04-02 06:50 . 2012-01-31 06:56        74640        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2012-04-02 06:50 . 2012-01-31 06:56        137416        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2012-04-02 06:50 . 2012-04-02 06:50        --------        d-----w-        c:\programdata\Avira

2012-04-02 06:50 . 2012-04-02 06:50        --------        d-----w-        c:\program files\Avira

2012-04-01 19:21 . 2012-04-01 19:21        --------        d-----w-        c:\program files\iPod

2012-04-01 19:21 . 2012-04-01 19:22        --------        d-----w-        c:\program files\iTunes

2012-04-01 18:34 . 2012-04-01 18:34        --------        d-----w-        c:\program files\Common Files\Java

2012-04-01 18:10 . 2012-02-02 15:16        2044416        ----a-w-        c:\windows\system32\win32k.sys

2012-04-01 18:10 . 2012-01-09 15:54        613376        ----a-w-        c:\windows\system32\rdpencom.dll

2012-04-01 18:10 . 2012-01-09 13:58        180736        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-04-01 18:10 . 2012-01-31 10:59        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat

2012-04-01 18:10 . 2012-02-14 15:45        219648        ----a-w-        c:\windows\system32\d3d10_1core.dll

2012-04-01 18:10 . 2012-02-14 15:45        160768        ----a-w-        c:\windows\system32\d3d10_1.dll

2012-04-01 18:10 . 2012-02-13 14:12        1172480        ----a-w-        c:\windows\system32\d3d10warp.dll

2012-04-01 18:10 . 2012-02-13 13:47        683008        ----a-w-        c:\windows\system32\d2d1.dll

2012-04-01 18:10 . 2012-02-13 13:44        1068544        ----a-w-        c:\windows\system32\DWrite.dll

2012-04-01 14:44 . 2012-04-01 14:44        --------        d-----w-        c:\users\***\AppData\Roaming\Malwarebytes

2012-04-01 14:43 . 2012-04-01 14:43        --------        d-----w-        c:\programdata\Malwarebytes

2012-04-01 14:43 . 2012-04-02 08:23        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-04-02 09:09 . 2011-11-12 21:56        70304        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-01-10 11:57 . 2012-01-15 11:10        637848        ----a-w-        c:\windows\system32\npdeployJava1.dll

2012-01-10 11:57 . 2010-07-09 16:06        567696        ----a-w-        c:\windows\system32\deployJava1.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="RtHDVCpl.exe" [2007-01-18 4349952]

"PowerManager"="c:\program files\Power Manager\PM.exe" [2007-03-13 29696]

"CLMLServer"="c:\program files\HomeCinema\Power2Go\CLMLSvc.exe" [2008-07-18 104936]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-01-31 258512]

.

c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

DSL-Manager.lnk - c:\program files\DSL-Manager\DslMgr.exe [2009-7-17 1085440]

.

c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

DSL-Manager.lnk - c:\program files\DSL-Manager\DslMgr.exe [2009-7-17 1085440]

.

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

DSL-Manager.lnk - c:\program files\DSL-Manager\DslMgr.exe [2009-7-17 1085440]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]

2008-01-18 21:38        1008184        ----a-w-        c:\program files\Windows Defender\MSASCui.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start

"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe"

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 253600]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs        REG_MULTI_SZ           BthServ

HsfXAudioService        REG_MULTI_SZ           HsfXAudioService

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

Inhalt des "geplante Tasks" Ordners

.

2012-04-06 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 09:09]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = about:blank

TCP: DhcpNameServer = 192.168.0.1

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

AddRemove-glasklar Komplettpaket DVD1 - c:\windows\IsUn0407.exe

AddRemove-SLABCOMM&10C4&EA60 - c:\windows\system32\Silabs\DriverUninstaller.exe VCP CP210x Cardinal\SLABCOMM&10C4&EA60

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2012-04-06 16:43

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MEMSWEEP2]

"ImagePath"="\??\c:\windows\system32\12C5.tmp"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Zeit der Fertigstellung: 2012-04-06  16:46:53

ComboFix-quarantined-files.txt  2012-04-06 14:46

.

Vor Suchlauf: 22 Verzeichnis(se), 91.735.547.904 Bytes frei

Nach Suchlauf: 26 Verzeichnis(se), 91.658.944.512 Bytes frei

.

- - End Of File - - 5D1C078D179A1D1800F2F974B4802C86

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

GMER:

Code:

Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\00000064 WDC_WD25 rev.01.0

Running: 4w0iiydb.exe; Driver: C:\Users\***\AppData\Local\Temp\kwtdrpow.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT    8D3185EE                                                                                              ZwCreateSection

SSDT    8D3185F8                                                                                              ZwRequestWaitReplyPort

SSDT    8D3185F3                                                                                              ZwSetContextThread

SSDT    8D3185FD                                                                                              ZwSetSecurityObject

SSDT    8D318602                                                                                              ZwSystemDebugControl

SSDT    8D31858F                                                                                              ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text   ntkrnlpa.exe!KeSetEvent + 215                                                                         820E3998 4 Bytes  [EE, 85, 31, 8D]

.text   ntkrnlpa.exe!KeSetEvent + 539                                                                         820E3CBC 4 Bytes  [F8, 85, 31, 8D]

.text   ntkrnlpa.exe!KeSetEvent + 56D                                                                         820E3CF0 4 Bytes  [F3, 85, 31, 8D]

.text   ntkrnlpa.exe!KeSetEvent + 5D1                                                                         820E3D54 4 Bytes  [FD, 85, 31, 8D]

.text   ntkrnlpa.exe!KeSetEvent + 619                                                                         820E3D9C 4 Bytes  [02, 86, 31, 8D]

.text   ...                                                                                                   
 

---- Devices - GMER 1.0.15 ----
 

Device  \Driver\BTHUSB \Device\00000078                                                                       bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)

Device  \Driver\BTHUSB \Device\0000007a                                                                       bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg     HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001060d01269                           

Reg     HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001060d0161a                           

Reg     HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                      

Reg     HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                   0

Reg     HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                0x4B 0x7A 0xA4 0xC6 ...

Reg     HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001060d01269 (not active ControlSet)       

Reg     HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001060d0161a (not active ControlSet)       

Reg     HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)  

Reg     HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                       0

Reg     HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                    0x4B 0x7A 0xA4 0xC6 ...
 

---- EOF - GMER 1.0.15 ----

OSAM:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 16:48:49 on 07.04.2012
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Microsoft Corporation Internet Explorer 9.00.8112.16421
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl

"ISUSPM.cpl" - "Macrovision Corporation" - C:\Windows\system32\ISUSPM.cpl

"nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl

"PhysX.cpl" - "NVIDIA Corporation" - C:\Windows\system32\PhysX.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero Toolkit\NeroBurnRights.cpl

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys

"BVRPMPR5 NDIS Protocol Driver" (BVRPMPR5) - "Avanquest Software" - C:\Windows\system32\drivers\BVRPMPR5.SYS

"catchme" (catchme) - ? - C:\Users\***\AppData\Local\Temp\catchme.sys  (File not found)

"dsltestSp5 NDIS Protocol Driver" (dsltestSp5) - "Printing Communications Assoc., Inc. (PCAUSA)" - C:\Windows\System32\Drivers\dsltestSp5.sys

"HIDUASDesc" (KMWDFILTER) - "Windows (R) Codename Longhorn DDK provider" - C:\Windows\System32\DRIVERS\KMWDFILTER.sys

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"kwtdrpow" (kwtdrpow) - ? - C:\Users\***\AppData\Local\Temp\kwtdrpow.sys  (Hidden registry entry, rootkit activity | File not found)

"MEMSWEEP2" (MEMSWEEP2) - ? - C:\Windows\system32\12C5.tmp  (File not found)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

"STK02H Camera" (DCamUSBSTK02H) - ? - C:\Windows\System32\DRIVERS\STK02HW2.sys  (File not found)

"Video Grabber" (TridVid) - "10moons Technologies Co.,Ltd" - C:\Windows\System32\DRIVERS\TridVid.sys

"WINIO" (WINIO) - "hxxp://www.internals.com" - C:\Windows\system32\WinIo.sys
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - "The Document Foundation" - C:\Program Files\LibreOffice 3.4\Basis\program\shlxthdl\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{4CCEFB41-18FA-11D3-9EF3-00A0C9E897FD} "CorelDRAW Shell Extension Component" - "Corel Corporation" - C:\Program Files\Corel\Corel Graphics 11\DRAW\CDRVIEWER\CrlShell110.dll

{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll

{AE424E85-F6DF-4910-A6A9-438797986431} "LibreOffice Property Handler" - "The Document Foundation" - C:\Program Files\LibreOffice 3.4\Basis\program\shlxthdl\propertyhdl.dll

{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - D:\Eigene Dateien\Brief\Office10\msohev.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll

{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll

{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - "The Document Foundation" - C:\Program Files\LibreOffice 3.4\Basis\program\shlxthdl\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - "The Document Foundation" - C:\Program Files\LibreOffice 3.4\Basis\program\shlxthdl\shlxthdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - "The Document Foundation" - C:\Program Files\LibreOffice 3.4\Basis\program\shlxthdl\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - "The Document Foundation" - C:\Program Files\LibreOffice 3.4\Basis\program\shlxthdl\shlxthdl.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} "Java Plug-in 1.7.0_03" - "Oracle Corporation" - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.7.0_03" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\ssv.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 10.3.1" - "Oracle Corporation" - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab

{7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control" - "ESET" - C:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX / hxxp://download.eset.com/special/eos/OnlineScanner.cab

{166B1BCA-3F9C-11CF-8075-444553540000} "Shockwave ActiveX Control" - "Adobe Systems, Inc." - C:\Windows\system32\Adobe\Director\SwDir.dll / hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

{1E54D648-B804-468d-BC78-4AFFED8E262F} "System Requirements Lab Class" - "Husdawg, LLC" - C:\Windows\Downloaded Program Files\sysreqlab_nvd.dll / hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -   (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"DSL-Manager.lnk" - "T-Systems Enterprise Services GmbH" - C:\Program Files\DSL-Manager\DslMgr.exe  (Shortcut exists | File exists)

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" - "Nero AG" - "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"APSDaemon" - "Apple Inc." - "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"CLMLServer" - "CyberLink" - "C:\Program Files\HomeCinema\Power2Go\CLMLSvc.exe"

"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"

"PowerManager" - ? - C:\Program Files\Power Manager\PM.exe

"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"DSL-Manager" (TDslMgrService) - "T-Systems Enterprise Services GmbH" - C:\Program Files\DSL-Manager\DslMgrSvc.exe

"FSCLBaseUpdaterService" (FSCLBaseUpdaterService) - ? - C:\Program Files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe

"Fujitsu Siemens Computers Diagnostic Testhandler" (TestHandler) - "Fujitsu Siemens Computers" - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"IviRegMgr" (IviRegMgr) - "InterVideo" - c:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

"Machine Debug Manager" (MDM) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"NBService" (NBService) - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe

"PLFlash DeviceIoControl Service" (PLFlash DeviceIoControl Service) - "Prolific Technology Inc." - C:\Windows\system32\IoctlSvc.exe

"Symantec Lic NetConnect service" (CLTNetCnService) - ? - "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon  (File not found)
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

aswMBR:

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-04-07 18:00:46

-----------------------------

18:00:46.939    OS Version: Windows 6.0.6002 Service Pack 2

18:00:46.939    Number of processors: 2 586 0x4802

18:00:46.939    ComputerName: ALLE-PC  UserName: 

18:00:49.311    Initialize success

18:01:01.276    AVAST engine defs: 12040700

18:01:05.254    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000065

18:01:05.254    Disk 0 Vendor: WDC_WD25 01.0 Size: 238475MB BusType: 6

18:01:05.269    Disk 0 MBR read successfully

18:01:05.285    Disk 0 MBR scan

18:01:05.363    Disk 0 Windows VISTA default MBR code

18:01:05.394    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS        12000 MB offset 2048

18:01:05.425    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS       151650 MB offset 24578048

18:01:05.457    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        74823 MB offset 335157248

18:01:05.488    Disk 0 scanning sectors +488394752

18:01:05.675    Disk 0 scanning C:\Windows\system32\drivers

18:01:17.656    Service scanning

18:01:42.834    Modules scanning

18:01:48.013    Disk 0 trace - called modules:

18:01:48.045    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys 

18:01:48.045    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85717620]

18:01:48.060    3 CLASSPNP.SYS[8273b8b3] -> nt!IofCallDriver -> [0x8447b4f0]

18:01:48.060    5 acpi.sys[8260d6bc] -> nt!IofCallDriver -> \Device\00000065[0x8447a030]

18:01:49.402    AVAST engine scan C:\Windows

18:01:54.706    AVAST engine scan C:\Windows\system32

18:06:10.049    AVAST engine scan C:\Windows\system32\drivers

18:06:24.182    AVAST engine scan C:\Users\***

18:06:56.708    AVAST engine scan C:\ProgramData

18:07:29.187    Scan finished successfully

18:11:38.438    Disk 0 MBR has been saved successfully to "C:\Users\***\Desktop\scan\MBR.dat"

18:11:38.438    The log file has been saved successfully to "C:\Users\***\Desktop\scan\aswMBR.txt"

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

MBAM:

Code:

Malwarebytes Anti-Malware 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.04.08.02
 

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

*** :: ALLE-PC [Administrator]
 

08.04.2012 12:35:05

mbam-log-2012-04-08 (12-35-05).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 417715

Laufzeit: 1 Stunde(n), 12 Minute(n), 33 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

SASW:

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 04/08/2012 at 04:50 PM
 

Application Version : 5.0.1146
 

Core Rules Database Version : 8424

Trace Rules Database Version: 6236
 

Scan type       : Complete Scan

Total Scan Time : 02:19:12
 

Operating System Information

Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)

UAC On - Limited User (Administrator User)
 

Memory items scanned      : 665

Memory threats detected   : 0

Registry items scanned    : 36213

Registry threats detected : 0

File items scanned        : 217996

File threats detected     : 86
 

Adware.Tracking Cookie

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\5O10HVXA.txt [ Cookie:***@tradedoubler.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\AIBCALYO.txt [ Cookie:***@ad2.adfarm1.adition.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\MY1JCPXU.txt [ Cookie:***@eas.apm.emediate.eu/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\7UU21DND.txt [ Cookie:***@smartadserver.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\9YKZB31Z.txt [ Cookie:***@delivery.atkmedia.de/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\KN64WWH5.txt [ Cookie:***@www.etracker.de/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\LMGEMH59.txt [ Cookie:***@zanox.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\70YVLQIK.txt [ Cookie:***@clickfuse.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\XWAU46CT.txt [ Cookie:***@de.sitestat.com/otto-de/ottode-testcl/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\***@mediaplex[1].txt [ Cookie:***@mediaplex.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\***@apmebf[1].txt [ Cookie:***@apmebf.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\3N7UR4JO.txt [ Cookie:***@revsci.net/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\JAZ1D16N.txt [ Cookie:***@a.revenuemax.de/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\SOWN1E4W.txt [ Cookie:***@atdmt.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\Z2R4V6S0.txt [ Cookie:***@tracking.mindshare.de/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\3809EQTX.txt [ Cookie:***@im.banner.t-online.de/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\***@specificclick[2].txt [ Cookie:***@specificclick.net/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\UR0OKU3V.txt [ Cookie:***@fastclick.net/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\97OGLT1Y.txt [ Cookie:***@ww251.smartadserver.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\6Z6K9CCQ.txt [ Cookie:***@ad.yieldmanager.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\PNDYTXUW.txt [ Cookie:***@advertising.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\UG8K2IZJ.txt [ Cookie:***@adtech.de/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\3YT4F19A.txt [ Cookie:***@adfarm1.adition.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\TGEIK70B.txt [ Cookie:***@serving-sys.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\8NGG1KRY.txt [ Cookie:***@tracking.mlsat02.de/tmobile/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\S648XKQ4.txt [ Cookie:***@www.googleadservices.com/pagead/conversion/1044648193/ ]

        C:\USERS\***\Cookies\5O10HVXA.txt [ Cookie:***@tradedoubler.com/ ]

        C:\USERS\***\Cookies\AIBCALYO.txt [ Cookie:***@ad2.adfarm1.adition.com/ ]

        C:\USERS\***\Cookies\MY1JCPXU.txt [ Cookie:***@eas.apm.emediate.eu/ ]

        C:\USERS\***\Cookies\7UU21DND.txt [ Cookie:***@smartadserver.com/ ]

        C:\USERS\***\Cookies\9YKZB31Z.txt [ Cookie:***@delivery.atkmedia.de/ ]

        C:\USERS\***\Cookies\KN64WWH5.txt [ Cookie:***@www.etracker.de/ ]

        C:\USERS\***\Cookies\LMGEMH59.txt [ Cookie:***@zanox.com/ ]

        C:\USERS\***\Cookies\70YVLQIK.txt [ Cookie:***@clickfuse.com/ ]

        C:\USERS\***\Cookies\XWAU46CT.txt [ Cookie:***@de.sitestat.com/otto-de/ottode-testcl/ ]

        C:\USERS\***\Cookies\***@mediaplex[1].txt [ Cookie:***@mediaplex.com/ ]

        C:\USERS\***\Cookies\***@apmebf[1].txt [ Cookie:***@apmebf.com/ ]

        C:\USERS\***\Cookies\3N7UR4JO.txt [ Cookie:***@revsci.net/ ]

        C:\USERS\***\Cookies\JAZ1D16N.txt [ Cookie:***@a.revenuemax.de/ ]

        C:\USERS\***\Cookies\SOWN1E4W.txt [ Cookie:***@atdmt.com/ ]

        C:\USERS\***\Cookies\Z2R4V6S0.txt [ Cookie:***@tracking.mindshare.de/ ]

        C:\USERS\***\Cookies\3809EQTX.txt [ Cookie:***@im.banner.t-online.de/ ]

        C:\USERS\***\Cookies\***@specificclick[2].txt [ Cookie:***@specificclick.net/ ]

        C:\USERS\***\Cookies\UR0OKU3V.txt [ Cookie:***@fastclick.net/ ]

        C:\USERS\***\Cookies\97OGLT1Y.txt [ Cookie:***@ww251.smartadserver.com/ ]

        C:\USERS\***\Cookies\6Z6K9CCQ.txt [ Cookie:***@ad.yieldmanager.com/ ]

        C:\USERS\***\Cookies\PNDYTXUW.txt [ Cookie:***@advertising.com/ ]

        C:\USERS\***\Cookies\UG8K2IZJ.txt [ Cookie:***@adtech.de/ ]

        C:\USERS\***\Cookies\3YT4F19A.txt [ Cookie:***@adfarm1.adition.com/ ]

        C:\USERS\***\Cookies\TGEIK70B.txt [ Cookie:***@serving-sys.com/ ]

        C:\USERS\***\Cookies\8NGG1KRY.txt [ Cookie:***@tracking.mlsat02.de/tmobile/ ]

        C:\USERS\***\Cookies\S648XKQ4.txt [ Cookie:***@www.googleadservices.com/pagead/conversion/1044648193/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\KKGVPZFB.txt [ Cookie:***@revsci.net/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\G22PQDZ0.txt [ Cookie:***@doubleclick.net/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\X8WSGDBG.txt [ Cookie:***@tracking.quisma.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\5WV0MX4F.txt [ Cookie:***@im.banner.t-online.de/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\65PO2WZ0.txt [ Cookie:***@track.effiliation.com/servlet/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\0Q7Q3GWV.txt [ Cookie:***@xiti.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\PDXG85JH.txt [ Cookie:***@invitemedia.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\7XHD490J.txt [ Cookie:***@zanox-affiliate.de/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\6RY245GP.txt [ Cookie:***@mediaplex.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\083C0NAK.txt [ Cookie:***@track.effiliation.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\HY1WGTP8.txt [ Cookie:***@adfarm1.adition.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\XM30WDCK.txt [ Cookie:***@ww251.smartadserver.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\ELJPGJAG.txt [ Cookie:***@zanox.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\WJCN866X.txt [ Cookie:***@ad2.adfarm1.adition.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\G4Z6U2PA.txt [ Cookie:***@webmasterplan.com/ ]

        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\NJ8FVPJN.txt [ Cookie:***@ad4.adfarm1.adition.com/ ]

        C:\USERS\***\Cookies\KKGVPZFB.txt [ Cookie:***@revsci.net/ ]

        C:\USERS\***\Cookies\G22PQDZ0.txt [ Cookie:***@doubleclick.net/ ]

        C:\USERS\***\Cookies\X8WSGDBG.txt [ Cookie:***@tracking.quisma.com/ ]

        C:\USERS\***\Cookies\5WV0MX4F.txt [ Cookie:***@im.banner.t-online.de/ ]

        C:\USERS\***\Cookies\65PO2WZ0.txt [ Cookie:***@track.effiliation.com/servlet/ ]

        C:\USERS\***\Cookies\0Q7Q3GWV.txt [ Cookie:***@xiti.com/ ]

        C:\USERS\***\Cookies\PDXG85JH.txt [ Cookie:***@invitemedia.com/ ]

        C:\USERS\***\Cookies\7XHD490J.txt [ Cookie:***@zanox-affiliate.de/ ]

        C:\USERS\***\Cookies\6RY245GP.txt [ Cookie:***@mediaplex.com/ ]

        C:\USERS\***\Cookies\083C0NAK.txt [ Cookie:***@track.effiliation.com/ ]

        C:\USERS\***\Cookies\HY1WGTP8.txt [ Cookie:***@adfarm1.adition.com/ ]

        C:\USERS\***\Cookies\XM30WDCK.txt [ Cookie:***@ww251.smartadserver.com/ ]

        C:\USERS\***\Cookies\ELJPGJAG.txt [ Cookie:***@zanox.com/ ]

        C:\USERS\***\Cookies\WJCN866X.txt [ Cookie:***@ad2.adfarm1.adition.com/ ]

        C:\USERS\***\Cookies\G4Z6U2PA.txt [ Cookie:***@webmasterplan.com/ ]

        C:\USERS\***\Cookies\NJ8FVPJN.txt [ Cookie:***@ad4.adfarm1.adition.com/ ]

        C:\USERS\***\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\***@XITI[1].TXT [ /XITI ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\ALLE-PC$@XITI[1].TXT [ /XITI ]

Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Ist alles wieder in Ordnung. VIELEN DANK!

Was den Browser angeht: Es ist ja eigentlich der Computer meines Vaters, weshalb ich jetzt mal den IE benutzt habe. Aber: Ich habe ihn so eingestellt, dass bei jedem Beenden Cookies, Cache und weiteres gelöscht werden. Die Cookies stammen von den Konten meiner Eltern (ich werde mal mit ihnen reden müssen! :)). Bei mir nutz ich Firefox und lasse nach jedem Beenden die Chronik löschen.

Also: nochmals VIELEN DANK!

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.