Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Trojan-Ransom.Win32.Gimemo.rmo desktop gesperrt (https://www.trojaner-board.de/117284-trojan-ransom-win32-gimemo-rmo-desktop-gesperrt.html)

pa4sim 13.06.2012 20:10
Trojan-Ransom.Win32.Gimemo.rmo desktop gesperrt
 
Hallo Trojaner-board,

auf diesem Rechner mit Windows 7-64bit war ein Gema Trojaner, wahrscheinlich eingefangen über ein Minecraft Video Tutorial. Er liess sich mit der windows unlock option der Kapersky rescue disc und anschliessendem "de-trojanern" mit Kapersky wieder in einen Zustand bringen, der ein normales booten erlaubt. Aus dem Kapersky log habe ich den Namen des Trojaners (Trojan-Ransom.Win32.Gimemo.rmo).

Derzeit ist allerdings der Desktop gesperrt und das Verzeichnis C:/Benutzer/<aktueller nutzer> ist mit einem Schloss versehen.

Ich hoffe Ihr könntmir dabei helfen, den Rechner wieder in einen Normalzustand zu bringen, ohne ihn neu aufzusetzten.

defogger habe ich laufen lassen, OTL auch. Die beiden txt Dateien sind im ANhang.

Liebe Grüße.

cosinus 15.06.2012 19:14
Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

pa4sim 16.06.2012 08:27
Hallo Arne,

hier der log von Malewarebytes:
Code:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.15.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
suser :: SCHLEPPTOP [Administrator]

15.06.2012 21:25:15
mbam-log-2012-06-15 (21-25-15).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 422425
Laufzeit: 1 Stunde(n), 10 Minute(n), 50 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Userinit (Backdoor.Agent) -> Daten: C:\Users\suser\AppData\Roaming\itunes_service01.exe,C:\WINDOWS\System32\userinit.exe, -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 3
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoDesktop (PUM.Hidden.Desktop) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools (PUM.Hijack.Regedit) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

und hier kommt der log von ESET:
Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-06-15 10:50:57
# local_time=2012-06-16 12:50:57 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 5807 91423807 0 0
# compatibility_mode=8192 67108863 100 0 151 151 0 0
# compatibility_mode=8449 16775165 50 96 5822 153056591 0 0
# scanned=235900
# found=0
# cleaned=0
# scan_time=6701
und hier noch zusätzlich der log von Sophos, das ich normalerweise auf dem Rechner habe:

Code:
****************** Sophos Anti-Virus Protokoll - 16.06.2012 07:14:50 **************

20120601 142551        Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20120601 143222        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20120601 143223        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664262 Objekte erkennen.
20120601 143223        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20120601 163150        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20120601 163152        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664273 Objekte erkennen.
20120601 163152        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20120601 175610        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20120601 175611        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664274 Objekte erkennen.
20120601 175611        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20120602 102509        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664274 Objekte erkennen.
20120602 102509        Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20120602 103113        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20120602 103115        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664301 Objekte erkennen.
20120602 103115        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20120604 140505        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664301 Objekte erkennen.
20120604 140505        Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20120604 141126        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20120604 141130        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664397 Objekte erkennen.
20120604 141130        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20120604 171054        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20120604 171055        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664409 Objekte erkennen.
20120604 171055        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20120604 212639        Der Scan von 'C:\Windows\SysWOW64\netutils.dll' führte zu SAV Interface-Fehler 0xa0040202: Scan fehlgeschlagen.
20120608 191819        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664409 Objekte erkennen.
20120608 191819        Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20120608 192458        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20120608 192501        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664738 Objekte erkennen.
20120608 192501        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20120610 113515        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20120610 113515        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664777 Objekte erkennen.
20120610 113515        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20120610 120320        Scan 'Rechtsklick-Überprüfung' gestartet.
20120610 120321        Scan 'Rechtsklick-Überprüfung' abgeschlossen.
20120610 120321        Ergebniszusammenfassung für Scan 'Rechtsklick-Überprüfung':
                Gescannte Objekte: 2
                Fehler: 0
                Objekte in Quarantäne: 0
                Behandelte Objekte: 0
20120610 120427        Scan 'Rechtsklick-Überprüfung' gestartet.
20120610 120428        Scan 'Rechtsklick-Überprüfung' abgeschlossen.
20120610 120428        Ergebniszusammenfassung für Scan 'Rechtsklick-Überprüfung':
                Gescannte Objekte: 2
                Fehler: 0
                Objekte in Quarantäne: 0
                Behandelte Objekte: 0
20120610 122301        Scan 'Rechtsklick-Überprüfung' gestartet.
20120610 122303        Scan 'Rechtsklick-Überprüfung' abgeschlossen.
20120610 122303        Ergebniszusammenfassung für Scan 'Rechtsklick-Überprüfung':
                Gescannte Objekte: 2
                Fehler: 0
                Objekte in Quarantäne: 0
                Behandelte Objekte: 0
20120610 122328        Scan 'Rechtsklick-Überprüfung' gestartet.
20120610 122330        Scan 'Rechtsklick-Überprüfung' abgeschlossen.
20120610 122330        Ergebniszusammenfassung für Scan 'Rechtsklick-Überprüfung':
                Gescannte Objekte: 2
                Fehler: 0
                Objekte in Quarantäne: 0
                Behandelte Objekte: 0
20120610 123141        Scan 'Rechtsklick-Überprüfung' gestartet.
20120610 123141        Scan 'Rechtsklick-Überprüfung' abgeschlossen.
20120610 123141        Ergebniszusammenfassung für Scan 'Rechtsklick-Überprüfung':
                Gescannte Objekte: 2
                Fehler: 0
                Objekte in Quarantäne: 0
                Behandelte Objekte: 0
20120612 132458        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664777 Objekte erkennen.
20120612 132459        Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20120612 133151        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20120612 133206        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664887 Objekte erkennen.
20120612 133206        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20120612 163054        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20120612 163103        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664903 Objekte erkennen.
20120612 163103        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20120613 100200        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20120613 100203        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664950 Objekte erkennen.
20120613 100203        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20120613 120210        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20120613 120210        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664951 Objekte erkennen.
20120613 120210        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20120613 140201        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20120613 140204        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664981 Objekte erkennen.
20120613 140204        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20120613 160200        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20120613 160201        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664984 Objekte erkennen.
20120613 160201        Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20120613 190037        Prozess "c:\Users\suser\Desktop\OTL.exe" weist verdächtiges Verhaltensmuster 'HIPS/RegMod-009' auf.
                Zugriff verweigert.
                Wenn Sie die Anwendung nicht mit Sicherheit zulassen können, senden Sie ein Sample an Sophos.
20120613 190037        Prozess "c:\Users\suser\Desktop\OTL.exe" weist verdächtiges Verhaltensmuster 'HIPS/RegMod-009' auf.
                Zugriff verweigert.
                Wenn Sie die Anwendung nicht mit Sicherheit zulassen können, senden Sie ein Sample an Sophos.
20120615 191612        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3664984 Objekte erkennen.
20120615 191613        Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20120615 192120        Benutzer (Schlepptop\suser) hat den On-Access-Scan auf diesem Computer abgebrochen.
20120615 192215        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3665157 Objekte erkennen.
20120615 212236        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3665160 Objekte erkennen.
20120615 222218        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3665179 Objekte erkennen.
20120616 002147        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3665184 Objekte erkennen.
20120616 055146        Die Erkennungsdatenversion 4.78G (Detection Engine 3.32.0) wird verwendet. Diese Version kann 3665193 Objekte erkennen.
20120616 071109        Benutzer (Schlepptop\suser) hat den On-Access-Scan auf diesem Computer gestartet.
      (102 Objekte)
Gruß,
Jens

cosinus 17.06.2012 20:15
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

pa4sim 17.06.2012 20:45
Der Rechner bootet das normale Windows und im Startmenu sind alle Ordner sichtbar - alle Programme die ich ausprobiert habe starten auch normal.

cosinus 17.06.2012 20:50
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

pa4sim 17.06.2012 21:42
hier der neue scan von OTL
hab gerade nachgeschaut wie lang das mit dem Trojamer her ist. Es könnten mehr als die 30 Tage sein, dit bei OTL als default angegeben sind. Brauchst Du einen scan mit mehr als 30 Tagen?

OTL Logfile:
Code:
OTL logfile created on: 6/17/2012 10:13:05 PM - Run 2
OTL by OldTimer - Version 3.2.49.0    Folder = D:\Papas Daten
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
3.98 Gb Total Physical Memory | 2.51 Gb Available Physical Memory | 63.00% Memory free
7.96 Gb Paging File | 6.43 Gb Available in Paging File | 80.79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 150.00 Gb Total Space | 68.45 Gb Free Space | 45.63% Space Free | Partition Type: NTFS
Drive D: | 292.31 Gb Total Space | 252.99 Gb Free Space | 86.55% Space Free | Partition Type: NTFS
 
Computer Name: SCHLEPPTOP | User Name: suser | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012/06/17 22:00:53 | 000,595,968 | ---- | M] (OldTimer Tools) -- D:\Papas Daten\OTL.exe
PRC - [2012/04/11 16:43:09 | 000,232,472 | ---- | M] (Sophos Plc) -- C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
PRC - [2012/02/21 13:48:21 | 001,543,704 | ---- | M] (Sophos Plc) -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
PRC - [2011/02/25 03:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2011/02/14 12:15:38 | 004,394,576 | ---- | M] (SEC) -- C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
PRC - [2011/02/07 11:55:24 | 001,757,264 | ---- | M] (SAMSUNG Electronics) -- C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
PRC - [2011/01/04 15:06:42 | 007,060,560 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe
PRC - [2010/12/23 08:07:58 | 000,945,232 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe
PRC - [2010/12/21 04:30:38 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2010/12/21 04:30:36 | 000,325,656 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010/11/29 07:42:38 | 000,775,848 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe
PRC - [2010/11/10 01:03:52 | 000,136,488 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
PRC - [2010/10/08 15:15:13 | 000,163,056 | ---- | M] (Sophos Plc) -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
PRC - [2010/09/21 16:16:22 | 000,644,336 | ---- | M] (Sophos Plc) -- C:\ProgramData\Sophos\AutoUpdate\Cache\sophos_autoupdate1.dir\ALUpdate.exe
PRC - [2010/09/21 16:16:17 | 000,439,536 | ---- | M] (Sophos Plc) -- C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
PRC - [2010/09/20 05:24:42 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe
PRC - [2010/08/27 03:52:12 | 002,782,064 | ---- | M] (Samsung Electronics) -- C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe
PRC - [2010/07/29 12:37:16 | 000,222,496 | ---- | M] (Acresso Corporation) -- C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
PRC - [2010/06/14 18:42:36 | 000,097,520 | ---- | M] (Sophos Plc) -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
PRC - [2010/02/10 16:29:52 | 000,719,360 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
PRC - [2009/11/02 07:21:26 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
PRC - [2008/06/12 02:25:18 | 000,037,232 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe
PRC - [2008/06/11 22:43:26 | 000,640,376 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
PRC - [2003/05/08 11:00:58 | 000,049,152 | ---- | M] (ScanSoft, Inc.) -- C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\opwareSE2.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2010/07/05 12:42:58 | 000,203,776 | ---- | M] () -- C:\Program Files (x86)\Samsung\Movie Color Enhancer\WinCRT.dll
MOD - [2010/05/07 16:22:18 | 001,636,864 | ---- | M] () -- C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\Resdll.dll
MOD - [2009/11/02 07:23:36 | 000,013,096 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
MOD - [2009/11/02 07:20:10 | 000,619,816 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
MOD - [2006/08/12 05:48:40 | 000,049,152 | ---- | M] () -- C:\Program Files (x86)\Samsung\Easy Display Manager\HookDllPS2.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011/02/08 01:41:16 | 000,956,192 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV:64bit: - [2010/09/22 11:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2010/08/09 21:04:12 | 000,166,704 | ---- | M] (Samsung Electronics CO., LTD.) [On_Demand | Stopped] -- C:\Windows\SysNative\SUPDSvc.exe -- (Samsung UPD Service)
SRV:64bit: - [2009/07/14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2012/05/22 07:55:31 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012/05/05 23:05:17 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/04/11 16:43:09 | 000,232,472 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe -- (Sophos AutoUpdate Service)
SRV - [2012/02/29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/02/21 13:48:21 | 001,543,704 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe -- (swi_service)
SRV - [2011/09/25 15:37:22 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011/03/01 14:23:36 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011/02/25 03:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2010/12/21 04:30:38 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2010/12/21 04:30:36 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2010/10/08 15:15:13 | 000,163,056 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe -- (SAVAdminService)
SRV - [2010/07/29 06:05:38 | 000,296,808 | ---- | M] (Nuance Communications, Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe -- (DragonSvc)
SRV - [2010/06/14 18:42:36 | 000,097,520 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe -- (SAVService)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/03/01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/03/11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/03/04 09:59:18 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2011/02/08 21:13:12 | 000,349,736 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (BTWAMPFL)
DRV:64bit: - [2011/02/08 21:13:10 | 000,138,280 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2011/02/08 21:13:10 | 000,107,560 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2011/02/08 21:13:10 | 000,039,464 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2011/02/08 21:13:10 | 000,021,416 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2011/02/04 05:59:06 | 001,413,680 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2011/01/27 07:35:26 | 000,425,064 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010/11/20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/10 01:04:14 | 000,031,088 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\clwvd.sys -- (clwvd)
DRV:64bit: - [2010/10/20 02:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R)
DRV:64bit: - [2010/10/08 15:15:06 | 000,142,328 | ---- | M] (Sophos Plc) [File_System | System | Running] -- C:\Windows\SysNative\drivers\savonaccess.sys -- (SAVOnAccess)
DRV:64bit: - [2010/10/07 04:59:00 | 000,013,824 | ---- | M] (SAMSUNG ELECTRONICS) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\SABI.sys -- (SABI)
DRV:64bit: - [2010/09/13 11:24:26 | 000,437,272 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010/07/29 02:23:08 | 003,065,408 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2010/03/02 22:34:09 | 000,025,608 | ---- | M] (Sophos Plc) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\SophosBootDriver.sys -- (SophosBootDriver)
DRV:64bit: - [2009/08/07 03:35:34 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\SSPORT.sys -- (SSPORT)
DRV:64bit: - [2009/07/14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009/06/10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009/06/10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2005/06/14 13:01:16 | 000,296,448 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\hardlock.sys -- (Hardlock)
DRV - [2011/07/21 09:24:10 | 000,015,144 | ---- | M] (Windows (R) 2003 DDK 3790 provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\rtport.sys -- (rtport)
DRV - [2009/07/14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://samsung.msn.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBox
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-336442205-827502387-1674173946-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\suser\Desktop
IE - HKU\S-1-5-21-336442205-827502387-1674173946-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung.msn.com
IE - HKU\S-1-5-21-336442205-827502387-1674173946-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
IE - HKU\S-1-5-21-336442205-827502387-1674173946-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-336442205-827502387-1674173946-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-336442205-827502387-1674173946-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.at/"
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\suser\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/12/19 19:51:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2011/12/19 19:51:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\suser\AppData\Roaming\mozilla\Extensions
[2012/04/23 17:03:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012/04/23 17:03:09 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011/11/21 06:21:43 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/11/21 03:17:49 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/11/21 03:09:48 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011/11/21 03:17:49 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011/11/21 03:17:49 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/11/21 03:17:49 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/11/21 03:17:49 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Sophos Web Content Scanner) - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SophosBHOX64.dll (Sophos Plc)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Sophos Web Content Scanner) - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SophosBHO.dll (Sophos Plc)
O2 - BHO: (Samsung BHO Class) - {AA609D72-8482-4076-8991-8CDAE5B93BCB} - C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll ()
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-336442205-827502387-1674173946-1000\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [DNS7reminder] C:\Program Files (x86)\Nuance\NaturallySpeaking11\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [OPSE reminder] C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\EregGer\Ereg.exe ()
O4 - HKLM..\Run: [OpwareSE2] C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Program Files (x86)\Sophos\AutoUpdate\almon.exe (Sophos Plc)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-336442205-827502387-1674173946-1000..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
O4 - HKU\S-1-5-21-336442205-827502387-1674173946-1000..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-336442205-827502387-1674173946-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Samsung AnyWeb Print - {328ECD19-C167-40eb-A0C7-16FE7634105E} - C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\ProgramData\Sophos Web Intelligence\swi_lsp_64.dll (Sophos Plc)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\ProgramData\Sophos Web Intelligence\swi_lsp_64.dll (Sophos Plc)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\ProgramData\Sophos Web Intelligence\swi_lsp_64.dll (Sophos Plc)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\ProgramData\Sophos Web Intelligence\swi_lsp_64.dll (Sophos Plc)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\ProgramData\Sophos Web Intelligence\swi_lsp_64.dll (Sophos Plc)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\ProgramData\Sophos Web Intelligence\swi_lsp_64.dll (Sophos Plc)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\ProgramData\Sophos Web Intelligence\swi_lsp_64.dll (Sophos Plc)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\ProgramData\Sophos Web Intelligence\swi_lsp_64.dll (Sophos Plc)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000020 - C:\ProgramData\Sophos Web Intelligence\swi_lsp_64.dll (Sophos Plc)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\ProgramData\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\ProgramData\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\ProgramData\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\ProgramData\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\ProgramData\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\ProgramData\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\ProgramData\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\ProgramData\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\ProgramData\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6232175D-65B3-41ED-B91E-AD5CD677075C}: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E420E3BF-C2A1-4233-BA32-746E24431A49}: DhcpNameServer = 10.0.0.138
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~2.DLL) - C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~2.DLL (Sophos Plc)
O20 - AppInit_DLLs: (C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL) - C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Plc)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\S-1-5-21-336442205-827502387-1674173946-1000 Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
 
MsConfig:64bit - State: "services" - Reg Error: Key error.
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {9B52B7E1-DAA3-B2AA-D208-E68D27852A98} - Microsoft Windows Media Player 12.0
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.pspgru - C:\Windows\SysWow64\PSPGRU.acm (Philips Austria GmbH - Speech Processing)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/06/17 21:54:48 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\suser\Desktop\OTL (1).exe
[2012/06/15 22:56:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012/06/15 21:20:30 | 000,000,000 | ---D | C] -- C:\Users\suser\AppData\Roaming\Malwarebytes
[2012/06/15 21:20:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/15 21:20:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/06/15 21:20:07 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/06/15 21:20:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/06/15 21:18:47 | 010,063,000 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\suser\Desktop\mbam-setup-1.61.0.1400.exe
[2012/06/13 20:25:11 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\suser\Desktop\OTL.exe
[2012/05/25 22:04:15 | 000,000,000 | ---D | C] -- D:\susers Daten\Documents\CyberLink
[2 C:\Users\suser\Desktop\*.tmp files -> C:\Users\suser\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/06/17 22:15:30 | 000,014,144 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/17 22:15:30 | 000,014,144 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/17 22:07:28 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/06/17 22:07:21 | 4273,520,640 | -HS- | M] () -- C:\hiberfil.sys
[2012/06/17 22:05:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/06/17 21:57:28 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\suser\Desktop\OTL (1).exe
[2012/06/15 21:18:47 | 010,063,000 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\suser\Desktop\mbam-setup-1.61.0.1400.exe
[2012/06/15 21:15:59 | 000,430,432 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/06/13 21:26:58 | 001,543,672 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/06/13 21:26:58 | 000,668,778 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012/06/13 21:26:58 | 000,616,008 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/06/13 21:26:58 | 000,134,562 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012/06/13 21:26:58 | 000,110,478 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/06/13 20:37:06 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\suser\Desktop\OTL.exe
[2012/06/10 14:31:23 | 000,123,362 | ---- | M] () -- C:\Users\suser\Desktop\Weaponmod.zip
[2012/06/10 14:22:17 | 000,795,970 | ---- | M] () -- C:\Users\suser\Desktop\MinecraftForge-3.2.5.120-Client.zip
[2 C:\Users\suser\Desktop\*.tmp files -> C:\Users\suser\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/06/10 14:31:23 | 000,123,362 | ---- | C] () -- C:\Users\suser\Desktop\Weaponmod.zip
[2012/06/10 14:22:17 | 000,795,970 | ---- | C] () -- C:\Users\suser\Desktop\MinecraftForge-3.2.5.120-Client.zip
[2011/09/28 18:52:19 | 000,000,556 | ---- | C] () -- C:\Windows\MAXLINK.INI
[2011/09/23 11:33:25 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\hlduinst.exe
[2011/09/23 11:33:24 | 000,164,864 | ---- | C] () -- C:\Windows\SysWow64\UNWISE.EXE
[2011/09/23 11:33:07 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\pdfrw_.dll
[2011/09/23 11:33:06 | 003,872,256 | ---- | C] () -- C:\Windows\SysWow64\pdf2imagepdf.dll
[2011/09/23 11:33:06 | 000,494,080 | ---- | C] () -- C:\Windows\SysWow64\freetype.dll
[2011/09/23 11:33:06 | 000,331,776 | ---- | C] () -- C:\Windows\SysWow64\bwdec.dll
[2011/09/23 11:33:06 | 000,077,824 | ---- | C] () -- C:\Windows\SysWow64\faxdecode.dll
[2011/09/23 11:33:06 | 000,032,768 | ---- | C] () -- C:\Windows\SysWow64\faxencode.dll
[2011/09/23 11:32:23 | 000,544,256 | ---- | C] () -- C:\Windows\SysWow64\janGraphics.dll
[2011/09/23 11:32:23 | 000,110,592 | ---- | C] () -- C:\Windows\SysWow64\MTTB4032.DLL
[2011/09/23 11:32:21 | 000,025,600 | ---- | C] () -- C:\Windows\SysWow64\Cbndll.dll
[2011/09/23 11:32:09 | 000,000,530 | ---- | C] () -- C:\Windows\SysWow64\tx12_ic.ini
[2011/09/23 11:32:08 | 000,663,552 | ---- | C] () -- C:\Windows\SysWow64\tx12.dll
[2011/03/18 07:52:51 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll
[2011/03/18 07:36:45 | 000,258,864 | ---- | C] () -- C:\Windows\SUPDRun.exe
[2011/03/18 02:56:15 | 000,307,200 | ---- | C] () -- C:\Windows\SetDisplayResolution.exe
[2011/03/18 01:22:43 | 000,001,898 | ---- | C] () -- C:\Windows\HotFixList.ini
[2011/03/18 01:10:01 | 000,142,128 | ---- | C] () -- C:\Windows\wiainst64.exe
 
========== LOP Check ==========
 
[2012/06/12 20:05:18 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\.minecraft
[2011/09/28 18:14:59 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\Langenscheidt
[2011/12/06 19:17:08 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\LaunchPad
[2012/04/28 17:25:39 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\LolClient
[2012/05/07 18:08:20 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\MULTITEXT
[2011/09/25 17:45:46 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\Nuance
[2012/02/04 16:10:25 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\pymclevel
[2011/09/23 11:42:28 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\REHASOFT
[2011/09/28 18:52:22 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\ScanSoft
[2012/04/30 23:02:07 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\TS3Client
[2011/12/31 22:30:20 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\Unity
[2011/11/24 21:02:23 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\WildTangent
[2012/05/05 13:32:45 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012/06/12 20:05:18 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\.minecraft
[2011/10/22 14:05:08 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\Adobe
[2012/05/25 22:04:17 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\CyberLink
[2011/09/25 15:26:33 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\FLEXnet
[2011/09/22 21:00:29 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\Identities
[2011/09/28 18:14:59 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\Langenscheidt
[2011/12/06 19:17:08 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\LaunchPad
[2012/04/28 17:25:39 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\LolClient
[2011/09/22 21:10:54 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\Macromedia
[2012/06/15 21:20:30 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\Malwarebytes
[2011/03/18 07:57:00 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\Media Center Programs
[2011/10/04 21:31:52 | 000,000,000 | --SD | M] -- C:\Users\suser\AppData\Roaming\Microsoft
[2011/12/19 19:51:45 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\Mozilla
[2012/05/07 18:08:20 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\MULTITEXT
[2011/09/25 17:45:46 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\Nuance
[2012/02/04 16:10:25 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\pymclevel
[2011/09/23 11:42:28 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\REHASOFT
[2011/09/28 18:52:22 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\ScanSoft
[2012/06/10 20:09:43 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\Skype
[2012/04/30 23:02:07 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\TS3Client
[2011/12/31 22:30:20 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\Unity
[2011/11/24 21:02:23 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\WildTangent
[2012/01/06 21:54:44 | 000,000,000 | ---D | M] -- C:\Users\suser\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009/07/14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009/07/14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009/07/14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009/07/14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009/07/14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009/07/14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009/07/14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009/07/14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2008/06/06 07:03:52 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files (x86)\CyberLink\PowerDirector\EventLog.dll
 
< MD5 for: IASTOR.SYS  >
[2010/09/13 11:24:26 | 000,437,272 | ---- | M] (Intel Corporation) MD5=F7CE9BE72EDAC499B713ECA6DAE5D26F -- C:\Windows\SysNative\drivers\iaStor.sys
[2010/09/13 11:24:26 | 000,437,272 | ---- | M] (Intel Corporation) MD5=F7CE9BE72EDAC499B713ECA6DAE5D26F -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_2b0c50dc63f09dae\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2010/11/20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010/11/20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2010/05/12 10:37:57 | 000,410,504 | ---- | M] (Intel Corporation) MD5=513DC087CFED7D2BB82F005385D3531F -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16592_none_0af87721a183cb70\iaStorV.sys
[2011/03/11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011/03/11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011/03/11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011/03/11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011/03/11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011/03/11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009/07/14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
[2010/05/12 10:50:37 | 000,410,496 | ---- | M] (Intel Corporation) MD5=E353CF970C5D4D6A092911E15FB78C07 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20712_none_0bd89532ba6088d9\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009/07/14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010/11/20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010/11/20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010/11/20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010/11/20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009/07/14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2010/05/12 10:38:10 | 000,166,280 | ---- | M] (NVIDIA Corporation) MD5=0AF7B8136794E23E87BE138992880E64 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16592_none_95c1e7d0d8ba7548\nvstor.sys
[2009/07/14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011/03/11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011/03/11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2010/05/12 10:50:49 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=CE76755AF933E728CEBA6C7A970838A4 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20712_none_96a205e1f19732b1\nvstor.sys
[2011/03/11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011/03/11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011/03/11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011/03/11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010/11/20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010/11/20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009/07/14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009/07/14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010/11/20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010/11/20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010/11/20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010/11/20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010/11/20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010/11/20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009/07/14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009/07/14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010/11/20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010/11/20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010/11/20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010/11/20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009/07/14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009/07/14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012/04/04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010/11/20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010/11/20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009/10/28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009/10/28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009/07/14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<          >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 242 bytes -> C:\ProgramData\Temp:0FF263E8

< End of report >
--- --- ---

cosinus 18.06.2012 10:12
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)


Code:
:OTL
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-336442205-827502387-1674173946-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
@Alternate Data Stream - 242 bytes -> C:\ProgramData\Temp:0FF263E8
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

pa4sim 18.06.2012 18:58
Hallo Arne,

hier das logfile von OTL:
Code:
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f}\ deleted successfully.
C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_USERS\S-1-5-21-336442205-827502387-1674173946-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDesktop deleted successfully.
ADS C:\ProgramData\Temp:0FF263E8 deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
User: suser
->Temp folder emptied: 460010743 bytes
->Temporary Internet Files folder emptied: 361096525 bytes
->Java cache emptied: 151317 bytes
->FireFox cache emptied: 602367964 bytes
->Flash cache emptied: 23618 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 470730236 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 17235022 bytes
 
Total Files Cleaned = 1,823.00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Public
 
User: suser
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0.00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.49.0 log created on 06182012_185340

Files\Folders moved on Reboot...
File\Folder C:\Users\suser\AppData\Local\Temp\{BBE10BDA-44F3-4175-9DB8-3971DBA9C4B8}\fpb.tmp not found!
C:\Users\suser\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\SYXVQIHD\ads[4].htm not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PVSJ17FL\google_ads[1].js not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PBSJKZNG\si[1].htm not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PBSJKZNG\si[2].htm not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PBSJKZNG\si[3].htm not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LZZ4IQLF\ads[2].js not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LZZ4IQLF\ads[3].js not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\E4CE9QT2\ads[5].htm not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\E4CE9QT2\ads[6].htm not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\E4CE9QT2\brand[1].js not found!
File\Folder C:\Users\suser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\E4CE9QT2\show_ads[1].js not found!

Registry entries deleted on Reboot...
derzeit ist der Bildschirmhintergrund wie zuvor gesperrt und der Zugriff auf das Nutzerspezifische Profil (c:\Benutzer\suser) nicht möglich. Im Explorer wird der Ordner als gesperrt angezeigt (mit so nem Schloss am Symbol).

Grüße,
Jens

cosinus 18.06.2012 21:20
Hast du unhide schon gemacht? :wtf:

Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

pa4sim 19.06.2012 20:55
Hallo Arne,

hier das log von unhide:
Code:
Unhide by Lawrence Abrams (Grinler)
hxxp://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Unhide.exe can be found at this link:
  hxxp://www.bleepingcomputer.com/forums/topic405109.html

Program started at: 06/19/2012 09:23:45 PM
Windows Version: Windows 7

Please be patient while your files are made visible again.

Processing the C:\ drive
Finished processing the C:\ drive. 260144 files processed.

Processing the D:\ drive
Finished processing the D:\ drive. 846 files processed.

The C:\Users\suser\AppData\Local\Temp\smtmp\ folder does not exist!!
Unhide cannot restore your missing shortcuts!!
Please see this topic in order to learn how to restore default
Start Menu shortcuts: hxxp://www.bleepingcomputer.com/forums/topic405109.html

Searching for Windows Registry changes made by FakeHDD rogues.
 - Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
 - Checking HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
 - Checking HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
 - Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  * HideIcons was set to 1! It was set back to 0!

Restarting Explorer.exe in order to apply changes.

Program finished at: 06/19/2012 09:31:30 PM
Execution time: 0 hours(s), 7 minute(s), and 44 seconds(s)
der Ordner C:\Benutzer\suser ist immer noch schreibgeschützt (ist eventuell normal?), die Dateien+Ordner darunter aber nicht. Sichtbar sind alle Dateien im Explorer, aber der "Desktop" (Bildschirmhintergrund mit den dazugehörigen Icons/Folders) ist auch nach dem Neustart nicht mit dem gefüllt, was im Ordner c:\Benutzer\suser\Desktop oder im Explorer unter Favoriten/Desktop ist.

Hast Du da auch noch einen guten Tipp?

Gruß,
Jens

cosinus 20.06.2012 10:55
Bitte erstmal (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

pa4sim 20.06.2012 20:39
Hallo Arne,

hier das log von TDSSkiller:
Code:
21:32:01.0407 3808        TDSS rootkit removing tool 2.7.40.0 Jun 15 2012 15:13:31
21:32:01.0657 3808        ============================================================
21:32:01.0657 3808        Current date / time: 2012/06/20 21:32:01.0657
21:32:01.0657 3808        SystemInfo:
21:32:01.0657 3808       
21:32:01.0657 3808        OS Version: 6.1.7601 ServicePack: 1.0
21:32:01.0657 3808        Product type: Workstation
21:32:01.0657 3808        ComputerName: SCHLEPPTOP
21:32:01.0657 3808        UserName: suser
21:32:01.0657 3808        Windows directory: C:\Windows
21:32:01.0657 3808        System windows directory: C:\Windows
21:32:01.0657 3808        Running under WOW64
21:32:01.0657 3808        Processor architecture: Intel x64
21:32:01.0657 3808        Number of processors: 4
21:32:01.0657 3808        Page size: 0x1000
21:32:01.0657 3808        Boot type: Normal boot
21:32:01.0657 3808        ============================================================
21:32:02.0328 3808        Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
21:32:02.0343 3808        ============================================================
21:32:02.0343 3808        \Device\Harddisk0\DR0:
21:32:02.0343 3808        MBR partitions:
21:32:02.0343 3808        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
21:32:02.0343 3808        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x12C00000
21:32:02.0343 3808        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x12C33000, BlocksNum 0x248A0800
21:32:02.0343 3808        ============================================================
21:32:02.0390 3808        C: <-> \Device\Harddisk0\DR0\Partition1
21:32:02.0421 3808        D: <-> \Device\Harddisk0\DR0\Partition2
21:32:02.0421 3808        ============================================================
21:32:02.0421 3808        Initialize success
21:32:02.0421 3808        ============================================================
21:32:18.0224 1288        ============================================================
21:32:18.0224 1288        Scan started
21:32:18.0224 1288        Mode: Manual; SigCheck; TDLFS;
21:32:18.0224 1288        ============================================================
21:32:19.0051 1288        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
21:32:19.0176 1288        1394ohci - ok
21:32:19.0254 1288        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
21:32:19.0285 1288        ACPI - ok
21:32:19.0363 1288        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
21:32:19.0410 1288        AcpiPmi - ok
21:32:19.0628 1288        AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
21:32:19.0659 1288        AdobeFlashPlayerUpdateSvc - ok
21:32:19.0769 1288        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
21:32:19.0800 1288        adp94xx - ok
21:32:19.0878 1288        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
21:32:19.0925 1288        adpahci - ok
21:32:19.0971 1288        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
21:32:20.0003 1288        adpu320 - ok
21:32:20.0065 1288        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
21:32:20.0174 1288        AeLookupSvc - ok
21:32:20.0283 1288        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
21:32:20.0330 1288        AFD - ok
21:32:20.0393 1288        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
21:32:20.0424 1288        agp440 - ok
21:32:20.0455 1288        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
21:32:20.0517 1288        ALG - ok
21:32:20.0533 1288        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
21:32:20.0564 1288        aliide - ok
21:32:20.0564 1288        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
21:32:20.0580 1288        amdide - ok
21:32:20.0627 1288        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
21:32:20.0673 1288        AmdK8 - ok
21:32:20.0751 1288        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
21:32:20.0814 1288        AmdPPM - ok
21:32:20.0861 1288        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
21:32:20.0892 1288        amdsata - ok
21:32:20.0954 1288        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
21:32:21.0001 1288        amdsbs - ok
21:32:21.0017 1288        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
21:32:21.0032 1288        amdxata - ok
21:32:21.0095 1288        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
21:32:21.0219 1288        AppID - ok
21:32:21.0251 1288        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
21:32:21.0344 1288        AppIDSvc - ok
21:32:21.0391 1288        Appinfo        (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
21:32:21.0469 1288        Appinfo - ok
21:32:21.0531 1288        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
21:32:21.0563 1288        arc - ok
21:32:21.0594 1288        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
21:32:21.0625 1288        arcsas - ok
21:32:21.0656 1288        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
21:32:21.0750 1288        AsyncMac - ok
21:32:21.0812 1288        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
21:32:21.0828 1288        atapi - ok
21:32:21.0937 1288        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
21:32:22.0062 1288        AudioEndpointBuilder - ok
21:32:22.0077 1288        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
21:32:22.0171 1288        AudioSrv - ok
21:32:22.0233 1288        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
21:32:22.0296 1288        AxInstSV - ok
21:32:22.0405 1288        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
21:32:22.0452 1288        b06bdrv - ok
21:32:22.0530 1288        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
21:32:22.0592 1288        b57nd60a - ok
21:32:22.0717 1288        BBSvc          (93ee7d9c35ae7e9ffda148d7805f1421) C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
21:32:22.0764 1288        BBSvc - ok
21:32:23.0013 1288        BCM43XX        (63dd9c990883709053dd2c427df0db6f) C:\Windows\system32\DRIVERS\bcmwl664.sys
21:32:23.0138 1288        BCM43XX - ok
21:32:23.0279 1288        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
21:32:23.0325 1288        BDESVC - ok
21:32:23.0403 1288        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
21:32:23.0513 1288        Beep - ok
21:32:23.0653 1288        BFE            (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
21:32:23.0762 1288        BFE - ok
21:32:23.0871 1288        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
21:32:23.0981 1288        BITS - ok
21:32:24.0043 1288        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
21:32:24.0090 1288        blbdrive - ok
21:32:24.0152 1288        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
21:32:24.0199 1288        bowser - ok
21:32:24.0230 1288        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
21:32:24.0277 1288        BrFiltLo - ok
21:32:24.0293 1288        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
21:32:24.0339 1288        BrFiltUp - ok
21:32:24.0402 1288        Browser        (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
21:32:24.0495 1288        Browser - ok
21:32:24.0542 1288        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
21:32:24.0589 1288        Brserid - ok
21:32:24.0620 1288        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
21:32:24.0651 1288        BrSerWdm - ok
21:32:24.0698 1288        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
21:32:24.0745 1288        BrUsbMdm - ok
21:32:24.0761 1288        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
21:32:24.0792 1288        BrUsbSer - ok
21:32:24.0839 1288        BthEnum        (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\drivers\BthEnum.sys
21:32:24.0870 1288        BthEnum - ok
21:32:24.0932 1288        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
21:32:24.0979 1288        BTHMODEM - ok
21:32:25.0010 1288        BthPan          (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys
21:32:25.0057 1288        BthPan - ok
21:32:25.0166 1288        BTHPORT        (64c198198501f7560ee41d8d1efa7952) C:\Windows\System32\Drivers\BTHport.sys
21:32:25.0213 1288        BTHPORT - ok
21:32:25.0260 1288        bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
21:32:25.0369 1288        bthserv - ok
21:32:25.0400 1288        BTHUSB          (f188b7394d81010767b6df3178519a37) C:\Windows\System32\Drivers\BTHUSB.sys
21:32:25.0447 1288        BTHUSB - ok
21:32:25.0525 1288        BTWAMPFL        (a0dfb69ade3444c78b17636fcf28e898) C:\Windows\system32\DRIVERS\btwampfl.sys
21:32:25.0556 1288        BTWAMPFL - ok
21:32:25.0603 1288        btwaudio        (7cf028ce78696882b327ff13d2dfa534) C:\Windows\system32\drivers\btwaudio.sys
21:32:25.0619 1288        btwaudio - ok
21:32:25.0650 1288        btwavdt        (3def2370e414b4e299673558ba171a51) C:\Windows\system32\drivers\btwavdt.sys
21:32:25.0665 1288        btwavdt - ok
21:32:25.0837 1288        btwdins        (cc9dae7759ac2c0d19111c0d38ddd232) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
21:32:25.0884 1288        btwdins - ok
21:32:25.0915 1288        btwl2cap        (9ad0fa253ed531d39fb2d74fe12a5fa9) C:\Windows\system32\DRIVERS\btwl2cap.sys
21:32:25.0931 1288        btwl2cap - ok
21:32:25.0946 1288        btwrchid        (9937e0e4dfc0030560a6dfe9d3a94b39) C:\Windows\system32\DRIVERS\btwrchid.sys
21:32:25.0962 1288        btwrchid - ok
21:32:26.0009 1288        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
21:32:26.0102 1288        cdfs - ok
21:32:26.0180 1288        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
21:32:26.0227 1288        cdrom - ok
21:32:26.0289 1288        CertPropSvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
21:32:26.0383 1288        CertPropSvc - ok
21:32:26.0445 1288        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
21:32:26.0477 1288        circlass - ok
21:32:26.0570 1288        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
21:32:26.0601 1288        CLFS - ok
21:32:26.0695 1288        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:32:26.0726 1288        clr_optimization_v2.0.50727_32 - ok
21:32:26.0757 1288        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
21:32:26.0773 1288        clr_optimization_v2.0.50727_64 - ok
21:32:26.0882 1288        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:32:26.0898 1288        clr_optimization_v4.0.30319_32 - ok
21:32:26.0976 1288        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
21:32:26.0991 1288        clr_optimization_v4.0.30319_64 - ok
21:32:27.0023 1288        clwvd          (50f92c943f18b070f166d019dfab3d9a) C:\Windows\system32\DRIVERS\clwvd.sys
21:32:27.0038 1288        clwvd - ok
21:32:27.0085 1288        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
21:32:27.0116 1288        CmBatt - ok
21:32:27.0163 1288        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
21:32:27.0179 1288        cmdide - ok
21:32:27.0288 1288        CNG            (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
21:32:27.0335 1288        CNG - ok
21:32:27.0381 1288        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
21:32:27.0397 1288        Compbatt - ok
21:32:27.0459 1288        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
21:32:27.0506 1288        CompositeBus - ok
21:32:27.0522 1288        COMSysApp - ok
21:32:27.0553 1288        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
21:32:27.0569 1288        crcdisk - ok
21:32:27.0631 1288        CryptSvc        (4f5414602e2544a4554d95517948b705) C:\Windows\system32\cryptsvc.dll
21:32:27.0678 1288        CryptSvc - ok
21:32:27.0771 1288        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
21:32:27.0865 1288        DcomLaunch - ok
21:32:27.0927 1288        defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
21:32:28.0037 1288        defragsvc - ok
21:32:28.0068 1288        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
21:32:28.0161 1288        DfsC - ok
21:32:28.0239 1288        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
21:32:28.0333 1288        Dhcp - ok
21:32:28.0395 1288        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
21:32:28.0489 1288        discache - ok
21:32:28.0520 1288        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
21:32:28.0551 1288        Disk - ok
21:32:28.0598 1288        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
21:32:28.0629 1288        Dnscache - ok
21:32:28.0707 1288        dot3svc        (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
21:32:28.0801 1288        dot3svc - ok
21:32:28.0848 1288        DPS            (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
21:32:28.0941 1288        DPS - ok
21:32:29.0082 1288        DragonSvc      (5f6b9858815da69146a0249d4e83c8fd) C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe
21:32:29.0113 1288        DragonSvc - ok
21:32:29.0160 1288        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
21:32:29.0191 1288        drmkaud - ok
21:32:29.0331 1288        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
21:32:29.0394 1288        DXGKrnl - ok
21:32:29.0456 1288        EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
21:32:29.0534 1288        EapHost - ok
21:32:29.0799 1288        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
21:32:29.0955 1288        ebdrv - ok
21:32:30.0096 1288        EFS            (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
21:32:30.0127 1288        EFS - ok
21:32:30.0267 1288        ehRecvr        (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
21:32:30.0314 1288        ehRecvr - ok
21:32:30.0345 1288        ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
21:32:30.0423 1288        ehSched - ok
21:32:30.0564 1288        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
21:32:30.0626 1288        elxstor - ok
21:32:30.0657 1288        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
21:32:30.0689 1288        ErrDev - ok
21:32:30.0751 1288        EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
21:32:30.0845 1288        EventSystem - ok
21:32:30.0907 1288        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
21:32:31.0001 1288        exfat - ok
21:32:31.0032 1288        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
21:32:31.0141 1288        fastfat - ok
21:32:31.0250 1288        Fax            (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
21:32:31.0313 1288        Fax - ok
21:32:31.0344 1288        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
21:32:31.0375 1288        fdc - ok
21:32:31.0406 1288        fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
21:32:31.0500 1288        fdPHost - ok
21:32:31.0515 1288        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
21:32:31.0593 1288        FDResPub - ok
21:32:31.0625 1288        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
21:32:31.0640 1288        FileInfo - ok
21:32:31.0671 1288        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
21:32:31.0749 1288        Filetrace - ok
21:32:31.0874 1288        FLEXnet Licensing Service (f76d04f7413b07daa029f6520b64b4e8) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
21:32:31.0952 1288        FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - warning
21:32:31.0952 1288        FLEXnet Licensing Service - detected UnsignedFile.Multi.Generic (1)
21:32:31.0983 1288        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
21:32:31.0999 1288        flpydisk - ok
21:32:32.0077 1288        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
21:32:32.0108 1288        FltMgr - ok
21:32:32.0249 1288        FontCache      (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
21:32:32.0311 1288        FontCache - ok
21:32:32.0420 1288        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
21:32:32.0436 1288        FontCache3.0.0.0 - ok
21:32:32.0498 1288        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
21:32:32.0514 1288        FsDepends - ok
21:32:32.0561 1288        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
21:32:32.0592 1288        Fs_Rec - ok
21:32:32.0654 1288        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
21:32:32.0701 1288        fvevol - ok
21:32:32.0732 1288        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
21:32:32.0748 1288        gagp30kx - ok
21:32:32.0857 1288        GameConsoleService (521a469caf61f00e1de081cc2099c1d6) C:\Program Files (x86)\WildGames\Game Console - WildGames\GameConsoleService.exe
21:32:32.0888 1288        GameConsoleService - ok
21:32:33.0013 1288        gpsvc          (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
21:32:33.0107 1288        gpsvc - ok
21:32:33.0153 1288        Hardlock        (091582da724f54830012e3faaf2f1d1a) C:\Windows\system32\drivers\hardlock.sys
21:32:33.0185 1288        Hardlock ( UnsignedFile.Multi.Generic ) - warning
21:32:33.0185 1288        Hardlock - detected UnsignedFile.Multi.Generic (1)
21:32:33.0231 1288        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
21:32:33.0263 1288        hcw85cir - ok
21:32:33.0372 1288        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
21:32:33.0419 1288        HdAudAddService - ok
21:32:33.0450 1288        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
21:32:33.0497 1288        HDAudBus - ok
21:32:33.0512 1288        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
21:32:33.0528 1288        HidBatt - ok
21:32:33.0559 1288        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
21:32:33.0606 1288        HidBth - ok
21:32:33.0637 1288        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
21:32:33.0684 1288        HidIr - ok
21:32:33.0715 1288        hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
21:32:33.0809 1288        hidserv - ok
21:32:33.0871 1288        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
21:32:33.0887 1288        HidUsb - ok
21:32:33.0933 1288        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
21:32:34.0011 1288        hkmsvc - ok
21:32:34.0074 1288        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
21:32:34.0121 1288        HomeGroupListener - ok
21:32:34.0167 1288        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
21:32:34.0214 1288        HomeGroupProvider - ok
21:32:34.0261 1288        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
21:32:34.0292 1288        HpSAMD - ok
21:32:34.0401 1288        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
21:32:34.0511 1288        HTTP - ok
21:32:34.0542 1288        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
21:32:34.0573 1288        hwpolicy - ok
21:32:34.0635 1288        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
21:32:34.0651 1288        i8042prt - ok
21:32:34.0729 1288        iaStor          (f7ce9be72edac499b713eca6dae5d26f) C:\Windows\system32\DRIVERS\iaStor.sys
21:32:34.0760 1288        iaStor - ok
21:32:34.0854 1288        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
21:32:34.0885 1288        iaStorV - ok
21:32:35.0072 1288        idsvc          (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
21:32:35.0119 1288        idsvc - ok
21:32:35.0525 1288        igfx            (a87261ef1546325b559374f5689cf5bc) C:\Windows\system32\DRIVERS\igdkmd64.sys
21:32:35.0790 1288        igfx - ok
21:32:35.0961 1288        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
21:32:35.0993 1288        iirsp - ok
21:32:36.0117 1288        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
21:32:36.0227 1288        IKEEXT - ok
21:32:36.0507 1288        IntcAzAudAddService (404561d4ee0cae109379a40247046b03) C:\Windows\system32\drivers\RTKVHD64.sys
21:32:36.0617 1288        IntcAzAudAddService - ok
21:32:36.0757 1288        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
21:32:36.0788 1288        intelide - ok
21:32:36.0851 1288        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
21:32:36.0882 1288        intelppm - ok
21:32:36.0929 1288        IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
21:32:37.0022 1288        IPBusEnum - ok
21:32:37.0069 1288        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
21:32:37.0163 1288        IpFilterDriver - ok
21:32:37.0287 1288        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
21:32:37.0381 1288        iphlpsvc - ok
21:32:37.0412 1288        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
21:32:37.0443 1288        IPMIDRV - ok
21:32:37.0475 1288        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
21:32:37.0568 1288        IPNAT - ok
21:32:37.0584 1288        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
21:32:37.0631 1288        IRENUM - ok
21:32:37.0677 1288        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
21:32:37.0693 1288        isapnp - ok
21:32:37.0755 1288        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
21:32:37.0787 1288        iScsiPrt - ok
21:32:37.0818 1288        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
21:32:37.0849 1288        kbdclass - ok
21:32:37.0896 1288        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
21:32:37.0927 1288        kbdhid - ok
21:32:37.0974 1288        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:32:38.0005 1288        KeyIso - ok
21:32:38.0036 1288        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
21:32:38.0052 1288        KSecDD - ok
21:32:38.0083 1288        KSecPkg        (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
21:32:38.0099 1288        KSecPkg - ok
21:32:38.0130 1288        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
21:32:38.0223 1288        ksthunk - ok
21:32:38.0286 1288        KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
21:32:38.0379 1288        KtmRm - ok
21:32:38.0457 1288        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
21:32:38.0535 1288        LanmanServer - ok
21:32:38.0598 1288        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
21:32:38.0676 1288        LanmanWorkstation - ok
21:32:38.0723 1288        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
21:32:38.0816 1288        lltdio - ok
21:32:38.0879 1288        lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
21:32:38.0957 1288        lltdsvc - ok
21:32:38.0988 1288        lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
21:32:39.0050 1288        lmhosts - ok
21:32:39.0206 1288        LMS            (2ed1786b7542cda261029f6b526edf44) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
21:32:39.0237 1288        LMS - ok
21:32:39.0269 1288        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
21:32:39.0315 1288        LSI_FC - ok
21:32:39.0331 1288        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
21:32:39.0347 1288        LSI_SAS - ok
21:32:39.0378 1288        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
21:32:39.0393 1288        LSI_SAS2 - ok
21:32:39.0440 1288        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
21:32:39.0456 1288        LSI_SCSI - ok
21:32:39.0503 1288        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
21:32:39.0596 1288        luafv - ok
21:32:39.0643 1288        Mcx2Svc        (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
21:32:39.0674 1288        Mcx2Svc - ok
21:32:39.0705 1288        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
21:32:39.0721 1288        megasas - ok
21:32:39.0783 1288        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
21:32:39.0830 1288        MegaSR - ok
21:32:39.0877 1288        MEIx64          (a6518dcc42f7a6e999bb3bea8fd87567) C:\Windows\system32\DRIVERS\HECIx64.sys
21:32:39.0893 1288        MEIx64 - ok
21:32:39.0939 1288        MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
21:32:40.0033 1288        MMCSS - ok
21:32:40.0064 1288        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
21:32:40.0127 1288        Modem - ok
21:32:40.0173 1288        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
21:32:40.0220 1288        monitor - ok
21:32:40.0267 1288        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
21:32:40.0298 1288        mouclass - ok
21:32:40.0361 1288        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
21:32:40.0392 1288        mouhid - ok
21:32:40.0454 1288        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
21:32:40.0470 1288        mountmgr - ok
21:32:40.0532 1288        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
21:32:40.0563 1288        mpio - ok
21:32:40.0595 1288        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
21:32:40.0688 1288        mpsdrv - ok
21:32:40.0797 1288        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
21:32:40.0922 1288        MpsSvc - ok
21:32:40.0969 1288        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
21:32:41.0000 1288        MRxDAV - ok
21:32:41.0047 1288        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
21:32:41.0094 1288        mrxsmb - ok
21:32:41.0141 1288        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
21:32:41.0203 1288        mrxsmb10 - ok
21:32:41.0250 1288        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
21:32:41.0281 1288        mrxsmb20 - ok
21:32:41.0328 1288        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
21:32:41.0343 1288        msahci - ok
21:32:41.0406 1288        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
21:32:41.0437 1288        msdsm - ok
21:32:41.0484 1288        MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
21:32:41.0531 1288        MSDTC - ok
21:32:41.0577 1288        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
21:32:41.0655 1288        Msfs - ok
21:32:41.0687 1288        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
21:32:41.0765 1288        mshidkmdf - ok
21:32:41.0796 1288        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
21:32:41.0827 1288        msisadrv - ok
21:32:41.0874 1288        MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
21:32:41.0967 1288        MSiSCSI - ok
21:32:41.0983 1288        msiserver - ok
21:32:42.0030 1288        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
21:32:42.0092 1288        MSKSSRV - ok
21:32:42.0123 1288        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
21:32:42.0201 1288        MSPCLOCK - ok
21:32:42.0217 1288        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
21:32:42.0295 1288        MSPQM - ok
21:32:42.0357 1288        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
21:32:42.0389 1288        MsRPC - ok
21:32:42.0435 1288        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
21:32:42.0451 1288        mssmbios - ok
21:32:42.0498 1288        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
21:32:42.0591 1288        MSTEE - ok
21:32:42.0638 1288        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
21:32:42.0654 1288        MTConfig - ok
21:32:42.0685 1288        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
21:32:42.0701 1288        Mup - ok
21:32:42.0794 1288        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
21:32:42.0872 1288        napagent - ok
21:32:42.0935 1288        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
21:32:42.0981 1288        NativeWifiP - ok
21:32:43.0122 1288        NDIS            (c38b8ae57f78915905064a9a24dc1586) C:\Windows\system32\drivers\ndis.sys
21:32:43.0169 1288        NDIS - ok
21:32:43.0231 1288        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
21:32:43.0309 1288        NdisCap - ok
21:32:43.0356 1288        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
21:32:43.0434 1288        NdisTapi - ok
21:32:43.0465 1288        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
21:32:43.0543 1288        Ndisuio - ok
21:32:43.0590 1288        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
21:32:43.0683 1288        NdisWan - ok
21:32:43.0746 1288        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
21:32:43.0839 1288        NDProxy - ok
21:32:43.0886 1288        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
21:32:43.0964 1288        NetBIOS - ok
21:32:44.0027 1288        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
21:32:44.0105 1288        NetBT - ok
21:32:44.0151 1288        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:32:44.0183 1288        Netlogon - ok
21:32:44.0261 1288        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
21:32:44.0370 1288        Netman - ok
21:32:44.0417 1288        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
21:32:44.0526 1288        netprofm - ok
21:32:44.0604 1288        NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
21:32:44.0635 1288        NetTcpPortSharing - ok
21:32:44.0682 1288        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
21:32:44.0697 1288        nfrd960 - ok
21:32:44.0775 1288        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
21:32:44.0853 1288        NlaSvc - ok
21:32:44.0869 1288        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
21:32:44.0947 1288        Npfs - ok
21:32:44.0963 1288        nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
21:32:45.0056 1288        nsi - ok
21:32:45.0056 1288        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
21:32:45.0134 1288        nsiproxy - ok
21:32:45.0321 1288        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
21:32:45.0399 1288        Ntfs - ok
21:32:45.0555 1288        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
21:32:45.0633 1288        Null - ok
21:32:45.0711 1288        NVHDA          (f2662fdc20518ee8a8eed4f61ba42349) C:\Windows\system32\drivers\nvhda64v.sys
21:32:45.0743 1288        NVHDA - ok
21:32:46.0585 1288        nvlddmkm        (e4c35efde340f3a18123ae85104b2b82) C:\Windows\system32\DRIVERS\nvlddmkm.sys
21:32:47.0006 1288        nvlddmkm - ok
21:32:47.0147 1288        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
21:32:47.0178 1288        nvraid - ok
21:32:47.0256 1288        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
21:32:47.0287 1288        nvstor - ok
21:32:47.0427 1288        NVSvc          (7e4d066d8be847723807ef161b78bf07) C:\Windows\system32\nvvsvc.exe
21:32:47.0474 1288        NVSvc - ok
21:32:47.0537 1288        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
21:32:47.0568 1288        nv_agp - ok
21:32:47.0615 1288        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
21:32:47.0661 1288        ohci1394 - ok
21:32:47.0771 1288        ose            (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
21:32:47.0786 1288        ose - ok
21:32:48.0161 1288        osppsvc        (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
21:32:48.0395 1288        osppsvc - ok
21:32:48.0551 1288        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
21:32:48.0597 1288        p2pimsvc - ok
21:32:48.0660 1288        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
21:32:48.0691 1288        p2psvc - ok
21:32:48.0785 1288        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
21:32:48.0831 1288        Parport - ok
21:32:48.0863 1288        partmgr        (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
21:32:48.0894 1288        partmgr - ok
21:32:48.0941 1288        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
21:32:48.0987 1288        PcaSvc - ok
21:32:49.0034 1288        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
21:32:49.0065 1288        pci - ok
21:32:49.0097 1288        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
21:32:49.0128 1288        pciide - ok
21:32:49.0190 1288        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
21:32:49.0221 1288        pcmcia - ok
21:32:49.0237 1288        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
21:32:49.0253 1288        pcw - ok
21:32:49.0331 1288        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
21:32:49.0455 1288        PEAUTH - ok
21:32:49.0565 1288        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
21:32:49.0596 1288        PerfHost - ok
21:32:49.0861 1288        pla            (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
21:32:50.0001 1288        pla - ok
21:32:50.0079 1288        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
21:32:50.0126 1288        PlugPlay - ok
21:32:50.0157 1288        PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
21:32:50.0189 1288        PNRPAutoReg - ok
21:32:50.0235 1288        PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
21:32:50.0267 1288        PNRPsvc - ok
21:32:50.0345 1288        PolicyAgent    (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
21:32:50.0438 1288        PolicyAgent - ok
21:32:50.0516 1288        Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
21:32:50.0610 1288        Power - ok
21:32:50.0703 1288        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
21:32:50.0781 1288        PptpMiniport - ok
21:32:50.0813 1288        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
21:32:50.0844 1288        Processor - ok
21:32:50.0891 1288        ProfSvc        (53e83f1f6cf9d62f32801cf66d8352a8) C:\Windows\system32\profsvc.dll
21:32:50.0937 1288        ProfSvc - ok
21:32:50.0984 1288        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:32:51.0000 1288        ProtectedStorage - ok
21:32:51.0062 1288        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
21:32:51.0156 1288        Psched - ok
21:32:51.0312 1288        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
21:32:51.0421 1288        ql2300 - ok
21:32:51.0593 1288        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
21:32:51.0624 1288        ql40xx - ok
21:32:51.0686 1288        QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
21:32:51.0749 1288        QWAVE - ok
21:32:51.0764 1288        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
21:32:51.0827 1288        QWAVEdrv - ok
21:32:51.0842 1288        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
21:32:51.0920 1288        RasAcd - ok
21:32:51.0983 1288        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
21:32:52.0045 1288        RasAgileVpn - ok
21:32:52.0123 1288        RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
21:32:52.0201 1288        RasAuto - ok
21:32:52.0263 1288        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
21:32:52.0373 1288        Rasl2tp - ok
21:32:52.0435 1288        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
21:32:52.0544 1288        RasMan - ok
21:32:52.0607 1288        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
21:32:52.0669 1288        RasPppoe - ok
21:32:52.0700 1288        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
21:32:52.0794 1288        RasSstp - ok
21:32:52.0856 1288        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
21:32:52.0950 1288        rdbss - ok
21:32:52.0981 1288        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
21:32:53.0028 1288        rdpbus - ok
21:32:53.0059 1288        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
21:32:53.0121 1288        RDPCDD - ok
21:32:53.0137 1288        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
21:32:53.0199 1288        RDPENCDD - ok
21:32:53.0215 1288        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
21:32:53.0293 1288        RDPREFMP - ok
21:32:53.0355 1288        RDPWD          (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys
21:32:53.0402 1288        RDPWD - ok
21:32:53.0480 1288        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
21:32:53.0511 1288        rdyboost - ok
21:32:53.0558 1288        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
21:32:53.0636 1288        RemoteAccess - ok
21:32:53.0683 1288        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
21:32:53.0792 1288        RemoteRegistry - ok
21:32:53.0855 1288        RFCOMM          (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys
21:32:53.0901 1288        RFCOMM - ok
21:32:54.0026 1288        RichVideo      (f12a68ed55053940cadd59ca5e3468dd) C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
21:32:54.0042 1288        RichVideo ( UnsignedFile.Multi.Generic ) - warning
21:32:54.0042 1288        RichVideo - detected UnsignedFile.Multi.Generic (1)
21:32:54.0073 1288        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
21:32:54.0182 1288        RpcEptMapper - ok
21:32:54.0198 1288        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
21:32:54.0229 1288        RpcLocator - ok
21:32:54.0307 1288        RpcSs          (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
21:32:54.0401 1288        RpcSs - ok
21:32:54.0463 1288        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
21:32:54.0525 1288        rspndr - ok
21:32:54.0588 1288        RTL8167        (ea5532868ba76923d75bcb2a1448d810) C:\Windows\system32\DRIVERS\Rt64win7.sys
21:32:54.0619 1288        RTL8167 - ok
21:32:54.0759 1288        rtport          (4ca0dba9e224473d664c25e411f5a3bd) C:\Windows\SysWOW64\drivers\rtport.sys
21:32:54.0791 1288        rtport - ok
21:32:54.0822 1288        SABI            (62db6cc4b0818f1b5f3441241b098f12) C:\Windows\system32\Drivers\SABI.sys
21:32:54.0869 1288        SABI - ok
21:32:54.0900 1288        SamSs          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:32:54.0931 1288        SamSs - ok
21:32:54.0978 1288        Samsung UPD Service (d641337b75b9a9d5ae10687aa1097755) C:\Windows\System32\SUPDSvc.exe
21:32:55.0009 1288        Samsung UPD Service - ok
21:32:55.0149 1288        SAVAdminService (bd57b12fa4c21b1ce7da3570410bf12d) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
21:32:55.0165 1288        SAVAdminService - ok
21:32:55.0227 1288        SAVCleanupService (fa389f50940205526c5f22cd5905be3e) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVCleanupService.exe
21:32:55.0243 1288        SAVCleanupService - ok
21:32:55.0305 1288        SAVOnAccess    (d9057e8ca97628e275979a09ea66b34b) C:\Windows\system32\DRIVERS\savonaccess.sys
21:32:55.0337 1288        SAVOnAccess - ok
21:32:55.0399 1288        SAVService      (836aec603665f6db83965ee57b3dcf57) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
21:32:55.0415 1288        SAVService - ok
21:32:55.0461 1288        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
21:32:55.0493 1288        sbp2port - ok
21:32:55.0539 1288        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
21:32:55.0649 1288        SCardSvr - ok
21:32:55.0695 1288        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
21:32:55.0773 1288        scfilter - ok
21:32:55.0914 1288        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
21:32:56.0023 1288        Schedule - ok
21:32:56.0070 1288        SCPolicySvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
21:32:56.0148 1288        SCPolicySvc - ok
21:32:56.0195 1288        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
21:32:56.0273 1288        SDRSVC - ok
21:32:56.0382 1288        SeaPort        (cc781378e7eda615d2cdca3b17829fa4) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
21:32:56.0413 1288        SeaPort - ok
21:32:56.0475 1288        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
21:32:56.0569 1288        secdrv - ok
21:32:56.0600 1288        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
21:32:56.0694 1288        seclogon - ok
21:32:56.0756 1288        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
21:32:56.0834 1288        SENS - ok
21:32:56.0850 1288        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
21:32:56.0881 1288        SensrSvc - ok
21:32:56.0943 1288        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
21:32:56.0975 1288        Serenum - ok
21:32:57.0006 1288        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
21:32:57.0037 1288        Serial - ok
21:32:57.0099 1288        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
21:32:57.0131 1288        sermouse - ok
21:32:57.0193 1288        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
21:32:57.0302 1288        SessionEnv - ok
21:32:57.0333 1288        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
21:32:57.0365 1288        sffdisk - ok
21:32:57.0396 1288        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
21:32:57.0411 1288        sffp_mmc - ok
21:32:57.0427 1288        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
21:32:57.0458 1288        sffp_sd - ok
21:32:57.0505 1288        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
21:32:57.0536 1288        sfloppy - ok
21:32:57.0599 1288        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
21:32:57.0692 1288        SharedAccess - ok
21:32:57.0755 1288        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
21:32:57.0848 1288        ShellHWDetection - ok
21:32:57.0879 1288        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
21:32:57.0895 1288        SiSRaid2 - ok
21:32:57.0926 1288        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
21:32:57.0957 1288        SiSRaid4 - ok
21:32:58.0051 1288        SkypeUpdate    (6128e98eaaed364ed1a32708d2fd22cb) C:\Program Files (x86)\Skype\Updater\Updater.exe
21:32:58.0082 1288        SkypeUpdate - ok
21:32:58.0113 1288        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
21:32:58.0207 1288        Smb - ok
21:32:58.0269 1288        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
21:32:58.0316 1288        SNMPTRAP - ok
21:32:58.0410 1288        Sophos AutoUpdate Service (b5774835a13b5ed31378aabd07746262) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
21:32:58.0441 1288        Sophos AutoUpdate Service - ok
21:32:58.0503 1288        SophosBootDriver (69fbe35a8165adbc313aa7f64b868ca1) C:\Windows\system32\DRIVERS\SophosBootDriver.sys
21:32:58.0519 1288        SophosBootDriver - ok
21:32:58.0550 1288        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
21:32:58.0566 1288        spldr - ok
21:32:58.0659 1288        Spooler        (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
21:32:58.0753 1288        Spooler - ok
21:32:59.0034 1288        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
21:32:59.0190 1288        sppsvc - ok
21:32:59.0330 1288        sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
21:32:59.0424 1288        sppuinotify - ok
21:32:59.0533 1288        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
21:32:59.0564 1288        srv - ok
21:32:59.0627 1288        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
21:32:59.0673 1288        srv2 - ok
21:32:59.0705 1288        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
21:32:59.0751 1288        srvnet - ok
21:32:59.0829 1288        SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
21:32:59.0939 1288        SSDPSRV - ok
21:32:59.0985 1288        SSPORT          (0211ab46b73a2623b86c1cfcb30579ab) C:\Windows\system32\Drivers\SSPORT.sys
21:33:00.0001 1288        SSPORT - ok
21:33:00.0032 1288        SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
21:33:00.0126 1288        SstpSvc - ok
21:33:00.0204 1288        Steam Client Service - ok
21:33:00.0219 1288        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
21:33:00.0251 1288        stexstor - ok
21:33:00.0297 1288        StillCam        (decacb6921ded1a38642642685d77dac) C:\Windows\system32\DRIVERS\serscan.sys
21:33:00.0329 1288        StillCam - ok
21:33:00.0438 1288        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
21:33:00.0500 1288        stisvc - ok
21:33:00.0531 1288        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
21:33:00.0547 1288        swenum - ok
21:33:00.0828 1288        swi_service    (aa5ca4a5f87c1576ff550a0372b3ed84) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
21:33:00.0906 1288        swi_service - ok
21:33:01.0077 1288        swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
21:33:01.0187 1288        swprv - ok
21:33:01.0421 1288        SynTP          (f5b46df59feaa48a442aed7eeb754d4b) C:\Windows\system32\DRIVERS\SynTP.sys
21:33:01.0483 1288        SynTP - ok
21:33:01.0795 1288        SysMain        (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
21:33:01.0904 1288        SysMain - ok
21:33:02.0045 1288        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
21:33:02.0107 1288        TabletInputService - ok
21:33:02.0185 1288        TapiSrv        (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
21:33:02.0279 1288        TapiSrv - ok
21:33:02.0310 1288        TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
21:33:02.0403 1288        TBS - ok
21:33:02.0637 1288        Tcpip          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
21:33:02.0731 1288        Tcpip - ok
21:33:03.0059 1288        TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
21:33:03.0152 1288        TCPIP6 - ok
21:33:03.0308 1288        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
21:33:03.0402 1288        tcpipreg - ok
21:33:03.0433 1288        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
21:33:03.0449 1288        TDPIPE - ok
21:33:03.0495 1288        TDTCP          (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
21:33:03.0527 1288        TDTCP - ok
21:33:03.0589 1288        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
21:33:03.0667 1288        tdx - ok
21:33:03.0714 1288        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
21:33:03.0745 1288        TermDD - ok
21:33:03.0823 1288        TermService    (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
21:33:03.0932 1288        TermService - ok
21:33:03.0963 1288        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
21:33:04.0010 1288        Themes - ok
21:33:04.0041 1288        THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
21:33:04.0119 1288        THREADORDER - ok
21:33:04.0151 1288        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
21:33:04.0229 1288        TrkWks - ok
21:33:04.0307 1288        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
21:33:04.0400 1288        TrustedInstaller - ok
21:33:04.0447 1288        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
21:33:04.0525 1288        tssecsrv - ok
21:33:04.0572 1288        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
21:33:04.0603 1288        TsUsbFlt - ok
21:33:04.0665 1288        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
21:33:04.0759 1288        tunnel - ok
21:33:04.0790 1288        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
21:33:04.0806 1288        uagp35 - ok
21:33:04.0868 1288        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
21:33:04.0946 1288        udfs - ok
21:33:04.0993 1288        UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
21:33:05.0024 1288        UI0Detect - ok
21:33:05.0071 1288        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
21:33:05.0087 1288        uliagpkx - ok
21:33:05.0133 1288        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
21:33:05.0180 1288        umbus - ok
21:33:05.0227 1288        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
21:33:05.0274 1288        UmPass - ok
21:33:05.0570 1288        UNS            (7e5e1603d0ff2d240ae70295c5c3fefc) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
21:33:05.0679 1288        UNS - ok
21:33:05.0835 1288        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
21:33:05.0945 1288        upnphost - ok
21:33:06.0007 1288        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
21:33:06.0038 1288        usbccgp - ok
21:33:06.0101 1288        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
21:33:06.0132 1288        usbcir - ok
21:33:06.0179 1288        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys
21:33:06.0210 1288        usbehci - ok
21:33:06.0272 1288        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
21:33:06.0319 1288        usbhub - ok
21:33:06.0366 1288        usbohci        (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
21:33:06.0381 1288        usbohci - ok
21:33:06.0413 1288        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
21:33:06.0459 1288        usbprint - ok
21:33:06.0475 1288        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
21:33:06.0522 1288        USBSTOR - ok
21:33:06.0537 1288        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
21:33:06.0584 1288        usbuhci - ok
21:33:06.0647 1288        usbvideo        (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys
21:33:06.0725 1288        usbvideo - ok
21:33:06.0756 1288        UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
21:33:06.0849 1288        UxSms - ok
21:33:06.0881 1288        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:33:06.0912 1288        VaultSvc - ok
21:33:06.0959 1288        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
21:33:06.0974 1288        vdrvroot - ok
21:33:07.0068 1288        vds            (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
21:33:07.0177 1288        vds - ok
21:33:07.0208 1288        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
21:33:07.0239 1288        vga - ok
21:33:07.0255 1288        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
21:33:07.0333 1288        VgaSave - ok
21:33:07.0395 1288        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
21:33:07.0427 1288        vhdmp - ok
21:33:07.0458 1288        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
21:33:07.0473 1288        viaide - ok
21:33:07.0505 1288        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
21:33:07.0536 1288        volmgr - ok
21:33:07.0598 1288        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
21:33:07.0629 1288        volmgrx - ok
21:33:07.0707 1288        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
21:33:07.0739 1288        volsnap - ok
21:33:07.0801 1288        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
21:33:07.0832 1288        vsmraid - ok
21:33:08.0019 1288        VSS            (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
21:33:08.0175 1288        VSS - ok
21:33:08.0347 1288        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
21:33:08.0378 1288        vwifibus - ok
21:33:08.0425 1288        vwififlt        (13a0decd1794de60a8427862c8669d27) C:\Windows\system32\DRIVERS\vwififlt.sys
21:33:08.0456 1288        vwififlt - ok
21:33:08.0534 1288        W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
21:33:08.0659 1288        W32Time - ok
21:33:08.0690 1288        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
21:33:08.0737 1288        WacomPen - ok
21:33:08.0799 1288        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:33:08.0893 1288        WANARP - ok
21:33:08.0909 1288        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:33:08.0971 1288        Wanarpv6 - ok
21:33:09.0174 1288        WatAdminSvc    (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
21:33:09.0252 1288        WatAdminSvc - ok
21:33:09.0439 1288        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
21:33:09.0548 1288        wbengine - ok
21:33:09.0704 1288        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
21:33:09.0751 1288        WbioSrvc - ok
21:33:09.0829 1288        wcncsvc        (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
21:33:09.0891 1288        wcncsvc - ok
21:33:09.0907 1288        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
21:33:09.0954 1288        WcsPlugInService - ok
21:33:10.0032 1288        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
21:33:10.0047 1288        Wd - ok
21:33:10.0141 1288        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
21:33:10.0188 1288        Wdf01000 - ok
21:33:10.0203 1288        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
21:33:10.0250 1288        WdiServiceHost - ok
21:33:10.0266 1288        WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
21:33:10.0297 1288        WdiSystemHost - ok
21:33:10.0359 1288        WebClient      (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
21:33:10.0422 1288        WebClient - ok
21:33:10.0469 1288        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
21:33:10.0547 1288        Wecsvc - ok
21:33:10.0578 1288        wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
21:33:10.0656 1288        wercplsupport - ok
21:33:10.0703 1288        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
21:33:10.0796 1288        WerSvc - ok
21:33:10.0874 1288        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
21:33:10.0937 1288        WfpLwf - ok
21:33:10.0968 1288        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
21:33:10.0983 1288        WIMMount - ok
21:33:11.0015 1288        WinDefend - ok
21:33:11.0030 1288        WinHttpAutoProxySvc - ok
21:33:11.0093 1288        Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
21:33:11.0186 1288        Winmgmt - ok
21:33:11.0405 1288        WinRM          (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
21:33:11.0561 1288        WinRM - ok
21:33:11.0748 1288        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
21:33:11.0779 1288        WinUsb - ok
21:33:11.0888 1288        Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
21:33:11.0951 1288        Wlansvc - ok
21:33:12.0029 1288        wlcrasvc        (06c8fa1cf39de6a735b54d906ba791c6) C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
21:33:12.0044 1288        wlcrasvc - ok
21:33:12.0325 1288        wlidsvc        (7e47c328fc4768cb8beafbcfafa70362) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
21:33:12.0419 1288        wlidsvc - ok
21:33:12.0559 1288        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
21:33:12.0590 1288        WmiAcpi - ok
21:33:12.0684 1288        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
21:33:12.0746 1288        wmiApSrv - ok
21:33:12.0793 1288        WMPNetworkSvc - ok
21:33:12.0855 1288        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
21:33:12.0871 1288        WPCSvc - ok
21:33:12.0918 1288        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
21:33:12.0965 1288        WPDBusEnum - ok
21:33:12.0996 1288        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
21:33:13.0074 1288        ws2ifsl - ok
21:33:13.0105 1288        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
21:33:13.0136 1288        wscsvc - ok
21:33:13.0152 1288        WSearch - ok
21:33:13.0386 1288        wuauserv        (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
21:33:13.0557 1288        wuauserv - ok
21:33:13.0713 1288        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
21:33:13.0823 1288        WudfPf - ok
21:33:13.0854 1288        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
21:33:13.0932 1288        WUDFRd - ok
21:33:13.0979 1288        wudfsvc        (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
21:33:14.0057 1288        wudfsvc - ok
21:33:14.0103 1288        WwanSvc        (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
21:33:14.0166 1288        WwanSvc - ok
21:33:14.0213 1288        MBR (0x1B8)    (2e5debb2116b3417023e0d6562d7ed07) \Device\Harddisk0\DR0
21:33:14.0774 1288        \Device\Harddisk0\DR0 - ok
21:33:14.0774 1288        Boot (0x1200)  (a71f9d4598d239d26ca108ec7b2813b3) \Device\Harddisk0\DR0\Partition0
21:33:14.0774 1288        \Device\Harddisk0\DR0\Partition0 - ok
21:33:14.0805 1288        Boot (0x1200)  (90c9597566c6f7b05beb06829773d490) \Device\Harddisk0\DR0\Partition1
21:33:14.0821 1288        \Device\Harddisk0\DR0\Partition1 - ok
21:33:14.0837 1288        Boot (0x1200)  (75c97f766ac9bbafea66ddb327ee8a65) \Device\Harddisk0\DR0\Partition2
21:33:14.0837 1288        \Device\Harddisk0\DR0\Partition2 - ok
21:33:14.0837 1288        ============================================================
21:33:14.0837 1288        Scan finished
21:33:14.0837 1288        ============================================================
21:33:14.0852 5540        Detected object count: 3
21:33:14.0852 5540        Actual detected object count: 3
21:33:44.0742 5540        FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user
21:33:44.0742 5540        FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:33:44.0742 5540        Hardlock ( UnsignedFile.Multi.Generic ) - skipped by user
21:33:44.0742 5540        Hardlock ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:33:44.0742 5540        RichVideo ( UnsignedFile.Multi.Generic ) - skipped by user
21:33:44.0742 5540        RichVideo ( UnsignedFile.Multi.Generic ) - User select action: Skip
LG,
Jens

cosinus 21.06.2012 10:36
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

pa4sim 22.06.2012 19:00
Hier das log von Combofix:
[code]
Combofix Logfile:
Code:
ComboFix 12-06-21.03 - suser 22.06.2012  19:33:10.1.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.43.1031.18.4076.2613 [GMT 2:00]
ausgeführt von:: d:\papas daten\ComboFix.exe
AV: Sophos Anti-Virus *Disabled/Updated* {479CCF92-4960-B3E0-7373-BF453B467D2C}
SP: Sophos Anti-Virus *Disabled/Updated* {FCFD2E76-6F5A-BC6E-49C3-843740C13791}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
c:\windows\SysWow64\Temp
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-05-22 bis 2012-06-22  ))))))))))))))))))))))))))))))
.
.
2012-06-22 17:51 . 2012-06-22 17:51        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-06-22 08:53 . 2012-05-31 04:04        9013136        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{AFA6F6F9-6BE5-40B6-B07B-0E1BDD175532}\mpengine.dll
2012-06-15 20:56 . 2012-06-15 20:56        --------        d-----w-        c:\program files (x86)\ESET
2012-06-15 19:20 . 2012-06-15 19:20        --------        d-----w-        c:\users\suser\AppData\Roaming\Malwarebytes
2012-06-15 19:20 . 2012-06-15 19:20        --------        d-----w-        c:\programdata\Malwarebytes
2012-06-15 19:20 . 2012-06-15 19:20        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2012-06-15 19:20 . 2012-04-04 13:56        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-06-13 19:15 . 2012-05-18 01:59        1392128        ----a-w-        c:\windows\system32\wininet.dll
2012-06-13 11:11 . 2012-04-26 05:41        149504        ----a-w-        c:\windows\system32\rdpcorekmts.dll
2012-06-13 11:11 . 2012-04-26 05:41        77312        ----a-w-        c:\windows\system32\rdpwsx.dll
2012-06-13 11:11 . 2012-04-26 05:34        9216        ----a-w-        c:\windows\system32\rdrmemptylst.exe
2012-06-13 11:11 . 2012-05-01 05:40        209920        ----a-w-        c:\windows\system32\profsvc.dll
2012-06-13 11:11 . 2012-05-04 11:06        5559664        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-06-13 11:10 . 2012-05-04 10:03        3913072        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe
2012-06-13 11:10 . 2012-05-04 10:03        3968368        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe
2012-06-13 11:10 . 2012-05-15 01:32        3146752        ----a-w-        c:\windows\system32\win32k.sys
2012-06-13 11:10 . 2012-04-28 03:55        210944        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-06-13 11:10 . 2012-04-07 12:31        3216384        ----a-w-        c:\windows\system32\msi.dll
2012-06-13 11:10 . 2012-04-07 11:26        2342400        ----a-w-        c:\windows\SysWow64\msi.dll
2012-06-13 11:10 . 2012-04-24 05:37        1462272        ----a-w-        c:\windows\system32\crypt32.dll
2012-06-13 11:10 . 2012-04-24 04:36        1158656        ----a-w-        c:\windows\SysWow64\crypt32.dll
2012-06-13 11:10 . 2012-04-24 05:37        184320        ----a-w-        c:\windows\system32\cryptsvc.dll
2012-06-13 11:10 . 2012-04-24 05:37        140288        ----a-w-        c:\windows\system32\cryptnet.dll
2012-06-13 11:10 . 2012-04-24 04:36        140288        ----a-w-        c:\windows\SysWow64\cryptsvc.dll
2012-06-13 11:10 . 2012-04-24 04:36        103936        ----a-w-        c:\windows\SysWow64\cryptnet.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-05 21:05 . 2012-04-11 12:29        419488        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-05-05 21:05 . 2011-10-10 13:54        70304        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-05 21:05 . 2012-04-11 13:05        8744608        ----a-w-        c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-03-30 11:35 . 2012-05-09 20:00        1918320        ----a-w-        c:\windows\system32\drivers\tcpip.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\programdata\FLEXnet\Connect\11\ISUSPM.exe" [2010-07-29 222496]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2011-12-01 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Sophos AutoUpdate Monitor"="c:\program files (x86)\Sophos\AutoUpdate\almon.exe" [2010-09-21 439536]
"DNS7reminder"="c:\program files (x86)\Nuance\NaturallySpeaking11\Ereg\Ereg.exe" [2007-04-16 259624]
"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"OpwareSE2"="c:\program files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"OPSE reminder"="c:\program files (x86)\ScanSoft\OmniPageSE2.0\EregGer\Ereg.exe" [2003-07-07 729088]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2011-2-8 1136928]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\Sophos\SOPHOS~1\sophos_detoured.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer7"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *\0SophosBootTasks
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SAVCleanupService;Sophos Cleanup Service;c:\program files (x86)\Sophos\Sophos Anti-Virus\SAVCleanupService.exe [2010-07-23 104688]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 257696]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-01 183560]
R3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 Samsung UPD Service;Samsung UPD Service;c:\windows\System32\SUPDSvc.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 DragonSvc;Dragon Service;c:\program files (x86)\Common Files\Nuance\dgnsvc.exe [2010-07-29 296808]
R4 SophosBootDriver;SophosBootDriver;c:\windows\system32\DRIVERS\SophosBootDriver.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [x]
S1 SAVOnAccess;SAVOnAccess;c:\windows\system32\DRIVERS\savonaccess.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 SAVAdminService;Sophos Anti-Virus Statusreporter;c:\program files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [2010-10-08 163056]
S2 SAVService;Sophos Anti-Virus;c:\program files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [2010-06-14 97520]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [x]
S2 swi_service;Sophos Web Intelligence Service;c:\program files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [2012-02-21 1543704]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-21 2656280]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-22 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 21:05]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-02-27 11780712]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\progra~2\Sophos\SOPHOS~1\sophos_detoured_x64.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.at/
mStart Page = hxxp://samsung.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
LSP: c:\programdata\Sophos Web Intelligence\swi_lsp.dll
TCP: DhcpNameServer = 10.0.0.138
TCP: Interfaces\{6232175D-65B3-41ED-B91E-AD5CD677075C}\A415453435: NameServer = 109.73.52.12,109.73.52.11
FF - ProfilePath - c:\users\suser\AppData\Roaming\Mozilla\Firefox\Profiles\ul4lh25d.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.at/
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Hardlock Device Drivers - c:\windows\System32\UNWISE.EXE
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-06-22  19:54:03
ComboFix-quarantined-files.txt  2012-06-22 17:54
.
Vor Suchlauf: 16 Verzeichnis(se), 77.423.902.720 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 76.777.185.280 Bytes frei
.
- - End Of File - - E0F3E4C339BBAEB65D851757C227DAF9
--- --- ---


Grüße,
Jens

cosinus 24.06.2012 15:49
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

pa4sim 26.06.2012 20:31
Hallo Arne,

gmer lief problemlos, OSAM konnte ich nicht runterladen (gibt es eine alternativadresse?) und aswMBR ging mit AVscan-none. 2 logs anbei:
1. GMER:
[code]
GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-26 20:41:06
Windows 6.1.7601 Service Pack 1
Running: 0exmjbgz.exe


---- Registry - GMER 1.0.15 ----

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\b4749fd61096                     
Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\b482fee44c72                     
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\b4749fd61096 (not active ControlSet) 
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\b482fee44c72 (not active ControlSet) 

---- EOF - GMER 1.0.15 ----
--- --- ---


2. aswMBR:
[code]
GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-26 20:41:06
Windows 6.1.7601 Service Pack 1
Running: 0exmjbgz.exe


---- Registry - GMER 1.0.15 ----

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\b4749fd61096                     
Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\b482fee44c72                     
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\b4749fd61096 (not active ControlSet) 
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\b482fee44c72 (not active ControlSet) 

---- EOF - GMER 1.0.15 ----
--- --- ---


OSAM kann ich morgen nochmal probieren runterzuladen, falls es keine alternativadresse gibt.

Grüße,
Jens

cosinus 27.06.2012 12:30
Der Link ist aber nicht tot :confused:
=> http://www2.online-solutions.ru/en/d...e.php?p=131115

pa4sim 28.06.2012 20:08
Hete geht's. Hier das logfile von OSAM:
Code:
OSAM Logfile:

       
Code:

       
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 21:05:09 on 28.06.2012

OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 64-bit
Default Browser: Mozilla Corporation Firefox 8.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[AppInit DLLs]
-----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )-----
"AppInit_DLLs" - "Sophos Plc" - C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured.dll

[Common]
-----( %SystemRoot%\Tasks )-----
"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

[Control Panel Objects]
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\MLCFG32.CPL
"Pando" - "Pando Networks" - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"btwampfl" (BTWAMPFL) - "Broadcom Corporation." - C:\Windows\System32\DRIVERS\btwampfl.sys
"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)
"Hardlock" (Hardlock) - "Aladdin Knowledge Systems Ltd." - C:\Windows\system32\drivers\hardlock.sys
"rtport" (rtport) - "Windows (R) 2003 DDK 3790 provider" - C:\Windows\SysWOW64\drivers\rtport.sys
"SAVOnAccess" (SAVOnAccess) - "Sophos Plc" - C:\Windows\System32\DRIVERS\savonaccess.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} "Album Download IE Asynchronous Pluggable Protocol Interface" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files (x86)\7-Zip\7-zip.dll
{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "Acrobat Elements Context Menu" - "Adobe Systems Inc." - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat Elements\ContextMenu.dll
{D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\VISSHE.DLL
{A3A1D8A1-006D-4B93-BA27-6F6B4C9C4F1D} "ContextMenuHandler Class" - "Sophos Plc" - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavShellExt.dll
{506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\VISSHE.DLL
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{0875DCB6-C686-4243-9432-ADCCF0B9F2D7} "Microsoft OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Outlook" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\MLSHEXT.DLL
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\OLKFSTUB.DLL
{E99987AC-6311-4686-B095-EB30B69F9258} "Samsung AnyWeb Print" - ? - C:\Program Files\Samsung AnyWeb Print\W2PDeskband.dll
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files (x86)\WinRAR\rarext.dll
{B41DB860-64E4-11D2-9906-E49FADC173CA} "WinRAR shell extension" - ? -   (File not found | COM-object registry key not found)
{0563DB41-F538-4B37-A92D-4659049B7766} "WLMD Message Handler" - ? -   (File not found | COM-object registry key not found)
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
ITBar7Height64 "ITBar7Height64" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout64" - ? -   (File not found | COM-object registry key not found)
<binary data> "{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "@C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
{94BB0C4C-B957-479A-85E4-42F53B89F681} "Samsung AnyWeb Print" - ? - C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll
"Senden an Bluetooth" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{FFFDC614-B694-4AE6-AB38-5D6374584B52} "Verknüpfte &OneNote-Notizen" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{AE7CD045-E861-484f-8273-0445EE161910} "Adobe PDF Conversion Toolbar Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{d2ce3e00-f94a-4740-988e-03dc2f38c34f} "Bing Bar Helper" - ? - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"  (File not found)
{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
{AA609D72-8482-4076-8991-8CDAE5B93BCB} "Samsung BHO Class" - ? - C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Browser Helper" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{F4971EE7-DAA0-4053-9964-665D8EE6A077} "SmartSelect Class" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
{39EA7695-B3F2-4C44-A4BC-297ADA8FD235} "Sophos Web Content Scanner" - "Sophos Plc" - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SophosBHO.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corp." - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[LSA Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----
"Security Packages" - "Microsoft Corp." - C:\Windows\system32\livessp.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\suser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Bluetooth.lnk" - ? - C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File not found)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"ISUSPM" - "Acresso Corporation" - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
"Steam" - "Valve Corporation" - "C:\Program Files (x86)\Steam\steam.exe" -silent
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce )-----
"FlashPlayerUpdate" - "Adobe Systems Incorporated" - C:\Windows\system32\Macromed\Flash\FlashUtil64_11_2_202_235_ActiveX.exe -update activex
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Acrobat Assistant 8.0" - "Adobe Systems Inc." - "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
"Adobe Acrobat Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
"DNS7reminder" - "Nuance Communications, Inc." - "C:\Program Files (x86)\Nuance\NaturallySpeaking11\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking11\Ereg.ini
"OPSE reminder" - ? - "C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\EregGer\Ereg.exe" -r "C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\EregGer\ereg.ini"
"OpwareSE2" - "ScanSoft, Inc." - "C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
"Sophos AutoUpdate Monitor" - "Sophos Plc" - C:\Program Files (x86)\Sophos\AutoUpdate\almon.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Adobe PDF Port Monitor" - "Adobe Systems Inc" - C:\Windows\system32\AdobePDF.dll
"HP Discovery Port Monitor (HP Photosmart Plus B210 series)" - "Hewlett-Packard Co." - C:\Windows\system32\HPDiscoPM8e11.dll
"spd__ Langmon" - ? - C:\Windows\system32\spd__l.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)
"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)
"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
"Bing Bar Update Service" (BBSvc) - "Microsoft Corporation." - C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Macrovision Europe Ltd." - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"GameConsoleService" (GameConsoleService) - "WildTangent, Inc." - C:\Program Files (x86)\WildGames\Game Console - WildGames\GameConsoleService.exe
"Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
"Intel(R) Management and Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"NVIDIA Driver Helper Service" (NVSvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe
"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"Samsung UPD Service" (Samsung UPD Service) - "Samsung Electronics CO., LTD." - C:\Windows\System32\SUPDSvc.exe
"SeaPort" (SeaPort) - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files (x86)\Skype\Updater\Updater.exe
"Sophos Anti-Virus" (SAVService) - "Sophos Plc" - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
"Sophos Anti-Virus Statusreporter" (SAVAdminService) - "Sophos Plc" - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
"Sophos AutoUpdate Service" (Sophos AutoUpdate Service) - "Sophos Plc" - C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
"Sophos Web Intelligence Service" (swi_service) - "Sophos Plc" - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
"Steam Client Service" (Steam Client Service) - "Valve Corporation" - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"WindowsLive Local NSP" - "Microsoft Corp." - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
"WindowsLive NSP" - "Microsoft Corp." - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----
"Sophos Web Intelligence LSP" - "Sophos Plc" - C:\ProgramData\Sophos Web Intelligence\swi_lsp.dll

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Grüße,
Jens

cosinus 29.06.2012 11:44
aswMBR fehlt noch, du hast das GMER LOg dafür 2x gepostet ;)

pa4sim 29.06.2012 18:18
Hallo Arne,

meine Oma hat immer gesagt: "was man nicht im Kopf hat, hat man in den Beinen" - ist zwar mit dem Computer eher im Finger, ändert aber nichts am Sinn :-).

hier der aswMBR log, ich musste den AVscan auf none stellen:
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-26 21:12:44
-----------------------------
21:12:44.876    OS Version: Windows x64 6.1.7601 Service Pack 1
21:12:44.876    Number of processors: 4 586 0x2A07
21:12:44.876    ComputerName: SCHLEPPTOP  UserName: suser
21:12:45.547    Initialize success
21:12:55.304    AVAST engine defs: 12062600
21:16:09.861    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
21:16:09.877    Disk 0 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 3
21:16:09.892    Disk 0 MBR read successfully
21:16:09.892    Disk 0 MBR scan
21:16:09.908    Disk 0 unknown MBR code
21:16:09.924    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
21:16:09.939    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      153600 MB offset 206848
21:16:09.955    Disk 0 Partition - 00    0F Extended LBA            299330 MB offset 314779648
21:16:09.986    Disk 0 Partition 3 00    27 Hidden NTFS WinRE NTFS        23907 MB offset 927807488
21:16:10.033    Disk 0 Partition 4 00    07    HPFS/NTFS NTFS      299329 MB offset 314781696
21:16:10.080    Disk 0 scanning C:\Windows\system32\drivers
21:16:24.915    Service scanning
21:17:21.559    Modules scanning
21:17:21.575    Disk 0 trace - called modules:
21:17:21.621    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
21:17:21.637    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8005fff060]
21:17:21.653    3 CLASSPNP.SYS[fffff88001b6243f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004505050]
21:17:21.668    Scan finished successfully
21:17:46.129    Disk 0 MBR has been saved successfully to "D:\suser\MBR.dat"
21:17:46.145    The log file has been saved successfully to "D:\suser\aswMBR.txt"
Grüße,
Jens

cosinus 01.07.2012 14:20
Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

pa4sim 01.07.2012 20:39
Hallo Arne,

hier der neue log:
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-07-01 21:19:36
-----------------------------
21:19:36.637    OS Version: Windows x64 6.1.7601 Service Pack 1
21:19:36.637    Number of processors: 4 586 0x2A07
21:19:36.637    ComputerName: SCHLEPPTOP  UserName: suser
21:19:37.277    Initialize success
21:21:27.423    AVAST engine defs: 12070100
21:22:32.781    Verifying
21:22:42.796    Disk 0 Windows 601 MBR fixed successfully
21:23:07.460    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
21:23:07.475    Disk 0 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 3
21:23:07.475    Disk 0 MBR read successfully
21:23:07.491    Disk 0 MBR scan
21:23:07.491    Disk 0 Windows 7 default MBR code
21:23:07.553    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
21:23:07.569    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      153600 MB offset 206848
21:23:07.584    Disk 0 Partition - 00    0F Extended LBA            299330 MB offset 314779648
21:23:07.616    Disk 0 Partition 3 00    27 Hidden NTFS WinRE NTFS        23907 MB offset 927807488
21:23:07.647    Disk 0 Partition 4 00    07    HPFS/NTFS NTFS      299329 MB offset 314781696
21:23:07.694    Disk 0 scanning C:\Windows\system32\drivers
21:23:21.079    Service scanning
21:24:18.065    Modules scanning
21:24:18.081    Disk 0 trace - called modules:
21:24:18.097    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
21:24:18.112    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8005fe2060]
21:24:18.112    3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80040e3050]
21:24:18.128    Scan finished successfully
21:24:40.857    Disk 0 MBR has been saved successfully to "D:\Papas Daten\MBR.dat"
21:24:40.857    The log file has been saved successfully to "D:\Papas Daten\aswMBR_after_fixMBR.txt"


aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-07-01 21:32:22
-----------------------------
21:32:22.498    OS Version: Windows x64 6.1.7601 Service Pack 1
21:32:22.498    Number of processors: 4 586 0x2A07
21:32:22.514    ComputerName: SCHLEPPTOP  UserName: suser
21:32:23.044    Initialize success
21:32:34.728    AVAST engine defs: 12070100
21:32:41.140    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
21:32:41.140    Disk 0 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 3
21:32:41.187    Disk 0 MBR read successfully
21:32:41.202    Disk 0 MBR scan
21:32:41.202    Disk 0 Windows 7 default MBR code
21:32:41.218    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
21:32:41.249    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      153600 MB offset 206848
21:32:41.265    Disk 0 Partition - 00    0F Extended LBA            299330 MB offset 314779648
21:32:41.296    Disk 0 Partition 3 00    27 Hidden NTFS WinRE NTFS        23907 MB offset 927807488
21:32:41.327    Disk 0 Partition 4 00    07    HPFS/NTFS NTFS      299329 MB offset 314781696
21:32:41.374    Disk 0 scanning C:\Windows\system32\drivers
21:32:55.664    Service scanning
21:33:54.335    Modules scanning
21:33:54.866    Disk 0 trace - called modules:
21:33:54.897    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
21:33:54.913    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8006000060]
21:33:54.913    3 CLASSPNP.SYS[fffff88001ba843f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800449d050]
21:33:54.928    Scan finished successfully
21:34:09.982    Disk 0 MBR has been saved successfully to "D:\Papas Daten\MBR.dat"
21:34:10.013    The log file has been saved successfully to "D:\Papas Daten\aswMBR_after_fixMBR.txt"
Grüße,
Jens

cosinus 02.07.2012 11:05
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

pa4sim 02.07.2012 16:31
Hallo Arne,

anbei die logs von MBAM und SASW:

1. MBAM
Code:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.07.02.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
suser :: SCHLEPPTOP [Administrator]

02.07.2012 14:11:53
mbam-log-2012-07-02 (14-11-53).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 410949
Laufzeit: 52 Minute(n), 40 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
SASW:
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 07/02/2012 at 05:13 PM

Application Version : 5.5.1006

Core Rules Database Version : 8828
Trace Rules Database Version: 6640

Scan type      : Complete Scan
Total Scan Time : 01:56:33

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator

Memory items scanned      : 644
Memory threats detected  : 0
Registry items scanned    : 67865
Registry threats detected : 0
File items scanned        : 194660
File threats detected    : 251

Adware.Tracking Cookie
        C:\Users\suser\AppData\Roaming\Microsoft\Windows\Cookies\RGV3GV1S.txt [ /partypoker.com ]
        C:\Users\suser\AppData\Roaming\Microsoft\Windows\Cookies\M6N2NXXL.txt [ /c.atdmt.com ]
        C:\Users\suser\AppData\Roaming\Microsoft\Windows\Cookies\Y43U22XC.txt [ /doubleclick.net ]
        C:\Users\suser\AppData\Roaming\Microsoft\Windows\Cookies\W87VXFVH.txt [ /openstat.net ]
        C:\Users\suser\AppData\Roaming\Microsoft\Windows\Cookies\2S6VUZ41.txt [ /spylog.com ]
        C:\Users\suser\AppData\Roaming\Microsoft\Windows\Cookies\1B0O5EEJ.txt [ /serving-sys.com ]
        C:\Users\suser\AppData\Roaming\Microsoft\Windows\Cookies\CG7O0LIS.txt [ /atdmt.com ]
        C:\Users\suser\AppData\Roaming\Microsoft\Windows\Cookies\FQJQ3BJ3.txt [ /apmebf.com ]
        C:\Users\suser\AppData\Roaming\Microsoft\Windows\Cookies\RG1NIB7L.txt [ /rambler.ru ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\L1Y2EWI9.txt [ Cookie:suser@tradedoubler.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\W9WAM4Q4.txt [ Cookie:suser@revsci.net/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\RK9CMQ2M.txt [ Cookie:suser@ad2.adfarm1.adition.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\RJ931ZO5.txt [ Cookie:suser@ad1.adfarm1.adition.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\FB3RNM0E.txt [ Cookie:suser@ad4.adfarm1.adition.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\35YD2432.txt [ Cookie:suser@tns-counter.ru/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\DIOU7PFZ.txt [ Cookie:suser@eliteanimes.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\592KR5AJ.txt [ Cookie:suser@adform.net/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\TW23OXCV.txt [ Cookie:suser@webmasterplan.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\2N7X7JZV.txt [ Cookie:suser@yadro.ru/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\VEW6JWLN.txt [ Cookie:suser@clicksor.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\6TT84DFC.txt [ Cookie:suser@ads.falkemedia.de/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\JEORMI7K.txt [ Cookie:suser@c.atdmt.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\WU49BHGK.txt [ Cookie:suser@counter.sexsuche.tv/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\VZMUU65O.txt [ Cookie:suser@invitemedia.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\6BQK0K2J.txt [ Cookie:suser@2o7.net/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\PCZX2Z1Q.txt [ Cookie:suser@trafficmp.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\X7SEW7OP.txt [ Cookie:suser@www.elitepvpers.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\TD8BOW9T.txt [ Cookie:suser@fastclick.net/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\0IXFVOK7.txt [ Cookie:suser@www.etracker.de/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\LM5JHE9A.txt [ Cookie:suser@doubleclick.net/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\X5TKU8XI.txt [ Cookie:suser@adviva.net/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\UVWWE110.txt [ Cookie:suser@tracking.gameforge.de/track/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\VG0CCRJZ.txt [ Cookie:suser@elitepvpers.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\94AZXT4E.txt [ Cookie:suser@zanox.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\K3BUF5PE.txt [ Cookie:suser@guj.122.2o7.net/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\BFWV62SS.txt [ Cookie:suser@at.atwola.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZX4LHXFE.txt [ Cookie:suser@accounts.google.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\IFO1Z1YI.txt [ Cookie:suser@lfstmedia.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\DLMRUVKP.txt [ Cookie:suser@specificclick.net/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\7EYFR72Y.txt [ Cookie:suser@rts.pgmediaserve.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\DACVPIIR.txt [ Cookie:suser@www.burstnet.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\T6YO6EHB.txt [ Cookie:suser@butlers.traffective-tracking.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\0LHWQAXF.txt [ Cookie:suser@tribalfusion.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\HD9LZUB8.txt [ Cookie:suser@publishers.domainadvertising.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\RFCHZTZ6.txt [ Cookie:suser@serving-sys.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\0SM3P7YH.txt [ Cookie:suser@statse.webtrendslive.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\DBXK1RCF.txt [ Cookie:suser@ads.quartermedia.de/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\WV22FQXN.txt [ Cookie:suser@insightexpressai.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\QLD3A8QO.txt [ Cookie:suser@adtech.de/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\X438TBGV.txt [ Cookie:suser@track.adform.net/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\HD4V3B31.txt [ Cookie:suser@de.partypoker.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\ER2ABD45.txt [ Cookie:suser@counter2.sexmoney.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\52B4OO2P.txt [ Cookie:suser@collective-media.net/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\K5OJJ87Q.txt [ Cookie:suser@ad3.adfarm1.adition.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\QMY32ESD.txt [ Cookie:suser@atdmt.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\XKSBOYP0.txt [ Cookie:suser@ad.zanox.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\AMGVLLQW.txt [ Cookie:suser@media6degrees.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\446EBD4I.txt [ Cookie:suser@server.cpmstar.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\9QJD4IG8.txt [ Cookie:suser@advertising.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\X8PNJL3O.txt [ Cookie:suser@tracking.quisma.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\0ZAGWYLJ.txt [ Cookie:suser@mediaplex.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\UMTZXK5O.txt [ Cookie:suser@mediafire.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\C1HK70HS.txt [ Cookie:suser@c.gigcount.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\RPEMOZSW.txt [ Cookie:suser@r1-ads.ace.advertising.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\NEQH5IA1.txt [ Cookie:suser@casalemedia.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\RRIC1UR2.txt [ Cookie:suser@track.effiliation.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\FYBDFUTL.txt [ Cookie:suser@www.eliteanimes.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\V682LMY6.txt [ Cookie:suser@adxpose.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\G5352G8O.txt [ Cookie:suser@new-media-engineering.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\18CDFJ1B.txt [ Cookie:suser@zanox-affiliate.de/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\MKUGQ82A.txt [ Cookie:suser@austrianairlines.122.2o7.net/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\DG2IRD7E.txt [ Cookie:suser@adserver.adreactor.com/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\IA5273M5.txt [ Cookie:suser@eas4.emediate.eu/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\8V9OGD0D.txt [ Cookie:suser@airfrance.bannerfactory.fr/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\KRYVLIM3.txt [ Cookie:suser@livestat.derstandard.at/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\JQ55BZ1O.txt [ Cookie:suser@track.effiliation.com/servlet/ ]
        C:\USERS\suser\AppData\Roaming\Microsoft\Windows\Cookies\Low\FU4HH9M0.txt [ Cookie:suser@dyntracker.com/ ]
        C:\USERS\suser\Cookies\M6N2NXXL.txt [ Cookie:suser@c.atdmt.com/ ]
        C:\USERS\suser\Cookies\Y43U22XC.txt [ Cookie:suser@doubleclick.net/ ]
        C:\USERS\suser\Cookies\W87VXFVH.txt [ Cookie:suser@openstat.net/ ]
        C:\USERS\suser\Cookies\2S6VUZ41.txt [ Cookie:suser@spylog.com/ ]
        C:\USERS\suser\Cookies\1B0O5EEJ.txt [ Cookie:suser@serving-sys.com/ ]
        C:\USERS\suser\Cookies\CG7O0LIS.txt [ Cookie:suser@atdmt.com/ ]
        .server.cpmstar.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        eas4.emediate.eu [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .technoratimedia.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .technoratimedia.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .adxpose.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .counter.sexsuche.tv [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        counter2.sexmoney.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        logging.ourstats.de [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        www.usenext.de [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad.adserver01.de [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        tracking.oe24.at [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        tracking.oe24.at [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        tracking.oe24.at [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        rts.pgmediaserve.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        rts.pgmediaserve.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        rts.pgmediaserve.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        www.my-adserver.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .my-adserver.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        www.my-adserver.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        www.my-adserver.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        www.my-adserver.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        www.my-adserver.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad.velmedia.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad.velmedia.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad.velmedia.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad.velmedia.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .ad.velmedia.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .ad.velmedia.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .ad.velmedia.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .velmedia.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .yadro.ru [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .content.yieldmanager.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .adserver.adtechus.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .247realmedia.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .martiniadnetwork.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .martiniadnetwork.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .martiniadnetwork.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .247realmedia.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        www.elitepvpers.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        www.elitepvpers.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        www.elitepvpers.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .elitepvpers.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .elitepvpers.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .elitepvpers.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .elitepvpers.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        www.elitepvpers.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        www.elitepvpers.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        www.elitepvpers.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .mediafire.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .mediafire.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .mediafire.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .mediafire.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .burstnet.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .burstnet.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        dc.tremormedia.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        gr.burstnet.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .adinterax.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .adinterax.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        tracking.mlsat02.de [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad1.adfarm1.adition.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        server.adform.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        server.adform.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .c1.atdmt.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .lucidmedia.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        eas4.emediate.eu [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        media.tripod.lycos.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        media.laredoute.fr [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        www.netxmedia.net [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .a.revenuemax.de [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        adfarm1.adition.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        ad2.adfarm1.adition.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\suser\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL4LH25D.DEFAULT\COOKIES.SQLITE ]
Grüße,
Jens

cosinus 03.07.2012 10:35
Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

pa4sim 05.07.2012 13:32
Hallo Arne,

schön zu hören, dass das System trojanerfrei zu sein scheint. Das Problem vom Anfang, dass der Desktop (= Bildschirmhintergrund) nicht benutzt werden kann ist allerdings immer noch das gleiche. Symptome: Ich bekomme die Dateien/links nicht am Desktop angezeigt, die unter "C:/Benutzer/suser/Desktop/" liegen. Ich kann zwar bei der Installation von Programmen angeben, dass ein Desktoplink erzeugt werden soll (was in dem Ordner auch passiert) aber auf dem Desktop erscheint nichts. Der Ordner selber scheint irgendwie geschützt (im Explorer ist ein Schloss zu sehen, wenn ich den Ornder ansehe).

Hast Du da auch einen Lösungsvorschlag?

Liebe Grüße,
Jens

cosinus 05.07.2012 13:37
Manchmal wird das Startmenü und der Desktop von Ransomware gelöscht oder versteckt, wenn überhaupt kannst du mit unhide noch was wiederherstellen. Wenn nicht bist du ohne Backup angeschmiert
Vllt hast du aber auch Glück und die Symbole wurden nur versteckt ("versteckt" ist in diesem Zusammenhang ein Dateiattribut )


Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

pa4sim 05.07.2012 14:21
Hallo Arne,

mit unhide geht nichts - schade.

ich nehme an, dass der Ort von dem Das System die Desktopinfo nimmt nicht nur ein Registryeintrag ist?

Grüße,
Jens

cosinus 05.07.2012 16:06
Wenn unhide nicht funktioniert, gibt es AFAIK keine einfache Möglichkeit Startmenü/Desktop wiederherzustellen

Ansonsten noch Probleme offen?

pa4sim 17.07.2012 15:05
Hallo Arne,

danke für die Unterstützung. Ich werde den Rechner wohl neu aufsetzten und dann in den Tipps von Dir schauen um etwas sicherer unterwegs zu sein.

Grüße,
Jens

cosinus 18.07.2012 14:43
Wieso gleich deswegen komplett neu aufsetzen? Wenn es nur um die Verknüpfungen geht, di ekann man sich doch selbst wieder erstellen :wtf: :confused:

pa4sim 20.07.2012 18:17
Hallo Arne,

super. Wie geht das denn?

Grüße,
Jens

cosinus 21.07.2012 15:01
Ja einfach die Programmverknüpfungen wieder erstellen? :balla:

Für solche trivialen Sachen darfst du auch ruhig selbst mal Google anschmeißen! => Verknpfung mit Ordner, Datei oder Programm erstellen

pa4sim 21.07.2012 22:02
Hi Arne,

wie ich eine Verknüpfung erstelle ist eh' klar :stirn:.
Was aber noch unklar ist: Auf dem Bildschirm wird normalerweise angezeigt, was im Ordner "Benutzer/<user>/Desktop/" aufgelistet ist. Das ist bei dem Rechner aber derzeit nicht der Fall. Wenn ich auf den Bildschirm (= Hintergrund in diesem Fall) gehe und sage "Neue Verknüpfung" kommt der übliche Dialog und im genannten Ordner ist dann auch die Verknüpfung zu sehen, aber nicht auf dem Bildschirm, wo sie normalerweise zu sehen ist. Da ist immer nur das Hintergrundbild zu sehen. Gleiches passiert, wenn ich eine Verknüpfung aus einem explorer-Fenster durch draganddrop erstelle. Es ist fast so, als wenn die icons einen offset haben und per default nicht mehr im "sichtbaren Bereich" des Desktops abgelegt werden.

Ich weis nicht wie ich es besser beschreiben soll.

LG,
Jens

cosinus 23.07.2012 14:13
Das hier hast du schon gecheckt? http://cheesebuerger.de/images/midi/froehlich/a048.gif => Alle Desktop-Symbole schnell einblenden und ausblenden

pa4sim 23.07.2012 18:57
Hallo Arne,

das ist super :applaus: . Rechner wie gewohnt. Ich wusste nicht mal dass es in W7 so eine Option gibt. Danke für die Hilfe bis ins letzte Detail.

Grüße,
Jens

cosinus 24.07.2012 14:36
Das gab es schon bei XP http://www.saved.im/mtg4otiynwpn/3.gif


Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 03:43 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131