Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   GUV Verschlüsselungs-Trojaner (https://www.trojaner-board.de/129527-guv-verschluesselungs-trojaner.html)

as9361 14.01.2013 11:56
GUV Verschlüsselungs-Trojaner
 
Hallo zusammen,

ich habe offensichtlich einen GUV Trojaner auf meinem Rechner.

Leider lässt sich der Rechner auch nicht im abgesicherten Modus hochfahren,
er fährt dann beim Erscheinen des Desktop wieder runter.

Ich habe mir eine CD mit OTLPENet.exe erstellt und den Rechner damit gestartet. Dann OTLpe ausgeführt, mit Run Scan.

Nach dem Scan wurde ein Fenster mit der OTL.txt geöffnet. Diese habe ich gespeichert und füge sie meiner Nachricht bei. Weiter habe ich noch nichts unternommen.

Bin auch kein Experte und hoffe das ihr mir weiter helfen könnt.

Danke und Grüße
Andreas

as9361 14.01.2013 13:01
Sorry, ich hatte überlesen, daß die txt als Code-Tag gesendet werden soll.

Grüße
Andreas

OTL Logfile:
Code:
OTL logfile created on: 1/13/2013 11:10:01 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
Windows Vista (TM) Home Premium Service Pack 1 (Version = 6.0.6001) - Type = System
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 226.76 Gb Total Space | 75.40 Gb Free Space | 33.25% Space Free | Partition Type: NTFS
Drive D: | 226.00 Gb Total Space | 225.91 Gb Free Space | 99.96% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto] --  -- (Winmgmt)
SRV - [2012/11/29 03:26:17 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/05/08 12:52:41 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/05/08 12:52:40 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/06/08 06:02:00 | 000,633,856 | ---- | M] (Nokia) [On_Demand] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2009/03/05 04:54:50 | 000,311,296 | ---- | M] () [Auto] -- C:\Windows\System32\Rezip.exe -- (Rezip)
SRV - [2009/01/30 04:07:00 | 000,282,624 | ---- | M] (Marvell) [Auto] -- C:\Windows\System32\ykx32mpcoinst.dll -- (yksvc)
SRV - [2008/03/17 22:27:12 | 000,013,312 | ---- | M] (Agere Systems) [Auto] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2008/01/20 21:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008/01/15 19:51:44 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand] --  -- (IpInIp)
DRV - [2012/12/26 10:46:49 | 000,030,616 | ---- | M] () [Kernel | On_Demand] -- C:\Windows\System32\drivers\hitmanpro37.sys -- (hitmanpro37)
DRV - [2012/05/08 12:52:41 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012/05/08 12:52:41 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011/09/16 10:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011/05/18 03:12:28 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2009/10/08 10:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/03/12 11:25:28 | 004,386,304 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008/11/20 20:22:24 | 000,238,464 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\VMC326.sys -- (VMC326)
DRV - [2008/11/03 23:13:32 | 000,952,320 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008/08/26 03:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/08/11 21:03:20 | 000,013,312 | ---- | M] (SAMSUNG ELECTRONICS CO., LTD.) [Kernel | Auto] -- C:\Windows\System32\drivers\KMDFMEMIO.sys -- (KMDFMEMIO)
DRV - [2008/03/20 22:13:00 | 001,203,776 | ---- | M] (Agere Systems) [Kernel | On_Demand] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2008/01/20 21:23:20 | 002,225,664 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2007/08/14 18:00:00 | 000,567,936 | ---- | M] (AVM Berlin) [Kernel | On_Demand] -- C:\Windows\System32\drivers\fxusbase.sys -- (fxusbase)
DRV - [2007/08/14 18:00:00 | 000,064,512 | ---- | M] (AVM GmbH) [Kernel | On_Demand] -- C:\Windows\System32\drivers\avmcowan.sys -- (AVMCOWAN)
DRV - [2006/11/02 02:30:53 | 000,045,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\Scherer_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
IE - HKU\Scherer_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\Scherer_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKU\Scherer_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\Scherer_ON_C\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com
IE - HKU\Scherer_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com
IE - HKU\Scherer_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\System32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/12/28 09:34:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/06/24 05:15:28 | 000,000,000 | ---D | M]
 
[2012/12/28 09:34:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/06/24 05:15:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012/11/29 03:26:57 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/11/29 04:19:31 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/11/29 04:19:31 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/11/29 04:19:31 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012/11/29 04:19:32 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/11/29 04:19:31 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/11/29 04:19:31 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006/09/18 16:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Nikon Message Center 2] C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe (Nikon Corporation)
O4 - HKLM..\Run: [PDFPrint] C:\Program Files\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\Scherer_ON_C..\Run: [avupdate]  File not found
O4 - HKU\Scherer_ON_C..\Run: [L1QtW710QzepO1Z]  File not found
O4 - Startup: Error locating startup folders.
O13 - gopher Prefix: missing
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\Scherer_ON_C Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\Scherer_ON_C Winlogon: Shell - (C:\Users\Scherer\AppData\Roaming\skype.dat) - C:\Users\Scherer\AppData\Roaming\skype.dat ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/01/03 14:16:09 | 000,000,000 | ---D | C] -- C:\Users\Scherer\Documents\Ethnicraft stonecut oak tv board
[2013/01/01 15:41:49 | 000,000,000 | ---D | C] -- C:\Users\Scherer\AppData\Local\Macromedia
[2013/01/01 15:39:47 | 000,697,272 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012/12/28 09:30:35 | 019,232,984 | ---- | C] (Mozilla) -- C:\Users\Scherer\Desktop\Firefox_Setup_17.0.1.exe
[2012/12/26 20:02:25 | 000,213,640 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfehidk.sys
[2012/12/26 20:02:25 | 000,130,424 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\Mpfp.sys
[2012/12/26 20:02:25 | 000,079,304 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfeavfk.sys
[2012/12/26 20:02:25 | 000,040,552 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfesmfk.sys
[2012/12/26 20:02:25 | 000,035,272 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfebopk.sys
[2012/12/26 20:02:25 | 000,034,216 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mferkdk.sys
[2012/12/26 20:02:24 | 000,054,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmProv.dll
[2012/12/26 20:02:24 | 000,001,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmCl.dll
[2012/12/26 17:45:26 | 000,000,000 | ---D | C] -- C:\Users\Scherer\AppData\Roaming\Malwarebytes
[2012/12/26 17:45:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/12/26 17:44:33 | 010,063,000 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Scherer\Desktop\mbam-setup.exe
[2012/12/26 17:09:49 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/12/26 17:06:12 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Scherer\Desktop\OTL.exe
[2012/12/26 10:46:05 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro
[2012/12/26 03:10:57 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012/12/25 18:12:30 | 001,754,528 | ---- | C] (Bleeping Computer, LLC) -- C:\rkill.com
[2012/12/25 18:05:26 | 000,000,000 | ---D | C] -- C:\Users\Scherer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Progressive Protection
[2012/12/25 17:15:37 | 000,000,000 | ---D | C] -- C:\ProgramData\9EA1536869B7623500009EA0B4CE68E9
[2012/12/18 15:15:15 | 000,000,000 | ---D | C] -- C:\Users\Scherer\Desktop\fotobuch 2012_mcf-Dateien
[2012/12/15 16:00:31 | 000,000,000 | ---D | C] -- C:\Users\Scherer\AppData\Local\Nik Software
[1 C:\Users\Scherer\AppData\Roaming\*.tmp files -> C:\Users\Scherer\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/01/13 13:50:09 | 000,000,004 | ---- | M] () -- C:\Users\Scherer\AppData\Roaming\skype.ini
[2013/01/13 13:50:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/01/13 13:50:02 | 000,000,422 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{8ABE1372-F6EF-4A57-8A93-2F3EBBB833DE}.job
[2013/01/13 13:49:42 | 000,372,096 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013/01/13 13:49:39 | 000,004,784 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/13 13:49:38 | 000,004,784 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/13 13:48:52 | 3184,119,808 | -HS- | M] () -- C:\hiberfil.sys
[2013/01/12 18:18:44 | 000,019,968 | ---- | M] () -- C:\Users\Scherer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/01/12 16:47:13 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2013/01/05 15:12:35 | 000,052,240 | ---- | M] () -- C:\Users\Scherer\Documents\Fotowelt-Datei 2011.mcf
[2013/01/05 15:12:02 | 000,052,240 | ---- | M] () -- C:\Users\Scherer\Documents\Fotowelt-Datei 2011.mcf~
[2013/01/01 15:59:38 | 000,004,121 | ---- | M] () -- C:\Users\Scherer\Documents\musik.rtf
[2013/01/01 15:39:47 | 000,697,272 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013/01/01 15:39:47 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/12/31 04:51:03 | 000,000,020 | -H-- | M] () -- C:\ProgramData\PKP_DLet.DAT
[2012/12/28 09:34:22 | 000,000,870 | ---- | M] () -- C:\Users\Scherer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/12/28 09:34:22 | 000,000,858 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/12/28 09:32:36 | 019,232,984 | ---- | M] (Mozilla) -- C:\Users\Scherer\Desktop\Firefox_Setup_17.0.1.exe
[2012/12/26 17:17:00 | 095,023,320 | ---- | M] () -- C:\ProgramData\0tbpw.pad
[2012/12/26 11:31:44 | 000,550,017 | ---- | M] () -- C:\Users\Scherer\Desktop\adwcleaner.exe
[2012/12/26 11:31:44 | 000,550,017 | ---- | M] () -- C:\adwcleaner.exe
[2012/12/26 11:26:16 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Scherer\Desktop\OTL.exe
[2012/12/26 10:46:49 | 000,030,616 | ---- | M] () -- C:\Windows\System32\drivers\hitmanpro37.sys
[2012/12/26 05:01:38 | 010,063,000 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Scherer\Desktop\mbam-setup.exe
[2012/12/26 03:23:24 | 000,684,726 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012/12/26 03:23:24 | 000,642,094 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/12/26 03:23:24 | 000,149,396 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012/12/26 03:23:24 | 000,120,982 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/12/26 03:10:57 | 101,531,662 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012/12/25 18:55:59 | 000,003,201 | ---- | M] () -- C:\ProgramData\0tbpw.js
[2012/12/25 18:07:48 | 001,754,528 | ---- | M] (Bleeping Computer, LLC) -- C:\rkill.com
[2012/12/19 15:09:25 | 000,174,015 | ---- | M] () -- C:\Users\Scherer\Desktop\fotobuch 2012.mcf
[2012/12/18 16:07:45 | 000,104,525 | ---- | M] () -- C:\Users\Scherer\Desktop\fotobuch 2012.mcf~
[2012/12/18 14:49:35 | 001,566,704 | ---- | M] () -- C:\Users\Scherer\Desktop\setup_Mein_CEWE_FOTOBUCH.exe
[2012/12/17 15:21:45 | 000,250,300 | ---- | M] () -- C:\Users\Scherer\Desktop\gimpfx-foundry-2.6-1.zip
[1 C:\Users\Scherer\AppData\Roaming\*.tmp files -> C:\Users\Scherer\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/01/13 13:48:52 | 3184,119,808 | -HS- | C] () -- C:\hiberfil.sys
[2013/01/12 18:27:16 | 000,000,004 | ---- | C] () -- C:\Users\Scherer\AppData\Roaming\skype.ini
[2013/01/05 14:44:47 | 000,052,240 | ---- | C] () -- C:\Users\Scherer\Documents\Fotowelt-Datei 2011.mcf~
[2013/01/05 14:44:47 | 000,052,240 | ---- | C] () -- C:\Users\Scherer\Documents\Fotowelt-Datei 2011.mcf
[2012/12/28 09:34:22 | 000,000,870 | ---- | C] () -- C:\Users\Scherer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/12/26 20:02:25 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01007_Inbox_Critical.Wdf
[2012/12/26 18:14:22 | 000,550,017 | ---- | C] () -- C:\adwcleaner.exe
[2012/12/26 17:57:05 | 000,550,017 | ---- | C] () -- C:\Users\Scherer\Desktop\adwcleaner.exe
[2012/12/26 10:46:49 | 000,030,616 | ---- | C] () -- C:\Windows\System32\drivers\hitmanpro37.sys
[2012/12/26 03:10:38 | 101,531,662 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012/12/25 18:55:59 | 000,003,201 | ---- | C] () -- C:\ProgramData\0tbpw.js
[2012/12/25 18:55:48 | 095,023,320 | ---- | C] () -- C:\ProgramData\0tbpw.pad
[2012/12/18 15:15:15 | 000,174,015 | ---- | C] () -- C:\Users\Scherer\Desktop\fotobuch 2012.mcf
[2012/12/18 15:15:15 | 000,104,525 | ---- | C] () -- C:\Users\Scherer\Desktop\fotobuch 2012.mcf~
[2012/12/18 14:49:30 | 001,566,704 | ---- | C] () -- C:\Users\Scherer\Desktop\setup_Mein_CEWE_FOTOBUCH.exe
[2012/12/17 15:21:45 | 000,250,300 | ---- | C] () -- C:\Users\Scherer\Desktop\gimpfx-foundry-2.6-1.zip
[2012/10/12 17:20:16 | 000,000,536 | ---- | C] () -- C:\Users\Scherer\AppData\Roaming\.gmic_sources.cimgz
[2012/05/12 08:31:53 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Examples
[2012/05/12 08:31:53 | 000,000,268 | RH-- | C] () -- C:\Users\Scherer\AppData\Roaming\Enhance Timing
[2012/05/12 08:31:53 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLev.DAT
[2012/05/12 08:31:52 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Error Handlers
[2012/05/12 08:31:52 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Equalizer
[2012/05/12 08:31:52 | 000,000,268 | RH-- | C] () -- C:\Users\Scherer\AppData\Roaming\Electric Piano
[2012/05/12 08:31:52 | 000,000,268 | RH-- | C] () -- C:\Users\Scherer\AppData\Roaming\Electric Clav
[2012/05/12 08:31:52 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLet.DAT
[2012/05/12 08:31:52 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLes.DAT
[2012/03/15 18:21:03 | 000,000,048 | ---- | C] () -- C:\Users\Scherer\AppData\Roaming\blckdom.res
[2012/02/25 04:52:10 | 000,000,680 | ---- | C] () -- C:\Users\Scherer\AppData\Local\d3d9caps.dat
[2012/02/17 16:20:19 | 000,019,968 | ---- | C] () -- C:\Users\Scherer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/10/14 02:42:30 | 000,000,294 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2011/07/12 15:19:13 | 000,000,454 | ---- | C] () -- C:\Users\Scherer\AppData\Roaming\.gmic_faves
[2011/06/05 16:40:03 | 000,013,264 | -HS- | C] () -- C:\Users\Scherer\AppData\Local\d14v7w72vysgy
[2011/06/05 16:40:03 | 000,013,264 | -HS- | C] () -- C:\ProgramData\d14v7w72vysgy
[2011/05/31 13:15:34 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2011/03/27 12:39:21 | 000,000,103 | ---- | C] () -- C:\Windows\wiso.ini
[2011/02/09 12:05:33 | 000,058,880 | ---- | C] () -- C:\Users\Scherer\AppData\Roaming\skype.dat
[2009/12/23 04:57:04 | 000,003,654 | ---- | C] () -- C:\Windows\System32\drivers\Sonyhcp.dll
[2009/06/12 12:42:24 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2009/06/11 22:08:28 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009/06/11 22:05:00 | 000,307,200 | ---- | C] () -- C:\Windows\SetDisplayResolution.exe
[2009/06/11 21:28:23 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009/06/11 21:28:23 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/06/11 20:58:24 | 000,000,135 | R--- | C] () -- C:\Windows\System32\lngEng.ini
[2009/06/11 20:58:24 | 000,000,117 | ---- | C] () -- C:\Windows\System32\lngKor.ini
[2009/06/11 20:53:10 | 000,311,296 | ---- | C] () -- C:\Windows\System32\Rezip.exe
[2009/06/11 20:51:50 | 000,040,960 | ---- | C] () -- C:\Windows\System32\IhDEV.exe
[2009/06/11 20:51:49 | 000,024,576 | ---- | C] () -- C:\Windows\System32\IhINF.exe
[2009/06/11 20:51:34 | 000,003,990 | ---- | C] () -- C:\Windows\HotFixList.ini
[2009/06/11 06:15:20 | 000,684,726 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009/06/11 06:15:20 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009/06/11 06:15:20 | 000,149,396 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009/06/11 06:15:20 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009/06/11 06:07:03 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2009/06/11 06:06:50 | 000,181,944 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2009/06/11 06:06:50 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2009/06/11 06:06:50 | 000,081,920 | ---- | C] () -- C:\Windows\System32\ATIODE.exe
[2009/06/11 06:06:50 | 000,045,056 | ---- | C] () -- C:\Windows\System32\ATIODCLI.exe
[2008/02/09 11:03:07 | 000,024,576 | ---- | C] () -- C:\Windows\System32\drivers\Marker.exe
[2007/02/26 02:49:12 | 006,139,774 | ---- | C] () -- C:\Windows\imagine digital freedom.dat
[2006/11/02 07:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 07:47:37 | 000,372,096 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 07:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 05:33:01 | 000,642,094 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 05:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 05:33:01 | 000,120,982 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 05:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 05:25:21 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006/11/02 05:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 03:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 03:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 02:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
 
========== LOP Check ==========
 
[2012/03/15 18:21:23 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\01014
[2012/03/16 15:44:11 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\01015
[2012/02/11 14:26:57 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\Buhl Data Service
[2011/08/07 04:39:44 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\DVDVideoSoft
[2011/08/07 04:39:31 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\DVDVideoSoftIEHelpers
[2010/11/21 08:31:53 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\Eumex 400
[2012/05/14 15:00:27 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\FreeFileSync
[2013/01/12 11:38:27 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\gtk-2.0
[2011/10/14 02:45:14 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\Imusol
[2012/08/17 12:03:20 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\IrfanView
[2012/03/15 18:20:41 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\kock
[2011/06/19 10:04:54 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\Mirillis
[2012/02/29 16:07:33 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\NeatImage SL 32
[2012/08/30 13:55:41 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\Nikon
[2012/02/02 17:21:44 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\Nuvi
[2011/07/22 01:23:30 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\PC Suite
[2012/10/21 08:04:14 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\Picturenaut
[2011/12/28 09:35:02 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\RavensburgerTipToi
[2012/03/15 17:43:41 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\TeamViewer
[2012/03/25 16:49:38 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\UAs
[2012/03/25 16:50:25 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\xmldm
[2011/10/14 02:29:52 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\Ybcigy
[2012/02/03 19:29:39 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\Zusu
[2011/05/03 14:19:26 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\Zuyqer
[2012/12/25 17:50:56 | 000,000,000 | ---D | M] -- C:\ProgramData\9EA1536869B7623500009EA0B4CE68E9
[2009/09/21 13:35:38 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2012/02/11 14:27:21 | 000,000,000 | ---D | M] -- C:\ProgramData\Buhl Data Service GmbH
[2010/08/05 06:22:13 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonBJ
[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2012/05/12 08:31:52 | 000,000,000 | ---D | M] -- C:\ProgramData\Documentation
[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2009/09/21 13:35:38 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2012/05/12 08:31:52 | 000,000,000 | ---D | M] -- C:\ProgramData\Electric Clav
[2012/05/12 08:31:53 | 000,000,000 | ---D | M] -- C:\ProgramData\EnterNHelp
[2012/05/12 08:31:53 | 000,000,000 | ---D | M] -- C:\ProgramData\Extensions
[2009/09/21 13:35:38 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2012/12/26 10:46:05 | 000,000,000 | ---D | M] -- C:\ProgramData\HitmanPro
[2011/06/19 10:04:54 | 000,000,000 | ---D | M] -- C:\ProgramData\Mirillis
[2012/05/12 08:25:12 | 000,000,000 | ---D | M] -- C:\ProgramData\Nikon
[2011/09/08 04:19:50 | 000,000,000 | ---D | M] -- C:\ProgramData\NokiaInstallerCache
[2012/03/16 15:54:28 | 000,000,000 | ---D | M] -- C:\ProgramData\PC Suite
[2011/11/16 15:15:02 | 000,000,000 | ---D | M] -- C:\ProgramData\PhotoME
[2012/12/28 06:42:24 | 000,000,000 | ---D | M] -- C:\ProgramData\RavensburgerTipToi
[2009/06/11 22:10:28 | 000,000,000 | ---D | M] -- C:\ProgramData\SAMSUNG
[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2009/09/21 13:35:38 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2006/11/02 08:02:04 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2013/01/05 14:30:53 | 000,000,000 | ---D | M] -- C:\ProgramData\tmp
[2012/05/12 08:31:53 | 000,000,000 | ---D | M] -- C:\ProgramData\Ultima_T15
[2009/09/21 13:35:38 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2012/03/18 20:07:48 | 000,000,000 | ---D | M] -- C:\ProgramData\WinClon
[2012/02/06 16:30:55 | 000,000,000 | ---D | M] -- C:\ProgramData\Windows
[2009/11/13 17:03:35 | 000,000,000 | ---D | M] -- C:\ProgramData\WinZip
[2013/01/12 16:47:14 | 000,032,586 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2013/01/13 13:50:02 | 000,000,422 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{8ABE1372-F6EF-4A57-8A93-2F3EBBB833DE}.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\Scherer\Documents\CIMG0191.AVI:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Scherer\Documents\CIMG0190.AVI:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Scherer\Documents\CIMG0156.AVI:TOC.WMV
< End of report >
--- --- ---

[/CODE]

cosinus 16.01.2013 08:35
:hallo:

Mach einen OTL-Fix über OTLPE, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
O4 - HKU\Scherer_ON_C..\Run: [avupdate]  File not found
O4 - HKU\Scherer_ON_C..\Run: [L1QtW710QzepO1Z]  File not found
O20 - HKU\Scherer_ON_C Winlogon: Shell - (C:\Users\Scherer\AppData\Roaming\skype.dat) - C:\Users\Scherer\AppData\Roaming\skype.dat ()
:Files
C:\Users\Scherer\AppData\Roaming\01014
C:\Users\Scherer\AppData\Roaming\01015
C:\Users\Scherer\AppData\Roaming\kock
C:\Users\Scherer\AppData\Roaming\UAs
C:\Users\Scherer\AppData\Roaming\xmldm
C:\Users\Scherer\AppData\Roaming\Ybcigy
C:\Users\Scherer\AppData\Roaming\Zusu
C:\Users\Scherer\AppData\Roaming\Zuyqer
C:\ProgramData\9EA1536869B7623500009EA0B4CE68E9
C:\Users\Scherer\AppData\Roaming\skype.dat
C:\Users\Scherer\AppData\Roaming\skype.ini
C:\Users\Scherer\AppData\Local\d14v7w72vysgy
C:\ProgramData\d14v7w72vysgy
C:\ProgramData\PKP_DLet.DAT
C:\ProgramData\PKP_DLes.DAT
C:\ProgramData\PKP_DLev.DAT
C:\ProgramData\0tbpw.js
C:\ProgramData\0tbpw.pad
C:\Users\Scherer\AppData\Roaming\blckdom.res
:Commands
[purity]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Danach sollte Windows wieder normal starten - stell uns bitte den Quarantäneordner von OTL zur Verfügung. Dabei bitte so vorgehen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinträchtigen!
2.) Ordner movedfiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten!

4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

as9361 16.01.2013 09:34
Hallo Cosinuns,

vielen Dank für die Hilfe, der Rechner fährt wieder "normal" hoch.

Das Logfile sende ich als Anlage.

Soll ich einen Scan mit Malwarebytes und dem adwcleaner machen?

Grüße
Andreas

cosinus 16.01.2013 10:04
Bevor wir uns an die weitere Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
  • Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.

  • Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.

  • Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!

  • Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!

  • Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.


Malwarebytes Anti-Rootkit http://img.trojaner-board.de/malware...otkit/logo.png

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Entpacke das Archiv auf deinem Desktop.
  • Im neu erstellten Ordner starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

as9361 16.01.2013 12:07
Erledigt.

Erster Scan: Malware Found: 8, Logfile: mbar-log-2013-01-16 (11-24-31).txt

Code:
Malwarebytes Anti-Rootkit BETA 1.01.0.1016
www.malwarebytes.org

Database version: v2013.01.09.01

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
Scherer :: SCHERER-PC [administrator]

16.01.2013 11:24:31
mbar-log-2013-01-16 (11-24-31).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 27958
Time elapsed: 11 minute(s), 47 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKCU\SOFTWARE\CLASSES\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9} (Hijack.Trojan.Siredef.C) -> Delete on reboot.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 3
c:\$Recycle.Bin\S-1-5-21-326891830-3036340036-2452681849-1003\$9579f6821fdb988c8b83cc51a3e96cb6\U (Trojan.Siredef.C) -> Delete on reboot.
c:\$Recycle.Bin\S-1-5-21-326891830-3036340036-2452681849-1003\$9579f6821fdb988c8b83cc51a3e96cb6\L (Trojan.Siredef.C) -> Delete on reboot.
c:\$Recycle.Bin\S-1-5-21-326891830-3036340036-2452681849-1003\$9579f6821fdb988c8b83cc51a3e96cb6 (Trojan.Siredef.C) -> Delete on reboot.

Files Detected: 4
c:\$Recycle.Bin\S-1-5-21-326891830-3036340036-2452681849-1003\$9579f6821fdb988c8b83cc51a3e96cb6\@ (Trojan.Siredef.C) -> Delete on reboot.
c:\$Recycle.Bin\S-1-5-21-326891830-3036340036-2452681849-1003\$9579f6821fdb988c8b83cc51a3e96cb6\U\00000001.@ (Trojan.Siredef.C) -> Delete on reboot.
c:\$Recycle.Bin\S-1-5-21-326891830-3036340036-2452681849-1003\$9579f6821fdb988c8b83cc51a3e96cb6\U\80000000.@ (Trojan.Siredef.C) -> Delete on reboot.
c:\$Recycle.Bin\S-1-5-21-326891830-3036340036-2452681849-1003\$9579f6821fdb988c8b83cc51a3e96cb6\U\800000cb.@ (Trojan.Siredef.C) -> Delete on reboot.

(end)



Zweiter Scan: Nichts gefunden, Logfile: mbar-log-2013-01-16 (11-58-12).txt

Code:
Malwarebytes Anti-Rootkit BETA 1.01.0.1016
www.malwarebytes.org

Database version: v2013.01.09.01

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
Scherer :: SCHERER-PC [administrator]

16.01.2013 11:58:12
mbar-log-2013-01-16 (11-58-12).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 27963
Time elapsed: 12 minute(s), 52 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

cosinus 16.01.2013 16:01
Hast auch noch einen ZeroAcess http://www.saved.im/mtg4oti2n3no/7.gif

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

as9361 16.01.2013 20:30
Hallo, hier die txt-Datei.

Ich habe vorher den Avira-Antivirus Scan deaktiviert. Reichte das aus?
Das Avira Symbol unten rechts habe ich nicht weg bekommen.

ComboFix.txt

Code:
Combofix Logfile:

       
Code:

       
ComboFix 13-01-16.01 - Scherer 16.01.2013  19:45:41.1.2 - x86
ausgeführt von:: c:\users\Scherer\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Windows
c:\programdata\windows\dsdd.dat
c:\programdata\Windows\nudr.dat
c:\users\Scherer\AppData\Roaming\AcroIEHelpe.txt
c:\users\Scherer\AppData\Roaming\Adobe\plugs
c:\users\Scherer\AppData\Roaming\Adobe\shed
c:\users\Scherer\AppData\Roaming\srvblck2.tmp
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-12-16 bis 2013-01-16  ))))))))))))))))))))))))))))))
.
.
2013-01-16 18:37 . 2012-11-08 18:00        6812136        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8B168B6-F6B4-400A-8AE0-0FF28782F7F6}\mpengine.dll
2013-01-16 15:26 . 2013-01-16 15:26        --------        d-----w-        c:\users\Scherer\.thumbnails
2013-01-01 20:41 . 2013-01-01 20:41        --------        d-----w-        c:\users\Scherer\AppData\Local\Macromedia
2013-01-01 20:39 . 2013-01-01 20:39        697272        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-12-28 14:34 . 2012-11-29 08:26        96224        ----a-w-        c:\program files\Mozilla Firefox\webapprt-stub.exe
2012-12-28 14:34 . 2012-11-29 08:26        157272        ----a-w-        c:\program files\Mozilla Firefox\webapp-uninstaller.exe
2012-12-28 14:34 . 2012-11-29 08:26        73696        ----a-w-        c:\program files\Mozilla Firefox\breakpadinjector.dll
2012-12-28 14:34 . 2012-11-29 08:25        770384        ----a-w-        c:\program files\Mozilla Firefox\msvcr100.dll
2012-12-28 14:34 . 2012-11-29 08:25        421200        ----a-w-        c:\program files\Mozilla Firefox\msvcp100.dll
2012-12-27 01:03 . 2012-12-27 01:03        --------        d-----w-        c:\windows\system32\wbem\en-US
2012-12-27 01:02 . 2009-01-09 03:03        79304        ----a-w-        c:\windows\system32\drivers\mfeavfk.sys
2012-12-27 01:02 . 2009-01-09 03:03        40552        ----a-w-        c:\windows\system32\drivers\mfesmfk.sys
2012-12-27 01:02 . 2009-01-09 03:03        35272        ----a-w-        c:\windows\system32\drivers\mfebopk.sys
2012-12-27 01:02 . 2009-01-09 03:03        213640        ----a-w-        c:\windows\system32\drivers\mfehidk.sys
2012-12-27 01:02 . 2009-01-09 03:03        34216        ----a-w-        c:\windows\system32\drivers\mferkdk.sys
2012-12-27 01:02 . 2008-10-23 04:08        130424        ----a-w-        c:\windows\system32\drivers\Mpfp.sys
2012-12-27 01:02 . 2008-01-21 02:24        54784        ----a-w-        c:\windows\system32\WsmProv.dll
2012-12-27 01:02 . 2008-01-21 02:24        1536        ----a-w-        c:\windows\system32\WsmCl.dll
2012-12-26 23:14 . 2012-12-26 16:31        550017        ----a-w-        C:\adwcleaner.exe
2012-12-26 22:45 . 2012-12-26 22:45        --------        d-----w-        c:\users\Scherer\AppData\Roaming\Malwarebytes
2012-12-26 22:45 . 2012-12-26 22:45        --------        d-----w-        c:\programdata\Malwarebytes
2012-12-26 22:09 . 2013-01-16 08:18        --------        d-----w-        C:\_OTL
2012-12-26 15:46 . 2012-12-26 15:46        30616        ----a-w-        c:\windows\system32\drivers\hitmanpro37.sys
2012-12-26 15:46 . 2012-12-26 15:46        --------        d-----w-        c:\programdata\HitmanPro
2012-12-25 23:12 . 2012-12-25 23:07        1754528        ----a-w-        C:\rkill.com
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-01 20:39 . 2011-09-28 20:17        73656        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-11-29 08:26 . 2012-05-05 07:35        262112        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-03-12 61440]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-02-13 6814240]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-28 1049896]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-11 34672]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"PDFPrint"="c:\program files\PDF24\pdf24.exe" [2011-04-28 220552]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-08-17 348664]
"Nikon Message Center 2"="c:\program files\Nikon\Nikon Message Center 2\NkMC2.exe" [2010-05-25 619008]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Printkey2000.lnk - c:\program files\PrintKey2000\Printkey2000.exe [2010-12-9 869376]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs        REG_MULTI_SZ           BthServ
yksvcs        REG_MULTI_SZ           yksvc
.
Inhalt des "geplante Tasks" Ordners
.
2013-01-16 c:\windows\Tasks\User_Feed_Synchronization-{8ABE1372-F6EF-4A57-8A93-2F3EBBB833DE}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
uSearchAssistant = hxxp://www.google.com
IE: Free YouTube Download - c:\users\Scherer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to Mp3 Converter - c:\users\Scherer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Scherer\AppData\Roaming\Mozilla\Firefox\Profiles\inqqxxmk.default\
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-mcmscsvc
SafeBoot-MCODS
AddRemove-Konfigurator Eumex 400 - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-01-16 19:58
Windows 6.0.6001 Service Pack 1 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\program files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\windows\SYSTEM32\Rezip.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\conime.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-01-16  20:02:24 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2013-01-16 19:02
.
Vor Suchlauf: 12 Verzeichnis(se), 114.571.952.128 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 114.304.794.624 Bytes frei
.
- - End Of File - - 0DFE27B350ECBCD8CB4922A094FC26CC

--- --- ---

cosinus 17.01.2013 14:16
Bitte nun Logs mit GMER (<<< klick für Anleitung) und aswMBR (Anleitung etwas weiter unten) erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim zweiten Mal nicht will, lass es einfach weg und führ nur aswMBR aus.

aswMBR-Download => aswMBR.exe - speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

as9361 17.01.2013 23:53
Sorry, bin etwas spät



Code:
GMER 2.0.18444 - hxxp://www.gmer.net
Rootkit scan 2013-01-17 18:13:15
Windows 6.0.6001 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.PB4O 465,76GB
Running: gmer-2.0.18444.exe; Driver: C:\Users\Scherer\AppData\Local\Temp\kwdirfow.sys


---- System - GMER 2.0 ----

SSDT  8D16BE26                                                                                        ZwCreateSection
SSDT  8D16BE30                                                                                        ZwRequestWaitReplyPort
SSDT  8D16BE2B                                                                                        ZwSetContextThread
SSDT  8D16BE35                                                                                        ZwSetSecurityObject
SSDT  8D16BE3A                                                                                        ZwSystemDebugControl
SSDT  8D16BDC7                                                                                        ZwTerminateProcess

---- Kernel code sections - GMER 2.0 ----

.text  ntoskrnl.exe!KeInsertQueue + 405                                                                8247C9CC 4 Bytes  [26, BE, 16, 8D]
.text  ntoskrnl.exe!KeInsertQueue + 729                                                                8247CCF0 4 Bytes  [30, BE, 16, 8D]
.text  ntoskrnl.exe!KeInsertQueue + 75D                                                                8247CD24 4 Bytes  [2B, BE, 16, 8D]
.text  ntoskrnl.exe!KeInsertQueue + 7C1                                                                8247CD88 4 Bytes  [35, BE, 16, 8D]
.text  ntoskrnl.exe!KeInsertQueue + 809                                                                8247CDD0 4 Bytes  [3A, BE, 16, 8D]
.text  ...                                                                                             
.text  C:\Windows\system32\DRIVERS\atikmdag.sys                                                        section is writeable [0x8E401000, 0x258606, 0xE8000020]

---- Registry - GMER 2.0 ----

Reg    HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002269e276d4                     
Reg    HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002269e276d8                     
Reg    HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002269e2770b                     
Reg    HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002269e279d5                     
Reg    HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\002269e276d4 (not active ControlSet) 
Reg    HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\002269e276d8 (not active ControlSet) 
Reg    HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\002269e2770b (not active ControlSet) 
Reg    HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\002269e279d5 (not active ControlSet) 

---- EOF - GMER 2.0 ----


Code:
aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2013-01-17 23:37:18
-----------------------------
23:37:18.795    OS Version: Windows 6.0.6001 Service Pack 1
23:37:18.795    Number of processors: 2 586 0x170A
23:37:18.795    ComputerName: SCHERER-PC  UserName: Scherer
23:38:10.057    Initialize success
23:38:30.867    AVAST engine defs: 13011700
23:39:58.087    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
23:39:58.087    Disk 0 Vendor: Hitachi_ PB4O Size: 476940MB BusType: 3
23:39:58.118    Disk 0 MBR read successfully
23:39:58.118    Disk 0 MBR scan
23:39:58.118    Disk 0 unknown MBR code
23:39:58.134    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        13312 MB offset 2048
23:39:58.149    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS      232200 MB offset 27265024
23:39:58.181    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      231426 MB offset 502810624
23:39:58.196    Disk 0 scanning sectors +976771072
23:39:58.337    Disk 0 scanning C:\Windows\system32\drivers
23:40:16.699    Service scanning
23:40:48.772    Modules scanning
23:41:15.870    Disk 0 trace - called modules:
23:41:16.400    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
23:41:16.416    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85ae33e8]
23:41:16.416    3 CLASSPNP.SYS[8a411745] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x84fcf028]
23:41:16.431    Scan finished successfully
23:41:50.000    Disk 0 MBR has been saved successfully to "C:\Users\Scherer\Desktop\MBR.dat"
23:41:50.016    The log file has been saved successfully to "C:\Users\Scherer\Desktop\aswMBR.txt"

cosinus 18.01.2013 12:39
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehlalarm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtg4nzy0ywy5/settings_2012-09-04.png

as9361 18.01.2013 18:53
Hallo,

3 Funde, habe alles auf "skip" gelassen und dann beendet.


Code:
18:48:23.0676 1372  TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
18:48:24.0207 1372  ============================================================
18:48:24.0207 1372  Current date / time: 2013/01/18 18:48:24.0207
18:48:24.0207 1372  SystemInfo:
18:48:24.0207 1372 
18:48:24.0207 1372  OS Version: 6.0.6001 ServicePack: 1.0
18:48:24.0207 1372  Product type: Workstation
18:48:24.0207 1372  ComputerName: SCHERER-PC
18:48:24.0207 1372  UserName: Scherer
18:48:24.0207 1372  Windows directory: C:\Windows
18:48:24.0207 1372  System windows directory: C:\Windows
18:48:24.0207 1372  Processor architecture: Intel x86
18:48:24.0207 1372  Number of processors: 2
18:48:24.0207 1372  Page size: 0x1000
18:48:24.0207 1372  Boot type: Normal boot
18:48:24.0207 1372  ============================================================
18:48:24.0971 1372  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
18:48:24.0971 1372  ============================================================
18:48:24.0971 1372  \Device\Harddisk0\DR0:
18:48:24.0971 1372  MBR partitions:
18:48:24.0971 1372  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1A00800, BlocksNum 0x1C584000
18:48:24.0971 1372  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1DF84800, BlocksNum 0x1C401000
18:48:24.0971 1372  ============================================================
18:48:25.0080 1372  C: <-> \Device\Harddisk0\DR0\Partition1
18:48:25.0112 1372  D: <-> \Device\Harddisk0\DR0\Partition2
18:48:25.0112 1372  ============================================================
18:48:25.0112 1372  Initialize success
18:48:25.0112 1372  ============================================================
18:48:36.0936 3652  ============================================================
18:48:36.0936 3652  Scan started
18:48:36.0936 3652  Mode: Manual; SigCheck; TDLFS;
18:48:36.0936 3652  ============================================================
18:48:37.0451 3652  ================ Scan system memory ========================
18:48:37.0451 3652  System memory - ok
18:48:37.0451 3652  ================ Scan services =============================
18:48:37.0826 3652  [ FCB8C7210F0135E24C6580F7F649C73C ] ACPI            C:\Windows\system32\drivers\acpi.sys
18:48:37.0997 3652  ACPI - ok
18:48:38.0044 3652  [ 04F0FCAC69C7C71A3AC4EB97FAFC8303 ] adp94xx        C:\Windows\system32\drivers\adp94xx.sys
18:48:38.0075 3652  adp94xx - ok
18:48:38.0138 3652  [ 60505E0041F7751BDBB80F88BF45C2CE ] adpahci        C:\Windows\system32\drivers\adpahci.sys
18:48:38.0169 3652  adpahci - ok
18:48:38.0200 3652  [ 8A42779B02AEC986EAB64ECFC98F8BD7 ] adpu160m        C:\Windows\system32\drivers\adpu160m.sys
18:48:38.0216 3652  adpu160m - ok
18:48:38.0262 3652  [ 241C9E37F8CE45EF51C3DE27515CA4E5 ] adpu320        C:\Windows\system32\drivers\adpu320.sys
18:48:38.0278 3652  adpu320 - ok
18:48:38.0372 3652  [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
18:48:38.0528 3652  AeLookupSvc - ok
18:48:38.0637 3652  [ 48EB99503533C27AC6135648E5474457 ] AFD            C:\Windows\system32\drivers\afd.sys
18:48:38.0730 3652  AFD - ok
18:48:38.0777 3652  [ EFBC44FBD75E4F80BD927AEBF6E7EADE ] AgereModemAudio C:\Windows\system32\agrsmsvc.exe
18:48:38.0840 3652  AgereModemAudio - ok
18:48:38.0918 3652  [ 1CFEBA39FC613E45B49D3EDDFBCDA289 ] AgereSoftModem  C:\Windows\system32\DRIVERS\AGRSM.sys
18:48:39.0011 3652  AgereSoftModem - ok
18:48:39.0105 3652  [ 13F9E33747E6B41A3FF305C37DB0D360 ] agp440          C:\Windows\system32\drivers\agp440.sys
18:48:39.0120 3652  agp440 - ok
18:48:39.0152 3652  [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx        C:\Windows\system32\drivers\djsvs.sys
18:48:39.0183 3652  aic78xx - ok
18:48:39.0198 3652  [ A1545B731579895D8CC44FC0481C1192 ] ALG            C:\Windows\System32\alg.exe
18:48:39.0261 3652  ALG - ok
18:48:39.0276 3652  [ 9EAEF5FC9B8E351AFA7E78A6FAE91F91 ] aliide          C:\Windows\system32\drivers\aliide.sys
18:48:39.0308 3652  aliide - ok
18:48:39.0339 3652  [ C47344BC706E5F0B9DCE369516661578 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
18:48:39.0354 3652  amdagp - ok
18:48:39.0386 3652  [ 9B78A39A4C173FDBC1321E0DD659B34C ] amdide          C:\Windows\system32\drivers\amdide.sys
18:48:39.0386 3652  amdide - ok
18:48:39.0417 3652  [ 18F29B49AD23ECEE3D2A826C725C8D48 ] AmdK7          C:\Windows\system32\drivers\amdk7.sys
18:48:39.0495 3652  AmdK7 - ok
18:48:39.0526 3652  [ 93AE7F7DD54AB986A6F1A1B37BE7442D ] AmdK8          C:\Windows\system32\drivers\amdk8.sys
18:48:39.0604 3652  AmdK8 - ok
18:48:39.0744 3652  [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe
18:48:39.0760 3652  AntiVirSchedulerService - ok
18:48:39.0854 3652  [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService  C:\Program Files\Avira\AntiVir Desktop\avguard.exe
18:48:39.0869 3652  AntiVirService - ok
18:48:39.0947 3652  [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo        C:\Windows\System32\appinfo.dll
18:48:40.0025 3652  Appinfo - ok
18:48:40.0119 3652  [ 5D2888182FB46632511ACEE92FDAD522 ] arc            C:\Windows\system32\drivers\arc.sys
18:48:40.0150 3652  arc - ok
18:48:40.0197 3652  [ 5E2A321BD7C8B3624E41FDEC3E244945 ] arcsas          C:\Windows\system32\drivers\arcsas.sys
18:48:40.0212 3652  arcsas - ok
18:48:40.0259 3652  [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
18:48:40.0322 3652  AsyncMac - ok
18:48:40.0368 3652  [ 0D83C87A801A3DFCD1BF73893FE7518C ] atapi          C:\Windows\system32\drivers\atapi.sys
18:48:40.0384 3652  atapi - ok
18:48:40.0462 3652  [ 99D78248BFD454BFA9B5BEC37350FADE ] athr            C:\Windows\system32\DRIVERS\athr.sys
18:48:40.0587 3652  athr - ok
18:48:40.0634 3652  [ DB338C400CC9F5CEB568899D664FF335 ] Ati External Event Utility C:\Windows\system32\Ati2evxx.exe
18:48:40.0712 3652  Ati External Event Utility - ok
18:48:41.0242 3652  [ 45C45796CAAD4F3354496530329A7B10 ] atikmdag        C:\Windows\system32\DRIVERS\atikmdag.sys
18:48:41.0476 3652  atikmdag - ok
18:48:41.0507 3652  [ C49972BB5DC0AD5BF11074CD8F5B3265 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
18:48:41.0570 3652  AudioEndpointBuilder - ok
18:48:41.0585 3652  [ C49972BB5DC0AD5BF11074CD8F5B3265 ] Audiosrv        C:\Windows\System32\Audiosrv.dll
18:48:41.0601 3652  Audiosrv - ok
18:48:41.0679 3652  [ D5541F0AFB767E85FC412FC609D96A74 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
18:48:41.0726 3652  avgntflt - ok
18:48:41.0788 3652  [ 7D967A682D4694DF7FA57D63A2DB01FE ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
18:48:41.0788 3652  avipbb - ok
18:48:41.0882 3652  [ 271CFD1A989209B1964E24D969552BF7 ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
18:48:41.0928 3652  avkmgr - ok
18:48:42.0006 3652  [ 5685E9F471135E6675D981D5D45C9935 ] AVMCOWAN        C:\Windows\system32\DRIVERS\AVMCOWAN.sys
18:48:42.0053 3652  AVMCOWAN - ok
18:48:42.0147 3652  [ 08015D34F6FDD0B355805BAD978497C3 ] bcm4sbxp        C:\Windows\system32\DRIVERS\bcm4sbxp.sys
18:48:42.0303 3652  bcm4sbxp - ok
18:48:42.0396 3652  [ 6163664C7E9CD110AF70180C126C3FDC ] BcmSqlStartupSvc C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
18:48:42.0412 3652  BcmSqlStartupSvc - ok
18:48:42.0474 3652  [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep            C:\Windows\system32\drivers\Beep.sys
18:48:42.0521 3652  Beep - ok
18:48:42.0615 3652  [ 8582E233C346AEFE759833E8A30DD697 ] BFE            C:\Windows\System32\bfe.dll
18:48:42.0755 3652  BFE - ok
18:48:42.0833 3652  [ 02ED7B4DBC2A3232A389106DA7515C3D ] BITS            C:\Windows\system32\qmgr.dll
18:48:42.0911 3652  BITS - ok
18:48:42.0958 3652  [ D4DF28447741FD3D953526E33A617397 ] blbdrive        C:\Windows\system32\drivers\blbdrive.sys
18:48:43.0036 3652  blbdrive - ok
18:48:43.0067 3652  [ 8153396D5551276227FA146900F734E6 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
18:48:43.0130 3652  bowser - ok
18:48:43.0176 3652  [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo        C:\Windows\system32\drivers\brfiltlo.sys
18:48:43.0239 3652  BrFiltLo - ok
18:48:43.0270 3652  [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp        C:\Windows\system32\drivers\brfiltup.sys
18:48:43.0332 3652  BrFiltUp - ok
18:48:43.0395 3652  [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser        C:\Windows\System32\browser.dll
18:48:43.0473 3652  Browser - ok
18:48:43.0535 3652  [ B304E75CFF293029EDDF094246747113 ] Brserid        C:\Windows\system32\drivers\brserid.sys
18:48:43.0613 3652  Brserid - ok
18:48:43.0629 3652  [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm        C:\Windows\system32\drivers\brserwdm.sys
18:48:43.0769 3652  BrSerWdm - ok
18:48:43.0816 3652  [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm        C:\Windows\system32\drivers\brusbmdm.sys
18:48:43.0910 3652  BrUsbMdm - ok
18:48:43.0956 3652  [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer        C:\Windows\system32\drivers\brusbser.sys
18:48:44.0081 3652  BrUsbSer - ok
18:48:44.0128 3652  [ C7065FA296C91BF054F421B0EBF93461 ] BthEnum        C:\Windows\system32\DRIVERS\BthEnum.sys
18:48:44.0222 3652  BthEnum - ok
18:48:44.0253 3652  [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
18:48:44.0331 3652  BTHMODEM - ok
18:48:44.0393 3652  [ 5904EFA25F829BF84EA6FB045134A1D8 ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
18:48:44.0456 3652  BthPan - ok
18:48:44.0487 3652  [ 1712D956E5A96F866D6791869E99B1D6 ] BTHPORT        C:\Windows\system32\Drivers\BTHport.sys
18:48:44.0518 3652  BTHPORT - ok
18:48:44.0549 3652  [ 58EE7F5E68310BC8D4E7CEBD8358C12E ] BthServ        C:\Windows\System32\bthserv.dll
18:48:44.0596 3652  BthServ - ok
18:48:44.0627 3652  [ 66088E161E769D11C3134BC23D0E6144 ] BTHUSB          C:\Windows\system32\Drivers\BTHUSB.sys
18:48:44.0674 3652  BTHUSB - ok
18:48:44.0705 3652  catchme - ok
18:48:44.0721 3652  [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
18:48:44.0814 3652  cdfs - ok
18:48:44.0846 3652  [ 1EC25CEA0DE6AC4718BF89F9E1778B57 ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
18:48:44.0908 3652  cdrom - ok
18:48:44.0939 3652  [ 87C2D0377B23E2D8A41093C2F5FB1A5B ] CertPropSvc    C:\Windows\System32\certprop.dll
18:48:45.0002 3652  CertPropSvc - ok
18:48:45.0017 3652  [ E5D4133F37219DBCFE102BC61072589D ] circlass        C:\Windows\system32\drivers\circlass.sys
18:48:45.0080 3652  circlass - ok
18:48:45.0111 3652  [ 465745561C832B29F7C48B488AAB3842 ] CLFS            C:\Windows\system32\CLFS.sys
18:48:45.0126 3652  CLFS - ok
18:48:45.0251 3652  [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
18:48:45.0282 3652  clr_optimization_v2.0.50727_32 - ok
18:48:45.0345 3652  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
18:48:45.0360 3652  clr_optimization_v4.0.30319_32 - ok
18:48:45.0392 3652  [ 99AFC3795B58CC478FBBBCDC658FCB56 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
18:48:45.0454 3652  CmBatt - ok
18:48:45.0485 3652  [ 0CA25E686A4928484E9FDABD168AB629 ] cmdide          C:\Windows\system32\drivers\cmdide.sys
18:48:45.0501 3652  cmdide - ok
18:48:45.0532 3652  [ 6AFEF0B60FA25DE07C0968983EE4F60A ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
18:48:45.0579 3652  Compbatt - ok
18:48:45.0594 3652  COMSysApp - ok
18:48:45.0626 3652  [ 741E9DFF4F42D2D8477D0FC1DC0DF871 ] crcdisk        C:\Windows\system32\drivers\crcdisk.sys
18:48:45.0641 3652  crcdisk - ok
18:48:45.0672 3652  [ 1F07BECDCA750766A96CDA811BA86410 ] Crusoe          C:\Windows\system32\drivers\crusoe.sys
18:48:45.0719 3652  Crusoe - ok
18:48:45.0782 3652  [ 6DE363F9F99334514C46AEC02D3E3678 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
18:48:45.0828 3652  CryptSvc - ok
18:48:45.0891 3652  [ 301AE00E12408650BADDC04DBC832830 ] DcomLaunch      C:\Windows\system32\rpcss.dll
18:48:45.0953 3652  DcomLaunch - ok
18:48:46.0016 3652  [ A3E9FA213F443AC77C7746119D13FEEC ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
18:48:46.0094 3652  DfsC - ok
18:48:46.0328 3652  [ FA3463F25F9CC9C3BCF1E7912FEFF099 ] DFSR            C:\Windows\system32\DFSR.exe
18:48:46.0468 3652  DFSR - ok
18:48:46.0562 3652  [ 43A988A9C10333476CB5FB667CBD629D ] Dhcp            C:\Windows\System32\dhcpcsvc.dll
18:48:46.0655 3652  Dhcp - ok
18:48:46.0686 3652  [ 64109E623ABD6955C8FB110B592E68B7 ] disk            C:\Windows\system32\drivers\disk.sys
18:48:46.0702 3652  disk - ok
18:48:46.0764 3652  [ 4805D9A6D281C7A7DEFD9094DEC6AF7D ] Dnscache        C:\Windows\System32\dnsrslvr.dll
18:48:46.0811 3652  Dnscache - ok
18:48:46.0842 3652  [ 5AF620A08C614E24206B79E8153CF1A8 ] dot3svc        C:\Windows\System32\dot3svc.dll
18:48:46.0905 3652  dot3svc - ok
18:48:46.0952 3652  [ 4F59C172C094E1A1D46463A8DC061CBD ] Dot4            C:\Windows\system32\DRIVERS\Dot4.sys
18:48:46.0998 3652  Dot4 - ok
18:48:47.0045 3652  [ A84D8A9006B1AE515CC7B6B3586C295A ] Dot4Scan        C:\Windows\system32\DRIVERS\Dot4Scan.sys
18:48:47.0092 3652  Dot4Scan - ok
18:48:47.0139 3652  [ C55004CA6B419B6695970DFE849B122F ] dot4usb        C:\Windows\system32\DRIVERS\dot4usb.sys
18:48:47.0217 3652  dot4usb - ok
18:48:47.0248 3652  [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS            C:\Windows\system32\dps.dll
18:48:47.0295 3652  DPS - ok
18:48:47.0342 3652  [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
18:48:47.0420 3652  drmkaud - ok
18:48:47.0513 3652  [ 85F33880B8CFB554BD3D9CCDB486845A ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
18:48:47.0607 3652  DXGKrnl - ok
18:48:47.0669 3652  [ 5425F74AC0C1DBD96A1E04F17D63F94C ] E1G60          C:\Windows\system32\DRIVERS\E1G60I32.sys
18:48:47.0716 3652  E1G60 - ok
18:48:47.0778 3652  [ C0B95E40D85CD807D614E264248A45B9 ] EapHost        C:\Windows\System32\eapsvc.dll
18:48:47.0856 3652  EapHost - ok
18:48:47.0903 3652  [ DD2CD259D83D8B72C02C5F2331FF9D68 ] Ecache          C:\Windows\system32\drivers\ecache.sys
18:48:47.0919 3652  Ecache - ok
18:48:47.0981 3652  [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
18:48:48.0044 3652  ehRecvr - ok
18:48:48.0075 3652  [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched        C:\Windows\ehome\ehsched.exe
18:48:48.0168 3652  ehSched - ok
18:48:48.0200 3652  [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart        C:\Windows\ehome\ehstart.dll
18:48:48.0262 3652  ehstart - ok
18:48:48.0309 3652  [ 23B62471681A124889978F6295B3F4C6 ] elxstor        C:\Windows\system32\drivers\elxstor.sys
18:48:48.0356 3652  elxstor - ok
18:48:48.0543 3652  [ 70B1A86DF0C8EAD17D2BC332EDAE2C7C ] EMDMgmt        C:\Windows\system32\emdmgmt.dll
18:48:48.0668 3652  EMDMgmt - ok
18:48:48.0730 3652  [ 3DB974F3935483555D7148663F726C61 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
18:48:48.0777 3652  ErrDev - ok
18:48:48.0839 3652  [ 3CB3343D720168B575133A0A20DC2465 ] EventSystem    C:\Windows\system32\es.dll
18:48:48.0902 3652  EventSystem - ok
18:48:48.0948 3652  [ 0D858EB20589A34EFB25695ACAA6AA2D ] exfat          C:\Windows\system32\drivers\exfat.sys
18:48:48.0980 3652  exfat - ok
18:48:49.0058 3652  [ 3C489390C2E2064563727752AF8EAB9E ] fastfat        C:\Windows\system32\drivers\fastfat.sys
18:48:49.0167 3652  fastfat - ok
18:48:49.0198 3652  [ AFE1E8B9782A0DD7FB46BBD88E43F89A ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
18:48:49.0260 3652  fdc - ok
18:48:49.0307 3652  [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost        C:\Windows\system32\fdPHost.dll
18:48:49.0385 3652  fdPHost - ok
18:48:49.0416 3652  [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub        C:\Windows\system32\fdrespub.dll
18:48:49.0494 3652  FDResPub - ok
18:48:49.0526 3652  [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
18:48:49.0541 3652  FileInfo - ok
18:48:49.0588 3652  [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
18:48:49.0682 3652  Filetrace - ok
18:48:49.0791 3652  [ 85B7CF99D532820495D68D747FDA9EBD ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
18:48:49.0853 3652  flpydisk - ok
18:48:49.0884 3652  [ 05EA53AFE985443011E36DAB07343B46 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
18:48:49.0900 3652  FltMgr - ok
18:48:50.0025 3652  [ C9BE08664611DDAF98E2331E9288B00B ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
18:48:50.0040 3652  FontCache3.0.0.0 - ok
18:48:50.0072 3652  [ 65EA8B77B5851854F0C55C43FA51A198 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
18:48:50.0118 3652  Fs_Rec - ok
18:48:50.0259 3652  [ 4A51F6DE41CF9FE72A5893D80504E998 ] fxusbase        C:\Windows\system32\DRIVERS\fxusbase.sys
18:48:50.0337 3652  fxusbase - ok
18:48:50.0368 3652  [ 34582A6E6573D54A07ECE5FE24A126B5 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
18:48:50.0399 3652  gagp30kx - ok
18:48:50.0555 3652  [ D9F1113D9401185245573350712F92FC ] gpsvc          C:\Windows\System32\gpsvc.dll
18:48:50.0696 3652  gpsvc - ok
18:48:50.0742 3652  [ CB04C744BE0A61B1D648FAED182C3B59 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
18:48:50.0836 3652  HdAudAddService - ok
18:48:50.0867 3652  [ C87B1EE051C0464491C1A7B03FA0BC99 ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
18:48:50.0898 3652  HDAudBus - ok
18:48:50.0961 3652  [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth          C:\Windows\system32\drivers\hidbth.sys
18:48:51.0054 3652  HidBth - ok
18:48:51.0101 3652  [ FF3160C3A2445128C5A6D9B076DA519E ] HidIr          C:\Windows\system32\drivers\hidir.sys
18:48:51.0210 3652  HidIr - ok
18:48:51.0257 3652  [ 8FA640195279ACE21BEA91396A0054FC ] hidserv        C:\Windows\System32\hidserv.dll
18:48:51.0351 3652  hidserv - ok
18:48:51.0382 3652  [ 854CA287AB7FAF949617A788306D967E ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
18:48:51.0444 3652  HidUsb - ok
18:48:51.0507 3652  [ 7EAB073BF5949ED639660787A01B623D ] hitmanpro37    C:\Windows\system32\drivers\hitmanpro37.sys
18:48:51.0538 3652  hitmanpro37 - ok
18:48:51.0585 3652  [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc          C:\Windows\system32\kmsvc.dll
18:48:51.0663 3652  hkmsvc - ok
18:48:51.0725 3652  [ 16EE7B23A009E00D835CDB79574A91A6 ] HpCISSs        C:\Windows\system32\drivers\hpcisss.sys
18:48:51.0756 3652  HpCISSs - ok
18:48:51.0803 3652  [ 96E241624C71211A79C84F50A8E71CAB ] HTTP            C:\Windows\system32\drivers\HTTP.sys
18:48:51.0866 3652  HTTP - ok
18:48:51.0897 3652  [ C6B032D69650985468160FC9937CF5B4 ] i2omp          C:\Windows\system32\drivers\i2omp.sys
18:48:51.0928 3652  i2omp - ok
18:48:51.0990 3652  [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
18:48:52.0006 3652  i8042prt - ok
18:48:52.0100 3652  [ 496DB78E6A0C4C44023D9A92B4A7AC31 ] ialm            C:\Windows\system32\DRIVERS\igdkmd32.sys
18:48:52.0224 3652  ialm - ok
18:48:52.0318 3652  [ 71ECC07BC7C5E24C3DD01D8A29A24054 ] iaStor          C:\Windows\system32\DRIVERS\iaStor.sys
18:48:52.0365 3652  iaStor - ok
18:48:52.0380 3652  [ 54155EA1B0DF185878E0FC9EC3AC3A14 ] iaStorV        C:\Windows\system32\drivers\iastorv.sys
18:48:52.0427 3652  iaStorV - ok
18:48:52.0568 3652  [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT        C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
18:48:52.0630 3652  IDriverT ( UnsignedFile.Multi.Generic ) - warning
18:48:52.0630 3652  IDriverT - detected UnsignedFile.Multi.Generic (1)
18:48:52.0739 3652  [ 7B630ACAED64FEF0C3E1CF255CB56686 ] idsvc          C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
18:48:52.0786 3652  idsvc - ok
18:48:52.0817 3652  [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp          C:\Windows\system32\drivers\iirsp.sys
18:48:52.0848 3652  iirsp - ok
18:48:52.0973 3652  [ A3BC480A2BF8AA8E4DABD2D5DCE0AFAC ] IKEEXT          C:\Windows\System32\ikeext.dll
18:48:53.0082 3652  IKEEXT - ok
18:48:53.0207 3652  [ B4FD14F7B231E358BEC6C71D1A6C2845 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
18:48:53.0457 3652  IntcAzAudAddService - ok
18:48:53.0535 3652  [ 83AA759F3189E6370C30DE5DC5590718 ] intelide        C:\Windows\system32\drivers\intelide.sys
18:48:53.0550 3652  intelide - ok
18:48:53.0566 3652  [ 224191001E78C89DFA78924C3EA595FF ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
18:48:53.0644 3652  intelppm - ok
18:48:53.0706 3652  [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
18:48:53.0800 3652  IPBusEnum - ok
18:48:53.0816 3652  [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
18:48:53.0862 3652  IpFilterDriver - ok
18:48:53.0909 3652  [ 6A35D233693EDC29A12742049BC5E37F ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
18:48:53.0987 3652  iphlpsvc - ok
18:48:53.0987 3652  IpInIp - ok
18:48:54.0034 3652  [ B25AAF203552B7B3491139D582B39AD1 ] IPMIDRV        C:\Windows\system32\drivers\ipmidrv.sys
18:48:54.0128 3652  IPMIDRV - ok
18:48:54.0174 3652  [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT          C:\Windows\system32\DRIVERS\ipnat.sys
18:48:54.0237 3652  IPNAT - ok
18:48:54.0284 3652  [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
18:48:54.0346 3652  IRENUM - ok
18:48:54.0377 3652  [ 6C70698A3E5C4376C6AB5C7C17FB0614 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
18:48:54.0393 3652  isapnp - ok
18:48:54.0440 3652  [ F247EEC28317F6C739C16DE420097301 ] iScsiPrt        C:\Windows\system32\DRIVERS\msiscsi.sys
18:48:54.0455 3652  iScsiPrt - ok
18:48:54.0502 3652  [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi        C:\Windows\system32\drivers\iteatapi.sys
18:48:54.0533 3652  iteatapi - ok
18:48:54.0549 3652  [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid        C:\Windows\system32\drivers\iteraid.sys
18:48:54.0564 3652  iteraid - ok
18:48:54.0564 3652  [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
18:48:54.0580 3652  kbdclass - ok
18:48:54.0642 3652  [ 18247836959BA67E3511B62846B9C2E0 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
18:48:54.0736 3652  kbdhid - ok
18:48:54.0783 3652  [ A911ECAC81F94ADEAFBE8E3F7873EDB0 ] KeyIso          C:\Windows\system32\lsass.exe
18:48:54.0845 3652  KeyIso - ok
18:48:54.0876 3652  [ EBC507F129DF8F0E0CA270DCFC0CF87F ] KMDFMEMIO      C:\Windows\system32\DRIVERS\kmdfmemio.sys
18:48:54.0908 3652  KMDFMEMIO - ok
18:48:54.0923 3652  [ 7A0CF7908B6824D6A2A1D313E5AE3DCA ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
18:48:54.0954 3652  KSecDD - ok
18:48:55.0001 3652  [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm          C:\Windows\system32\msdtckrm.dll
18:48:55.0095 3652  KtmRm - ok
18:48:55.0157 3652  [ 1925E63C91CF1610AE41BFD539062079 ] LanmanServer    C:\Windows\System32\srvsvc.dll
18:48:55.0251 3652  LanmanServer - ok
18:48:55.0313 3652  [ 2AE2E1628C5D3F1C0A46A67C9FA1DF15 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
18:48:55.0360 3652  LanmanWorkstation - ok
18:48:55.0407 3652  [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
18:48:55.0454 3652  lltdio - ok
18:48:55.0516 3652  [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc        C:\Windows\System32\lltdsvc.dll
18:48:55.0578 3652  lltdsvc - ok
18:48:55.0610 3652  [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts        C:\Windows\System32\lmhsvc.dll
18:48:55.0672 3652  lmhosts - ok
18:48:55.0766 3652  [ C7E15E82879BF3235B559563D4185365 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
18:48:55.0812 3652  LSI_FC - ok
18:48:55.0859 3652  [ EE01EBAE8C9BF0FA072E0FF68718920A ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
18:48:55.0875 3652  LSI_SAS - ok
18:48:55.0922 3652  [ 912A04696E9CA30146A62AFA1463DD5C ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
18:48:55.0953 3652  LSI_SCSI - ok
18:48:55.0968 3652  [ 8F5C7426567798E62A3B3614965D62CC ] luafv          C:\Windows\system32\drivers\luafv.sys
18:48:56.0015 3652  luafv - ok
18:48:56.0062 3652  [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
18:48:56.0093 3652  Mcx2Svc - ok
18:48:56.0140 3652  [ 0001CE609D66632FA17B84705F658879 ] megasas        C:\Windows\system32\drivers\megasas.sys
18:48:56.0156 3652  megasas - ok
18:48:56.0296 3652  [ C252F32CD9A49DBFC25ECF26EBD51A99 ] MegaSR          C:\Windows\system32\drivers\megasr.sys
18:48:56.0390 3652  MegaSR - ok
18:48:56.0452 3652  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS          C:\Windows\system32\mmcss.dll
18:48:56.0483 3652  MMCSS - ok
18:48:56.0514 3652  [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem          C:\Windows\system32\drivers\modem.sys
18:48:56.0577 3652  Modem - ok
18:48:56.0655 3652  [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
18:48:56.0702 3652  monitor - ok
18:48:56.0717 3652  [ 5BF6A1326A335C5298477754A506D263 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
18:48:56.0733 3652  mouclass - ok
18:48:56.0780 3652  [ 93B8D4869E12CFBE663915502900876F ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
18:48:56.0826 3652  mouhid - ok
18:48:56.0873 3652  [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr        C:\Windows\system32\drivers\mountmgr.sys
18:48:56.0889 3652  MountMgr - ok
18:48:57.0014 3652  [ 8C7336950F1E69CDFD811CBBD9CF00A2 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
18:48:57.0029 3652  MozillaMaintenance - ok
18:48:57.0092 3652  [ 511D011289755DD9F9A7579FB0B064E6 ] mpio            C:\Windows\system32\drivers\mpio.sys
18:48:57.0107 3652  mpio - ok
18:48:57.0154 3652  [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
18:48:57.0232 3652  mpsdrv - ok
18:48:57.0294 3652  [ D1639BA315B0D79DEC49A4B0E1FB929B ] MpsSvc          C:\Windows\system32\mpssvc.dll
18:48:57.0341 3652  MpsSvc - ok
18:48:57.0372 3652  [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x        C:\Windows\system32\drivers\mraid35x.sys
18:48:57.0388 3652  Mraid35x - ok
18:48:57.0404 3652  [ AE3DE84536B6799D2267443CEC8EDBB9 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
18:48:57.0450 3652  MRxDAV - ok
18:48:57.0482 3652  [ 5734A0F2BE7E495F7D3ED6EFD4B9F5A1 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
18:48:57.0544 3652  mrxsmb - ok
18:48:57.0622 3652  [ 6B5FA5ADFACAC9DBBE0991F4566D7D55 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
18:48:57.0653 3652  mrxsmb10 - ok
18:48:57.0669 3652  [ 5C80D8159181C7ABF1B14BA703B01E0B ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
18:48:57.0700 3652  mrxsmb20 - ok
18:48:57.0731 3652  [ 28023E86F17001F7CD9B15A5BC9AE07D ] msahci          C:\Windows\system32\drivers\msahci.sys
18:48:57.0747 3652  msahci - ok
18:48:57.0762 3652  [ 4468B0F385A86ECDDAF8D3CA662EC0E7 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
18:48:57.0778 3652  msdsm - ok
18:48:57.0809 3652  [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC          C:\Windows\System32\msdtc.exe
18:48:57.0872 3652  MSDTC - ok
18:48:57.0903 3652  [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
18:48:57.0950 3652  Msfs - ok
18:48:57.0981 3652  [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
18:48:58.0012 3652  msisadrv - ok
18:48:58.0059 3652  [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
18:48:58.0106 3652  MSiSCSI - ok
18:48:58.0106 3652  msiserver - ok
18:48:58.0152 3652  [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
18:48:58.0215 3652  MSKSSRV - ok
18:48:58.0262 3652  [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
18:48:58.0324 3652  MSPCLOCK - ok
18:48:58.0340 3652  [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
18:48:58.0402 3652  MSPQM - ok
18:48:58.0449 3652  [ B5614AECB05A9340AA0FB55BF561CC63 ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
18:48:58.0464 3652  MsRPC - ok
18:48:58.0511 3652  [ E384487CB84BE41D09711C30CA79646C ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
18:48:58.0527 3652  mssmbios - ok
18:48:58.0605 3652  MSSQL$MSSMLBIZ - ok
18:48:58.0698 3652  [ 1D89EB4E2A99CABD4E81225F4F4C4B25 ] MSSQLServerADHelper C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe
18:48:58.0714 3652  MSSQLServerADHelper - ok
18:48:58.0745 3652  [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
18:48:58.0792 3652  MSTEE - ok
18:48:58.0823 3652  [ 6DFD1D322DE55B0B7DB7D21B90BEC49C ] Mup            C:\Windows\system32\Drivers\mup.sys
18:48:58.0839 3652  Mup - ok
18:48:58.0917 3652  [ C43B25863FBD65B6D2A142AF3AE320CA ] napagent        C:\Windows\system32\qagentRT.dll
18:48:58.0979 3652  napagent - ok
18:48:59.0026 3652  [ 3C21CE48FF529BB73DADB98770B54025 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
18:48:59.0073 3652  NativeWifiP - ok
18:48:59.0104 3652  [ 9BDC71790FA08F0A0B5F10462B1BD0B1 ] NDIS            C:\Windows\system32\drivers\ndis.sys
18:48:59.0166 3652  NDIS - ok
18:48:59.0229 3652  [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
18:48:59.0276 3652  NdisTapi - ok
18:48:59.0307 3652  [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
18:48:59.0354 3652  Ndisuio - ok
18:48:59.0400 3652  [ 3D14C3B3496F88890D431E8AA022A411 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
18:48:59.0432 3652  NdisWan - ok
18:48:59.0463 3652  [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
18:48:59.0494 3652  NDProxy - ok
18:48:59.0510 3652  [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
18:48:59.0541 3652  NetBIOS - ok
18:48:59.0588 3652  [ 7C5FEE5B1C5728507CD96FB4A13E7A02 ] netbt          C:\Windows\system32\DRIVERS\netbt.sys
18:48:59.0681 3652  netbt - ok
18:48:59.0697 3652  [ A911ECAC81F94ADEAFBE8E3F7873EDB0 ] Netlogon        C:\Windows\system32\lsass.exe
18:48:59.0712 3652  Netlogon - ok
18:48:59.0759 3652  [ C8052711DAECC48B982434C5116CA401 ] Netman          C:\Windows\System32\netman.dll
18:48:59.0822 3652  Netman - ok
18:48:59.0853 3652  [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm        C:\Windows\System32\netprofm.dll
18:48:59.0931 3652  netprofm - ok
18:48:59.0993 3652  [ 0AD5876EF4E9EB77C8F93EB5B2FFF386 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
18:49:00.0009 3652  NetTcpPortSharing - ok
18:49:00.0243 3652  [ 35D5458D9A1B26B2005ABFFBF4C1C5E7 ] NETw3v32        C:\Windows\system32\DRIVERS\NETw3v32.sys
18:49:00.0461 3652  NETw3v32 - ok
18:49:00.0492 3652  [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960        C:\Windows\system32\drivers\nfrd960.sys
18:49:00.0508 3652  nfrd960 - ok
18:49:00.0586 3652  [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc          C:\Windows\System32\nlasvc.dll
18:49:00.0648 3652  NlaSvc - ok
18:49:00.0695 3652  [ CFE3462A9E94A57DCD9676F6B7FE7F67 ] nmwcd          C:\Windows\system32\drivers\ccdcmb.sys
18:49:00.0758 3652  nmwcd - ok
18:49:00.0773 3652  [ ECB5003F484F9ED6C608D6D6C7886CBB ] Npfs            C:\Windows\system32\drivers\Npfs.sys
18:49:00.0820 3652  Npfs - ok
18:49:00.0882 3652  [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi            C:\Windows\system32\nsisvc.dll
18:49:00.0945 3652  nsi - ok
18:49:00.0992 3652  [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
18:49:01.0070 3652  nsiproxy - ok
18:49:01.0132 3652  [ B4EFFE29EB4F15538FD8A9681108492D ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
18:49:01.0210 3652  Ntfs - ok
18:49:01.0304 3652  [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi      C:\Windows\system32\drivers\ntrigdigi.sys
18:49:01.0428 3652  ntrigdigi - ok
18:49:01.0444 3652  [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null            C:\Windows\system32\drivers\Null.sys
18:49:01.0506 3652  Null - ok
18:49:01.0522 3652  [ 2EDF9E7751554B42CBB60116DE727101 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
18:49:01.0538 3652  nvraid - ok
18:49:01.0600 3652  [ ABED0C09758D1D97DB0042DBB2688177 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
18:49:01.0616 3652  nvstor - ok
18:49:01.0631 3652  [ 18BBDF913916B71BD54575BDB6EEAC0B ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
18:49:01.0662 3652  nv_agp - ok
18:49:01.0662 3652  NwlnkFlt - ok
18:49:01.0678 3652  NwlnkFwd - ok
18:49:01.0803 3652  [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv          C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
18:49:01.0818 3652  odserv - ok
18:49:01.0850 3652  [ 790E27C3DB53410B40FF9EF2FD10A1D9 ] ohci1394        C:\Windows\system32\DRIVERS\ohci1394.sys
18:49:01.0928 3652  ohci1394 - ok
18:49:01.0974 3652  [ 5A432A042DAE460ABE7199B758E8606C ] ose            C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
18:49:01.0990 3652  ose - ok
18:49:02.0115 3652  [ 5DE1A3972FD3112C75EB17BDCF454169 ] p2pimsvc        C:\Windows\system32\p2psvc.dll
18:49:02.0240 3652  p2pimsvc - ok
18:49:02.0240 3652  [ 5DE1A3972FD3112C75EB17BDCF454169 ] p2psvc          C:\Windows\system32\p2psvc.dll
18:49:02.0286 3652  p2psvc - ok
18:49:02.0318 3652  [ 0FA9B5055484649D63C303FE404E5F4D ] Parport        C:\Windows\system32\drivers\parport.sys
18:49:02.0396 3652  Parport - ok
18:49:02.0442 3652  [ 3B38467E7C3DAED009DFE359E17F139F ] partmgr        C:\Windows\system32\drivers\partmgr.sys
18:49:02.0458 3652  partmgr - ok
18:49:02.0489 3652  [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm          C:\Windows\system32\drivers\parvdm.sys
18:49:02.0583 3652  Parvdm - ok
18:49:02.0630 3652  [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc          C:\Windows\System32\pcasvc.dll
18:49:02.0661 3652  PcaSvc - ok
18:49:02.0723 3652  [ FD2041E9BA03DB7764B2248F02475079 ] pccsmcfd        C:\Windows\system32\DRIVERS\pccsmcfd.sys
18:49:02.0770 3652  pccsmcfd - ok
18:49:02.0801 3652  [ 01B94418DEB235DFF777CC80076354B4 ] pci            C:\Windows\system32\drivers\pci.sys
18:49:02.0817 3652  pci - ok
18:49:02.0864 3652  [ FC175F5DDAB666D7F4D17449A547626F ] pciide          C:\Windows\system32\drivers\pciide.sys
18:49:02.0879 3652  pciide - ok
18:49:02.0926 3652  [ B7C5A8769541900F6DFA6FE0C5E4D513 ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
18:49:02.0957 3652  pcmcia - ok
18:49:03.0004 3652  [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
18:49:03.0129 3652  PEAUTH - ok
18:49:03.0347 3652  [ B1689DF169143F57053F795390C99DB3 ] pla            C:\Windows\system32\pla.dll
18:49:03.0456 3652  pla - ok
18:49:03.0503 3652  [ 78F975CB6D18265BE6F492EDB2D7BC7B ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
18:49:03.0550 3652  PlugPlay - ok
18:49:03.0675 3652  [ 5DE1A3972FD3112C75EB17BDCF454169 ] PNRPAutoReg    C:\Windows\system32\p2psvc.dll
18:49:03.0737 3652  PNRPAutoReg - ok
18:49:03.0753 3652  [ 5DE1A3972FD3112C75EB17BDCF454169 ] PNRPsvc        C:\Windows\system32\p2psvc.dll
18:49:03.0784 3652  PNRPsvc - ok
18:49:03.0893 3652  [ 47B8F37AA18B74D8C2E1BC1A7A2C8F8A ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
18:49:04.0018 3652  PolicyAgent - ok
18:49:04.0080 3652  [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
18:49:04.0112 3652  PptpMiniport - ok
18:49:04.0174 3652  [ 2027293619DD0F047C584CF2E7DF4FFD ] Processor      C:\Windows\system32\drivers\processr.sys
18:49:04.0236 3652  Processor - ok
18:49:04.0330 3652  [ B627E4FC8585E8843C5905D4D3587A90 ] ProfSvc        C:\Windows\system32\profsvc.dll
18:49:04.0392 3652  ProfSvc - ok
18:49:04.0439 3652  [ A911ECAC81F94ADEAFBE8E3F7873EDB0 ] ProtectedStorage C:\Windows\system32\lsass.exe
18:49:04.0455 3652  ProtectedStorage - ok
18:49:04.0502 3652  [ BFEF604508A0ED1EAE2A73E872555FFB ] PSched          C:\Windows\system32\DRIVERS\pacer.sys
18:49:04.0580 3652  PSched - ok
18:49:04.0689 3652  [ 0A6DB55AFB7820C99AA1F3A1D270F4F6 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
18:49:04.0782 3652  ql2300 - ok
18:49:04.0845 3652  [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
18:49:04.0876 3652  ql40xx - ok
18:49:04.0954 3652  [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE          C:\Windows\system32\qwave.dll
18:49:05.0016 3652  QWAVE - ok
18:49:05.0048 3652  [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
18:49:05.0079 3652  QWAVEdrv - ok
18:49:05.0094 3652  [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
18:49:05.0157 3652  RasAcd - ok
18:49:05.0172 3652  [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto        C:\Windows\System32\rasauto.dll
18:49:05.0219 3652  RasAuto - ok
18:49:05.0282 3652  [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
18:49:05.0375 3652  Rasl2tp - ok
18:49:05.0453 3652  [ 6E7C284FC5C4EC07AD164D93810385A6 ] RasMan          C:\Windows\System32\rasmans.dll
18:49:05.0516 3652  RasMan - ok
18:49:05.0547 3652  [ 3E9D9B048107B40D87B97DF2E48E0744 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
18:49:05.0609 3652  RasPppoe - ok
18:49:05.0625 3652  [ A7D141684E9500AC928A772ED8E6B671 ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
18:49:05.0703 3652  RasSstp - ok
18:49:05.0796 3652  [ 6E1C5D0457622F9EE35F683110E93D14 ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
18:49:05.0906 3652  rdbss - ok
18:49:05.0937 3652  [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
18:49:05.0984 3652  RDPCDD - ok
18:49:06.0108 3652  [ FBC0BACD9C3D7F6956853F64A66E252D ] rdpdr          C:\Windows\system32\drivers\rdpdr.sys
18:49:06.0155 3652  rdpdr - ok
18:49:06.0186 3652  [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
18:49:06.0249 3652  RDPENCDD - ok
18:49:06.0311 3652  [ E1C18F4097A5ABCEC941DC4B2F99DB7E ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
18:49:06.0405 3652  RDPWD - ok
18:49:06.0452 3652  [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess    C:\Windows\System32\mprdim.dll
18:49:06.0498 3652  RemoteAccess - ok
18:49:06.0545 3652  [ CC4E32400F3C7253400CF8F3F3A0B676 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
18:49:06.0592 3652  RemoteRegistry - ok
18:49:06.0654 3652  [ F85AE59A52885F4B09AADAFB23001A3B ] Rezip          C:\Windows\SYSTEM32\Rezip.exe
18:49:06.0701 3652  Rezip ( UnsignedFile.Multi.Generic ) - warning
18:49:06.0701 3652  Rezip - detected UnsignedFile.Multi.Generic (1)
18:49:06.0748 3652  [ 10536B0AD6F416FC7F1149977C28CCDC ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
18:49:06.0795 3652  RFCOMM - ok
18:49:06.0826 3652  [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator      C:\Windows\system32\locator.exe
18:49:06.0873 3652  RpcLocator - ok
18:49:06.0935 3652  [ 301AE00E12408650BADDC04DBC832830 ] RpcSs          C:\Windows\system32\rpcss.dll
18:49:06.0966 3652  RpcSs - ok
18:49:07.0044 3652  [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
18:49:07.0107 3652  rspndr - ok
18:49:07.0138 3652  [ A911ECAC81F94ADEAFBE8E3F7873EDB0 ] SamSs          C:\Windows\system32\lsass.exe
18:49:07.0154 3652  SamSs - ok
18:49:07.0247 3652  [ 3CE8F073A557E172B330109436984E30 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
18:49:07.0263 3652  sbp2port - ok
18:49:07.0310 3652  [ 11387E32642269C7E62E8B52C060B3C6 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
18:49:07.0356 3652  SCardSvr - ok
18:49:07.0403 3652  [ 7B587B8A6D4A99F79D2902D0385F29BD ] Schedule        C:\Windows\system32\schedsvc.dll
18:49:07.0466 3652  Schedule - ok
18:49:07.0497 3652  [ 87C2D0377B23E2D8A41093C2F5FB1A5B ] SCPolicySvc    C:\Windows\System32\certprop.dll
18:49:07.0544 3652  SCPolicySvc - ok
18:49:07.0606 3652  [ 126EA89BCC413EE45E3004FB0764888F ] sdbus          C:\Windows\system32\DRIVERS\sdbus.sys
18:49:07.0653 3652  sdbus - ok
18:49:07.0700 3652  [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
18:49:07.0762 3652  SDRSVC - ok
18:49:07.0793 3652  [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
18:49:07.0887 3652  secdrv - ok
18:49:07.0918 3652  [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon        C:\Windows\system32\seclogon.dll
18:49:07.0965 3652  seclogon - ok
18:49:07.0980 3652  [ A9BBAB5759771E523F55563D6CBE140F ] SENS            C:\Windows\system32\sens.dll
18:49:08.0043 3652  SENS - ok
18:49:08.0090 3652  [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum        C:\Windows\system32\drivers\serenum.sys
18:49:08.0168 3652  Serenum - ok
18:49:08.0214 3652  [ C70D69A918B178D3C3B06339B40C2E1B ] Serial          C:\Windows\system32\drivers\serial.sys
18:49:08.0292 3652  Serial - ok
18:49:08.0324 3652  [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
18:49:08.0355 3652  sermouse - ok
18:49:08.0589 3652  [ 8C1F87F5FDD92229D1754B98F073913F ] ServiceLayer    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
18:49:08.0636 3652  ServiceLayer ( UnsignedFile.Multi.Generic ) - warning
18:49:08.0636 3652  ServiceLayer - detected UnsignedFile.Multi.Generic (1)
18:49:08.0682 3652  [ D2193326F729B163125610DBF3E17D57 ] SessionEnv      C:\Windows\system32\sessenv.dll
18:49:08.0729 3652  SessionEnv - ok
18:49:08.0792 3652  [ 3EFA810BDCA87F6ECC24F9832243FE86 ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
18:49:08.0838 3652  sffdisk - ok
18:49:08.0870 3652  [ E95D451F7EA3E583AEC75F3B3EE42DC5 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
18:49:08.0948 3652  sffp_mmc - ok
18:49:08.0979 3652  [ 3D0EA348784B7AC9EA9BD9F317980979 ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
18:49:09.0041 3652  sffp_sd - ok
18:49:09.0072 3652  [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy        C:\Windows\system32\drivers\sfloppy.sys
18:49:09.0166 3652  sfloppy - ok
18:49:09.0197 3652  [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
18:49:09.0275 3652  SharedAccess - ok
18:49:09.0322 3652  [ 1E3FDB80E40A3CE645F229DFBDFB7694 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
18:49:09.0384 3652  ShellHWDetection - ok
18:49:09.0416 3652  [ 1D76624A09A054F682D746B924E2DBC3 ] sisagp          C:\Windows\system32\drivers\sisagp.sys
18:49:09.0431 3652  sisagp - ok
18:49:09.0462 3652  [ 43CB7AA756C7DB280D01DA9B676CFDE2 ] SiSRaid2        C:\Windows\system32\drivers\sisraid2.sys
18:49:09.0478 3652  SiSRaid2 - ok
18:49:09.0509 3652  [ A99C6C8B0BAA970D8AA59DDC50B57F94 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
18:49:09.0540 3652  SiSRaid4 - ok
18:49:09.0650 3652  [ 0BA91E1358AD25236863039BB2609A2E ] slsvc          C:\Windows\system32\SLsvc.exe
18:49:09.0852 3652  slsvc - ok
18:49:09.0915 3652  [ 7C6DC44CA0BFA6291629AB764200D1D4 ] SLUINotify      C:\Windows\system32\SLUINotify.dll
18:49:09.0962 3652  SLUINotify - ok
18:49:09.0993 3652  [ 031E6BCD53C9B2B9ACE111EAFEC347B6 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
18:49:10.0040 3652  Smb - ok
18:49:10.0071 3652  [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
18:49:10.0086 3652  SNMPTRAP - ok
18:49:10.0133 3652  [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr          C:\Windows\system32\drivers\spldr.sys
18:49:10.0133 3652  spldr - ok
18:49:10.0196 3652  [ 3665F79026A3F91FBCA63F2C65A09B19 ] Spooler        C:\Windows\System32\spoolsv.exe
18:49:10.0258 3652  Spooler - ok
18:49:10.0305 3652  [ 86EBD8B1F23E743AAD21F4D5B4D40985 ] SQLBrowser      C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
18:49:10.0320 3652  SQLBrowser - ok
18:49:10.0383 3652  [ D89083C4EB02DACA8F944B0E05E57F9D ] SQLWriter      C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
18:49:10.0398 3652  SQLWriter - ok
18:49:10.0554 3652  [ 2252AEF839B1093D16761189F45AF885 ] srv            C:\Windows\system32\DRIVERS\srv.sys
18:49:10.0586 3652  srv - ok
18:49:10.0648 3652  [ B7FF59408034119476B00A81BB53D5D1 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
18:49:10.0710 3652  srv2 - ok
18:49:10.0742 3652  [ 2ACCC9B12AF02030F531E6CCA6F8B76E ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
18:49:10.0788 3652  srvnet - ok
18:49:10.0851 3652  [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
18:49:10.0898 3652  SSDPSRV - ok
18:49:10.0960 3652  [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv          C:\Windows\system32\DRIVERS\ssmdrv.sys
18:49:11.0116 3652  ssmdrv - ok
18:49:11.0178 3652  [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc        C:\Windows\system32\sstpsvc.dll
18:49:11.0256 3652  SstpSvc - ok
18:49:11.0303 3652  [ 7DD08A597BC56051F320DA0BAF69E389 ] stisvc          C:\Windows\System32\wiaservc.dll
18:49:11.0366 3652  stisvc - ok
18:49:11.0428 3652  [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
18:49:11.0459 3652  swenum - ok
18:49:11.0506 3652  [ B36C7CDB86F7F7A8E884479219766950 ] swprv          C:\Windows\System32\swprv.dll
18:49:11.0568 3652  swprv - ok
18:49:11.0615 3652  [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx        C:\Windows\system32\drivers\symc8xx.sys
18:49:11.0631 3652  Symc8xx - ok
18:49:11.0646 3652  [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi          C:\Windows\system32\drivers\sym_hi.sys
18:49:11.0662 3652  Sym_hi - ok
18:49:11.0678 3652  [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3          C:\Windows\system32\drivers\sym_u3.sys
18:49:11.0693 3652  Sym_u3 - ok
18:49:11.0740 3652  [ 71837FBCE3FD8143953444B3FF7938DC ] SynTP          C:\Windows\system32\DRIVERS\SynTP.sys
18:49:11.0756 3652  SynTP - ok
18:49:11.0787 3652  [ 8710A92D0024B03B5FB9540DF1F71F1D ] SysMain        C:\Windows\system32\sysmain.dll
18:49:11.0849 3652  SysMain - ok
18:49:11.0865 3652  [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll
18:49:11.0943 3652  TabletInputService - ok
18:49:11.0974 3652  [ 680916BB09EE0F3A6ACA7C274B0D633F ] TapiSrv        C:\Windows\System32\tapisrv.dll
18:49:12.0021 3652  TapiSrv - ok
18:49:12.0068 3652  [ CB05822CD9CC6C688168E113C603DBE7 ] TBS            C:\Windows\System32\tbssvc.dll
18:49:12.0114 3652  TBS - ok
18:49:12.0270 3652  [ 782568AB6A43160A159B6215B70BCCE9 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
18:49:12.0348 3652  Tcpip - ok
18:49:12.0458 3652  [ 782568AB6A43160A159B6215B70BCCE9 ] Tcpip6          C:\Windows\system32\DRIVERS\tcpip.sys
18:49:12.0504 3652  Tcpip6 - ok
18:49:12.0551 3652  [ D4A2E4A4B011F3A883AF77315A5AE76B ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
18:49:12.0629 3652  tcpipreg - ok
18:49:12.0645 3652  [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
18:49:12.0738 3652  TDPIPE - ok
18:49:12.0754 3652  [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
18:49:12.0832 3652  TDTCP - ok
18:49:12.0863 3652  [ D09276B1FAB033CE1D40DCBDF303D10F ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
18:49:12.0941 3652  tdx - ok
18:49:12.0988 3652  [ A048056F5E1A96A9BF3071B91741A5AA ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
18:49:13.0004 3652  TermDD - ok
18:49:13.0066 3652  [ D605031E225AACCBCEB5B76A4F1603A6 ] TermService    C:\Windows\System32\termsrv.dll
18:49:13.0160 3652  TermService - ok
18:49:13.0191 3652  [ 1E3FDB80E40A3CE645F229DFBDFB7694 ] Themes          C:\Windows\system32\shsvcs.dll
18:49:13.0222 3652  Themes - ok
18:49:13.0253 3652  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER    C:\Windows\system32\mmcss.dll
18:49:13.0300 3652  THREADORDER - ok
18:49:13.0347 3652  [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks          C:\Windows\System32\trkwks.dll
18:49:13.0409 3652  TrkWks - ok
18:49:13.0472 3652  [ 16613A1BAD034D4ECF957AF18B7C2FF5 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
18:49:13.0518 3652  TrustedInstaller - ok
18:49:13.0534 3652  [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
18:49:13.0596 3652  tssecsrv - ok
18:49:13.0628 3652  [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp          C:\Windows\system32\DRIVERS\tunmp.sys
18:49:13.0690 3652  tunmp - ok
18:49:13.0721 3652  [ 6042505FF6FA9AC1EF7684D0E03B6940 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
18:49:13.0752 3652  tunnel - ok
18:49:13.0784 3652  [ 7D33C4DB2CE363C8518D2DFCF533941F ] uagp35          C:\Windows\system32\drivers\uagp35.sys
18:49:13.0799 3652  uagp35 - ok
18:49:13.0846 3652  [ 8B5088058FA1D1CD897A2113CCFF6C58 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
18:49:13.0940 3652  udfs - ok
18:49:14.0002 3652  [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
18:49:14.0064 3652  UI0Detect - ok
18:49:14.0096 3652  [ B0ACFDC9E4AF279E9116C03E014B2B27 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
18:49:14.0111 3652  uliagpkx - ok
18:49:14.0142 3652  [ 9224BB254F591DE4CA8D572A5F0D635C ] uliahci        C:\Windows\system32\drivers\uliahci.sys
18:49:14.0158 3652  uliahci - ok
18:49:14.0189 3652  [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata          C:\Windows\system32\drivers\ulsata.sys
18:49:14.0220 3652  UlSata - ok
18:49:14.0252 3652  [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2        C:\Windows\system32\drivers\ulsata2.sys
18:49:14.0267 3652  ulsata2 - ok
18:49:14.0298 3652  [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
18:49:14.0361 3652  umbus - ok
18:49:14.0423 3652  [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost        C:\Windows\System32\upnphost.dll
18:49:14.0501 3652  upnphost - ok
18:49:14.0548 3652  [ AFB10A231254A1920C3BB4A0D02E1CA6 ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
18:49:14.0610 3652  usbccgp - ok
18:49:14.0626 3652  [ E9476E6C486E76BC4898074768FB7131 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
18:49:14.0720 3652  usbcir - ok
18:49:14.0751 3652  [ 44245742C4ED2EAFD69020583424455B ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
18:49:14.0766 3652  usbehci - ok
18:49:14.0860 3652  [ DB39B3F83AF77BCA019D7DF6AADDBDAE ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
18:49:14.0907 3652  usbhub - ok
18:49:14.0938 3652  [ 38DBC7DD6CC5A72011F187425384388B ] usbohci        C:\Windows\system32\drivers\usbohci.sys
18:49:15.0016 3652  usbohci - ok
18:49:15.0047 3652  [ E75C4B5269091D15A2E7DC0B6D35F2F5 ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
18:49:15.0094 3652  usbprint - ok
18:49:15.0125 3652  [ 87BA6B83C5D19B69160968D07D6E2982 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
18:49:15.0188 3652  USBSTOR - ok
18:49:15.0203 3652  [ 587809974E43CFAD0CA0EF6E1D940CA9 ] usbuhci        C:\Windows\system32\DRIVERS\usbuhci.sys
18:49:15.0250 3652  usbuhci - ok
18:49:15.0297 3652  [ E67998E8F14CB0627A769F6530BCB352 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys
18:49:15.0375 3652  usbvideo - ok
18:49:15.0406 3652  [ 032A0ACC3909AE7215D524E29D536797 ] UxSms          C:\Windows\System32\uxsms.dll
18:49:15.0468 3652  UxSms - ok
18:49:15.0500 3652  [ B13BC395B9D6116628F5AF47E0802AC4 ] vds            C:\Windows\System32\vds.exe
18:49:15.0578 3652  vds - ok
18:49:15.0609 3652  [ 87B06E1F30B749A114F74622D013F8D4 ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
18:49:15.0671 3652  vga - ok
18:49:15.0718 3652  [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave        C:\Windows\System32\drivers\vga.sys
18:49:15.0765 3652  VgaSave - ok
18:49:15.0812 3652  [ 5D7159DEF58A800D5781BA3A879627BC ] viaagp          C:\Windows\system32\drivers\viaagp.sys
18:49:15.0858 3652  viaagp - ok
18:49:15.0874 3652  [ C4F3A691B5BAD343E6249BD8C2D45DEE ] ViaC7          C:\Windows\system32\drivers\viac7.sys
18:49:15.0921 3652  ViaC7 - ok
18:49:15.0936 3652  [ AADF5587A4063F52C2C3FED7887426FC ] viaide          C:\Windows\system32\drivers\viaide.sys
18:49:15.0968 3652  viaide - ok
18:49:15.0999 3652  [ 20A559A25C4AE3F9B35F8229636EE5A7 ] VMC326          C:\Windows\system32\Drivers\VMC326.sys
18:49:16.0046 3652  VMC326 - ok
18:49:16.0077 3652  [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
18:49:16.0092 3652  volmgr - ok
18:49:16.0108 3652  [ 98F5FFE6316BD74E9E2C97206C190196 ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
18:49:16.0124 3652  volmgrx - ok
18:49:16.0139 3652  [ D8B4A53DD2769F226B3EB374374987C9 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
18:49:16.0170 3652  volsnap - ok
18:49:16.0186 3652  [ 587253E09325E6BF226B299774B728A9 ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
18:49:16.0217 3652  vsmraid - ok
18:49:16.0264 3652  [ D5FB73D19C46ADE183F968E13F186B23 ] VSS            C:\Windows\system32\vssvc.exe
18:49:16.0326 3652  VSS - ok
18:49:16.0373 3652  [ 1CF9206966A8458CDA9A8B20DF8AB7D3 ] W32Time        C:\Windows\system32\w32time.dll
18:49:16.0498 3652  W32Time - ok
18:49:16.0529 3652  [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
18:49:16.0638 3652  WacomPen - ok
18:49:16.0670 3652  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp          C:\Windows\system32\DRIVERS\wanarp.sys
18:49:16.0701 3652  Wanarp - ok
18:49:16.0701 3652  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
18:49:16.0732 3652  Wanarpv6 - ok
18:49:16.0794 3652  [ F3A5C2E1A6533192B070D06ECF6BE796 ] wcncsvc        C:\Windows\System32\wcncsvc.dll
18:49:16.0857 3652  wcncsvc - ok
18:49:16.0888 3652  [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
18:49:16.0966 3652  WcsPlugInService - ok
18:49:17.0013 3652  [ 78FE9542363F297B18C027B2D7E7C07F ] Wd              C:\Windows\system32\drivers\wd.sys
18:49:17.0028 3652  Wd - ok
18:49:17.0200 3652  [ 9950E3D0F08141C7E89E64456AE7DC73 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
18:49:17.0262 3652  Wdf01000 - ok
18:49:17.0294 3652  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost  C:\Windows\system32\wdi.dll
18:49:17.0356 3652  WdiServiceHost - ok
18:49:17.0356 3652  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost  C:\Windows\system32\wdi.dll
18:49:17.0403 3652  WdiSystemHost - ok
18:49:17.0465 3652  [ CF9A5F41789B642DB967021DE06A2713 ] WebClient      C:\Windows\System32\webclnt.dll
18:49:17.0512 3652  WebClient - ok
18:49:17.0574 3652  [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc          C:\Windows\system32\wecsvc.dll
18:49:17.0621 3652  Wecsvc - ok
18:49:17.0652 3652  [ 670FF720071ED741206D69BD995EA453 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
18:49:17.0684 3652  wercplsupport - ok
18:49:17.0730 3652  [ FD1965AAA112C6818A30AB02742D0461 ] WerSvc          C:\Windows\System32\WerSvc.dll
18:49:17.0777 3652  WerSvc - ok
18:49:17.0871 3652  [ 4575AA12561C5648483403541D0D7F2B ] WinDefend      C:\Program Files\Windows Defender\mpsvc.dll
18:49:17.0902 3652  WinDefend - ok
18:49:17.0902 3652  WinHttpAutoProxySvc - ok
18:49:18.0136 3652  [ 00B79A7C984678F24CF052E5BEB3A2F5 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
18:49:18.0183 3652  Winmgmt - ok
18:49:18.0495 3652  [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM          C:\Windows\system32\WsmSvc.dll
18:49:18.0588 3652  WinRM - ok
18:49:18.0854 3652  [ 275F4346E569DF56CFB95243BD6F6FF0 ] Wlansvc        C:\Windows\System32\wlansvc.dll
18:49:18.0932 3652  Wlansvc - ok
18:49:19.0010 3652  [ 2E7255D172DF0B8283CDFB7B433B864E ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
18:49:19.0056 3652  WmiAcpi - ok
18:49:19.0150 3652  [ ABA4CF9F856D9A3A25F4DDD7690A6E9D ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
18:49:19.0228 3652  wmiApSrv - ok
18:49:19.0415 3652  [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc  C:\Program Files\Windows Media Player\wmpnetwk.exe
18:49:19.0478 3652  WMPNetworkSvc - ok
18:49:19.0524 3652  [ 5D94CD167751294962BA238D82DD1BB8 ] WPCSvc          C:\Windows\System32\wpcsvc.dll
18:49:19.0602 3652  WPCSvc - ok
18:49:19.0634 3652  [ 396D406292B0CD26E3504FFE82784702 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
18:49:19.0712 3652  WPDBusEnum - ok
18:49:19.0758 3652  [ 0CEC23084B51B8288099EB710224E955 ] WpdUsb          C:\Windows\system32\DRIVERS\wpdusb.sys
18:49:19.0805 3652  WpdUsb - ok
18:49:19.0914 3652  [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
18:49:19.0961 3652  WPFFontCache_v0400 - ok
18:49:19.0992 3652  [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
18:49:20.0055 3652  ws2ifsl - ok
18:49:20.0102 3652  [ 683DD16B590372F2C9661D277F35E49C ] wscsvc          C:\Windows\system32\wscsvc.dll
18:49:20.0117 3652  wscsvc - ok
18:49:20.0133 3652  WSearch - ok
18:49:20.0273 3652  [ 6298277B73C77FA99106B271A7525163 ] wuauserv        C:\Windows\system32\wuaueng.dll
18:49:20.0351 3652  wuauserv - ok
18:49:20.0414 3652  [ AC13CB789D93412106B0FB6C7EB2BCB6 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
18:49:20.0492 3652  WUDFRd - ok
18:49:20.0523 3652  [ 575A4190D989F64732119E4114045A4F ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
18:49:20.0570 3652  wudfsvc - ok
18:49:20.0648 3652  [ 3541E083BE976294DA5E644DB122A9A7 ] yksvc          C:\Windows\System32\ykx32mpcoinst.dll
18:49:20.0710 3652  yksvc - ok
18:49:20.0741 3652  [ 6D16A5C05D4FA06FADE1D97580986803 ] yukonwlh        C:\Windows\system32\DRIVERS\yk60x86.sys
18:49:20.0788 3652  yukonwlh - ok
18:49:20.0835 3652  ================ Scan global ===============================
18:49:20.0850 3652  [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll
18:49:20.0944 3652  [ F42F8855CB5C22E203C6672B124F17FD ] C:\Windows\system32\winsrv.dll
18:49:20.0960 3652  [ F42F8855CB5C22E203C6672B124F17FD ] C:\Windows\system32\winsrv.dll
18:49:21.0038 3652  [ 2B336AB6286D6C81FA02CBAB914E3C6C ] C:\Windows\system32\services.exe
18:49:21.0038 3652  [Global] - ok
18:49:21.0038 3652  ================ Scan MBR ==================================
18:49:21.0084 3652  [ 61A349592C4728853F4A90FF78F7628E ] \Device\Harddisk0\DR0
18:49:21.0615 3652  \Device\Harddisk0\DR0 - ok
18:49:21.0615 3652  ================ Scan VBR ==================================
18:49:21.0646 3652  [ 68E65693FFCFD3E8AE526CCD5ABF1588 ] \Device\Harddisk0\DR0\Partition1
18:49:21.0662 3652  \Device\Harddisk0\DR0\Partition1 - ok
18:49:21.0677 3652  [ 7AE8CEAA12279B97B197CB3391D905BC ] \Device\Harddisk0\DR0\Partition2
18:49:21.0677 3652  \Device\Harddisk0\DR0\Partition2 - ok
18:49:21.0677 3652  ============================================================
18:49:21.0677 3652  Scan finished
18:49:21.0677 3652  ============================================================
18:49:21.0693 4064  Detected object count: 3
18:49:21.0693 4064  Actual detected object count: 3
18:49:56.0060 4064  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
18:49:56.0060 4064  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:49:56.0060 4064  Rezip ( UnsignedFile.Multi.Generic ) - skipped by user
18:49:56.0060 4064  Rezip ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:49:56.0060 4064  ServiceLayer ( UnsignedFile.Multi.Generic ) - skipped by user
18:49:56.0060 4064  ServiceLayer ( UnsignedFile.Multi.Generic ) - User select action: Skip
18:50:23.0192 0364  Deinitialize success

cosinus 20.01.2013 19:00
Die Dinger sind ok

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Falls der adwCleaner schon mal in der runtergeladen wurde, bitte die alte adwcleaner.exe löschen und neu runterladen!!
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Suche.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[Rx].txt. (x=fortlaufende Nummer)

as9361 21.01.2013 14:00
Hallo, hier die adwcleaner.txt

Code:
# AdwCleaner v2.106 - Datei am 21/01/2013 um 13:53:51 erstellt
# Aktualisiert am 17/01/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 1 (32 bits)
# Benutzer : Scherer - SCHERER-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Scherer\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v7.0.6001.18639

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v17.0.1 (de)

Datei : C:\Users\Scherer\AppData\Roaming\Mozilla\Firefox\Profiles\inqqxxmk.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R2].txt - [22568 octets] - [27/12/2012 00:14:31]
AdwCleaner[R3].txt - [1063 octets] - [27/12/2012 00:18:30]
AdwCleaner[R4].txt - [861 octets] - [21/01/2013 13:53:51]
AdwCleaner[S1].txt - [22429 octets] - [27/12/2012 00:15:12]

########## EOF - C:\AdwCleaner[R4].txt - [981 octets] ##########

cosinus 21.01.2013 14:06
Sieht ok aus. Eine Kontrolle mit OTL bitte:
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in CODE-Tags in den Thread.

as9361 21.01.2013 15:23
Hier sind sie


OTL.txt

OTL Logfile:
Code:
OTL logfile created on: 21.01.2013 14:53:58 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Scherer\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,96 Gb Total Physical Memory | 2,01 Gb Available Physical Memory | 67,87% Memory free
6,16 Gb Paging File | 5,15 Gb Available in Paging File | 83,69% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 226,76 Gb Total Space | 98,07 Gb Free Space | 43,25% Space Free | Partition Type: NTFS
Drive D: | 226,00 Gb Total Space | 225,91 Gb Free Space | 99,96% Space Free | Partition Type: NTFS
Drive F: | 298,09 Gb Total Space | 107,58 Gb Free Space | 36,09% Space Free | Partition Type: NTFS
 
Computer Name: SCHERER-PC | User Name: Scherer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Scherer\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\PDF24\pdf24.exe (Geek Software GmbH)
PRC - C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
PRC - C:\Programme\Samsung\Easy Display Manager\dmhkcore.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Programme\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Windows\System32\Rezip.exe ()
PRC - C:\Programme\Samsung\EBM\EasyBatteryMgr3.exe (SAMSUNG Electronics co., LTD.)
PRC - C:\Programme\Samsung\Samsung Update Plus\SUPNotifier.exe ()
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation)
PRC - C:\Programme\PrintKey2000\Printkey2000.exe (Fred's Software)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\0a1195c6b5fab213527364c9e8b26ef0\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\1ba19f8efcff8ad7f972aa38ab9a15f5\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\aa3e053d433c48e1e8c3f436b4de1ed3\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\d9228d58804dfd75fd92a4d12ffac8af\Accessibility.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\cfb60f99da570cc494e27e0e8ee747e2\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\381fb23cb39e1a61e13b8770eb9800ba\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\f1aa2385c0109f3059e0e6ba8b58ff68\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dff86a62a525ec8dc827fe9f50298b7\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\0309936a8e1672d39b9cf14463ce69f9\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.3358.38385__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3358.38459__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3358.38368__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3358.38387__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3358.38460__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3358.38441__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3358.38376__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3358.38423__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3358.38381__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3358.38410__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3358.38376__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3358.38412__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3358.38435__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3358.38428__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard\2.0.3358.38458__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3358.38428__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3358.38412__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3358.38427__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.3358.38458__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.3358.38377__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3358.38387__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3358.38407__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3358.38411__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Dashboard\2.0.3358.38422__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Wizard\2.0.3358.38391__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3358.38387__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3358.38421__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.3309.28604__90ba9c70f846762e\CLI.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3358.38411__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3358.38391__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3358.38411__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3358.38420__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3309.28601__90ba9c70f846762e\LOG.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3358.38422__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3309.28603__90ba9c70f846762e\NEWAEM.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3309.28669__90ba9c70f846762e\CLI.Foundation.XManifest.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3309.28630__90ba9c70f846762e\DEM.OS.I0602.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3309.28620__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3309.28617__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3309.28617__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3309.28608__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3309.28626__90ba9c70f846762e\MOM.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.3309.28645__90ba9c70f846762e\DEM.OS.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.3309.28630__90ba9c70f846762e\DEM.Graphics.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3309.28629__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.REG.Shared\2.0.3309.28645__90ba9c70f846762e\AEM.Plugin.REG.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3309.28647__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3309.28627__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3309.28647__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3358.38449__90ba9c70f846762e\CLI.Component.Systemtray.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Implementation\2.0.3358.38485__90ba9c70f846762e\ResourceManagement.Foundation.Implementation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3358.38381__90ba9c70f846762e\CLI.Component.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3358.38454__90ba9c70f846762e\MOM.Implementation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3358.38365__90ba9c70f846762e\CLI.Component.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3309.28636__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3358.38452__90ba9c70f846762e\LOG.Foundation.Implementation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3309.28618__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3358.38367__90ba9c70f846762e\CLI.Component.SkinFactory.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3309.28636__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3309.28634__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3309.28634__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3309.28634__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3309.28628__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3358.38467__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3309.28608__90ba9c70f846762e\CLI.Foundation.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3309.28644__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3309.28636__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3309.28614__90ba9c70f846762e\LOG.Foundation.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3309.28624__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.3309.28644__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3309.28632__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3309.28630__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3309.28627__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3309.28627__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3309.28635__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Private\2.0.3309.28612__90ba9c70f846762e\ResourceManagement.Foundation.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3309.28626__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3309.28611__90ba9c70f846762e\CLI.Component.Client.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3309.28630__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.3309.28626__90ba9c70f846762e\APM.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3309.28617__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3309.28631__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3309.28630__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3309.28617__90ba9c70f846762e\AEM.Server.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll ()
MOD - C:\Windows\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3358.38363__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3358.38372__90ba9c70f846762e\CLI.Component.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.3358.38366__90ba9c70f846762e\ATIDEMOS.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.3358.38365__90ba9c70f846762e\APM.Server.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.3358.38364__90ba9c70f846762e\AEM.Server.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3309.28621__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3358.38453__90ba9c70f846762e\CCC.Implementation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3309.28624__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3309.28637__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll ()
MOD - C:\Windows\System32\atitmmxx.dll ()
MOD - C:\Programme\ATI Technologies\ATI.ACE\Branding\Branding.dll ()
MOD - C:\Programme\Samsung\Samsung Update Plus\SUPNotifier.exe ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Programme\Samsung\Samsung Update Plus\HMXML.dll ()
MOD - C:\Programme\Samsung\Samsung Magic Doctor\HookDllPS2.dll ()
MOD - C:\Programme\Samsung\EasySpeedUpManager\HookDllPS2.dll ()
MOD - C:\Programme\Samsung\Easy Display Manager\HookDllPS2.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (SQLWriter) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (MSSQL$MSSMLBIZ) -- C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLBrowser) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
SRV - (MSSQLServerADHelper) -- C:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)
SRV - (Rezip) -- C:\Windows\System32\Rezip.exe ()
SRV - (yksvc) -- C:\Windows\System32\ykx32mpcoinst.dll (Marvell)
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (BcmSqlStartupSvc) -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (catchme) -- C:\ComboFix\catchme.sys File not found
DRV - (hitmanpro37) -- C:\Windows\System32\drivers\hitmanpro37.sys ()
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (nmwcd) -- C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (VMC326) -- C:\Windows\System32\drivers\VMC326.sys (Vimicro Corporation)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (KMDFMEMIO) -- C:\Windows\System32\drivers\KMDFMEMIO.sys (SAMSUNG ELECTRONICS CO., LTD.)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (NETw3v32) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel Corporation)
DRV - (fxusbase) -- C:\Windows\System32\drivers\fxusbase.sys (AVM Berlin)
DRV - (AVMCOWAN) -- C:\Windows\System32\drivers\avmcowan.sys (AVM GmbH)
DRV - (bcm4sbxp) -- C:\Windows\System32\drivers\bcm4sbxp.sys (Broadcom Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
IE - HKLM\..\SearchScopes,DefaultScope =
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-21-326891830-3036340036-2452681849-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKU\S-1-5-21-326891830-3036340036-2452681849-1003\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-326891830-3036340036-2452681849-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com
IE - HKU\S-1-5-21-326891830-3036340036-2452681849-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com
IE - HKU\S-1-5-21-326891830-3036340036-2452681849-1003\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-326891830-3036340036-2452681849-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-326891830-3036340036-2452681849-1003\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
IE - HKU\S-1-5-21-326891830-3036340036-2452681849-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-326891830-3036340036-2452681849-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledAddons: %7BACAA314B-EEBA-48e4-AD47-84E31C44796C%7D:1.0.1
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1
FF - prefs.js..extensions.enabledItems: helperbar@helperbar.com:1.0
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.0.14
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.4.76
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.12.28 15:34:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.06.24 11:15:28 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{2EF9C33D-8C9E-412D-90A1-D89882559C18}: C:\Users\Scherer\AppData\Local\{2EF9C33D-8C9E-412D-90A1-D89882559C18}
 
[2011.01.23 22:40:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Scherer\AppData\Roaming\mozilla\Extensions
[2012.12.27 00:15:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Scherer\AppData\Roaming\mozilla\Firefox\Profiles\inqqxxmk.default\extensions
[2011.05.20 19:37:47 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Scherer\AppData\Roaming\mozilla\Firefox\Profiles\inqqxxmk.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.12.28 15:34:12 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.06.24 11:15:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012.11.29 09:26:57 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.11.29 10:19:31 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.11.29 10:19:31 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.11.29 10:19:31 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.11.29 10:19:32 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.11.29 10:19:31 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.11.29 10:19:31 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2013.01.16 19:54:21 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Nikon Message Center 2] C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe (Nikon Corporation)
O4 - HKLM..\Run: [PDFPrint] C:\Programme\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-326891830-3036340036-2452681849-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-326891830-3036340036-2452681849-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Free YouTube Download - C:\Users\Scherer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Scherer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1182E39A-2576-41B0-9F03-17318447B695}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FBADC4E0-3506-4561-88A1-0BFB76CA0EAF}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Scherer\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Scherer\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-21-326891830-3036340036-2452681849-1003\...com [@ = ComFile] -- Reg Error: Key error. File not found
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.01.21 14:50:23 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Scherer\Desktop\OTL.exe
[2013.01.21 10:12:21 | 000,000,000 | ---D | C] -- C:\Users\Scherer\AppData\Local\Apps
[2013.01.21 10:09:57 | 000,000,000 | ---D | C] -- C:\Users\Scherer\AppData\Roaming\Sony Corporation
[2013.01.19 11:13:12 | 000,000,000 | ---D | C] -- C:\ProgramData\HP
[2013.01.19 11:13:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Hewlett-Packard
[2013.01.19 11:11:35 | 000,167,480 | ---- | C] (Hewlett-Packard) -- C:\Windows\System32\hppccompio.dll
[2013.01.19 11:11:34 | 000,151,040 | ---- | C] (Hewlett-Packard) -- C:\Windows\System32\hpmpm081.dll
[2013.01.19 11:11:34 | 000,128,512 | ---- | C] (Hewlett-Packard) -- C:\Windows\System32\hpmtp130.dll
[2013.01.19 11:11:34 | 000,056,320 | ---- | C] (Hewlett-Packard) -- C:\Windows\System32\hpmpw081.dll
[2013.01.19 11:11:33 | 000,189,952 | ---- | C] (Hewlett-Packard) -- C:\Windows\System32\hpmml130.dll
[2013.01.19 11:11:33 | 000,128,000 | ---- | C] (Hewlett-Packard) -- C:\Windows\System32\hpmja130.dll
[2013.01.19 11:11:33 | 000,087,552 | ---- | C] (Hewlett-Packard Company) -- C:\Windows\System32\hpmlm121.dll
[2013.01.19 11:11:33 | 000,049,252 | ---- | C] (Hewlett-Packard) -- C:\Windows\System32\hpmnque.dll
[2013.01.19 11:11:33 | 000,049,250 | ---- | C] (Hewlett-Packard) -- C:\Windows\System32\hpmnndps.dll
[2013.01.19 11:11:28 | 000,299,008 | ---- | C] (Hewlett-Packard Corporation) -- C:\Windows\System32\hpcpn130.dll
[2013.01.19 11:11:28 | 000,097,280 | ---- | C] (Hewlett-Packard) -- C:\Windows\System32\hpcjpm.dll
[2013.01.19 11:11:27 | 000,059,928 | ---- | C] (Hewlett-Packard) -- C:\Windows\System32\fxcompchannel.dll
[2013.01.19 11:10:22 | 000,000,000 | ---D | C] -- C:\HP Universal Print Driver
[2013.01.18 18:46:04 | 002,213,976 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Scherer\Desktop\tdsskiller.exe
[2013.01.17 14:41:16 | 004,732,416 | ---- | C] (AVAST Software) -- C:\Users\Scherer\Desktop\aswMBR.exe
[2013.01.16 20:02:28 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013.01.16 20:02:28 | 000,000,000 | ---D | C] -- C:\Users\Scherer\AppData\Local\temp
[2013.01.16 19:56:16 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.01.16 19:42:04 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.01.16 19:42:04 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.01.16 19:42:04 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.01.16 19:41:43 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.01.16 19:40:55 | 000,000,000 | R--D | C] -- C:\Users\Scherer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2013.01.16 19:40:41 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.01.16 19:34:08 | 005,022,302 | R--- | C] (Swearware) -- C:\Users\Scherer\Desktop\ComboFix.exe
[2013.01.16 16:26:40 | 000,000,000 | ---D | C] -- C:\Users\Scherer\.thumbnails
[2013.01.16 11:11:28 | 000,000,000 | ---D | C] -- C:\Users\Scherer\Desktop\mbar-1.01.0.1016
[2013.01.03 20:16:09 | 000,000,000 | ---D | C] -- C:\Users\Scherer\Documents\Ethnicraft stonecut oak tv board
[2013.01.01 21:41:49 | 000,000,000 | ---D | C] -- C:\Users\Scherer\AppData\Local\Macromedia
[2013.01.01 21:39:47 | 000,697,272 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.12.28 15:30:35 | 019,232,984 | ---- | C] (Mozilla) -- C:\Users\Scherer\Desktop\Firefox_Setup_17.0.1.exe
[2012.12.27 02:02:25 | 000,213,640 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfehidk.sys
[2012.12.27 02:02:25 | 000,130,424 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\Mpfp.sys
[2012.12.27 02:02:25 | 000,079,304 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfeavfk.sys
[2012.12.27 02:02:25 | 000,040,552 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfesmfk.sys
[2012.12.27 02:02:25 | 000,035,272 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfebopk.sys
[2012.12.27 02:02:25 | 000,034,216 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mferkdk.sys
[2012.12.27 02:02:24 | 000,054,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmProv.dll
[2012.12.27 02:02:24 | 000,001,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmCl.dll
[2012.12.26 23:45:26 | 000,000,000 | ---D | C] -- C:\Users\Scherer\AppData\Roaming\Malwarebytes
[2012.12.26 23:45:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.12.26 23:44:33 | 010,063,000 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Scherer\Desktop\mbam-setup.exe
[2012.12.26 23:09:49 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.12.26 16:46:05 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro
[2012.12.26 09:10:57 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012.12.26 00:12:30 | 001,754,528 | ---- | C] (Bleeping Computer, LLC) -- C:\rkill.com
[2012.07.13 21:09:05 | 076,225,536 | ---- | C] (The GIMP Team                                              ) -- C:\Users\Scherer\gimp-2.8.0-setup.exe
[2011.07.28 23:39:35 | 013,746,936 | ---- | C] (DsNET Corp) -- C:\Users\Scherer\aTube24636_Catcher.exe
[2011.01.23 22:28:23 | 008,417,616 | ---- | C] (Mozilla) -- C:\Users\Scherer\Firefox Setup 3.6.13.exe
[2010.12.08 13:50:25 | 000,876,824 | ---- | C] (DivX, Inc. ) -- C:\Users\Scherer\DivXInstaller.exe
[2010.11.21 20:21:46 | 008,402,944 | ---- | C] (Mozilla) -- C:\Users\Scherer\Firefox Setup 3.6.12.exe
[2010.07.28 21:50:18 | 018,112,808 | ---- | C] (DVDVideoSoft Limited.                                      ) -- C:\Users\Scherer\FreeYouTubeToMp3Converter.exe
[2010.05.14 21:27:17 | 017,227,474 | ---- | C] (DVDVideoSoft Limited.                                      ) -- C:\Users\Scherer\FreeYouTubeToMp3Converter33.exe
[2009.11.11 00:16:40 | 002,665,188 | ---- | C] (Ur I.T. Mate Group                                          ) -- C:\Users\Scherer\idsuite_2.10.1.exe
[2009.11.10 23:39:25 | 002,788,051 | ---- | C] (Ur I.T. Mate Group                                          ) -- C:\Users\Scherer\idsuite_setup.exe
 
========== Files - Modified Within 30 Days ==========
 
[2013.01.21 14:55:00 | 000,000,422 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{8ABE1372-F6EF-4A57-8A93-2F3EBBB833DE}.job
[2013.01.21 14:52:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.01.21 14:50:32 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Scherer\Desktop\OTL.exe
[2013.01.21 13:52:00 | 000,685,712 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.01.21 13:52:00 | 000,642,704 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.01.21 13:52:00 | 000,149,980 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.01.21 13:52:00 | 000,121,592 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.01.21 13:50:22 | 000,574,677 | ---- | M] () -- C:\Users\Scherer\Desktop\adwcleaner.exe
[2013.01.21 12:59:37 | 000,030,247 | ---- | M] () -- C:\Users\Scherer\.recently-used.xbel
[2013.01.21 09:56:34 | 000,004,784 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.01.21 09:56:34 | 000,004,784 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.01.21 09:56:18 | 3184,119,808 | -HS- | M] () -- C:\hiberfil.sys
[2013.01.20 22:08:14 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2013.01.19 11:12:40 | 000,000,000 | ---- | M] () -- C:\Windows\HPMProp.INI
[2013.01.19 11:08:28 | 016,717,728 | ---- | M] () -- C:\Users\Scherer\Desktop\upd-pcl5-x32-5.5.0.12834.exe
[2013.01.18 18:46:06 | 002,213,976 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Scherer\Desktop\tdsskiller.exe
[2013.01.17 23:58:15 | 000,019,968 | ---- | M] () -- C:\Users\Scherer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.01.17 23:41:50 | 000,000,512 | ---- | M] () -- C:\Users\Scherer\Desktop\MBR.dat
[2013.01.17 18:45:27 | 459,906,582 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013.01.17 14:41:16 | 004,732,416 | ---- | M] (AVAST Software) -- C:\Users\Scherer\Desktop\aswMBR.exe
[2013.01.17 14:39:10 | 000,365,568 | ---- | M] () -- C:\Users\Scherer\Desktop\gmer-2.0.18444.exe
[2013.01.16 19:54:21 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2013.01.16 19:35:42 | 005,022,302 | R--- | M] (Swearware) -- C:\Users\Scherer\Desktop\ComboFix.exe
[2013.01.16 11:09:13 | 013,462,931 | ---- | M] () -- C:\Users\Scherer\Desktop\mbar-1.01.0.1016.zip
[2013.01.14 22:26:42 | 000,372,096 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.01.05 21:12:35 | 000,052,240 | ---- | M] () -- C:\Users\Scherer\Documents\Fotowelt-Datei 2011.mcf
[2013.01.05 21:12:02 | 000,052,240 | ---- | M] () -- C:\Users\Scherer\Documents\Fotowelt-Datei 2011.mcf~
[2013.01.01 21:59:38 | 000,004,121 | ---- | M] () -- C:\Users\Scherer\Documents\musik.rtf
[2013.01.01 21:39:47 | 000,697,272 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.01.01 21:39:47 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.01.01 14:53:00 | 000,000,607 | ---- | M] () -- C:\Users\Scherer\.ufrawrc
[2012.12.28 15:32:36 | 019,232,984 | ---- | M] (Mozilla) -- C:\Users\Scherer\Desktop\Firefox_Setup_17.0.1.exe
[2012.12.26 17:31:44 | 000,550,017 | ---- | M] () -- C:\adwcleaner.exe
[2012.12.26 16:46:49 | 000,030,616 | ---- | M] () -- C:\Windows\System32\drivers\hitmanpro37.sys
[2012.12.26 11:01:38 | 010,063,000 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Scherer\Desktop\mbam-setup.exe
[2012.12.26 00:07:48 | 001,754,528 | ---- | M] (Bleeping Computer, LLC) -- C:\rkill.com
 
========== Files Created - No Company Name ==========
 
[2013.01.21 12:59:37 | 000,030,247 | ---- | C] () -- C:\Users\Scherer\.recently-used.xbel
[2013.01.19 11:12:40 | 000,000,000 | ---- | C] () -- C:\Windows\HPMProp.INI
[2013.01.19 11:06:47 | 016,717,728 | ---- | C] () -- C:\Users\Scherer\Desktop\upd-pcl5-x32-5.5.0.12834.exe
[2013.01.17 23:41:50 | 000,000,512 | ---- | C] () -- C:\Users\Scherer\Desktop\MBR.dat
[2013.01.17 14:39:10 | 000,365,568 | ---- | C] () -- C:\Users\Scherer\Desktop\gmer-2.0.18444.exe
[2013.01.16 21:58:12 | 000,574,677 | ---- | C] () -- C:\Users\Scherer\Desktop\adwcleaner.exe
[2013.01.16 19:42:04 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.01.16 19:42:04 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.01.16 19:42:04 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.01.16 19:42:04 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.01.16 19:42:04 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.01.16 11:08:58 | 013,462,931 | ---- | C] () -- C:\Users\Scherer\Desktop\mbar-1.01.0.1016.zip
[2013.01.16 09:11:20 | 3184,119,808 | -HS- | C] () -- C:\hiberfil.sys
[2013.01.05 20:44:47 | 000,052,240 | ---- | C] () -- C:\Users\Scherer\Documents\Fotowelt-Datei 2011.mcf~
[2013.01.05 20:44:47 | 000,052,240 | ---- | C] () -- C:\Users\Scherer\Documents\Fotowelt-Datei 2011.mcf
[2012.12.27 02:02:25 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01007_Inbox_Critical.Wdf
[2012.12.27 00:14:22 | 000,550,017 | ---- | C] () -- C:\adwcleaner.exe
[2012.12.26 16:46:49 | 000,030,616 | ---- | C] () -- C:\Windows\System32\drivers\hitmanpro37.sys
[2012.12.26 09:10:38 | 459,906,582 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.11.20 22:26:30 | 000,000,607 | ---- | C] () -- C:\Users\Scherer\.ufrawrc
[2012.10.12 23:20:16 | 000,000,536 | ---- | C] () -- C:\Users\Scherer\AppData\Roaming\.gmic_sources.cimgz
[2012.07.15 09:47:56 | 001,562,480 | ---- | C] () -- C:\Users\Scherer\setup_Mein_CEWE_FOTOBUCH.exe
[2012.07.14 09:38:10 | 000,308,302 | ---- | C] () -- C:\Users\Scherer\2075659789.pdf
[2012.07.13 21:29:46 | 000,000,642 | ---- | C] () -- C:\Users\Scherer\PSPI für GIMP - 8BF Plugins.rtf
[2012.07.13 21:24:59 | 000,020,009 | ---- | C] () -- C:\Users\Scherer\gimp-pspi-1.0.7.win32.zip
[2012.07.13 21:10:14 | 002,032,774 | ---- | C] (                                                            ) -- C:\Users\Scherer\gmic_gimp_win32.exe
[2012.05.12 14:31:53 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Examples
[2012.05.12 14:31:53 | 000,000,268 | RH-- | C] () -- C:\Users\Scherer\AppData\Roaming\Enhance Timing
[2012.05.12 14:31:52 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Error Handlers
[2012.05.12 14:31:52 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Equalizer
[2012.05.12 14:31:52 | 000,000,268 | RH-- | C] () -- C:\Users\Scherer\AppData\Roaming\Electric Piano
[2012.05.12 14:31:52 | 000,000,268 | RH-- | C] () -- C:\Users\Scherer\AppData\Roaming\Electric Clav
[2012.02.25 10:52:10 | 000,000,680 | ---- | C] () -- C:\Users\Scherer\AppData\Local\d3d9caps.dat
[2012.02.17 22:20:19 | 000,019,968 | ---- | C] () -- C:\Users\Scherer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.10.14 08:42:30 | 000,000,294 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2011.07.12 21:19:13 | 000,000,454 | ---- | C] () -- C:\Users\Scherer\AppData\Roaming\.gmic_faves
[2011.05.31 19:15:34 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2011.03.27 18:39:21 | 000,000,103 | ---- | C] () -- C:\Windows\wiso.ini
[2011.01.30 13:18:36 | 059,398,824 | ---- | C] () -- C:\Users\Scherer\avira_antivir_personal_de609.exe
[2011.01.13 10:21:56 | 002,649,191 | ---- | C] () -- C:\Users\Scherer\Lindner_Hotel_&_Sporting_Club_Wiesensee[1].pdf
[2010.12.12 21:04:37 | 000,000,000 | ---- | C] () -- C:\Users\Scherer\Fotobuch 2010.mcf
[2010.12.09 09:48:32 | 000,577,612 | ---- | C] () -- C:\Users\Scherer\Setup printkey2000.exe
[2010.12.08 20:41:10 | 001,561,824 | ---- | C] () -- C:\Users\Scherer\setup_dm_Fotowelt.exe
[2010.10.19 20:30:45 | 000,894,032 | ---- | C] () -- C:\Users\Scherer\vshare-plugin.exe
[2010.09.29 19:17:26 | 006,115,840 | ---- | C] () -- C:\Users\Scherer\konf_Eumex_400_v10301.exe
[2010.05.13 16:31:04 | 010,814,464 | ---- | C] () -- C:\Users\Scherer\CDex-win32-1.70-b4-2009.exe
[2010.03.28 13:49:51 | 167,555,440 | ---- | C] () -- C:\Users\Scherer\OOo_3.2.0_Win32Intel_install_wJRE_de.exe
[2010.02.27 01:18:00 | 004,998,707 | ---- | C] () -- C:\Users\Scherer\flvplayer_setup20_25.exe
[2010.02.20 10:43:40 | 000,013,628 | ---- | C] () -- C:\Users\Scherer\Ablesung Gas 10_02_20 _X4736612812_20_02_2010[1].pdf
[2009.11.13 20:01:25 | 014,994,368 | ---- | C] () -- C:\Users\Scherer\Setup_Railroad_Tycoon.exe
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2011.01.21 16:46:32 | 011,582,464 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2008.01.21 03:24:24 | 000,614,400 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008.01.21 03:24:03 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.02.11 20:26:57 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\Buhl Data Service
[2011.08.07 10:39:44 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\DVDVideoSoft
[2011.08.07 10:39:31 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.11.21 14:31:53 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\Eumex 400
[2012.05.14 21:00:27 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\FreeFileSync
[2013.01.21 12:59:37 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\gtk-2.0
[2011.10.14 08:45:14 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\Imusol
[2012.08.17 18:03:20 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\IrfanView
[2011.06.19 16:04:54 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\Mirillis
[2012.02.29 22:07:33 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\NeatImage SL 32
[2012.08.30 19:55:41 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\Nikon
[2012.02.02 23:21:44 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\Nuvi
[2011.07.22 07:23:30 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\PC Suite
[2012.10.21 14:04:14 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\Picturenaut
[2011.12.28 15:35:02 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\RavensburgerTipToi
[2012.03.15 23:43:41 | 000,000,000 | ---D | M] -- C:\Users\Scherer\AppData\Roaming\TeamViewer
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\Scherer\Documents\CIMG0191.AVI:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Scherer\Documents\CIMG0190.AVI:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Scherer\Documents\CIMG0156.AVI:TOC.WMV

< End of report >
--- --- ---

[/CODE]



Extras.txt
OTL Logfile:
Code:
OTL Extras logfile created on: 21.01.2013 14:53:58 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Scherer\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,96 Gb Total Physical Memory | 2,01 Gb Available Physical Memory | 67,87% Memory free
6,16 Gb Paging File | 5,15 Gb Available in Paging File | 83,69% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 226,76 Gb Total Space | 98,07 Gb Free Space | 43,25% Space Free | Partition Type: NTFS
Drive D: | 226,00 Gb Total Space | 225,91 Gb Free Space | 99,96% Space Free | Partition Type: NTFS
Drive F: | 298,09 Gb Total Space | 107,58 Gb Free Space | 36,09% Space Free | Partition Type: NTFS
 
Computer Name: SCHERER-PC | User Name: Scherer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_USERS\S-1-5-21-326891830-3036340036-2452681849-1003\SOFTWARE\Classes\<extension>]
.bat [@ = batfile] -- Reg Error: Key error. File not found
.cmd [@ = cmdfile] -- Reg Error: Key error. File not found
.com [@ = ComFile] -- Reg Error: Key error. File not found
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.pif [@ = piffile] -- Reg Error: Key error. File not found
.vbs [@ = VBSFile] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [CEWE FOTOSCHAU] -- "C:\Program Files\dm\dm-Fotowelt\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [dm-Fotowelt] -- "C:\Program Files\dm\dm-Fotowelt\dm-Fotowelt.exe" "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2BE5DDE6-3222-4B3E-A4DA-190A2B2F5F37}" = rport=137 | protocol=17 | dir=out | app=system |
"{38D7F6D3-2F0C-4506-AE75-BD6896EEC83E}" = rport=445 | protocol=6 | dir=out | app=system |
"{50204B2F-829B-4B87-85D4-F6B929E93A5A}" = rport=138 | protocol=17 | dir=out | app=system |
"{563F8A80-33DF-4780-80D3-4B3480EFC789}" = rport=139 | protocol=6 | dir=out | app=system |
"{5CE5C468-9641-44D5-804A-040A4B76BD9C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{626EEAB6-CD02-4048-8DD1-E6ED902B0E73}" = lport=139 | protocol=6 | dir=in | app=system |
"{6E79A02B-EC88-417B-966D-EC0933A3CC93}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{81780412-7DC7-4E6A-9EE1-21BA93666696}" = lport=445 | protocol=6 | dir=in | app=system |
"{97DEF3C7-7D38-475A-8120-AD15D9090E00}" = lport=138 | protocol=17 | dir=in | app=system |
"{ACBDDD68-2BDD-4188-BADF-A346EEC7F01C}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{E844359D-952C-4E27-8EB3-1896CE835E37}" = lport=137 | protocol=17 | dir=in | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{10CC88AB-E478-4025-A4E8-982212F18133}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{65BDDA06-C361-4C73-8A2C-9E3CD8F821AB}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{7154374E-4021-40E4-BD4C-FDD63BAE8888}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{B8C49885-5C0C-4AE6-9F5B-FB88078BEA24}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"TCP Query User{1C5A675B-CE31-4201-B04A-911EAC4872C2}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{77C54B07-D724-4EAC-AF09-42CA9F5B6FBC}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{97726128-11B1-40B5-8B86-165E22C5F5DE}C:\program files\dsnet corp\atube catcher 2.0\yct.exe" = protocol=6 | dir=in | app=c:\program files\dsnet corp\atube catcher 2.0\yct.exe |
"TCP Query User{DE2BCA9A-63FE-4824-9E79-4188F217F676}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"UDP Query User{2D825876-29F3-4F80-B8D8-FF294E200C11}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"UDP Query User{3648519B-85B8-4050-B844-B5DA36A5CAE2}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{9C4B6FEE-7780-4DFE-A1AD-C03F5E6A1AFA}C:\program files\dsnet corp\atube catcher 2.0\yct.exe" = protocol=17 | dir=in | app=c:\program files\dsnet corp\atube catcher 2.0\yct.exe |
"UDP Query User{D3CD5FFA-CA84-4034-983F-811FC09B645E}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{027CC103-7CBD-3091-BD05-61C3B39C5F41}" = CCC Help French
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{04983D37-2202-4295-94A2-8B547C66133F}" = Atheros WLAN Client
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05C866EC-C6E6-B63B-5E93-310048EA28F4}" = ccc-utility
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{0CC1DAFB-40C8-4903-953D-471E541477C7}" = WISO Steuer-Sparbuch 2012
"{13C3016D-EDE0-A37F-1F01-DAFB618DA715}" = CCC Help Greek
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution III
"{16119AAC-9FE5-8BDC-6DEF-F52576AF1649}" = CCC Help Czech
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{1B6C72A0-6F6F-441B-AD46-1F4B7F337496}" = FotoToGo Home G3
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20226F96-074F-CA03-3FDB-48EA38F99A34}" = CCC Help English
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2D99A593-C841-43A7-B7C9-D6F3AE70B756}" = Nokia Connectivity Cable Driver
"{2F0B0B99-2AF4-0A85-4E37-F45C48CC0B21}" = CCC Help Swedish
"{312E49B1-3621-C991-7A6F-E3B30CCA9E6B}" = CCC Help Turkish
"{31B1789F-00B9-D898-1578-CE4CD0EF205B}" = CCC Help Chinese Standard
"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor
"{3B240B92-3596-9F6F-2D1D-2E031D50F5DC}" = CCC Help Danish
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D599ADA-65D9-4B51-898F-CE718DEC5DBB}" = Microsoft Image Composite Editor
"{47F081A8-64F6-C280-A694-5637817B8904}" = Catalyst Control Center Graphics Light
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{506CEF40-A02C-D047-3F75-0FB34AFCCEE7}" = CCC Help Hungarian
"{52797A98-AB5F-2715-BAB9-256085988154}" = Catalyst Control Center Graphics Previews Vista
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{581FE9BC-4A4F-85D9-7308-09DCD7817C29}" = ccc-core-static
"{58B269E7-5D66-4425-89C8-7EA0FDCD70C2}" = Splash Lite
"{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}" = Sony USB Driver
"{65A5CA1A-16CF-0FE2-2452-ED6D625AD58F}" = Skins
"{68CAE442-579C-4D84-AA5F-253852522ED5}" = PCTroubleshooting
"{6A1F72DD-2465-43A2-A137-8A849399B7A8}" = REALTEK Wireless LAN Software
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Easy Battery Manager
"{7020FC34-6E04-4858-924D-354B28CB2402}_is1" = Luminance HDR 2.3.0
"{70E893FF-56BB-8AF3-64E4-54A49F9F896E}" = Catalyst Control Center Graphics Full Existing
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71A51B59-E7D3-11DB-A386-005056C00008}" = Namuga 1.3M Webcam
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7FE0877D-B669-F5E1-1842-0E9676F03A7A}" = Catalyst Control Center Core Implementation
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 3.0.0
"{836A12E6-3418-593C-DC70-B7E7048C44F2}" = CCC Help Dutch
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86924253-1BCC-4BF5-B995-33C1DB7EECAE}" = 32 Bit HP CIO Components Installer
"{8717416E-107D-4D2F-8F30-11C342A1F9EE}" = Picturenaut 3.2
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{8E106A57-A17E-431D-B48F-175E42EB9F74}" = imagine digital freedom - Samsung
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_PROHYBRIDR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_PROHYBRIDR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{94815A13-F1B8-1384-0F0A-A8E4CE6EA62B}" = CCC Help Thai
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A230C543-7D98-D7CF-91EF-280081A0DDD2}" = CCC Help Japanese
"{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus
"{A6BEDC5B-ABF7-FADF-8D0F-0FF1FEF34C87}" = CCC Help Chinese Traditional
"{A7581D39-EA20-4883-A480-80C21047052B}" = Easy Network Manager
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AA16A9E5-40E9-44F5-801E-6B3D3CFE79E5}" = BatteryLifeExtender
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{AC76BA86-7AD7-5670-0000-900000000003}" = Korean Fonts Support For Adobe Reader 9
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AFB6EECF-0CA4-9C01-C48A-6F0E5BB0FE74}" = Catalyst Control Center Localization All
"{B00EE7D4-8D4C-CE86-D1DF-5B9D026C13F5}" = CCC Help Russian
"{B014EE44-9197-4513-9613-71E6EB1B514E}" = Nikon Message Center 2
"{B6D8DC8C-F077-4631-A221-4D5E1D8E87E7}" = Catalyst Control Center - Branding
"{B8971880-0060-11D8-87CB-C2A1A3E71907}_is1" = Index.dat Suite
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{BD9F153A-E812-B910-EA23-1BFEF07D3352}" = CCC Help Korean
"{BE12D93E-0C6E-7DDD-0838-667326C287A1}" = CCC Help German
"{C0E2DFB6-3D76-8BAD-62DF-47871AF6A5A4}" = CCC Help Polish
"{C343B6AD-A23C-8138-35CE-883DE2DEAFE7}" = CCC Help Finnish
"{C373F7C4-05D2-4047-96D1-6AF30661C6AA}" = PC Connectivity Solution
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240B7}" = WinZip 12.0
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1E7142C-6BC3-49EB-A71A-E5D7ADAC7599}" = Nikon File Uploader 2
"{D2777D85-7E63-402F-A5E7-2AF436C1C9D4}" = Intel(R) PROSet/Wireless WiFi-Software
"{D5068583-D569-468B-9755-5FBF5848F46F}" = Sony Picture Utility
"{DDD62492-32A7-412B-8AF1-2CF032AD42E3}" = ViewNX 2
"{DDF998C0-099C-5D46-9985-5730306330A9}" = CCC Help Spanish
"{DEB8C753-9CB6-1BD1-34BA-4ED9382755E9}" = ATI Catalyst Install Manager
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{ED97F2D3-7BCF-E0B4-E8C6-0F6BA058CA95}" = CCC Help Portuguese
"{EEFB5B34-DEF9-0BF4-89A9-AB62320AA44E}" = Catalyst Control Center Graphics Full New
"{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client
"{F5115AA1-78F1-EBBC-4888-A10310FD4A6A}" = CCC Help Italian
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FD458F33-C5A9-3E69-425C-129F21B3ADF9}" = CCC Help Norwegian
"{FDE96E86-7780-431C-92F7-679C6A7CEC51}" = Microsoft SQL Server VSS Writer
"{FEC19789-7756-17C3-765B-C532E09322D7}" = Catalyst Control Center InstallProxy
"7-Zip" = 7-Zip 4.65
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira Free Antivirus
"Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2
"CDex" = CDex - Open Source Digital Audio CD Extractor
"dm-Fotowelt" = dm-Fotowelt
"ExposurePlot_is1" = ExposurePlot 1.13
"FLV Player" = FLV Player 2.0 (build 25)
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.8
"Free YouTube Download 3_is1" = Free YouTube Download 3 version 3.0.11.727
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.38.517
"FreeFileSync" = FreeFileSync v5.3
"G'MIC for GIMP_is1" = G'MIC for GIMP Version 1.5.0.0
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus
"IrfanView" = IrfanView (remove only)
"Marvell Miniport Driver" = Marvell Miniport Driver
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox 17.0.1 (x86 de)" = Mozilla Firefox 17.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Photo And Book" = Photo And Book
"PhotoME Beta-Release_is1" = PhotoME Beta-Release
"PrintKey2000" = PrintKey2000
"PROHYBRIDR" = 2007 Microsoft Office system
"ProInst" = Intel PROSet Wireless
"Ravensburger tiptoi" = Ravensburger tiptoi
"Recuva" = Recuva
"Sid Meier's Railroad Tycoon" = Sid Meier's Railroad Tycoon
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"UFRaw_is1" = UFRaw 0.18
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.9
"WinGimp-2.0_is1" = GIMP 2.6.11
"YTdetect" = Yahoo! Detect
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 18.01.2013 19:15:06 | Computer Name = Scherer-PC | Source = EventSystem | ID = 4621
Description =
 
Error - 18.01.2013 19:24:46 | Computer Name = Scherer-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 18.01.2013 20:47:23 | Computer Name = Scherer-PC | Source = EventSystem | ID = 4621
Description =
 
Error - 19.01.2013 05:50:29 | Computer Name = Scherer-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 19.01.2013 06:24:57 | Computer Name = Scherer-PC | Source = EventSystem | ID = 4621
Description =
 
Error - 19.01.2013 06:27:27 | Computer Name = Scherer-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 19.01.2013 20:22:07 | Computer Name = Scherer-PC | Source = EventSystem | ID = 4621
Description =
 
Error - 20.01.2013 05:16:31 | Computer Name = Scherer-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 20.01.2013 16:24:45 | Computer Name = Scherer-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 21.01.2013 04:58:08 | Computer Name = Scherer-PC | Source = WinMgmt | ID = 10
Description =
 
[ System Events ]
Error - 11.04.2011 15:50:03 | Computer Name = Scherer-PC | Source = HTTP | ID = 15016
Description =
 
Error - 11.04.2011 15:51:36 | Computer Name = Scherer-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
Error - 11.04.2011 15:51:42 | Computer Name = Scherer-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 12.04.2011 01:33:28 | Computer Name = Scherer-PC | Source = HTTP | ID = 15016
Description =
 
Error - 12.04.2011 01:34:31 | Computer Name = Scherer-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
Error - 12.04.2011 01:35:05 | Computer Name = Scherer-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 12.04.2011 04:35:01 | Computer Name = Scherer-PC | Source = HTTP | ID = 15016
Description =
 
Error - 12.04.2011 04:35:54 | Computer Name = Scherer-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
Error - 12.04.2011 04:36:37 | Computer Name = Scherer-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 12.04.2011 10:53:57 | Computer Name = Scherer-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 12.04.2011 um 12:21:47 unerwartet heruntergefahren.
 
 
< End of report >
--- --- ---

[/CODE]

cosinus 21.01.2013 15:36
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes - denk bitte vorher daran, Malwarebytes über den Updatebutton zu aktualisieren

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


as9361 22.01.2013 16:39
Hallo,

hier das mwb-File. ESET kann ich aktuell nicht durchführen weil mein DSL Zugang streikt. Hole ich nach wenn es wieder funktioniert.

Code:
Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2012.12.14.11

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
Scherer :: SCHERER-PC [Administrator]

21.01.2013 15:47:33
mbam-log-2013-01-21 (15-47-33).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 201132
Laufzeit: 4 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
So, geschafft!

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6889
# api_version=3.0.2
# EOSSerial=e12bfc3feec67246a0e02009d52ddbb7
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-01-22 09:53:09
# local_time=2013-01-22 10:53:09 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=1799 16775165 100 100 190309 104658474 183075 0
# compatibility_mode=5892 16776573 100 100 8415 196424318 0 0
# scanned=173779
# found=0
# cleaned=0
# scan_time=7881

cosinus 23.01.2013 00:21
Sieht soweit ok aus

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

as9361 23.01.2013 11:19
Hallo Cosinus,

ja, es ist wieder in Ordnung. Vielen vielen Dank dafür. :daumenhoc

Ein Problemchen gibt es noch.

Beim Systemstart werden ja allerlei Programme automatisch geladen.
Die sehe ich unten rechts in der Leiste.
Einige davon sind sehr nervig (z.B. Java Upate Scheduler, Samsung Update Plus...)

Wie kann ich den automatischen Start der Programme verhindern?

Reicht es aus über über msconfig -> SYSTEMKONFIGURATION -> Systemstart, die entsprechenden Häckchen ab zu wählen?


In
HKEY_LOCAL_MACHINE\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWARE

und in

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN

finde ich ebenfalls entsprechende Einträge. Da trau ich mich allerdings nicht ran.


Grüße
Andreas

cosinus 23.01.2013 15:48
Zitat:
Reicht es aus über über msconfig -> SYSTEMKONFIGURATION -> Systemstart, die entsprechenden Häckchen ab zu wählen?
Ja das reicht. Die Updatescheduler aber rauszukicken kann u.U. nicht so clever sein!
Nicht dass du ein Update für Java verpasst!

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter.

Combofix entfernen: Start/Ausführen (Tastenkombination WIN+R), dort den Befehl combofix /uninstall eintippen und ausführen

Mit Hilfe von OTL kannst du auch viele andere Tools entfernen: Starte dazu einfach OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate
Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.
Windows Vista/7: Start, Systemsteuerung, Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks findest du hier => Browsers and Plugins - FilePony.de

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

as9361 24.01.2013 21:27
Super, noch mal herzlichen Dank, auch für die guten Tipps.

Räume jetzt meinen Desktop auf. Der ist ziemlich voll.

Grüße
Andreas


Alle Zeitangaben in WEZ +1. Es ist jetzt 12:05 Uhr.

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130